@webjsdev/server 0.8.88 → 0.8.90

package/src/ssr/render.js

@@ -1,9 +1,9 @@
-import { resolve } from 'node:path';
 import { renderToString, isNotFound, isRedirect, isForbidden, isUnauthorized } from '@webjsdev/core';
 import { vendorPreloadTargets } from '../importmap.js';
 import {
-  componentPreloads, deduplicatedPreloads, reachedVendorSpecifiers, toUrlPath,
+  componentPreloads, pagePreloadHints, toUrlPath,
 } from './preloads.js';
+import { shippedBootModules } from './shipped-modules.js';
 import { seedingEnabled, collectSeeds, buildSeedScript, SEED_DROP_BLOCK } from '../action-seed.js';
 import {
   readRevalidate,
@@ -830,7 +830,7 @@ async function ssrBoundaryHtml(file, heading, opts) {
       moduleUrls = [];
     }
   }
-  const nonce = opts.req ? getNonce(opts.req) : undefined;
+  const nonce = getNonce();
   return wrapInDocument(body, {
     metadata: { title: heading.replace(/^\d+:\s*/, '') },
     moduleUrls,
@@ -900,7 +900,7 @@ async function ssrNotFoundHtml(notFoundFile, opts) {
       moduleUrls = [];
     }
   }
-  const nonce = opts.req ? getNonce(opts.req) : undefined;
+  const nonce = getNonce();
   return wrapInDocument(body, {
     metadata: { title: 'Not found' },
     moduleUrls,
@@ -1113,37 +1113,19 @@ export async function ssrPage(route, params, url, opts) {
     // lazy loader instead of imported, exactly as a shipping module's served
     // source defers its side-effect import of one, so the boot never fetches
     // it up front and a tag revealed later still loads on first sight.
-    const inert = opts.inertRouteModules;
-    const importOnly = opts.importOnlyRouteModules;
+    //
+    // The assembly itself lives in `shipped-modules.js` (#1644), shared with
+    // the Node listener's 103 Early Hints and memoized per route object and
+    // build epoch; nothing below mutates `moduleUrls`, which is what lets the
+    // memoized array be handed out as is.
     const lazyFiles = opts.lazyComponentFiles;
-    const moduleUrls = [];
-    /** @type {Record<string, string>} */
-    const frontierLazy = {};
-    {
-      const seen = new Set();
-      const push = (abs) => {
-        const u = toUrlPath(abs, opts.appDir);
-        const tags = lazyFiles && lazyFiles.get(abs);
-        if (tags) { for (const t of tags) frontierLazy[t] = u; return; }
-        if (!seen.has(u)) { seen.add(u); moduleUrls.push(u); }
-      };
-      for (const f of [route.file, ...route.layouts]) {
-        if (inert && inert.has(f)) continue;
-        const emit = importOnly && importOnly.get(f);
-        if (emit) emit.forEach(push);
-        else push(f);
-      }
-    }
-    // instrumentation-client.{js,ts} (#848): import it FIRST in the client boot
-    // so it runs before app modules (Next's instrumentation-client ordering).
-    // It ships even on an otherwise-static page (the app opted into client work),
-    // so it is prepended AFTER the component/page modules are collected.
-    if (opts.instrumentationClient) {
-      const u = toUrlPath(opts.instrumentationClient, opts.appDir);
-      const i = moduleUrls.indexOf(u);
-      if (i !== -1) moduleUrls.splice(i, 1);
-      moduleUrls.unshift(u);
-    }
+    const { moduleUrls, frontierLazy } = shippedBootModules(route, {
+      appDir: opts.appDir,
+      inert: opts.inertRouteModules,
+      importOnly: opts.importOnlyRouteModules,
+      lazyFiles,
+      instrumentationClient: opts.instrumentationClient,
+    });
     // Emit <link rel="modulepreload"> for every custom element that
     // actually rendered PLUS their transitive dependencies (from the
     // module graph). URLs are deduplicated so the browser never sees
@@ -1153,48 +1135,28 @@ export async function ssrPage(route, params, url, opts) {
     const { eager: eagerComponents, lazy: renderedLazy } =
