@qzsy/vinext 0.1.7

package/dist/server/app-fallback-renderer.js

@@ -0,0 +1,136 @@
+import { renderAppPageErrorBoundary, renderAppPageHttpAccessFallback } from "./app-page-boundary-render.js";
+import { DEFAULT_GLOBAL_ERROR_MODULE } from "./default-global-error-module.js";
+import { DEFAULT_NOT_FOUND_MODULE } from "./default-not-found-module.js";
+//#region src/server/app-fallback-renderer.ts
+const EMPTY_MW_CTX = {
+	headers: null,
+	status: null
+};
+function createAppFallbackRenderer(options) {
+	const { applyFileBasedMetadata, basePath = "", clearRequestContext, createRscOnErrorHandler: buildRscOnErrorHandler, fontProviders, getNavigationContext, globalErrorModule, loadGlobalNotFoundModule, makeThenableParams, metadataRoutes, resolveChildSegments, rootBoundaries, rscRenderer, sanitizer, ssrLoader, trailingSlash } = options;
+	const { rootForbiddenModule, rootLayouts, rootNotFoundModule, rootUnauthorizedModule } = rootBoundaries;
+	const effectiveGlobalErrorModule = globalErrorModule ?? DEFAULT_GLOBAL_ERROR_MODULE;
+	const effectiveRootNotFoundModule = rootNotFoundModule ?? DEFAULT_NOT_FOUND_MODULE;
+	let globalNotFoundModulePromise = null;
+	function resolveGlobalNotFoundModule() {
+		if (!loadGlobalNotFoundModule) return null;
+		if (globalNotFoundModulePromise === null) globalNotFoundModulePromise = Promise.resolve().then(loadGlobalNotFoundModule);
+		return globalNotFoundModulePromise;
+	}
+	return {
+		async renderHttpAccessFallback(route, statusCode, isRscRequest, request, opts, scriptNonce, middlewareContext, callContext) {
+			if (statusCode === 404 && !!loadGlobalNotFoundModule && !route && !opts?.boundaryComponent) {
+				const globalNotFoundModule = await resolveGlobalNotFoundModule();
+				const globalNotFoundComponent = globalNotFoundModule?.default ?? null;
+				if (globalNotFoundComponent) return renderAppPageHttpAccessFallback({
+					applyFileBasedMetadata,
+					boundaryComponent: globalNotFoundComponent,
+					boundaryModule: globalNotFoundModule ?? null,
+					buildFontLinkHeader: fontProviders.buildFontLinkHeader,
+					clearRequestContext,
+					createRscOnErrorHandler(pathname, routePath) {
+						return buildRscOnErrorHandler(request, pathname, routePath);
+					},
+					getFontLinks: fontProviders.getFontLinks,
+					getFontPreloads: fontProviders.getFontPreloads,
+					getFontStyles: fontProviders.getFontStyles,
+					getNavigationContext,
+					globalErrorModule: effectiveGlobalErrorModule,
+					isEdgeRuntime: callContext?.isEdgeRuntime,
+					isRscRequest,
+					layoutModules: [],
+					loadSsrHandler: ssrLoader,
+					makeThenableParams,
+					matchedParams: opts?.matchedParams ?? {},
+					middlewareContext: middlewareContext ?? EMPTY_MW_CTX,
+					metadataRoutes,
+					requestUrl: request.url,
+					resolveChildSegments,
+					rootForbiddenModule: null,
+					rootLayouts: [],
+					rootNotFoundModule: null,
+					rootUnauthorizedModule: null,
+					route: null,
+					renderToReadableStream: rscRenderer,
+					scriptNonce,
+					skipLayoutWrapping: true,
+					statusCode
+				});
+			}
+			return renderAppPageHttpAccessFallback({
+				applyFileBasedMetadata,
+				basePath,
+				trailingSlash,
+				boundaryComponent: opts?.boundaryComponent ?? null,
+				boundaryModule: opts?.boundaryModule ?? null,
+				buildFontLinkHeader: fontProviders.buildFontLinkHeader,
+				clearRequestContext,
+				createRscOnErrorHandler(pathname, routePath) {
+					return buildRscOnErrorHandler(request, pathname, routePath);
+				},
+				getFontLinks: fontProviders.getFontLinks,
+				getFontPreloads: fontProviders.getFontPreloads,
+				getFontStyles: fontProviders.getFontStyles,
+				getNavigationContext,
+				globalErrorModule: effectiveGlobalErrorModule,
+				isEdgeRuntime: callContext?.isEdgeRuntime,
+				isRscRequest,
+				layoutModules: opts?.layouts ?? null,
+				loadSsrHandler: ssrLoader,
+				makeThenableParams,
+				matchedParams: opts?.matchedParams ?? route?.params ?? {},
+				middlewareContext: middlewareContext ?? EMPTY_MW_CTX,
+				metadataRoutes,
+				requestUrl: request.url,
+				resolveChildSegments,
+				rootForbiddenModule,
+				rootLayouts,
+				rootNotFoundModule: effectiveRootNotFoundModule,
+				rootUnauthorizedModule,
+				route,
+				renderToReadableStream: rscRenderer,
+				scriptNonce,
+				sourcePageSegments: callContext?.sourcePageSegments,
+				statusCode
+			});
+		},
+		renderNotFound(route, isRscRequest, request, matchedParams, scriptNonce, middlewareContext, callContext) {
+			return this.renderHttpAccessFallback(route, 404, isRscRequest, request, { matchedParams }, scriptNonce, middlewareContext, callContext);
+		},
+		renderErrorBoundary(route, error, isRscRequest, request, matchedParams, scriptNonce, middlewareContext, callContext) {
+			return renderAppPageErrorBoundary({
+				applyFileBasedMetadata,
+				basePath,
+				trailingSlash,
+				buildFontLinkHeader: fontProviders.buildFontLinkHeader,
+				clearRequestContext,
+				createRscOnErrorHandler(pathname, routePath) {
+					return buildRscOnErrorHandler(request, pathname, routePath);
+				},
+				error,
+				getFontLinks: fontProviders.getFontLinks,
+				getFontPreloads: fontProviders.getFontPreloads,
+				getFontStyles: fontProviders.getFontStyles,
+				getNavigationContext,
+				globalErrorModule: effectiveGlobalErrorModule,
+				isEdgeRuntime: callContext?.isEdgeRuntime,
+				isRscRequest,
+				loadSsrHandler: ssrLoader,
+				makeThenableParams,
+				matchedParams: matchedParams ?? route?.params ?? {},
+				middlewareContext: middlewareContext ?? EMPTY_MW_CTX,
+				metadataRoutes,
+				requestUrl: request.url,
+				resolveChildSegments,
+				rootLayouts,
+				route,
+				renderToReadableStream: rscRenderer,
+				sanitizeErrorForClient: sanitizer,
+				scriptNonce,
+				sourcePageSegments: callContext?.sourcePageSegments
+			});
+		}
+	};
+}
+//#endregion
+export { createAppFallbackRenderer };

