@webjsdev/server 0.8.39 → 0.8.40

package/src/listener-bun.js

@@ -3,9 +3,15 @@
  * selected when the host runtime is Bun. Bun's server is `Request`/`Response`
  * native, so this path skips the node:http `toWebRequest` / `sendWebResponse`
  * bridge entirely and hands the app's `handle(req): Response` straight to
- * `Bun.serve({ fetch })`. A benchmark on the full listening path (node:http
- * compat on Bun vs `Bun.serve`) measured ~1.9x more req/s, which is what justifies
- * a second shell rather than running the node compat path on Bun.
+ * `Bun.serve({ fetch })`. A microbenchmark of the LISTENING PATH ONLY (a trivial
+ * handler: node:http compat on Bun vs `Bun.serve`) measured ~1.9x more req/s,
+ * which is what justifies a second shell rather than running the node compat path
+ * on Bun. That figure is the listening-path delta, NOT end-to-end throughput: for
+ * a real SSR page the render cost dominates and the listener delta is small (see
+ * the end-to-end benchmark in `scripts/bench-listener.mjs`, #756). The hot path
+ * is kept allocation-lean: the remote IP is stamped out of band (no per-request
+ * `Request` clone, #756) and a buffered response is compressed synchronously (no
+ * per-response stream bridge).
  *
  * Feature parity with the node shell, routed through the shared
  * `listener-core.js` so the two cannot drift:
@@ -39,6 +45,7 @@ import { EventEmitter } from 'node:events';
 import { Readable, pipeline } from 'node:stream';
 import { matchApi } from './router.js';
 import { registerClient } from './broadcast.js';
+import { setTrustedRemoteIp } from './rate-limit.js';
 import {
   isCompressible,
   isEventsPath,
@@ -47,8 +54,10 @@ import {
   makeShutdown,
   negotiateEncoding,
   createCompressor,
+  compressBufferSync,
+  MAX_SYNC_COMPRESS_BYTES,
   varyWithAcceptEncoding,
-  webStreamChunks,
+  readBufferedOrStream,
 } from './listener-core.js';
 
 /* global Bun */
@@ -93,9 +102,9 @@ export function startBunListener(ctx) {
         // hints still ship in the rendered <head>, so the only loss is the
         // head-start during SSR compute, not the preloads themselves.
 
-        const webReq = stampRemoteIp(req, srv);
-        const resp = await app.handle(webReq);
-        return compress ? maybeCompress(resp, req) : resp;
+        stampRemoteIp(req, srv);
+        const resp = await app.handle(req);
+        return compress ? await maybeCompress(resp, req) : resp;
       } catch (e) {
         logger.error('request pipeline threw', { err: e instanceof Error ? e.stack : String(e) });
         return new Response(
@@ -287,20 +296,21 @@ function bunSseResponse(req, hub, app) {
 }
 
 /**
- * Stamp the framework-trusted remote IP from Bun's `server.requestIP`, after
- * stripping any spoofed inbound `x-webjs-remote-ip` (the node `toWebRequest`
- * equivalent, which reads `req.socket.remoteAddress`). Re-wraps the request with
- * the adjusted headers, preserving method + body.
+ * Stamp the framework-trusted remote IP from Bun's `server.requestIP`,
+ * out-of-band via `setTrustedRemoteIp` (#756). The previous implementation
+ * cloned the whole `Request` (`new Request(req, { headers })`) on EVERY request
+ * just to set one header; the WeakMap channel avoids that hot-path reallocation.
+ * The stamp is authoritative (`clientIp` reads it and ignores the inbound
+ * `x-webjs-remote-ip` header), so a client cannot spoof it even though the
+ * unmodified request still carries any inbound copy. Always stamps (with `''`
+ * when no IP is available) so the inbound header is never trusted on Bun.
  * @param {Request} req
  * @param {any} srv
  */
 function stampRemoteIp(req, srv) {
-  const headers = new Headers(req.headers);
-  headers.delete('x-webjs-remote-ip');
   let ip;
   try { ip = srv.requestIP(req)?.address; } catch {}
-  if (ip) headers.set('x-webjs-remote-ip', ip);
-  return new Request(req, { headers });
+  setTrustedRemoteIp(req, ip || '');
 }
 
