rwsdk 1.2.2 → 1.2.4-canary.0

package/dist/runtime/register/methodEnforcer.d.ts

@@ -3,6 +3,7 @@ type DecodeReply = (data: string | FormData, moduleMap: null) => Promise<unknown
 export interface RscActionHandlerDeps {
     getServerModuleExport: GetServerModuleExport;
     decodeReply: DecodeReply;
+    allowedOrigins?: readonly string[];
 }
-export declare function rscActionHandler(req: Request, { getServerModuleExport, decodeReply }: RscActionHandlerDeps): Promise<unknown>;
+export declare function rscActionHandler(req: Request, { getServerModuleExport, decodeReply, allowedOrigins }: RscActionHandlerDeps): Promise<unknown>;
 export {};

package/dist/runtime/register/methodEnforcer.js

@@ -2,9 +2,45 @@
 // The real getServerModuleExport and decodeReply require the react-server environment
 // (virtual module lookup, react-server-dom-webpack), so we accept them as injected
 // dependencies. worker.ts passes the real implementations; tests pass fakes.
-export async function rscActionHandler(req, { getServerModuleExport, decodeReply }) {
+// context(justinvdm, 2026-04-20): Origin validation for non-GET action requests.
+// Method enforcement alone does not distinguish a legitimate same-origin POST
+// from a POST driven by a same-site sibling origin (e.g. sibling subdomain,
+// another localhost port). SameSite=Lax cookies are attached in both cases, and
+// the action request's Content-Type is CORS-safelisted, so no preflight fires.
+// We require the request's Origin header to match the app's own origin, unless
+// the caller origin is listed in allowedOrigins.
+function validateSameOrigin(req, allowedOrigins) {
+    const origin = req.headers.get("Origin");
+    if (!origin) {
+        return {
+            valid: false,
+            response: new Response("Missing Origin header", { status: 403 }),
+        };
+    }
+    const selfOrigin = new URL(req.url).origin;
+    if (origin === selfOrigin) {
+        return { valid: true };
+    }
+    if (allowedOrigins && allowedOrigins.includes(origin)) {
+        return { valid: true };
+    }
+    return {
+        valid: false,
+        response: new Response("Origin not allowed", { status: 403 }),
+    };
+}
+export async function rscActionHandler(req, { getServerModuleExport, decodeReply, allowedOrigins }) {
     const url = new URL(req.url);
     const contentType = req.headers.get("content-type");
+    // context(justinvdm, 2026-04-20): Enforce Origin/Host match for non-GET action
+    // requests. GET (serverQuery) is expected to be idempotent and is not subject
+    // to this check.
+    if (req.method !== "GET") {
+        const originCheck = validateSameOrigin(req, allowedOrigins);
+        if (!originCheck.valid) {
+            return originCheck.response;
+        }
+    }
     let args = [];
     if (req.method === "GET") {
         const argsParam = url.searchParams.get("args");

package/dist/runtime/register/methodEnforcer.test.js

@@ -6,15 +6,30 @@ function createDeps(action) {
         decodeReply: vi.fn().mockResolvedValue([]),
     };
 }
-function makeRequest(url, method, body) {
+function makeRequest(url, method, body, extraHeaders) {
     const init = { method };
+    const headers = {};
     if (body !== undefined) {
         init.body = body;
-        init.headers = { "content-type": "application/json" };
+        headers["content-type"] = "application/json";
+    }
+    if (extraHeaders) {
+        Object.assign(headers, extraHeaders);
+    }
+    if (Object.keys(headers).length > 0) {
+        init.headers = headers;
     }
     return new Request(url, init);
 }
 const ACTION_URL = "https://app.test/page?__rsc_action_id=%2Factions.tsx%23doThing";
+const SELF_ORIGIN = "https://app.test";
+function postWithOrigin(origin) {
+    const headers = {};
+    if (origin !== undefined) {
+        headers["Origin"] = origin;
+    }
+    return makeRequest(ACTION_URL, "POST", "[]", headers);
+}
 describe("rscActionHandler method enforcement", () => {
     it("rejects GET for an action with method POST", async () => {
         const action = Object.assign(vi.fn(), { method: "POST" });
@@ -30,7 +45,7 @@ describe("rscActionHandler method enforcement", () => {
     it("rejects POST for an action with method GET", async () => {
         const action = Object.assign(vi.fn(), { method: "GET" });
         const deps = createDeps(action);
-        const req = makeRequest(ACTION_URL, "POST", "[]");
+        const req = makeRequest(ACTION_URL, "POST", "[]", { Origin: SELF_ORIGIN });
         const result = await rscActionHandler(req, deps);
         expect(result).toBeInstanceOf(Response);
         const res = result;
@@ -43,7 +58,7 @@ describe("rscActionHandler method enforcement", () => {
             method: "POST",
         });
         const deps = createDeps(action);
-        const req = makeRequest(ACTION_URL, "POST", "[]");
+        const req = makeRequest(ACTION_URL, "POST", "[]", { Origin: SELF_ORIGIN });
         const result = await rscActionHandler(req, deps);
         expect(result).toBe("ok");
         expect(action).toHaveBeenCalled();
@@ -61,7 +76,9 @@ describe("rscActionHandler method enforcement", () => {
     it("defaults to POST for actions without .method property", async () => {
         const action = vi.fn().mockReturnValue("ok");
         const deps = createDeps(action);
-        const postReq = makeRequest(ACTION_URL, "POST", "[]");
+        const postReq = makeRequest(ACTION_URL, "POST", "[]", {
+            Origin: SELF_ORIGIN,
+        });
         const postResult = await rscActionHandler(postReq, deps);
         expect(postResult).toBe("ok");
         expect(action).toHaveBeenCalled();
@@ -120,9 +137,101 @@ describe("rscActionHandler method enforcement", () => {
             getServerModuleExport: vi.fn().mockResolvedValue(action),
             decodeReply: vi.fn().mockResolvedValue(["decoded-arg"]),
         };
-        const req = makeRequest(ACTION_URL, "POST", "serialized-body");
+        const req = makeRequest(ACTION_URL, "POST", "serialized-body", {
+            Origin: SELF_ORIGIN,
+        });
         await rscActionHandler(req, deps);
         expect(deps.decodeReply).toHaveBeenCalledWith("serialized-body", null);
         expect(action).toHaveBeenCalledWith("decoded-arg");
     });
 });
+describe("rscActionHandler origin enforcement", () => {
+    it("allows POST whose Origin matches the request's own origin", async () => {
+        const action = Object.assign(vi.fn().mockReturnValue("ok"), {
+            method: "POST",
+        });
+        const deps = createDeps(action);
+        const req = postWithOrigin(SELF_ORIGIN);
+        const result = await rscActionHandler(req, deps);
+        expect(result).toBe("ok");
+        expect(action).toHaveBeenCalled();
+    });
+    it("rejects POST from a different origin with 403", async () => {
+        const action = Object.assign(vi.fn(), { method: "POST" });
+        const deps = createDeps(action);
+        const req = postWithOrigin("https://evil.test");
+        const result = await rscActionHandler(req, deps);
+        expect(result).toBeInstanceOf(Response);
+        expect(result.status).toBe(403);
+        expect(action).not.toHaveBeenCalled();
+    });
+    it("rejects POST from a same-site sibling subdomain with 403", async () => {
+        // context(justinvdm, 2026-04-20): The exact scenario in the advisory —
+        // Origin sits under the same registrable domain so SameSite=Lax cookies
+        // are attached, but the Origin header does not match the app's own origin.
+        const action = Object.assign(vi.fn(), { method: "POST" });
+        const deps = createDeps(action);
+        const req = postWithOrigin("https://evil.test.example");
+        const result = await rscActionHandler(req, deps);
+        expect(result).toBeInstanceOf(Response);
+        expect(result.status).toBe(403);
+        expect(action).not.toHaveBeenCalled();
+    });
+    it("rejects POST missing the Origin header with 403", async () => {
+        const action = Object.assign(vi.fn(), { method: "POST" });
+        const deps = createDeps(action);
+        const req = postWithOrigin(undefined);
+        const result = await rscActionHandler(req, deps);
+        expect(result).toBeInstanceOf(Response);
+        expect(result.status).toBe(403);
+        expect(action).not.toHaveBeenCalled();
+    });
+    it("allows POST from an origin in the allowedOrigins list", async () => {
+        const action = Object.assign(vi.fn().mockReturnValue("ok"), {
+            method: "POST",
+        });
+        const deps = {
+            ...createDeps(action),
+            allowedOrigins: ["https://trusted.example"],
+        };
+        const req = postWithOrigin("https://trusted.example");
+        const result = await rscActionHandler(req, deps);
+        expect(result).toBe("ok");
+        expect(action).toHaveBeenCalled();
+    });
+    it("rejects POST from an origin not in the allowedOrigins list", async () => {
+        const action = Object.assign(vi.fn(), { method: "POST" });
+        const deps = {
+            ...createDeps(action),
+            allowedOrigins: ["https://trusted.example"],
+        };
+        const req = postWithOrigin("https://not-trusted.example");
+        const result = await rscActionHandler(req, deps);
+        expect(result).toBeInstanceOf(Response);
+        expect(result.status).toBe(403);
+        expect(action).not.toHaveBeenCalled();
+    });
+    it("does not apply the origin check to GET (serverQuery) requests", async () => {
+        // context(justinvdm, 2026-04-20): GET is expected to be idempotent and is
+        // out of scope for the origin check. A top-level GET navigation from
+        // another origin does not send an Origin header at all, so enforcing here
+        // would reject legitimate navigations.
+        const action = Object.assign(vi.fn().mockReturnValue("data"), {
+            method: "GET",
+        });
+        const deps = createDeps(action);
+        const req = makeRequest(ACTION_URL + "&args=%5B%5D", "GET");
+        const result = await rscActionHandler(req, deps);
+        expect(result).toBe("data");
+        expect(action).toHaveBeenCalled();
+    });
+    it("runs origin check before invoking the action", async () => {
+        const action = Object.assign(vi.fn(), { method: "POST" });
+        const deps = createDeps(action);
+        const req = postWithOrigin("https://evil.test");
+        await rscActionHandler(req, deps);
+        expect(deps.getServerModuleExport).not.toHaveBeenCalled();
+        expect(deps.decodeReply).not.toHaveBeenCalled();
+        expect(action).not.toHaveBeenCalled();
+    });
+});

