fix: keep dot runs out of chunk and asset file names - #393

Fixes #391

Problem

A catch-all route module like [...404].tsx builds to _...404_-<hash>.js: the bundler's default sanitizeFileName swaps the brackets and keeps the dots. Vite names the route's CSS after the chunk, so it comes out as _..-<hash>.css. Any server, CDN or middleware that refuses URLs containing .. refuses both files, and the lazy route fails to hydrate.

Fix

The main plugin wraps output.sanitizeFileName in a post-order outputOptions hook: the configured sanitizer runs first (or the default rule, when none is set), then runs of dots in the last segment of the name collapse to one. [...404] now builds to _.404_-<hash>.js.

• sanitizeFileName rather than chunkFileNames, because it also covers assets such as the CSS file above.
• order: 'post', so a sanitizer set by another plugin's outputOptions hook gets wrapped instead of replacing the wrapper.
• The server build is wrapped too. The server bundle writes the URLs of the assets it imports, so collapsing on the client only would point server-rendered src/href attributes at files the client never wrote (an imported mark..svg became mark-<hash>.svg on the client while the SSR markup said mark.-<hash>.svg).
• Only the last segment is touched. With preserveModules the name carries the module's directories, ../ included, and changing those makes Rolldown reject the name.
• A run collapses to one dot instead of being dropped, since the extension is split off the sanitized name: dropping it would turn mark..svg into marksvg-<hash>, with no extension.
• Rolldown's default rule is native and not exported, so the plugin restates Rollup's.
• sanitizeFileName: false is left alone, as the way to ask for raw names.

Verification

examples/start-ssr gets a lazy catch-all route, src/routes/[...rest].tsx, with its own CSS and an image named mark..svg, and a file-names mode in test/run.mjs (node test/run.mjs file-names). It builds the example with the default sanitizer, with a user function from the config, with the same function from another plugin's outputOptions hook, and with sanitizeFileName: false, then serves the build through the example's server.js, which already skips static files for URLs containing ... It also builds a small library with preserveModules from a directory named test-dot..lib.

With the plugin built from next the mode fails 11 of 16: the chunk and CSS keep their dots, server.js answers them with the SSR page, and Rolldown rejects the two builds with a user function. With the fix it passes 16/16. Reverting each piece fails it too: collapsing on the client only, collapsing before the user's function, dropping order: 'post', or collapsing the whole path.

The file-names mode isn't part of the PR workflow, so I ran the full pnpm test of the examples the hook affects:

• examples/start-ssr: run.mjs 661/661, http-bridge 10/10, components-warning 11/11, webworker-warning 12/12, dedupe 8/8
• examples/start-client: 65/65
• examples/ssr: 12/12, boundary 8/8
• examples/css-matrix: 87/87, bridge 19/19
• examples/start-env: 47/47

pnpm exec tsc --noEmit -p . is clean.