@rsalmn/extremerouter 0.7.7 → 0.7.9

package/app/node_modules/next/dist/lib/verify-typescript-setup.js

@@ -2,14 +2,26 @@
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
-Object.defineProperty(exports, "verifyAndRunTypeScript", {
-    enumerable: true,
-    get: function() {
+0 && (module.exports = {
+    verifyAndRunTypeScript: null,
+    verifyAndRunTypeScriptInWorker: null
+});
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: all[name]
+    });
+}
+_export(exports, {
+    verifyAndRunTypeScript: function() {
         return verifyAndRunTypeScript;
+    },
+    verifyAndRunTypeScriptInWorker: function() {
+        return verifyAndRunTypeScriptInWorker;
     }
 });
 const _picocolors = require("./picocolors");
-const _path = /*#__PURE__*/ _interop_require_wildcard(require("path"));
+const _path = /*#__PURE__*/ _interop_require_default(require("path"));
 const _hasnecessarydependencies = require("./has-necessary-dependencies");
 const _semver = /*#__PURE__*/ _interop_require_default(require("next/dist/compiled/semver"));
 const _compileerror = require("./compile-error");
@@ -20,7 +32,7 @@ const _writeConfigurationDefaults = require("./typescript/writeConfigurationDefa
 const _installdependencies = require("./install-dependencies");
 const _ciinfo = require("../server/ci-info");
 const _missingDependencyError = require("./typescript/missingDependencyError");
-const _resolvefrom = require("./resolve-from");
+const _runTypeScriptCli = require("./typescript/runTypeScriptCli");
 function _interop_require_default(obj) {
     return obj && obj.__esModule ? obj : {
         default: obj
@@ -67,13 +79,18 @@ function _interop_require_wildcard(obj, nodeInterop) {
     }
     return newObj;
 }
-const typescriptPackage = {
+const typescriptApiPackage = {
     file: 'typescript/lib/typescript.js',
     pkg: 'typescript',
+    install: 'typescript@^6.0.0',
     exportsRestrict: true
 };
-const requiredPackages = [
-    typescriptPackage,
+const typescriptCliPackage = {
+    file: 'typescript/bin/tsc',
+    pkg: 'typescript',
+    exportsRestrict: true
+};
+const requiredTypePackages = [
     {
         file: '@types/react/index.d.ts',
         pkg: '@types/react',
@@ -85,21 +102,10 @@ const requiredPackages = [
         exportsRestrict: true
     }
 ];
-/**
- * Check if @typescript/native-preview is installed as an alternative TypeScript compiler.
- * This is a Go-based native TypeScript compiler that can be used instead of the standard
- * TypeScript package for faster compilation.
- */ function hasNativeTypeScriptPreview(dir) {
-    try {
-        (0, _resolvefrom.resolveFrom)(dir, '@typescript/native-preview/package.json');
-        return true;
-    } catch  {
-        return false;
-    }
-}
-async function verifyAndRunTypeScript({ dir, distDir, cacheDir, strictRouteTypes, tsconfigPath, shouldRunTypeCheck, typedRoutes, disableStaticImages, hasAppDir, hasPagesDir, appDir, pagesDir, debugBuildPaths }) {
+async function verifyAndRunTypeScript({ dir, distDir, cacheDir, strictRouteTypes, tsconfigPath, shouldRunTypeCheck, typedRoutes, disableStaticImages, hasAppDir, hasPagesDir, appDir, pagesDir, debugBuildPaths, useTypeScriptCli = false, onFirstCliOutput }) {
     const tsConfigFileName = tsconfigPath || 'tsconfig.json';
     const resolvedTsConfigPath = _path.default.join(dir, tsConfigFileName);
+    const typeCheckMode = useTypeScriptCli ? 'typescript-cli' : 'typescript-api';
     // Construct intentDirs from appDir and pagesDir for getTypeScriptIntent
     const intentDirs = [
         pagesDir,
@@ -111,17 +117,26 @@ async function verifyAndRunTypeScript({ dir, distDir, cacheDir, strictRouteTypes
         const intent = await (0, _getTypeScriptIntent.getTypeScriptIntent)(dir, intentDirs, tsConfigFileName);
         if (!intent) {
             return {
-                version: null
+                version: null,
+                typeCheckMode
             };
         }
         // Check if @typescript/native-preview is installed as an alternative
-        const hasNativePreview = hasNativeTypeScriptPreview(dir);
+        const hasNativePreview = (0, _runTypeScriptCli.hasNativeTypeScriptPreview)(dir);
+        const installedTypeScript = (0, _runTypeScriptCli.getTypeScriptPackageInfo)(dir);
+        if (!useTypeScriptCli && !hasNativePreview && installedTypeScript && !installedTypeScript.apiPath) {
+            throw (0, _runTypeScriptCli.getTypeScriptApiMissingError)(installedTypeScript.version);
+        }
+        const requiredPackages = [
+            useTypeScriptCli ? typescriptCliPackage : typescriptApiPackage,
+            ...requiredTypePackages
+        ];
         // Ensure TypeScript and necessary `@types/*` are installed:
         let deps = (0, _hasnecessarydependencies.hasNecessaryDependencies)(dir, requiredPackages);
         // If @typescript/native-preview is installed and only the typescript package is missing,
         // we can skip auto-installing typescript since the native preview provides TS compilation.