package/dist/runtime/register/worker.d.ts

@@ -1,4 +1,7 @@
 export declare function registerServerReference(action: Function, id: string, name: string): Function;
 export declare function registerClientReference<Target extends Record<string, unknown>>(ssrModule: Target, id: string, exportName: string): {};
 export declare function __smokeTestActionHandler(timestamp?: number): Promise<unknown>;
+export declare function createRscActionHandler(options?: {
+    allowedOrigins?: readonly string[];
+}): (req: Request) => Promise<unknown>;
 export declare function rscActionHandler(req: Request): Promise<unknown>;

package/dist/runtime/register/worker.js

@@ -48,6 +48,13 @@ export async function __smokeTestActionHandler(timestamp) {
     await new Promise((resolve) => setTimeout(resolve, 0));
     return { status: "ok", timestamp };
 }
+export function createRscActionHandler(options = {}) {
+    return (req) => rscActionHandlerImpl(req, {
+        getServerModuleExport,
+        decodeReply,
+        allowedOrigins: options.allowedOrigins,
+    });
+}
 export async function rscActionHandler(req) {
     return rscActionHandlerImpl(req, { getServerModuleExport, decodeReply });
 }

package/dist/runtime/render/assembleDocument.js

@@ -17,6 +17,6 @@ export const assembleDocument = ({ requestInfo, pageElement, shouldSSR, }) => {
     };
     const Document = requestInfo.rw.Document;
     return (_jsxs(Document, { ...requestInfo, children: [_jsx("script", { nonce: requestInfo.rw.nonce, dangerouslySetInnerHTML: {
-                    __html: `globalThis.__RWSDK_CONTEXT = ${JSON.stringify(clientContext)}`,
+                    __html: `globalThis.__RWSDK_CONTEXT = ${JSON.stringify(clientContext)};if(!globalThis.__webpack_require__){globalThis.__webpack_require__=function(id){throw new Error("rwsdk: __webpack_require__ called before client init for: "+id)};globalThis.__webpack_require__.u=function(){}}`,
                 } }), _jsx(Stylesheets, { requestInfo: requestInfo }), _jsx(Preloads, { requestInfo: requestInfo }), _jsx("div", { id: "hydrate-root", children: pageElement })] }));
 };

package/dist/runtime/render/renderDocumentHtmlStream.js

@@ -20,7 +20,7 @@ export const renderDocumentHtmlStream = async ({ rscPayloadStream, Document, req
     };
     // Create the outer document with a marker for injection
     const documentElement = (_jsxs(Document, { ...requestInfo, children: [_jsx("script", { nonce: requestInfo.rw.nonce, dangerouslySetInnerHTML: {
-                    __html: `globalThis.__RWSDK_CONTEXT = ${JSON.stringify(clientContext)}`,
+                    __html: `globalThis.__RWSDK_CONTEXT = ${JSON.stringify(clientContext)};if(!globalThis.__webpack_require__){globalThis.__webpack_require__=function(id){throw new Error("rwsdk: __webpack_require__ called before client init for: "+id)};globalThis.__webpack_require__.u=function(){}}`,
                 } }), _jsx(Stylesheets, { requestInfo: requestInfo }), _jsx(Preloads, { requestInfo: requestInfo }), _jsx("div", { id: "hydrate-root", children: _jsx("div", { id: "rwsdk-app-start" }) })] }));
     const outerHtmlStream = await renderHtmlStream({
         node: documentElement,

package/dist/runtime/render/stylesheets.js

@@ -23,6 +23,20 @@ const findCssForModule = (scriptId, manifest) => {
                 css.add(href);
             }
         }
+        // context(justinvdm, 2026-04-23): Rolldown associates CSS with the
+        // chunk that imports the CSS file, which may be a dynamic import target
+        // rather than the entry chunk. Walk both static and dynamic imports to
+        // find CSS from transitive dependencies.
+        if (entry.imports) {
+            for (const importId of entry.imports) {
+                inner(importId);
+            }
+        }
+        if (entry.dynamicImports) {
+            for (const importId of entry.dynamicImports) {
+                inner(importId);
+            }
+        }
     };
     inner(scriptId);
     return Array.from(css);
@@ -37,5 +51,13 @@ export const Stylesheets = async ({ requestInfo, }) => {
             allStylesheets.add(toAbsoluteHref(entry));
         }
     }
+    for (const [, entry] of Object.entries(manifest)) {
+        if (entry.isEntry) {
+            const css = findCssForModule(entry.src ?? "", manifest);
+            for (const href of css) {
+                allStylesheets.add(toAbsoluteHref(href));
+            }
+        }
+    }
     return (_jsx(_Fragment, { children: Array.from(allStylesheets).map((href) => (_jsx("link", { rel: "stylesheet", href: href, precedence: "first" }, href))) }));
 };