 /**
@@ -308,35 +318,70 @@ function stampRemoteIp(req, srv) {
  * negotiation + compressor factory the node shell uses (shared in
  * `listener-core.js`). `node:zlib` runs natively on Bun, so this gives **brotli
  * on Bun** (the web `CompressionStream` used before had no brotli) and full
- * compression parity with the node shell. The body is bridged web -> node ->
- * web (`Readable.from(webStreamChunks(...))` -> `compressor` -> `Readable.toWeb`,
- * driven by `pipeline`; NOT `Readable.fromWeb`, which does not propagate a
- * mid-stream source error through `pipeline` on Bun, the #509 hang). Skips an
- * already-encoded body and a non-compressible media type (`isCompressible`
- * already excludes `text/event-stream`).
+ * compression parity with the node shell.
+ *
+ * A BUFFERED body (the common SSR page / JSON / file response, detected by
+ * `readBufferedOrStream` peeking a single bounded chunk) is compressed
+ * SYNCHRONOUSLY (`compressBufferSync`), skipping the per-response
+ * web -> node -> web stream bridge entirely (#756). A genuinely STREAMED body
+ * (Suspense, an action / route stream) or an oversized one keeps the bridge
+ * (`Readable.from(peeked.stream)` -> `compressor` -> `Readable.toWeb`, driven by
+ * `pipeline`; NOT `Readable.fromWeb`, which does not propagate a mid-stream
+ * source error through `pipeline` on Bun, the #509 hang). The sync and streamed
+ * paths use the SAME algo + params, so WITHIN a runtime the buffered fast path
+ * and the streaming bridge produce identical bytes (a buffered body is not
+ * served differently from a streamed one). Across runtimes the exact bytes can
+ * differ for gzip / deflate (Bun's bundled zlib is not the same build as Node's,
+ * so the compressed output is not guaranteed identical, byte-for-byte; brotli
+ * does match), which is fine since each response is self-describing via
+ * `content-encoding` and a client just decodes it. Skips an already-encoded body
+ * and a non-compressible media type (`isCompressible` already excludes
+ * `text/event-stream`).
  * @param {Response} resp
  * @param {Request} req
  */
-function maybeCompress(resp, req) {
+async function maybeCompress(resp, req) {
   if (!resp.body) return resp;
   if (resp.headers.has('content-encoding')) return resp;
   if (!isCompressible(resp.headers.get('content-type'))) return resp;
   const encoding = negotiateEncoding(req.headers.get('accept-encoding'));
-  const compressor = createCompressor(encoding);
-  if (!compressor) return resp;
+  if (!encoding) return resp;
 
   const headers = new Headers(resp.headers);
   headers.set('content-encoding', encoding);
-  headers.delete('content-length');
   headers.set('vary', varyWithAcceptEncoding(headers.get('vary')));
-  // Feed the web body into the compressor through the reader-loop generator (NOT
-  // Readable.fromWeb, which does not propagate a mid-stream source error through
-  // `pipeline` on Bun, the #509 hang) and drive it with `pipeline` so a source
-  // error (or a client disconnect destroying the output) tears down the whole
-  // chain instead of leaking/hanging the compressor. Backpressure is preserved:
-  // a slow client stalls `toWeb`, which stalls the compressor, which pauses the
-  // source.
-  const source = Readable.from(webStreamChunks(resp.body));
+
+  // Buffered-body fast path (#756): peek the body to tell a single bounded
+  // buffered chunk (the common SSR page / JSON / file response) from a genuinely
+  // streamed body (Suspense, an action / route stream) WITHOUT buffering a real
+  // stream. A buffered body cannot error mid-stream, so compress it synchronously
+  // and skip the per-response web -> node -> web stream bridge entirely. The sync
+  // path and the streaming bridge share the SAME algo + params, so within this
+  // runtime a buffered body and a streamed one compress identically (the wire is
+  // self-describing via content-encoding either way). A streamed / oversized body
+  // falls through to the bridge below.
+  const peeked = await readBufferedOrStream(resp.body, MAX_SYNC_COMPRESS_BYTES);
+  if (peeked.buffered !== undefined) {
+    const out = compressBufferSync(encoding, peeked.buffered);
+    headers.set('content-length', String(out.length));
+    return new Response(out, { status: resp.status, statusText: resp.statusText, headers });
+  }
+
+  headers.delete('content-length');
+  // Allocate the streaming compressor ONLY on the streamed path: the buffered
+  // fast path above used `compressBufferSync` and never needs a Transform, so
+  // hoisting this would waste a native zlib/brotli handle on the common case.
+  // `encoding` is guaranteed br/gzip/deflate (negotiateEncoding), so
+  // `createCompressor` never returns null here.
+  const compressor = createCompressor(encoding);
+  // Feed the (peeked + drained) web body into the compressor through the reader
+  // loop (NOT Readable.fromWeb, which does not propagate a mid-stream source
+  // error through `pipeline` on Bun, the #509 hang) and drive it with `pipeline`
+  // so a source error (or a client disconnect destroying the output) tears down
+  // the whole chain instead of leaking/hanging the compressor. Backpressure is
+  // preserved: a slow client stalls `toWeb`, which stalls the compressor, which
+  // pauses the source.
+  const source = Readable.from(peeked.stream);
   pipeline(source, compressor, () => {});
   const body = Readable.toWeb(compressor);
   return new Response(body, { status: resp.status, statusText: resp.statusText, headers });