         // However, we still need @types/react and @types/node for type checking.
-        if (hasNativePreview && ((_deps_missing = deps.missing) == null ? void 0 : _deps_missing.length) > 0) {
+        if (!useTypeScriptCli && hasNativePreview && ((_deps_missing = deps.missing) == null ? void 0 : _deps_missing.length) > 0) {
             const missingWithoutTypescript = deps.missing.filter((dep)=>dep.pkg !== 'typescript');
             const onlyTypescriptMissing = deps.missing.length === 1 && deps.missing[0].pkg === 'typescript';
             if (onlyTypescriptMissing) {
@@ -139,7 +154,8 @@ async function verifyAndRunTypeScript({ dir, distDir, cacheDir, strictRouteTypes
                     typedRoutes
                 });
                 return {
-                    version: null
+                    version: null,
+                    typeCheckMode
                 };
             }
             // If there are other missing deps besides typescript, only install those
@@ -162,10 +178,14 @@ async function verifyAndRunTypeScript({ dir, distDir, cacheDir, strictRouteTypes
             });
             deps = (0, _hasnecessarydependencies.hasNecessaryDependencies)(dir, requiredPackages);
         }
-        // Load TypeScript after we're sure it exists:
-        const tsPackageJsonPath = deps.resolved.get((0, _path.join)('typescript', 'package.json'));
-        const typescriptPackageJson = require(tsPackageJsonPath);
-        const typescriptVersion = typescriptPackageJson.version;
+        const typeScriptPackage = (0, _runTypeScriptCli.getTypeScriptPackageInfo)(dir);
+        const typeScriptPath = useTypeScriptCli ? typeScriptPackage == null ? void 0 : typeScriptPackage.tscPath : typeScriptPackage == null ? void 0 : typeScriptPackage.apiPath;
+        if (!typeScriptPackage || !typeScriptPath) {
+            (0, _missingDependencyError.missingDepsError)(dir, deps.missing.length > 0 ? deps.missing : [
+                useTypeScriptCli ? typescriptCliPackage : typescriptApiPackage
+            ]);
+        }
+        const typescriptVersion = typeScriptPackage.version;
         if (_semver.default.lt(typescriptVersion, '5.1.0')) {
             _log.warn(`Minimum recommended TypeScript version is v5.1.0, older versions can potentially be incompatible with Next.js. Detected: ${typescriptVersion}`);
         }
@@ -184,45 +204,66 @@ async function verifyAndRunTypeScript({ dir, distDir, cacheDir, strictRouteTypes
         });
         let result;
         if (shouldRunTypeCheck) {
-            const { runTypeCheck } = require('./typescript/runTypeCheck');
-            // Install native bindings so that code frame rendering works in the worker
-            const { installBindings } = require('../build/swc/install-bindings');
-            await installBindings();
-            const tsPath = deps.resolved.get('typescript');
-            const typescript = await Promise.resolve(require(tsPath));
-            // Verify the project passes type-checking before we go to webpack phase:
-            result = await runTypeCheck(typescript, dir, distDir, resolvedTsConfigPath, cacheDir, hasAppDir, {
-                app: appDir,
-                pages: pagesDir
-            }, debugBuildPaths);
+            if (useTypeScriptCli) {
+                if (debugBuildPaths) {
+                    _log.warn('`experimental.useTypeScriptCli` checks the complete TypeScript project; `--debug-build-paths` does not limit type checking.');
+                }
+                const { runTypeCheckCli } = require('./typescript/runTypeCheckCli');
+                result = await runTypeCheckCli({
+                    baseDir: dir,
+                    tsConfigPath: resolvedTsConfigPath,
+                    tscPath: typeScriptPath,
+                    cacheDir,
+                    onFirstOutput: onFirstCliOutput
+                });
+            } else {
+                const { runTypeCheck } = require('./typescript/runTypeCheck');
+                // Install native bindings so that code frame rendering works in the worker
+                const { installBindings } = require('../build/swc/install-bindings');
