@webjsdev/server 0.8.88 → 0.8.90

package/src/importmap.js

@@ -4,7 +4,8 @@ import { createHash } from 'node:crypto';
 import { digestHex } from './crypto-utils.js';
 import { jsonForScriptTag } from './script-tag-json.js';
 import { withBasePath } from './base-path.js';
-import { withAssetHash } from './asset-hash.js';
+import { withAssetHash, assetHashMisses } from './asset-hash.js';
+import { buildEpoch, bumpBuildEpoch } from './build-epoch.js';
 
 // Local attribute escaper, byte-identical to the pair in `ssr/escape.js`,
 // which is the source of truth for HTML attribute escaping in this package.
@@ -32,6 +33,18 @@ function escapeAttr(s) {
 /** @type {Record<string, string>} */
 let _extraEntries = {};
 
+/**
+ * Per-build memos (#1644), each `{ epoch, value }` keyed on `buildEpoch()`.
+ * Every setter in this module bumps the epoch, as do the asset-hash roots,
+ * the elision fingerprint, the hash-cache clear, and the dev rebuild.
+ * @type {{ epoch: number, value: { imports: Record<string, string>, integrity?: Record<string, string> } }}
+ */
+let _mapMemo = { epoch: 0, value: { imports: {} } };
+/** @type {{ epoch: number, value: string }} */
+let _tagJsonMemo = { epoch: 0, value: '' };
+/** @type {{ epoch: number, max: number, value: string[] }} */
+let _preconnectMemo = { epoch: 0, max: -1, value: [] };
+
 /**
  * Browser importmap entries for the app's `package.json "imports"` subpath
  * aliases (#555), e.g. `{ "#lib/": "/lib/" }` for `"#lib/*": "./lib/*"`. Kept in lockstep
@@ -68,6 +81,9 @@ let _basePath = '';
  * @returns {Promise<void>}
  */
 export async function setBasePath(basePath) {
+  // Bumped BEFORE the await below so a render racing this setter cannot
+  // refill the importmap memo with the old base path (#1644).
+  bumpBuildEpoch();
   _basePath = basePath || '';
   _importMapHash = await digestHex('SHA-256', JSON.stringify(buildImportMap({ fingerprint: false })));
 }
@@ -137,6 +153,7 @@ export function importAliasBrowserEntries(importsMap, topLevelDirs = []) {
  * @returns {Promise<void>}
  */
 export async function setImportAliasEntries(entries) {
+  bumpBuildEpoch();
   _aliasEntries = entries && typeof entries === 'object' ? entries : {};
   _importMapHash = await digestHex('SHA-256', JSON.stringify(buildImportMap({ fingerprint: false })));
 }
@@ -160,6 +177,7 @@ let _vendorIntegrity = {};
  * @returns {Promise<void>}
  */
 export async function setVendorEntries(entries, integrity) {
+  bumpBuildEpoch();
   _extraEntries = entries;
   _vendorIntegrity = integrity || {};
   _importMapHash = await digestHex('SHA-256', JSON.stringify(buildImportMap({ fingerprint: false })));
@@ -296,11 +314,9 @@ export function vendorIntegrityFor(url) {
  * Initialized to the two minimum-safe defaults (the bare specifier
  * pointing at the browser source-mode entry and the catch-all prefix
  * pointing at `src/`) so any consumer that calls `buildImportMap()`
- * before `setCoreInstall` runs still gets a usable map. Pre-#118 the
- * legacy `coreMappings` were always derived from a boolean and so
- * could not be empty; this keeps that fail-open posture for embedded
- * SSR test helpers and one-shot tooling that imports `importmap.js`
- * without booting `dev.js`.
+ * before `setCoreInstall` runs still gets a usable map: a fail-open
+ * posture for embedded SSR test helpers and one-shot tooling that
+ * imports `importmap.js` without booting `dev.js`.
  *
  * @type {Record<string, string>}
  */
@@ -329,9 +345,7 @@ let _coreEntries = {
  * rebuilds today; if `@webjsdev/core/package.json` is edited in a
  * long-running dev session (e.g. workspace dev that runs a fresh
  * `npm run build:dist`), the derivation is refreshed on next server
- * restart, not on the watcher tick. Pre-#118 the legacy
- * `setCoreDistMode` had the same behaviour: only the dist-presence
- * boolean was watched, not the package.json itself.
+ * restart, not on the watcher tick.
  *
  * Like `setVendorEntries`, the importmap-hash is recomputed eagerly
  * so `importMapHash()` stays synchronous on the per-request SSR
@@ -342,6 +356,7 @@ let _coreEntries = {
  * @returns {Promise<void>}
  */
 export async function setCoreInstall(coreDir, distMode) {
+  bumpBuildEpoch();
   _coreEntries = buildCoreEntries(coreDir, !!distMode);
   // Capture the installed @webjsdev/core version (#899). The importmap targets
   // core at a version-independent URL, so a core RELEASE (new implementation,
@@ -458,6 +473,18 @@ export function buildCoreEntries(coreDir, distMode) {
  */
 export function buildImportMap(opts = {}) {
   const fingerprint = opts.fingerprint !== false;
+  // The SERVED (fingerprinted) map is request-independent within a build and
+  // was rebuilt two or three times per page render, each pass running
+  // `withAssetHash` over every target (#1644). Memoized by build epoch; every
+  // setter above bumps it. The `fingerprint: false` form the setters use for
+  // the build-id hash stays live, since it is what the memo is derived from.
+  // Callers only READ the returned object.
+  if (fingerprint && _mapMemo.epoch === buildEpoch()) return _mapMemo.value;
+  // A transient hash miss during this build (`assetHashMisses` moved) means a
+  // target fell back to its un-fingerprinted url; that map is served but NOT
+  // memoized, so the next render re-attempts the read as `asset-hash.js`
+  // promises, instead of pinning the fallback for the rest of the build.
+  const missesBefore = assetHashMisses();
   const merged = {
     ..._coreEntries,
     ..._extraEntries,
@@ -509,6 +536,7 @@ export function buildImportMap(opts = {}) {
     for (const k of intKeys) integrity[withBasePath(k, _basePath)] = _vendorIntegrity[k];
     out.integrity = integrity;
   }
+  if (fingerprint && assetHashMisses() === missesBefore) _mapMemo = { epoch: buildEpoch(), value: out };
   return out;
 }
 
