packages/nuxt/src/components/module.ts (1)

112-114: Drop the empty brace alternative in the declaration ignore pattern.

Line 112 expands to **/*.{d.ts,d.mts,d.cts,}, which leaves an empty alternative and causes the ignore set to match files ending in a bare dot. Remove the trailing comma so only the declaration extensions are ignored.

-            `**/*.{${DECLARATION_EXTENSIONS.join(',')},}`, // .d.ts files
+            `**/*.{${DECLARATION_EXTENSIONS.join(',')}}`, // .d.ts files

packages/schema/src/types/compiler.ts (1)

6-11: Retain source as optional until Nuxt 5, but add a runtime warning for missing entries
All built-in defaults and tests already specify source, so making it required now would be a breaking change reserved for Nuxt 5. To prevent silent skips, emit a warning (or throw) when any keyedComposables entry omits source at runtime, with a pointer to the migration guide.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: GalacticHypernova
PR: nuxt/nuxt#26468
File: packages/nuxt/src/components/plugins/loader.ts:24-24
Timestamp: 2024-11-05T15:22:54.759Z
Learning: In `packages/nuxt/src/components/plugins/loader.ts`, the references to `resolve` and `distDir` are legacy code from before Nuxt used the new unplugin VFS and will be removed.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

packages/schema/src/types/compiler.ts (1)

1-27: Document default-export semantics and note source requirement

Please extend JSDoc to clarify:

• Set name: 'default' to target a module’s default export (the injected callable will be the default import; the effective callable name is derived from the filename).
• source is now required (no RegExp/undefined). Add a brief migration note to avoid confusion.

Example patch:

 export interface KeyedFunction {
   /**
    * The name of the function.
+   * Use 'default' to target a module's default export. In that case, the callable name
+   * is derived from the filename (camel-cased) for matching during analysis.
    */
   name: string
   /**
    * The path to the file where the function is defined.
    * You can use Nuxt aliases (~ or @) to refer to directories inside the project or directly use an npm package path similar to require.
+   *
+   * Note: `source` is required. Previous support for RegExp/undefined is removed.
    */
   source: string
   /**
    * The maximum number of arguments the function can accept.
    * In the case that the function is called with fewer arguments than this number,
    * the compiler will inject an auto-generated key as an additional argument.
    *
    * The key is unique based on the location of the function being invoked within the file.
    *
    * @example `{ name: 'useKey', source: '~/composables/useKey', argumentLength: 2 }`
    *
    * ```ts
    * useKey()                  // will be transformed to: useKey('\$KzLSZ0O59L')
    * useKey('first')           // will be transformed to: useKey('first', '\$KzLSZ0O59L')
    * useKey('first', 'second') // will not be transformed
    * ```
    */
   argumentLength: number
 }

packages/nuxt/src/compiler/plugins/keyed-functions.ts (5)

35-44: Avoid dynamic RegExp from array without escaping; precompute pattern

Current construction may be brittle if extensions contain metacharacters and is flagged for ReDoS by static analysis. Escape and precompile:

-        : new RegExp(`\\.(${extensions.join('|')})$`).test(pathname)
+        : new RegExp(`\\.(?:${extensions.map(e => escapeRE(e)).join('|')})$`).test(pathname)

Import escape-string-regexp if needed in this scope.

---

94-96: Large dynamic include RegExp: cap/optimise prefilter

This builds a potentially large alternation. Consider:

• Fallback to a fast string prefilter (code.includes(name)) before the AST pass, or
• Cap the number of alternations, or
• Use a Set and a quick scan instead of a single mega-RegExp.

This reduces worst‑case backtracking and memory pressure while preserving correctness since AST analysis is authoritative.

---

170-189: Parse only the <script> block for SFCs to avoid parse errors

You already extract script and its index (codeIndex). Use script (not full code) as the parse target to avoid attempting to parse .vue markup in edge toolchains where post ordering isn’t guaranteed.

-        const { program } = parseAndWalk(code, id, {
+        const { program } = parseAndWalk(script, id, {
           scopeTracker,
           enter (node) {
             if (!shouldConsiderExports) { return }
             if (node.type !== 'ExportNamedDeclaration' && node.type !== 'ExportDefaultDeclaration') { return }

Position math already accounts for codeIndex, so this change is safe.

