vike 0.4.238 → 0.4.239-commit-050a4a3

package/dist/esm/node/vite/plugins/pluginBuild/pluginDistFileNames.js

@@ -12,88 +12,90 @@ function pluginDistFileNames() {
         name: 'vike:build:pluginDistFileNames',
         apply: 'build',
         enforce: 'post',
-        configResolved(config) {
-            const rollupOutputs = getRollupOutputs(config);
-            // We need to support multiple outputs: @vite/plugin-legacy adds an output, see https://github.com/vikejs/vike/issues/477#issuecomment-1406434802
-            rollupOutputs.forEach((rollupOutput) => {
-                if (!('entryFileNames' in rollupOutput)) {
-                    rollupOutput.entryFileNames = (chunkInfo) => getEntryFileName(chunkInfo, config, true);
-                }
-                if (!('chunkFileNames' in rollupOutput)) {
-                    rollupOutput.chunkFileNames = (chunkInfo) => getChunkFileName(chunkInfo, config);
-                }
-                if (!('assetFileNames' in rollupOutput)) {
-                    rollupOutput.assetFileNames = (chunkInfo) => getAssetFileName(chunkInfo, config);
-                    rollupOutput.assetFileNames.isTheOneSetByVike = true;
-                    assert(rollupOutput.assetFileNames.isTheOneSetByVike);
-                }
-                else {
-                    // If a user needs this:
-                    //  - assertUsage() that the naming provided by the user ends with `.[hash][extname]`
-                    //    - It's needed for getHash() of handleAssetsManifest()
-                    //    - Asset URLs should always contain a hash: it's paramount for caching assets.
-                    //    - If rollupOutput.assetFileNames is a function then use a wrapper function to apply the assertUsage()
-                    assertUsage(rollupOutput.assetFileNames.isTheOneSetByVike, "Setting Vite's configuration build.rollupOptions.output.assetFileNames is currently forbidden. Reach out if you need to use it.");
-                }
-                {
-                    const manualChunksOriginal = rollupOutput.manualChunks;
-                    rollupOutput.manualChunks = function (id, ...args) {
-                        if (manualChunksOriginal) {
-                            if (isCallable(manualChunksOriginal)) {
-                                const result = manualChunksOriginal.call(this, id, ...args);
-                                if (result !== undefined)
-                                    return result;
-                            }
-                            else {
-                                assertUsage(false, "The Vite's configuration build.rollupOptions.output.manualChunks must be a function. Reach out if you need to set it to another value.");
-                            }
-                        }
-                        // Disable CSS bundling to workaround https://github.com/vikejs/vike/issues/1815
-                        // TO-DO/eventually: let's bundle CSS again once Rolldown replaces Rollup
-                        if (id.endsWith('.css')) {
-                            const userRootDir = config.root;
-                            if (id.startsWith(userRootDir)) {
-                                assertPosixPath(id);
-                                assertModuleId(id);
-                                let name;
-                                const isNodeModules = id.match(/node_modules\/([^\/]+)\/(?!.*node_modules)/);
-                                if (isNodeModules) {
-                                    name = isNodeModules[1];
+        configResolved: {
+            handler(config) {
+                const rollupOutputs = getRollupOutputs(config);
+                // We need to support multiple outputs: @vite/plugin-legacy adds an output, see https://github.com/vikejs/vike/issues/477#issuecomment-1406434802
+                rollupOutputs.forEach((rollupOutput) => {
+                    if (!('entryFileNames' in rollupOutput)) {
+                        rollupOutput.entryFileNames = (chunkInfo) => getEntryFileName(chunkInfo, config, true);
+                    }
+                    if (!('chunkFileNames' in rollupOutput)) {
+                        rollupOutput.chunkFileNames = (chunkInfo) => getChunkFileName(chunkInfo, config);
+                    }
+                    if (!('assetFileNames' in rollupOutput)) {
+                        rollupOutput.assetFileNames = (chunkInfo) => getAssetFileName(chunkInfo, config);
+                        rollupOutput.assetFileNames.isTheOneSetByVike = true;
+                        assert(rollupOutput.assetFileNames.isTheOneSetByVike);
+                    }
+                    else {
+                        // If a user needs this:
+                        //  - assertUsage() that the naming provided by the user ends with `.[hash][extname]`
+                        //    - It's needed for getHash() of handleAssetsManifest()
+                        //    - Asset URLs should always contain a hash: it's paramount for caching assets.
+                        //    - If rollupOutput.assetFileNames is a function then use a wrapper function to apply the assertUsage()
+                        assertUsage(rollupOutput.assetFileNames.isTheOneSetByVike, "Setting Vite's configuration build.rollupOptions.output.assetFileNames is currently forbidden. Reach out if you need to use it.");
+                    }
