rwsdk 1.0.5 → 1.0.7

package/dist/runtime/entries/types/shared.d.ts

@@ -4,4 +4,5 @@ interface ImportMeta {
 interface ImportMetaEnv {
     readonly DEV: boolean;
     readonly VITE_IS_DEV_SERVER: string;
+    readonly BASE_URL: string;
 }

package/dist/runtime/register/methodEnforcer.d.ts

@@ -0,0 +1,8 @@
+type GetServerModuleExport = (actionId: string) => Promise<unknown>;
+type DecodeReply = (data: string | FormData, moduleMap: null) => Promise<unknown>;
+export interface RscActionHandlerDeps {
+    getServerModuleExport: GetServerModuleExport;
+    decodeReply: DecodeReply;
+}
+export declare function rscActionHandler(req: Request, { getServerModuleExport, decodeReply }: RscActionHandlerDeps): Promise<unknown>;
+export {};

package/dist/runtime/register/methodEnforcer.js

@@ -0,0 +1,41 @@
+// context(justinvdm, 2026-04-06): Extracted from rscActionHandler() for testability.
+// The real getServerModuleExport and decodeReply require the react-server environment
+// (virtual module lookup, react-server-dom-webpack), so we accept them as injected
+// dependencies. worker.ts passes the real implementations; tests pass fakes.
+export async function rscActionHandler(req, { getServerModuleExport, decodeReply }) {
+    const url = new URL(req.url);
+    const contentType = req.headers.get("content-type");
+    let args = [];
+    if (req.method === "GET") {
+        const argsParam = url.searchParams.get("args");
+        if (argsParam) {
+            args = JSON.parse(argsParam);
+        }
+    }
+    else {
+        const data = contentType?.startsWith("multipart/form-data")
+            ? await req.formData()
+            : await req.text();
+        args = (await decodeReply(data, null));
+    }
+    const actionId = url.searchParams.get("__rsc_action_id");
+    if (import.meta.env.VITE_IS_DEV_SERVER && actionId === "__rsc_hot_update") {
+        return null;
+    }
+    const action = await getServerModuleExport(actionId);
+    if (typeof action !== "function") {
+        throw new Error(`Action ${actionId} is not a function`);
+    }
+    // context(justinvdm, 2026-04-06): Validate the declared HTTP method before
+    // invocation. serverAction() attaches .method = "POST" at creation time via
+    // createServerFunction(), serverQuery() attaches "GET". Functions without
+    // .method default to POST to match serverAction() semantics.
+    const actionMethod = action.method ?? "POST";
+    if (actionMethod !== req.method) {
+        return new Response(`Method ${req.method} is not allowed for this action. Allowed: ${actionMethod}.`, {
+            status: 405,
+            headers: { Allow: actionMethod },
+        });
+    }
+    return action(...args);
+}

package/dist/runtime/register/methodEnforcer.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/runtime/register/methodEnforcer.test.js