package/dist/server/app-history-state.d.ts

@@ -0,0 +1,85 @@
+import { TraverseDirection } from "./navigation-planner.js";
+
+//#region src/server/app-history-state.d.ts
+type HistoryStateRecord = {
+  [key: string]: unknown;
+};
+type BfcacheIdMap = Readonly<Record<string, string>>;
+type HistoryTraversalIntent = {
+  direction: TraverseDirection;
+  historyState: unknown;
+  targetHistoryIndex: number | null;
+};
+type HistoryStateSnapshotRestoreDecision<TState> = {
+  kind: "restore";
+  state: TState;
+  targetHistoryIndex: number;
+} | {
+  kind: "skip";
+  reason: "guarded" | "missing-history-index" | "missing-snapshot" | "stale-bfcache-version";
+  targetHistoryIndex: number | null;
+};
+declare class HistoryStateSnapshotCache<TState> {
+  #private;
+  constructor(options: {
+    maxEntries: number;
+  });
+  clear(): void;
+  remember(options: {
+    bfcacheVersion: number;
+    historyIndex: number | null;
+    state: TState;
+  }): void;
+  resolveRestore(options: {
+    currentBfcacheVersion: number;
+    guarded: boolean;
+    historyState: unknown;
+  }): HistoryStateSnapshotRestoreDecision<TState>;
+}
+declare class RestorableClientStateController<TState> {
+  #private;
+  constructor(options: {
+    initialHistoryState: unknown;
+    maxHistoryStateSnapshots: number;
+  });
+  get currentBfcacheVersion(): number;
+  beginCacheInvalidationGuard(): () => void;
+  isCacheInvalidationGuarded(): boolean;
+  isCurrentBfcacheVersion(historyState: unknown): boolean;
+  readCurrentBfcacheVersionHistoryIds(historyState: unknown): BfcacheIdMap | null;
+  invalidateClientState(): void;
+  rememberHistoryStateSnapshot(options: {
+    historyIndex: number | null;
+    state: TState;
+  }): void;
+  resolveHistoryStateSnapshotRestore(historyState: unknown): HistoryStateSnapshotRestoreDecision<TState>;
+}
+declare function createHistoryStateWithPreviousNextUrl(state: unknown, previousNextUrl: string | null): HistoryStateRecord | null;
+declare function createHistoryStateWithNavigationMetadata(state: unknown, metadata: {
+  bfcacheIds?: BfcacheIdMap | null;
+  bfcacheVersion?: number | null;
+  previousNextUrl: string | null;
+  traversalIndex?: number | null;
+}): HistoryStateRecord | null;
+declare function createExternalHistoryStatePreservingMetadata(callerState: unknown, currentHistoryState: unknown): unknown;
+declare function readHistoryStatePreviousNextUrl(state: unknown): string | null;
+declare function readHistoryStateBfcacheIds(state: unknown): BfcacheIdMap | null;
+declare function readHistoryStateBfcacheVersion(state: unknown): number | null;
+/**
+ * Whether a history entry's stored bfcache version matches the document's
+ * current version. A missing/invalid stored version (null) is NEVER current:
+ * coercing it to 0 would let un-versioned entries (older builds / external
+ * pushState) pass the gate on a fresh document whose current version is 0,
+ * defeating the document-scoped stale-id rejection. App-written entries always
+ * carry an explicit version, so the legitimate first-document path (0 === 0)
+ * still matches.
+ */
+declare function isHistoryStateBfcacheVersionCurrent(state: unknown, currentVersion: number): boolean;
+declare function createHashOnlyHistoryStatePreservingNavigationMetadata(state: unknown): unknown;
+declare function readHistoryStateTraversalIndex(state: unknown): number | null;
+declare function resolveHistoryTraversalIntent(options: {
+  currentHistoryIndex: number | null;
+  historyState: unknown;
+}): HistoryTraversalIntent;
+//#endregion
+export { BfcacheIdMap, HistoryStateSnapshotCache, HistoryTraversalIntent, RestorableClientStateController, createExternalHistoryStatePreservingMetadata, createHashOnlyHistoryStatePreservingNavigationMetadata, createHistoryStateWithNavigationMetadata, createHistoryStateWithPreviousNextUrl, isHistoryStateBfcacheVersionCurrent, readHistoryStateBfcacheIds, readHistoryStateBfcacheVersion, readHistoryStatePreviousNextUrl, readHistoryStateTraversalIndex, resolveHistoryTraversalIntent };

package/dist/server/app-history-state.js

@@ -0,0 +1,223 @@
+import { AppElementsWire } from "./app-elements-wire.js";
+import "./app-elements.js";
+import { isNonNegativeSafeInteger } from "../utils/number.js";
+//#region src/server/app-history-state.ts
+const VINEXT_PREVIOUS_NEXT_URL_HISTORY_STATE_KEY = "__vinext_previousNextUrl";
+const VINEXT_HISTORY_INDEX_HISTORY_STATE_KEY = "__vinext_historyIndex";
+const VINEXT_BFCACHE_IDS_HISTORY_STATE_KEY = "__vinext_bfcacheIds";
+const VINEXT_BFCACHE_VERSION_HISTORY_STATE_KEY = "__vinext_bfcacheVersion";
+var HistoryStateSnapshotCache = class {
+	#maxEntries;
+	#snapshots = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.#maxEntries = options.maxEntries;
+	}
+	clear() {
+		this.#snapshots.clear();
+	}
+	remember(options) {
+		if (options.historyIndex === null) return;
+		this.#snapshots.delete(options.historyIndex);
+		this.#snapshots.set(options.historyIndex, {
+			bfcacheVersion: options.bfcacheVersion,
+			state: options.state
+		});
+		if (this.#snapshots.size <= this.#maxEntries) return;
+		const oldestIndex = this.#snapshots.keys().next().value;
+		if (typeof oldestIndex === "number") this.#snapshots.delete(oldestIndex);
+	}
+	resolveRestore(options) {
+		const targetHistoryIndex = readHistoryStateTraversalIndex(options.historyState);
+		if (targetHistoryIndex === null) return {
+			kind: "skip",
+			reason: "missing-history-index",
+			targetHistoryIndex
+		};
+		const snapshot = this.#snapshots.get(targetHistoryIndex);
+		if (!snapshot) return {
+			kind: "skip",
+			reason: "missing-snapshot",
+			targetHistoryIndex
+		};
+		if (options.guarded) return {
+			kind: "skip",
+			reason: "guarded",
+			targetHistoryIndex
+		};
+		if (snapshot.bfcacheVersion !== options.currentBfcacheVersion) {
+			this.#snapshots.delete(targetHistoryIndex);
+			return {
+				kind: "skip",
+				reason: "stale-bfcache-version",
+				targetHistoryIndex
+			};
+		}
+		return {
+			kind: "restore",
+			state: snapshot.state,
+			targetHistoryIndex
+		};
+	}
+};
+var RestorableClientStateController = class {
+	#currentBfcacheVersion;
+	#pendingCacheInvalidationGuards = 0;
+	#snapshots;
+	constructor(options) {
+		const initialHistoryBfcacheVersion = readHistoryStateBfcacheVersion(options.initialHistoryState);
+		this.#currentBfcacheVersion = initialHistoryBfcacheVersion === null ? 0 : initialHistoryBfcacheVersion + 1;
+		this.#snapshots = new HistoryStateSnapshotCache({ maxEntries: options.maxHistoryStateSnapshots });
+	}
+	get currentBfcacheVersion() {
+		return this.#currentBfcacheVersion;
+	}
+	beginCacheInvalidationGuard() {
+		this.#pendingCacheInvalidationGuards += 1;
+		let released = false;
+		return () => {
+			if (released) return;
+			released = true;
+			this.#pendingCacheInvalidationGuards = Math.max(0, this.#pendingCacheInvalidationGuards - 1);
+		};
+	}
+	isCacheInvalidationGuarded() {
+		return this.#pendingCacheInvalidationGuards > 0;
+	}
+	isCurrentBfcacheVersion(historyState) {
+		return isHistoryStateBfcacheVersionCurrent(historyState, this.#currentBfcacheVersion);
+	}
+	readCurrentBfcacheVersionHistoryIds(historyState) {
+		if (this.isCacheInvalidationGuarded()) return null;
+		const ids = readHistoryStateBfcacheIds(historyState);
+		if (ids === null) return null;