+                    {
+                        const manualChunksOriginal = rollupOutput.manualChunks;
+                        rollupOutput.manualChunks = function (id, ...args) {
+                            if (manualChunksOriginal) {
+                                if (isCallable(manualChunksOriginal)) {
+                                    const result = manualChunksOriginal.call(this, id, ...args);
+                                    if (result !== undefined)
+                                        return result;
                                 }
                                 else {
-                                    const filePath = getModuleFilePathAbsolute(id, config);
-                                    name = filePath;
-                                    name = name.split('.').slice(0, -1).join('.'); // remove file extension
-                                    name = name.split('/').filter(Boolean).join('_');
+                                    assertUsage(false, "The Vite's configuration build.rollupOptions.output.manualChunks must be a function. Reach out if you need to set it to another value.");
                                 }
-                                // Make fileHash the same between local development and CI
-                                const idStable = path.posix.relative(userRootDir, id);
-                                // Don't remove `?` queries because each `id` should belong to a unique bundle.
-                                const hash = getIdHash(idStable);
-                                return `${name}-${hash}`;
                             }
-                            else {
-                                let name;
-                                const isVirtualModule = id.match(/virtual:([^:]+):/);
-                                if (isVirtualModule) {
-                                    name = isVirtualModule[1];
-                                    assert(name);
-                                }
-                                else if (
-                                // https://github.com/vikejs/vike/issues/1818#issuecomment-2298478321
-                                id.startsWith('/__uno')) {
-                                    name = 'uno';
+                            // Disable CSS bundling to workaround https://github.com/vikejs/vike/issues/1815
+                            // TO-DO/eventually: let's bundle CSS again once Rolldown replaces Rollup
+                            if (id.endsWith('.css')) {
+                                const userRootDir = config.root;
+                                if (id.startsWith(userRootDir)) {
+                                    assertPosixPath(id);
+                                    assertModuleId(id);
+                                    let name;
+                                    const isNodeModules = id.match(/node_modules\/([^\/]+)\/(?!.*node_modules)/);
+                                    if (isNodeModules) {
+                                        name = isNodeModules[1];
+                                    }
+                                    else {
+                                        const filePath = getModuleFilePathAbsolute(id, config);
+                                        name = filePath;
+                                        name = name.split('.').slice(0, -1).join('.'); // remove file extension
+                                        name = name.split('/').filter(Boolean).join('_');
+                                    }
+                                    // Make fileHash the same between local development and CI
+                                    const idStable = path.posix.relative(userRootDir, id);
+                                    // Don't remove `?` queries because each `id` should belong to a unique bundle.
+                                    const hash = getIdHash(idStable);
+                                    return `${name}-${hash}`;
                                 }
                                 else {
-                                    name = 'style';
+                                    let name;
+                                    const isVirtualModule = id.match(/virtual:([^:]+):/);
+                                    if (isVirtualModule) {
+                                        name = isVirtualModule[1];
+                                        assert(name);
+                                    }
+                                    else if (
+                                    // https://github.com/vikejs/vike/issues/1818#issuecomment-2298478321
+                                    id.startsWith('/__uno')) {
+                                        name = 'uno';
+                                    }
+                                    else {
+                                        name = 'style';
+                                    }
+                                    const hash = getIdHash(id);
+                                    return `${name}-${hash}`;
                                 }
-                                const hash = getIdHash(id);
-                                return `${name}-${hash}`;
                             }
-                        }
-                    };
-                }
-            });
+                        };
+                    }
+                });
+            },
         },
     };
 }