@@ -0,0 +1,128 @@
+import { describe, expect, it, vi } from "vitest";
+import { rscActionHandler } from "./methodEnforcer";
+function createDeps(action) {
+    return {
+        getServerModuleExport: vi.fn().mockResolvedValue(action),
+        decodeReply: vi.fn().mockResolvedValue([]),
+    };
+}
+function makeRequest(url, method, body) {
+    const init = { method };
+    if (body !== undefined) {
+        init.body = body;
+        init.headers = { "content-type": "application/json" };
+    }
+    return new Request(url, init);
+}
+const ACTION_URL = "https://app.test/page?__rsc_action_id=%2Factions.tsx%23doThing";
+describe("rscActionHandler method enforcement", () => {
+    it("rejects GET for an action with method POST", async () => {
+        const action = Object.assign(vi.fn(), { method: "POST" });
+        const deps = createDeps(action);
+        const req = makeRequest(ACTION_URL, "GET");
+        const result = await rscActionHandler(req, deps);
+        expect(result).toBeInstanceOf(Response);
+        const res = result;
+        expect(res.status).toBe(405);
+        expect(res.headers.get("Allow")).toBe("POST");
+        expect(action).not.toHaveBeenCalled();
+    });
+    it("rejects POST for an action with method GET", async () => {
+        const action = Object.assign(vi.fn(), { method: "GET" });
+        const deps = createDeps(action);
+        const req = makeRequest(ACTION_URL, "POST", "[]");
+        const result = await rscActionHandler(req, deps);
+        expect(result).toBeInstanceOf(Response);
+        const res = result;
+        expect(res.status).toBe(405);
+        expect(res.headers.get("Allow")).toBe("GET");
+        expect(action).not.toHaveBeenCalled();
+    });
+    it("allows POST for an action with method POST", async () => {
+        const action = Object.assign(vi.fn().mockReturnValue("ok"), {
+            method: "POST",
+        });
+        const deps = createDeps(action);
+        const req = makeRequest(ACTION_URL, "POST", "[]");
+        const result = await rscActionHandler(req, deps);
+        expect(result).toBe("ok");
+        expect(action).toHaveBeenCalled();
+    });
+    it("allows GET for an action with method GET", async () => {
+        const action = Object.assign(vi.fn().mockReturnValue("data"), {
+            method: "GET",
+        });
+        const deps = createDeps(action);
+        const req = makeRequest(ACTION_URL + "&args=%5B%5D", "GET");
+        const result = await rscActionHandler(req, deps);
+        expect(result).toBe("data");
+        expect(action).toHaveBeenCalled();
+    });
+    it("defaults to POST for actions without .method property", async () => {
+        const action = vi.fn().mockReturnValue("ok");
+        const deps = createDeps(action);
+        const postReq = makeRequest(ACTION_URL, "POST", "[]");
+        const postResult = await rscActionHandler(postReq, deps);
+        expect(postResult).toBe("ok");
+        expect(action).toHaveBeenCalled();
+    });
+    it("rejects GET for actions without .method property", async () => {
+        const action = vi.fn();
+        const deps = createDeps(action);
+        const getReq = makeRequest(ACTION_URL, "GET");
+        const getResult = await rscActionHandler(getReq, deps);
+        expect(getResult).toBeInstanceOf(Response);
+        expect(getResult.status).toBe(405);
+        expect(action).not.toHaveBeenCalled();
+    });
+    it("includes allowed methods in 405 response body", async () => {
+        const action = Object.assign(vi.fn(), { method: "POST" });
+        const deps = createDeps(action);
+        const req = makeRequest(ACTION_URL, "GET");
+        const result = (await rscActionHandler(req, deps));
+        const body = await result.text();
+        expect(body).toContain("Method GET is not allowed");
+        expect(body).toContain("Allowed: POST");
+    });
+    it("rejects when .method is not a valid string", async () => {
+        const action = Object.assign(vi.fn(), {
+            method: 42,
+        });
+        const deps = createDeps(action);
+        const req = makeRequest(ACTION_URL, "GET");
+        const result = await rscActionHandler(req, deps);
+        expect(result).toBeInstanceOf(Response);
+        expect(result.status).toBe(405);
+        expect(action).not.toHaveBeenCalled();
+    });
+    it("throws when action is not a function", async () => {
+        const deps = {
+            getServerModuleExport: vi.fn().mockResolvedValue("not-a-function"),
+            decodeReply: vi.fn(),
+        };
+        const req = makeRequest(ACTION_URL, "GET");
+        await expect(rscActionHandler(req, deps)).rejects.toThrow("is not a function");
+    });
+    it("parses GET args from query string", async () => {
+        const action = Object.assign(vi.fn().mockReturnValue("result"), {
+            method: "GET",
+        });
+        const deps = createDeps(action);
+        const req = makeRequest(ACTION_URL + '&args=%5B%22hello%22%2C%2042%5D', "GET");
+        await rscActionHandler(req, deps);
+        expect(action).toHaveBeenCalledWith("hello", 42);
+    });
+    it("uses decodeReply for POST body", async () => {
+        const action = Object.assign(vi.fn().mockReturnValue("result"), {
+            method: "POST",
+        });
+        const deps = {
+            getServerModuleExport: vi.fn().mockResolvedValue(action),
+            decodeReply: vi.fn().mockResolvedValue(["decoded-arg"]),
+        };
+        const req = makeRequest(ACTION_URL, "POST", "serialized-body");
+        await rscActionHandler(req, deps);
+        expect(deps.decodeReply).toHaveBeenCalledWith("serialized-body", null);
+        expect(action).toHaveBeenCalledWith("decoded-arg");
+    });
+});