---

352-355: Derive key from callsite location for stability (aligns with docs)

Docs say the key is based on callsite location. Using an incrementing counter can produce different keys across minor AST/order changes. Prefer offsets:

-                (parsedCall.callExpression.arguments.length && !endsWithComma ? ', ' : '') + '\'$' + hash(`${_id}-${++count}`).slice(0, 10) + `' ${NUXT_INJECTED_MARKER}`,
+                (() => {
+                  const seed = `${id}:${parsedCall.callExpression.start}:${parsedCall.callExpression.end}`
+                  const key = '$' + hash(seed).slice(0, 10)
+                  return (parsedCall.callExpression.arguments.length && !endsWithComma ? ', ' : '') + `'${key}' ${NUXT_INJECTED_MARKER}`
+                })(),

Keeps keys deterministic per file + callsite.

---

321-343: Edge cases for built-in composables: broaden literal detection (optional)

You skip when a literal key already exists. Today you treat any TemplateLiteral as a key (even with expressions). If you want stricter behaviour (only static templates), refine checks to ensure quasis.length === 1 && expressions.length === 0. Optional but improves precision.

packages/nuxt/test/keyed-functions.test.ts (3)

126-138: Make dev-warning test robust to env detection

The plugin guards duplicate warnings behind import.meta.dev. Instead of stubbing a custom global, ensure the test runs with import.meta.dev === true (e.g., via Vitest/Vite config) or temporarily monkey‑patch Object.defineProperty(import.meta, 'dev', { value: true }) if supported. Current vi.stubGlobal('__TEST_DEV__', true) may not affect the guard.

---

46-57: Add coverage for auto‑imports and SFCs

• Add a case where a keyed function is auto‑imported (no import statement) to assert the intended behaviour with source required (either inject or deliberately skip).
• Add a .vue SFC case to ensure parsing of the <script> block works as expected.

As per coding guidelines (Vitest).

Also applies to: 216-223, 523-532

---

768-799: Strengthen template literal key tests

You currently expect no injection for template literals (including interpolated). If you adopt stricter “static-only” detection, add assertions for both static and interpolated templates to lock behaviour.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

packages/nuxt/src/compiler/plugins/keyed-functions.ts (1)

144-180: Restore source-less keyed function matching for manual imports.

Line 162 still misses the backwards-compatible fallback for entries without a source. If a module adds { name: 'useFoo', argumentLength: 1 } (no source) and calls import { useFoo } from '~/composables/foo', source is the resolved path while the metadata lives under the empty-string bucket, so getFunctionMetaByLocalName returns undefined and no key is injected. This regresses existing keyed composable configs. Please always fall back to the '' entry (or regex) when the exact source lookup fails, including the exported/local-name branches.

-          if (exportedName) {
-            return namesToSourcesToFunctionMeta.get(exportedName)?.get(source)
+          if (exportedName) {
+            const metaBySource = namesToSourcesToFunctionMeta.get(exportedName)
+            return (source && metaBySource?.get(source)) ?? metaBySource?.get('')
           }
           // check static direct imports
           const directImport = directImports.get(localName)
           if (directImport) {
             const functionName = directImport.originalName === 'default'
               ? camelCase(parse(directImport.source).name)
               : directImport.originalName
-
-            // TODO: remove auto-import checks in Nuxt 5
-            const sourcesToMetas = namesToSourcesToFunctionMeta.get(functionName)
-            if (!sourcesToMetas) { return }
-
-            const fnMeta = sourcesToMetas.get(source)
-            if (fnMeta) { return fnMeta }
-
-            const backwardsCompatibleFnMeta = sourcesToMetas.get('') // functions without a source or with a regex fall under ''
+            const sourcesToMetas = namesToSourcesToFunctionMeta.get(functionName)
+            if (!sourcesToMetas) { return }
+
+            const fnMeta = (source && sourcesToMetas.get(source)) ?? sourcesToMetas.get('')
+            if (!fnMeta) { return }
+
+            if (fnMeta.source === undefined) {
+              return fnMeta
+            }
+
+            const backwardsCompatibleFnMeta = fnMeta
             if (backwardsCompatibleFnMeta?.source === undefined) {
               const autoImportResolvedSource = stripExtension(resolveAlias(autoImportsToSources.get(localName) ?? ''))
               if (autoImportResolvedSource === source) {
                 return backwardsCompatibleFnMeta
               }
             } else if (backwardsCompatibleFnMeta.source instanceof RegExp && backwardsCompatibleFnMeta.source.test(source)) {
               return backwardsCompatibleFnMeta
             }
-
-            return
           }
 