package/dist/runtime/server.d.ts

@@ -19,7 +19,7 @@ export type ServerFunctionWrap = (fn: Function, args: any[], type: "action" | "q
  * handler function, its arguments, and the type ("action" or "query").
  * Interruptors run *outside* the wrapper.
  *
- * Throws if called more than once.
+ * Only one wrapper is active at a time; the most recent call wins.
  *
  * @example
  * ```ts

package/dist/runtime/server.js

@@ -7,7 +7,7 @@ let globalWrap;
  * handler function, its arguments, and the type ("action" or "query").
  * Interruptors run *outside* the wrapper.
  *
- * Throws if called more than once.
+ * Only one wrapper is active at a time; the most recent call wins.
  *
  * @example
  * ```ts
@@ -23,10 +23,6 @@ let globalWrap;
  * ```
  */
 export function registerServerFunctionWrap(wrap) {
-    if (globalWrap) {
-        throw new Error("registerServerFunctionWrap() has already been called. " +
-            "Only one wrapper can be registered.");
-    }
     globalWrap = wrap;
 }
 /**

package/dist/runtime/server.test.js

@@ -86,11 +86,17 @@ describe("registerServerFunctionWrap", () => {
         expect(wrapSpy).not.toHaveBeenCalled();
         expect(result).toBeInstanceOf(Response);
     });
-    it("throws if called more than once", () => {
-        registerServerFunctionWrap(async (fn, args) => fn(...args));
-        expect(() => {
-            registerServerFunctionWrap(async (fn, args) => fn(...args));
-        }).toThrow("registerServerFunctionWrap() has already been called");
+    it("replaces the wrapper if called more than once", async () => {
+        const first = vi.fn((fn, args, _type) => fn(...args));
+        const second = vi.fn((fn, args, _type) => fn(...args));
+        registerServerFunctionWrap(first);
+        registerServerFunctionWrap(second);
+        const action = serverAction(async function run() {
+            return "ok";
+        });
+        await action();
+        expect(first).not.toHaveBeenCalled();
+        expect(second).toHaveBeenCalledOnce();
     });
     it("without registration, handlers work normally", async () => {
         const action = serverAction(async function echo(msg) {

package/dist/runtime/worker.d.ts

@@ -12,7 +12,10 @@ export type AppDefinition<Routes extends readonly Route<any>[], T extends Reques
     fetch: (request: Request, env: Env, cf: ExecutionContext) => Promise<Response>;
     __rwRoutes: Routes;
 };
-export declare const defineApp: <T extends RequestInfo = RequestInfo<any, DefaultAppContext>, Routes extends readonly Route<T>[] = readonly Route<T>[]>(routes: Routes) => AppDefinition<Routes, T>;
+export interface DefineAppOptions {
+    allowedOrigins?: readonly string[];
+}
+export declare const defineApp: <T extends RequestInfo = RequestInfo<any, DefaultAppContext>, Routes extends readonly Route<T>[] = readonly Route<T>[]>(routes: Routes, options?: DefineAppOptions) => AppDefinition<Routes, T>;
 export declare const DefaultDocument: React.FC<{
     children: React.ReactNode;
 }>;

package/dist/runtime/worker.js

@@ -4,14 +4,17 @@ import { renderDocumentHtmlStream } from "./render/renderDocumentHtmlStream";
 import { renderToRscStream } from "./render/renderToRscStream";
 import { injectRSCPayload } from "rsc-html-stream/server";
 import { ErrorResponse } from "./error";
-import { rscActionHandler } from "./register/worker";
+import { createRscActionHandler } from "./register/worker";
 import { getRequestInfo, runWithRequestInfo, runWithRequestInfoOverrides, } from "./requestInfo/worker";
 import { ssrWebpackRequire } from "./imports/worker";
 import { defineRoutes } from "./lib/router";
 import { generateNonce } from "./lib/utils";
 export * from "./requestInfo/types";
-export const defineApp = (routes) => {
+export const defineApp = (routes, options = {}) => {
     const router = defineRoutes(routes);
+    const rscActionHandler = createRscActionHandler({
+        allowedOrigins: options.allowedOrigins,
+    });
     return {
         __rwRoutes: routes,
         fetch: async (request, env, cf) => {

package/dist/vite/addOptimizeDepsPlugin.d.mts

@@ -0,0 +1,10 @@
+import type { EnvironmentOptions } from "vite";
+interface OptimizeDepsPlugin {
+    name: string;
+    resolveId?: (id: string, importer: string | undefined, opts: {
+        kind: string;
+    }) => any;
+    load?: (id: string) => any;
+}
+export declare function addOptimizeDepsPlugin(config: EnvironmentOptions, plugin: OptimizeDepsPlugin): void;
+export {};

package/dist/vite/addOptimizeDepsPlugin.mjs

@@ -0,0 +1,6 @@
+export function addOptimizeDepsPlugin(config, plugin) {
+    config.optimizeDeps ??= {};
+    config.optimizeDeps.rolldownOptions ??= {};
+    config.optimizeDeps.rolldownOptions.plugins ??= [];
+    config.optimizeDeps.rolldownOptions.plugins.push(plugin);
+}

package/dist/vite/configPlugin.mjs

@@ -6,8 +6,12 @@ import { externalModules } from "./constants.mjs";
 import { ssrBridgeWrapPlugin } from "./ssrBridgeWrapPlugin.mjs";
 export const configPlugin = ({ silent, projectRootDir, workerEntryPathname, clientFiles, serverFiles, clientEntryPoints, esbuildOptions, }) => ({
     name: "rwsdk:config",
-    config: async (_, { command }) => {
+    config: async (config, { command }) => {
         const mode = process.env.NODE_ENV;
+        // context(justinvdm, 2026-05-06): Only set a sourcemap default if the user
+        // hasn't already configured it in their vite config. This lets users opt in
+        // or out explicitly while still providing a sensible mode-aware default.
+        const sourcemap = config.build?.sourcemap ?? (mode === "development");
         const workerConfig = {
             resolve: {
                 conditions: [
@@ -45,11 +49,13 @@ export const configPlugin = ({ silent, projectRootDir, workerEntryPathname, clie
                 ],
                 exclude: [],
                 entries: [workerEntryPathname],
-                esbuildOptions: {
-                    jsx: "automatic",
-                    jsxImportSource: "react",
-                    define: {
-                        "process.env.NODE_ENV": JSON.stringify(mode),
+                rolldownOptions: {
+                    transform: {
+                        jsx: "react-jsx",
+                        define: {
+                            "process.env.NODE_ENV": JSON.stringify(mode),
+                            "__webpack_require__": "globalThis.__webpack_require__",
+                        },
                     },
                 },
             },
@@ -65,9 +71,12 @@ export const configPlugin = ({ silent, projectRootDir, workerEntryPathname, clie
             appType: "custom",
             mode,
             logLevel: silent ? "silent" : "info",
+            resolve: {
+                tsconfigPaths: true,
+            },
             build: {
                 minify: mode !== "development",
-                sourcemap: true,
+                sourcemap,
             },
             define: {
                 "process.env.NODE_ENV": JSON.stringify(mode),
@@ -99,12 +108,13 @@ export const configPlugin = ({ silent, projectRootDir, workerEntryPathname, clie
                             "rwsdk/turnstile",
                         ],
                         entries: [],
-                        esbuildOptions: {
-                            jsx: "automatic",
-                            jsxImportSource: "react",
-                            plugins: [],
-                            define: {
-                                "process.env.NODE_ENV": JSON.stringify(mode),
+                        rolldownOptions: {
+                            transform: {
+                                jsx: "react-jsx",
+                                define: {
+                                    "process.env.NODE_ENV": JSON.stringify(mode),
+                                    "__webpack_require__": "globalThis.__webpack_require__",
+                                },
                             },
                         },
                     },
@@ -136,12 +146,13 @@ export const configPlugin = ({ silent, projectRootDir, workerEntryPathname, clie
                             "rwsdk/realtime/durableObject",
                             "rwsdk/realtime/worker",
                         ],
-                        esbuildOptions: {
-                            jsx: "automatic",
-                            jsxImportSource: "react",
-                            plugins: [],
-                            define: {