@@ -567,6 +595,10 @@ export function vendorPreloadTargets(specifiers) {
  * @returns {string[]}  e.g. `['https://ga.jspm.io']`
  */
 export function vendorPreconnectOrigins(max = 2) {
+  // Request-independent within a build (it reads only `_extraEntries`), and
+  // it re-parsed every vendor url with `new URL` per render (#1644). Keyed by
+  // epoch AND `max`, since a caller can ask for a different cap.
+  if (_preconnectMemo.epoch === buildEpoch() && _preconnectMemo.max === max) return _preconnectMemo.value;
   /** @type {Map<string, number>} */
   const counts = new Map();
   for (const target of Object.values(_extraEntries)) {
@@ -579,10 +611,12 @@ export function vendorPreconnectOrigins(max = 2) {
     try { origin = new URL(target).origin; } catch { continue; }
     counts.set(origin, (counts.get(origin) || 0) + 1);
   }
-  return [...counts.entries()]
+  const origins = [...counts.entries()]
     .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
     .slice(0, Math.max(0, max))
     .map(([origin]) => origin);
+  _preconnectMemo = { epoch: buildEpoch(), max, value: origins };
+  return origins;
 }
 
 /**
@@ -619,5 +653,15 @@ export function importMapTag(opts = {}) {
   // change here evicts the client caches softly (see appSourceId()); empty until
   // the analysis is ready, which the client reads as "unknown".
   const s = ` data-webjs-src="${appSourceId()}"`;
-  return `<script type="importmap"${n}${b}${s}>${jsonForScriptTag(buildImportMap())}</script>`;
+  // The JSON body is memoized by build epoch (#1644); the nonce and the two
+  // deploy signals above are assembled per call, which is why `publishBuildId`
+  // and `setAppSourceId` need no epoch bump.
+  let json = _tagJsonMemo.epoch === buildEpoch() ? _tagJsonMemo.value : null;
+  if (json === null) {
+    json = jsonForScriptTag(buildImportMap());
+    // Stored only when the map itself memoized: a transient hash miss leaves
+    // both live for the next render (see `buildImportMap`).
+    if (_mapMemo.epoch === buildEpoch()) _tagJsonMemo = { epoch: buildEpoch(), value: json };
+  }
+  return `<script type="importmap"${n}${b}${s}>${json}</script>`;
 }

