@wular/pnext 0.0.19 → 0.0.21

package/src/routing/routes.ts

@@ -1,5 +1,5 @@
 import path from 'node:path'
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync } from 'node:fs'
 import { listFiles, listFilesSync, readDirListing, toPosixPath, withDirCache } from '../utils/fs'
 import { safeDecode } from '../utils/decode'
 import {
@@ -7,14 +7,7 @@ import {
   pnextDynamicImportNames,
   rewriteLiteralDynamicCalls,
 } from '../resolve/dynamic'
-import {
-  commonJsModuleHasDefaultExport,
-  packageNameForFile,
-  packageNameOfSpecifier,
-  resolveImport,
-  resolveModuleAlias,
-  resolvePackageSpecifier,
-} from '../resolve/imports'
+import { resolveImport, resolveModuleAlias, resolvePackageSpecifier } from '../resolve/imports'
 import { dynamicCallFacts, scanFacts, type DynamicCallFact } from '../resolve/scan-facts'
 import { readSourceSync } from '../resolve/source-text'
 import { globalCssSourcesForPaths } from '../css/build'
@@ -251,6 +244,7 @@ export interface RouteFacts {
   clientReferences: ClientReference[]
   cssImports: string[]
   sourceFiles: string[]
+  serverActionFile?: string
   stream?: RouteManifestEntry['stream']
   maxDuration?: number
   ppr?: boolean
@@ -269,6 +263,7 @@ const deferredFields = [
   'clientReferences',
   'cssImports',
   'sourceFiles',
+  'serverActionFile',
   'stream',
   'maxDuration',
   'ppr',
@@ -678,6 +673,7 @@ function pageOrHandlerFacts(
     clientReferences,
     cssImports,
     sourceFiles,
+    ...(kind === 'page' ? serverActionFileFact(context, sourceFiles) : {}),
     ...(stream ? { stream } : {}),
     maxDuration: maxDurationFromSources([source, ...layoutSources]),
     ppr: interception ? false : ppr,
@@ -1744,6 +1740,84 @@ function hasUseClientDirective(file: string, source: string) {
   return scanFacts(file, source).useClient
 }
 
+/**
+ * The first `'use server'` module REACHABLE from this PAGE's graph - `sourceFiles`
+ * is the transitive import closure of the page, its layouts and everything they
+ * render, so a directive file that nothing imports is not one of these. That
+ * scoping is the contract: existence never refuses an app, reachability does.
+ *
+ * Pages only, by the caller. An action is dangerous when it can reach a CLIENT
+ * boundary, and a route handler's graph cannot - it returns a Response, never
+ * markup and never an island - so a directive reachable only from a handler is
+ * inert. Refusing it would break an app that works, for no user-visible reason.
+ *
+ * Computed regardless of compat (the parse is already memoized); only core
+ * CONSUMES it - see serverActionsUnsupportedMessage.
+ */
+function serverActionFileFact(context: ScanContext, sourceFiles: string[]) {
+  for (const file of sourceFiles) {
+    if (!fileExists(context, file) || isAssetFile(file)) continue
+    if (scanFacts(file, readSource(context, file)).useServer) return { serverActionFile: file }
+  }
+  return {}
+}
+
+/**
+ * Core has no action registry and no dispatch endpoint: `'use server'` is a
+ * next-compat feature. Refusing by name beats the alternative core used to have -
+ * building clean and rendering a form whose `action` was silently dropped.
+ *
+ * Read once, act once: the file, what pnext will not do, and both remedies. No
+ * stack - the CLI prints `error.message` alone (cli/index.ts).
+ */
+export function serverActionsUnsupportedMessage(offender: {
+  file: string
+  route?: string
+  root?: string
+}) {
+  const file = offender.root
+    ? toPosixPath(path.relative(offender.root, offender.file))
+    : offender.file
+  const reach = offender.route ? `, reachable from the route ${offender.route}` : ''
+  return [
+    `Server actions need next compat, and this app is pure core.`,
+    ``,
+    `  ${file} has a 'use server' directive${reach}.`,
+    ``,
+    `pnext will not build this app: core has no server-action registry and no`,
+    `dispatch endpoint, so the action could only render as a form that submits`,
+    `nowhere.`,
+    ``,
+    `Fix it one of two ways:`,
+    `  1. Enable compat in pnext.config.ts:`,
+    `       export default { compat: { next: true } }`,
+    `  2. Or delete the 'use server' directive from ${file}, if those exports are`,
+    `     only ever called on the server (in core the directive does nothing).`,
+  ].join('\n')
+}
+
+/**
+ * Fail the build / the dev request rather than render a form whose action goes
+ * nowhere. Only page routes carry the fact (see serverActionFileFact), so a
+ * handler-only directive never reaches here.
+ */
+export function assertNoServerActionsWithoutCompat(
+  routes: RouteManifestEntry[],
+  compatEnabled: boolean,
+  root?: string,
+) {
+  if (compatEnabled) return
+  const offender = routes.find(route => route.serverActionFile)
+  if (!offender) return
+  throw new Error(
+    serverActionsUnsupportedMessage({
+      file: offender.serverActionFile!,
+      route: offender.route,
+      root,
+    }),
+  )
+}
+
 function isClientModule(context: ScanContext, file: string) {
   const key = path.resolve(file)
   let client = context.useClient.get(key)
@@ -1832,15 +1906,21 @@ function collectFromFile(
   file: string,
   references: Map<string, ClientReference>,
   visited: Set<string>,
+  withinClientBoundary = false,
 ) {
-  if (visited.has(file) || !fileExists(context, file)) return
-  visited.add(file)
+  const visitKey = `${file}\0${withinClientBoundary ? 'client' : 'server'}`
+  if (visited.has(visitKey) || !fileExists(context, file)) return
+  visited.add(visitKey)
 