-                                "process.env.NODE_ENV": JSON.stringify(mode),
+                        rolldownOptions: {
+                            transform: {
+                                jsx: "react-jsx",
+                                define: {
+                                    "process.env.NODE_ENV": JSON.stringify(mode),
+                                    "__webpack_require__": "globalThis.__webpack_require__",
+                                },
                             },
                         },
                     },

package/dist/vite/createDirectiveLookupPlugin.mjs

@@ -1,6 +1,7 @@
 import debug from "debug";
 import MagicString from "magic-string";
 import path from "path";
+import { addOptimizeDepsPlugin } from "./addOptimizeDepsPlugin.mjs";
 import { VENDOR_CLIENT_BARREL_EXPORT_PATH, VENDOR_SERVER_BARREL_EXPORT_PATH, } from "../lib/constants.mjs";
 export function generateLookupMap({ files, isDev, kind, exportName, }) {
     const s = new MagicString(`
@@ -55,32 +56,27 @@ export const createDirectiveLookupPlugin = async ({ projectRootDir, files, confi
                 return;
             }
             log("Configuring environment: env=%s", env);
-            viteConfig.optimizeDeps ??= {};
-            viteConfig.optimizeDeps.esbuildOptions ??= {};
-            viteConfig.optimizeDeps.esbuildOptions.plugins ??= [];
-            viteConfig.optimizeDeps.esbuildOptions.plugins.push({
+            const escapedVirtualModuleName = config.virtualModuleName.replace(/[-\/\\^$*+?.()|[\]{}]/g, "\\$&");
+            const escapedPrefixedModuleName = `/@id/${config.virtualModuleName}`.replace(/[-\/\\^$*+?.()|[\]{}]/g, "\\$&");
+            const lookupFilter = new RegExp(`^(${escapedVirtualModuleName}|${escapedPrefixedModuleName})\\.js$`);
+            addOptimizeDepsPlugin(viteConfig, {
                 name: `rwsdk:${config.pluginName}`,
-                setup(build) {
-                    log("Setting up esbuild plugin for %s", config.virtualModuleName);
-                    // Handle both direct virtual module name and /@id/ prefixed version
-                    const escapedVirtualModuleName = config.virtualModuleName.replace(/[-\/\\^$*+?.()|[\]{}]/g, "\\$&");
-                    const escapedPrefixedModuleName = `/@id/${config.virtualModuleName}`.replace(/[-\/\\^$*+?.()|[\]{}]/g, "\\$&");
-                    build.onResolve({
-                        filter: new RegExp(`^(${escapedVirtualModuleName}|${escapedPrefixedModuleName})\\.js$`),
-                    }, () => {
+                resolveId(id) {
+                    if (lookupFilter.test(id)) {
                         process.env.VERBOSE &&
-                            log("Esbuild onResolve: marking %s as external", config.virtualModuleName);
+                            log("Marking %s as external", config.virtualModuleName);
                         return {
-                            path: `${config.virtualModuleName}.js`,
+                            id: `${config.virtualModuleName}.js`,
                             external: true,
                         };
-                    });
+                    }
                 },
             });
             const shouldOptimizeForEnv = !config.optimizeForEnvironments ||
                 config.optimizeForEnvironments.includes(env);
             if (shouldOptimizeForEnv) {
                 log("Applying optimizeDeps and aliasing for environment: %s", env);
+                viteConfig.optimizeDeps ??= {};
                 viteConfig.optimizeDeps.include ??= [];
                 for (const file of files) {
                     if (file.includes("node_modules")) {

package/dist/vite/directiveModulesDevPlugin.mjs

@@ -99,52 +99,36 @@ export const directiveModulesDevPlugin = ({ clientFiles, serverFiles, projectRoo
                 else if (envName === "worker") {
                     entries.push(APP_SERVER_BARREL_PATH);
                 }
-                env.optimizeDeps.esbuildOptions ??= {};
-                env.optimizeDeps.esbuildOptions.plugins ??= [];
-                env.optimizeDeps.esbuildOptions.plugins.unshift({
+                const appBarrelPaths = [
+                    APP_CLIENT_BARREL_PATH,
+                    APP_SERVER_BARREL_PATH,
+                ];
+                const appBarrelFilter = new RegExp(`(${appBarrelPaths
+                    .map((p) => p.replace(/\\/g, "\\\\"))
+                    .join("|")})$`);
+                const BARREL_PREFIX = "\0rwsdk-app-barrel:";
+                env.optimizeDeps.rolldownOptions ??= {};
+                env.optimizeDeps.rolldownOptions.plugins ??= [];
+                env.optimizeDeps.rolldownOptions.plugins.unshift({
                     name: "rwsdk:app-barrel-blocker",
-                    setup(build) {
-                        const appBarrelPaths = [
-                            APP_CLIENT_BARREL_PATH,
-                            APP_SERVER_BARREL_PATH,
-                        ];
-                        const appBarrelFilter = new RegExp(`(${appBarrelPaths
-                            .map((p) => p.replace(/\\/g, "\\\\"))
-                            .join("|")})$`);
-                        build.onResolve({ filter: /.*/ }, async (args) => {
-                            // Block all resolutions until the scan is complete.
-                            await scanPromise;
-                            // Handle app barrel files
-                            if (appBarrelFilter.test(args.path)) {
-                                return {
-                                    path: args.path,
-                                    namespace: "rwsdk-app-barrel-ns",
-                                };
-                            }
-                            // context(justinvdm, 11 Sep 2025): Prevent Vite from
-                            // externalizing our application files. If we don't, paths
-                            // imported in our application barrel files will be marked as
-                            // external, and thus not scanned for dependencies.
-                            if (args.path.startsWith("/") &&
-                                (args.path.includes("/src/") ||
-                                    args.path.includes("/generated/")) &&
-                                !args.path.includes("node_modules")) {
-                                // By returning a result, we claim the module and prevent vite:dep-scan
-                                // from marking it as external.
-                                return {
-                                    path: args.path,
-                                };
-                            }
-                        });
-                        build.onLoad({ filter: /.*/, namespace: "rwsdk-app-barrel-ns" }, (args) => {
-                            const isServerBarrel = args.path.includes("app-server-barrel");
+                    async resolveId(id) {
+                        await scanPromise;
+                        if (appBarrelFilter.test(id)) {
+                            return `${BARREL_PREFIX}${id}`;
+                        }
+                        if (id.startsWith("/") &&
+                            (id.includes("/src/") || id.includes("/generated/")) &&
+                            !id.includes("node_modules")) {
+                            return id;
+                        }
+                    },
+                    load(id) {
+                        if (id.startsWith(BARREL_PREFIX)) {
+                            const barrelPath = id.slice(BARREL_PREFIX.length);
+                            const isServerBarrel = barrelPath.includes("app-server-barrel");
                             const files = isServerBarrel ? serverFiles : clientFiles;
-                            const content = generateAppBarrelContent(files, projectRootDir);
-                            return {
-                                contents: content,
-                                loader: "js",
-                            };
-                        });
+                            return generateAppBarrelContent(files, projectRootDir);
+                        }
                     },
                 });
             }

package/dist/vite/directivesPlugin.mjs

@@ -2,6 +2,7 @@ import debug from "debug";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { normalizeModulePath } from "../lib/normalizeModulePath.mjs";
+import { addOptimizeDepsPlugin } from "./addOptimizeDepsPlugin.mjs";
