@wular/pnext 0.0.19 → 0.0.21

package/src/render/resource-hints.ts

@@ -1,15 +1,62 @@
 import type { ResourceHint } from '../types'
 
-declare global {
-  var __PNEXT_RESOURCE_HINTS__: ResourceHint[] | undefined
-}
-
 // Optional server-side observer for every registered hint (compat's Link response-header emission).
 // Anchored on globalThis because react-dom's preload()/preinit() shims are compiled into app bundles as
 // separate module instances - only a global slot lets the runtime-registered listener see the
 // bundle-registered hints. No-op for pure-core apps.
 const HINT_LISTENER = Symbol.for('pnext.resourceHintListener')
 
+// The buffers a render fills and the renderer drains at document assembly: resource hints, the
+// beforeInteractive head scripts and the deferred script runtime. One global array per kind is not
+// enough - two renders alive at once in one process (a build prerendering a route beside the
+// not-found document, or two concurrent requests) then share it, and whichever assembles first
+// drains the other's preloads and head scripts. So a render gets a FRAME, and the buffers live in
+// it; outside a render they stay on globalThis, where the next render start drops them.
+//
+// The frame store is created by the renderer (server-only, it owns node:async_hooks) and read here
+// through the same globalThis anchor as the work unit: this module is compiled into client bundles
+// and into every compat bundle's own copy, and only a shared slot lets those copies write into the
+// frame the renderer reads.
+export const RENDER_BUFFER_SCOPE = Symbol.for('pnext.renderBufferScope')
+const RENDER_BUFFER_STRAYS = Symbol.for('pnext.renderBufferStrays')
+
+export type RenderBufferKind = 'hints' | 'head' | 'deferred'
+export type RenderBufferFrame = Record<RenderBufferKind, unknown[]>
+
+export const newRenderBufferFrame = (): RenderBufferFrame => ({ hints: [], head: [], deferred: [] })
+
+const globals = globalThis as Record<PropertyKey, unknown>
+
+/** Duck-typed store read, so this module never pulls node:async_hooks into a client bundle. */
+function frame(): RenderBufferFrame {
+  const scope = globals[RENDER_BUFFER_SCOPE] as
+    { getStore(): RenderBufferFrame | undefined } | undefined
+  return (
+    scope?.getStore() ??
+    ((globals[RENDER_BUFFER_STRAYS] ??= newRenderBufferFrame()) as RenderBufferFrame)
+  )
+}
+
+/** The current render's buffer, or the process-wide stray one outside a render. */
+export function renderBuffer<T>(kind: RenderBufferKind): T[] {
+  return frame()[kind] as T[]
+}
+
+/** Hand the buffer to the document being assembled and leave a fresh one behind. */
+export function takeRenderBuffer<T>(kind: RenderBufferKind): T[] {
+  const active = frame()
+  const buffer = active[kind]
+  active[kind] = []
+  return buffer as T[]
+}
+
+/** Drop the frame's buffer AND the stray one, so out-of-render writes never accumulate. */
+export function clearRenderBuffer(kind: RenderBufferKind): void {
+  frame()[kind] = []
+  const strays = globals[RENDER_BUFFER_STRAYS] as RenderBufferFrame | undefined
+  if (strays) strays[kind] = []
+}
+
 export function setResourceHintListener(listener: ((hint: ResourceHint) => void) | undefined) {
   ;(globalThis as Record<PropertyKey, unknown>)[HINT_LISTENER] = listener
 }
@@ -22,22 +69,28 @@ export function registerResourceHint(hint: ResourceHint): void {
   const listener = (globalThis as Record<PropertyKey, unknown>)[HINT_LISTENER] as
     ((hint: ResourceHint) => void) | undefined
   listener?.(hint)
-  const hints = (globalThis.__PNEXT_RESOURCE_HINTS__ ??= [])
+  const hints = renderBuffer<ResourceHint>('hints')
   if (hints.some(existing => resourceHintKey(existing) === resourceHintKey(hint))) return
   hints.push(hint)
 }
 
 export function clearResourceHints(): void {
-  globalThis.__PNEXT_RESOURCE_HINTS__ = []
+  clearRenderBuffer('hints')
 }
 