-  if (isClientModule(context, file)) {
+  const clientFile = isClientModule(context, file)
+  if (clientFile) {
     addClientReference(references, clientReference(file, 'default'))
   }
 
-  for (const imported of moduleEdges(context, file)) {
+  const nestedClientBoundary = withinClientBoundary || clientFile
+  const imports = [...moduleEdges(context, file)]
+  if (!nestedClientBoundary) imports.push(...publishedClientImports(context, file))
+  for (const imported of imports) {
     if (isClientModule(context, imported.file)) {
       // `export * from './client'` re-exports the target's named exports (never
       // its default), so each of them is a client reference of this module.
@@ -1884,7 +1964,7 @@ function collectFromFile(
       )
     }
 
-    collectFromFile(context, imported.file, references, visited)
+    collectFromFile(context, imported.file, references, visited, nestedClientBoundary)
   }
 }
 
@@ -2182,7 +2262,7 @@ function moduleEdges(context: ScanContext, file: string) {
   const key = path.resolve(file)
   let edges = context.edges.get(key)
   if (!edges) {
-    edges = moduleEdgesFromSource(context.root, file, readSource(context, file))
+    edges = moduleEdgesFromSource(context, file, readSource(context, file))
     context.edges.set(key, edges)
   }
   return edges
@@ -2199,19 +2279,93 @@ function resolveModuleEdge(root: string, file: string, specifier: string) {
     resolveModuleAlias(specifier) ??
     resolveImport(root, file, specifier) ??
     getBundlerExtensions().resolveRouteDependency(root, file, specifier) ??
-    resolveScopedClientBoundaryPackage(root, file, specifier) ??
     getCssExtensions().resolveCssDependency(root, file, specifier)
   )
 }
 
-const scopedClientBoundaryPackages = new Set(['@next/third-parties'])
+/** Rendered Client Component exports hidden behind a package's dist barrels. */
+function publishedClientImports(context: ScanContext, file: string) {
+  const source = readSource(context, file)
+  const found: ModuleEdge[] = []
+  for (const edge of scanFacts(file, source).imports) {
+    if (resolveModuleEdge(context.root, file, edge.specifier)) continue
+    found.push(...publishedClientEdges(context, file, edge.specifier, edge.exports))
+  }
+  return found
+}
 