 import { transformClientComponents } from "./transformClientComponents.mjs";
 import { transformServerFunctions } from "./transformServerFunctions.mjs";
 const log = debug("rwsdk:vite:rsc-directives-plugin");
@@ -92,100 +93,56 @@ export const directivesPlugin = ({ projectRootDir, clientFiles, serverFiles, })
                 return;
             }
             process.env.VERBOSE && log("Configuring environment: env=%s", env);
-            config.optimizeDeps ??= {};
-            config.optimizeDeps.esbuildOptions ??= {};
-            config.optimizeDeps.esbuildOptions.plugins ??= [];
-            config.optimizeDeps.esbuildOptions.plugins.push({
-                name: "rsc-directives-esbuild-transform",
-                setup(build) {
-                    log("Setting up esbuild plugin for environment: %s", env);
-                    build.onLoad({ filter: /\.(js|ts|jsx|tsx|mts|mjs|cjs)$/ }, async (args) => {
-                        process.env.VERBOSE &&
-                            log("Esbuild onLoad called for environment=%s, path=%s", env, args.path);
-                        const normalizedPath = normalizeModulePath(args.path, projectRootDir);
-                        // context(justinvdm,2025-06-15): If we're in app code,
-                        // we will be doing the transform work in the vite plugin hooks,
-                        // the only reason we're in esbuild land for app code is for
-                        // dependency discovery, so we can skip transform work
-                        // and use heuristics instead - see below inside if block
-                        if (!args.path.includes("node_modules")) {
-                            if (clientFiles.has(normalizedPath)) {
-                                // context(justinvdm,2025-06-15): If this is a client file:
-                                // * for ssr and client envs we can skip so esbuild looks at the
-                                // original source code to discovery dependencies
-                                // * for worker env, the transform would have just created
-                                // references and dropped all imports, so we can just return empty code
-                                if (env === "client" || env === "ssr") {
-                                    log("Esbuild onLoad skipping client module in app code for client or ssr env, path=%s", args.path);
-                                    return undefined;
-                                }
-                                else {
-                                    log("Esbuild onLoad returning empty code for server module in app code for worker env, path=%s to bypass esbuild dependency discovery", args.path);
-                                    return {
-                                        contents: "",
-                                        loader: "js",
-                                    };
-                                }
-                            }
-                            else if (serverFiles.has(normalizedPath)) {
-                                // context(justinvdm,2025-06-15): If this is a server file:
-                                // * for worker env, we can skip so esbuild looks at the
-                                // original source code to discovery dependencies
-                                // * for ssr and client envs, the transform would have just created
-                                // references and dropped all imports, so we can just return empty code
-                                if (env === "worker") {
-                                    log("Esbuild onLoad skipping server module in app code for worker env, path=%s", args.path);
-                                    return undefined;
-                                }
-                                else if (env === "ssr" || env === "client") {
-                                    log("Esbuild onLoad returning empty code for server module in app code for ssr or client env, path=%s", args.path);
-                                    return {
-                                        contents: "",
-                                        loader: "js",
-                                    };
-                                }
-                            }
+            const directivesFileFilter = /\.(js|ts|jsx|tsx|mts|mjs|cjs)$/;
+            async function handleDirectivesLoad(filePath) {
+                const normalizedPath = normalizeModulePath(filePath, projectRootDir);
+                if (!filePath.includes("node_modules")) {
+                    if (clientFiles.has(normalizedPath)) {
+                        if (env === "client" || env === "ssr") {
+                            return undefined;
                         }
-                        let code;
-                        try {
-                            code = await fs.readFile(args.path, "utf-8");
+                        else {
+                            return { code: "", moduleType: "js" };
                         }
-                        catch {
-                            process.env.VERBOSE &&
-                                log("Failed to read file: %s, environment=%s", args.path, env);
+                    }
+                    else if (serverFiles.has(normalizedPath)) {
+                        if (env === "worker") {
                             return undefined;
                         }
-                        const clientResult = await transformClientComponents(code, normalizedPath, {
-                            environmentName: env,
-                            clientFiles,
-                            isEsbuild: true,
-                        });
-                        if (clientResult) {
-                            process.env.VERBOSE &&
-                                log("Esbuild client component transformation successful for environment=%s, path=%s", env, args.path);
-                            process.env.VERBOSE &&
-                                log("Esbuild client component transformation for environment=%s, path=%s, code: %j", env, args.path, clientResult.code);
-                            return {
-                                contents: clientResult.code,
-                                loader: getLoader(args.path),
-                            };
-                        }
-                        const serverResult = transformServerFunctions(code, normalizedPath, env, serverFiles);
-                        if (serverResult) {
-                            process.env.VERBOSE &&
-                                log("Esbuild server function transformation successful for environment=%s, path=%s", env, args.path);
-                            return {
-                                contents: serverResult.code,
-                                loader: getLoader(args.path),
-                            };
+                        else if (env === "ssr" || env === "client") {
+                            return { code: "", moduleType: "js" };
                         }
-                        process.env.VERBOSE &&
-                            log("Esbuild no transformation applied for environment=%s, path=%s", env, args.path);
-                    });
+                    }
+                }
+                let code;
+                try {
+                    code = await fs.readFile(filePath, "utf-8");
+                }
+                catch {
+                    return undefined;
+                }
+                const clientResult = await transformClientComponents(code, normalizedPath, { environmentName: env, clientFiles, isEsbuild: true });
+                if (clientResult) {
+                    return { code: clientResult.code, moduleType: getLoader(filePath) };
+                }
+                const serverResult = transformServerFunctions(code, normalizedPath, env, serverFiles);
+                if (serverResult) {
+                    return { code: serverResult.code, moduleType: getLoader(filePath) };
+                }
+                return undefined;
+            }
+            addOptimizeDepsPlugin(config, {
+                name: "rsc-directives-transform",
+                async load(id) {
+                    if (!directivesFileFilter.test(id)) {
+                        return;
+                    }
+                    const result = await handleDirectivesLoad(id);
+                    if (result) {
+                        return { code: result.code, moduleType: result.moduleType };
