vike 0.4.240 → 0.4.241-commit-60b0676

package/dist/esm/node/vite/index.js

@@ -6,7 +6,7 @@ export { getVikeConfig } from './shared/resolveVikeConfigInternal.js';
 export { PROJECT_VERSION as version } from './utils.js';
 import { getClientEntrySrcDev } from './shared/getClientEntrySrcDev.js';
 import { setGetClientEntrySrcDev } from '../runtime/renderPage/getPageAssets/retrievePageAssetsDev.js';
-import { assertIsNotProductionRuntime, assertUsage } from './utils.js';
+import { assertIsNotProductionRuntime, assertUsage, isVitest } from './utils.js';
 import pc from '@brillout/picocolors';
 import { pluginPreview } from './plugins/pluginPreview.js';
 import { pluginDev } from './plugins/pluginDev.js';
@@ -16,12 +16,12 @@ import { pluginExtractExportNames } from './plugins/pluginExtractExportNames.js'
 import { pluginSetGlobalContext } from './plugins/pluginSetGlobalContext.js';
 import { pluginCommon } from './plugins/pluginCommon.js';
 import { pluginBaseUrls } from './plugins/pluginBaseUrls.js';
-import { pluginEnvVars } from './plugins/pluginEnvVars.js';
+import { pluginReplaceConstantsEnvVars } from './plugins/pluginReplaceConstantsEnvVars.js';
 import { pluginFileEnv } from './plugins/pluginFileEnv.js';
 import { pluginWorkaroundCssModuleHmr } from './plugins/pluginWorkaroundCssModuleHmr.js';
 import { pluginWorkaroundVite6HmrRegression } from './plugins/pluginWorkaroundVite6HmrRegression.js';
-import { pluginReplaceIsClientSide } from './plugins/pluginReplaceIsClientSide.js';
-import { pluginReplaceGlobalThisConstants } from './plugins/pluginReplaceGlobalThisConstants.js';
+import { pluginReplaceConstantsPageContext } from './plugins/pluginReplaceConstantsPageContext.js';
+import { pluginReplaceConstantsGlobalThis } from './plugins/pluginReplaceConstantsGlobalThis.js';
 import { pluginViteRPC } from './plugins/non-runnable-dev/pluginViteRPC.js';
 import { pluginBuildApp } from './plugins/build/pluginBuildApp.js';
 import { pluginDistPackageJsonFile } from './plugins/build/pluginDistPackageJsonFile.js';
@@ -31,31 +31,40 @@ import { pluginProdBuildEntry } from './plugins/build/pluginProdBuildEntry.js';
 import { pluginBuildConfig } from './plugins/build/pluginBuildConfig.js';
 import { pluginModuleBanner } from './plugins/build/pluginModuleBanner.js';
 import { pluginReplaceConstantsNonRunnableDev } from './plugins/non-runnable-dev/pluginReplaceConstantsNonRunnableDev.js';
+import { isVikeCliOrApi } from '../api/context.js';
+import { pluginViteConfigVikeExtensions } from './plugins/pluginViteConfigVikeExtensions.js';
+import { isOnlyResolvingUserConfig } from '../api/resolveViteConfigFromUser.js';
 // We don't call this in ./onLoad.ts to avoid a cyclic dependency with utils.ts
 setGetClientEntrySrcDev(getClientEntrySrcDev);
 assertIsNotProductionRuntime();
 // Return `PluginInterop` instead of `Plugin` to avoid type mismatch upon different Vite versions
 function plugin(vikeVitePluginOptions = {}) {
-    const plugins = [
-        ...pluginCommon(vikeVitePluginOptions),
-        ...pluginVirtualFiles(),
-        ...pluginDev(),
-        ...pluginBuild(),
-        ...pluginPreview(),
-        ...pluginExtractAssets(),
-        ...pluginExtractExportNames(),
-        ...pluginSetGlobalContext(),
-        ...pluginBaseUrls(),
-        ...pluginEnvVars(),
-        ...pluginFileEnv(),
-        ...pluginWorkaroundCssModuleHmr(),
-        ...pluginWorkaroundVite6HmrRegression(),
-        ...pluginReplaceIsClientSide(),
-        ...pluginReplaceGlobalThisConstants(),
-        ...pluginNonRunnabeDev(),
-    ];
-    Object.assign(plugins, { _vikeVitePluginOptions: vikeVitePluginOptions });
-    return plugins;
+    const promise = (async () => {
+        if (skip())
+            return [];
+        const plugins = [
+            ...pluginCommon(vikeVitePluginOptions),
+            ...pluginVirtualFiles(),
+            ...pluginDev(),
+            ...pluginBuild(),
+            ...pluginPreview(),
+            ...pluginExtractAssets(),
+            ...pluginExtractExportNames(),
+            ...pluginSetGlobalContext(),
+            ...pluginBaseUrls(),
+            ...pluginReplaceConstantsEnvVars(),
+            ...pluginFileEnv(),
+            ...pluginWorkaroundCssModuleHmr(),
+            ...pluginWorkaroundVite6HmrRegression(),
+            ...pluginReplaceConstantsPageContext(),
+            ...pluginReplaceConstantsGlobalThis(),
+            ...pluginNonRunnabeDev(),
+            ...(await pluginViteConfigVikeExtensions()),
+        ];
+        return plugins;
+    })();
+    Object.assign(promise, { _vikeVitePluginOptions: vikeVitePluginOptions });
+    return promise;
 }
 function pluginBuild() {
     return [
@@ -71,6 +80,28 @@ function pluginBuild() {
 function pluginNonRunnabeDev() {
     return [...pluginViteRPC(), ...pluginReplaceConstantsNonRunnableDev()];
 }
+function skip() {
+    // Early resolving of user Vite configs
+    if (isOnlyResolvingUserConfig()) {
+        return true;
+    }
+    // For Vitest, we only add Vike's Vite plugin if Vike's JavaScript API is used.
+    // - In the context of running unit tests with Vitest, Vike's Vite plugin doesn't add any value AFAICT.
+    // - If the user calls Vike's JavaScript API inside Vitest (e.g. `build()` inside `beforeAll()`)  => vite.config.js is loaded twice: once by Vitest and once by Vike => problematic because Vitest's environment is `development` whereas Vike's `build()` environment is `production` => the globalContext.ts isProd() function throws an assertion fail (I don't know why the two globalContext.ts instances aren't independent from each other) => that's why we skip Vike's Vite plugin when it's Vitest that loads vite.config.js
+    //   - When calling `$ vitest` Vitest loads vite.config.js if it lives at process.cwd()
+    // - The user is supposed to use Vike's API instead of Vite's API. Vike supports Vite's API only for third parties (e.g. Vitest or Storybook).
+    // - https://vike.dev/vitest
+    if (
+    /* Maybe also all third party tools such as Storybook?
+    !isViteCli() &&
+    /*/
+    isVitest() &&
+        ///*/
+        !isVikeCliOrApi()) {
+        return true;
+    }
+    return false;
+}
 // Error upon wrong usage
 Object.defineProperty(plugin, 'apply', {
     enumerable: true,

