@evoscientist/webui 0.2.4 → 0.2.6

package/dist/node_modules/next/dist/server/async-storage/request-store.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", {
     value: true
 });
 0 && (module.exports = {
+    createRequestStore: null,
     createRequestStoreForAPI: null,
     createRequestStoreForRender: null,
     synchronizeMutableCookies: null
@@ -14,6 +15,9 @@ function _export(target, all) {
     });
 }
 _export(exports, {
+    createRequestStore: function() {
+        return createRequestStore;
+    },
     createRequestStoreForAPI: function() {
         return createRequestStoreForAPI;
     },
@@ -30,12 +34,36 @@ const _requestcookies = require("../web/spec-extension/adapters/request-cookies"
 const _cookies = require("../web/spec-extension/cookies");
 const _draftmodeprovider = require("./draft-mode-provider");
 const _utils = require("../web/utils");
+/**
+ * Internal request headers that userland `headers()` must not expose. They stay
+ * on the shared request headers for framework plumbing.
+ *
+ * Every internal header that the client can send must be listed here. The
+ * sealed userland view reads through to the shared request headers, so an
+ * omission leaks the header to userland.
+ *
+ * The names are lowercased because `HeadersAdapter.seal` matches them in
+ * lowercase.
+ */ const HIDDEN_REQUEST_HEADERS = new Set([
+    ..._approuterheaders.FLIGHT_HEADERS,
+    // The client sends these dev-only request IDs so the server can route debug
+    // information back to the originating request. Like the flight headers,
+    // they are internal plumbing.
+    _approuterheaders.NEXT_REQUEST_ID_HEADER,
+    _approuterheaders.NEXT_HTML_REQUEST_ID_HEADER
+].map((header)=>header.toLowerCase()));
 function getHeaders(headers) {
-    const cleaned = _headers.HeadersAdapter.from(headers);
-    for (const header of _approuterheaders.FLIGHT_HEADERS){
-        cleaned.delete(header);
-    }
-    return _headers.HeadersAdapter.seal(cleaned);
+    // The sealed userland view must not copy the request headers.
+    // `HeadersAdapter.from` returns a `Headers` instance unchanged, so the view
+    // reads through to `NextRequest.headers`. A copy detaches `headers()` from
+    // the writes that Proxy makes to `NextRequest.headers` afterwards.
+    //
+    // The view must also not delete the internal headers. Because
+    // `HeadersAdapter.from` does not copy, a delete removes them from the shared
+    // `req.headers`. The dev server reads the request-id headers from the raw
+    // request again, for example when it renders a redirect target after a server
+    // action. Their removal breaks the dev debug channel routing.
+    return _headers.HeadersAdapter.seal(_headers.HeadersAdapter.from(headers), HIDDEN_REQUEST_HEADERS);
 }
 function getMutableCookies(headers, onUpdateCookies) {
     const cookies = new _cookies.RequestCookies(_headers.HeadersAdapter.from(headers));
@@ -45,9 +73,13 @@ function getMutableCookies(headers, onUpdateCookies) {
  * If middleware set cookies in this request (indicated by `x-middleware-set-cookie`),
  * then merge those into the existing cookie object, so that when `cookies()` is accessed
  * it's able to read the newly set cookies.
- */ function mergeMiddlewareCookies(req, existingCookies) {
-    if ('x-middleware-set-cookie' in req.headers && typeof req.headers['x-middleware-set-cookie'] === 'string') {
-        const setCookieValue = req.headers['x-middleware-set-cookie'];
+ */ function mergeMiddlewareCookies(headers, existingCookies) {
+    // TODO: this only fires for `IncomingHttpHeaders`; `Headers` instances
+    // silently fall through (the `in` check and bracket access don't reach header
+    // values stored in internal slots). Confirm whether edge / Web `Headers`
+    // callers need this merge or already handle it elsewhere.