+                    }
                 },
             });
-            process.env.VERBOSE &&
-                log("Environment configuration complete for env=%s", env);
         },
     };
 };

package/dist/vite/knownDepsResolverPlugin.mjs

@@ -91,44 +91,34 @@ export const knownDepsResolverPlugin = ({ projectRootDir, }) => {
     // Log a clean summary instead of all the individual mappings
     const totalMappings = Object.values(ENV_IMPORT_MAPPINGS).reduce((sum, mappings) => sum + mappings.size, 0);
     log("Known dependencies resolver configured with %d total mappings across %d environments", totalMappings, Object.keys(ENV_IMPORT_MAPPINGS).length);
-    function createEsbuildResolverPlugin(envName, mappings) {
+    function createResolverPlugin(envName, mappings) {
         if (!mappings) {
             return null;
         }
-        // Create reverse mapping from slugified names to original imports
-        // Vite converts "react-dom/server.edge" -> "react-dom_server__edge"
-        // Pattern: / becomes _, . becomes __
         const slugifiedToOriginal = new Map();
-        for (const [original, resolved] of mappings) {
+        for (const [original] of mappings) {
             const slugified = original.replace(/\//g, "_").replace(/\./g, "__");
             slugifiedToOriginal.set(slugified, original);
         }
         return {
-            name: `rwsdk:known-dependencies-resolver-esbuild-${envName}`,
-            setup(build) {
-                build.onResolve({ filter: /.*/ }, (args) => {
-                    let resolved = mappings.get(args.path);
-                    // If not found, check if it's a slugified version
-                    if (!resolved) {
-                        const originalImport = slugifiedToOriginal.get(args.path);
-                        if (originalImport) {
-                            resolved = mappings.get(originalImport);
-                        }
-                    }
-                    if (!resolved) {
-                        resolved = resolveKnownImport(args.path, envName, projectRootDir);
+            name: `rwsdk:known-dependencies-resolver-${envName}`,
+            resolveId(id) {
+                let resolved = mappings.get(id);
+                if (!resolved) {
+                    const originalImport = slugifiedToOriginal.get(id);
+                    if (originalImport) {
+                        resolved = mappings.get(originalImport);
                     }
-                    // Resolve for both entry points (importer === '') and regular imports
-                    // Entry points come from optimizeDeps.include and are critical to intercept
-                    if (resolved) {
-                        if (args.path === "react-server-dom-webpack/client.edge") {
-                            return;
-                        }
-                        return {
-                            path: resolved,
-                        };
+                }
+                if (!resolved) {
+                    resolved = resolveKnownImport(id, envName, projectRootDir);
+                }
+                if (resolved) {
+                    if (id === "react-server-dom-webpack/client.edge") {
+                        return;
                     }
-                });
+                    return resolved;
+                }
             },
         };
     }
@@ -152,17 +142,20 @@ export const knownDepsResolverPlugin = ({ projectRootDir, }) => {
                         config.environments[envName] = {};
                     }
                     const envConfig = config.environments[envName];
-                    const esbuildPlugin = createEsbuildResolverPlugin(envName, mappings);
-                    if (esbuildPlugin && mappings) {
+                    if (mappings) {
                         envConfig.optimizeDeps ??= {};
-                        envConfig.optimizeDeps.esbuildOptions ??= {};
-                        envConfig.optimizeDeps.esbuildOptions.define ??= {};
-                        envConfig.optimizeDeps.esbuildOptions.define["process.env.NODE_ENV"] = JSON.stringify(process.env.NODE_ENV);
-                        envConfig.optimizeDeps.esbuildOptions.plugins ??= [];
-                        envConfig.optimizeDeps.esbuildOptions.plugins.push(esbuildPlugin);
+                        envConfig.optimizeDeps.rolldownOptions ??= {};
+                        envConfig.optimizeDeps.rolldownOptions.transform ??= {};
+                        envConfig.optimizeDeps.rolldownOptions.transform.define ??= {};
+                        envConfig.optimizeDeps.rolldownOptions.transform.define["process.env.NODE_ENV"] = JSON.stringify(process.env.NODE_ENV);
+                        envConfig.optimizeDeps.rolldownOptions.plugins ??= [];
+                        const plugin = createResolverPlugin(envName, mappings);
+                        if (plugin) {
+                            envConfig.optimizeDeps.rolldownOptions.plugins.push(plugin);
+                        }
                         envConfig.optimizeDeps.include ??= [];
                         envConfig.optimizeDeps.include.push(...predefinedImports);
-                        log("Added esbuild plugin and optimizeDeps includes for environment: %s", envName);
+                        log("Added optimizeDeps plugin and includes for environment: %s", envName);
                     }
                     const aliases = ensureAliasArray(envConfig);
                     for (const [find, replacement] of mappings) {

package/dist/vite/linkerPlugin.mjs

@@ -9,7 +9,7 @@ export function linkWorkerBundle({ code, manifestContent, projectRootDir, base,
     const manifest = JSON.parse(manifestContent);
     // 1. Replace the manifest placeholder with the actual manifest content.
     log("Injecting manifest into worker bundle");
-    newCode = newCode.replace(/['"]__RWSDK_MANIFEST_PLACEHOLDER__['"]/, manifestContent);
+    newCode = newCode.replace(/['"`]__RWSDK_MANIFEST_PLACEHOLDER__['"`]/, manifestContent);
     // 2. Replace asset placeholders with their final hashed paths.
     log("Replacing asset placeholders in final worker bundle");
     for (const [key, value] of Object.entries(manifest)) {

package/dist/vite/prismaPlugin.mjs

@@ -1,4 +1,5 @@
 import { resolve } from "node:path";
+import { addOptimizeDepsPlugin } from "./addOptimizeDepsPlugin.mjs";
 import { checkPrismaStatus } from "./checkIsUsingPrisma.mjs";
 import { ensureAliasArray } from "./ensureAliasArray.mjs";
 import { invalidateCacheIfPrismaClientChanged } from "./invalidateCacheIfPrismaClientChanged.mjs";
@@ -21,17 +22,13 @@ export const prismaPlugin = async ({ projectRootDir, }) => {
                 return;
             }
             const wasmPath = resolve(projectRootDir, "node_modules/.prisma/client/wasm.js");
-            config.optimizeDeps ??= {};
-            config.optimizeDeps.esbuildOptions ??= {};
-            config.optimizeDeps.esbuildOptions.plugins ??= [];
-            config.optimizeDeps.esbuildOptions.plugins.push({
+            const prismaFilter = /^.prisma\/client\/default/;
+            addOptimizeDepsPlugin(config, {
                 name: "rwsdk:prisma",
-                setup(build) {
-                    build.onResolve({ filter: /^.prisma\/client\/default/ }, async () => {
-                        return {
-                            path: wasmPath,
-                        };
-                    });
+                resolveId(id) {
+                    if (prismaFilter.test(id)) {
+                        return wasmPath;
+                    }
                 },
             });
             ensureAliasArray(config).push({

package/dist/vite/redwoodPlugin.mjs

@@ -6,7 +6,6 @@ import { devServerConstantPlugin } from "./devServerConstant.mjs";
 import { hasOwnCloudflareVitePlugin } from "./hasOwnCloudflareVitePlugin.mjs";
 import { hasOwnReactVitePlugin } from "./hasOwnReactVitePlugin.mjs";
 import reactPlugin from "@vitejs/plugin-react";
-import tsconfigPaths from "vite-tsconfig-paths";
 import { pathExists } from "fs-extra";
 import { $ } from "../lib/$.mjs";
 import { findWranglerConfig } from "../lib/findWranglerConfig.mjs";
@@ -112,7 +111,6 @@ export const redwoodPlugin = async (options = {}) => {
         }),
         knownDepsResolverPlugin({ projectRootDir }),
         cloudflarePreInitPlugin(),
-        tsconfigPaths({ root: projectRootDir }),
         shouldIncludeCloudflarePlugin
             ? cloudflare({