package/dist/esm/node/vite/onLoad.js

@@ -2,18 +2,13 @@ export { onLoad };
 import { assertIsNotBrowser } from '../../utils/assertIsNotBrowser.js';
 import { assertIsNotProductionRuntime, markSetup_vikeVitePlugin } from '../../utils/assertSetup.js';
 import { assertNodeVersion } from '../../utils/assertNodeVersion.js';
-import { assertVersion } from '../../utils/assertVersion.js';
-import { version } from 'vite';
+import { version as viteVersion } from 'vite';
+import { assertViteVersion } from '../../utils/assertViteVersion.js';
 function onLoad() {
     markSetup_vikeVitePlugin();
     assertIsNotBrowser();
     assertNodeVersion();
-    // package.json#peerDependencies isn't enough as users often ignore it
-    // This assertion isn't reliable: the user may still use a Vite version older than 6.0.0 — see https://github.com/vitejs/vite/pull/19355
-    // TO-DO/eventually: let's also use this.meta.viteVersion
-    // - https://github.com/vitejs/vite/pull/20088
-    // - https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md#700-2025-06-24
-    assertVersion('Vite', version, ['6.3.0']);
+    assertViteVersion(viteVersion);
     // Ensure we don't bloat the server runtime with heavy dependencies such Vite and esbuild
     assertIsNotProductionRuntime();
 }