package/src/listener-core.js

@@ -16,7 +16,11 @@
  * and its own `closeServer` thunk, and reuses everything else verbatim.
  */
 import { pathToFileURL } from 'node:url';
-import { createBrotliCompress, createGzip, createDeflate, constants as zlibConstants } from 'node:zlib';
+import {
+  createBrotliCompress, createGzip, createDeflate,
+  brotliCompressSync, gzipSync, deflateSync,
+  constants as zlibConstants,
+} from 'node:zlib';
 import { stripBasePath } from './base-path.js';
 
 /** The dev live-reload SSE path (matched after base-path stripping). */
@@ -96,6 +100,37 @@ export function createCompressor(encoding) {
   return null;
 }
 
+/**
+ * The largest buffered body that takes the SYNCHRONOUS compression fast path
+ * (#756). Sync `node:zlib` blocks the event loop, whereas the streaming
+ * compressor offloads to the libuv threadpool, so the sync path is a win ONLY
+ * for small bodies (a typical SSR HTML page) where the per-response stream
+ * bridge dominates; a larger buffered body keeps the non-blocking stream path.
+ */
+export const MAX_SYNC_COMPRESS_BYTES = 256 * 1024;
+
+/**
+ * Compress an already-buffered body synchronously, byte-for-byte identical to
+ * the streaming `createCompressor` ON THE SAME RUNTIME (same algorithm + params:
+ * brotli quality 4, gzip / deflate level 6, over the same `node:zlib`), so a
+ * buffered fast path and a streamed slow path produce the same wire bytes within
+ * a runtime (#756). Across runtimes the exact gzip / deflate bytes can differ
+ * (Bun's bundled zlib is not Node's build; brotli matches), which is fine since
+ * each response is self-describing via `content-encoding`. For a buffered body
+ * (one that cannot error mid-stream) this skips the per-response
+ * web -> node -> web stream bridge entirely. Returns null for an unknown / empty
+ * encoding so the caller leaves the body uncompressed.
+ * @param {'br' | 'gzip' | 'deflate' | ''} encoding
+ * @param {Uint8Array} buf
+ * @returns {Buffer | null}
+ */
+export function compressBufferSync(encoding, buf) {
+  if (encoding === 'br') return brotliCompressSync(buf, { params: { [zlibConstants.BROTLI_PARAM_QUALITY]: 4 } });
+  if (encoding === 'gzip') return gzipSync(buf, { level: 6 });
+  if (encoding === 'deflate') return deflateSync(buf, { level: 6 });
+  return null;
+}
+
 /**
  * Merge `Accept-Encoding` into an existing `Vary` header (or create it) without
  * duplicating, so compressing a response that already varies (on `Cookie`, an
@@ -135,6 +170,145 @@ export async function* webStreamChunks(web) {
   }
 }
 