+                await installBindings();
+                const typescript = await Promise.resolve(require(typeScriptPath));
+                // Verify the project passes type-checking before we go to webpack phase:
+                result = await runTypeCheck(typescript, dir, distDir, resolvedTsConfigPath, cacheDir, hasAppDir, {
+                    app: appDir,
+                    pages: pagesDir
+                }, debugBuildPaths);
+            }
         }
         return {
             result,
-            version: typescriptVersion
+            version: typescriptVersion,
+            typeCheckMode
         };
     } catch (err) {
-        // These are special errors that should not show a stack trace:
+        // Print the user-facing message here and rethrow. This function runs both
+        // in-process (next dev / next test / next typegen, and the CLI type-check
+        // during build) and inside a jest worker (the TypeScript-API type-check
+        // during build). A thrown error does not survive the worker boundary — the
+        // parent only sees `Call retries were exceeded` — so the message must be
+        // printed on this side. The caller decides what to do with the throw (exit,
+        // or tolerate it as `next dev` does on re-verification).
         if (err instanceof _compileerror.CompileError) {
+            // The checker already printed its diagnostics.
             console.error((0, _picocolors.red)('Failed to type check.\n'));
-            console.error(err.message);
-            process.exit(1);
-        }
-        /**
-     * verifyAndRunTypeScript can be either invoked directly in the main thread (during next dev / next lint)
-     * or run in a worker (during next build). In the latter case, we need to print the error message, as the
-     * parent process will only receive an `Jest worker encountered 1 child process exceptions, exceeding retry limit`.
-     */ // we are in a worker, print the error message and exit the process
-        if (process.env.IS_NEXT_WORKER) {
-            if (err instanceof Error) {
+            if (err.message) {
                 console.error(err.message);
-            } else {
-                console.error(err);
             }
-            process.exit(1);
+        } else if (err instanceof Error) {
+            console.error(err.message);
+        } else {
+            console.error(err);
         }
-        // we are in the main thread, throw the error and it will be handled by the caller
         throw err;
     }
 }
+async function verifyAndRunTypeScriptInWorker(options) {
+    try {
+        return await verifyAndRunTypeScript(options);
+    } catch  {
+        // The error was already printed by `verifyAndRunTypeScript`.
+        // Kill the worker with a non-zero exit code.
+        process.exit(1);
+    }
+}
 
 //# sourceMappingURL=verify-typescript-setup.js.map

package/app/node_modules/next/dist/server/app-render/action-handler.js

@@ -125,7 +125,6 @@ function addRevalidationHeader(res, { workStore, requestStore }) {
 /**
  * Forwards a server action request to a separate worker. Used when the requested action is not available in the current worker.
  */ async function createForwardedActionResponse(req, res, host, workerPathname, basePath) {
-    var _getRequestMeta;
     if (!host) {
         throw Object.defineProperty(new Error('Invariant: Missing `host` header from a forwarded Server Actions request.'), "__NEXT_ERROR_CODE", {
             value: "E226",
@@ -138,10 +137,31 @@ function addRevalidationHeader(res, { workStore, requestStore }) {
     // we use this to skip rendering the flight tree so that we don't update the UI
     // with the response from the forwarded worker
     forwardedHeaders.set('x-action-forwarded', '1');
-    const proto = ((_getRequestMeta = (0, _requestmeta.getRequestMeta)(req, 'initProtocol')) == null ? void 0 : _getRequestMeta.replace(/:+$/, '')) || 'https';
-    // For standalone or the serverful mode, use the internal origin directly
-    // other than the host headers from the request.