+    if ('x-middleware-set-cookie' in headers && typeof headers['x-middleware-set-cookie'] === 'string') {
+        const setCookieValue = headers['x-middleware-set-cookie'];
         const responseHeaders = new Headers();
         for (const cookie of (0, _utils.splitCookiesString)(setCookieValue)){
             responseHeaders.append('set-cookie', cookie);
@@ -59,20 +91,44 @@ function getMutableCookies(headers, onUpdateCookies) {
         }
     }
 }
-function createRequestStoreForRender(req, res, url, rootParams, implicitTags, onUpdateCookies, previewProps, isHmrRefresh, serverComponentsHmrCache, renderResumeDataCache, fallbackParams) {
-    return createRequestStoreImpl(// Pages start in render phase by default
-    'render', req, res, url, rootParams, implicitTags, onUpdateCookies, renderResumeDataCache, previewProps, isHmrRefresh, serverComponentsHmrCache, fallbackParams);
+function createRequestStoreForRender(req, res, url, rootParams, implicitTags, onUpdateCookies, previewProps, isHmrRefresh, serverComponentsHmrCache, resumeDataCache, fallbackParams, hmrRefreshHash) {
+    return createRequestStore({
+        // Pages start in render phase by default
+        phase: 'render',
+        headers: req.headers,
+        onUpdateCookies: onUpdateCookies ?? (res ? (cookies)=>{
+            res.setHeader('Set-Cookie', cookies);
+        } : undefined),
+        url,
+        rootParams,
+        implicitTags,
+        resumeDataCache,
+        previewProps,
+        isHmrRefresh,
+        serverComponentsHmrCache,
+        hmrRefreshHash,
+        fallbackParams
+    });
 }
-function createRequestStoreForAPI(req, url, implicitTags, onUpdateCookies, previewProps) {
-    return createRequestStoreImpl(// API routes start in action phase by default
-    'action', req, undefined, url, {}, implicitTags, onUpdateCookies, null, previewProps, false, undefined, null);
+function createRequestStoreForAPI(req, url, implicitTags, onUpdateCookies, previewProps, hmrRefreshHash) {
+    return createRequestStore({
+        // API routes start in action phase by default
+        phase: 'action',
+        headers: req.headers,
+        onUpdateCookies,
+        url,
+        rootParams: {},
+        implicitTags,
+        resumeDataCache: null,
+        previewProps,
+        isHmrRefresh: false,
+        serverComponentsHmrCache: undefined,
+        hmrRefreshHash,
+        fallbackParams: null
+    });
 }
-function createRequestStoreImpl(phase, req, res, url, rootParams, implicitTags, onUpdateCookies, renderResumeDataCache, previewProps, isHmrRefresh, serverComponentsHmrCache, fallbackParams) {
-    function defaultOnUpdateCookies(cookies) {
-        if (res) {
-            res.setHeader('Set-Cookie', cookies);
-        }
-    }
+function createRequestStore(inputs) {
+    const { phase, headers, onUpdateCookies, url, rootParams, implicitTags, resumeDataCache, previewProps, isHmrRefresh, serverComponentsHmrCache, hmrRefreshHash, fallbackParams } = inputs;
     const cache = {};
     return {
         type: 'request',
@@ -90,7 +146,7 @@ function createRequestStoreImpl(phase, req, res, url, rootParams, implicitTags,
             if (!cache.headers) {
                 // Seal the headers object that'll freeze out any methods that could
                 // mutate the underlying data.
-                cache.headers = getHeaders(req.headers);
+                cache.headers = getHeaders(headers);
             }
             return cache.headers;
         },
@@ -98,8 +154,8 @@ function createRequestStoreImpl(phase, req, res, url, rootParams, implicitTags,
             if (!cache.cookies) {
                 // if middleware is setting cookie(s), then include those in
                 // the initial cached cookies so they can be read in render
-                const requestCookies = new _cookies.RequestCookies(_headers.HeadersAdapter.from(req.headers));
-                mergeMiddlewareCookies(req, requestCookies);
+                const requestCookies = new _cookies.RequestCookies(_headers.HeadersAdapter.from(headers));
+                mergeMiddlewareCookies(headers, requestCookies);
                 // Seal the cookies object that'll freeze out any methods that could
                 // mutate the underlying data.
                 cache.cookies = _requestcookies.RequestCookiesAdapter.seal(requestCookies);
@@ -111,8 +167,8 @@ function createRequestStoreImpl(phase, req, res, url, rootParams, implicitTags,
         },
         get mutableCookies () {
             if (!cache.mutableCookies) {
-                const mutableCookies = getMutableCookies(req.headers, onUpdateCookies || (res ? defaultOnUpdateCookies : undefined));
-                mergeMiddlewareCookies(req, mutableCookies);
+                const mutableCookies = getMutableCookies(headers, onUpdateCookies);
+                mergeMiddlewareCookies(headers, mutableCookies);
                 cache.mutableCookies = mutableCookies;
             }
             return cache.mutableCookies;
@@ -126,13 +182,14 @@ function createRequestStoreImpl(phase, req, res, url, rootParams, implicitTags,
         },
         get draftMode () {
             if (!cache.draftMode) {
-                cache.draftMode = new _draftmodeprovider.DraftModeProvider(previewProps, req, this.cookies, this.mutableCookies);
+                cache.draftMode = new _draftmodeprovider.DraftModeProvider(previewProps, headers, this.cookies, this.mutableCookies);
             }
             return cache.draftMode;
         },
-        renderResumeDataCache: renderResumeDataCache ?? null,
+        resumeDataCache: resumeDataCache ?? null,
         isHmrRefresh,
         serverComponentsHmrCache: serverComponentsHmrCache || globalThis.__serverComponentsHmrCache,
+        hmrRefreshHash,
         fallbackParams
     };
 }

package/dist/node_modules/next/dist/server/async-storage/work-store.js

@@ -30,7 +30,7 @@ function createWorkStore({ page, renderOpts, isPrefetchRequest, buildId, deploym
    *
    * These rules help ensure that other existing features like request caching,
    * coalescing, and ISR continue working as intended.