package/src/listener-bun.js

@@ -49,6 +49,7 @@ import { registerClient } from './broadcast.js';
 import { setTrustedRemoteIp, propagateTrustedRemoteIp } from './rate-limit.js';
 import { applyForwarded } from './forwarded.js';
 import { isAddrInUse, portInUseError, reusePortRequested } from './port-in-use.js';
+import { isBufferedResponse } from './conditional-get.js';
 import {
   isCompressible,
   isEventsPath,
@@ -59,6 +60,7 @@ import {
   createCompressor,
   compressBufferSync,
   MAX_SYNC_COMPRESS_BYTES,
+  MIN_COMPRESS_BYTES,
   varyWithAcceptEncoding,
   readBufferedOrStream,
 } from './listener-core.js';
@@ -462,8 +464,10 @@ async function maybeCompress(resp, req) {
   const encoding = negotiateEncoding(req.headers.get('accept-encoding'));
   if (!encoding) return resp;
 
+  // `encoding` decides WHETHER the response is compressed and is the coding a
+  // streamed body gets; a buffered body re-asks with its size (the small-body
+  // gzip preference, #1646). The header is set once, where the coding is final.
   const headers = new Headers(resp.headers);
-  headers.set('content-encoding', encoding);
   headers.set('vary', varyWithAcceptEncoding(headers.get('vary')));
 
   // Buffered-body fast path (#756): peek the body to tell a single bounded
@@ -475,9 +479,24 @@ async function maybeCompress(resp, req) {
   // runtime a buffered body and a streamed one compress identically (the wire is
   // self-describing via content-encoding either way). A streamed / oversized body
   // falls through to the bridge below.
-  const peeked = await readBufferedOrStream(resp.body, MAX_SYNC_COMPRESS_BYTES);
-  if (peeked.buffered !== undefined) {
-    const out = compressBufferSync(encoding, peeked.buffered);
+  // A response the framework built from a string or bytes is read whole
+  // (`isBufferedResponse`, #1644: the reader peek costs about 45 µs per
+  // response on Bun against 3 µs for `arrayBuffer()`); anything else is peeked
+  // without reading ahead of the client.
+  const peeked = isBufferedResponse(resp)
+    ? { buffered: new Uint8Array(await resp.arrayBuffer()) }
+    : await readBufferedOrStream(resp.body, MAX_SYNC_COMPRESS_BYTES);
+  if (peeked.buffered !== undefined && peeked.buffered.byteLength <= MAX_SYNC_COMPRESS_BYTES) {
+    // Under the shared floor (#1644) the body goes out uncompressed, with the
+    // ORIGINAL headers (the vary written above is not applied).
+    // The peek consumed the body, so rebuild the Response from the bytes.
+    if (peeked.buffered.byteLength < MIN_COMPRESS_BYTES) {
+      return new Response(peeked.buffered, { status: resp.status, statusText: resp.statusText, headers: resp.headers });
+    }
+    // The size is known now, so the small-body gzip preference applies (#1646).
+    const sized = negotiateEncoding(req.headers.get('accept-encoding'), peeked.buffered.byteLength);
+    headers.set('content-encoding', sized);
+    const out = compressBufferSync(sized, peeked.buffered);
     headers.set('content-length', String(out.length));
     return new Response(out, { status: resp.status, statusText: resp.statusText, headers });
   }
@@ -488,6 +507,7 @@ async function maybeCompress(resp, req) {
   // hoisting this would waste a native zlib/brotli handle on the common case.
   // `encoding` is guaranteed br/gzip/deflate (negotiateEncoding), so
   // `createCompressor` never returns null here.
+  headers.set('content-encoding', encoding);
   const compressor = createCompressor(encoding);
   // Feed the (peeked + drained) web body into the compressor through the reader
   // loop (NOT Readable.fromWeb, which does not propagate a mid-stream source
@@ -495,8 +515,9 @@ async function maybeCompress(resp, req) {
   // so a source error (or a client disconnect destroying the output) tears down
   // the whole chain instead of leaking/hanging the compressor. Backpressure is
   // preserved: a slow client stalls `toWeb`, which stalls the compressor, which
-  // pauses the source.
-  const source = Readable.from(peeked.stream);
+  // pauses the source. A known-buffered body over the sync cap is replayed as
+  // a single chunk through the same path.
+  const source = Readable.from(peeked.buffered !== undefined ? [peeked.buffered] : peeked.stream);
   pipeline(source, compressor, () => {});
   const body = Readable.toWeb(compressor);
   return new Response(body, { status: resp.status, statusText: resp.statusText, headers });

package/src/listener-core.js

@@ -79,23 +79,60 @@ export function isCompressible(contentType) {
   return /^(?:text\/|application\/(?:javascript|json|xml|wasm|manifest)|image\/svg\+xml)/i.test(ct);
 }
 
+/**
+ * The smallest BUFFERED body brotli is worth on the sync path (#1646). Below
+ * it gzip level 6 is preferred when the client accepts both: measured on the
+ * two runtimes, a 2.4 KB SSR page costs 60 to 82 µs at brotli quality 4
+ * against 18 to 29 µs at gzip 6 for 912 against 986 bytes, and at 8 KB the
+ * byte gap is 3 percent for a 1.7 to 2.8x CPU gap. From about 32 KB brotli's
+ * ratio advantage and Node's slower gzip cross over (a 133 KB page compresses
+ * to 36.3 KB either way, brotli 1.1 to 1.4 ms, gzip 1.3 to 1.8 ms). This is
+ * the sync, buffered path only; a streamed body's size is unknown when its
+ * head goes out, and a streamed body is large or Suspense-driven by nature.
+ */
+export const BROTLI_MIN_BYTES = 32 * 1024;
+
 /**
  * Negotiate a response content-encoding from a request's `Accept-Encoding`,
  * preferring brotli (best ratio), then gzip, then deflate. Returns `''` when
  * none is acceptable. Shared by BOTH listener shells so they negotiate
  * identically; the matching uses the same `(?:^|,\s*)<enc>(?:;|,|$)` token test
- * the node shell has always used.
+ * the node shell has always used. With a known body size (the buffered path),
+ * gzip wins over brotli under `BROTLI_MIN_BYTES` when both are accepted.
+ * A coding listed with `q=0` is refused (RFC 9110), so `gzip;q=0, br` never
+ * gets gzip from the small-body preference and `br;q=0, gzip` gets gzip.
  * @param {string | string[] | undefined | null} acceptEncoding
+ * @param {number} [bodyBytes]  the buffered body's size, when known
  * @returns {'br' | 'gzip' | 'deflate' | ''}
  */
-export function negotiateEncoding(acceptEncoding) {
+export function negotiateEncoding(acceptEncoding, bodyBytes) {
   const accept = Array.isArray(acceptEncoding) ? acceptEncoding.join(',') : String(acceptEncoding || '');
-  if (/(?:^|,\s*)br(?:;|,|$)/.test(accept)) return 'br';
-  if (/(?:^|,\s*)gzip(?:;|,|$)/.test(accept)) return 'gzip';
-  if (/(?:^|,\s*)deflate(?:;|,|$)/.test(accept)) return 'deflate';
+  const br = accepts(ACCEPT_BR, accept);
+  const gzip = accepts(ACCEPT_GZIP, accept);
+  if (br && gzip && bodyBytes !== undefined && bodyBytes < BROTLI_MIN_BYTES) return 'gzip';
+  if (br) return 'br';
+  if (gzip) return 'gzip';
+  if (accepts(ACCEPT_DEFLATE, accept)) return 'deflate';
   return '';
 }
 
+// One coding token with its optional parameters, matched as a whole list
+// member (`xbr` and `brx` are not `br`).
+const ACCEPT_BR = /(?:^|,\s*)br(;[^,]*)?(?:,|$)/;
+const ACCEPT_GZIP = /(?:^|,\s*)gzip(;[^,]*)?(?:,|$)/;
+const ACCEPT_DEFLATE = /(?:^|,\s*)deflate(;[^,]*)?(?:,|$)/;
+const Q_ZERO = /;\s*q\s*=\s*0(?:\.0*)?\s*(?:;|$)/i;
+
+/**
+ * Whether the header lists the coding with a non-zero quality.
+ * @param {RegExp} token
+ * @param {string} accept
+ */
+function accepts(token, accept) {
+  const m = token.exec(accept);
+  return m !== null && !(m[1] && Q_ZERO.test(m[1]));
+}
+
 /**
  * Create a `node:zlib` compressor Transform for a negotiated encoding, or null.
  * `node:zlib` runs NATIVELY on Bun, so both shells get brotli through it (the web
@@ -121,6 +158,16 @@ export function createCompressor(encoding) {
  */
 export const MAX_SYNC_COMPRESS_BYTES = 256 * 1024;
 