+/** An async generator that throws on first pull (a source that errored before
+ * any output), so the caller's `pipeline` tears down exactly as it would for a
+ * mid-stream error. @param {unknown} err */
+async function* failingStream(err) { throw err; }
+
+/** Yield a fixed set of already-read chunks with no further reads (the source is
+ * already exhausted). @param {Uint8Array[]} chunks */
+async function* justChunks(chunks) { for (const c of chunks) yield c; }
+
+/**
+ * Drain a reader after replaying already-peeked `prefix` chunks, mirroring
+ * `webStreamChunks`' error + early-cancel semantics (so the #509 hang fix is
+ * preserved for the reconstructed stream). If `pendingError` is set (the peek's
+ * second read rejected, a mid-stream source error), the prefix is replayed and
+ * then the error is rethrown.
+ * @param {Uint8Array[]} prefix
+ * @param {ReadableStreamDefaultReader} reader
+ * @param {unknown} pendingError
+ */
+async function* drainAfter(prefix, reader, pendingError) {
+  let finished = false;
+  try {
+    for (const c of prefix) yield c;
+    if (pendingError) { finished = true; throw pendingError; }
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) { finished = true; return; }
+      yield value;
+    }
+  } finally {
+    if (!finished) { try { await reader.cancel(); } catch {} }
+    try { reader.releaseLock(); } catch {}
+  }
+}
+
+/** Sentinel: the classifying second read has not settled within a macrotask, so
+ * the body is genuinely streaming and must not be withheld (#756). */
+const STREAM_PENDING = Symbol('webjs.stream-pending');
+
+/**
+ * Drain a reader for a STREAMED body whose classifying second read is still
+ * in flight (`secondP`, a settled-shape promise `{ r }` | `{ e }`). Yields the
+ * already-peeked `firstChunk`, then CONSUMES the in-flight second read (never
+ * issuing a duplicate `reader.read()`), then drains the rest. Same error +
+ * early-cancel teardown as `drainAfter` / `webStreamChunks` (the #509 fix).
+ * @param {Uint8Array} firstChunk
+ * @param {ReadableStreamDefaultReader} reader
+ * @param {Promise<{ r?: ReadableStreamReadResult<Uint8Array>, e?: unknown }>} secondP
+ */
+async function* drainAfterPending(firstChunk, reader, secondP) {
+  let finished = false;
+  try {
+    yield firstChunk;
+    const settled = await secondP;
+    if (settled.e !== undefined) { finished = true; throw settled.e; }
+    if (settled.r.done) { finished = true; return; }
+    yield settled.r.value;
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) { finished = true; return; }
+      yield value;
+    }
+  } finally {
+    if (!finished) { try { await reader.cancel(); } catch {} }
+    try { reader.releaseLock(); } catch {}
+  }
+}
+
+/**
+ * Decide whether a web body is a single bounded buffered chunk (the common SSR
+ * page / JSON / file response) or a genuinely streamed body (Suspense, an action
+ * / route `ReadableStream`), WITHOUT buffering a real stream and WITHOUT
+ * withholding a streamed body's first byte (#756). It peeks the first chunk, then
+ * classifies on the SECOND read, but does NOT block on it: a buffered Response
+ * (built from a string / Uint8Array) has an already-closed underlying stream, so
+ * its second read settles on the next microtask; a streamed body's second chunk