package/dist/esm/node/vite/plugins/build/handleAssetsManifest.js

@@ -310,7 +310,6 @@ async function handleAssetsManifest_getBuildConfig() {
 async function handleAssetsManifest(config, viteEnv, options, bundle) {
     const isSsrEnv = isViteServerSide_onlySsrEnv(config, viteEnv);
     if (isSsrEnv) {
-        assert(!globalObject.assetsJsonFilePath);
         const outDirs = getOutDirs(config, viteEnv);
         globalObject.assetsJsonFilePath = path.posix.join(outDirs.outDirRoot, 'assets.json');
         await writeAssetsManifestFile(globalObject.assetsJsonFilePath, config);

package/dist/esm/node/vite/plugins/build/pluginBuildApp.js

@@ -3,7 +3,7 @@ import { runPrerender_forceExit } from '../../../prerender/runPrerenderEntry.js'
 import { resolveOutDir } from '../../shared/getOutDirs.js';
 import { assert, assertWarning, getGlobalObject, onSetupBuild } from '../../utils.js';
 import { isPrerenderAutoRunEnabled, wasPrerenderRun } from '../../../prerender/context.js';
-import { isViteCliCall, getViteConfigFromCli } from '../../shared/isViteCliCall.js';
+import { isViteCli, getViteConfigForBuildFromCli } from '../../shared/isViteCli.js';
 import pc from '@brillout/picocolors';
 import { logErrorHint } from '../../../runtime/renderPage/logErrorHint.js';
 import { getVikeConfigInternal } from '../../shared/resolveVikeConfigInternal.js';
@@ -142,7 +142,7 @@ async function triggerPrerendering(config, viteEnv, bundle) {
 }
 async function abortViteBuildSsr() {
     const vikeConfig = await getVikeConfigInternal();
-    if (vikeConfig.config.disableAutoFullBuild !== true && isViteCliCall() && getViteConfigFromCli()?.build.ssr) {
+    if (vikeConfig.config.disableAutoFullBuild !== true && isViteCli() && getViteConfigForBuildFromCli()?.build.ssr) {
         assertWarning(false, `The CLI call ${pc.cyan('$ vite build --ssr')} is superfluous since ${pc.cyan('$ vite build')} also builds the server-side. If you want two separate build steps then use https://vike.dev/disableAutoFullBuild or use Vite's ${pc.cyan('build()')} API.`, { onlyOnce: true });
         process.exit(0);
     }
@@ -150,7 +150,7 @@ async function abortViteBuildSsr() {
 function isDisabled(vikeConfig) {
     const { disableAutoFullBuild } = vikeConfig.config;
     if (disableAutoFullBuild === undefined || disableAutoFullBuild === 'prerender') {
-        const isUserUsingViteApi = !isViteCliCall() && !isVikeCliOrApi();
+        const isUserUsingViteApi = !isViteCli() && !isVikeCliOrApi();
         return isUserUsingViteApi;
     }
     else {
@@ -161,9 +161,9 @@ function isPrerenderForceExit() {
     return globalObject.forceExit;
 }
 function getFullBuildInlineConfig(config) {
-    const configFromCli = !isViteCliCall() ? null : getViteConfigFromCli();
-    if (config._viteConfigFromUserEnhanced) {
-        return config._viteConfigFromUserEnhanced;
+    const configFromCli = !isViteCli() ? null : getViteConfigForBuildFromCli();
+    if (config._viteConfigFromUserResolved) {
+        return config._viteConfigFromUserResolved;
     }
     else {
         return {

package/dist/esm/node/vite/plugins/build/pluginDistFileNames.js

@@ -6,7 +6,7 @@ import { assertPosixPath, assert, assertUsage, isArray, isCallable } from '../..
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { getAssetsDir } from '../../shared/getAssetsDir.js';
-import { assertModuleId, getModuleFilePathAbsolute } from '../../shared/getFilePath.js';
+import { assertModuleId, getFilePathToShowToUserModule } from '../../shared/getFilePath.js';
 function pluginDistFileNames() {
     return [
         {
@@ -63,7 +63,7 @@ function pluginDistFileNames() {
                                             name = isNodeModules[1];
                                         }
                                         else {
-                                            const filePath = getModuleFilePathAbsolute(id, config);
+                                            const filePath = getFilePathToShowToUserModule(id, config);
                                             name = filePath;
                                             name = name.split('.').slice(0, -1).join('.'); // remove file extension
                                             name = name.split('/').filter(Boolean).join('_');