                 viteEnvironment: { name: "worker" },

package/dist/vite/ssrBridgePlugin.mjs

@@ -1,6 +1,7 @@
 import debug from "debug";
 import MagicString from "magic-string";
 import { INTERMEDIATE_SSR_BRIDGE_PATH } from "../lib/constants.mjs";
+import { addOptimizeDepsPlugin } from "./addOptimizeDepsPlugin.mjs";
 import { externalModulesSet } from "./constants.mjs";
 import { findSsrImportCallSites } from "./findSsrSpecifiers.mjs";
 const log = debug("rwsdk:vite:ssr-bridge-plugin");
@@ -49,31 +50,18 @@ export const ssrBridgePlugin = ({ clientFiles, serverFiles, }) => {
         configEnvironment(env, config) {
             log("Configuring environment: env=%s", env);
             if (env === "worker") {
-                // Configure esbuild to mark rwsdk/__ssr paths as external for worker environment
-                log("Configuring esbuild options for worker environment");
                 config.optimizeDeps ??= {};
-                config.optimizeDeps.esbuildOptions ??= {};
-                config.optimizeDeps.esbuildOptions.plugins ??= [];
                 config.optimizeDeps.include ??= [];
-                config.optimizeDeps.esbuildOptions.plugins.push({
+                addOptimizeDepsPlugin(config, {
                     name: "rwsdk-ssr-external",
-                    setup(build) {
-                        log("Setting up esbuild plugin to mark rwsdk/__ssr paths as external for worker");
-                        build.onResolve({ filter: /.*$/ }, (args) => {
-                            process.env.VERBOSE &&
-                                log("Esbuild onResolve called for path=%s, args=%O", args.path, args);
-                            if (args.path === "rwsdk/__ssr_bridge" ||
-                                args.path.startsWith(VIRTUAL_SSR_PREFIX)) {
-                                log("Marking as external: %s", args.path);
-                                return {
-                                    path: args.path,
-                                    external: true,
-                                };
-                            }
-                        });
+                    resolveId(id) {
+                        if (id === "rwsdk/__ssr_bridge" ||
+                            id.startsWith(VIRTUAL_SSR_PREFIX)) {
+                            log("Marking as external: %s", id);
+                            return { id, external: true };
+                        }
                     },
                 });
-                log("Worker environment esbuild configuration complete");
             }
         },
         async resolveId(id, importer, options) {

package/dist/vite/statePlugin.mjs

@@ -1,6 +1,7 @@
 import debug from "debug";
 import fs from "node:fs/promises";
 import { RW_STATE_EXPORT_PATH } from "../lib/constants.mjs";
+import { addOptimizeDepsPlugin } from "./addOptimizeDepsPlugin.mjs";
 import { maybeResolveEnvImport } from "./envResolvers.mjs";
 const log = debug("rwsdk:vite:state-plugin");
 const VIRTUAL_STATE_PREFIX = "virtual:rwsdk:state:";
@@ -22,22 +23,14 @@ export const statePlugin = ({ projectRootDir, }) => {
         },
         configEnvironment(env, config) {
             if (env === "worker") {
-                config.optimizeDeps ??= {};
-                config.optimizeDeps.esbuildOptions ??= {};
-                config.optimizeDeps.esbuildOptions.plugins ??= [];
-                config.optimizeDeps.esbuildOptions.plugins.push({
+                const stateFilter = new RegExp(`^(${RW_STATE_EXPORT_PATH}|${VIRTUAL_STATE_PREFIX}.*)$`);
+                addOptimizeDepsPlugin(config, {
                     name: "rwsdk-state-external",
-                    setup(build) {
-                        build.onResolve({
-                            // context(justinvdm, 13 Oct 2025): Vite dep optimizer slugifies the export path
-                            filter: new RegExp(`^(${RW_STATE_EXPORT_PATH}|${VIRTUAL_STATE_PREFIX}.*)$`),
-                        }, (args) => {
-                            log("Marking as external: %s", args.path);
-                            return {
-                                path: args.path,
-                                external: true,
-                            };
-                        });
+                    resolveId(id) {
+                        if (stateFilter.test(id)) {
+                            log("Marking as external: %s", id);
+                            return { id, external: true };
+                        }
                     },
                 });
             }

package/dist/vite/transformJsxScriptTagsPlugin.mjs

@@ -105,9 +105,9 @@ export async function transformJsxScriptTagsCode(code, clientEntryPoints, manife
         .forEach((callExpr) => {
         const expression = callExpr.getExpression();
         const expressionText = expression.getText();
-        if (expressionText !== "jsx" &&
-            expressionText !== "jsxs" &&
-            expressionText !== "jsxDEV") {
+        if (!expressionText.endsWith("jsx") &&
+            !expressionText.endsWith("jsxs") &&
+            !expressionText.endsWith("jsxDEV")) {
             return;
         }
         const args = callExpr.getArguments();

package/dist/vite/vitePreamblePlugin.d.mts

@@ -1,153 +1,2 @@
-import type { ResolvedConfig } from "vite";
-export declare const vitePreamblePlugin: () => {
-    configResolved(config: ResolvedConfig): void;
-    hotUpdate?: import("rollup").ObjectHook<(this: import("rollup").MinimalPluginContext & {
-        environment: import("vite").DevEnvironment;
-    }, options: import("vite").HotUpdateOptions) => Array<import("vite").EnvironmentModuleNode> | void | Promise<Array<import("vite").EnvironmentModuleNode> | void>>;
-    resolveId?: import("rollup").ObjectHook<(this: import("rollup").PluginContext, source: string, importer: string | undefined, options: {
-        attributes: Record<string, string>;
-        custom?: import("rollup").CustomPluginOptions;
-        ssr?: boolean | undefined;
-        isEntry: boolean;
-    }) => Promise<import("rollup").ResolveIdResult> | import("rollup").ResolveIdResult, {
-        filter?: {
-            id?: RegExp | RegExp[] | {
-                include?: RegExp | RegExp[] | undefined;
-                exclude?: RegExp | RegExp[] | undefined;
-            };
-        };
-    }>;
-    load?: import("rollup").ObjectHook<(this: import("rollup").PluginContext, id: string, options?: {
-        ssr?: boolean | undefined;
-    }) => Promise<import("rollup").LoadResult> | import("rollup").LoadResult, {
-        filter?: {
-            id?: string | RegExp | (string | RegExp)[] | {
-                include?: string | RegExp | (string | RegExp)[] | undefined;
-                exclude?: string | RegExp | (string | RegExp)[] | undefined;
-            };
-        };
-    }>;
-    transform?: import("rollup").ObjectHook<(this: import("rollup").TransformPluginContext, code: string, id: string, options?: {
-        ssr?: boolean | undefined;
-    }) => Promise<import("rollup").TransformResult> | import("rollup").TransformResult, {
-        filter?: {
-            id?: string | RegExp | (string | RegExp)[] | {
-                include?: string | RegExp | (string | RegExp)[] | undefined;
-                exclude?: string | RegExp | (string | RegExp)[] | undefined;
-            };
-            code?: string | RegExp | (string | RegExp)[] | {
-                include?: string | RegExp | (string | RegExp)[] | undefined;
-                exclude?: string | RegExp | (string | RegExp)[] | undefined;
-            };
-        };
-    }>;
-    sharedDuringBuild?: boolean;
-    perEnvironmentStartEndDuringDev?: boolean;
-    perEnvironmentWatchChangeDuringDev?: boolean;
-    enforce?: "pre" | "post";
-    apply?: "serve" | "build" | ((this: void, config: import("vite").UserConfig, env: import("vite").ConfigEnv) => boolean);
-    applyToEnvironment?: (environment: {
-        name: string;
-        getTopLevelConfig(): ResolvedConfig;
-        config: ResolvedConfig & {
-            define?: Record<string, any>;
-            resolve: Required<import("vite").ResolveOptions>;
-            consumer: "client" | "server";
-            keepProcessEnv?: boolean;
-            optimizeDeps: import("vite").DepOptimizationOptions;
-            dev: import("vite").ResolvedDevEnvironmentOptions;
-            build: import("vite").ResolvedBuildEnvironmentOptions;
-            plugins: readonly import("vite").Plugin[];
-        };
-        logger: import("vite").Logger;
