@qzsy/vinext 0.1.7

package/dist/server/client-reuse-manifest.d.ts

@@ -0,0 +1,104 @@
+import { ArtifactCompatibilityEnvelope } from "./artifact-compatibility.js";
+
+//#region src/server/client-reuse-manifest.d.ts
+declare const CLIENT_REUSE_MANIFEST_SCHEMA_VERSION = 1;
+type ClientReuseManifestSchemaVersion = 1;
+declare const CLIENT_REUSE_MANIFEST_HASH_ALGORITHM = "fnv1a64";
+type ClientReuseManifestHashAlgorithm = typeof CLIENT_REUSE_MANIFEST_HASH_ALGORITHM;
+type ClientReuseManifestLimits = Readonly<{
+  maxEntryCount: number;
+  maxEntryIdLength: number;
+  maxManifestBytes: number;
+  maxPayloadHashLength: number;
+  maxVariantCacheKeyLength: number;
+}>;
+declare const DEFAULT_CLIENT_REUSE_MANIFEST_LIMITS: {
+  maxEntryCount: number;
+  maxEntryIdLength: number;
+  maxManifestBytes: number;
+  maxPayloadHashLength: number;
+  maxVariantCacheKeyLength: number;
+};
+declare const CLIENT_REUSE_MANIFEST_SKIP_VERIFICATION_ENTRY_BUDGET = 8;
+type ClientReuseManifestEntryKind = "layout" | "page" | "route" | "slot" | "template";
+type ClientReuseManifestEntryPrivacy = "private" | "public";
+type ClientReuseManifestReplayWindow = Readonly<{
+  validFromVisibleCommitVersion: number;
+  validUntilVisibleCommitVersion: number;
+}>;
+type ClientReuseManifestEntry = Readonly<{
+  artifactCompatibility: ArtifactCompatibilityEnvelope;
+  id: string;
+  kind: ClientReuseManifestEntryKind;
+  payloadHash: string;
+  privacy: "public";
+  variantCacheKey: string;
+}>;
+type ClientReuseManifestWireEntry = Readonly<{
+  artifactCompatibility: ArtifactCompatibilityEnvelope;
+  id: string;
+  payloadHash: string;
+  privacy: ClientReuseManifestEntryPrivacy;
+  variantCacheKey: string;
+}>;
+type ClientReuseManifest = Readonly<{
+  entries: readonly ClientReuseManifestEntry[];
+  hashAlgorithm: ClientReuseManifestHashAlgorithm;
+  replayWindow: ClientReuseManifestReplayWindow;
+  schemaVersion: ClientReuseManifestSchemaVersion;
+  visibleCommitVersion: number;
+}>;
+type ClientReuseManifestWire = Readonly<{
+  entries: readonly ClientReuseManifestWireEntry[];
+  hashAlgorithm: ClientReuseManifestHashAlgorithm;
+  replayWindow: ClientReuseManifestReplayWindow;
+  schemaVersion: ClientReuseManifestSchemaVersion;
+  visibleCommitVersion: number;
+}>;
+type CreateClientReuseManifestInput = Readonly<{
+  entries: readonly ClientReuseManifestWireEntry[];
+  replayWindow?: ClientReuseManifestReplayWindow;
+  visibleCommitVersion: number;
+}>;
+type ClientReuseManifestRejectionCode = "SKIP_CACHE_ARTIFACT_COMPATIBILITY_INCOMPATIBLE" | "SKIP_CACHE_ARTIFACT_COMPATIBILITY_UNKNOWN" | "SKIP_CACHE_ARTIFACT_PROOF_MISMATCH" | "SKIP_CACHE_ENTRY_ID_MISMATCH" | "SKIP_CACHE_INVALIDATED" | "SKIP_CACHE_INVALIDATION_UNKNOWN" | "SKIP_CACHE_PAYLOAD_HASH_MISMATCH" | "SKIP_CACHE_PAYLOAD_HASH_MISSING" | "SKIP_CACHE_PROOF_MISSING" | "SKIP_CACHE_PROOF_REJECTED" | "SKIP_CACHE_REUSE_CLASS_UNSUPPORTED" | "SKIP_CACHE_VARIANT_MISMATCH" | "SKIP_LAYOUT_CACHE_LIFE_OBSERVED" | "SKIP_LAYOUT_CACHE_TAGS_OBSERVED" | "SKIP_LAYOUT_CACHEABLE_FETCHES_OBSERVED" | "SKIP_LAYOUT_DYNAMIC_FETCHES_OBSERVED" | "SKIP_LAYOUT_DYNAMIC_USAGE_OBSERVED" | "SKIP_LAYOUT_PARAMS_OBSERVED" | "SKIP_LAYOUT_PARAMS_OBSERVATION_INCOMPLETE" | "SKIP_LAYOUT_PARAMS_PRESENT" | "SKIP_LAYOUT_REVALIDATE_PRESENT" | "SKIP_LAYOUT_REQUEST_API_OBSERVED" | "SKIP_LAYOUT_UNSTABLE_CACHE_OBSERVED" | "SKIP_ARTIFACT_COMPATIBILITY_INVALID" | "SKIP_ENTRY_COUNT_EXCEEDED" | "SKIP_VERIFICATION_BUDGET_EXCEEDED" | "SKIP_ENTRY_HASH_INVALID" | "SKIP_ENTRY_ID_INVALID" | "SKIP_ENTRY_ID_TOO_LONG" | "SKIP_ENTRY_MALFORMED" | "SKIP_ENTRY_ORDER_NON_CANONICAL" | "SKIP_HASH_ALGORITHM_UNSUPPORTED" | "SKIP_MANIFEST_MALFORMED" | "SKIP_MANIFEST_SCHEMA_UNSUPPORTED" | "SKIP_MANIFEST_TOO_LARGE" | "SKIP_PRIVATE_ENTRY" | "SKIP_REPLAY_WINDOW_INVALID" | "SKIP_UNKNOWN_ENTRY" | "SKIP_VARIANT_CACHE_KEY_INVALID" | "SKIP_VARIANT_CACHE_KEY_TOO_LONG" | "SKIP_VISIBLE_COMMIT_VERSION_INVALID" | "SKIP_VISIBLE_COMMIT_VERSION_MISMATCH";
+type ClientReuseManifestTraceFieldValue = string | number | boolean | null | readonly string[];
+type ClientReuseManifestTraceFields = Readonly<Record<string, ClientReuseManifestTraceFieldValue>>;
+type ClientReuseManifestRejection = Readonly<{
+  code: ClientReuseManifestRejectionCode;
+  fields: ClientReuseManifestTraceFields;
+}>;
+type ClientReuseManifestEntryRejection = ClientReuseManifestRejection & Readonly<{
+  entryId: string | null;
+}>;
+type ClientReuseManifestSkipDisposition = Readonly<{
+  code: "SKIP_MODEL_DISABLED";
+  enabled: false;
+  mode: "renderAndSend";
+}> | Readonly<{
+  code: "SKIP_STATIC_LAYOUT_VERIFIED";
+  enabled: true;
+  mode: "skipStaticLayout";
+  skippedEntryIds: readonly string[];
+}>;
+type ClientReuseManifestParseResult = Readonly<{
+  kind: "absent";
+}> | Readonly<{
+  kind: "rejected";
+  rejection: ClientReuseManifestRejection;
+}> | Readonly<{
+  entryRejections: readonly ClientReuseManifestEntryRejection[];
+  kind: "parsed";
+  manifest: ClientReuseManifest;
+  skipDisposition: ClientReuseManifestSkipDisposition;
+}>;
+type ParseClientReuseManifestOptions = Readonly<{
+  currentVisibleCommitVersion?: number;
+  limits?: ClientReuseManifestLimits;
+}>;
+declare function countUtf8Bytes(input: string): number;
+declare function createClientReusePayloadHash(input: string): string;
+declare function createClientReuseManifest(input: CreateClientReuseManifestInput): ClientReuseManifestWire;
+declare function serializeClientReuseManifest(input: CreateClientReuseManifestInput): string;
+declare function parseClientReuseManifestHeader(rawHeader: string | null | undefined, options?: ParseClientReuseManifestOptions): ClientReuseManifestParseResult;
+//#endregion
+export { CLIENT_REUSE_MANIFEST_HASH_ALGORITHM, CLIENT_REUSE_MANIFEST_SCHEMA_VERSION, CLIENT_REUSE_MANIFEST_SKIP_VERIFICATION_ENTRY_BUDGET, ClientReuseManifestEntry, ClientReuseManifestEntryRejection, ClientReuseManifestParseResult, ClientReuseManifestRejection, ClientReuseManifestRejectionCode, ClientReuseManifestSkipDisposition, ClientReuseManifestTraceFields, DEFAULT_CLIENT_REUSE_MANIFEST_LIMITS, countUtf8Bytes, createClientReuseManifest, createClientReusePayloadHash, parseClientReuseManifestHeader, serializeClientReuseManifest };