 export function takeResourceHints(): ResourceHint[] {
-  const hints = globalThis.__PNEXT_RESOURCE_HINTS__ ?? []
-  globalThis.__PNEXT_RESOURCE_HINTS__ = []
-  return hints
+  return takeRenderBuffer<ResourceHint>('hints')
 }
 
 function resourceHintKey(hint: ResourceHint): string {
+  // React Float dedupes image preloads by the image URL, not the full attribute
+  // set. next/image may register the same optimized candidate more than once
+  // while a shared layout renders, and the first registration owns its shape.
+  if (hint.rel === 'preload' && hint.as === 'image') {
+    const srcSet = hint.attributes?.imagesrcset
+    const first = typeof srcSet === 'string' ? srcSet.split(/[\s,]+/)[0] : undefined
+    return `image:${first || hint.url || ''}`
+  }
   const attributes = Object.entries(hint.attributes ?? {}).sort(([a], [b]) => a.localeCompare(b))
   return JSON.stringify({ ...hint, attributes })
 }

package/src/render/slots.tsx

@@ -18,6 +18,7 @@ import {
 } from '../routing/slots'
 import { toPosixPath } from '../utils/fs'
 import { PROMISE_MARKER_KEY, revivePromiseMarkers } from '../utils/serialize'
+import { getRenderExtensions } from '../extensions'
 import type { PageProps, RouteManifestEntry, RouteParamValue, ServerComponent } from '../types'
 
 interface SlotRenderOptions {
@@ -423,7 +424,7 @@ export function promisePlaceholderJson(kind: 'params' | 'searchParams'): string
  * entry runs, so a nested marker is a promise on both sides rather than a bare object on one.
  */
 export function revivePromiseProps(props: Record<string, unknown>) {
-  return revivePromiseMarkers({ ...props })
+  return revivePromiseMarkers({ ...props }, getRenderExtensions().legacySyncProps)
 }
 
 function slotPageProps<Options extends SlotRenderOptions>(

package/src/resolve/scan-facts.ts

@@ -115,6 +115,8 @@ export interface ScanFacts {
   exportStars: string[]
   /** A real `'use client'` directive — prologue position only, never a comment. */
   useClient: boolean
+  /** A real module-level `'use server'` directive, on the same terms. */
+  useServer: boolean
   /** Loader-shaped calls (see `DynamicCallFact`); only sources that can bind `dynamic` are walked. */
   dynamicCalls: DynamicCallFact[]
 }
@@ -128,6 +130,7 @@ const emptyFacts: ScanFacts = {
   exportNames: [],
   exportStars: [],
   useClient: false,
+  useServer: false,
   dynamicCalls: [],
 }
 
@@ -378,7 +381,8 @@ function parseFacts(file: string, source: string, lang: ParserLang) {
       requires,
       exportNames,
       exportStars,
-      useClient: hasUseClient(source, result),
+      useClient: moduleDirective(source, result, 'use client'),
+      useServer: moduleDirective(source, result, 'use server'),
       // `result.program` deserializes the whole AST: walk it only for sources
       // that can bind `dynamic()` at all (same cheap gate as resolve/dynamic.ts).
       dynamicCalls:
@@ -400,12 +404,16 @@ function parseFacts(file: string, source: string, lang: ParserLang) {
  * was its only consumer. The raw-source scanner answers it without the AST; the AST is still
  * consulted for the prologue shapes the scanner will not commit to.
  */
-function hasUseClient(source: string, result: { program: { body: readonly Directive[] } }) {
-  const sniffed = sniffDirective(source, 'use client')
+function moduleDirective(
+  source: string,
+  result: { program: { body: readonly Directive[] } },
+  directive: string,
+) {
+  const sniffed = sniffDirective(source, directive)
   if (sniffed !== undefined) return sniffed
   // Uncertain, but a directive is its raw text: no occurrence, no directive.
-  if (!source.includes('use client')) return false
-  return hasDirective(result.program.body, 'use client')
+  if (!source.includes(directive)) return false
+  return hasDirective(result.program.body, directive)
 }
 
 interface Directive {

package/src/routing/forwarded.ts

@@ -1,26 +1,34 @@
 // x-forwarded-* request header injection (CORE HTTP correctness).
 //
 // Before route matching / render, the server records the observed host, port,
-// and protocol on the incoming request headers so headers() during render and
-// any request-header reader (middleware, route handlers) see them. Client-sent
+// protocol, and peer address on the incoming request headers so headers() during
+// render and any request-header reader (middleware, route handlers) see them. Client-sent
 // x-forwarded-* values are never overridden (a trusted proxy already set them),
 // including multi-value forms like "https, https".
 