+		return this.isCurrentBfcacheVersion(historyState) ? ids : null;
+	}
+	#invalidateBfcacheIds() {
+		this.#currentBfcacheVersion += 1;
+	}
+	invalidateClientState() {
+		this.#snapshots.clear();
+		this.#invalidateBfcacheIds();
+	}
+	rememberHistoryStateSnapshot(options) {
+		this.#snapshots.remember({
+			bfcacheVersion: this.#currentBfcacheVersion,
+			historyIndex: options.historyIndex,
+			state: options.state
+		});
+	}
+	resolveHistoryStateSnapshotRestore(historyState) {
+		return this.#snapshots.resolveRestore({
+			currentBfcacheVersion: this.#currentBfcacheVersion,
+			guarded: this.isCacheInvalidationGuarded(),
+			historyState
+		});
+	}
+};
+function cloneHistoryState(state) {
+	if (!state || typeof state !== "object") return {};
+	const nextState = {};
+	for (const [key, value] of Object.entries(state)) nextState[key] = value;
+	return nextState;
+}
+function readHistoryStateRecord(state) {
+	if (!state || typeof state !== "object" || Array.isArray(state)) return null;
+	return state;
+}
+function createHistoryStateWithPreviousNextUrl(state, previousNextUrl) {
+	return createHistoryStateWithNavigationMetadata(state, { previousNextUrl });
+}
+function createHistoryStateWithNavigationMetadata(state, metadata) {
+	const nextState = cloneHistoryState(state);
+	const bfcacheIdsWereCleared = metadata.bfcacheIds !== void 0 && (metadata.bfcacheIds === null || Object.keys(metadata.bfcacheIds).length === 0);
+	if (metadata.previousNextUrl === null) delete nextState[VINEXT_PREVIOUS_NEXT_URL_HISTORY_STATE_KEY];
+	else nextState[VINEXT_PREVIOUS_NEXT_URL_HISTORY_STATE_KEY] = metadata.previousNextUrl;
+	if (metadata.traversalIndex !== void 0) if (isNonNegativeSafeInteger(metadata.traversalIndex)) nextState[VINEXT_HISTORY_INDEX_HISTORY_STATE_KEY] = metadata.traversalIndex;
+	else delete nextState[VINEXT_HISTORY_INDEX_HISTORY_STATE_KEY];
+	if (metadata.bfcacheIds !== void 0) if (bfcacheIdsWereCleared) {
+		delete nextState[VINEXT_BFCACHE_IDS_HISTORY_STATE_KEY];
+		delete nextState[VINEXT_BFCACHE_VERSION_HISTORY_STATE_KEY];
+	} else nextState[VINEXT_BFCACHE_IDS_HISTORY_STATE_KEY] = { ...metadata.bfcacheIds };
+	if (metadata.bfcacheVersion !== void 0) if (bfcacheIdsWereCleared) delete nextState[VINEXT_BFCACHE_VERSION_HISTORY_STATE_KEY];
+	else if (isNonNegativeSafeInteger(metadata.bfcacheVersion)) nextState[VINEXT_BFCACHE_VERSION_HISTORY_STATE_KEY] = metadata.bfcacheVersion;
+	else delete nextState[VINEXT_BFCACHE_VERSION_HISTORY_STATE_KEY];
+	return Object.keys(nextState).length > 0 ? nextState : null;
+}
+function createExternalHistoryStatePreservingMetadata(callerState, currentHistoryState) {
+	const previousNextUrl = readHistoryStatePreviousNextUrl(currentHistoryState);
+	const traversalIndex = readHistoryStateTraversalIndex(currentHistoryState);
+	const bfcacheIds = readHistoryStateBfcacheIds(currentHistoryState);
+	const bfcacheVersion = readHistoryStateBfcacheVersion(currentHistoryState);
+	if (previousNextUrl === null && traversalIndex === null && bfcacheIds === null) return callerState;
+	return createHistoryStateWithNavigationMetadata(callerState, {
+		bfcacheIds,
+		bfcacheVersion: bfcacheIds === null ? void 0 : bfcacheVersion,
+		previousNextUrl,
+		traversalIndex
+	});
+}
+function readHistoryStatePreviousNextUrl(state) {