package/dist/runtime/register/worker.js

@@ -2,6 +2,7 @@ import { isValidElementType } from "react-is";
 import { registerClientReference as baseRegisterClientReference, registerServerReference as baseRegisterServerReference, decodeReply, } from "react-server-dom-webpack/server.edge";
 import { getServerModuleExport } from "../imports/worker.js";
 import { requestInfo } from "../requestInfo/worker.js";
+import { rscActionHandler as rscActionHandlerImpl } from "./methodEnforcer.js";
 export function registerServerReference(action, id, name) {
     if (typeof action !== "function") {
         return action;
@@ -48,28 +49,5 @@ export async function __smokeTestActionHandler(timestamp) {
     return { status: "ok", timestamp };
 }
 export async function rscActionHandler(req) {
-    const url = new URL(req.url);
-    const contentType = req.headers.get("content-type");
-    let args = [];
-    if (req.method === "GET") {
-        const argsParam = url.searchParams.get("args");
-        if (argsParam) {
-            args = JSON.parse(argsParam);
-        }
-    }
-    else {
-        const data = contentType?.startsWith("multipart/form-data")
-            ? await req.formData()
-            : await req.text();
-        args = (await decodeReply(data, null));
-    }
-    const actionId = url.searchParams.get("__rsc_action_id");
-    if (import.meta.env.VITE_IS_DEV_SERVER && actionId === "__rsc_hot_update") {
-        return null;
-    }
-    const action = await getServerModuleExport(actionId);
-    if (typeof action !== "function") {
-        throw new Error(`Action ${actionId} is not a function`);
-    }
-    return action(...args);
+    return rscActionHandlerImpl(req, { getServerModuleExport, decodeReply });
 }

package/dist/runtime/render/assetPaths.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Ensures asset hrefs from the Vite manifest are absolute paths.
+ *
+ * Vite's manifest stores file paths without a leading slash (e.g. "assets/foo.js").
+ * When used as href attributes, these resolve relative to the current page URL,
+ * breaking on nested routes (e.g. /dashboard/editor resolves "assets/foo.js"
+ * as "/dashboard/assets/foo.js" instead of "/assets/foo.js").
+ *
+ * Prepends import.meta.env.BASE_URL (defaults to "/") to make paths absolute.
+ */
+export declare const toAbsoluteHref: (href: string) => string;

package/dist/runtime/render/assetPaths.js

@@ -0,0 +1,11 @@
+/**
+ * Ensures asset hrefs from the Vite manifest are absolute paths.
+ *
+ * Vite's manifest stores file paths without a leading slash (e.g. "assets/foo.js").
+ * When used as href attributes, these resolve relative to the current page URL,
+ * breaking on nested routes (e.g. /dashboard/editor resolves "assets/foo.js"
+ * as "/dashboard/assets/foo.js" instead of "/assets/foo.js").
+ *
+ * Prepends import.meta.env.BASE_URL (defaults to "/") to make paths absolute.
+ */
+export const toAbsoluteHref = (href) => href.startsWith("/") ? href : import.meta.env.BASE_URL + href;

package/dist/runtime/render/assetPaths.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/runtime/render/assetPaths.test.js