-function resolveScopedClientBoundaryPackage(root: string, file: string, specifier: string) {
-  if (!scopedClientBoundaryPackages.has(packageNameOfSpecifier(specifier) ?? '')) return undefined
-  return resolvePackageSpecifier(root, file, specifier, ['import', 'default'])
+function publishedClientEdges(
+  context: ScanContext,
+  file: string,
+  specifier: string,
+  requested: string[],
+) {
+  const cacheKey = `${file}\0${specifier}\0${requested.join(',')}`
+  const cached = context.edges.get(cacheKey)
+  if (cached) return cached
+  const entry = resolvePublishedEdge(context, file, specifier, 'import')
+  const edges = entry ? publishedClientExports(context, entry, requested, new Set()) : []
+  context.edges.set(cacheKey, edges)
+  return edges
 }
 
-function moduleEdgesFromSource(root: string, file: string, source: string) {
+function resolvePublishedEdge(
+  context: ScanContext,
+  file: string,
+  specifier: string,
+  kind: 'import' | 'require',
+) {
+  return (
+    resolveModuleEdge(context.root, file, specifier) ??
+    resolvePackageSpecifier(context.root, file, specifier, [kind, 'default'])
+  )
+}
+
+function publishedClientExports(
+  context: ScanContext,
+  file: string,
+  requested: string[],
+  visiting: Set<string>,
+): ModuleEdge[] {
+  const key = path.resolve(file)
+  if (visiting.has(key) || !fileExists(context, key)) return []
+  visiting.add(key)
+  const source = readSource(context, key)
+  if (hasUseClientDirective(key, source)) {
+    visiting.delete(key)
+    const names = [...scanFacts(key, source).exportNames, ...commonJsRouteExportNames(source)]
+    const exports = requested.filter(name => names.includes(name))
+    return exports.length > 0 ? [{ file: key, exports }] : []
+  }
+
+  const facts = scanFacts(key, source)
+  const found: ModuleEdge[] = []
+  for (const edge of facts.imports) {
+    if (!edge.reexport) continue
+    const map = esmReexportMap(source, edge.specifier)
+    const next = edge.star
+      ? requested.filter(name => name !== 'default')
+      : requested.map(name => map[name]).filter((name): name is string => Boolean(name))
+    const target = resolvePublishedEdge(context, key, edge.specifier, 'import')
+    if (target && next.length > 0) {
+      found.push(...publishedClientExports(context, target, next, visiting))
+    }
+  }
+  for (const edge of facts.requires) {
+    const map = commonJsRequireReexportMap(source, edge.specifier)
+    const next = map.star
+      ? requested
+      : requested.map(name => map.names[name]).filter((name): name is string => Boolean(name))
+    const target = resolvePublishedEdge(context, key, edge.specifier, 'require')
+    if (target && next.length > 0) {
+      found.push(...publishedClientExports(context, target, next, visiting))
+    }
+  }
+  visiting.delete(key)
+  return found
+}
+
+function moduleEdgesFromSource(context: ScanContext, file: string, source: string) {
   const dynamicNames = pnextDynamicImportNames(source, file)
   assertSupportedDynamicCalls(file, source, dynamicNames)
   // Edges carry their byte offset so the final list follows true source order:
@@ -2222,7 +2376,7 @@ function moduleEdgesFromSource(root: string, file: string, source: string) {
   const facts = scanFacts(file, source)
 
   for (const edge of facts.imports) {
-    const resolved = resolveModuleEdge(root, file, edge.specifier)
+    const resolved = resolveModuleEdge(context.root, file, edge.specifier)
     if (!resolved) continue
     ordered.push({
       file: resolved,
@@ -2232,26 +2386,91 @@ function moduleEdgesFromSource(root: string, file: string, source: string) {
     })
   }
 
-  if (scopedClientBoundaryPackages.has(packageNameForFile(file) ?? '')) {
-    for (const call of facts.requires) {
-      const resolved = resolveModuleEdge(root, file, call.specifier)
-      if (!resolved) continue
-      const exports = commonJsModuleHasDefaultExport(readFileSync(resolved, 'utf8'), resolved)
-        ? ['default']
-        : []
-      ordered.push({ file: resolved, exports, index: call.index })
-    }
-  }
-
   ordered.sort((a, b) => a.index - b.index)
   const imports: ModuleEdge[] = ordered.map(({ index: _index, ...edge }) => edge)
 