+	const value = readHistoryStateRecord(state)?.[VINEXT_PREVIOUS_NEXT_URL_HISTORY_STATE_KEY];
+	return typeof value === "string" ? value : null;
+}
+function isBfcacheSegmentId(id) {
+	const parsed = AppElementsWire.parseElementKey(id);
+	return parsed?.kind === "layout" || parsed?.kind === "page" || parsed?.kind === "slot" || parsed?.kind === "template";
+}
+function readHistoryStateBfcacheIds(state) {
+	const value = readHistoryStateRecord(state)?.[VINEXT_BFCACHE_IDS_HISTORY_STATE_KEY];
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	const ids = {};
+	for (const [key, id] of Object.entries(value)) {
+		if (!isBfcacheSegmentId(key) || typeof id !== "string") return null;
+		ids[key] = id;
+	}
+	return ids;
+}
+function readHistoryStateBfcacheVersion(state) {
+	const value = readHistoryStateRecord(state)?.[VINEXT_BFCACHE_VERSION_HISTORY_STATE_KEY];
+	return isNonNegativeSafeInteger(value) ? value : null;
+}
+/**
+* Whether a history entry's stored bfcache version matches the document's
+* current version. A missing/invalid stored version (null) is NEVER current:
+* coercing it to 0 would let un-versioned entries (older builds / external
+* pushState) pass the gate on a fresh document whose current version is 0,
+* defeating the document-scoped stale-id rejection. App-written entries always
+* carry an explicit version, so the legitimate first-document path (0 === 0)
+* still matches.
+*/
+function isHistoryStateBfcacheVersionCurrent(state, currentVersion) {
+	const version = readHistoryStateBfcacheVersion(state);
+	return version !== null && version === currentVersion;
+}
+function createHashOnlyHistoryStatePreservingNavigationMetadata(state) {
+	const previousNextUrl = readHistoryStatePreviousNextUrl(state);
+	const bfcacheIds = readHistoryStateBfcacheIds(state);
+	const bfcacheVersion = readHistoryStateBfcacheVersion(state);
+	if (previousNextUrl === null && bfcacheIds === null) return null;
+	return createHistoryStateWithNavigationMetadata(null, {
+		bfcacheIds,
+		bfcacheVersion: bfcacheIds === null ? void 0 : bfcacheVersion,
+		previousNextUrl
+	});
+}
+function readHistoryStateTraversalIndex(state) {
+	const value = readHistoryStateRecord(state)?.[VINEXT_HISTORY_INDEX_HISTORY_STATE_KEY];
+	return isNonNegativeSafeInteger(value) ? value : null;
+}
+function resolveHistoryTraversalIntent(options) {
+	const targetHistoryIndex = readHistoryStateTraversalIndex(options.historyState);
+	let direction = "unknown";
+	if (options.currentHistoryIndex !== null && targetHistoryIndex !== null) {
+		if (targetHistoryIndex < options.currentHistoryIndex) direction = "back";
+		else if (targetHistoryIndex > options.currentHistoryIndex) direction = "forward";
+	}
+	return {
+		direction,
+		historyState: options.historyState,
+		targetHistoryIndex
+	};
+}
+//#endregion
+export { HistoryStateSnapshotCache, RestorableClientStateController, createExternalHistoryStatePreservingMetadata, createHashOnlyHistoryStatePreservingNavigationMetadata, createHistoryStateWithNavigationMetadata, createHistoryStateWithPreviousNextUrl, isHistoryStateBfcacheVersionCurrent, readHistoryStateBfcacheIds, readHistoryStateBfcacheVersion, readHistoryStatePreviousNextUrl, readHistoryStateTraversalIndex, resolveHistoryTraversalIntent };