-    const origin = process.env.__NEXT_PRIVATE_ORIGIN || `${proto}://${host.value}`;
+    // TODO: Remove __NEXT_PRIVATE_ORIGIN
+    let origin = process.env.__NEXT_PRIVATE_ORIGIN;
+    if (origin === undefined) {
+        const initUrl = (0, _requestmeta.getRequestMeta)(req, 'initURL');
+        if (initUrl !== undefined) {
+            try {
+                const parsedUrl = new URL(initUrl);
+                origin = parsedUrl.origin;
+            } catch (error) {
+                throw Object.defineProperty(new Error('Could not determine origin for forwarded Server Actions request. This can happen if port or hostname are not configured for this server.', {
+                    cause: error
+                }), "__NEXT_ERROR_CODE", {
+                    value: "E1148",
+                    enumerable: false,
+                    configurable: true
+                });
+            }
+        } else {
+            throw Object.defineProperty(new _invarianterror.InvariantError('Missing initURL'), "__NEXT_ERROR_CODE", {
+                value: "E1147",
+                enumerable: false,
+                configurable: true
+            });
+        }
+    }
     const fetchUrl = new URL(`${origin}${basePath}${workerPathname}`);
     try {
         var _response_headers_get, // Since we aren't consuming the response body, we cancel it to avoid memory leaks
@@ -245,7 +265,6 @@ async function createRedirectRenderResult(req, res, originalHost, redirectUrl, r
     // `basePath` we treat it as an app-relative redirect;
     const appRelativeRedirectUrl = getAppRelativeRedirectUrl(basePath, originalHost, redirectUrl, currentPathname);
     if (appRelativeRedirectUrl) {
-        var _getRequestMeta;
         if (!originalHost) {
             throw Object.defineProperty(new Error('Invariant: Missing `host` header from a forwarded Server Actions request.'), "__NEXT_ERROR_CODE", {
                 value: "E226",
@@ -255,10 +274,31 @@ async function createRedirectRenderResult(req, res, originalHost, redirectUrl, r
         }
         const forwardedHeaders = getForwardedHeaders(req, res);
         forwardedHeaders.set(_approuterheaders.RSC_HEADER, '1');
-        const proto = ((_getRequestMeta = (0, _requestmeta.getRequestMeta)(req, 'initProtocol')) == null ? void 0 : _getRequestMeta.replace(/:+$/, '')) || 'https';
-        // For standalone or the serverful mode, use the internal origin directly
-        // other than the host headers from the request.
-        const origin = process.env.__NEXT_PRIVATE_ORIGIN || `${proto}://${originalHost.value}`;
+        // TODO: Remove __NEXT_PRIVATE_ORIGIN
+        let origin = process.env.__NEXT_PRIVATE_ORIGIN;
+        if (origin === undefined) {
+            const initUrl = (0, _requestmeta.getRequestMeta)(req, 'initURL');
+            if (initUrl !== undefined) {
+                try {
+                    const parsedUrl = new URL(initUrl);
+                    origin = parsedUrl.origin;
+                } catch (error) {
+                    throw Object.defineProperty(new Error('Could not determine origin for forwarded Server Actions request. This can happen if port or hostname are not configured for this server.', {
+                        cause: error
+                    }), "__NEXT_ERROR_CODE", {
+                        value: "E1148",
+                        enumerable: false,
+                        configurable: true
+                    });
+                }
+            } else {
+                throw Object.defineProperty(new _invarianterror.InvariantError('Missing initURL'), "__NEXT_ERROR_CODE", {
+                    value: "E1147",
+                    enumerable: false,
+                    configurable: true
+                });
+            }
+        }
         const fetchUrl = new URL(`${origin}${appRelativeRedirectUrl.pathname}${appRelativeRedirectUrl.search}`);
         if (workStore.pendingRevalidatedTags) {
             var _workStore_incrementalCache_prerenderManifest_preview, _workStore_incrementalCache_prerenderManifest, _workStore_incrementalCache;
@@ -370,7 +410,8 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
     }
     // If the app has no server actions at all, we can 404 early.
