@webjsdev/server 0.8.58 → 0.8.60

package/src/ssr.js

@@ -1,12 +1,12 @@
 import { pathToFileURL, fileURLToPath } from 'node:url';
 import { resolve } from 'node:path';
 import { renderToString, isNotFound, isRedirect, isForbidden, isUnauthorized, lookupModuleUrl, isLazy, cspNonce } from '@webjsdev/core';
-import { importMapTag, vendorIntegrityFor, publishedBuildId, appSourceId, basePath, vendorPreconnectOrigins, vendorPreloadTargets } from './importmap.js';
+import { importMapTag, vendorIntegrityFor, publishedBuildId, appSourceId, basePath, vendorPreconnectOrigins, vendorPreloadTargets, buildImportMap } from './importmap.js';
 import { withBasePath } from './base-path.js';
 import { withAssetHash } from './asset-hash.js';
 import { jsonForScriptTag } from './script-tag-json.js';
 import { transitiveDeps, bareImports } from './module-graph.js';
-import { seedingEnabled, collectSeeds, buildSeedScript } from './action-seed.js';
+import { seedingEnabled, collectSeeds, buildSeedScript, SEED_DROP_BLOCK } from './action-seed.js';
 import { BUFFERED_MARKER, STREAM_MARKER } from './conditional-get.js';
 import {
   readRevalidate,
@@ -41,7 +41,7 @@ export async function ssrPage(route, params, url, opts) {
   // and is threaded back through `opts.pageModule` so renderChain reuses the
   // same evaluation (no double-load). A cache HIT serves the stored HTML
   // without re-running the page function. Skipped entirely (no opt-in read,
-  // no double behaviour) for the page-action re-render (actionData / a non-200
+  // no double behaviour) for the form-action re-render (actionData / a non-200
   // status) and for a partial-nav request (X-Webjs-Have), whose bytes depend
   // on the request and must not be shared under the full-URL key.
   const cacheEligible =
@@ -57,7 +57,15 @@ export async function ssrPage(route, params, url, opts) {
       revalidateSeconds = readRevalidate(pageMod);
       if (revalidateSeconds !== null) {
         const hit = await readHtmlCache(url);
-        if (hit) return cachedHtmlResponse(hit, opts.req, url);
+        if (hit) {
+          const cached = cachedHtmlResponse(hit, opts.req, url);
+          // A cache hit returns before any seed work runs, so it would otherwise
+          // report nothing at all, which reads as "seeding is broken" when it is
+          // really the cache answering (#1309). The seed block rides INSIDE the
+          // cached bytes, so the seeds are exactly as fresh as the HTML.
+          if (opts.dev) cached.headers.set('X-Webjs-Seed', 'html-cache');
+          return cached;
+        }
       }
     } catch {
       // A load / store failure falls through to a normal fresh render: the
@@ -288,16 +296,40 @@ export async function ssrPage(route, params, url, opts) {
     // block (those slow regions keep the stale-while-revalidate refetch). An
     // empty collector yields '' so the output stays byte-identical.
     let outBody = streamBody;
-    if (seedCollector && suspenseCtx.pending.length === 0) {
-      const seedScript = await buildSeedScript(seedCollector);
+    // Dev-only seeding diagnostics (#1309). `off` (seeding disabled) is kept
+    // DISTINCT from `collected=0` on purpose: the counting lives with the
+    // collector rather than behind the seed gate, so a seeding-DISABLED app
+    // never looks like a seeding-BROKEN one.
+    let seedHeader = 'off';
+    const streamed = suspenseCtx.pending.length > 0;
+    if (seedCollector && streamed) {
+      // A streamed render's deferred boundaries resolve AFTER the first flush,
+      // so their results cannot ride this block and none is emitted in prod. In
+      // DEV emit the marker alone, so the client reports the CAUSE instead of
+      // leaving the developer to guess why every action call went to the network.
+      seedHeader = `collected=${seedCollector.size}, emitted=0, streamed`;
+      if (opts.dev) {
+        const marker = await buildSeedScript(null, { dev: true, reason: 'streamed' });
+        if (marker) outBody = streamBody + marker;
+      }
+    } else if (seedCollector) {
+      const seedScript = await buildSeedScript(seedCollector, { dev: opts.dev });
       if (seedScript) outBody = streamBody + seedScript;
+      // `emitted` differs from `collected` exactly when the serializer threw and
+      // dropped the whole block, which is otherwise a completely invisible
+      // failure. In DEV that throw still emits a marker-only block, so the
+      // browser can name the cause; it carries no seeds, so it must NOT count as
+      // emitted or the header would report a total success on the very failure
+      // it exists to expose.
+      const dropped = seedScript === SEED_DROP_BLOCK;
+      seedHeader = `collected=${seedCollector.size}, emitted=${seedScript && !dropped ? seedCollector.size : 0}`;
     }
     const res = streamingHtmlResponse(
       prefix,
       outBody,
       closer,
       suspenseCtx,
-      // Normally 200. After a failed page `action` submission the caller passes
+      // Normally 200. After a failed form-action submission the caller passes
       // 422 (or another 4xx) so the re-rendered page with field errors carries
       // the right status for both the no-JS reload and the enhanced swap (#244).
       opts.status || 200,
@@ -307,6 +339,11 @@ export async function ssrPage(route, params, url, opts) {
       nonce,
       opts.dev,
     );
+    // Dev-only seeding diagnostics (#1309). A miss is indistinguishable from a
+    // hit from the outside, so an app whose seeding silently broke looks exactly
+    // like one where it works. Dev only: a production header would publish how
+    // many server calls a page made, for no benefit.
+    if (opts.dev) res.headers.set('X-Webjs-Seed', seedHeader);
     // REDUCED response (#1009): the X-Webjs-Have short-circuit omitted the
     // outer-layout chrome, so these bytes are only valid for a request that
     // sent a matching `have`. Left shared-cacheable, a CDN edge could store the
@@ -346,7 +383,7 @@ export async function ssrPage(route, params, url, opts) {
       // navigation (an auth bounce, a gate). 302 Found is the conventional
       // code there, so it is the default when the caller did not pick one. An
       // explicit `redirect(url, status)` overrides it. (Action redirects, a
-      // POST, default to 307 in page-action.js so the method is preserved.)
+      // POST, default to 307 in form-dispatch.js so the method is preserved.)
       return new Response(null, { status: e.status || 302, headers: { location: e.url } });
     }
     if (isNotFound(err)) {
@@ -459,7 +496,7 @@ export async function ssrNotFound(notFoundFile, opts) {
 /**
  * 403 response for a thrown forbidden() (#848). Renders the nearest
  * forbidden.{js,ts} in the page's chain, else a default 403 page. Shared by the
- * page-render catch (ssr.js) and the page-action write path (page-action.js) so
+ * page-render catch (ssr.js) and the form-action write path (form-dispatch.js) so
  * both behave identically.
  * @param {{ forbiddens?: string[] }} route
  * @param {{ dev: boolean, appDir: string, req?: Request, url?: URL }} opts
@@ -674,10 +711,13 @@ async function ssrNotFoundHtml(notFoundFile, opts) {
 }
 
 async function renderChain(route, ctx, dev, suspenseCtx, have, pageModule) {
-  // Reuse a caller-supplied page module when present (the page-action
-  // re-render passes the exact module whose `action` just ran, so the
-  // failure re-render shares that single evaluation instead of re-importing
-  // and re-running the module's top-level side effects).
+  // Reuse a caller-supplied page module when present. The only producer is the
+  // HTML-cache path above, which loads the module to read `export const
+  // revalidate` and threads it back so this does not load it a second time.
+  // (The removed page `action` export used to be a second producer: it ran in
+  // the page module, so the 422 re-render could share that evaluation. A form
+  // action lives in a `.server.*` module instead, so the re-render loads the
+  // page module itself, exactly as a plain render does.)
   const page = pageModule || await loadModule(route.file, dev);
   if (!page.default) throw new Error(`Page ${route.file} must have a default export`);
   let tree = await page.default(ctx);
@@ -1657,6 +1697,36 @@ function wrapHead(opts) {
   // importmap-rails) applies nonce on every modulepreload tag for
   // the same reason.
   const noncePreload = opts.nonce ? ` nonce="${escapeAttr(opts.nonce)}"` : '';
+  // Core runtime modulepreload (#1118). Every module the boot imports pulls
+  // `@webjsdev/core`, but the boot script names only page and component URLs,
+  // so without this hint the browser discovers core only after one of those is
+  // fetched AND parsed: one full round trip into the load, which is exactly
+  // where the pre-boot click window lives on a cold, throttled connection.
+  //
+  // The href comes STRAIGHT from the importmap target (no `fp()` rewrite: the
+  // map's targets are already base-path-prefixed and content-hashed), so it is
+  // byte-identical to what the import resolves to. A differing href makes the
+  // browser treat the preload and the import as two resources and fetch core
+  // twice. That is why this copies the vendor loop below, not the module loop
+  // above. `vendorPreloadTargets` still excludes core deliberately; this hint
+  // is emitted from the head builder, not the vendor path.
+  //
+  // Gated on the boot actually shipping something. A fully elided page ships no
+  // boot module and must not be handed a preload for a runtime it never loads
+  // (#780), which also keeps it off `global-error.{js,ts}`, whose document is
+  // returned verbatim with no importmap and no boot script.
+  if (opts.moduleUrls.length || lazyEntries) {
+    const coreMap = buildImportMap();
+    const coreHref = coreMap.imports['@webjsdev/core'];
+    if (coreHref) {
+      const raw = coreMap.integrity ? coreMap.integrity[coreHref] : undefined;
+      const coreIntegrity = raw ? ` integrity="${escapeAttr(raw)}"` : '';
+      linkTags.push(
+        `<link rel="modulepreload" href="${escapeAttr(coreHref)}"` +
+        `${preloadCrossOriginAttr(coreHref)}${coreIntegrity}${noncePreload}>`,
+      );
+    }
+  }
   // Sub-path deployment (issue #256): the modulepreload href is prefixed with
   // the base path (a no-op when empty), but `crossorigin` / `integrity` are
   // decided on the ORIGINAL url, so the integrity lookup still keys on the
@@ -2052,7 +2122,7 @@ function streamingHtmlResponse(prefix, bodyHtml, closer, ctx, status, req, url,
   const headers = new Headers({ 'content-type': 'text/html; charset=utf-8' });
   // Default: no caching. Pages are dynamic by default: the developer
   // opts in to caching explicitly via metadata.cacheControl. A non-200 does
-  // NOT inherit it (#1140): the page-action re-render is a 422 carrying the
+  // NOT inherit it (#1140): the form-action re-render is a 422 carrying the
   // submitter's own field values and errors, which must never be handed to a
   // shared cache just because the page opted into public caching.
   headers.set('cache-control', status === 200 ? (metadata?.cacheControl || 'no-store') : 'no-store');
@@ -2095,6 +2165,13 @@ function streamingHtmlResponse(prefix, bodyHtml, closer, ctx, status, req, url,
               try {
                 const resolved = await p.promise;
                 const sub = { pending: [], nextId: ctx.nextId, dev: ctx.dev };
+                // A fresh scan that cannot see the shell the boundary sits in.
+                // That used to require carrying the boundary's form scope
+                // (#1207), or a `<button formaction=${fn}>` inside a bound
+                // form's boundary read as form-less, was refused, and the catch
+                // below turned it into an empty boundary on a 200 in
+                // production. #1307 made a bound submitter self-sufficient, so
+                // there is nothing left to carry.
                 const html = await renderToString(resolved, { ssr: true, suspenseCtx: sub });
                 ctx.nextId = sub.nextId;
                 for (const n of sub.pending) ctx.pending.push(n);
@@ -2141,13 +2218,12 @@ function streamingHtmlResponse(prefix, bodyHtml, closer, ctx, status, req, url,
  * serves a single evaluation; in dev a cache-bust query forces a fresh
  * evaluation so source edits take effect (which also re-runs the module's
  * top-level side effects, the reason pages/layouts must keep their top level
- * side-effect-free). Exported so page-action.js loads the page module the same
- * way the SSR re-render does.
+ * side-effect-free).
  *
  * @param {string} file
  * @param {boolean} dev
  */
-export async function loadModule(file, dev) {
+async function loadModule(file, dev) {
   const url = pathToFileURL(file).toString();
   const bust = dev ? `?t=${Date.now()}-${Math.random().toString(36).slice(2)}` : '';
   return import(url + bust);

package/src/stream.js

@@ -6,7 +6,7 @@
  * The payload is plain HTML, a `<webjs-stream action target>` wrapping one
  * `<template>`. These helpers compose that string for the two delivery paths,
  * a content-negotiated HTTP form response and a `broadcast()` / WS message, so
- * an app never hand-writes the markup. A page `action` or a `route` handler
+ * an app never hand-writes the markup. A form-bound action or a `route` handler
  * branches on `acceptsStream(request)`, returning `streamResponse(...)` when the
  * router asked for a stream and a normal render otherwise (the JS-off degrade).
  *

package/src/testing.d.ts

@@ -42,6 +42,25 @@ export declare function withCookies(init: RequestInit | undefined, cookieValue:
 /** Merge a session cookie string into a `RequestInit`'s `Cookie` header. */
 export declare function withSessionCookie(init: RequestInit | undefined, sessionCookie: string): RequestInit;
 
+/**
+ * Submit a page's `<form action={action}>` the way a browser with JS OFF does:
+ * render the page, reuse the identity the server put in its hidden
+ * `__webjs_action` field, and POST it back with the given fields. A POST that
+ * omits that field is not a form submission and is answered `405`.
+ */
+export declare function submitForm(
+  handle: Handle,
+  path: string,
+  fields?: Record<string, string> | URLSearchParams | FormData,
+  opts?: {
+    index?: number;
+    match?: string | RegExp;
+    cookies?: string;
+    submitPath?: string;
+    headers?: Record<string, string>;
+  },
+): Promise<Response>;
+
 /**
  * Drive the REAL credentials login (`POST /api/auth/signin/credentials` by
  * default) and capture the genuine signed session `Set-Cookie`.

package/src/testing.js

@@ -33,6 +33,7 @@
  */
 
 import { hashFile, RPC_CONTENT_TYPE } from './actions.js';
+import { FORM_ACTION_FIELD } from '@webjsdev/core';
 import { getSerializer } from './serializer.js';
 import { join, sep } from 'node:path';
 
@@ -200,6 +201,118 @@ export async function loginAndGetCookies(handle, credentials, opts = {}) {
   return { cookies, setCookies, response: res };
 }
 
+/**
+ * Submit a page's `<form action=${action}>` the way a browser with JS OFF does
+ * (#1155): render the page, take the identity the server put in its hidden
+ * `__webjs_action` field, and POST it back with the author's fields.
+ *
+ * A bound form carries that field because the identity is what tells the
+ * dispatcher WHICH action to run, so a hand-written POST that omits it is not a
+ * form submission at all and is answered `405`. Reproducing the scrape in every
+ * app test is how that ends up looking like a database problem instead: the
+ * status is wrong, an assertion fails, and a `catch` around it reports a skip.
+ * Hence a helper, so the identity is never the test's business.
+ *
+ * The form is located by INDEX (`opts.index`, default the first on the page),
+ * which is enough for the common one-form page. For a page with several, pass
+ * `opts.match`: a string or RegExp that must appear in the form's markup, so
+ * the test names the form by something an author recognizes (a heading, a field
+ * name, an id) rather than by counting.
+ *
+ * @param {Handle} handle
+ * @param {string} path the page to render AND, by default, to submit back to
+ * @param {Record<string, string> | URLSearchParams | FormData} [fields]
+ * @param {{
+ *   index?: number,
+ *   match?: string | RegExp,
+ *   cookies?: string,
+ *   submitPath?: string,
+ *   headers?: Record<string, string>,
+ * }} [opts]
+ * @returns {Promise<Response>} the submission response (a `303` on success, a
+ *   `422` re-render on a failure result)
+ */
+/**
+ * The `<form>...</form>` blocks of a rendered page.
+ *
+ * A bare `/<form[\s\S]*?<\/form>/g` gets two things wrong that a test helper
+ * must not, because both fail SILENTLY: a form inside an HTML comment is
+ * matched (so `opts.index` counts a form that is not on the page), and a
+ * `</form>` sitting inside an ATTRIBUTE VALUE ends the match early (so the
+ * identity field falls outside it and the helper reports an unbound form).
+ * Comments are stripped first, and the scan skips quoted attribute values while
+ * looking for the end of the start tag.
+ *
+ * @param {string} html
+ * @returns {string[]}
+ */
+function findForms(html) {
+  const src = html.replace(/<!--[\s\S]*?-->/g, '');
+  const out = [];
+  const open = /<form\b/gi;
+  let m;
+  while ((m = open.exec(src))) {
+    // Walk the start tag, skipping quoted values so `data-x="<form>"` is inert.
+    let i = m.index + m[0].length;
+    let quote = '';
+    for (; i < src.length; i++) {
+      const c = src[i];
+      if (quote) { if (c === quote) quote = ''; continue; }
+      if (c === '"' || c === "'") { quote = c; continue; }
+      if (c === '>') break;
+    }
+    const close = src.toLowerCase().indexOf('</form>', i);
+    if (close === -1) continue;
+    out.push(src.slice(m.index, close + '</form>'.length));
+    open.lastIndex = close;
+  }
+  return out;
+}
+
+export async function submitForm(handle, path, fields = {}, opts = {}) {
+  const getInit = opts.cookies ? withCookies({}, opts.cookies) : {};
+  const page = await testRequest(handle, path, getInit);
+  const html = await page.text();
+
+  const forms = findForms(html);
+  const candidates = opts.match
+    ? forms.filter((f) => (opts.match instanceof RegExp ? opts.match.test(f) : f.includes(opts.match)))
+    : forms;
+  const form = candidates[opts.index || 0];
+  if (!form) {
+    throw new Error(
+      `submitForm: no ${opts.match ? 'matching ' : ''}<form> found on ${path} `
+      + `(status ${page.status}, ${forms.length} form(s) on the page).`,
+    );
+  }
+  const id = form.match(/name="__webjs_action"\s+value="([^"]*)"/);
+  if (!id) {
+    throw new Error(
+      `submitForm: the <form> on ${path} carries no __webjs_action field, so it `
+      + 'is not bound to a server action. Write it as `<form action=${myAction}>` '
+      + 'with the action imported from a `use server` module.',
+    );
+  }
+
+  const body = new URLSearchParams();
+  body.set(FORM_ACTION_FIELD, id[1]);
+  const entries = fields instanceof URLSearchParams || fields instanceof FormData
+    ? fields.entries()
+    : Object.entries(fields);
+  for (const [k, v] of entries) body.append(k, String(v));
+
+  const init = {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded', ...(opts.headers || {}) },
+    body: body.toString(),
+  };
+  return await testRequest(
+    handle,
+    opts.submitPath || path,
+    opts.cookies ? withCookies(init, opts.cookies) : init,
+  );
+}
+
 /**
  * Compute the RPC endpoint path for an action, addressing it the same way the
  * generated client stub does: by the SHA-256 hash of the action's ABSOLUTE file

package/src/vendor.js

@@ -338,6 +338,27 @@ let lastLiveResolveFailed = false;
 
 const JSPM_GENERATE_ENDPOINT = 'https://api.jspm.io/generate';
 const JSPM_GENERATE_TIMEOUT_MS = 10_000;
+// Bounds a single bundle GET during the SERVER's warmup live-integrity pass
+// (`fetchLiveIntegrity`). Short on purpose: that pass gates readiness, so a
+// stalled CDN must not hold the first request, and it is additionally capped
+// by INTEGRITY_TOTAL_BUDGET_MS across all URLs.
+const INTEGRITY_FETCH_TIMEOUT_MS = 10_000;
+
+// Bounds a single bundle GET made by the pin command, which either writes the
+// bytes to disk (`downloadBundle`) or fetches them to hash
+// (`fetchIntegrity`). Deliberately six times the warmup budget, because the
+// two are not the same situation: a pin is a one-shot command a person ran and
+// is waiting on, with a whole multi-megabyte package to transfer, while the
+// warmup is a server holding a request. Ten seconds is generous for the
+// latter and tight for the former on a slow link.
+//
+// 60s matches what importmap-rails effectively allows. It sets no timeout at
+// all, but Ruby's Net::HTTP defaults open_timeout and read_timeout to 60s, so
+// a Rails pin is bounded at a minute without asking. JavaScript's fetch() has
+// no default whatsoever, which is why this has to be explicit: without it a
+// CDN that accepts the connection and then stalls hangs the pin forever, with
+// no ambient deadline on a CLI run to cut it short.
+const PIN_BUNDLE_TIMEOUT_MS = 60_000;
 
 /**
  * Provider names accepted by `webjs vendor pin --from <provider>`.
@@ -387,12 +408,15 @@ export function normalizeProvider(name) {
  *
  * @param {Array<string>} installs  e.g. ['dayjs@1.11.13', '@codemirror/lint@6.9.6']
  * @param {string} provider  one of SUPPORTED_PROVIDERS
+ * @param {number} [timeoutMs]  defaults to the SERVER budget; a CLI caller
+ *   passes the longer one, since it is a command someone is waiting on rather
+ *   than a request being held open.
  * @returns {Promise<JspmCallResult>}
  */
-async function jspmCall(installs, provider) {
+async function jspmCall(installs, provider, timeoutMs = JSPM_GENERATE_TIMEOUT_MS) {
   const label = installs.length === 1 ? `'${installs[0]}'` : `${installs.length} packages`;
   const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), JSPM_GENERATE_TIMEOUT_MS);
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
     const response = await fetch(JSPM_GENERATE_ENDPOINT, {
       method: 'POST',
@@ -440,7 +464,7 @@ async function jspmCall(installs, provider) {
     return { ok: true, imports, transient: false };
   } catch (e) {
     const msg = e && e.name === 'AbortError'
-      ? `timed out after ${JSPM_GENERATE_TIMEOUT_MS}ms`
+      ? `timed out after ${timeoutMs}ms`
       : `${e && e.message}`;
     console.error(`[webjs] could not vendor ${label} via ${provider}: ${msg}`);
     return { ok: false, imports: {}, transient: true };
@@ -466,8 +490,8 @@ async function jspmCall(installs, provider) {
  * @param {string} [provider]  one of SUPPORTED_PROVIDERS; defaults to 'jspm'
  * @returns {Promise<Record<string, string>>}
  */
-async function jspmResolveOne(install, provider = 'jspm') {
-  const { ok, imports, transient } = await jspmProbeOne(install, provider);
+async function jspmResolveOne(install, provider = 'jspm', timeoutMs) {
+  const { ok, imports, transient } = await jspmProbeOne(install, provider, timeoutMs);
   // Preserve the public contract: an empty map on any failure, and the
   // module-global retry flag set ONLY on a transient one (a permanent 401
   // for an unresolvable private/server-only dep is tolerated).
@@ -492,13 +516,13 @@ async function jspmResolveOne(install, provider = 'jspm') {
  * @param {string} provider
  * @returns {Promise<JspmCallResult>}
  */
-function jspmProbeOne(install, provider) {
+function jspmProbeOne(install, provider, timeoutMs) {
   const cacheKey = `${provider}::probe::${install}`;
   const existing = jspmCache.get(cacheKey);
   if (existing) return existing;
 
   const promise = (async () => {
-    const result = await jspmCall([install], provider);
+    const result = await jspmCall([install], provider, timeoutMs);
     // Do not cache a failure: a transient one must be re-attempted on the
     // next resolve, and a permanent one is cheap to re-confirm and must not
     // pin a stale "unresolvable" verdict across a dependency change.
@@ -543,14 +567,18 @@ function jspmProbeOne(install, provider) {
  *
  * @param {Array<string>} installs  e.g. ['dayjs@1.11.13', 'clsx@2.1.1']
  * @param {string} [provider]  one of SUPPORTED_PROVIDERS; defaults to 'jspm'
+ * @param {number} [timeoutMs]  per-call budget. Defaults to the SERVER one,
+ *   because this runs on a cold first request as well as from the CLI; the two
+ *   pin commands pass PIN_BUNDLE_TIMEOUT_MS instead. importmap-rails only ever
+ *   resolves from the CLI, so its flat 60s has no request path to slow down.
  * @returns {Promise<Record<string, string>>}
  */
-export async function jspmGenerate(installs, provider = 'jspm') {
+export async function jspmGenerate(installs, provider = 'jspm', timeoutMs) {
   if (installs.length === 0) return {};
 
   // A single install has no cross-package graph to reconcile, so the
   // isolated path IS the coherent path; reuse the per-install cache.
-  if (installs.length === 1) return jspmResolveOne(installs[0], provider);
+  if (installs.length === 1) return jspmResolveOne(installs[0], provider, timeoutMs);
 
   // Stable key regardless of scan order so the same dep set hits cache.
   const unifiedKey = `${provider}::unified::${[...installs].sort().join('\n')}`;
@@ -558,7 +586,7 @@ export async function jspmGenerate(installs, provider = 'jspm') {
   if (cached) return cached;
 
   const promise = (async () => {
-    const unified = await jspmCall(installs, provider);
+    const unified = await jspmCall(installs, provider, timeoutMs);
     if (unified.ok) return unified.imports;
 
     // The unified call failed. Drop the cached failure so a later retry
@@ -570,14 +598,14 @@ export async function jspmGenerate(installs, provider = 'jspm') {
       // per-install fragments (each may still be cached / reachable) so we
       // serve whatever we can, and flag the transient failure for retry.
       lastLiveResolveFailed = true;
-      return mergePerInstall(await Promise.all(installs.map(i => jspmResolveOne(i, provider))));
+      return mergePerInstall(await Promise.all(installs.map(i => jspmResolveOne(i, provider, timeoutMs))));
     }
 
     // Permanent failure: at least one install is unresolvable. Probe each
     // in isolation to learn which ones jspm can resolve, then re-run the
     // unified call over only those so the survivors form one consistent
     // graph (restores #446 coherence for the resolvable subset).
-    const probes = await Promise.all(installs.map(i => jspmProbeOne(i, provider)));
+    const probes = await Promise.all(installs.map(i => jspmProbeOne(i, provider, timeoutMs)));
 
     // A GOOD package whose isolated probe failed TRANSIENTLY (a network blip
     // mid-probe) must NOT be classified as unresolvable and dropped. Only a
@@ -612,11 +640,11 @@ export async function jspmGenerate(installs, provider = 'jspm') {
       return mergePerInstall(probes.map(p => p.imports));
     }
     if (resolvable.length === 0) return {};
-    if (resolvable.length === 1) return jspmResolveOne(resolvable[0], provider);
+    if (resolvable.length === 1) return jspmResolveOne(resolvable[0], provider, timeoutMs);
 
     // Re-run unified over the resolvable subset. If even that fails (a
     // conflict among the survivors), fall back to their merged fragments.
-    const retry = await jspmCall(resolvable, provider);
+    const retry = await jspmCall(resolvable, provider, timeoutMs);
     if (retry.ok) return retry.imports;
     return mergePerInstall(resolvable.map(i => probes[installs.indexOf(i)].imports));
   })();
@@ -679,6 +707,12 @@ export async function vendorImportMapEntries(bareImports, appDir) {
 export function clearVendorCache() {
   jspmCache.clear();
   liveIntegrityCache.clear();
+  // Deliberately does NOT touch `lastLiveResolveFailed`, which looks like an
+  // omission and is not. `resolveVendorImports` is the flag's only reader and
+  // it resets the flag on entry, while the pinned short-circuit above that
+  // returns `ok: true` outright, so a value left behind by an earlier
+  // `pinAll` or `vendorImportMapEntries` can never be observed. Clearing it
+  // here would be a change nothing could write a failing test for (#1150).
 }
 
 /**
@@ -1071,14 +1105,21 @@ async function writePinFile(appDir, imports, integrity, provider) {
  * success or null on failure. The integrity hash is computed from the
  * downloaded bytes so it's always consistent with what's on disk.
  *
+ * Bounded by PIN_BUNDLE_TIMEOUT_MS. `pinAll(dir, { download: true })`
+ * runs this once per resolved URL on a CLI run with no ambient
+ * deadline, so a CDN that accepts the connection and then stalls would
+ * otherwise hang the pin with nothing to interrupt it (#1150).
+ *
  * @param {string} url
  * @param {string} appDir
  * @param {string} filename
  * @returns {Promise<{ bytes: number, integrity: string } | null>}
  */
 async function downloadBundle(url, appDir, filename) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), PIN_BUNDLE_TIMEOUT_MS);
   try {
-    const response = await fetch(url);
+    const response = await fetch(url, { signal: controller.signal });
     if (!response.ok) {
       console.error(`[webjs] download ${url} returned ${response.status}`);
       return null;
@@ -1094,8 +1135,13 @@ async function downloadBundle(url, appDir, filename) {
     await writeFile(join(pinDir(appDir), filename), buf);
     return { bytes: buf.byteLength, integrity: await sha384Integrity(buf) };
   } catch (e) {
-    console.error(`[webjs] download ${url} failed: ${e && e.message}`);
+    const why = e && e.name === 'AbortError'
+      ? `timed out after ${PIN_BUNDLE_TIMEOUT_MS}ms`
+      : e && e.message;
+    console.error(`[webjs] download ${url} failed: ${why}`);
     return null;
+  } finally {
+    clearTimeout(timer);
   }
 }
 