-  for (const imported of dynamicImportEdgesFromSource(root, file, source, dynamicNames))
+  for (const imported of dynamicImportEdgesFromSource(context.root, file, source, dynamicNames))
     imports.push(imported)
 
   return imports
 }
 
+function esmReexportMap(source: string, specifier: string) {
+  const escaped = escapeRegex(specifier)
+  const names: Record<string, string> = {}
+  const pattern = new RegExp(`\\bexport\\s*\\{([^}]*)\\}\\s*from\\s*["']${escaped}["']`, 'g')
+  for (const clause of source.matchAll(pattern)) {
+    for (const item of (clause[1] ?? '').split(',')) {
+      const parts = item.trim().split(/\s+as\s+/)
+      const imported = parts[0]?.trim()
+      const exported = (parts[1] ?? parts[0])?.trim()
+      if (imported && exported && /^[$\w]+$/.test(imported) && /^[$\w]+$/.test(exported)) {
+        names[exported] = imported
+      }
+    }
+  }
+  return names
+}
+
+function commonJsRequireReexportMap(source: string, specifier: string) {
+  const escaped = escapeRegex(specifier)
+  const names: Record<string, string> = {}
+  const direct = new RegExp(
+    `exports\\.([A-Za-z_$][\\w$]*)\\s*=\\s*require\\(\\s*["']${escaped}["']\\s*\\)\\.([A-Za-z_$][\\w$]*)`,
+    'g',
+  )
+  for (const match of source.matchAll(direct)) {
+    names[match[1]!] = match[2]!
+  }
+
+  const binding = new RegExp(
+    `(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*require\\(\\s*["']${escaped}["']\\s*\\)`,
+  ).exec(source)?.[1]
+  if (binding) {
+    const local = escapeRegex(binding)
+    const assignment = new RegExp(
+      `exports\\.([A-Za-z_$][\\w$]*)\\s*=\\s*${local}\\.([A-Za-z_$][\\w$]*)`,
+      'g',
+    )
+    for (const match of source.matchAll(assignment)) {
+      names[match[1]!] = match[2]!
+    }
+    const getter = new RegExp(
+      `Object\\.defineProperty\\(\\s*exports\\s*,\\s*["']([A-Za-z_$][\\w$]*)["'](?:(?!Object\\.defineProperty)[\\s\\S]){0,300}?return\\s+${local}\\.([A-Za-z_$][\\w$]*)`,
+      'g',
+    )
+    for (const match of source.matchAll(getter)) {
+      names[match[1]!] = match[2]!
+    }
+    const helper = new RegExp(
+      `(?:^|[,\\{])\\s*([A-Za-z_$][\\w$]*)\\s*:\\s*\\(\\s*\\)\\s*=>\\s*${local}\\.([A-Za-z_$][\\w$]*)`,
+      'g',
+    )
+    for (const match of source.matchAll(helper)) {
+      names[match[1]!] = match[2]!
+    }
+  }
+
+  const star = new RegExp(
+    `module\\.exports\\s*=\\s*(?:require\\(\\s*["']${escaped}["']\\s*\\)|${binding ?? '(?!)'})(?=\\s*(?:;|$))`,
+    'm',
+  ).test(source)
+  return { names, star }
+}
+
+function commonJsRouteExportNames(source: string) {
+  return [
+    ...new Set([
+      ...[...source.matchAll(/\bexports\.([A-Za-z_$][\w$]*)\s*=/g)].map(match => match[1]!),
+      ...[
+        ...source.matchAll(
+          /\bObject\.defineProperty\(\s*exports\s*,\s*["']([A-Za-z_$][\w$]*)["']/g,
+        ),
+      ].map(match => match[1]!),
+    ]),
+  ].filter(name => name !== '__esModule')
+}
+
 function assertSupportedDynamicCalls(file: string, source: string, dynamicNames: Set<string>) {
   for (const call of dynamicCallsFromSource(source, dynamicNames)) {
     if (!/\bimport\s*\(/.test(call.source)) {