package/dist/esm/node/vite/plugins/pluginCommon.d.ts

@@ -7,7 +7,7 @@ declare module 'vite' {
         _isDev?: boolean;
         _rootResolvedEarly?: string;
         _baseViteOriginal?: string;
-        _viteConfigFromUserEnhanced?: InlineConfig;
+        _viteConfigFromUserResolved?: InlineConfig;
     }
 }
 declare global {

package/dist/esm/node/vite/plugins/pluginCommon.js

@@ -1,13 +1,13 @@
 export { pluginCommon };
-import { assert, assertUsage, assertWarning, hasProp, isDevCheck, isDocker, isObject, isVitest } from '../utils.js';
+import { assert, assertUsage, assertWarning, hasProp, isDevCheck, isDocker, isExactlyOneTruthy, isObject, isVitest, } from '../utils.js';
 import { assertRollupInput } from './build/pluginBuildConfig.js';
 import { installRequireShim_setUserRootDir } from '@brillout/require-shim';
 import pc from '@brillout/picocolors';
 import { assertResolveAlias } from './pluginCommon/assertResolveAlias.js';
-import { isViteCliCall } from '../shared/isViteCliCall.js';
+import { isViteCli } from '../shared/isViteCli.js';
 import { isVikeCliOrApi } from '../../api/context.js';
 import { getVikeConfigInternal, setVikeConfigContext } from '../shared/resolveVikeConfigInternal.js';
-import { assertViteRoot, getViteRoot, normalizeViteRoot } from '../../api/prepareViteApiCall.js';
+import { assertViteRoot, getViteRoot, normalizeViteRoot } from '../../api/resolveViteConfigFromUser.js';
 import { temp_disablePrerenderAutoRun } from '../../prerender/context.js';
 const pluginName = 'vike:pluginCommon';
 globalThis.__VIKE__IS_PROCESS_SHARED_WITH_VITE = true;
@@ -20,12 +20,14 @@ function pluginCommon(vikeVitePluginOptions) {
                 order: 'pre',
                 async handler(configFromUser, env) {
                     const isDev = isDevCheck(env);
-                    const operation = env.command === 'build' ? 'build' : env.isPreview ? 'preview' : 'dev';
+                    const isBuild = env.command === 'build';
+                    const isPreview = env.isPreview;
+                    assert(isExactlyOneTruthy(isDev, isBuild, isPreview));
+                    const viteContext = isBuild ? 'build' : isPreview ? 'preview' : 'dev';
                     const rootResolvedEarly = configFromUser.root
                         ? normalizeViteRoot(configFromUser.root)
-                        : await getViteRoot(operation);
+                        : await getViteRoot(viteContext);
                     assert(rootResolvedEarly);
-                    // TO-DO/next-major-release: we can remove setVikeConfigContext() call here since with Vike's CLI it's already called at vike/node/api/prepareViteApiCall.ts
                     setVikeConfigContext({ userRootDir: rootResolvedEarly, isDev, vikeVitePluginOptions });
                     const vikeConfig = await getVikeConfigInternal();
                     return {
@@ -91,6 +93,11 @@ function pluginCommon(vikeVitePluginOptions) {
                         // Set `--host` for Docker/Podman
                         setDefault('host', true, configFromUser, configFromVike);
                     }
+                    // https://vike.dev/force
+                    if (vikeConfig.config.force !== undefined && configFromUser.optimizeDeps?.force === undefined) {
+                        configFromVike.optimizeDeps ?? (configFromVike.optimizeDeps = {});
+                        configFromVike.optimizeDeps.force = vikeConfig.config.force;
+                    }
                     return configFromVike;
                 },
             },
@@ -127,14 +134,20 @@ function assertSingleInstance(config) {
 function assertVikeCliOrApi(config) {
     if (isVikeCliOrApi())
         return;
-    if (isViteCliCall()) {
+    if (isViteCli()) {
         assert(!isVitest());
         return;
     }
+    /* This warning is always shown: Vitest loads Vite *before* any Vike JavaScript API can be invoked.
     if (isVitest()) {
-        assertWarning(false, `Unexpected Vitest setup: you seem to be using Vitest together with Vike's Vite plugin but without using Vike's JavaScript API which is unexpected, see ${pc.underline('https://vike.dev/vitest')}`, { onlyOnce: true });
-        return;
+      assertWarning(
+        false,
+        `Unexpected Vitest setup: you seem to be using Vitest together with Vike's Vite plugin but without using Vike's JavaScript API which is unexpected, see ${pc.underline('https://vike.dev/vitest')}`,
+        { onlyOnce: true },
+      )
+      return
     }
+    */
     if (config.server.middlewareMode) {
         assertWarning(false, `${pc.cyan('vite.createServer()')} is deprecated ${pc.underline('https://vike.dev/migration/cli#api')}`, {
             onlyOnce: true,