package/dist/server/client-reuse-manifest.js

@@ -0,0 +1,209 @@
+import { isUnknownRecord } from "../utils/record.js";
+import { fnv1a64 } from "../utils/hash.js";
+import { parseArtifactCompatibilityEnvelope } from "./artifact-compatibility.js";
+import { AppElementsWire } from "./app-elements-wire.js";
+import { isNonNegativeSafeInteger } from "../utils/number.js";
+//#region src/server/client-reuse-manifest.ts
+const CLIENT_REUSE_MANIFEST_SCHEMA_VERSION = 1;
+const CLIENT_REUSE_MANIFEST_HASH_ALGORITHM = "fnv1a64";
+const DEFAULT_CLIENT_REUSE_MANIFEST_LIMITS = {
+	maxEntryCount: 64,
+	maxEntryIdLength: 512,
+	maxManifestBytes: 4096,
+	maxPayloadHashLength: 16,
+	maxVariantCacheKeyLength: 256
+};
+const CLIENT_REUSE_MANIFEST_SKIP_VERIFICATION_ENTRY_BUDGET = 8;
+const HASH_DIGEST_PATTERN = /^[0-9a-z]+$/;
+const textEncoder = new TextEncoder();
+function createRejection(code, fields = {}) {
+	return {
+		code,
+		fields
+	};
+}
+function rejectManifest(code, fields = {}) {
+	return {
+		kind: "rejected",
+		rejection: createRejection(code, fields)
+	};
+}
+function rejectEntry(code, entryId, fields = {}) {
+	return {
+		code,
+		entryId,
+		fields
+	};
+}
+function compareManifestEntries(left, right) {
+	if (left.id < right.id) return -1;
+	if (left.id > right.id) return 1;
+	return 0;
+}
+function createCanonicalWireEntries(entries) {
+	const entriesById = /* @__PURE__ */ new Map();
+	for (const entry of entries) if (!entriesById.has(entry.id)) entriesById.set(entry.id, entry);
+	return Array.from(entriesById.values()).sort(compareManifestEntries);
+}
+function countUtf8Bytes(input) {
+	return textEncoder.encode(input).length;
+}
+function parseReplayWindow(value, visibleCommitVersion) {
+	if (!isUnknownRecord(value)) return {
+		kind: "rejected",
+		rejection: createRejection("SKIP_REPLAY_WINDOW_INVALID", { field: "replayWindow" })
+	};
+	const validFromVisibleCommitVersion = value.validFromVisibleCommitVersion;
+	const validUntilVisibleCommitVersion = value.validUntilVisibleCommitVersion;
+	if (!isNonNegativeSafeInteger(validFromVisibleCommitVersion) || !isNonNegativeSafeInteger(validUntilVisibleCommitVersion) || validFromVisibleCommitVersion > validUntilVisibleCommitVersion || visibleCommitVersion < validFromVisibleCommitVersion || visibleCommitVersion > validUntilVisibleCommitVersion) return {
+		kind: "rejected",
+		rejection: createRejection("SKIP_REPLAY_WINDOW_INVALID", {
+			validFromVisibleCommitVersion: isNonNegativeSafeInteger(validFromVisibleCommitVersion) ? validFromVisibleCommitVersion : null,
+			validUntilVisibleCommitVersion: isNonNegativeSafeInteger(validUntilVisibleCommitVersion) ? validUntilVisibleCommitVersion : null,
+			visibleCommitVersion
+		})
+	};
+	return {
+		kind: "parsed",
+		replayWindow: {
+			validFromVisibleCommitVersion,
+			validUntilVisibleCommitVersion
+		}
+	};
+}
+function currentCommitVersionMatchesReplayWindow(currentVisibleCommitVersion, replayWindow) {
+	if (currentVisibleCommitVersion === void 0) return true;
+	return currentVisibleCommitVersion >= replayWindow.validFromVisibleCommitVersion && currentVisibleCommitVersion <= replayWindow.validUntilVisibleCommitVersion;
+}
+function parseEntryKind(id) {
+	const parsed = AppElementsWire.parseElementKey(id);
+	if (parsed === null) return null;
+	return parsed.kind;
+}
+function isValidPayloadHash(value, limits) {
+	return typeof value === "string" && value.length > 0 && value.length <= limits.maxPayloadHashLength && HASH_DIGEST_PATTERN.test(value);
+}
+function parseManifestEntry(value, limits, index) {
+	if (!isUnknownRecord(value)) return rejectEntry("SKIP_ENTRY_MALFORMED", null, { index });
+	const id = value.id;
+	if (typeof id !== "string" || id.length === 0) return rejectEntry("SKIP_ENTRY_ID_INVALID", null, { index });
+	if (id.length > limits.maxEntryIdLength) return rejectEntry("SKIP_ENTRY_ID_TOO_LONG", id, {
+		idHash: createClientReusePayloadHash(id),
+		maxEntryIdLength: limits.maxEntryIdLength
+	});
+	const kind = parseEntryKind(id);
+	if (kind === null) return rejectEntry("SKIP_UNKNOWN_ENTRY", id, { idHash: createClientReusePayloadHash(id) });
+	const privacy = value.privacy;
+	if (privacy === "private") return rejectEntry("SKIP_PRIVATE_ENTRY", id, { privacy });
+	if (privacy !== "public") return rejectEntry("SKIP_ENTRY_MALFORMED", id, { field: "privacy" });
+	const payloadHash = value.payloadHash;
+	if (!isValidPayloadHash(payloadHash, limits)) return rejectEntry("SKIP_ENTRY_HASH_INVALID", id, { maxPayloadHashLength: limits.maxPayloadHashLength });
+	const variantCacheKey = value.variantCacheKey;
+	if (typeof variantCacheKey !== "string" || variantCacheKey.length === 0) return rejectEntry("SKIP_VARIANT_CACHE_KEY_INVALID", id, { field: "variantCacheKey" });
+	if (variantCacheKey.length > limits.maxVariantCacheKeyLength) return rejectEntry("SKIP_VARIANT_CACHE_KEY_TOO_LONG", id, {