package/dist/server/app-hook-warning-suppression.d.ts

@@ -0,0 +1,6 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+
+//#region src/server/app-hook-warning-suppression.d.ts
+declare const suppressHookWarningAls: AsyncLocalStorage<boolean>;
+//#endregion
+export { suppressHookWarningAls };

package/dist/server/app-hook-warning-suppression.js

@@ -0,0 +1,10 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/server/app-hook-warning-suppression.ts
+const suppressHookWarningAls = new AsyncLocalStorage();
+const _origConsoleError = console.error;
+console.error = (...args) => {
+	if (suppressHookWarningAls.getStore() === true && typeof args[0] === "string" && args[0].includes("Invalid hook call")) return;
+	_origConsoleError.apply(console, args);
+};
+//#endregion
+export { suppressHookWarningAls };

package/dist/server/app-inline-css-client.d.ts

@@ -0,0 +1,6 @@
+//#region src/server/app-inline-css-client.d.ts
+type InlineCssStylesheetLinkElement = Pick<HTMLLinkElement, "getAttribute" | "hasAttribute">;
+declare function isInlineCssStylesheetLinkElement(link: InlineCssStylesheetLinkElement): boolean;
+declare function removeStylesheetLinksCoveredByInlineCss(): void;
+//#endregion
+export { isInlineCssStylesheetLinkElement, removeStylesheetLinksCoveredByInlineCss };