       componentPreloads(suspenseCtx.usedComponents, opts.appDir, opts.elidableComponents, lazyFiles);
     const lazyComponents = { ...frontierLazy, ...renderedLazy };
-    // The preload walks skip a lazy component and the subtree reachable only
-    // through it (#1524), the same way they skip an elided one: the browser
-    // does not fetch it until the loader asks.
-    const preloadSkip = lazyFiles && lazyFiles.size
-      ? new Set([...(opts.elidableComponents || []), ...lazyFiles.keys()])
-      : opts.elidableComponents;
-    // The walk roots for BOTH preload passes are the BOOT's actually-shipped
-    // module set (`moduleUrls`, which already drops inert page/layout modules and
-    // substitutes an import-only page with its components), NOT the raw route
-    // entries `[route.file, ...route.layouts]`. Rooting at the raw entries would
-    // walk a dropped page's SSR-only subtree (a direct import OR a relative
-    // helper) and hint a `modulepreload` for a module nothing that ships imports,
-    // an over-fetch (#780, the app-module analog of the #754 vendor over-fetch).
-    const shippedRoots = moduleUrls.map((u) =>
-      resolve(opts.appDir, u.startsWith('/') ? u.slice(1) : u));
-    const preloads = deduplicatedPreloads(
-      eagerComponents,
+    // Both preload passes (the app-module hints and the vendor hints, #754)
+    // root at the BOOT's shipped set plus the rendered components and skip a
+    // lazy component (#1524) or an elided one and the subtree only it reaches;
+    // `pagePreloadHints` walks that closure ONCE for both (#1644), where the
+    // two passes used to walk it twice. The over-fetch rules (#780, #754) are
+    // documented on the helper.
+    const hints = pagePreloadHints({
+      graph: opts.moduleGraph,
+      appDir: opts.appDir,
       moduleUrls,
-      opts.moduleGraph,
-      shippedRoots,
-      opts.appDir,
-      opts.serverFiles,
-      preloadSkip,
-    );
+      eagerComponents,
+      elidableComponents: opts.elidableComponents,
+      lazyFiles,
+      serverFiles: opts.serverFiles,
+    });
+    const preloads = hints.preloads;
     // Vendor modulepreload (#754): flatten the npm CDN waterfall by hinting the
-    // vendor URLs the page's SHIPPED modules actually import, fetched in parallel
-    // instead of discovered level by level. Same shipped-module roots as the
-    // app-module walk above, so a vendor reached ONLY through a dropped module
-    // (a page's SSR-only direct import OR its SSR-only relative helper) is never
-    // preloaded (no over-fetch).
-    const vendorPreloads = vendorPreloadTargets(
-      reachedVendorSpecifiers(
-        opts.moduleGraph,
-        shippedRoots,
-        eagerComponents,
-        opts.appDir,
-        preloadSkip,
-        opts.serverFiles,
-      ),
-    );
+    // vendor URLs the page's SHIPPED modules actually import, fetched in
+    // parallel instead of discovered level by level.
+    const vendorPreloads = vendorPreloadTargets(hints.vendorSpecifiers);
     // Extract CSP nonce from request headers (if present).
-    const nonce = opts.req ? getNonce(opts.req) : undefined;
+    const nonce = getNonce();
     const wrapOpts = {
       metadata,
       moduleUrls,
@@ -1342,7 +1304,7 @@ export async function ssrPage(route, params, url, opts) {
     // Error paths still need to honor the request's CSP nonce so the
     // error page's boot scripts (when moduleUrls is non-empty) and
     // the meta csp-nonce tag both pass strict-CSP enforcement.
-    const errNonce = opts.req ? getNonce(opts.req) : undefined;
+    const errNonce = getNonce();
     // One dedup set for the whole 500 path: the walk below and the
     // global-error attempt after it collapse REPEATS of the same cause (a
     // shared layout that fails every attempt) while still reporting a