package/dist/esm/node/vite/plugins/pluginBuild/pluginDistPackageJsonFile.js

@@ -6,21 +6,25 @@ function pluginDistPackageJsonFile() {
     return {
         name: 'vike:build:pluginDistPackageJsonFile',
         apply: 'build',
-        configResolved(config_) {
-            config = config_;
+        configResolved: {
+            handler(config_) {
+                config = config_;
+            },
         },
-        generateBundle(options, bundle) {
-            if (!isViteServerSide(config, this.environment))
-                return;
-            const isEsm = rollupIsEsm(options);
-            const fileName = 'package.json';
-            if (bundle[fileName])
-                return; // E.g. already generated by Telefunc / vike
-            this.emitFile({
-                fileName,
-                type: 'asset',
-                source: getPackageJsonContent(isEsm),
-            });
+        generateBundle: {
+            handler(options, bundle) {
+                if (!isViteServerSide(config, this.environment))
+                    return;
+                const isEsm = rollupIsEsm(options);
+                const fileName = 'package.json';
+                if (bundle[fileName])
+                    return; // E.g. already generated by Telefunc / vike
+                this.emitFile({
+                    fileName,
+                    type: 'asset',
+                    source: getPackageJsonContent(isEsm),
+                });
+            },
         },
     };
 }

package/dist/esm/node/vite/plugins/pluginBuild/pluginModuleBanner.js

@@ -10,8 +10,10 @@ function pluginModuleBanner() {
         name: 'vike:build:pluginModuleBanner',
         enforce: 'post',
         apply: 'build',
-        configResolved(config_) {
-            config = config_;
+        configResolved: {
+            handler(config_) {
+                config = config_;
+            },
         },
         transform: {
             order: 'post',

package/dist/esm/node/vite/plugins/pluginBuild/pluginProdBuildEntry.js

@@ -17,8 +17,10 @@ function pluginProdBuildEntry() {
             name: 'vike:build:pluginProdBuildEntry',
             apply: 'build',
             enforce: 'post',
-            async configResolved(config_) {
-                config = config_;
+            configResolved: {
+                async handler(config_) {
+                    config = config_;
+                },
             },
         },
         ...serverProductionEntryPlugin({

package/dist/esm/node/vite/plugins/pluginBuild/pluginSuppressRollupWarning.js

@@ -5,24 +5,26 @@ function pluginSuppressRollupWarning() {
         name: 'vike:build:pluginSuppressRollupWarning',
         apply: 'build',
         enforce: 'post',
-        async configResolved(config) {
-            const onWarnOriginal = config.build.rollupOptions.onwarn;
-            config.build.rollupOptions.onwarn = function (warning, warn) {
-                // Suppress
-                if (suppressUnusedImport(warning))
-                    return;
-                if (suppressEmptyBundle(warning))
-                    return;
-                if (suppressUseClientDirective(warning))
-                    return;
-                // Pass through
-                if (onWarnOriginal) {
-                    onWarnOriginal.apply(this, arguments);
-                }
-                else {
-                    warn(warning);
-                }
-            };
+        configResolved: {
+            async handler(config) {
+                const onWarnOriginal = config.build.rollupOptions.onwarn;
+                config.build.rollupOptions.onwarn = function (warning, warn) {
+                    // Suppress
+                    if (suppressUnusedImport(warning))
+                        return;
+                    if (suppressEmptyBundle(warning))
+                        return;
+                    if (suppressUseClientDirective(warning))
+                        return;
+                    // Pass through
+                    if (onWarnOriginal) {
+                        onWarnOriginal.apply(this, arguments);
+                    }
+                    else {
+                        warn(warning);
+                    }
+                };
+            },
         },
     };
 }