-   */ const isStaticGeneration = !renderOpts.shouldWaitOnAllReady && !renderOpts.supportsDynamicResponse && !renderOpts.isDraftMode && !renderOpts.isPossibleServerAction;
+   */ const isStaticGeneration = !renderOpts.supportsDynamicResponse && !renderOpts.isDraftMode && !renderOpts.isPossibleServerAction;
     const shouldTrackFetchMetrics = !!process.env.__NEXT_DEV_SERVER || // The only times we want to track fetch metrics outside of development is
     // when we are performing a static generation and we either are in debug
     // mode, or tracking fetch metrics was specifically opted into.
@@ -43,9 +43,13 @@ function createWorkStore({ page, renderOpts, isPrefetchRequest, buildId, deploym
         // so that it can access the fs cache without mocks
         renderOpts.incrementalCache || globalThis.__incrementalCache,
         cacheLifeProfiles: renderOpts.cacheLifeProfiles,
+        useCacheTimeout: renderOpts.experimental.useCacheTimeout,
+        staticPageGenerationTimeout: renderOpts.staticPageGenerationTimeout,
         isBuildTimePrerendering: renderOpts.isBuildTimePrerendering,
         fetchCache: renderOpts.fetchCache,
         isOnDemandRevalidate: renderOpts.isOnDemandRevalidate,
+        requestId: undefined,
+        htmlRequestId: undefined,
         isDraftMode: renderOpts.isDraftMode,
         isPrefetchRequest,
         buildId,
@@ -55,7 +59,9 @@ function createWorkStore({ page, renderOpts, isPrefetchRequest, buildId, deploym
         nonce,
         afterContext: createAfterContext(renderOpts),
         cacheComponentsEnabled: renderOpts.cacheComponents,
+        validationLevel: renderOpts.validationLevel,
         previouslyRevalidatedTags,
+        requestStartTime: performance.timeOrigin + performance.now(),
         refreshTagsByCacheKind: createRefreshTagsByCacheKind(),
         runInCleanSnapshot: (0, _asynclocalstorage.createSnapshot)(),
         shouldTrackFetchMetrics,

package/dist/node_modules/next/dist/server/base-server.js

@@ -26,10 +26,12 @@ const _path = /*#__PURE__*/ _interop_require_wildcard(require("path"));
 const _url = require("url");
 const _formathostname = require("./lib/format-hostname");
 const _isrscrequest = require("./lib/is-rsc-request");
+const _isnonhtmlsecfetchdest = require("./lib/is-non-html-sec-fetch-dest");
 const _constants = require("../shared/lib/constants");
 const _utils1 = require("../shared/lib/router/utils");
 const _utils2 = require("./utils");
 const _isbot = require("../shared/lib/router/utils/is-bot");
+const _routeregex = require("../shared/lib/router/utils/route-regex");
 const _renderresult = /*#__PURE__*/ _interop_require_default(require("./render-result"));
 const _removetrailingslash = require("../shared/lib/router/utils/remove-trailing-slash");
 const _denormalizepagepath = require("../shared/lib/page-path/denormalize-page-path");
@@ -43,6 +45,7 @@ const _gethostname = require("../shared/lib/get-hostname");
 const _parseurl = require("../shared/lib/router/utils/parse-url");
 const _getnextpathnameinfo = require("../shared/lib/router/utils/get-next-pathname-info");
 const _approuterheaders = require("../client/components/app-router-headers");
+const _nanoid = require("next/dist/compiled/nanoid");
 const _localeroutenormalizer = require("./normalizers/locale-route-normalizer");
 const _defaultroutematchermanager = require("./route-matcher-managers/default-route-matcher-manager");
 const _apppageroutematcherprovider = require("./route-matcher-providers/app-page-route-matcher-provider");
@@ -52,6 +55,8 @@ const _pagesroutematcherprovider = require("./route-matcher-providers/pages-rout
 const _servermanifestloader = require("./route-matcher-providers/helpers/manifest-loaders/server-manifest-loader");
 const _tracer = require("./lib/trace/tracer");
 const _constants1 = require("./lib/trace/constants");
+const _requestinsightsidentity = require("./lib/trace/request-insights-identity");
+const _spanstore = require("./lib/trace/span-store");
 const _i18nprovider = require("./lib/i18n-provider");
 const _sendresponse = require("./send-response");
 const _utils3 = require("./web/utils");
@@ -139,6 +144,13 @@ class Server {
         return this.nextConfig.experimental.serverComponentsHmrCache ? globalThis.__serverComponentsHmrCache : undefined;
     }
     /**
+   * The hash of the most recent server component change (dev only), used to
+   * revalidate `"use cache"` entries after an edit. Overridden by the dev
+   * server; returns `undefined` otherwise.