package/src/runtime/fetch-host.ts

@@ -0,0 +1,42 @@
+/**
+ * Bun's fetch sends a caller-supplied `host` header verbatim; undici (Node, and therefore Next)
+ * always derives Host from the request URL and drops any supplied one. An app that forwards its
+ * inbound request headers to an upstream - every proxy/BFF route handler - would otherwise send
+ * the local Host upstream, an RFC 9110 7.2 violation that real upstreams reject. Match undici.
+ */
+
+let installed = false
+
+function isHostKey(key: unknown): boolean {
+  return typeof key === 'string' && key.length === 4 && key.toLowerCase() === 'host'
+}
+
+/** Allocation-free probe: the overwhelmingly common case is no `host` at all. */
+function hasHost(headers: HeadersInit): boolean {
+  if (headers instanceof Headers) return headers.has('host')
+  if (Array.isArray(headers)) {
+    for (const entry of headers) if (isHostKey(entry?.[0])) return true
+    return false
+  }
+  for (const key in headers) if (isHostKey(key)) return true
+  return false
+}
+
+/** Only ever runs when a `host` was actually supplied, so the copy stays off the hot path. */
+function withoutHost(headers: HeadersInit): Headers {
+  const next = new Headers(headers)
+  next.delete('host')
+  return next
+}
+
+/** Idempotent; safe to call from every server and build entry point. */
+export function installFetchHostNormalization(): void {
+  if (installed) return
+  installed = true
+  const original = globalThis.fetch.bind(globalThis)
+  globalThis.fetch = function fetch(input: RequestInfo | URL, init?: RequestInit) {
+    const source = init?.headers ?? (input instanceof Request ? input.headers : undefined)
+    if (source === undefined || !hasHost(source)) return original(input, init)
+    return original(input, { ...init, headers: withoutHost(source) })
+  } as typeof globalThis.fetch
+}