     if (!hasServerActions()) {
-        return handleUnrecognizedFetchAction(getActionNotFoundError(actionId));
+        const error = actionId !== null && !(0, _serverreferenceinfo.mightBeServerReferenceId)(actionId) ? (0, _manifestssingleton.getInvalidServerReferenceIdError)(actionId) : (0, _manifestssingleton.getActionNotFoundError)(actionId);
+        return handleUnrecognizedFetchAction(error);
     }
     if (workStore.isStaticGeneration) {
         throw Object.defineProperty(new Error("Invariant: server actions can't be handled during static rendering"), "__NEXT_ERROR_CODE", {
@@ -473,6 +514,10 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
             // We only use these for fetch actions -- MPA actions handle them inside `decodeAction`.
             let actionModId;
             let boundActionArguments = [];
+            const defaultBodySizeLimit = '1 MB';
+            const bodySizeLimit = (serverActions == null ? void 0 : serverActions.bodySizeLimit) ?? defaultBodySizeLimit;
+            const bodySizeLimitBytes = bodySizeLimit !== defaultBodySizeLimit ? require('next/dist/compiled/bytes').parse(bodySizeLimit) : 1024 * 1024 // 1 MB
+            ;
             if (// The type check here ensures that `req` is correctly typed, and the
             // environment variable check provides dead code elimination.
             process.env.NEXT_RUNTIME === 'edge' && (0, _helpers.isWebNextRequest)(req)) {
@@ -483,13 +528,48 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
                         configurable: true
                     });
                 }
-                // TODO: add body limit
                 // Use react-server-dom-webpack/server
                 const { createTemporaryReferenceSet, decodeReply, decodeAction, decodeFormState } = ComponentMod;
                 temporaryReferences = createTemporaryReferenceSet();
                 if (isMultipartAction) {
                     // TODO-APP: Add streaming support
-                    const formData = await req.request.formData();
+                    // Read the body stream with size tracking to enforce bodySizeLimitBytes.
+                    // We cannot call req.request.formData() directly as that would bypass
+                    // the body size limit entirely.
+                    const edgeChunks = [];
+                    let edgeBodySize = 0;
+                    const edgeReader = req.body.getReader();
+                    while(true){
+                        const { done, value } = await edgeReader.read();
+                        if (done) break;
+                        edgeBodySize += value.byteLength;
+                        if (edgeBodySize > bodySizeLimitBytes) {
+                            const { ApiError } = require('../api-utils');
+                            throw Object.defineProperty(new ApiError(413, `Body exceeded ${bodySizeLimit} limit.\n` + `To configure the body size limit for Server Actions, see: https://nextjs.org/docs/app/api-reference/next-config-js/serverActions#bodysizelimit`), "__NEXT_ERROR_CODE", {
+                                value: "E394",
+                                enumerable: false,
+                                configurable: true
+                            });
+                        }
+                        edgeChunks.push(value);
+                    }
+                    // Reconstruct a Blob from the buffered chunks and parse formData from it.
+                    // Note: we must pass the original Content-Type as an explicit header
+                    // rather than relying on the Blob's `type`. The Blob constructor
+                    // normalizes `type` to ASCII lowercase per the File API spec, which
+                    // would lowercase the multipart boundary parameter (e.g.
+                    // `boundary=----WebKitFormBoundaryAbCdEf`). The body bytes contain the
+                    // original mixed-case boundary delimiter, so a lowercased boundary
+                    // would fail to match and `formData()` would throw. An explicit header
+                    // on the Request takes precedence over the Blob's normalized type.
+                    const edgeBodyBlob = new Blob(edgeChunks);
+                    const formData = await new Request('http://n/', {
+                        method: 'POST',
+                        headers: {
+                            'content-type': req.headers['content-type'] ?? ''
+                        },
+                        body: edgeBodyBlob
+                    }).formData();
                     if (isFetchAction) {
                         // A fetch action with a multipart body.
                         try {
@@ -547,12 +627,22 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
                     // In practice, this happens if `encodeReply` returned a string instead of FormData,
                     // which can happen for very simple JSON-like values that don't need multiple flight rows.