+   */ getServerComponentsHmrRefreshHash() {
+        return undefined;
+    }
+    /**
    * This is used to persist cache scopes across
    * prefetch -> full route requests for cache components
    * it's only fully used in dev
@@ -315,6 +327,9 @@ class Server {
         // TODO: should conf be normalized to prevent missing
         // values from causing issues as this can be user provided
         this.nextConfig = conf;
+        if ((dev || process.env.__NEXT_DEV_SERVER) && this.nextConfig.experimental.requestInsights) {
+            process.env.__NEXT_REQUEST_INSIGHTS = 'true';
+        }
         if (this.nextConfig.experimental.runtimeServerDeploymentId) {
             if (!process.env.NEXT_DEPLOYMENT_ID) {
                 throw Object.defineProperty(new Error('process.env.NEXT_DEPLOYMENT_ID is missing but runtimeServerDeploymentId is enabled'), "__NEXT_ERROR_CODE", {
@@ -330,7 +345,7 @@ class Server {
             process.env.NEXT_DEPLOYMENT_ID = id;
         }
         ;
-        globalThis.NEXT_CLIENT_ASSET_SUFFIX = this.nextConfig.experimental.immutableAssetToken || this.deploymentId ? `?dpl=${this.nextConfig.experimental.immutableAssetToken || this.deploymentId}` : '';
+        globalThis.NEXT_CLIENT_ASSET_SUFFIX = this.nextConfig.supportsImmutableAssets || !this.deploymentId ? '' : `?dpl=${this.deploymentId}`;
         this.hostname = hostname;
         if (this.hostname) {
             // we format the hostname so that it can be fetched
@@ -377,6 +392,7 @@ class Server {
             distDir: this.distDir,
             serverComponents: this.enabledDirectories.app,
             cacheLifeProfiles: this.nextConfig.cacheLife,
+            staticPageGenerationTimeout: this.nextConfig.staticPageGenerationTimeout,
             enableTainting: this.nextConfig.experimental.taint,
             crossOrigin: this.nextConfig.crossOrigin ? this.nextConfig.crossOrigin : undefined,
             largePageDataBytes: this.nextConfig.experimental.largePageDataBytes,
@@ -384,6 +400,8 @@ class Server {
             // `htmlLimitedBots` is passed to server as serialized config in string format
             htmlLimitedBots: this.nextConfig.htmlLimitedBots,
             cacheComponents: this.nextConfig.cacheComponents ?? false,
+            partialPrefetching: this.nextConfig.partialPrefetching,
+            validationLevel: this.nextConfig.experimental.instantInsights.validationLevel,
             experimental: {
                 expireTime: this.nextConfig.expireTime,
                 staleTimes: this.nextConfig.experimental.staleTimes,
@@ -394,8 +412,11 @@ class Server {
                 inlineCss: this.nextConfig.experimental.inlineCss ?? false,
                 prefetchInlining: this.nextConfig.experimental.prefetchInlining ?? false,
                 authInterrupts: !!this.nextConfig.experimental.authInterrupts,
+                serverComponentsHmrCancellation: this.nextConfig.experimental.serverComponentsHmrCancellation,
+                useCacheTimeout: this.nextConfig.experimental.useCacheTimeout,
                 cachedNavigations: this.nextConfig.experimental.cachedNavigations ?? false,
-                maxPostponedStateSizeBytes: (0, _configshared.parseMaxPostponedStateSize)(this.nextConfig.experimental.maxPostponedStateSize)
+                maxPostponedStateSizeBytes: (0, _configshared.parseMaxPostponedStateSize)(this.nextConfig.experimental.maxPostponedStateSize),
+                exposeTestingApi: this.dev === true || this.nextConfig.experimental.exposeTestingApiInProductionBuild === true
             },
             onInstrumentationRequestError: this.instrumentationOnRequestError.bind(this),
             prefetchHints: {},
@@ -467,64 +488,78 @@ class Server {
         await this.prepare();
         const method = req.method.toUpperCase();
         const tracer = (0, _tracer.getTracer)();
-        return tracer.withPropagatedContext(req.headers, ()=>{
-            // Capture the parent span before creating the handleRequest span.