+		maxVariantCacheKeyLength: limits.maxVariantCacheKeyLength,
+		variantCacheKeyHash: createClientReusePayloadHash(variantCacheKey)
+	});
+	const artifactCompatibility = parseArtifactCompatibilityEnvelope(value.artifactCompatibility);
+	if (artifactCompatibility === null) return rejectEntry("SKIP_ARTIFACT_COMPATIBILITY_INVALID", id, { field: "artifactCompatibility" });
+	return {
+		artifactCompatibility,
+		id,
+		kind,
+		payloadHash,
+		privacy,
+		variantCacheKey
+	};
+}
+function createClientReusePayloadHash(input) {
+	return fnv1a64(input);
+}
+function createClientReuseManifest(input) {
+	const replayWindow = input.replayWindow ?? {
+		validFromVisibleCommitVersion: input.visibleCommitVersion,
+		validUntilVisibleCommitVersion: input.visibleCommitVersion
+	};
+	return {
+		entries: createCanonicalWireEntries(input.entries),
+		hashAlgorithm: CLIENT_REUSE_MANIFEST_HASH_ALGORITHM,
+		replayWindow,
+		schemaVersion: 1,
+		visibleCommitVersion: input.visibleCommitVersion
+	};
+}
+function serializeClientReuseManifest(input) {
+	return JSON.stringify(createClientReuseManifest(input));
+}
+function parseClientReuseManifestHeader(rawHeader, options = {}) {
+	const header = rawHeader?.trim();
+	if (!header) return { kind: "absent" };
+	const limits = options.limits ?? DEFAULT_CLIENT_REUSE_MANIFEST_LIMITS;
+	const manifestBytes = countUtf8Bytes(header);
+	if (manifestBytes > limits.maxManifestBytes) return rejectManifest("SKIP_MANIFEST_TOO_LARGE", {
+		manifestBytes,
+		maxManifestBytes: limits.maxManifestBytes
+	});
+	let decoded;
+	try {
+		decoded = JSON.parse(header);
+	} catch {
+		return rejectManifest("SKIP_MANIFEST_MALFORMED");
+	}
+	if (!isUnknownRecord(decoded)) return rejectManifest("SKIP_MANIFEST_MALFORMED", { field: "manifest" });
+	if (decoded.schemaVersion !== 1) return rejectManifest("SKIP_MANIFEST_SCHEMA_UNSUPPORTED", { schemaVersion: typeof decoded.schemaVersion === "number" || typeof decoded.schemaVersion === "string" ? decoded.schemaVersion : null });
+	if (decoded.hashAlgorithm !== "fnv1a64") return rejectManifest("SKIP_HASH_ALGORITHM_UNSUPPORTED", { hashAlgorithm: typeof decoded.hashAlgorithm === "string" ? decoded.hashAlgorithm : null });
+	const visibleCommitVersion = decoded.visibleCommitVersion;
+	if (!isNonNegativeSafeInteger(visibleCommitVersion)) return rejectManifest("SKIP_VISIBLE_COMMIT_VERSION_INVALID", { visibleCommitVersion: null });
+	const replayWindowResult = parseReplayWindow(decoded.replayWindow, visibleCommitVersion);
+	if (replayWindowResult.kind === "rejected") return {
+		kind: "rejected",
+		rejection: replayWindowResult.rejection
+	};
+	const { replayWindow } = replayWindowResult;
+	if (!currentCommitVersionMatchesReplayWindow(options.currentVisibleCommitVersion, replayWindow)) return rejectManifest("SKIP_VISIBLE_COMMIT_VERSION_MISMATCH", {
+		currentVisibleCommitVersion: options.currentVisibleCommitVersion ?? null,
+		validFromVisibleCommitVersion: replayWindow.validFromVisibleCommitVersion,
+		validUntilVisibleCommitVersion: replayWindow.validUntilVisibleCommitVersion,
+		visibleCommitVersion
+	});
+	const entriesValue = decoded.entries;
+	if (!Array.isArray(entriesValue)) return rejectManifest("SKIP_MANIFEST_MALFORMED", { field: "entries" });
+	if (entriesValue.length > limits.maxEntryCount) return rejectManifest("SKIP_ENTRY_COUNT_EXCEEDED", {
+		entryCount: entriesValue.length,
+		maxEntryCount: limits.maxEntryCount
+	});
+	const entries = [];
+	const entryRejections = [];
+	let previousEntryId = null;
+	for (let index = 0; index < entriesValue.length; index++) {
+		const value = entriesValue[index];
+		if (isUnknownRecord(value) && typeof value.id === "string") {
+			if (previousEntryId !== null && value.id <= previousEntryId) return rejectManifest("SKIP_ENTRY_ORDER_NON_CANONICAL", {
+				entryIdHash: createClientReusePayloadHash(value.id),
+				previousEntryIdHash: createClientReusePayloadHash(previousEntryId)
+			});
+			previousEntryId = value.id;
+		}
+		const parsedEntry = parseManifestEntry(value, limits, index);
+		if ("code" in parsedEntry) entryRejections.push(parsedEntry);
+		else entries.push(parsedEntry);
+	}
+	return {
+		entryRejections,
+		kind: "parsed",
+		manifest: {
+			entries,
+			hashAlgorithm: CLIENT_REUSE_MANIFEST_HASH_ALGORITHM,
+			replayWindow,
+			schemaVersion: 1,
+			visibleCommitVersion
+		},
+		skipDisposition: {
+			code: "SKIP_MODEL_DISABLED",
+			enabled: false,
+			mode: "renderAndSend"
+		}
+	};
+}
+//#endregion
+export { CLIENT_REUSE_MANIFEST_HASH_ALGORITHM, CLIENT_REUSE_MANIFEST_SCHEMA_VERSION, CLIENT_REUSE_MANIFEST_SKIP_VERIFICATION_ENTRY_BUDGET, DEFAULT_CLIENT_REUSE_MANIFEST_LIMITS, countUtf8Bytes, createClientReuseManifest, createClientReusePayloadHash, parseClientReuseManifestHeader, serializeClientReuseManifest };