+ * may be arbitrarily far in the future (a Suspense boundary resolving), and
+ * awaiting it would stall the status line + first byte until then. So the second
+ * read is RACED against a macrotask sentinel: if it settles first AND is `done`
+ * (single chunk) within `maxBytes`, the body is buffered and returned as bytes so
+ * the caller can sync-compress and skip the stream bridge; otherwise (still
+ * pending = streaming, or multi-chunk, oversized, empty, or a mid-stream error)
+ * it returns an async iterable that replays the peeked chunk(s) then drains the
+ * rest, with the same error + cancel semantics as `webStreamChunks`.
+ *
+ * @param {ReadableStream} web
+ * @param {number} maxBytes
+ * @returns {Promise<{ buffered: Uint8Array } | { stream: AsyncIterable<Uint8Array> }>}
+ */
+export async function readBufferedOrStream(web, maxBytes) {
+  const reader = web.getReader();
+  let first;
+  try {
+    first = await reader.read();
+  } catch (e) {
+    // Source errored before any output: hand back a stream that rethrows it.
+    try { reader.releaseLock(); } catch {}
+    return { stream: failingStream(e) };
+  }
+  if (first.done) {
+    try { reader.releaseLock(); } catch {}
+    return { buffered: new Uint8Array(0) };
+  }
+  const firstChunk = first.value;
+
+  // Issue the classifying second read but DO NOT await it directly: race it
+  // against a macrotask sentinel so a streamed body (whose second chunk is far
+  // off) is handed back immediately as a stream instead of stalling first paint.
+  const secondP = reader.read().then((r) => ({ r }), (e) => ({ e }));
+  const settled = await Promise.race([
+    secondP,
+    new Promise((res) => { setImmediate(() => res(STREAM_PENDING)); }),
+  ]);
+  if (settled === STREAM_PENDING) {
+    // Still in flight after a macrotask: a genuinely streamed body. Emit the
+    // first chunk now and continue from the in-flight second read (consumed by
+    // the generator, never re-issued).
+    return { stream: drainAfterPending(firstChunk, reader, secondP) };
+  }
+  if (settled.e !== undefined) {
+    // The second read errored on a short body (a mid-stream source error):
+    // replay the first chunk then rethrow, matching webStreamChunks teardown.
+    return { stream: drainAfter([firstChunk], reader, settled.e) };
+  }
+  const second = settled.r;
+  if (second.done) {
+    try { reader.releaseLock(); } catch {}
+    if (firstChunk.byteLength <= maxBytes) return { buffered: firstChunk };
+    // One chunk but too large to block the event loop on a sync compress: stream
+    // it. The source is already exhausted (second read was `done`), so just
+    // replay the single chunk with no further reads.
+    return { stream: justChunks([firstChunk]) };
+  }
+  // Two quick chunks (a small multi-chunk buffered body): not a single buffer,
+  // so stream it (replay both, then drain the rest). The second read is already
+  // consumed, so drainAfter continues from the third chunk.
+  return { stream: drainAfter([firstChunk, second.value], reader, null) };
+}
+
 /**
  * Load a `route.{js,ts}` module for its `WS` export, cache-busting in dev so a
  * code edit is picked up per connection. Shared by the node WebSocket subsystem