                     const chunks = [];
+                    let nonMultipartBodySize = 0;
                     const reader = req.body.getReader();
                     while(true){
                         const { done, value } = await reader.read();
                         if (done) {
                             break;
                         }
+                        nonMultipartBodySize += value.byteLength;
+                        if (nonMultipartBodySize > bodySizeLimitBytes) {
+                            const { ApiError } = require('../api-utils');
+                            throw Object.defineProperty(new ApiError(413, `Body exceeded ${bodySizeLimit} limit.\n` + `To configure the body size limit for Server Actions, see: https://nextjs.org/docs/app/api-reference/next-config-js/serverActions#bodysizelimit`), "__NEXT_ERROR_CODE", {
+                                value: "E394",
+                                enumerable: false,
+                                configurable: true
+                            });
+                        }
                         chunks.push(value);
                     }
                     const actionData = Buffer.concat(chunks).toString('utf-8');
@@ -572,10 +662,6 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
                 // state prefix in minimal mode), use it instead of req.body
                 const actionBodyFromMeta = (0, _requestmeta.getRequestMeta)(req, 'actionBody');
                 const body = actionBodyFromMeta ? Readable.from(actionBodyFromMeta) : req.body;
-                const defaultBodySizeLimit = '1 MB';
-                const bodySizeLimit = (serverActions == null ? void 0 : serverActions.bodySizeLimit) ?? defaultBodySizeLimit;
-                const bodySizeLimitBytes = bodySizeLimit !== defaultBodySizeLimit ? require('next/dist/compiled/bytes').parse(bodySizeLimit) : 1024 * 1024 // 1 MB
-                ;
                 let size = 0;
                 const sizeLimitTransform = new Transform({
                     transform (chunk, encoding, callback) {
@@ -927,7 +1013,6 @@ async function executeActionAndPrepareForRender(action, args, workStore, request
  * the action came from a different deployment. It could also simply be an invalid POST request that is not a server action.
  * In either case, we'll throw an error to be handled by the caller.
  */ function getActionModIdOrError(actionId, serverModuleMap) {
-    var _serverModuleMap_actionId;
     // if we're missing the action ID header, we can't do any further processing
     if (!actionId) {
         throw Object.defineProperty(new _invarianterror.InvariantError("Missing 'next-action' header."), "__NEXT_ERROR_CODE", {
@@ -936,28 +1021,28 @@ async function executeActionAndPrepareForRender(action, args, workStore, request
             configurable: true
         });
     }
-    const actionModId = (_serverModuleMap_actionId = serverModuleMap[actionId]) == null ? void 0 : _serverModuleMap_actionId.id;
-    if (!actionModId) {
-        throw getActionNotFoundError(actionId);
+    const entry = serverModuleMap[actionId];
+    if (entry == null) {
+        // The proxy throws for malformed IDs and IDs that are missing from the
+        // manifest. It only returns undefined when the ID collides with a
+        // well-known property name (e.g. `toString`) that the proxy excludes from
+        // server reference validation so that framework reflection probes don't
+        // throw. Next.js never produces such an ID, so this is almost certainly a
+        // probe with a known-bad ID. Repeat the manifest's throw logic here so the
+        // caller gets a diagnosable error instead of a `TypeError`.
+        throw (0, _serverreferenceinfo.mightBeServerReferenceId)(actionId) ? (0, _manifestssingleton.getActionNotFoundError)(actionId) : (0, _manifestssingleton.getInvalidServerReferenceIdError)(actionId);
     }
-    return actionModId;
-}
-function getActionNotFoundError(actionId) {
-    return Object.defineProperty(new Error(`Failed to find Server Action${actionId ? ` "${actionId}"` : ''}. This request might be from an older or newer deployment.\nRead more: https://nextjs.org/docs/messages/failed-to-find-server-action`), "__NEXT_ERROR_CODE", {
-        value: "E974",
-        enumerable: false,
-        configurable: true
-    });
+    return entry.id;
 }
 const $ACTION_ = '$ACTION_';
 const $ACTION_REF_ = '$ACTION_REF_';
 const $ACTION_ID_ = '$ACTION_ID_';
-const ACTION_ID_EXPECTED_LENGTH = 42;
 /**
  * This function mirrors logic inside React's decodeAction and should be kept in sync with that.
  * It pre-parses the FormData to ensure that any action IDs referred to are actual action IDs for
  * this Next.js application.