+/**
+ * The smallest BUFFERED body worth compressing (#1644), shared by both shells.
+ * Below it the encoding's own cost (a zlib context, the framing bytes, a
+ * decode on the client) outweighs the few bytes it saves, so the body is sent
+ * as is with no `content-encoding`. 1 KB is the threshold Express's
+ * `compression` middleware has used for years. A STREAMED body is never
+ * measured against it (its size is unknown when the head goes out).
+ */
+export const MIN_COMPRESS_BYTES = 1024;
+
 /**
  * Compress an already-buffered body synchronously, byte-for-byte identical to
  * the streaming `createCompressor` ON THE SAME RUNTIME (same algorithm + params:

package/src/rate-limit.js

@@ -313,9 +313,3 @@ export function parseWindow(w) {
   const mult = { ms: 1, s: 1000, m: 60_000, h: 3_600_000 }[unit];
   return n * (mult || 1);
 }
-
-/** Testing hook: reset the default store (for unit tests). */
-export function _resetRateLimits() {
-  // With the cache store, there's nothing to reset here: the store
-  // handles its own state. This function exists for API compatibility.
-}

package/src/session.js

@@ -235,7 +235,7 @@ export function storeSessionStorage(opts = {}) {
   };
 }
 
-// Backwards-compatible aliases
+// Short aliases
 export const cookieSession = cookieSessionStorage;
 export const storeSession = storeSessionStorage;
 

package/src/ssr/env-shim.js

@@ -1,5 +1,6 @@
 import { jsonForScriptTag } from '../script-tag-json.js';
 import { escapeAttr } from './escape.js';
+import { buildEpoch } from '../build-epoch.js';
 
 /**
  * The `window.process.env` shim, kept in its own module because BOTH the head
@@ -28,12 +29,48 @@ import { escapeAttr } from './escape.js';
  * `</...` sequences in stringified values are escaped so an env value
  * containing `</script>` cannot terminate the inline script tag.
  *
+ * **The payload is a per-build SNAPSHOT (#1644).** Enumerating `process.env`
+ * is an exotic getenv walk, about 266 µs with a couple of hundred variables,
+ * and it ran on EVERY page render (24% of a production render's CPU) for a
+ * result that only changes with the build: `applyEnvValidation` writes its
+ * coerced values back BEFORE any render, and a dev rebuild bumps the build
+ * epoch, which re-snapshots. So `WEBJS_PUBLIC_*` is read at the first render
+ * of a build. A `process.env` mutation made at runtime, after that render, is
+ * not reflected until the next build (restart, or a dev rebuild). Only the
+ * nonce attribute varies per call. An explicit `opts.env` (tests) is never
+ * memoized.
+ *
  * @param {{ dev: boolean, nonce?: string, env?: Record<string, string|undefined> }} opts
  *   `env` defaults to `process.env`. Override for tests.
  * @returns {string}
  */
 export function publicEnvShim(opts) {
-  const source = opts.env || process.env;
+  const dev = !!opts.dev;
+  let payload;
+  if (opts.env) {
+    payload = publicEnvPayload(dev, opts.env);
+  } else {
+    const m = dev ? _memo.dev : _memo.prod;
+    if (m.epoch === buildEpoch()) payload = m.value;
+    else {
+      payload = publicEnvPayload(dev, process.env);
+      _memo[dev ? 'dev' : 'prod'] = { epoch: buildEpoch(), value: payload };
+    }
+  }
+  const n = opts.nonce ? ` nonce="${escapeAttr(opts.nonce)}"` : '';
+  return `<script${n}>${payload}</script>`;
+}
+
+/**
+ * The script BODY (everything inside the tag): the `WEBJS_PUBLIC_*` subset of
+ * `source` plus `NODE_ENV`, serialized with `jsonForScriptTag`. Pure in its
+ * inputs, so the memo above can hold its result.
+ *
+ * @param {boolean} dev
+ * @param {Record<string, string|undefined>} source
+ * @returns {string}
+ */
+export function publicEnvPayload(dev, source) {
   /** @type {Record<string, string>} */
   const env = {};
   for (const [k, v] of Object.entries(source)) {
@@ -41,11 +78,15 @@ export function publicEnvShim(opts) {
       env[k] = String(v);
     }
   }
-  env.NODE_ENV = opts.dev ? 'development' : 'production';
-  const n = opts.nonce ? ` nonce="${escapeAttr(opts.nonce)}"` : '';
-  return `<script${n}>`
-    + `window.process=window.process||{};`
-    + `window.process.env=Object.assign(window.process.env||{},${jsonForScriptTag(env)});`
-    + `</script>`;
+  env.NODE_ENV = dev ? 'development' : 'production';
+  return 'window.process=window.process||{};'
+    + `window.process.env=Object.assign(window.process.env||{},${jsonForScriptTag(env)});`;
 }
 