package/src/module-graph.js

@@ -101,10 +101,87 @@ const IMPORT_RE = /\bimport\s+(?:(?:[\w*{}\s,]+)\s+from\s+)?['"]([^'"]+)['"]/g;
  */
 const EXPORT_FROM_RE = /\bexport\b[^'";]+?\sfrom\s+['"]([^'"]+)['"]/g;
 
+/**
+ * @type {RegExp} match a dynamic `import('…')` with a STRING-LITERAL specifier
+ * only (`import('./x.ts')`, `await import("#lib/y.ts")`). A computed specifier
+ * (`import(expr)`) cannot be captured and is intentionally left out: it stays a
+ * documented limitation (and `webjs check` warns on it), not a phantom edge.
+ *
+ * Unlike the static `IMPORT_RE` (which requires `\s+` after `import`), this
+ * matches `import` immediately or with whitespace before the `(`, so the two
+ * never overlap. `m.index` is the `import` keyword start, so the same
+ * redaction-mask guard (keyword-in-code-position) applies.
+ *
+ * The specifier may be followed by `)` OR `,` so the import-attributes form
+ * `import('./data.json', { with: { type: 'json' } })` (a JSON / CSS module
+ * import) is captured too. A computed specifier still falls out: in
+ * `import('./pages/' + name)` the char after the closing quote is `+`, neither
+ * `,` nor `)`, so it does not match.
+ */
+const DYNAMIC_IMPORT_RE = /\bimport\s*\(\s*['"]([^'"]+)['"]\s*[,)]/g;
+
 /**
  * @typedef {Map<string, Set<string>>} ModuleGraph
- * A map of absolute file path → Set of absolute file paths it imports.
+ * A map of absolute file path → Set of absolute file paths it STATICALLY imports.
+ */
+
+/**
+ * Dynamic-import edges (string-literal `import('…')` only), kept SEPARATE from
+ * the static graph and keyed by it in a WeakMap. The authorization gate
+ * (`reachableFromEntries`) unions these in so a lazily-imported app module is
+ * servable instead of 404ing, but the preload walk (`transitiveDeps`) and the
+ * elision analysis stay on the static graph ONLY: a dynamic import is lazy by
+ * author intent, so eagerly preloading its target would over-fetch on every
+ * page load, and feeding dynamic edges into elision could flip a verdict. The
+ * module is fetched at call time, now served correctly by the gate.
+ * @type {WeakMap<ModuleGraph, ModuleGraph>}
+ */
+const DYNAMIC_EDGES = new WeakMap();
+
+/**
+ * The dynamic-import edges discovered for a built graph (string-literal targets
+ * only), or an empty map if none. Exposed for tests/ops.
+ * @param {ModuleGraph} graph
+ * @returns {ModuleGraph}
+ */
+export function dynamicEdges(graph) {
+  return DYNAMIC_EDGES.get(graph) || new Map();
+}
+
+/**
+ * Bare (npm vendor) import specifiers per file, kept SEPARATE from the static
+ * app graph (which only tracks relative + `#`-alias edges) and keyed by the
+ * graph in a WeakMap. Records the EXACT specifier as written (`dayjs`,
+ * `dayjs/plugin/utc`) so SSR can look it up in the vendor importmap and emit a
+ * `modulepreload` for the reached vendor URL (#754), flattening the vendor CDN
+ * waterfall. Excludes `node:` builtins and protocol specifiers.
+ * @type {WeakMap<ModuleGraph, Map<string, Set<string>>>}
+ */
+const BARE_EDGES = new WeakMap();
+
+/**
+ * The bare (npm vendor) import specifiers per file for a built graph, or an
+ * empty map if none. The values are specifiers (not resolved URLs); the caller
+ * maps them through the vendor importmap.
+ * @param {ModuleGraph} graph
+ * @returns {Map<string, Set<string>>}
  */
+export function bareImports(graph) {
+  return BARE_EDGES.get(graph) || new Map();
+}
+
+/**
+ * True for a bare npm vendor specifier (`dayjs`, `@scope/pkg/sub`), excluding
+ * relative / absolute / `#`-alias paths and `node:` / protocol specifiers.
+ * Inlined here (not imported from vendor.js) to avoid a module cycle.
+ * @param {string} spec
+ * @returns {boolean}
+ */
+function isVendorSpecifier(spec) {
+  if (!spec || spec.startsWith('.') || spec.startsWith('/') || spec.startsWith('#') || spec.startsWith('__')) return false;
+  if (spec.startsWith('node:') || /^[a-z][a-z0-9+.-]*:/.test(spec)) return false;
+  return true;
+}
 