-            // When deployed with an adapter, the platform's runtime may create its
-            // own OTEL HTTP server span before Next.js runs. We propagate http.route
-            // to this parent span so APM tools (e.g. Datadog) can derive the
-            // resource name correctly.
-            const parentSpan = tracer.getActiveScopeSpan();
-            return tracer.trace(_constants1.BaseServerSpan.handleRequest, {
-                spanName: `${method}`,
-                kind: _tracer.SpanKind.SERVER,
-                attributes: {
-                    'http.method': method,
-                    'http.target': req.url
-                }
-            }, async (span)=>this.handleRequestImpl(req, res, parsedUrl).finally(()=>{
-                    if (!span) return;
-                    const isRSCRequest = (0, _requestmeta.getRequestMeta)(req, 'isRSCRequest') ?? false;
-                    span.setAttributes({
-                        'http.status_code': res.statusCode,
-                        'next.rsc': isRSCRequest
-                    });
-                    if (res.statusCode && res.statusCode >= 500) {
-                        // For 5xx status codes: SHOULD be set to 'Error' span status.
-                        // x-ref: https://opentelemetry.io/docs/specs/semconv/http/http-spans/#status
-                        span.setStatus({
-                            code: _tracer.SpanStatusCode.ERROR
-                        });
-                        // For span status 'Error', SHOULD set 'error.type' attribute.
-                        span.setAttribute('error.type', res.statusCode.toString());
-                    }
-                    const rootSpanAttributes = tracer.getRootSpanAttributes();
-                    // We were unable to get attributes, probably OTEL is not enabled
-                    if (!rootSpanAttributes) return;
-                    if (rootSpanAttributes.get('next.span_type') !== _constants1.BaseServerSpan.handleRequest) {
-                        console.warn(`Unexpected root span type '${rootSpanAttributes.get('next.span_type')}'. Please report this Next.js issue https://github.com/vercel/next.js`);
-                        return;
+        const handleRequest = ()=>tracer.withPropagatedContext(req.headers, ()=>{
+                // Capture the parent span before creating the handleRequest span.
+                // When deployed with an adapter, the platform's runtime may create its
+                // own OTEL HTTP server span before Next.js runs. We propagate http.route
+                // to this parent span so APM tools (e.g. Datadog) can derive the
+                // resource name correctly.
+                const parentSpan = tracer.getActiveScopeSpan();
+                return tracer.trace(_constants1.BaseServerSpan.handleRequest, {
+                    spanName: `${method}`,
+                    kind: _tracer.SpanKind.SERVER,
+                    attributes: {
+                        'http.method': method,
+                        'http.target': req.url
                     }
-                    const route = rootSpanAttributes.get('next.route');
-                    if (route) {
-                        const name = isRSCRequest ? `RSC ${method} ${route}` : `${method} ${route}`;
+                }, async (span)=>this.handleRequestImpl(req, res, parsedUrl).finally(()=>{
+                        if (!span) return;
+                        const isRSCRequest = (0, _requestmeta.getRequestMeta)(req, 'isRSCRequest') ?? false;
                         span.setAttributes({
-                            'next.route': route,
-                            'http.route': route,
-                            'next.span_name': name
+                            'http.status_code': res.statusCode,
+                            'next.rsc': isRSCRequest
                         });
-                        span.updateName(name);
-                        // Propagate http.route to the parent span if one exists and
-                        // is different from the handleRequest span. This ensures APM
-                        // tools that read attributes from the outermost span (e.g.
-                        // a platform-created HTTP span) can derive the resource name.
-                        if (parentSpan && parentSpan !== span) {
-                            parentSpan.setAttribute('http.route', route);
+                        if (res.statusCode && res.statusCode >= 500) {
+                            // For 5xx status codes: SHOULD be set to 'Error' span status.
+                            // x-ref: https://opentelemetry.io/docs/specs/semconv/http/http-spans/#status
+                            span.setStatus({
+                                code: _tracer.SpanStatusCode.ERROR
+                            });
+                            // For span status 'Error', SHOULD set 'error.type' attribute.