package/dist/esm/node/vite/plugins/pluginCommon.js

@@ -1,9 +1,8 @@
 export { pluginCommon };
-import { assert, assertUsage, assertWarning, findPackageJson, hasProp, isDevCheck, isDocker, isObject, isVitest, } from '../utils.js';
+import { assert, assertUsage, assertWarning, hasProp, isDevCheck, isDocker, isObject, isVitest, } from '../utils.js';
 import { assertRollupInput } from './pluginBuild/pluginBuildConfig.js';
 import { installRequireShim_setUserRootDir } from '@brillout/require-shim';
 import pc from '@brillout/picocolors';
-import path from 'node:path';
 import { assertResolveAlias } from './pluginCommon/assertResolveAlias.js';
 import { isViteCliCall } from '../shared/isViteCliCall.js';
 import { isVikeCliOrApi } from '../../api/context.js';
@@ -42,10 +41,12 @@ function pluginCommon(vikeVitePluginOptions) {
         },
         {
             name: pluginName,
-            configResolved(config) {
-                assertViteRoot(config._rootResolvedEarly, config);
-                assertSingleInstance(config);
-                installRequireShim_setUserRootDir(config.root);
+            configResolved: {
+                handler(config) {
+                    assertViteRoot(config._rootResolvedEarly, config);
+                    assertSingleInstance(config);
+                    installRequireShim_setUserRootDir(config.root);
+                },
             },
         },
         {
@@ -64,7 +65,6 @@ function pluginCommon(vikeVitePluginOptions) {
                     workaroundCI(config);
                     assertRollupInput(config);
                     assertResolveAlias(config);
-                    assertEsm(config.root);
                     assertVikeCliOrApi(config);
                     temp_supportOldInterface(config);
                     await emitServerEntryOnlyIfNeeded(config);
@@ -107,7 +107,7 @@ function setDefault(setting, value, configFromUser, configFromVike) {
 /*
 import { version } from 'vite'
 function overrideViteDefaultSsrExternal(config: ResolvedConfig) {
-  if (!isVersionOrAbove(version, '5.0.12')) return
+  if (!isVersionMatch(version, ['5.0.12'])) return
   // @ts-ignore Not released yet: https://github.com/vitejs/vite/pull/10939/files#diff-5a3d42620df2c6b17e25f440ffdb67683dee7ef57317674d19f41d5f30502310L5
   config.ssr.external ??= true
 }
@@ -120,20 +120,6 @@ function workaroundCI(config) {
         (_b = config.preview).host ?? (_b.host = true);
     }
 }
-function assertEsm(userViteRoot) {
-    const found = findPackageJson(userViteRoot);
-    if (!found)
-        return;
-    const { packageJson, packageJsonPath } = found;
-    let dir = path.posix.dirname(packageJsonPath);
-    if (dir !== '/') {
-        assert(!dir.endsWith('/'));
-        dir = dir + '/';
-    }
-    assert(dir.endsWith('/'));
-    dir = pc.dim(dir);
-    assertWarning(packageJson.type === 'module', `We recommend setting ${dir}package.json#type to "module", see https://vike.dev/CJS`, { onlyOnce: true });
-}
 function assertSingleInstance(config) {
     const numberOfInstances = config.plugins.filter((o) => o.name === pluginName).length;
     assertUsage(numberOfInstances === 1, `Vike's Vite plugin (${pc.cyan("import vike from 'vike/plugin'")}) is being added ${numberOfInstances} times to the list of Vite plugins. Make sure to add it only once instead.`);