package/dist/esm/node/vite/plugins/pluginFileEnv.js

@@ -3,7 +3,7 @@ import { assert, assertUsage, assertWarning, capitalizeFirstLetter, isFilePathAb
 import { extractAssetsRE } from './pluginExtractAssets.js';
 import { extractExportNamesRE } from './pluginExtractExportNames.js';
 import pc from '@brillout/picocolors';
-import { getModuleFilePathAbsolute } from '../shared/getFilePath.js';
+import { getFilePathToShowToUserModule } from '../shared/getFilePath.js';
 import { getExportNames } from '../shared/parseEsModule.js';
 import { normalizeId } from '../shared/normalizeId.js';
 import { isV1Design } from '../shared/resolveVikeConfigInternal.js';
@@ -42,8 +42,10 @@ function pluginFileEnv() {
                     if (id.endsWith('?direct'))
                         id = id.slice(0, -1 * '?direct'.length);
                     const moduleInfo = viteDevServer.moduleGraph.getModuleById(id);
-                    assert(moduleInfo);
-                    const importers = Array.from(moduleInfo.importers)
+                    /* It can fail, no clue why — https://github.com/vikejs/vike/issues/2740
+                    assert(moduleInfo, { moduleId })
+                    */
+                    const importers = (!moduleInfo ? [] : Array.from(moduleInfo.importers))
                         .map((m) => m.id)
                         .filter((id) => id !== null);
                     assertFileEnv(id, isViteServerSide_extraSafe(config, this.environment, options), importers, 
@@ -122,7 +124,7 @@ function pluginFileEnv() {
         const envActual = isServerSide ? 'server' : 'client';
         const envExpect = isServerSide ? 'client' : 'server';
         let errMsg;
-        let modulePathPretty = getModuleFilePathAbsolute(modulePath, config);
+        let modulePathPretty = getFilePathToShowToUserModule(modulePath, config);
         if (!noColor) {
             const suffix = getSuffix(envExpect);
             modulePathPretty = modulePathPretty.replaceAll(suffix, pc.bold(suffix));
@@ -133,13 +135,14 @@ function pluginFileEnv() {
                 .filter((importer) => 
             // Can be Vike's virtual module: https://github.com/vikejs/vike/issues/2483
             isFilePathAbsolute(importer))
-                .map((importer) => getModuleFilePathAbsolute(importer, config));
+                .map((importer) => getFilePathToShowToUserModule(importer, config))
+                .map((importPath) => pc.cyan(importPath));
             if (importPaths.length > 0) {
                 errMsg += ` by ${joinEnglish(importPaths, 'and')}`;
             }
         }
         if (onlyWarn) {
-            errMsg += ' and, therefore, Vike will prevent building your app for production.';
+            errMsg += ". This is potentially a security issue and Vike won't allow you to build your app for production.";
         }
         return errMsg;
     }

package/dist/esm/node/vite/plugins/pluginReplaceConstantsEnvVars.d.ts

@@ -0,0 +1,3 @@
+export { pluginReplaceConstantsEnvVars };
+import type { Plugin } from 'vite';
+declare function pluginReplaceConstantsEnvVars(): Plugin[];