           // check local names
-          return namesToSourcesToFunctionMeta.get(localName)?.get(source)
+          const metaBySource = namesToSourcesToFunctionMeta.get(localName)
+          return (source && metaBySource?.get(source)) ?? metaBySource?.get('')
         }

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

packages/nuxt/src/compiler/plugins/keyed-functions.ts (2)

144-180: Restore fallback for keyed composables without source.

When a keyed function entry omits source, it's stored under the empty-string key (line 61: fnSource = ''). However, the lookup logic only checks the source-specific entry and never falls back to the '' bucket, causing configurations without source to be skipped. This regression breaks backward compatibility.

The following lookups need the fallback:

• Line 149: exported name lookup
• Line 162: direct import lookup
• Line 179: local name fallback lookup

Apply this diff to restore the fallback behaviour:

 function getFunctionMetaByLocalName (localName: string, source: string): BackwardsCompatibleKeyedFunction | undefined {
   if (!localName) { return }
   // check exports (higher priority)
   const exportedName = localNamesToExportedName.get(localName)
   if (exportedName) {
-    return namesToSourcesToFunctionMeta.get(exportedName)?.get(source)
+    const metaBySource = namesToSourcesToFunctionMeta.get(exportedName)
+    return metaBySource?.get(source) || metaBySource?.get('')
   }
   // check static direct imports
   const directImport = directImports.get(localName)
   if (directImport) {
     const functionName = directImport.originalName === 'default'
       ? camelCase(parse(directImport.source).name)
       : directImport.originalName

     // TODO: remove auto-import checks in Nuxt 5
     const sourcesToMetas = namesToSourcesToFunctionMeta.get(functionName)
     if (!sourcesToMetas) { return }

-    const fnMeta = sourcesToMetas.get(source)
+    const fnMeta = sourcesToMetas.get(source) || sourcesToMetas.get('')
     if (fnMeta) { return fnMeta }

     const backwardsCompatibleFnMeta = sourcesToMetas.get('') // functions without a source or with a regex fall under ''
     if (backwardsCompatibleFnMeta?.source === undefined) {
       const autoImportResolvedSource = stripExtension(resolveAlias(autoImportsToSources.get(localName) ?? ''))
       if (autoImportResolvedSource === source) {
         return backwardsCompatibleFnMeta
       }
     } else if (backwardsCompatibleFnMeta.source instanceof RegExp && backwardsCompatibleFnMeta.source.test(source)) {
       return backwardsCompatibleFnMeta
     }

     return
   }

   // check local names
-  return namesToSourcesToFunctionMeta.get(localName)?.get(source)
+  const metaBySource = namesToSourcesToFunctionMeta.get(localName)
+  return metaBySource?.get(source) || metaBySource?.get('')
 }

---

69-69: Consider using process.env.NODE_ENV for build-time checks.

import.meta.dev is Vite-specific and may not be reliably available in all build contexts (Webpack, Rspack). For Node.js build plugins, process.env.NODE_ENV is more portable.

Apply this diff:

-    if (import.meta.dev) {
+    if (process.env.NODE_ENV === 'development') {

packages/nuxt/src/compiler/plugins/keyed-functions.ts (1)

346-353: Simplify marker detection with string slice.

The character-by-character comparison can be replaced with a more efficient string slice operation.

Apply this diff:

               let wasKeyInjected = true
-              for (let i = 0; i < NUXT_INJECTED_MARKER.length; i++) {
-                // the magic comment does not match, we have not injected a key yet
-                if (code[codeIndex + lastArgument.end + 1 + i] !== NUXT_INJECTED_MARKER[i]) {
-                  wasKeyInjected = false
-                  break
-                }
-              }
+              const markerStart = codeIndex + lastArgument.end + 1
+              wasKeyInjected = code.slice(markerStart, markerStart + NUXT_INJECTED_MARKER.length) === NUXT_INJECTED_MARKER

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro