@bleedingdev/modern-js-app-tools-extensions 3.9.0-ultramodern.9 → 3.9.3-ultramodern.10

package/dist/esm-node/templates/cloudflare-entry.001-bootstrap-security.mjs

@@ -3,8 +3,12 @@ const MODERN_WORKER_MANIFEST = p_workerManifest;
 export const modernWorkerManifest = MODERN_WORKER_MANIFEST;
 const WORKER_MODULE_LOADERS = p_workerModuleLoaders;
 const workerModulePromises = new Map();
-const effectBffDispatcherPromises = new Map();
-const remoteJsonPromises = new Map();
+// workerd forbids awaiting I/O (a `fetch()` Promise) that was started by a
+// different request's execution context. This worker isolate outlives any
+// single request, so this map may only ever hold settled, plain JSON values
+// — never a live fetch Promise shared across requests. In-flight dedupe is
+// instead scoped per request; see `createRemoteJsonFetchScope`.
+const remoteJsonCache = new Map();
 const CORS_POLICY = MODERN_WORKER_MANIFEST.security?.cors || {};
 const ASSET_CORS_ENABLED = CORS_POLICY.assets !== false;
 const APP_CORS_ALLOWED_ORIGINS = (CORS_POLICY.allowedOrigins || []).map(
@@ -24,9 +28,6 @@ const ASSET_CORS_HEADERS = {
   'access-control-allow-origin': '*',
 };
 
-globalThis.__dirname ??= '/';
-globalThis.__filename ??= '/index.js';
-
 function getAllowedAppCorsOrigin(request) {
   if (APP_CORS_ALLOWED_ORIGINS.length === 0) {
     return null;
@@ -226,7 +227,11 @@ function withCloudflareSecurityHeaders(response, request) {
 }
 
 function createRenderableRequest(request) {
-  if (request.method !== 'HEAD') {
+  if (
+    request.method !== 'HEAD' ||
+    request.headers.get('x-rsc-action') ||
+    request.headers.get('x-rsc-tree')
+  ) {
     return request;
   }
 
@@ -242,6 +247,9 @@ function finalizeResponseForRequest(response, request) {
 
   const headers = new Headers(securedResponse.headers);
   headers.delete('content-length');
+  // A HEAD response sends no body, so release the producer's stream instead of abandoning it:
+  // a stream nobody reads never finishes, and whatever waits for its end never runs.
+  securedResponse.body?.cancel().catch(() => undefined);
 
   return new Response(null, {
     headers,

package/dist/esm-node/templates/cloudflare-entry.002-assets-routes.mjs

@@ -20,7 +20,7 @@ function withAssetHeaders(response, request) {
   });
 }
 
-async function createCorsPreflightResponse(request, env) {
+async function createCorsPreflightResponse(request, _env) {
   if (request.method !== 'OPTIONS') {
     return null;
   }
@@ -71,7 +71,15 @@ async function fetchAssetByPath(pathname, request, env) {
   const url = new URL(request.url);
   url.pathname = `/${pathname.replace(/^\/+/u, '')}`;
 
-  return fetchAsset(new Request(url, request), env);
+  return fetchAsset(
+    new Request(url, {
+      method: 'GET',
+      headers: request.headers,
+      redirect: request.redirect,
+      signal: request.signal,
+    }),
+    env,
+  );
 }
 
 async function fetchAssetByPathFollowingRedirects(