  */ function areAllActionIdsValid(mpaFormData, serverModuleMap) {
+    let seenActionRefs = 0;
     let hasAtLeastOneAction = false;
     // Before we attempt to decode the payload for a possible MPA action, assert that all
     // action IDs are valid IDs. If not we should disregard the payload
@@ -972,6 +1057,12 @@ const ACTION_ID_EXPECTED_LENGTH = 42;
             }
             hasAtLeastOneAction = true;
         } else if (key.startsWith($ACTION_REF_)) {
+            if (++seenActionRefs > 2) {
+                // We only expect to see at most 2 $ACTION_REF_ fields in the form data:
+                // one from <form action="..." method="post">
+                // and one from <input action="..." type="submit">
+                return false;
+            }
             // Bound args case
             const actionDescriptorField = $ACTION_ + key.slice($ACTION_REF_.length) + ':0';
             const actionFields = mpaFormData.getAll(actionDescriptorField);
@@ -996,10 +1087,13 @@ function isInvalidStringActionDescriptor(actionDescriptor, serverModuleMap) {
         return true;
     }
     const from = ACTION_DESCRIPTOR_ID_PREFIX.length;
-    const to = from + ACTION_ID_EXPECTED_LENGTH;
+    const to = actionDescriptor.indexOf('"', from);
+    if (to === -1) {
+        return true;
+    }
     // We expect actionDescriptor to be '{"id":"<actionId>",...}'
     const actionId = actionDescriptor.slice(from, to);
-    if (actionId.length !== ACTION_ID_EXPECTED_LENGTH || actionDescriptor[to] !== '"') {
+    if (!(0, _serverreferenceinfo.mightBeServerReferenceId)(actionId)) {
         return true;
     }
     const entry = serverModuleMap[actionId];
@@ -1012,11 +1106,12 @@ function isInvalidActionIdFieldName(actionIdFieldName, serverModuleMap) {
     // The field name must always start with $ACTION_ID_ but since it is
     // the id is extracted from the key of the field we have already validated
     // this before entering this function
-    if (actionIdFieldName.length !== $ACTION_ID_.length + ACTION_ID_EXPECTED_LENGTH) {
+    const actionId = actionIdFieldName.slice($ACTION_ID_.length);
+    if (!(0, _serverreferenceinfo.mightBeServerReferenceId)(actionId)) {
         // this field name has too few or too many characters
+        // or it is otherwise in the wrong format
         return true;
     }
-    const actionId = actionIdFieldName.slice($ACTION_ID_.length);
     const entry = serverModuleMap[actionId];
     if (entry == null) {
         return true;

package/app/node_modules/next/dist/server/app-render/manifests-singleton.js

@@ -3,7 +3,9 @@ Object.defineProperty(exports, "__esModule", {
     value: true
 });
 0 && (module.exports = {
+    getActionNotFoundError: null,
     getClientReferenceManifest: null,
+    getInvalidServerReferenceIdError: null,
     getServerActionsManifest: null,
     getServerModuleMap: null,
     selectWorkerForForwarding: null,
@@ -16,9 +18,15 @@ function _export(target, all) {
     });
 }
 _export(exports, {
+    getActionNotFoundError: function() {
+        return getActionNotFoundError;
+    },
     getClientReferenceManifest: function() {
         return getClientReferenceManifest;
     },
+    getInvalidServerReferenceIdError: function() {
+        return getInvalidServerReferenceIdError;
+    },
     getServerActionsManifest: function() {
         return getServerActionsManifest;
     },
@@ -36,7 +44,36 @@ const _invarianterror = require("../../shared/lib/invariant-error");
 const _apppaths = require("../../shared/lib/router/utils/app-paths");
 const _pathhasprefix = require("../../shared/lib/router/utils/path-has-prefix");
 const _removepathprefix = require("../../shared/lib/router/utils/remove-path-prefix");
+const _serverreferenceinfo = require("../../shared/lib/server-reference-info");
+const _reflectutils = require("../../shared/lib/utils/reflect-utils");
 const _workasyncstorageexternal = require("./work-async-storage.external");
+function getActionNotFoundError(actionId) {
+    return Object.defineProperty(new Error(`Failed to find Server Action${actionId ? ` "${actionId}"` : ''}. This request might be from an older or newer deployment.\nRead more: https://nextjs.org/docs/messages/failed-to-find-server-action`), "__NEXT_ERROR_CODE", {
+        value: "E974",
+        enumerable: false,
+        configurable: true
+    });
+}
+function getInvalidServerReferenceIdError(id) {
+    // `id` is arbitrary client-provided input. Unlike the not-found case, it has
+    // not passed the length gate and can reach this error via a malformed server
+    // reference in an action payload, so it may be of any length and contain
+    // control characters. `JSON.stringify` escapes newlines and quotes so it
+    // can't forge log lines, and truncating overly long ids prevents log
+    // flooding. Ids at or below the cap are logged in full so that we only add an
+    // ellipsis to ids that are meaningfully longer than the truncated length.