+/**
+ * One snapshot per `dev` flag (a test process renders both ways), each
+ * `{ epoch, value }` keyed on the build epoch.
+ * @type {{ dev: { epoch: number, value: string }, prod: { epoch: number, value: string } }}
+ */
+let _memo = { dev: { epoch: 0, value: '' }, prod: { epoch: 0, value: '' } };
+

package/src/ssr/head.js

@@ -10,6 +10,7 @@ import { clientRouterEnabled } from './client-router-flag.js';
 import { embedScriptTag } from '../dev-embed.js';
 import { devReloadState } from '../dev-reload-state.js';
 import { openGraphPairs, twitterPairs, setMetadataImageRoutes } from './seo.js';
+import { buildEpoch, bumpBuildEpoch } from '../build-epoch.js';
 
 // Which icon and manifest metadata the app has: the `app/icon.*`,
 // `app/apple-icon.*` and `app/manifest.*` files (a static file such as
@@ -99,6 +100,33 @@ export function setMetadataIconRoutes(metadataRoutes) {
     manifest: manifest ? /** @type {string} */ (manifest.urlPath) : null,
   };  // The og/twitter image routes ride the same rebuild hook (seo.js).
   setMetadataImageRoutes(metadataRoutes);
+  // The auto-link memos below key on the epoch (#1644).
+  bumpBuildEpoch();
+}
+
+/**
+ * Memo for `autoMetadataRouteIcons` / `autoManifestUrl` (#1644): both read
+ * only `_metadataIconRoutes` and `basePath()`, and `setMetadataIconRoutes` and
+ * `setBasePath` both bump the epoch, so one entry serves every render of a
+ * build instead of re-prefixing the lists per request.
+ * @type {{ epoch: number, icons: { icon?: AutoIcon[], apple?: AutoIcon[] } | null, manifest: string | null }}
+ */
+let _autoLinkMemo = { epoch: 0, icons: null, manifest: null };
+
+/** @returns {void} */
+function refreshAutoLinkMemo() {
+  if (_autoLinkMemo.epoch === buildEpoch()) return;
+  const { icon, apple, manifest } = _metadataIconRoutes;
+  const bp = basePath();
+  const prefix = (/** @type {AutoIcon} */ i) => ({ ...i, url: withBasePath(i.url, bp) });
+  /** @type {{ icon?: AutoIcon[], apple?: AutoIcon[] } | null} */
+  let icons = null;
+  if (icon.length || apple.length) {
+    icons = {};
+    if (icon.length) icons.icon = icon.map(prefix);
+    if (apple.length) icons.apple = apple.map(prefix);
+  }
+  _autoLinkMemo = { epoch: buildEpoch(), icons, manifest: manifest ? withBasePath(manifest, bp) : null };
 }
 
 /**
@@ -112,25 +140,18 @@ export function setMetadataIconRoutes(metadataRoutes) {
  *
  * @returns {{ icon?: AutoIcon[], apple?: AutoIcon[] } | null}
  */
-function autoMetadataRouteIcons() {
-  const { icon, apple } = _metadataIconRoutes;
-  if (!icon.length && !apple.length) return null;
-  const bp = basePath();
-  const prefix = (/** @type {AutoIcon} */ i) => ({ ...i, url: withBasePath(i.url, bp) });
-  /** @type {{ icon?: AutoIcon[], apple?: AutoIcon[] }} */
-  const out = {};
-  if (icon.length) out.icon = icon.map(prefix);
-  if (apple.length) out.apple = apple.map(prefix);
-  return out;
+export function autoMetadataRouteIcons() {
+  refreshAutoLinkMemo();
+  return _autoLinkMemo.icons;
 }
 