package/dist/esm/node/vite/plugins/pluginDev.js

@@ -17,54 +17,58 @@ function pluginDev() {
         {
             name: 'vike:pluginDev',
             apply: applyDev,
-            config() {
-                return {
-                    appType: 'custom',
-                    // TO-DO/next-major-release: remove (AFAICT we only need to use config.optimizeDeps for the old design)
-                    optimizeDeps: {
-                        exclude: [
-                            // We exclude Vike's client runtime to be able to use Vite's import.meta.glob()
-                            'vike/client',
-                            'vike/client/router',
-                            // It seems like client-side/isomorphic imports also need to be excluded, in order to avoid the following:
-                            //   ```
-                            //   Client runtime loaded twice https://vike.dev/client-runtime-duplicated
-                            //   ```
-                            'vike/routing',
-                            'vike/getPageContext',
-                            // We exclude @brillout/json-serializer and @brillout/picocolors to avoid:
-                            // ```
-                            // 9:28:58 AM [vite] ✨ new dependencies optimized: @brillout/json-serializer/parse
-                            // 9:28:58 AM [vite] ✨ optimized dependencies changed. reloading
-                            // ```
-                            '@brillout/json-serializer/parse',
-                            '@brillout/json-serializer/stringify',
-                            '@brillout/picocolors',
-                            // We exclude all packages that depend on any optimizeDeps.exclude entry because, otherwise, the entry cannot be resolved when using pnpm. For example:
-                            // ```
-                            // Failed to resolve import "@brillout/json-serializer/parse" from "../../packages/vike-react-query/dist/renderer/VikeReactQueryWrapper.js". Does the file exist?
-                            // 343|  // ../../node_modules/.pnpm/react-streaming@0.3.16_react-dom@18.2.0_react@18.2.0/node_modules/react-streaming/dist/esm/client/useAsync.js
-                            // 344|  import { parse as parse2 } from "@brillout/json-serializer/parse";
-                            // ```
-                            // The source map is confusing, the import actually lives at node_modules/.vite/deps/vike-react-query_renderer_VikeReactQueryWrapper.js which contains:
-                            // ```js
-                            // // ../../node_modules/.pnpm/react-streaming@0.3.16_react-dom@18.2.0_react@18.2.0/node_modules/react-streaming/dist/esm/client/useAsync.js
-                            // import { parse as parse2 } from "@brillout/json-serializer/parse";
-                            // ```
-                            'react-streaming',
-                        ],
-                    },
-                };
+            config: {
+                handler() {
+                    return {
+                        appType: 'custom',
+                        // TO-DO/next-major-release: remove (AFAICT we only need to use config.optimizeDeps for the old design)
+                        optimizeDeps: {
+                            exclude: [
+                                // We exclude Vike's client runtime to be able to use Vite's import.meta.glob()
+                                'vike/client',
+                                'vike/client/router',
+                                // It seems like client-side/isomorphic imports also need to be excluded, in order to avoid the following:
+                                //   ```
+                                //   Client runtime loaded twice https://vike.dev/client-runtime-duplicated
+                                //   ```
+                                'vike/routing',
+                                'vike/getPageContext',
+                                // We exclude @brillout/json-serializer and @brillout/picocolors to avoid:
+                                // ```
+                                // 9:28:58 AM [vite] ✨ new dependencies optimized: @brillout/json-serializer/parse
+                                // 9:28:58 AM [vite] ✨ optimized dependencies changed. reloading
+                                // ```
+                                '@brillout/json-serializer/parse',
+                                '@brillout/json-serializer/stringify',
+                                '@brillout/picocolors',
+                                // We exclude all packages that depend on any optimizeDeps.exclude entry because, otherwise, the entry cannot be resolved when using pnpm. For example:
+                                // ```
+                                // Failed to resolve import "@brillout/json-serializer/parse" from "../../packages/vike-react-query/dist/renderer/VikeReactQueryWrapper.js". Does the file exist?
+                                // 343|  // ../../node_modules/.pnpm/react-streaming@0.3.16_react-dom@18.2.0_react@18.2.0/node_modules/react-streaming/dist/esm/client/useAsync.js
+                                // 344|  import { parse as parse2 } from "@brillout/json-serializer/parse";
+                                // ```
+                                // The source map is confusing, the import actually lives at node_modules/.vite/deps/vike-react-query_renderer_VikeReactQueryWrapper.js which contains:
+                                // ```js
+                                // // ../../node_modules/.pnpm/react-streaming@0.3.16_react-dom@18.2.0_react@18.2.0/node_modules/react-streaming/dist/esm/client/useAsync.js
+                                // import { parse as parse2 } from "@brillout/json-serializer/parse";
+                                // ```
+                                'react-streaming',
+                            ],
+                        },
+                    };
+                },
             },
-            async configResolved(config_) {
-                config = config_;
-                await determineOptimizeDeps(config);
-                await determineFsAllowList(config);
-                if (!isErrorDebug()) {
-                    await installHttpRequestAsyncStore();
-                    improveViteLogs(config);
-                }
-                logDockerHint(config.server.host);
+            configResolved: {
+                async handler(config_) {
+                    config = config_;
+                    await determineOptimizeDeps(config);
+                    await determineFsAllowList(config);
+                    if (!isErrorDebug()) {
+                        await installHttpRequestAsyncStore();
+                        improveViteLogs(config);
+                    }
+                    logDockerHint(config.server.host);
+                },
             },
         },
         {