@@ -0,0 +1,23 @@
+import { describe, expect, it, vi, afterEach } from "vitest";
+import { toAbsoluteHref } from "./assetPaths";
+describe("toAbsoluteHref", () => {
+    afterEach(() => {
+        vi.unstubAllEnvs();
+    });
+    it("prepends / to relative paths when BASE_URL is /", () => {
+        vi.stubEnv("BASE_URL", "/");
+        expect(toAbsoluteHref("assets/client-abc123.js")).toBe("/assets/client-abc123.js");
+    });
+    it("prepends custom base to relative paths", () => {
+        vi.stubEnv("BASE_URL", "/app/");
+        expect(toAbsoluteHref("assets/client-abc123.js")).toBe("/app/assets/client-abc123.js");
+    });
+    it("does not double-prefix already absolute paths", () => {
+        vi.stubEnv("BASE_URL", "/");
+        expect(toAbsoluteHref("/assets/client-abc123.js")).toBe("/assets/client-abc123.js");
+    });
+    it("handles CSS paths", () => {
+        vi.stubEnv("BASE_URL", "/");
+        expect(toAbsoluteHref("assets/styles-def456.css")).toBe("/assets/styles-def456.css");
+    });
+});

package/dist/runtime/render/preloads.js

@@ -29,13 +29,14 @@ export function findScriptForModule(id, manifest) {
     }
     return find(id);
 }
+import { toAbsoluteHref } from "./assetPaths.js";
 export const Preloads = async ({ requestInfo, }) => {
     const manifest = await getManifest();
     const allScripts = new Set();
     for (const scriptId of requestInfo.rw.scriptsToBeLoaded) {
         const script = findScriptForModule(scriptId, manifest);
         if (script) {
-            allScripts.add(script.file);
+            allScripts.add(toAbsoluteHref(script.file));
         }
     }
     return (_jsx(_Fragment, { children: Array.from(allScripts).map((href) => (_jsx("link", { rel: "modulepreload", href: href }, href))) }));

package/dist/runtime/render/preloads.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/runtime/render/preloads.test.js

@@ -0,0 +1,69 @@
+import { describe, expect, it } from "vitest";
+import { findScriptForModule } from "./preloads";
+describe("findScriptForModule", () => {
+    it("finds a direct entry module", () => {
+        const manifest = {
+            "src/client.tsx": {
+                file: "assets/client-abc123.js",
+                isEntry: true,
+            },
+        };
+        const result = findScriptForModule("/src/client.tsx", manifest);
+        expect(result?.file).toBe("assets/client-abc123.js");
+    });
+    it("finds a dynamic entry module", () => {
+        const manifest = {
+            "src/pages/editor.tsx": {
+                file: "assets/editor-def456.js",
+                isDynamicEntry: true,
+            },
+        };
+        const result = findScriptForModule("/src/pages/editor.tsx", manifest);
+        expect(result?.file).toBe("assets/editor-def456.js");
+    });
+    it("follows imports to find the entry", () => {
+        const manifest = {
+            "src/components/Button.tsx": {
+                file: "assets/button-abc.js",
+                imports: ["src/lib/utils.ts"],
+            },
+            "src/lib/utils.ts": {
+                file: "assets/utils-def.js",
+                isEntry: true,
+            },
+        };
+        const result = findScriptForModule("/src/components/Button.tsx", manifest);
+        expect(result?.file).toBe("assets/utils-def.js");
+    });
+    it("returns undefined for missing modules", () => {
+        const manifest = {};
+        const result = findScriptForModule("/src/missing.tsx", manifest);
+        expect(result).toBeUndefined();
+    });
+    it("handles circular imports without infinite loop", () => {
+        const manifest = {
+            "src/a.ts": {
+                file: "assets/a.js",
+                imports: ["src/b.ts"],
+            },
+            "src/b.ts": {
+                file: "assets/b.js",
+                imports: ["src/a.ts"],
+            },
+        };
+        const result = findScriptForModule("/src/a.ts", manifest);
+        expect(result).toBeUndefined();
+    });
+    it("strips leading slash from id to match manifest keys", () => {
+        const manifest = {
+            "src/client.tsx": {
+                file: "assets/client.js",
+                isEntry: true,
+            },
+        };
+        // Module IDs from scriptsToBeLoaded have leading slashes
+        expect(findScriptForModule("/src/client.tsx", manifest)?.file).toBe("assets/client.js");
+        // Should also work without leading slash
+        expect(findScriptForModule("src/client.tsx", manifest)?.file).toBe("assets/client.js");
+    });
+});