 /**
  * The app's `app/manifest.*` URL (base-path prefixed), or null.
  * @returns {string | null}
  */
-function autoManifestUrl() {
-  const { manifest } = _metadataIconRoutes;
-  return manifest ? withBasePath(manifest, basePath()) : null;
+export function autoManifestUrl() {
+  refreshAutoLinkMemo();
+  return _autoLinkMemo.manifest;
 }
 
 /**
@@ -457,9 +478,9 @@ export function wrapHead(opts) {
 
   if (m.description) metaTags.push(`<meta name="description" content="${escapeAttr(m.description)}">`);
 
-  // viewport: support string form (legacy), `metadata.viewport` object form,
-  // and the new Next.js 14+ `export const viewport = { … }` shape captured
-  // into `_viewport` by collectMetadata.
+  // viewport: the `metadata.viewport` string or object form, or the Next.js
+  // 14+ `export const viewport = { … }` shape captured into `_viewport` by
+  // collectMetadata.
   let viewportStr = '';
   if (typeof m.viewport === 'string') {
     viewportStr = m.viewport;

package/src/ssr/preloads.js

@@ -93,7 +93,7 @@ export function componentPreloads(usedTags, appDir, elidable, lazyFiles) {
  * @param {Set<string>} [elidableComponents]  absolute paths to skip in the walk
  * @returns {string[]}
  */
-export function deduplicatedPreloads(componentUrls, moduleUrls, graph, entryFiles, appDir, serverFiles, elidableComponents) {
+export function deduplicatedPreloads(componentUrls, moduleUrls, graph, entryFiles, appDir, serverFiles, elidableComponents, precomputedDeps) {
   const seen = new Set(moduleUrls);
   const result = [];
 
@@ -119,17 +119,22 @@ export function deduplicatedPreloads(componentUrls, moduleUrls, graph, entryFile
 