+                            span.setAttribute('error.type', res.statusCode.toString());
                         }
-                    } else {
-                        span.updateName(isRSCRequest ? `RSC ${method}` : `${method}`);
-                    }
-                }));
-        });
+                        const rootSpanAttributes = tracer.getRootSpanAttributes();
+                        // We were unable to get attributes, probably OTEL is not enabled
+                        if (!rootSpanAttributes) return;
+                        if (rootSpanAttributes.get('next.span_type') !== _constants1.BaseServerSpan.handleRequest) {
+                            console.warn(`Unexpected root span type '${rootSpanAttributes.get('next.span_type')}'. Please report this Next.js issue https://github.com/vercel/next.js`);
+                            return;
+                        }
+                        const route = rootSpanAttributes.get('next.route');
+                        if (route) {
+                            const name = isRSCRequest ? `RSC ${method} ${route}` : `${method} ${route}`;
+                            span.setAttributes({
+                                'next.route': route,
+                                'http.route': route,
+                                'next.span_name': name
+                            });
+                            span.updateName(name);
+                            // Propagate http.route to the parent span if one exists and
+                            // is different from the handleRequest span. This ensures APM
+                            // tools that read attributes from the outermost span (e.g.
+                            // a platform-created HTTP span) can derive the resource name.
+                            if (parentSpan && parentSpan !== span) {
+                                parentSpan.setAttribute('http.route', route);
+                            }
+                        } else {
+                            span.updateName(isRSCRequest ? `RSC ${method}` : `${method}`);
+                        }
+                    }));
+            });
+        if (!(0, _spanstore.isRequestInsightsEnabled)()) {
+            return handleRequest();
+        }
+        const requestIdHeader = req.headers[_approuterheaders.NEXT_REQUEST_ID_HEADER];
+        const requestId = typeof requestIdHeader === 'string' ? requestIdHeader : (0, _nanoid.nanoid)();
+        const htmlRequestIdHeader = req.headers[_approuterheaders.NEXT_HTML_REQUEST_ID_HEADER];
+        // The request root and route-matching spans start before App Render creates
+        // its workStore. Carry their identity in this outer scope; App Render copies
+        // it into the workStore so the complete timeline uses one request ID.
+        return (0, _requestinsightsidentity.runWithRequestInsightsIdentity)({
+            requestId,
+            htmlRequestId: typeof htmlRequestIdHeader === 'string' ? htmlRequestIdHeader : requestId,
+            url: req.url
+        }, handleRequest);
     }
     async handleRequestImpl(req, res, parsedUrl) {
         try {
@@ -633,7 +668,7 @@ class Server {
                     }
                     // If the request is a next data request and it has a postponed state,
                     // we should error, as it represents an unprocessable request.
-                    if ((0, _requestmeta.getRequestMeta)(req, 'isNextDataReq') && (0, _requestmeta.getRequestMeta)(req, 'postponed')) {
+                    if ((0, _requestmeta.getRequestMeta)(req, 'isNextDataReq') && typeof (0, _requestmeta.getRequestMeta)(req, 'postponed') === 'string') {
                         // The server understood that this is a PPR resume request, as the
                         // headers were included to correctly indicate a resume request, but
                         // because the request URL indicates that this should render a next
@@ -889,6 +924,15 @@ class Server {
             if (!(0, _requestmeta.getRequestMeta)(req, 'serverComponentsHmrCache')) {
                 (0, _requestmeta.addRequestMeta)(req, 'serverComponentsHmrCache', this.getServerComponentsHmrCache());
             }
+            // Attach the server components HMR refresh hash here, alongside the HMR
+            // cache, so it reaches every render that passes through this request
+            // handling, including internal renders (e.g. dev validation/warmup) that
+            // don't re-enter the top-level request handler. It's included in `"use
+            // cache"` keys so cached entries revalidate after an edit, for every
+            // client.
+            if (!(0, _requestmeta.getRequestMeta)(req, 'hmrRefreshHash')) {
+                (0, _requestmeta.addRequestMeta)(req, 'hmrRefreshHash', this.getServerComponentsHmrRefreshHash());
+            }
             // when invokePath is specified we can short short circuit resolving
             // we only honor this header if we are inside of a render worker to
             // prevent external users coercing the routing path
@@ -1051,9 +1095,16 @@ class Server {
         let { cacheControl } = payload;
         if (!res.sent) {
             const { generateEtags, poweredByHeader } = this.renderOpts;
-            // In dev, we should not cache pages for any reason.