 const FORWARDED_HOST = 'x-forwarded-host'
 const FORWARDED_PORT = 'x-forwarded-port'
 const FORWARDED_PROTO = 'x-forwarded-proto'
+const FORWARDED_FOR = 'x-forwarded-for'
+
+/** The serving runtime, narrowed to the peer-address lookup (Bun's `Server`). */
+export interface PeerAddressSource {
+  requestIP(request: Request): { address: string } | null
+}
 
 /**
- * Return the request with x-forwarded-host/port/proto injected from the request
- * URL + Host header, preserving any client-sent values. Returns the same
- * request when every value was already present (no allocation on the hot path).
+ * Return the request with x-forwarded-host/port/proto/for injected from the
+ * request URL + Host header + peer address, preserving any client-sent values.
+ * Returns the same request when every value was already present (no allocation
+ * on the hot path).
  */
-export function withForwardedHeaders(request: Request): Request {
+export function withForwardedHeaders(request: Request, peer?: PeerAddressSource): Request {
   const headers = request.headers
   const hasHost = headers.has(FORWARDED_HOST)
   const hasPort = headers.has(FORWARDED_PORT)
   const hasProto = headers.has(FORWARDED_PROTO)
-  if (hasHost && hasPort && hasProto) return request
+  const hasFor = headers.has(FORWARDED_FOR)
+  if (hasHost && hasPort && hasProto && (hasFor || !peer)) return request
 
   let url: URL
   try {
@@ -37,5 +45,10 @@ export function withForwardedHeaders(request: Request): Request {
   if (!hasHost) next.set(FORWARDED_HOST, host)
   if (!hasPort) next.set(FORWARDED_PORT, port)
   if (!hasProto) next.set(FORWARDED_PROTO, proto)
+  // Next sets it from the socket's remoteAddress and never appends to a client-sent value.
+  if (!hasFor && peer) {
+    const address = peer.requestIP(request)?.address
+    if (address) next.set(FORWARDED_FOR, address)
+  }
   return new Request(request, { headers: next })
 }

package/src/routing/handler.ts

@@ -1,7 +1,7 @@
 import { isNotFoundError, isRedirectError } from '../api/navigation'
 import { getWorkUnit, runWithRequest } from '../request/context'
 import { nextResponseMeta, toNextRequest } from '../api/server'
-import { reportRequestError } from '../extensions'
+import { getRenderExtensions, reportRequestError } from '../extensions'
 import type { NextRequest, RouteManifestEntry, RouteParamValue } from '../types'
 import { safeDecode } from '../utils/decode'
 
@@ -156,7 +156,11 @@ function callHandler(
   // Static routes (no dynamic segments) get no `params` in context — Next
   // omits it, so `context.params` is `undefined` rather than a promise of `{}`.
   const context: RouteHandlerContext =
-    Object.keys(params).length > 0 ? { params: Promise.resolve(params) } : {}
+    Object.keys(params).length > 0
+      ? {
+          params: getRenderExtensions().legacySyncProps(Promise.resolve(params), 'params', params),
+        }
+      : {}
   return runWithRequest(nextRequest, () => handler(nextRequest, context), params, {
     responseHeaders,
   })

package/src/routing/href.ts

@@ -9,6 +9,16 @@ export interface HrefParts {
   hash?: string
 }
 
+/**
+ * A request for pnext's own build output: `/assets/*`, and next-compat's `/_next/static/*` - the
+ * same output under the path Next serves it from (see assetPathname). Every bypass that must not
+ * treat build output as a page (proxy, trailing-slash canonicalization) asks HERE, so moving the
+ * emitted prefix can never leave a bypass knowing only the old one.
+ */
+export function isBuildAssetPathname(pathname: string) {
+  return pathname.startsWith('/assets/') || pathname.startsWith('/_next/static/')
+}
+
 export function routeHref(route: string, options: HrefParts = {}) {
   const path = applyTrailingSlash(fillParams(route, options.params ?? {}))
   const search = searchString(options.search)
@@ -209,7 +219,7 @@ export function trailingSlashRedirect(
   if (method !== 'GET' && method !== 'HEAD') return null
   const pathname = url.pathname
   if (pathname === '/' || pathname === '') return null
-  if (pathname.startsWith('/__pnext') || pathname.startsWith('/assets/')) return null
+  if (pathname.startsWith('/__pnext') || isBuildAssetPathname(pathname)) return null
   const target = canonicalTrailingSlashPath(pathname, Boolean(config.trailingSlash))
   if (target === pathname) return null
   return new Response(null, {