 /**
  * Build the module graph for all source files under `appDir`.
@@ -118,10 +195,16 @@ export async function buildModuleGraph(appDir) {
   IMPORTS_CACHE.delete(appDir);
   /** @type {ModuleGraph} */
   const graph = new Map();
+  /** @type {ModuleGraph} dynamic-import edges, keyed to `graph` below */
+  const dynamic = new Map();
+  /** @type {Map<string, Set<string>>} bare vendor specifiers per file (#754) */
+  const bare = new Map();
   /** @type {Set<string>} every file walked this build (graph holds only files
    * with deps, so a separate set is needed to know what is still live). */
   const seen = new Set();
-  await walk(appDir, appDir, graph, seen);
+  await walk(appDir, appDir, graph, seen, dynamic, bare);
+  if (dynamic.size) DYNAMIC_EDGES.set(graph, dynamic);
+  if (bare.size) BARE_EDGES.set(graph, bare);
   // Evict parse-cache entries for files no longer in the tree (a rebuild after
   // a rename or delete), so a long dev session does not accumulate dead
   // entries. Scoped to appDir so a multi-app process (tests, dogfood smoke)
@@ -226,6 +309,13 @@ const SERVER_FILE_RE = /\.server\.m?[jt]s$/;
  * @returns {Set<string>}
  */
 export function reachableFromEntries(graph, entryFiles, appDir) {
+  // The gate unions in dynamic-import edges (#751) so a lazily-imported app
+  // module (`await import('./widget.ts')`) is servable instead of 404ing. A
+  // dynamically-imported module's OWN static imports are then walked normally
+  // (it joins the queue), so its subtree is servable too. The `.server.*`
+  // boundary still holds: a dynamic `import('./x.server.ts')` is admitted (a
+  // stub is served) but, like any server file, not traversed into.
+  const dynamic = DYNAMIC_EDGES.get(graph);
   /** @type {Set<string>} */
   const visited = new Set();
   /** @type {string[]} */
@@ -242,13 +332,17 @@ export function reachableFromEntries(graph, entryFiles, appDir) {
     // time), but we don't add its imports because the browser never
     // sees them.
     if (SERVER_FILE_RE.test(file)) continue;
-    const deps = graph.get(file);
-    if (!deps) continue;
-    for (const dep of deps) {
-      if (visited.has(dep)) continue;
-      if (!dep.startsWith(appDir)) continue;
-      visited.add(dep);
-      queue.push(dep);
+    const staticDeps = graph.get(file);
+    const dynDeps = dynamic && dynamic.get(file);
+    if (!staticDeps && !dynDeps) continue;
+    for (const set of [staticDeps, dynDeps]) {
+      if (!set) continue;
+      for (const dep of set) {
+        if (visited.has(dep)) continue;
+        if (!dep.startsWith(appDir)) continue;
+        visited.add(dep);
+        queue.push(dep);
+      }
     }
   }
   return visited;
@@ -260,7 +354,7 @@ export function reachableFromEntries(graph, entryFiles, appDir) {
  * @param {string} appDir
  * @param {ModuleGraph} graph
  */
-async function walk(dir, appDir, graph, seen) {
+async function walk(dir, appDir, graph, seen, dynamic, bare) {
   let entries;
   try { entries = await readdir(dir, { withFileTypes: true }); }
   catch { return; }
@@ -278,9 +372,9 @@ async function walk(dir, appDir, graph, seen) {
     if (e.name.startsWith('.')) continue;
     const full = join(dir, e.name);
     if (e.isDirectory()) {
-      await walk(full, appDir, graph, seen);
+      await walk(full, appDir, graph, seen, dynamic, bare);
     } else if (/\.(js|ts|mjs|mts)$/.test(e.name)) {
-      await parseFile(full, appDir, graph, seen);
+      await parseFile(full, appDir, graph, seen, dynamic, bare);
     }
   }
 }
@@ -308,7 +402,7 @@ export function _parseCacheHas(file) { return PARSE_CACHE.has(file); }
  * @param {string} appDir
  * @param {ModuleGraph} graph
  */
-async function parseFile(file, appDir, graph, seen) {
+async function parseFile(file, appDir, graph, seen, dynamic, bare) {
   let mtimeMs, size;
   try { const st = await stat(file); mtimeMs = st.mtimeMs; size = st.size; }
   catch { return; }
@@ -316,6 +410,8 @@ async function parseFile(file, appDir, graph, seen) {
   const cached = PARSE_CACHE.get(file);
   if (cached && cached.mtimeMs === mtimeMs && cached.size === size) {
     if (cached.deps.size) graph.set(file, cached.deps);
+    if (cached.dynDeps && cached.dynDeps.size && dynamic) dynamic.set(file, cached.dynDeps);
+    if (cached.bareDeps && cached.bareDeps.size && bare) bare.set(file, cached.bareDeps);
     return;
   }
 