package/dist/esm/node/vite/plugins/pluginReplaceConstantsEnvVars.js

@@ -0,0 +1,129 @@
+export { pluginReplaceConstantsEnvVars };
+import { loadEnv } from 'vite';
+import { assert, assertPosixPath, assertUsage, assertWarning, escapeRegex, isArray, isNotNullish, lowerFirst, } from '../utils.js';
+import { getFilePathToShowToUserModule } from '../shared/getFilePath.js';
+import { normalizeId } from '../shared/normalizeId.js';
+import { isViteServerSide_extraSafe } from '../shared/isViteServerSide.js';
+import { getMagicString } from '../shared/getMagicString.js';
+const PUBLIC_ENV_PREFIX = 'PUBLIC_ENV__';
+const PUBLIC_ENV_ALLOWLIST = [
+    // https://github.com/vikejs/vike/issues/1724
+    'STORYBOOK',
+];
+// TO-DO/eventually:
+// - Make import.meta.env work inside +config.js
+//   - For it to work, we'll probably need the user to define the settings (e.g. `envDir`) for loadEnv() inside vike.config.js instead of vite.config.js
+//   - Or stop using Vite's `mode` implementation and have Vike implement its own `mode` feature? (So that the only dependencies are `$ vike build --mode staging` and `$ MODE=staging vike build`.)
+const skipNodeModules = '/node_modules/';
+const skipIrrelevant = 'import.meta.env.';
+const filterRolldown = {
+    id: {
+        exclude: `**${skipNodeModules}**`,
+    },
+    code: {
+        include: skipIrrelevant,
+    },
+};
+const filterFunction = (id, code) => {
+    if (id.includes(skipNodeModules))
+        return false;
+    if (!code.includes(skipIrrelevant))
+        return false;
+    return true;
+};
+function pluginReplaceConstantsEnvVars() {
+    let envVarsAll;
+    let envPrefix;
+    let config;
+    return [
+        {
+            name: 'vike:pluginReplaceConstantsEnvVars',
+            enforce: 'post',
+            configResolved: {
+                handler(config_) {
+                    config = config_;
+                    envVarsAll = loadEnv(config.mode, config.envDir || config.root, '');
+                    envPrefix = getEnvPrefix(config);
+                    config.plugins.sort(lowerFirst((plugin) => (plugin.name === 'vite:define' ? 1 : 0)));
+                },
+            },
+            transform: {
+                filter: filterRolldown,
+                handler(code, id, options) {
+                    id = normalizeId(id);
+                    assertPosixPath(id);
+                    assertPosixPath(config.root);
+                    if (!id.startsWith(config.root))
+                        return; // skip linked dependencies
+                    assert(filterFunction(id, code));
+                    const isBuild = config.command === 'build';
+                    const isClientSide = !isViteServerSide_extraSafe(config, this.environment, options);
+                    const { magicString, getMagicStringResult } = getMagicString(code, id);
+                    // Get regex operations
+                    const replacements = Object.entries(envVarsAll)
+                        // Skip env vars that start with [`config.envPrefix`](https://vite.dev/config/shared-options.html#envprefix) — they are already handled by Vite
+                        .filter(([envName]) => !envPrefix.some((prefix) => envName.startsWith(prefix)))
+                        // Skip constants like import.meta.env.DEV which are already handled by Vite
+                        .filter(([envName]) => !['DEV', 'PROD', 'SSR', 'MODE', 'BASE_URL'].includes(envName))
+                        .map(([envName, envVal]) => {
+                        const envStatement = `import.meta.env.${envName}`;
+                        const envStatementRegExpStr = escapeRegex(envStatement) + '\\b';
+                        // Show error (warning in dev) if client code contains a private environment variable (one that doesn't start with PUBLIC_ENV__ and that isn't included in `PUBLIC_ENV_ALLOWLIST`).
+                        if (isClientSide) {
+                            const skip = assertNoClientSideLeak({
+                                envName,
+                                envStatement,
+                                envStatementRegExpStr,
+                                code,
+                                id,
+                                config,
+                                isBuild,
+                            });
+                            if (skip)
+                                return null;
+                        }
+                        return { regExpStr: envStatementRegExpStr, replacement: envVal };
+                    })
+                        .filter(isNotNullish);
+                    // Apply regex operations
+                    replacements.forEach(({ regExpStr, replacement }) => {
+                        magicString.replaceAll(new RegExp(regExpStr, 'g'), JSON.stringify(replacement));
+                    });
+                    return getMagicStringResult();
+                },
+            },
+        },
+    ];
+}
+function getEnvPrefix(config) {
+    const { envPrefix } = config;
+    if (!envPrefix)
+        return [];
+    if (!isArray(envPrefix))
+        return [envPrefix];
+    return envPrefix;
+}
+function assertNoClientSideLeak({ envName, envStatement, envStatementRegExpStr, code, id, config, isBuild, }) {
+    const isPrivate = !envName.startsWith(PUBLIC_ENV_PREFIX) && !PUBLIC_ENV_ALLOWLIST.includes(envName);
+    // ✅ All good
+    if (!isPrivate)
+        return;
+    if (!new RegExp(envStatementRegExpStr).test(code))
+        return true;
+    // ❌ Security leak!
+    // - Warning in dev
+    // - assertUsage() and abort when building for production
+    const modulePath = getFilePathToShowToUserModule(id, config);
+    const errMsgAddendum = isBuild ? '' : ' (Vike will prevent your app from building for production)';
+    const envNameFixed = `${PUBLIC_ENV_PREFIX}${envName}`;
+    const errMsg = `${envStatement} is used in client-side file ${modulePath} which means that the environment variable ${envName} will be included in client-side bundles and, therefore, ${envName} will be publicly exposed which can be a security leak${errMsgAddendum}. Use ${envStatement} only in server-side files, or rename ${envName} to ${envNameFixed}, see https://vike.dev/env`;
+    if (isBuild) {
+        assertUsage(false, errMsg);
+    }
+    else {
+        // - Only a warning for faster development DX (e.g. when user toggles `ssr: boolean` or `onBeforeRenderIsomorph: boolean`).
+        // - Although only showing a warning can be confusing: https://github.com/vikejs/vike/issues/1641
+        assertWarning(false, errMsg, { onlyOnce: true });
+    }
+    assert(!isBuild); // we should abort if building for production
+}