package/src/routing/metadata-files.ts

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto'
 import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 import type {
@@ -144,8 +145,12 @@ export async function withDynamicMetadataRoutes(
   pathname: string,
   loadModule: MetadataModuleLoader,
 ): Promise<StaticMetadataForPath> {
+  // Every render with no prebuilt metadata reaches here, so an app with no
+  // manifest/icon/sitemap modules pays one memoized lookup and no copy.
+  const discovered = discoverDynamicMetadataFiles(appPath)
+  if (discovered.length === 0) return metadata
   const routeDir = toPosixPath(path.relative(appPath, path.dirname(routeFile)))
-  const files = discoverDynamicMetadataFiles(appPath)
+  const files = discovered
     .map(file => matchDynamicMetadataFile(file, pathname, routeDir))
     .filter((file): file is MatchedDynamicMetadataFile => file !== undefined)
 
@@ -241,6 +246,7 @@ function staticMetadataFile(appPath: string, file: string): StaticMetadataFile |
     outputPath: toPosixPath(path.join(outputDir, outputName)),
     routeSegments,
     contentType: contentTypeForFile(name),
+    ...(kind === 'manifest' ? {} : { cacheIdentity: metadataFileIdentity(file) }),
     ...(info?.width ? { width: info.width } : {}),
     ...(info?.height ? { height: info.height } : {}),
     ...(info?.sizes ? { sizes: info.sizes } : {}),
@@ -296,8 +302,15 @@ function metadataImage(file: StaticMetadataFile): MetadataImage {
 }
 
 function staticMetadataUrl(file: StaticMetadataFile) {
-  const suffix = file.kind === 'favicon' ? 'favicon' : 'metadata'
-  return `/${file.outputPath}?${suffix}`
+  // File-convention images carry their content identity in the query so an
+  // image replacement cannot be served from an old browser cache. Manifests
+  // are the one non-image convention represented by this type.
+  if (file.kind === 'manifest') return `/${file.outputPath}`
+  return `/${file.outputPath}?${file.kind}.${file.cacheIdentity}.${path.extname(file.outputPath).slice(1)}`
+}
+
+function metadataFileIdentity(file: string) {
+  return createHash('sha256').update(readFileSync(file)).digest('base64url').slice(0, 16)
 }
 
 function nearestFile(files: StaticMetadataFile[], kind: StaticMetadataKind) {

package/src/routing/proxy.ts

@@ -21,7 +21,7 @@ import {
 } from '../api/server'
 import type { ExternalLoadTarget } from '../resolve/imports'
 import { getProxyExtensions, withRouteRuntime } from '../extensions'
-import { canonicalTrailingSlashPath } from './href'
+import { canonicalTrailingSlashPath, isBuildAssetPathname } from './href'
 
 export interface ProxyModule {
   default?: ProxyHandler
@@ -126,7 +126,7 @@ export async function runProxy(
   options: ProxyRunOptions = {},
 ): Promise<ProxyNextResult | Response | undefined> {
   const url = new URL(request.url)
-  if (url.pathname.startsWith('/__pnext/') || url.pathname.startsWith('/assets/')) {
+  if (url.pathname.startsWith('/__pnext/') || isBuildAssetPathname(url.pathname)) {
     return undefined
   }
 
@@ -165,7 +165,10 @@ export function createProxyRunner(
 
   const runner: ProxyRunner = async (request, options = {}) => {
     const url = new URL(request.url)
-    if (url.pathname.startsWith('/__pnext/') || url.pathname.startsWith('/assets/')) {
+    if (
+      url.pathname.startsWith('/__pnext/') ||
+      (!config.compat?.next && isBuildAssetPathname(url.pathname))
+    ) {
       return undefined
     }
     if (!file) return undefined