package/dist/esm/node/vite/plugins/pluginEnvVars.js

@@ -20,66 +20,72 @@ function pluginEnvVars() {
     return {
         name: 'vike:pluginEnvVars',
         enforce: 'post',
-        configResolved(config_) {
-            config = config_;
-            envsAll = loadEnv(config.mode, config.envDir || config.root, '');
-            config.plugins.sort(lowerFirst((plugin) => (plugin.name === 'vite:define' ? 1 : 0)));
+        configResolved: {
+            handler(config_) {
+                config = config_;
+                envsAll = loadEnv(config.mode, config.envDir || config.root, '');
+                config.plugins.sort(lowerFirst((plugin) => (plugin.name === 'vite:define' ? 1 : 0)));
+            },
         },
-        transform(code, id, options) {
-            id = normalizeId(id);
-            assertPosixPath(id);
-            if (id.includes('/node_modules/'))
-                return;
-            assertPosixPath(config.root);
-            if (!id.startsWith(config.root))
-                return;
-            if (!code.includes('import.meta.env.'))
-                return;
-            const isBuild = config.command === 'build';
-            const isClientSide = !isViteServerSide_extraSafe(config, this.environment, options);
-            const { magicString, getMagicStringResult } = getMagicString(code, id);
-            // Find & check
-            const replacements = Object.entries(envsAll)
-                .filter(([key]) => {
-                // Already handled by Vite
-                const envPrefix = !config.envPrefix ? [] : isArray(config.envPrefix) ? config.envPrefix : [config.envPrefix];
-                return !envPrefix.some((prefix) => key.startsWith(prefix));
-            })
-                .map(([envName, envVal]) => {
-                const envStatement = `import.meta.env.${envName}`;
-                const envStatementRegExpStr = escapeRegex(envStatement) + '\\b';
-                // Security check
-                {
-                    const isPrivate = !envName.startsWith(PUBLIC_ENV_PREFIX) && !PUBLIC_ENV_ALLOWLIST.includes(envName);
-                    if (isPrivate && isClientSide) {
-                        if (!new RegExp(envStatementRegExpStr).test(code))
-                            return;
-                        const modulePath = getModuleFilePathAbsolute(id, config);
-                        const errMsgAddendum = isBuild ? '' : ' (Vike will prevent your app from building for production)';
-                        const keyPublic = `${PUBLIC_ENV_PREFIX}${envName}`;
-                        const errMsg = `${envStatement} is used in client-side file ${modulePath} which means that the environment variable ${envName} will be included in client-side bundles and, therefore, ${envName} will be publicly exposed which can be a security leak${errMsgAddendum}. Use ${envStatement} only in server-side files, or rename ${envName} to ${keyPublic}, see https://vike.dev/env`;
-                        if (isBuild) {
-                            assertUsage(false, errMsg);
-                        }
-                        else {
-                            // - Only a warning for faster development DX (e.g. when user toggles `ssr: boolean` or `onBeforeRenderIsomorph: boolean`).
-                            // - But only showing a warning can be confusing: https://github.com/vikejs/vike/issues/1641
-                            assertWarning(false, errMsg, { onlyOnce: true });
+        transform: {
+            handler(code, id, options) {
+                id = normalizeId(id);
+                assertPosixPath(id);
+                if (id.includes('/node_modules/'))
+                    return;
+                assertPosixPath(config.root);
+                if (!id.startsWith(config.root))
+                    return;
+                if (!code.includes('import.meta.env.'))
+                    return;