package/dist/server/app-inline-css-client.js

@@ -0,0 +1,35 @@
+import { htmlTokenListContains } from "./html.js";
+//#region src/server/app-inline-css-client.ts
+function inlineStyleCoversStylesheetHref(styleHref, linkHref) {
+	for (const candidate of styleHref.split(/\s+/)) {
+		if (candidate === linkHref) return true;
+		try {
+			const candidateUrl = new URL(candidate, window.location.href);
+			const linkUrl = new URL(linkHref, window.location.href);
+			if (candidateUrl.href === linkUrl.href) return true;
+		} catch {}
+	}
+	return false;
+}
+function isInlineCssStylesheetLinkElement(link) {
+	return htmlTokenListContains(link.getAttribute("rel"), "stylesheet") && link.hasAttribute("href") && (link.hasAttribute("data-precedence") || link.hasAttribute("precedence"));
+}
+function removeStylesheetLinksCoveredByInlineCss() {
+	const inlineStyles = document.head.querySelectorAll("style[data-vinext-inline-css][data-href]");
+	if (inlineStyles.length === 0) return;
+	const links = document.head.querySelectorAll("link[rel][href]");
+	for (const link of links) {
+		if (!isInlineCssStylesheetLinkElement(link)) continue;
+		const href = link.getAttribute("href");
+		if (!href) continue;
+		for (const style of inlineStyles) {
+			const styleHref = style.getAttribute("data-href");
+			if (styleHref && inlineStyleCoversStylesheetHref(styleHref, href)) {
+				link.remove();
+				break;
+			}
+		}
+	}
+}
+//#endregion
+export { isInlineCssStylesheetLinkElement, removeStylesheetLinksCoveredByInlineCss };

package/dist/server/app-interception-context-header.d.ts

@@ -0,0 +1,32 @@
+//#region src/server/app-interception-context-header.d.ts
+/**
+ * Normalize the `x-vinext-interception-context` header from inbound requests.
+ *
+ * The browser sends the current pathname (e.g. `/feed`) as interception context
+ * so the server can decide whether to render an intercepted parallel route.
+ * The legitimate value is always a same-origin URL pathname produced by the
+ * vinext browser entry — never an arbitrary string.
+ *
+ * Security: this value flows into cache-key construction (via
+ * `getOptimisticRouteTemplateKey`, `getOptimisticPrefetchSourceKey`, and
+ * outbound RSC payload cache keys). Without bounds, an attacker who controls
+ * this header can fabricate unbounded distinct values to fragment the cache
+ * or drive per-write KV billing. See `SECURITY-AUDIT-2026-05.md` finding
+ * F-PROD-1.
+ *
+ * Bounds applied:
+ *   - Null bytes are stripped (header-injection defense).
+ *   - The value must start with `/` (a pathname).
+ *   - Whitespace is rejected (real pathnames do not contain raw whitespace;
+ *     legitimate spaces would be percent-encoded).
+ *   - Length capped at MAX_INTERCEPTION_CONTEXT_LENGTH bytes. Values that
+ *     exceed the cap are treated as absent so the request is still served,
+ *     just without interception.
+ *
+ * Anything that fails validation returns null, matching the prior behavior of
+ * an absent header. This is intentionally more permissive than rejecting the
+ * whole request — interception is a progressive enhancement.
+ */
+declare function normalizeInterceptionContextHeader(raw: string | null | undefined): string | null;
+//#endregion
+export { normalizeInterceptionContextHeader };