+    const encoded = JSON.stringify(id.length > MAX_LOGGED_SERVER_REFERENCE_ID_LENGTH ? id.slice(0, TRUNCATED_SERVER_REFERENCE_ID_LENGTH) + '…' : id);
+    return Object.defineProperty(new Error(`The Server Reference ID did not match the expected format. Received ${encoded}.\nRead more: https://nextjs.org/docs/messages/failed-to-find-server-action`), "__NEXT_ERROR_CODE", {
+        value: "E1144",
+        enumerable: false,
+        configurable: true
+    });
+}
+// Ids at or below the cap are logged in full. Longer ids are truncated to the
+// shorter length and marked with an ellipsis, so the cap leaves headroom over
+// the truncated length rather than ellipsizing ids that are barely too long.
+const MAX_LOGGED_SERVER_REFERENCE_ID_LENGTH = 100;
+const TRUNCATED_SERVER_REFERENCE_ID_LENGTH = 90;
 // This is a global singleton that is, among other things, also used to
 // encode/decode bound args of server function closures. This can't be using a
 // AsyncLocalStorage as it might happen at the module level.
@@ -148,12 +185,23 @@ function createProxiedClientReferenceManifest(clientReferenceManifestsPerRoute)
  * our manifest contains a lot of internal Next.js data that are relevant to the
  * runtime, workers, etc. that React doesn't need to know.
  */ function createServerModuleMap() {
-    return new Proxy({}, {
-        get: (_, id)=>{
+    return new Proxy(Object.create(null), {
+        get: (target, id, receiver)=>{
             var _getServerActionsManifest__id, _getServerActionsManifest_;
+            // React's debug serialization can probe the module map like a plain object.
+            // These probes are not server reference lookups.
+            if (typeof id !== 'string') {
+                return Reflect.get(target, id, receiver);
+            }
+            if (_reflectutils.wellKnownProperties.has(id)) {
+                return Reflect.get(target, id, receiver);
+            }
+            if (!(0, _serverreferenceinfo.mightBeServerReferenceId)(id)) {
+                throw getInvalidServerReferenceIdError(id);
+            }
             const workers = (_getServerActionsManifest_ = getServerActionsManifest()[process.env.NEXT_RUNTIME === 'edge' ? 'edge' : 'node']) == null ? void 0 : (_getServerActionsManifest__id = _getServerActionsManifest_[id]) == null ? void 0 : _getServerActionsManifest__id.workers;
             if (!workers) {
-                return undefined;
+                throw getActionNotFoundError(id);
             }
             const workStore = _workasyncstorageexternal.workAsyncStorage.getStore();
             let workerEntry;
@@ -170,7 +218,7 @@ function createProxiedClientReferenceManifest(clientReferenceManifestsPerRoute)
                 workerEntry = Object.values(workers).at(0);
             }
             if (!workerEntry) {
-                return undefined;
+                throw getActionNotFoundError(id);
             }
             const { moduleId, async } = workerEntry;
             return {

package/app/node_modules/next/dist/server/config-schema.js

@@ -257,7 +257,6 @@ const experimentalSchema = {
     imgOptTimeoutInSeconds: _zod.z.number().int().optional(),
     imgOptMaxInputPixels: _zod.z.number().int().optional(),
     imgOptSequentialRead: _zod.z.boolean().optional().nullable(),
-    imgOptSkipMetadata: _zod.z.boolean().optional().nullable(),
     isrFlushToDisk: _zod.z.boolean().optional(),
     largePageDataBytes: _zod.z.number().optional(),
     linkNoTouchStart: _zod.z.boolean().optional(),
@@ -373,6 +372,7 @@ const experimentalSchema = {
     optimizePackageImports: _zod.z.array(_zod.z.string()).optional(),
     optimizeServerReact: _zod.z.boolean().optional(),
     strictRouteTypes: _zod.z.boolean().optional(),
+    useTypeScriptCli: _zod.z.boolean().optional(),
     clientTraceMetadata: _zod.z.array(_zod.z.string()).optional(),
     serverMinification: _zod.z.boolean().optional(),
     serverSourceMaps: _zod.z.boolean().optional(),