package/dist/server/client-trace-metadata.d.ts

@@ -0,0 +1,30 @@
+//#region src/server/client-trace-metadata.d.ts
+type ClientTraceDataEntry = {
+  key: string;
+  value: string;
+};
+/**
+ * Filter an entry list against the configured `clientTraceMetadata` allow-list.
+ * Returns `undefined` when the allow-list is unset so callers can skip
+ * rendering altogether.
+ */
+declare function filterClientTraceMetadata(entries: readonly ClientTraceDataEntry[], allowList: readonly string[] | undefined): ClientTraceDataEntry[] | undefined;
+/**
+ * Render the filtered entries as a sequence of self-closing `<meta>` tags.
+ * Names and values are HTML-attribute escaped. Returns an empty string when
+ * `entries` is empty or undefined so callers can append unconditionally.
+ */
+declare function renderClientTraceMetadataTags(entries: readonly ClientTraceDataEntry[] | undefined): string;
+/**
+ * Convenience helper: read OTel propagation data, filter against the
+ * configured allow-list, and render the resulting `<meta>` tags. Returns an
+ * empty string when the allow-list is unset, OTel is not installed, or no
+ * matching keys were emitted by the propagator.
+ *
+ * Safe to call unconditionally on every SSR render — when nothing is
+ * configured/active this is a few `try/catch`-bounded operations and returns
+ * `""`.
+ */
+declare function getClientTraceMetadataHTML(allowList: readonly string[] | undefined): string;
+//#endregion
+export { ClientTraceDataEntry, filterClientTraceMetadata, getClientTraceMetadataHTML, renderClientTraceMetadataTags };