+                const isBuild = config.command === 'build';
+                const isClientSide = !isViteServerSide_extraSafe(config, this.environment, options);
+                const { magicString, getMagicStringResult } = getMagicString(code, id);
+                // Find & check
+                const replacements = Object.entries(envsAll)
+                    .filter(([key]) => {
+                    // Already handled by Vite
+                    const envPrefix = !config.envPrefix ? [] : isArray(config.envPrefix) ? config.envPrefix : [config.envPrefix];
+                    return !envPrefix.some((prefix) => key.startsWith(prefix));
+                })
+                    .map(([envName, envVal]) => {
+                    const envStatement = `import.meta.env.${envName}`;
+                    const envStatementRegExpStr = escapeRegex(envStatement) + '\\b';
+                    // Security check
+                    {
+                        const isPrivate = !envName.startsWith(PUBLIC_ENV_PREFIX) && !PUBLIC_ENV_ALLOWLIST.includes(envName);
+                        if (isPrivate && isClientSide) {
+                            if (!new RegExp(envStatementRegExpStr).test(code))
+                                return;
+                            const modulePath = getModuleFilePathAbsolute(id, config);
+                            const errMsgAddendum = isBuild
+                                ? ''
+                                : ' (Vike will prevent your app from building for production)';
+                            const keyPublic = `${PUBLIC_ENV_PREFIX}${envName}`;
+                            const errMsg = `${envStatement} is used in client-side file ${modulePath} which means that the environment variable ${envName} will be included in client-side bundles and, therefore, ${envName} will be publicly exposed which can be a security leak${errMsgAddendum}. Use ${envStatement} only in server-side files, or rename ${envName} to ${keyPublic}, see https://vike.dev/env`;
+                            if (isBuild) {
+                                assertUsage(false, errMsg);
+                            }
+                            else {
+                                // - Only a warning for faster development DX (e.g. when user toggles `ssr: boolean` or `onBeforeRenderIsomorph: boolean`).
+                                // - But only showing a warning can be confusing: https://github.com/vikejs/vike/issues/1641
+                                assertWarning(false, errMsg, { onlyOnce: true });
+                            }
                         }
+                        // Double check
+                        assert(!(isPrivate && isClientSide) || !isBuild);
                     }
-                    // Double check
-                    assert(!(isPrivate && isClientSide) || !isBuild);
-                }
-                return { regExpStr: envStatementRegExpStr, replacement: envVal };
-            })
-                .filter(isNotNullish);
-            // Apply
-            replacements.forEach(({ regExpStr, replacement }) => {
-                magicString.replaceAll(new RegExp(regExpStr, 'g'), JSON.stringify(replacement));
-            });
-            if (!magicString.hasChanged())
-                return null;
-            return getMagicStringResult();
+                    return { regExpStr: envStatementRegExpStr, replacement: envVal };
+                })
+                    .filter(isNotNullish);
+                // Apply
+                replacements.forEach(({ regExpStr, replacement }) => {
+                    magicString.replaceAll(new RegExp(regExpStr, 'g'), JSON.stringify(replacement));
+                });
+                if (!magicString.hasChanged())
+                    return null;
+                return getMagicStringResult();
+            },
         },
     };
 }