package/src/ssr/responses.js

@@ -16,19 +16,15 @@ import { escapeAttr, escapeHtml } from './escape.js';
  * scope. Delegates to `cspNonce()`, which returns the per-request nonce
  * the handler MINTED when CSP is enabled (issue #233), or, as a fallback,
  * the nonce parsed from an inbound `Content-Security-Policy` request
- * header (the legacy consume-only path). Using the same source as the
+ * header (a proxy that mints its own). Using the same source as the
  * `Content-Security-Policy` response header is what guarantees the inline
  * boot script, the importmap, the modulepreload hints, and the header all
- * carry the EXACT same nonce: one minted value, no drift.
+ * carry the EXACT same nonce: one minted value, no drift. The value comes
+ * from the request-scoped AsyncLocalStorage store, so it takes no request.
  *
- * `req` is accepted (and ignored) so existing call sites stay unchanged;
- * the value comes from the request-scoped AsyncLocalStorage store, not
- * the argument.
- *
- * @param {Request} [_req]
  * @returns {string | undefined}
  */
-export function getNonce(_req) {
+export function getNonce() {
   return cspNonce() || undefined;
 }
 

package/src/ssr/shipped-modules.js

@@ -0,0 +1,113 @@
+/**
+ * The boot's shipped-module assembly, shared by the SSR render and the 103
+ * Early Hints (#1644).
+ *
+ * For a matched route the client boot imports the page and its layouts MINUS
+ * the inert ones (a module that does no client work, #170), with an
+ * IMPORT-ONLY module (#605) replaced by the component frontier it exists to
+ * import, and a `static lazy` component in that frontier (#1524) diverted to
+ * the lazy loader instead of imported. `ssr/render.js` derived that list per
+ * request, and the Node listener's `routeFor` (the 103 Early Hints) carried a
+ * second copy of the same loop that had drifted: it knew nothing of lazy
+ * files, so a lazy frontier component was early-hinted although the boot
+ * never imports it.
+ *
+ * One function now owns the assembly, memoized per ROUTE OBJECT in a WeakMap
+ * (the route table is rebuilt per build, so a stale entry dies with its
+ * route, and a dynamic route cannot grow the memo the way a pathname key
+ * would) and validated against the build epoch (the inert / import-only /
+ * lazy sets are per-build inputs). The hinted url list, the same modules
+ * through `withBasePath` then `withAssetHash`, is memoized beside it so a
+ * warm GET costs one WeakMap lookup.
+ */
+import { buildEpoch } from '../build-epoch.js';
+import { withBasePath } from '../base-path.js';
+import { withAssetHash, assetHashMisses } from '../asset-hash.js';
+import { toUrlPath } from './preloads.js';
+
+/**
+ * @typedef {object} ShippedDeps
+ * @property {string} appDir
+ * @property {Set<string> | undefined} inert  inert page / layout files (never shipped)
+ * @property {Map<string, string[]> | undefined} importOnly  import-only module -> the component files emitted in its place
+ * @property {Map<string, string[]> | undefined} lazyFiles  lazy component file -> its tags
+ * @property {string | undefined} instrumentationClient  `instrumentation-client.*`, imported first when present
+ */
+
+/**
+ * @typedef {object} ShippedModules
+ * @property {string[]} moduleUrls  url paths the boot imports, in import order
+ * @property {Record<string, string>} frontierLazy  tag -> url for lazy components diverted out of the frontier
+ */
+
+/** @type {WeakMap<object, { epoch: number, value: ShippedModules, hinted: string[] | null, hintedBasePath: string }>} */
+const MEMO = new WeakMap();
+
+/**
+ * The modules the client boot imports for `route`, plus the lazy frontier it
+ * registers instead. Same object back for the same route within a build.
+ *
+ * @param {{ file: string, layouts: string[] }} route  the matched route (its object identity is the memo key)
+ * @param {ShippedDeps} deps
+ * @returns {ShippedModules}
+ */
+export function shippedBootModules(route, deps) {
+  const hit = MEMO.get(route);
+  if (hit && hit.epoch === buildEpoch()) return hit.value;
+  const { appDir, inert, importOnly, lazyFiles, instrumentationClient } = deps;
+  /** @type {string[]} */
+  const moduleUrls = [];
+  /** @type {Record<string, string>} */
+  const frontierLazy = {};
+  const seen = new Set();
+  const push = (/** @type {string} */ abs) => {
+    const u = toUrlPath(abs, appDir);
+    const tags = lazyFiles && lazyFiles.get(abs);
+    if (tags) { for (const t of tags) frontierLazy[t] = u; return; }
+    if (!seen.has(u)) { seen.add(u); moduleUrls.push(u); }
+  };
+  for (const f of [route.file, ...route.layouts]) {
+    if (inert && inert.has(f)) continue;
+    const emit = importOnly && importOnly.get(f);
+    if (emit) emit.forEach(push);
+    else push(f);
+  }
+  // instrumentation-client.{js,ts} (#848): import it FIRST in the client boot
+  // so it runs before app modules (Next's instrumentation-client ordering).
+  // It ships even on an otherwise-static page (the app opted into client work).
+  if (instrumentationClient) {
+    const u = toUrlPath(instrumentationClient, appDir);
+    const i = moduleUrls.indexOf(u);
+    if (i !== -1) moduleUrls.splice(i, 1);
+    moduleUrls.unshift(u);
+  }
+  const value = { moduleUrls, frontierLazy };
+  MEMO.set(route, { epoch: buildEpoch(), value, hinted: null, hintedBasePath: '' });
+  return value;
+}
+
+/**
+ * The 103 Early Hints url list for `route`: the SAME modules the boot
+ * imports, through `withBasePath` then `withAssetHash`, so the hint warms
+ * exactly the url the body requests (#243). Memoized beside the assembly.
+ *
+ * @param {{ file: string, layouts: string[] }} route
+ * @param {ShippedDeps} deps
+ * @param {string} basePath  the normalized `webjs.basePath` (`''` at a root mount)
+ * @returns {string[]}
+ */
+export function hintedBootModules(route, deps, basePath) {
+  const { moduleUrls } = shippedBootModules(route, deps);
+  const entry = /** @type {NonNullable<ReturnType<typeof MEMO.get>>} */ (MEMO.get(route));
+  if (entry.hinted && entry.hintedBasePath === basePath) return entry.hinted;
+  // Not stored when a hash read failed transiently while computing it
+  // (`assetHashMisses` moved): the list is served with the un-fingerprinted
+  // url, and the next request re-attempts the read (see `asset-hash.js`).
+  const missesBefore = assetHashMisses();
+  const hinted = moduleUrls.map((u) => withAssetHash(withBasePath(u, basePath), basePath));
+  if (assetHashMisses() === missesBefore) {
+    entry.hinted = hinted;
+    entry.hintedBasePath = basePath;
+  }
+  return hinted;
+}