package/dist/server/client-trace-metadata.js

@@ -0,0 +1,81 @@
+import { escapeHtmlAttr } from "./html.js";
+//#region src/server/client-trace-metadata.ts
+/**
+* Client trace metadata renderer.
+*
+* When `experimental.clientTraceMetadata` is configured in `next.config`,
+* vinext emits `<meta name="..." content="...">` tags in the SSR HTML head
+* for each configured key. The values are sourced from the active
+* OpenTelemetry context via the registered propagator.
+*
+* This mirrors Next.js' implementation:
+*  - packages/next/src/server/lib/trace/utils.ts (getTracedMetadata)
+*  - packages/next/src/server/app-render/make-get-server-inserted-html.tsx (traceMetaTags)
+*
+* OpenTelemetry is an optional peer — we resolve `@opentelemetry/api` at
+* runtime and silently no-op when it is not installed. This matches user
+* expectations: apps that don't configure OTel get no meta tags, and apps
+* that do get the filtered subset they asked for in `clientTraceMetadata`.
+*/
+const carrierSetter = { set(carrier, key, value) {
+	if (typeof key !== "string" || typeof value !== "string") return;
+	carrier.push({
+		key,
+		value
+	});
+} };
+function getOpenTelemetryTraceData() {
+	let api;
+	try {
+		const req = globalThis.require;
+		if (typeof req === "function") api = req("@opentelemetry/api");
+	} catch {
+		return [];
+	}
+	if (!api) return [];
+	try {
+		const activeContext = api.context.active();
+		const entries = [];
+		api.propagation.inject(activeContext, entries, carrierSetter);
+		return entries;
+	} catch {
+		return [];
+	}
+}
+/**
+* Filter an entry list against the configured `clientTraceMetadata` allow-list.
+* Returns `undefined` when the allow-list is unset so callers can skip
+* rendering altogether.
+*/
+function filterClientTraceMetadata(entries, allowList) {
+	if (!allowList || allowList.length === 0) return void 0;
+	const allowSet = new Set(allowList);
+	return entries.filter(({ key }) => allowSet.has(key));
+}
+/**
+* Render the filtered entries as a sequence of self-closing `<meta>` tags.
+* Names and values are HTML-attribute escaped. Returns an empty string when
+* `entries` is empty or undefined so callers can append unconditionally.
+*/
+function renderClientTraceMetadataTags(entries) {
+	if (!entries || entries.length === 0) return "";
+	let html = "";
+	for (const { key, value } of entries) html += `<meta name="${escapeHtmlAttr(key)}" content="${escapeHtmlAttr(value)}"/>`;
+	return html;
+}
+/**
+* Convenience helper: read OTel propagation data, filter against the
+* configured allow-list, and render the resulting `<meta>` tags. Returns an
+* empty string when the allow-list is unset, OTel is not installed, or no
+* matching keys were emitted by the propagator.
+*
+* Safe to call unconditionally on every SSR render — when nothing is
+* configured/active this is a few `try/catch`-bounded operations and returns
+* `""`.
+*/
+function getClientTraceMetadataHTML(allowList) {
+	if (!allowList || allowList.length === 0) return "";
+	return renderClientTraceMetadataTags(filterClientTraceMetadata(getOpenTelemetryTraceData(), allowList));
+}
+//#endregion
+export { filterClientTraceMetadata, getClientTraceMetadataHTML, renderClientTraceMetadataTags };

package/dist/server/cookie-utils.d.ts

@@ -0,0 +1,12 @@
+//#region src/server/cookie-utils.d.ts
+/**
+ * Parse the cookie name out of a serialised Set-Cookie line.
+ *
+ * Bounded by the first `;` so the attribute portion (e.g. `Path=/`) is never
+ * mistaken for part of the name when the value happens to contain another
+ * `=`. Returns null when the line is not parseable (defensive — callers keep
+ * unparseable entries verbatim so they don't drop user-supplied cookies).
+ */
+declare function getSetCookieName(cookie: string): string | null;
+//#endregion
+export { getSetCookieName };

package/dist/server/cookie-utils.js

@@ -0,0 +1,18 @@
+//#region src/server/cookie-utils.ts
+/**
+* Parse the cookie name out of a serialised Set-Cookie line.
+*
+* Bounded by the first `;` so the attribute portion (e.g. `Path=/`) is never
+* mistaken for part of the name when the value happens to contain another
+* `=`. Returns null when the line is not parseable (defensive — callers keep
+* unparseable entries verbatim so they don't drop user-supplied cookies).
+*/
+function getSetCookieName(cookie) {
+	const equalsIndex = cookie.indexOf("=");
+	if (equalsIndex <= 0) return null;
+	const semicolonIndex = cookie.indexOf(";");
+	const end = semicolonIndex === -1 ? equalsIndex : Math.min(equalsIndex, semicolonIndex);
+	return cookie.slice(0, end);
+}
+//#endregion
+export { getSetCookieName };