@@ -343,6 +439,8 @@ async function parseFile(file, appDir, graph, seen) {
   // code-example `import` string never becomes an edge.
   const masked = redactStringsAndTemplates(src, true);
   const deps = new Set();
+  /** @type {Set<string>} bare npm vendor specifiers imported by this file (#754) */
+  const bareDeps = new Set();
   for (const re of [IMPORT_RE, EXPORT_FROM_RE]) {
     for (const m of src.matchAll(re)) {
       // m.index is the keyword start (`\bimport` / `\bexport`). If that
@@ -350,17 +448,45 @@ async function parseFile(file, appDir, graph, seen) {
       // and is not a real import edge.
       if (masked[m.index] === ' ') continue;
       const spec = m[1];
+      // Guard a match whose `from '<spec>'` tail reaches INTO a blanked literal:
+      // EXPORT_FROM_RE's lazy `[^'";]+?` can span a template body to a `from`
+      // written inside example code (`export const t = html\`...import x from
+      // 'left-pad'\``), so the KEYWORD is real but the SPECIFIER is not. A real
+      // string keeps its delimiters in the mask (only the body blanks), while a
+      // template body blanks whole, so a blanked opening quote means the
+      // specifier is inside a literal and the match is spurious.
+      const quoteAt = m.index + m[0].length - spec.length - 2;
+      if (masked[quoteAt] === ' ') continue;
       // Only resolve relative imports + `#`-style subpath aliases (#555)
       // within the project. A bare npm specifier (dayjs) has no alias match
-      // and is skipped; an aliased `#lib/x.server.ts` IS followed so the
-      // graph / auth gate / elision see the real path through the alias.
-      if (!spec.startsWith('.') && !spec.startsWith('/') && !expandImportAlias(spec, appDir)) continue;
+      // and is skipped FROM THE GRAPH, but recorded as a vendor edge so SSR
+      // can emit a modulepreload for the reached vendor URL (#754); an aliased
+      // `#lib/x.server.ts` IS followed so the graph / auth gate / elision see
+      // the real path through the alias.
+      if (!spec.startsWith('.') && !spec.startsWith('/') && !expandImportAlias(spec, appDir)) {
+        if (isVendorSpecifier(spec)) bareDeps.add(spec);
+        continue;
+      }
       const resolved = resolveImport(spec, file, appDir);
       if (resolved) deps.add(resolved);
     }
   }
-  PARSE_CACHE.set(file, { mtimeMs, size, deps });
+  // Dynamic `import('…')` with a string-literal specifier (#751): a separate
+  // edge class so the gate admits the lazily-loaded module (no 404) without
+  // preloading it. Same redaction-mask + alias rules as the static scan. A
+  // target already statically imported is not duplicated as a dynamic edge.
+  const dynDeps = new Set();
+  for (const m of src.matchAll(DYNAMIC_IMPORT_RE)) {
+    if (masked[m.index] === ' ') continue;
+    const spec = m[1];
+    if (!spec.startsWith('.') && !spec.startsWith('/') && !expandImportAlias(spec, appDir)) continue;
+    const resolved = resolveImport(spec, file, appDir);
+    if (resolved && !deps.has(resolved)) dynDeps.add(resolved);
+  }
+  PARSE_CACHE.set(file, { mtimeMs, size, deps, dynDeps, bareDeps });
   if (deps.size) graph.set(file, deps);
+  if (dynDeps.size && dynamic) dynamic.set(file, dynDeps);
+  if (bareDeps.size && bare) bare.set(file, bareDeps);
 }
 
 /**

package/src/page-action.js

@@ -2,6 +2,7 @@ import { isNotFound, isRedirect } from '@webjsdev/core';
 import { ssrPage, ssrNotFound, loadModule } from './ssr.js';
 import { readBytesBounded, payloadTooLarge, DEFAULT_MAX_MULTIPART_BYTES } from './body-limit.js';
 import { getBodyLimits } from './context.js';
+import { propagateTrustedRemoteIp } from './rate-limit.js';
 
 /**
  * Page server actions: a `page.{js,ts}` may export an `action` function that
@@ -133,12 +134,20 @@ async function parseFormBody(req) {
   if (tooLarge) return { tooLarge: true, formData: new FormData(), request: req };
 
   // Rebuild a fresh Request from the bytes so the action can re-read the body.
+  // SECURITY (#756): strip any inbound `x-webjs-remote-ip` the copy carried so a
+  // client cannot spoof it through the rebuild, and carry the FRAMEWORK-trusted
+  // remote IP forward out of band (the rebuild is a new object, so the listener's
+  // WeakMap stamp on `req` does not follow it). Without this, `clientIp` inside a
+  // page `action` (the no-JS form write path, e.g. login throttling) would read
+  // the spoofable header on Bun.
   const headers = new Headers(req.headers);
+  headers.delete('x-webjs-remote-ip');
   const rebuilt = new Request(req.url, {
     method: req.method,
     headers,
     body: bytes && bytes.byteLength ? bytes : undefined,
   });
+  propagateTrustedRemoteIp(req, rebuilt);
 
   const isForm = /multipart\/form-data|application\/x-www-form-urlencoded/i.test(ct);
   let formData = new FormData();