+            // Dev responses use `no-cache` so the browser can restore them from the
+            // HTTP cache on back/forward instead of reloading. HMR refresh responses
+            // opt out into `no-store` because a superseded refresh's fetch is aborted
+            // mid-write: under `no-cache` the response is stored, so the abort leaves
+            // the cache entry shared with the superseding refresh (same URL)
+            // half-written; Chromium then discards it and reissues the superseding
+            // refresh on a second connection as a duplicate request. `no-store` keeps
+            // that entry from being created.
             if (this.dev) {
-                res.setHeader('Cache-Control', 'no-cache, must-revalidate');
+                res.setHeader('Cache-Control', req.headers[_approuterheaders.NEXT_HMR_REFRESH_HEADER] === '1' ? 'no-store' : 'no-cache, must-revalidate');
                 cacheControl = undefined;
             }
             if (cacheControl && cacheControl.expire === undefined) {
@@ -1205,7 +1256,7 @@ class Server {
         !is404Page) {
             const headers = req.headers;
             const prefetchHeaderValue = headers[_approuterheaders.NEXT_ROUTER_PREFETCH_HEADER];
-            const routerPrefetch = prefetchHeaderValue !== undefined ? prefetchHeaderValue === '1' || prefetchHeaderValue === '2' ? prefetchHeaderValue : undefined : // so we don't expect the header to be stripped by an intermediate layer.
+            const routerPrefetch = prefetchHeaderValue !== undefined ? prefetchHeaderValue === '1' || prefetchHeaderValue === '2' || prefetchHeaderValue === '3' ? prefetchHeaderValue : undefined : // so we don't expect the header to be stripped by an intermediate layer.
             // This should only happen for static prefetches, so we only handle those here.
             (0, _requestmeta.getRequestMeta)(req, 'isPrefetchRSCRequest') ? '1' : undefined;
             const segmentPrefetchRSCRequest = headers[_approuterheaders.NEXT_ROUTER_SEGMENT_PREFETCH_HEADER] || (0, _requestmeta.getRequestMeta)(req, 'segmentPrefetchRSCRequest');
@@ -1224,7 +1275,9 @@ class Server {
                 // generate the 5-character `_rsc` form.
                 // Note: When no headers are present, expectedHash is empty string and client
                 // must send `_rsc` param, otherwise actualHash is null and hash check fails.
-                const url = new URL(req.url || '', 'http://localhost');
+                // `req.url` may have had its basePath removed during normalization.
+                // Build the redirect from the original URL so it remains public-facing.
+                const url = new URL((0, _requestmeta.getRequestMeta)(req, 'initURL') || req.url || '', 'http://localhost');
                 (0, _setcachebustingsearchparam.setCacheBustingSearchParamWithHash)(url, expectedHash);
                 res.statusCode = 307;
                 res.setHeader('location', `${url.pathname}${url.search}`);
@@ -1298,9 +1351,18 @@ class Server {
         // the request metadata. If available, use it for resuming the postponed
         // render.
         const minimalPostponed = isRoutePPREnabled ? (0, _requestmeta.getRequestMeta)(req, 'postponed') : undefined;
+        const hasPostponedState = typeof minimalPostponed === 'string';
         // we need to ensure the status code if /404 is visited directly
         if (is404Page && !isNextDataRequest && !isRSCRequest) {
             res.statusCode = 404;
+            // For subresource requests (e.g. images or fonts), return plain text
+            // 404 instead of rendering the not-found route.
+            if ((req.method === 'GET' || req.method === 'HEAD') && (0, _isnonhtmlsecfetchdest.isNonHtmlSecFetchDest)(req.headers['sec-fetch-dest'])) {
+                res.setHeader('Cache-Control', 'private, no-cache, no-store, max-age=0, must-revalidate');
+                res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+                res.body('Not Found').send();
+                return null;
+            }
         }
         // ensure correct status is set when visiting a status page
         // directly e.g. /500
@@ -1309,7 +1371,7 @@ class Server {
         }
         if (// Server actions can use non-GET/HEAD methods.
         !isPossibleServerAction && // Resume can use non-GET/HEAD methods.