package/dist/server/app-interception-context-header.js

@@ -0,0 +1,42 @@
+//#region src/server/app-interception-context-header.ts
+/**
+* Normalize the `x-vinext-interception-context` header from inbound requests.
+*
+* The browser sends the current pathname (e.g. `/feed`) as interception context
+* so the server can decide whether to render an intercepted parallel route.
+* The legitimate value is always a same-origin URL pathname produced by the
+* vinext browser entry — never an arbitrary string.
+*
+* Security: this value flows into cache-key construction (via
+* `getOptimisticRouteTemplateKey`, `getOptimisticPrefetchSourceKey`, and
+* outbound RSC payload cache keys). Without bounds, an attacker who controls
+* this header can fabricate unbounded distinct values to fragment the cache
+* or drive per-write KV billing. See `SECURITY-AUDIT-2026-05.md` finding
+* F-PROD-1.
+*
+* Bounds applied:
+*   - Null bytes are stripped (header-injection defense).
+*   - The value must start with `/` (a pathname).
+*   - Whitespace is rejected (real pathnames do not contain raw whitespace;
+*     legitimate spaces would be percent-encoded).
+*   - Length capped at MAX_INTERCEPTION_CONTEXT_LENGTH bytes. Values that
+*     exceed the cap are treated as absent so the request is still served,
+*     just without interception.
+*
+* Anything that fails validation returns null, matching the prior behavior of
+* an absent header. This is intentionally more permissive than rejecting the
+* whole request — interception is a progressive enhancement.
+*/
+/** Hard cap on the byte length of the interception-context header value. */
+const MAX_INTERCEPTION_CONTEXT_LENGTH = 1024;
+function normalizeInterceptionContextHeader(raw) {
+	if (!raw) return null;
+	const stripped = raw.replaceAll("\0", "");
+	if (stripped.length === 0) return null;
+	if (stripped.length > MAX_INTERCEPTION_CONTEXT_LENGTH) return null;
+	if (!stripped.startsWith("/")) return null;
+	if (/\s/.test(stripped)) return null;
+	return stripped;
+}
+//#endregion
+export { normalizeInterceptionContextHeader };

package/dist/server/app-layout-param-observation.d.ts

@@ -0,0 +1,43 @@
+import { UnstableCacheObservation } from "../shims/cache-request-state.js";
+import { RenderRequestApiKind } from "./cache-proof.js";
+import { ClientReuseManifestRejectionCode, ClientReuseManifestTraceFields } from "./client-reuse-manifest.js";
+import { ThenableParamsObserver } from "../shims/thenable-params.js";
+
+//#region src/server/app-layout-param-observation.d.ts
+type AppLayoutParamAccessObservation = Readonly<{
+  cacheLifeObserved: boolean;
+  cacheTags: readonly string[];
+  cacheableFetchCount: number;
+  completeness: "complete" | "unknown";
+  dynamicFetchCount: number;
+  /**
+   * `markDynamicUsage()` fired during the probe (e.g. `"use cache: private"`,
+   * `connection()`) with no other observable trace. Folded in from the
+   * isolated probe scope so this signal can't diverge from the Layer-3
+   * `dynamicDetected` path it replaced.
+   */
+  dynamicUsageObserved: boolean;
+  finiteRevalidateSeconds: number | null;
+  keys: readonly string[];
+  observed: boolean;
+  paramScopeKeys: readonly string[];
+  requestApis: readonly RenderRequestApiKind[];
+  unstableCaches: readonly UnstableCacheObservation[];
+}>;
+type AppLayoutParamAccessTracker = Readonly<{
+  createThenableParamsObserver: (layoutId: string) => ThenableParamsObserver;
+  getLayoutObservation: (layoutId: string) => AppLayoutParamAccessObservation;
+  recordLayoutFiniteRevalidate: (layoutId: string, revalidateSeconds: number) => void;
+  recordLayoutParamScope: (layoutId: string, paramScopeKeys: readonly string[]) => void;
+  runLayoutProbe: (layoutId: string, probe: () => unknown) => unknown;
+}>;
+type StaticLayoutObservationSkipCode = Extract<ClientReuseManifestRejectionCode, `SKIP_LAYOUT_${string}`>;
+type StaticLayoutObservationSkipRejection = Readonly<{
+  code: StaticLayoutObservationSkipCode;
+  fields: ClientReuseManifestTraceFields;
+}>;
+declare function getStaticLayoutObservationSkipRejection(observation: AppLayoutParamAccessObservation): StaticLayoutObservationSkipRejection | null;
+declare function isAppLayoutObservationUnsafeForStaticReuse(observation: AppLayoutParamAccessObservation): boolean;
+declare function createAppLayoutParamAccessTracker(): AppLayoutParamAccessTracker;
+//#endregion
+export { AppLayoutParamAccessObservation, AppLayoutParamAccessTracker, StaticLayoutObservationSkipRejection, createAppLayoutParamAccessTracker, getStaticLayoutObservationSkipRejection, isAppLayoutObservationUnsafeForStaticReuse };