-    }) => boolean | Promise<boolean> | import("vite").PluginOption;
-    config?: import("rollup").ObjectHook<(this: import("vite").ConfigPluginContext, config: import("vite").UserConfig, env: import("vite").ConfigEnv) => Omit<import("vite").UserConfig, "plugins"> | null | void | Promise<Omit<import("vite").UserConfig, "plugins"> | null | void>>;
-    configEnvironment?: import("rollup").ObjectHook<(this: import("vite").ConfigPluginContext, name: string, config: import("vite").EnvironmentOptions, env: import("vite").ConfigEnv & {
-        isSsrTargetWebworker?: boolean;
-    }) => import("vite").EnvironmentOptions | null | void | Promise<import("vite").EnvironmentOptions | null | void>>;
-    configureServer?: import("rollup").ObjectHook<import("vite").ServerHook>;
-    configurePreviewServer?: import("rollup").ObjectHook<import("vite").PreviewServerHook>;
-    transformIndexHtml?: import("vite").IndexHtmlTransform;
-    buildApp?: import("rollup").ObjectHook<import("vite").BuildAppHook>;
-    handleHotUpdate?: import("rollup").ObjectHook<(this: import("vite").MinimalPluginContextWithoutEnvironment, ctx: import("vite").HmrContext) => Array<import("vite").ModuleNode> | void | Promise<Array<import("vite").ModuleNode> | void>>;
-    api?: any;
-    cacheKey?: string | undefined;
-    name: string;
-    version?: string | undefined;
-    renderError?: import("rollup").ObjectHook<(this: import("rollup").PluginContext, error?: Error | undefined) => void | Promise<void>, {
-        sequential?: boolean;
-    }> | undefined;
-    augmentChunkHash?: import("rollup").ObjectHook<(this: import("rollup").PluginContext, chunk: import("rollup").RenderedChunk) => string | void, {}> | undefined;
-    generateBundle?: import("rollup").ObjectHook<(this: import("rollup").PluginContext, options: import("rollup").NormalizedOutputOptions, bundle: import("rollup").OutputBundle, isWrite: boolean) => void | Promise<void>, {}> | undefined;
-    outputOptions?: import("rollup").ObjectHook<(this: import("rollup").PluginContext, options: import("rollup").OutputOptions) => import("rollup").OutputOptions | import("rollup").NullValue, {}> | undefined;
-    renderChunk?: import("rollup").ObjectHook<(this: import("rollup").PluginContext, code: string, chunk: import("rollup").RenderedChunk, options: import("rollup").NormalizedOutputOptions, meta: {
-        chunks: Record<string, import("rollup").RenderedChunk>;
-    }) => string | {
-        code: string;
-        map?: import("rollup").SourceMapInput;
-    } | import("rollup").NullValue | Promise<string | {
-        code: string;
-        map?: import("rollup").SourceMapInput;
-    } | import("rollup").NullValue>, {}> | undefined;
-    renderDynamicImport?: import("rollup").ObjectHook<(this: import("rollup").PluginContext, options: {
-        customResolution: string | null;
-        format: import("rollup").InternalModuleFormat;
-        moduleId: string;
-        targetModuleId: string | null;
-        chunk: import("rollup").PreRenderedChunkWithFileName;
-        targetChunk: import("rollup").PreRenderedChunkWithFileName | null;
-        getTargetChunkImports: () => import("rollup").DynamicImportTargetChunk[] | null;
-        targetModuleAttributes: Record<string, string>;
-    }) => {
-        left: string;
-        right: string;
-    } | import("rollup").NullValue, {}> | undefined;
-    renderStart?: import("rollup").ObjectHook<(this: import("rollup").PluginContext, outputOptions: import("rollup").NormalizedOutputOptions, inputOptions: import("rollup").NormalizedInputOptions) => void | Promise<void>, {
-        sequential?: boolean;
-    }> | undefined;
-    resolveFileUrl?: import("rollup").ObjectHook<import("rollup").ResolveFileUrlHook, {}> | undefined;
-    resolveImportMeta?: import("rollup").ObjectHook<import("rollup").ResolveImportMetaHook, {}> | undefined;
-    writeBundle?: import("rollup").ObjectHook<(this: import("rollup").PluginContext, options: import("rollup").NormalizedOutputOptions, bundle: import("rollup").OutputBundle) => void | Promise<void>, {
-        sequential?: boolean;
-    }> | undefined;
-    footer?: import("rollup").ObjectHook<import("rollup").AddonHook, {}> | undefined;
-    banner?: import("rollup").ObjectHook<import("rollup").AddonHook, {}> | undefined;
-    intro?: import("rollup").ObjectHook<import("rollup").AddonHook, {}> | undefined;
-    outro?: import("rollup").ObjectHook<import("rollup").AddonHook, {}> | undefined;
-    buildEnd?: import("rollup").ObjectHook<(this: import("rollup").PluginContext, error?: Error | undefined) => void | Promise<void>, {
-        sequential?: boolean;
-    }> | undefined;
-    buildStart?: import("rollup").ObjectHook<(this: import("rollup").PluginContext, options: import("rollup").NormalizedInputOptions) => void | Promise<void>, {
-        sequential?: boolean;
-    }> | undefined;
-    closeBundle?: import("rollup").ObjectHook<(this: import("rollup").PluginContext, error?: Error | undefined) => void | Promise<void>, {
-        sequential?: boolean;
-    }> | undefined;
-    closeWatcher?: import("rollup").ObjectHook<(this: import("rollup").PluginContext) => void | Promise<void>, {
-        sequential?: boolean;
-    }> | undefined;
-    moduleParsed?: import("rollup").ObjectHook<(this: import("rollup").PluginContext, info: import("rollup").ModuleInfo) => void | Promise<void>, {
-        sequential?: boolean;
-    }> | undefined;
-    onLog?: import("rollup").ObjectHook<(this: import("rollup").MinimalPluginContext, level: import("rollup").LogLevel, log: import("rollup").RollupLog) => boolean | import("rollup").NullValue, {}> | undefined;
-    options?: import("rollup").ObjectHook<(this: import("rollup").MinimalPluginContext, options: import("rollup").InputOptions) => import("rollup").InputOptions | import("rollup").NullValue | Promise<import("rollup").InputOptions | import("rollup").NullValue>, {}> | undefined;
-    resolveDynamicImport?: import("rollup").ObjectHook<(this: import("rollup").PluginContext, specifier: string | import("rollup").AstNode, importer: string, options: {
-        attributes: Record<string, string>;
-        importerAttributes: Record<string, string>;
-    }) => import("rollup").ResolveIdResult | Promise<import("rollup").ResolveIdResult>, {}> | undefined;
-    shouldTransformCachedModule?: import("rollup").ObjectHook<(this: import("rollup").PluginContext, options: {
-        ast: import("rollup").ProgramNode;
-        attributes: Record<string, string>;
-        code: string;
-        id: string;
-        meta: import("rollup").CustomPluginOptions;
-        moduleSideEffects: boolean | "no-treeshake";
-        resolvedSources: import("rollup").ResolvedIdMap;
-        syntheticNamedExports: boolean | string;
-    }) => boolean | import("rollup").NullValue | Promise<boolean | import("rollup").NullValue>, {}> | undefined;
-    watchChange?: import("rollup").ObjectHook<(this: import("rollup").PluginContext, id: string, change: {
-        event: import("rollup").ChangeEvent;
-    }) => void | Promise<void>, {
-        sequential?: boolean;
-    }> | undefined;
-};
+import type { Plugin } from "vite";
+export declare const vitePreamblePlugin: () => Plugin;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rwsdk",
-  "version": "1.2.2",
+  "version": "1.2.4-canary.0",
   "description": "Build fast, server-driven webapps on Cloudflare with SSR, RSC, and realtime",
   "type": "module",
   "bin": {
@@ -163,7 +163,7 @@
     "@types/react": "~19.2.14",
     "@types/react-dom": "~19.2.3",
     "@types/react-is": "~19.2.0",
-    "@vitejs/plugin-react": "~5.1.4",
+    "@vitejs/plugin-react": "~6.0.1",
     "chokidar": "~5.0.0",
     "debug": "~4.4.3",
     "decompress": "~4.2.1",
@@ -189,8 +189,7 @@
     "tmp-promise": "~3.0.3",
     "ts-morph": "~27.0.2",
     "unique-names-generator": "~4.7.1",
-    "vibe-rules": "~0.3.91",
-    "vite-tsconfig-paths": "~6.1.1"
+    "vibe-rules": "~0.3.91"
   },
   "peerDependencies": {
     "@cloudflare/vite-plugin": "^1.26.1",
@@ -198,7 +197,7 @@
     "react": ">=19.2.0-0 <19.3.0 || >=19.3.0-0 <20.0.0",
     "react-dom": ">=19.2.0-0 <19.3.0 || >=19.3.0-0 <20.0.0",
     "react-server-dom-webpack": ">=19.2.0-0 <19.3.0 || >=19.3.0-0 <20.0.0",
-    "vite": "^6.2.6 || 7.x",
+    "vite": "^6.2.6 || 7.x || 8.x",
     "wrangler": "^4.77.0"
   },
   "peerDependenciesMeta": {
@@ -220,7 +219,7 @@
     "semver": "~7.7.4",
     "tsx": "~4.21.0",
     "typescript": "~6.0.2",
-    "vite": "~7.3.2",
+    "vite": "~8.0.9",
     "vitest": "~4.1.2"
   }
 }