-        !minimalPostponed && !is404Page && !is500Page && pathname !== '/_error' && req.method !== 'HEAD' && req.method !== 'GET' && (typeof components.Component === 'string' || isSSG)) {
+        !hasPostponedState && !is404Page && !is500Page && pathname !== '/_error' && req.method !== 'HEAD' && req.method !== 'GET' && (typeof components.Component === 'string' || isSSG)) {
             res.statusCode = 405;
             res.setHeader('Allow', [
                 'GET',
@@ -1381,20 +1443,33 @@ class Server {
             if (isAppPath && this.nextConfig.cacheComponents) {
                 var _pathsResults_prerenderedRoutes;
                 if ((_pathsResults_prerenderedRoutes = pathsResults.prerenderedRoutes) == null ? void 0 : _pathsResults_prerenderedRoutes.length) {
-                    let smallestFallbackRouteParams = null;
+                    // Replicate, on demand, the per-URL fallback set a production build
+                    // writes to the prerender manifest. Production matches the requested
+                    // URL to the most-specific prerendered route and defers that route's
+                    // `fallbackRouteParams` (so `generateStaticParams`-covered params
+                    // resolve in the static shell and only the uncovered ones are
+                    // deferred). The dev prerender manifest isn't populated for these
+                    // ad-hoc routes, but `getStaticPaths` already computed every
+                    // prerendered route here, so we do the same match: among the routes
+                    // whose canonical regex matches this URL, pick the one with the
+                    // fewest fallback params (the most-specific) and thread it via the
+                    // `fallbackParams` meta. A fully-covered concrete route (e.g.
+                    // `/blog/a`) has zero fallback params and is the most-specific match
+                    // for its own URL, so it must be considered alongside the others: it
+                    // wins over the base dynamic route (`/blog/[slug]`) and leaves its
+                    // statically-known params out of the deferred set.
+                    let perUrlFallbackRouteParams = null;
                     for (const route of pathsResults.prerenderedRoutes){
-                        const fallbackRouteParams = route.fallbackRouteParams;
-                        if (!fallbackRouteParams || fallbackRouteParams.length === 0) {
-                            // There are no fallback route params so we don't need to continue
-                            smallestFallbackRouteParams = null;
-                            break;
+                        const fallbackRouteParams = route.fallbackRouteParams ?? [];
+                        if (!(0, _routeregex.getRouteRegex)(route.pathname).re.test(urlPathname)) {
+                            continue;
                         }
-                        if (smallestFallbackRouteParams === null || fallbackRouteParams.length < smallestFallbackRouteParams.length) {
-                            smallestFallbackRouteParams = fallbackRouteParams;
+                        if (perUrlFallbackRouteParams === null || fallbackRouteParams.length < perUrlFallbackRouteParams.length) {
+                            perUrlFallbackRouteParams = fallbackRouteParams;
                         }
                     }
-                    if (smallestFallbackRouteParams) {
-                        (0, _requestmeta.addRequestMeta)(req, 'fallbackParams', (0, _fallbackparams.createOpaqueFallbackRouteParams)(smallestFallbackRouteParams));
+                    if (perUrlFallbackRouteParams && perUrlFallbackRouteParams.length > 0) {
+                        (0, _requestmeta.addRequestMeta)(req, 'fallbackParams', (0, _fallbackparams.createOpaqueFallbackRouteParams)(perUrlFallbackRouteParams));
                     }
                 }
             }

package/dist/node_modules/next/dist/server/body-streams.js

@@ -80,7 +80,15 @@ function getCloneableBody(readable, sizeLimit) {
      */ cloneBodyStream () {
             const input = buffered ?? readable;
             const p1 = new _stream.PassThrough();
-            const p2 = new _stream.PassThrough();
+            // `p2` becomes the buffered body that replaces the original request stream
+            // in `finalize()` via `replaceRequestBody`. Since it is only ever fed via
+            // `.push()`, it must be a plain Readable: a Duplex (PassThrough) would copy
+            // its writable-side internals (`_writableState`, `write`, `end`, ...) onto the
+            // IncomingMessage, making the request look like an unfinished writable stream
+            // and hanging Node stream APIs such as `Readable.toWeb()`.
+            const p2 = new _stream.Readable({
+                read () {}
+            });
             let bytesRead = 0;
             const bodySizeLimit = sizeLimit ?? DEFAULT_BODY_CLONE_SIZE_LIMIT;
             let limitExceeded = false;

package/dist/node_modules/next/dist/server/client-component-renderer-logger.js

@@ -24,8 +24,8 @@ _export(exports, {
 let clientComponentLoadStart = 0;
 let clientComponentLoadTimes = 0;
 let clientComponentLoadCount = 0;
-function wrapClientComponentLoader(ComponentMod) {
-    if (!('performance' in globalThis)) {
+function wrapClientComponentLoader(ComponentMod, isTracingEnabled) {
+    if (!('performance' in globalThis) || !process.env.NEXT_OTEL_PERFORMANCE_PREFIX && !isTracingEnabled) {
         return ComponentMod.__next_app__;
     }
     return {