@@ -1105,12 +1151,21 @@ async function downloadBundle(url, appDir, filename) {
  * so the importmap can carry SRI hashes even when bundles aren't
  * locally vendored.
  *
+ * Bounded by PIN_BUNDLE_TIMEOUT_MS, the same budget `downloadBundle`
+ * gets, since it transfers the same bytes and differs only in whether
+ * they are written to disk. Default-mode `pinAll` runs this once per
+ * resolved URL, so a CDN that accepts the connection and then stalls
+ * would otherwise hang the pin with nothing to interrupt it: there is
+ * no ambient deadline on a CLI run (#1150).
+ *
  * @param {string} url
  * @returns {Promise<string | null>}  the integrity string, or null on failure
  */
 async function fetchIntegrity(url) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), PIN_BUNDLE_TIMEOUT_MS);
   try {
-    const response = await fetch(url);
+    const response = await fetch(url, { signal: controller.signal });
     if (!response.ok) {
       console.error(`[webjs] hash ${url} returned ${response.status}`);
       return null;
@@ -1121,8 +1176,13 @@ async function fetchIntegrity(url) {
     const buf = new Uint8Array(await response.arrayBuffer());
     return await sha384Integrity(buf);
   } catch (e) {
-    console.error(`[webjs] hash ${url} failed: ${e && e.message}`);
+    const why = e && e.name === 'AbortError'
+      ? `timed out after ${PIN_BUNDLE_TIMEOUT_MS}ms`
+      : e && e.message;
+    console.error(`[webjs] hash ${url} failed: ${why}`);
     return null;
+  } finally {
+    clearTimeout(timer);
   }
 }
 
@@ -1254,7 +1314,7 @@ export async function pinAll(appDir, opts = {}) {
     installs.push(install);
     partsByInstall.set(spec, { pkg, version, subpath });
   }
-  const resolved = await jspmGenerate(installs, from);
+  const resolved = await jspmGenerate(installs, from, PIN_BUNDLE_TIMEOUT_MS);
 
   /** @type {Record<string, string>} */
   const importmap = {};
@@ -1496,7 +1556,11 @@ export async function listPinned(appDir) {
 // ---------------------------------------------------------------------------
 
 const NPM_REGISTRY = 'https://registry.npmjs.org';
-const NPM_TIMEOUT_MS = 10_000;
+// The npm registry is reached only by `audit`, `outdated`, and `update`,
+// all CLI commands, so it takes the same generous budget the pin bundle
+// fetch does rather than the server's. importmap-rails makes these same two
+// calls with Ruby's 60s Net::HTTP default.
+const NPM_TIMEOUT_MS = 60_000;
 
 /**
  * Fetch one URL from registry.npmjs.org with a small timeout. Returns
@@ -1696,7 +1760,7 @@ export async function updatePinned(appDir, opts = {}) {
       if (specPkg !== pkg) continue;
       const subpath = spec.slice(specPkg.length);
       const install = `${pkg}@${latest}${subpath}`;
-      const resolved = await jspmGenerate([install], from);
+      const resolved = await jspmGenerate([install], from, PIN_BUNDLE_TIMEOUT_MS);
       const newUrl = resolved[spec];
       if (!newUrl) continue;
       newImports[spec] = newUrl;
@@ -2169,7 +2233,6 @@ export async function checkImportmapCoherence(imports, opts) {
  */
 const liveIntegrityCache = new Map();
 
-const INTEGRITY_FETCH_TIMEOUT_MS = 10_000;
 // Cap concurrent bundle fetches so a large dep set does not open dozens of
 // sockets at once during warmup. Matches the bounded posture of the rest of
 // vendor.js (the jspm resolve is per-package but the network is the shared