feat: support .tsrx route modules

[ryansolid]

Summary

• analyzeModule currently parses every route with oxc-parser hard-coded to lang: 'tsx', which throws on TSRX syntax (@{ ... } bodies, @if/@for, <style> sidecars). Export analysis now routes by filename: .tsrx modules parse through @tsrx/oxc/parser, the official TSRX oxc integration, whose ParseResult mirrors oxc-parser (same module.staticExports / StaticExportEntry shape) — so analysis semantics are byte-for-byte identical downstream. .ts/.tsx/.js/.jsx routes keep the exact existing oxc-parser path, untouched.
• @tsrx/oxc is a new optional peer dependency, loaded lazily via createRequire only when a .tsrx route module is actually scanned. Projects without .tsrx routes never load (or need) it; scanning a .tsrx route without it installed fails with an error naming the module and the fix. The facade reports most syntax errors through result.errors but throws on some malformed sources; both channels normalize into the analyzer's existing Failed to parse <file> SyntaxError shape.
• The Vite adapter's DEFAULT_EXTENSIONS gains tsrx, matching @solidjs/vite-plugin's extension-is-the-opt-in posture, so .tsrx pages participate in routing without an extensions override.

Tests

• .tsrx export analysis: named route config export, GET handler, default export with a statement-container body containing @if + a scoped <style> sidecar; type-only exports filtered.
• Page convention on .tsrx: page: true, $component.pick = ["default", "$css"], $$route.pick = ["route"].
• Malformed .tsrx throws the uniform Failed to parse error.
• Full suite: 103/103 passing; tsc build clean; npm pack --dry-run verified.

Verified end-to-end against a real consumer: the solid-v2/with-tsrx template builds with a .tsrx route module using this branch's dist.

Made with Cursor

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​tsrx/​oxc@​0.9.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Low adoption: npm @tsrx/oxc-darwin-arm64 Location: Package overview From: pnpm-lock.yaml → npm/@tsrx/oxc@0.9.0 → npm/@tsrx/oxc-darwin-arm64@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc-darwin-arm64@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @tsrx/oxc-darwin-x64 Location: Package overview From: pnpm-lock.yaml → npm/@tsrx/oxc@0.9.0 → npm/@tsrx/oxc-darwin-x64@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc-darwin-x64@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @tsrx/oxc-linux-arm64-gnu Location: Package overview From: pnpm-lock.yaml → npm/@tsrx/oxc@0.9.0 → npm/@tsrx/oxc-linux-arm64-gnu@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc-linux-arm64-gnu@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @tsrx/oxc-linux-arm64-musl Location: Package overview From: pnpm-lock.yaml → npm/@tsrx/oxc@0.9.0 → npm/@tsrx/oxc-linux-arm64-musl@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc-linux-arm64-musl@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @tsrx/oxc-linux-x64-gnu Location: Package overview From: pnpm-lock.yaml → npm/@tsrx/oxc@0.9.0 → npm/@tsrx/oxc-linux-x64-gnu@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc-linux-x64-gnu@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @tsrx/oxc-linux-x64-musl Location: Package overview From: pnpm-lock.yaml → npm/@tsrx/oxc@0.9.0 → npm/@tsrx/oxc-linux-x64-musl@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc-linux-x64-musl@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @tsrx/oxc-win32-arm64-msvc Location: Package overview From: pnpm-lock.yaml → npm/@tsrx/oxc@0.9.0 → npm/@tsrx/oxc-win32-arm64-msvc@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc-win32-arm64-msvc@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @tsrx/oxc-win32-x64-msvc Location: Package overview From: pnpm-lock.yaml → npm/@tsrx/oxc@0.9.0 → npm/@tsrx/oxc-win32-x64-msvc@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc-win32-x64-msvc@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm @tsrx/oxc Location: Package overview From: package.json → npm/@tsrx/oxc@0.9.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tsrx/oxc@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report