package/dist/server/csp.d.ts

@@ -0,0 +1,10 @@
+import { IncomingHttpHeaders, OutgoingHttpHeaders } from "node:http";
+
+//#region src/server/csp.d.ts
+type NodeHeaders = IncomingHttpHeaders | OutgoingHttpHeaders;
+declare function getScriptNonceFromHeader(cspHeaderValue: string): string | undefined;
+declare function getScriptNonceFromHeaders(headers: Headers | null | undefined): string | undefined;
+declare function getScriptNonceFromNodeHeaderSources(...headersList: readonly (NodeHeaders | null | undefined)[]): string | undefined;
+declare function getScriptNonceFromHeaderSources(...headersList: readonly (Headers | null | undefined)[]): string | undefined;
+//#endregion
+export { getScriptNonceFromHeader, getScriptNonceFromHeaderSources, getScriptNonceFromHeaders, getScriptNonceFromNodeHeaderSources };

package/dist/server/csp.js

@@ -0,0 +1,41 @@
+//#region src/server/csp.ts
+const ESCAPE_REGEX = /[&><\u2028\u2029]/;
+function getNodeHeaderValue(headers, key) {
+	const value = headers?.[key];
+	if (Array.isArray(value)) return value.join(", ");
+	if (value == null) return;
+	return String(value);
+}
+function getScriptNonceFromHeader(cspHeaderValue) {
+	const directives = cspHeaderValue.split(";").map((directive) => directive.trim());
+	const directive = directives.find((value) => value.startsWith("script-src")) ?? directives.find((value) => value.startsWith("default-src"));
+	if (!directive) return;
+	const nonce = directive.split(" ").slice(1).map((source) => source.trim()).find((source) => source.startsWith("'nonce-") && source.length > 8 && source.endsWith("'"))?.slice(7, -1);
+	if (!nonce) return;
+	if (ESCAPE_REGEX.test(nonce)) throw new Error("Nonce value from Content-Security-Policy contained HTML escape characters.\nLearn more: https://nextjs.org/docs/messages/nonce-contained-invalid-characters");
+	return nonce;
+}
+function getScriptNonceFromHeaders(headers) {
+	const csp = headers?.get("content-security-policy") ?? headers?.get("content-security-policy-report-only");
+	if (!csp) return;
+	return getScriptNonceFromHeader(csp);
+}
+function getScriptNonceFromNodeHeaders(headers) {
+	const csp = getNodeHeaderValue(headers, "content-security-policy") ?? getNodeHeaderValue(headers, "content-security-policy-report-only");
+	if (!csp) return;
+	return getScriptNonceFromHeader(csp);
+}
+function getScriptNonceFromNodeHeaderSources(...headersList) {
+	for (const headers of headersList) {
+		const nonce = getScriptNonceFromNodeHeaders(headers);
+		if (nonce) return nonce;
+	}
+}
+function getScriptNonceFromHeaderSources(...headersList) {
+	for (const headers of headersList) {
+		const nonce = getScriptNonceFromHeaders(headers);
+		if (nonce) return nonce;
+	}
+}
+//#endregion
+export { getScriptNonceFromHeader, getScriptNonceFromHeaderSources, getScriptNonceFromHeaders, getScriptNonceFromNodeHeaderSources };

package/dist/server/default-global-error-module.d.ts

@@ -0,0 +1,19 @@
+//#region src/server/default-global-error-module.d.ts
+/**
+ * Module-shaped wrapper around vinext's built-in default global error
+ * component. Used as the fallback when an app does not define its own
+ * `app/global-error.tsx`. The runtime treats any `{ default: Component }`
+ * record as a "global error module", so wrapping the component this way lets
+ * us thread the default through the existing `globalErrorModule` plumbing
+ * without introducing a parallel code path.
+ *
+ * Mirrors Next.js's `defaultGlobalErrorPath`
+ * (`next/dist/client/components/builtin/global-error.js`), which is selected
+ * automatically when the user has not supplied a custom global error file:
+ * https://github.com/vercel/next.js/blob/canary/packages/next/src/build/webpack/loaders/next-app-loader/index.ts
+ */
+declare const DEFAULT_GLOBAL_ERROR_MODULE: {
+  readonly default: any;
+};
+//#endregion
+export { DEFAULT_GLOBAL_ERROR_MODULE };