package/dist/runtime/render/stylesheets.js

@@ -27,13 +27,14 @@ const findCssForModule = (scriptId, manifest) => {
     inner(scriptId);
     return Array.from(css);
 };
+import { toAbsoluteHref } from "./assetPaths.js";
 export const Stylesheets = async ({ requestInfo, }) => {
     const manifest = await getManifest();
     const allStylesheets = new Set();
     for (const scriptId of requestInfo.rw.scriptsToBeLoaded) {
         const css = findCssForModule(scriptId, manifest);
         for (const entry of css) {
-            allStylesheets.add(entry);
+            allStylesheets.add(toAbsoluteHref(entry));
         }
     }
     return (_jsx(_Fragment, { children: Array.from(allStylesheets).map((href) => (_jsx("link", { rel: "stylesheet", href: href, precedence: "first" }, href))) }));

package/dist/vite/directivesFilteringPlugin.mjs

@@ -19,7 +19,8 @@ export const directivesFilteringPlugin = ({ clientFiles, serverFiles, projectRoo
                         absolute: true,
                     });
                     const info = this.getModuleInfo(absoluteId);
-                    if (!info?.isIncluded) {
+                    if (!info ||
+                        (typeof info.isIncluded !== "undefined" && !info.isIncluded)) {
                         files.delete(id);
                     }
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rwsdk",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "Build fast, server-driven webapps on Cloudflare with SSR, RSC, and realtime",
   "type": "module",
   "bin": {
@@ -153,8 +153,8 @@
   "author": "RedwoodSDK <peter@redwoodjs.com>",
   "license": "MIT",
   "dependencies": {
-    "@ast-grep/napi": "~0.41.0",
-    "@cloudflare/workers-types": "~4.20260331.1",
+    "@ast-grep/napi": "~0.42.1",
+    "@cloudflare/workers-types": "~4.20260405.1",
     "@mdx-js/mdx": "~3.1.1",
     "@puppeteer/browsers": "~2.13.0",
     "@types/decompress": "~4.2.7",
@@ -167,7 +167,7 @@
     "chokidar": "~5.0.0",
     "debug": "~4.4.3",
     "decompress": "~4.2.1",
-    "enhanced-resolve": "~5.20.0",
+    "enhanced-resolve": "~5.20.1",
     "eventsource-parser": "~3.0.6",
     "execa": "~9.6.1",
     "find-up": "~8.0.0",
@@ -178,7 +178,7 @@
     "jsonc-parser": "~3.3.1",
     "kysely": "~0.28.15",
     "kysely-do": "~0.0.1-rc.1",
-    "lodash": "~4.17.23",
+    "lodash": "~4.18.1",
     "magic-string": "~0.30.21",
     "picocolors": "~1.1.1",
     "proper-lockfile": "~4.1.2",
@@ -203,8 +203,8 @@
   },
   "packageManager": "pnpm@10.31.0",
   "devDependencies": {
-    "@cloudflare/vite-plugin": "1.30.1",
-    "wrangler": "^4.77.0",
+    "@cloudflare/vite-plugin": "1.31.0",
+    "wrangler": "^4.80.0",
     "capnweb": "~0.5.0",
     "@types/debug": "~4.1.13",
     "@types/js-beautify": "~1.14.3",
@@ -215,7 +215,7 @@
     "semver": "~7.7.4",
     "tsx": "~4.21.0",
     "typescript": "~6.0.2",
-    "vite": "~7.3.1",
+    "vite": "~7.3.2",
     "vitest": "~4.1.2"
   }
 }