package/dist/esm/node/vite/plugins/pluginReplaceConstantsGlobalThis.d.ts

@@ -0,0 +1,10 @@
+export { pluginReplaceConstantsGlobalThis };
+import type { Plugin } from 'vite';
+declare global {
+    /** Like `import.meta.env.DEV` but works for `node_modules/` packages with `ssr.external` */
+    var __VIKE__IS_DEV: boolean;
+    /** Like `import.meta.env.SSR` but works for `node_modules/` packages with `ssr.external` */
+    var __VIKE__IS_CLIENT: boolean;
+    var __VIKE__IS_DEBUG: boolean;
+}
+declare function pluginReplaceConstantsGlobalThis(): Plugin[];

package/dist/esm/node/vite/plugins/pluginReplaceConstantsGlobalThis.js

@@ -0,0 +1,77 @@
+export { pluginReplaceConstantsGlobalThis };
+import { assert, isDebug, addVirtualFileIdPrefix, escapeRegex } from '../utils.js';
+import { isViteServerSide_applyToEnvironment, isViteServerSide_configEnvironment, isViteServerSide_extraSafe, } from '../shared/isViteServerSide.js';
+const isDebugVal = isDebug();
+globalThis.__VIKE__IS_CLIENT = false;
+globalThis.__VIKE__IS_DEBUG = isDebugVal;
+const VIRTUAL_FILE_ID = 'virtual:vike:server:globalThis-constants';
+const filterRolldown = {
+    id: {
+        include: new RegExp(escapeRegex(VIRTUAL_FILE_ID)),
+    },
+};
+const filterFunction = (id) => id === VIRTUAL_FILE_ID || id === addVirtualFileIdPrefix(VIRTUAL_FILE_ID);
+function pluginReplaceConstantsGlobalThis() {
+    let config;
+    let isDev;
+    return [
+        {
+            name: 'vike:pluginReplaceConstantsGlobalThis:define',
+            config: {
+                handler(config) {
+                    assert(typeof config._isDev === 'boolean');
+                    isDev = config._isDev;
+                    globalThis.__VIKE__IS_DEV = isDev;
+                    return {
+                        define: {
+                            'globalThis.__VIKE__IS_DEV': JSON.stringify(isDev),
+                            'globalThis.__VIKE__IS_DEBUG': JSON.stringify(isDebugVal),
+                        },
+                    };
+                },
+            },
+            configEnvironment: {
+                handler(name, config) {
+                    const isClientSide = !isViteServerSide_configEnvironment(name, config);
+                    return {
+                        define: {
+                            'globalThis.__VIKE__IS_CLIENT': JSON.stringify(isClientSide),
+                        },
+                    };
+                },
+            },
+            configResolved(config_) {
+                config = config_;
+            },
+        },
+        {
+            name: 'vike:pluginReplaceConstantsGlobalThis:virtual-file',
+            // We only need the virtual file for the server-side (for node_modules/ packages with ssr.external) — the `define` values above always apply to the client-side.
+            applyToEnvironment(env) {
+                return isViteServerSide_applyToEnvironment(env);
+            },
+            resolveId: {
+                filter: filterRolldown,
+                handler(id) {
+                    assert(filterFunction(id));
+                    assert(id === VIRTUAL_FILE_ID);
+                    return addVirtualFileIdPrefix(id);
+                },
+            },
+            load: {
+                filter: filterRolldown,
+                handler(id, options) {
+                    assert(filterFunction(id));
+                    assert(isViteServerSide_extraSafe(config, this.environment, options));
+                    assert(typeof isDev === 'boolean');
+                    const code = [
+                        `globalThis.__VIKE__IS_DEV = ${JSON.stringify(isDev)};`,
+                        `globalThis.__VIKE__IS_CLIENT = false;`,
+                        `globalThis.__VIKE__IS_DEBUG = ${JSON.stringify(isDebugVal)};`,
+                    ].join('\n');
+                    return code;
+                },
+            },
+        },
+    ];
+}