package/dist/server/default-global-error-module.js

@@ -0,0 +1,18 @@
+import DefaultGlobalError from "../shims/default-global-error.js";
+//#region src/server/default-global-error-module.ts
+/**
+* Module-shaped wrapper around vinext's built-in default global error
+* component. Used as the fallback when an app does not define its own
+* `app/global-error.tsx`. The runtime treats any `{ default: Component }`
+* record as a "global error module", so wrapping the component this way lets
+* us thread the default through the existing `globalErrorModule` plumbing
+* without introducing a parallel code path.
+*
+* Mirrors Next.js's `defaultGlobalErrorPath`
+* (`next/dist/client/components/builtin/global-error.js`), which is selected
+* automatically when the user has not supplied a custom global error file:
+* https://github.com/vercel/next.js/blob/canary/packages/next/src/build/webpack/loaders/next-app-loader/index.ts
+*/
+const DEFAULT_GLOBAL_ERROR_MODULE = { default: DefaultGlobalError };
+//#endregion
+export { DEFAULT_GLOBAL_ERROR_MODULE };

package/dist/server/default-not-found-module.d.ts

@@ -0,0 +1,19 @@
+//#region src/server/default-not-found-module.d.ts
+/**
+ * Module-shaped wrapper around vinext's built-in default not-found component.
+ * Used as the fallback when an app does not define its own `app/not-found.tsx`
+ * (and has not opted into `app/global-not-found.tsx`). The runtime treats any
+ * `{ default: Component }` record as a "not-found module", so wrapping the
+ * component this way lets us thread the default through the existing
+ * `rootNotFoundModule` plumbing without introducing a parallel code path.
+ *
+ * Mirrors Next.js's `defaultNotFoundPath`
+ * (`next/dist/client/components/builtin/not-found.js`), which is selected
+ * automatically when the user has not supplied a custom not-found file:
+ * https://github.com/vercel/next.js/blob/canary/packages/next/src/build/webpack/loaders/next-app-loader/index.ts
+ */
+declare const DEFAULT_NOT_FOUND_MODULE: {
+  readonly default: any;
+};
+//#endregion
+export { DEFAULT_NOT_FOUND_MODULE };

package/dist/server/default-not-found-module.js

@@ -0,0 +1,18 @@
+import DefaultNotFound from "../shims/default-not-found.js";
+//#region src/server/default-not-found-module.ts
+/**
+* Module-shaped wrapper around vinext's built-in default not-found component.
+* Used as the fallback when an app does not define its own `app/not-found.tsx`
+* (and has not opted into `app/global-not-found.tsx`). The runtime treats any
+* `{ default: Component }` record as a "not-found module", so wrapping the
+* component this way lets us thread the default through the existing
+* `rootNotFoundModule` plumbing without introducing a parallel code path.
+*
+* Mirrors Next.js's `defaultNotFoundPath`
+* (`next/dist/client/components/builtin/not-found.js`), which is selected
+* automatically when the user has not supplied a custom not-found file:
+* https://github.com/vercel/next.js/blob/canary/packages/next/src/build/webpack/loaders/next-app-loader/index.ts
+*/
+const DEFAULT_NOT_FOUND_MODULE = { default: DefaultNotFound };
+//#endregion
+export { DEFAULT_NOT_FOUND_MODULE };

package/dist/server/defer-until-stream-consumed.d.ts

@@ -0,0 +1,7 @@
+//#region src/server/defer-until-stream-consumed.d.ts
+/**
+ * Defers cleanup until the downstream consumer drains or cancels the stream.
+ */
+declare function deferUntilStreamConsumed(stream: ReadableStream<Uint8Array>, onFlush: () => void): ReadableStream<Uint8Array>;
+//#endregion
+export { deferUntilStreamConsumed };

package/dist/server/defer-until-stream-consumed.js

@@ -0,0 +1,34 @@
+//#region src/server/defer-until-stream-consumed.ts
+/**
+* Defers cleanup until the downstream consumer drains or cancels the stream.
+*/
+function deferUntilStreamConsumed(stream, onFlush) {
+	let called = false;
+	const once = () => {
+		if (!called) {
+			called = true;
+			onFlush();
+		}
+	};
+	const cleanup = new TransformStream({ flush() {
+		once();
+	} });
+	const reader = stream.pipeThrough(cleanup).getReader();
+	return new ReadableStream({
+		pull(controller) {
+			return reader.read().then(({ done, value }) => {
+				if (done) controller.close();
+				else controller.enqueue(value);
+			}, (error) => {
+				once();
+				controller.error(error);
+			});
+		},
+		cancel(reason) {
+			once();
+			return reader.cancel(reason);
+		}
+	});
+}
+//#endregion
+export { deferUntilStreamConsumed };