   // Add transitive deps from the module graph
   if (graph) {
-    // Combine entry files + component files for graph lookup
-    const allEntries = [...entryFiles];
-    for (const url of componentUrls) {
-      // Convert URL back to absolute path for graph lookup
-      const abs = resolve(appDir, url.startsWith('/') ? url.slice(1) : url);
-      allEntries.push(abs);
+    // `precomputedDeps` is the closure `pagePreloadHints` already walked for
+    // this render (#1644); without it (a direct caller) walk it here.
+    let deps = precomputedDeps;
+    if (!deps) {
+      // Combine entry files + component files for graph lookup
+      const allEntries = [...entryFiles];
+      for (const url of componentUrls) {
+        // Convert URL back to absolute path for graph lookup
+        const abs = resolve(appDir, url.startsWith('/') ? url.slice(1) : url);
+        allEntries.push(abs);
+      }
+      // Skip elidable components and any subtree reachable only through
+      // them: their imports are stripped from served source, so the
+      // browser never fetches these modules.
+      deps = transitiveDeps(graph, allEntries, appDir, elidableComponents);
     }
-    // Skip elidable components and any subtree reachable only through
-    // them: their imports are stripped from served source, so the
-    // browser never fetches these modules.
-    const deps = transitiveDeps(graph, allEntries, appDir, elidableComponents);
     for (const dep of deps) {
       if (byIndex(dep)) continue;
       const url = toUrlPath(dep, appDir);
@@ -169,7 +174,7 @@ export function deduplicatedPreloads(componentUrls, moduleUrls, graph, entryFile
  * @param {Set<string>} [serverFiles]  the action / server-file index (`'use server'`, incl. no-`.server.` files)
  * @returns {Set<string>}
  */
-export function reachedVendorSpecifiers(graph, entryFiles, componentUrls, appDir, elidableComponents, serverFiles) {
+export function reachedVendorSpecifiers(graph, entryFiles, componentUrls, appDir, elidableComponents, serverFiles, precomputedDeps) {
   /** @type {Set<string>} */
   const specs = new Set();
   if (!graph) return specs;
@@ -177,13 +182,14 @@ export function reachedVendorSpecifiers(graph, entryFiles, componentUrls, appDir
   if (!bare.size) return specs;
   // Roots = the SHIPPED page/layout modules (already inert-dropped + import-only
   // expanded by the caller) + the rendered components, keyed by the graph's own
-  // absolute paths. Walk their non-elided transitive closure.
+  // absolute paths. Walk their non-elided transitive closure, unless
+  // `pagePreloadHints` already walked it for this render (#1644).
   const allEntries = [...entryFiles];
   for (const url of componentUrls) {
     allEntries.push(resolve(appDir, url.startsWith('/') ? url.slice(1) : url));
   }
   const files = new Set(allEntries);
-  for (const dep of transitiveDeps(graph, allEntries, appDir, elidableComponents)) files.add(dep);
+  for (const dep of precomputedDeps || transitiveDeps(graph, allEntries, appDir, elidableComponents)) files.add(dep);
   for (const file of files) {
     // A server file is never served to the browser (its source is an RPC /
     // throw-at-load stub), so a vendor it imports never ships and must NOT be
@@ -198,3 +204,71 @@ export function reachedVendorSpecifiers(graph, entryFiles, componentUrls, appDir
   }
   return specs;
 }
+
+/**
+ * The skip set for the preload walks: the elidable components plus, when the
+ * app has `static lazy` components (#1524), every lazy file. Built once per
+ * lazy map (a per-build object), since it was rebuilt per render (#1644).
+ * @type {WeakMap<Map<string, string[]>, WeakMap<Set<string>, Set<string>>>}
+ */
+const SKIP_MEMO = new WeakMap();
+const NO_ELIDABLE = new Set();
+
+/**
+ * @param {Set<string> | undefined} elidable
+ * @param {Map<string, string[]> | undefined} lazyFiles
+ * @returns {Set<string> | undefined}
+ */
+function preloadSkipSet(elidable, lazyFiles) {
+  if (!lazyFiles || !lazyFiles.size) return elidable;
+  const key = elidable || NO_ELIDABLE;
+  let byElidable = SKIP_MEMO.get(lazyFiles);
+  if (!byElidable) { byElidable = new WeakMap(); SKIP_MEMO.set(lazyFiles, byElidable); }
+  let skip = byElidable.get(key);
+  if (!skip) {
+    skip = new Set([...(elidable || []), ...lazyFiles.keys()]);
+    byElidable.set(key, skip);
+  }
+  return skip;
+}
+
+/**
+ * The page's preload hints in ONE graph walk (#1644). The app-module preload
+ * pass (`deduplicatedPreloads`) and the vendor pass
+ * (`reachedVendorSpecifiers`) root at the same shipped set with the same skip
+ * set, so they used to walk the identical closure twice per render. This
+ * walks it once and hands the closure to both.
+ *
+ * The walk roots are the BOOT's actually-shipped module set (`moduleUrls`,
+ * inert modules already dropped and an import-only page already substituted)
+ * plus the rendered eager components, NOT the raw route entries: rooting at
+ * the raw entries would walk a dropped page's SSR-only subtree and hint a
+ * `modulepreload` for a module nothing that ships imports (#780, the
+ * app-module analog of the #754 vendor over-fetch).
+ *
+ * @param {{
+ *   graph: import('../module-graph.js').ModuleGraph | undefined,
+ *   appDir: string,
+ *   moduleUrls: string[],
+ *   eagerComponents: string[],
+ *   elidableComponents: Set<string> | undefined,
+ *   lazyFiles: Map<string, string[]> | undefined,
+ *   serverFiles: Set<string> | undefined,
+ * }} input
+ * @returns {{ preloads: string[], vendorSpecifiers: Set<string>, skip: Set<string> | undefined }}
+ */
+export function pagePreloadHints(input) {
+  const { graph, appDir, moduleUrls, eagerComponents, elidableComponents, lazyFiles, serverFiles } = input;
+  const skip = preloadSkipSet(elidableComponents, lazyFiles);
+  const shippedRoots = moduleUrls.map((u) => resolve(appDir, u.startsWith('/') ? u.slice(1) : u));
+  /** @type {string[] | undefined} */
+  let deps;
+  if (graph) {
+    const allEntries = [...shippedRoots];
+    for (const url of eagerComponents) allEntries.push(resolve(appDir, url.startsWith('/') ? url.slice(1) : url));
+    deps = transitiveDeps(graph, allEntries, appDir, skip);
+  }
+  const preloads = deduplicatedPreloads(eagerComponents, moduleUrls, graph, shippedRoots, appDir, serverFiles, skip, deps);
+  const vendorSpecifiers = reachedVendorSpecifiers(graph, shippedRoots, eagerComponents, appDir, skip, serverFiles, deps);
+  return { preloads, vendorSpecifiers, skip };
+}