package/dist/esm/node/vite/plugins/pluginReplaceConstantsPageContext.d.ts

@@ -0,0 +1,3 @@
+export { pluginReplaceConstantsPageContext };
+import type { Plugin } from 'vite';
+declare function pluginReplaceConstantsPageContext(): Plugin[];

package/dist/esm/node/vite/plugins/{pluginReplaceIsClientSide.js → pluginReplaceConstantsPageContext.js}

@@ -1,4 +1,4 @@
-export { pluginReplaceIsClientSide };
+export { pluginReplaceConstantsPageContext };
 import { assert, assertPosixPath } from '../utils.js';
 import { normalizeId } from '../shared/normalizeId.js';
 import { isViteServerSide_extraSafe } from '../shared/isViteServerSide.js';
@@ -9,6 +9,8 @@ const constantsIsClientSide = [
     'globalContext.isClientSide',
     'pageContext.globalContext.isClientSide',
 ];
+// - See https://vike.dev/pageContext#narrowing-down
+// - We cannot use [`define`](https://vite.dev/config/shared-options.html#define) because of https://github.com/rolldown/rolldown/issues/4300
 const skipNodeModules = '/node_modules/';
 const skipIrrelevant = 'Context.isClientSide';
 assert(constantsIsClientSide.every((constant) => constant.endsWith(skipIrrelevant)));
@@ -27,11 +29,11 @@ const filterFunction = (id, code) => {
         return false;
     return true;
 };
-function pluginReplaceIsClientSide() {
+function pluginReplaceConstantsPageContext() {
     let config;
     return [
         {
-            name: 'vike:pluginReplaceIsClientSide',
+            name: 'vike:pluginReplaceConstantsPageContext',
             enforce: 'post',
             apply: 'build',
             configResolved: {

package/dist/esm/node/vite/plugins/pluginVirtualFiles/generateVirtualFileGlobalEntry.js

@@ -12,6 +12,9 @@ function getCode(pageConfigs, pageConfigGlobal, isForClientSide, isDev, id, isCl
     const lines = [];
     const importStatements = [];
     const filesEnv = new Map();
+    if (!isForClientSide) {
+        importStatements.push("import 'virtual:vike:server:globalThis-constants';");
+    }
     lines.push('export const pageConfigsSerialized = [');
     lines.push(getCodePageConfigsSerialized(pageConfigs, isForClientSide, isClientRouting, isDev, importStatements, filesEnv));
     lines.push('];');
@@ -22,7 +25,10 @@ function getCode(pageConfigs, pageConfigGlobal, isForClientSide, isDev, id, isCl
         // https://vite.dev/guide/api-environment-frameworks.html
         lines.push('if (import.meta.hot) import.meta.hot.accept();');
     }
-    const code = [...importStatements, ...lines].join('\n');
+    let code = [...importStatements, ...lines].join('\n');
+    if (!isForClientSide) {
+        code = "import 'virtual:vike:server:globalThis-constants';\n" + code;
+    }
     debug(id, isForClientSide ? 'CLIENT-SIDE' : 'SERVER-SIDE', code);
     return code;
 }

package/dist/esm/node/vite/plugins/pluginVirtualFiles/generateVirtualFileGlobalEntryWithOldDesign.js

@@ -23,6 +23,9 @@ async function getCode(config, isForClientSide, isClientRouting, isDev, id) {
     const isBuild = command === 'build';
     assert(isDev === !isBuild);
     let content = '';
+    if (!isForClientSide) {
+        content += "import 'virtual:vike:server:globalThis-constants';\n";
+    }
     {
         const globRoots = getGlobRoots(config);
         debugGlob('Glob roots: ', globRoots);