package/src/runtime/fingerprint.ts

@@ -0,0 +1,132 @@
+// pnext's own sources shape every artifact it emits, so a framework edit must invalidate an app's
+// compiled caches exactly the way an app edit does. ONE fingerprint over pnext's whole shipped `src`
+// tree does that - never a hand-picked directory list, which is how a compat-shim edit came to leave
+// a stale vendor bundle serving a bug that had already been fixed.
+import { createHash } from 'node:crypto'
+import { mkdirSync, readFileSync, readdirSync, statSync, writeFileSync, type Dirent } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+/**
+ * Exactly what the package publishes and the vercel adapter ships: source extensions only, never
+ * declarations (both drop them) and never machine-local files like `.DS_Store`. The same tree must
+ * fingerprint identically in a workspace, in an npm install and inside a deployed function, or the
+ * function distrusts the cache its own build wrote and re-vendors onto a read-only filesystem.
+ */
+const SOURCE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.cjs', '.mjs'])
+const DECLARATION = /\.d\.[cm]?ts$/
+
+const frameworkSrc = fileURLToPath(new URL('..', import.meta.url))
+
+/** Every shipped source under `dir`, sorted, so the fold order is stable. */
+function sourceFiles(dir: string, found: string[] = []) {
+  let entries: Dirent[]
+  try {
+    entries = readdirSync(dir, { withFileTypes: true })
+  } catch {
+    return found
+  }
+  for (const entry of entries.sort((a, b) => (a.name < b.name ? -1 : 1))) {
+    const full = path.join(dir, entry.name)
+    if (entry.isDirectory()) sourceFiles(full, found)
+    else if (SOURCE_EXTENSIONS.has(path.extname(entry.name)) && !DECLARATION.test(entry.name))
+      found.push(full)
+  }
+  return found
+}
+
+function contentFingerprint(files: string[], dir: string) {
+  const hash = createHash('sha256')
+  for (const file of files) {
+    hash.update(path.relative(dir, file))
+    try {
+      hash.update(Bun.hash(readFileSync(file)).toString(36))
+    } catch {
+      // A file that vanished mid-walk simply contributes its name.
+    }
+    hash.update('\0')
+  }
+  return hash.digest('hex').slice(0, 16)
+}
+
+/** Content identity of a framework source tree. Pure — no memo, no record. */
+export function computeFrameworkFingerprint(dir = frameworkSrc) {
+  return contentFingerprint(sourceFiles(dir), dir)
+}
+
+// Reading 4.4 MB of source costs ~13 ms; one stat per file costs ~3 ms. So the same three-step
+// ladder the module index and the client key use: the record maps a stat signature to the content
+// fingerprint it produced, a matching signature reuses it, and anything else re-reads. A touch that
+// changed nothing (a reinstall, a checkout, a staged copy) re-reads once and records the same
+// fingerprint, so it never costs a rebuild - only fingerprinting mtimes directly would.
+const RECORD_VERSION = 1
+
+interface Record {
+  version: number
+  stats: string
+  fingerprint: string
+}
+
+function statSignature(files: string[], dir: string) {
+  const hash = createHash('sha256')
+  for (const file of files) {
+    const stats = statSync(file, { throwIfNoEntry: false })
+    hash.update(`${path.relative(dir, file)}:${stats?.size ?? -1}:${stats?.mtimeMs ?? -1}\0`)
+  }
+  return hash.digest('hex').slice(0, 16)
+}
+
+function recordFile(dir: string) {
+  return path.join(dir, 'framework.json')
+}
+
+function readRecord(dir: string) {
+  try {
+    const parsed = JSON.parse(readFileSync(recordFile(dir), 'utf8')) as Record
+    return parsed.version === RECORD_VERSION && parsed.stats && parsed.fingerprint
+      ? parsed
+      : undefined
+  } catch {
+    return undefined
+  }
+}
+
+function writeRecord(dir: string, record: Record) {
+  try {
+    mkdirSync(dir, { recursive: true })
+    writeFileSync(recordFile(dir), JSON.stringify(record))
+  } catch {
+    // Non-fatal: an unwritable record only costs the next boot a re-read.
+  }
+}
+
+let fingerprint: string | undefined
+const recorded = new Set<string>()
+
+/**
+ * This pnext's generation. Mixed into every compiled-artifact cache key, so an artifact built by one
+ * framework generation is never handed to another.
+ *
+ * `recordDir` (a cache root) buys the O(1) stat path across restarts; without it the tree is read.
+ * `PNEXT_FRAMEWORK_FINGERPRINT` pins the value outright — the bisect seam, and how a deployment can
+ * replay its build's generation without walking the tree at all.
+ */
+export function frameworkFingerprint(recordDir?: string) {
+  // eslint-disable-next-line turbo/no-undeclared-env-vars
+  const pinned = process.env.PNEXT_FRAMEWORK_FINGERPRINT
+  if (pinned) return pinned
+  // Memoized, but a second app in the same process still gets its own record - without one its next
+  // boot pays the full read for a fingerprint this process already knows.
+  if (fingerprint !== undefined && (!recordDir || recorded.has(recordDir))) return fingerprint
+  const files = sourceFiles(frameworkSrc)
+  const stats = statSignature(files, frameworkSrc)
+  const previous = recordDir ? readRecord(recordDir) : undefined
+  fingerprint =
+    previous?.stats === stats ? previous.fingerprint : contentFingerprint(files, frameworkSrc)
+  if (recordDir) {
+    recorded.add(recordDir)
+    if (previous?.stats !== stats)
+      writeRecord(recordDir, { version: RECORD_VERSION, stats, fingerprint })
+  }
+  return fingerprint
+}

package/src/runtime/loader.ts

@@ -40,6 +40,7 @@ import {
   sourceHasDynamicImport,
 } from '../resolve/dynamic'
 import { cacheRoot } from './module-cache'
+import { frameworkFingerprint } from './fingerprint'
 import { readNodeModuleBundle, writeNodeModuleBundle } from '../dev/restart/node-modules'
 import { setBasePathPrefix, setDefaultPrefetchMode, setTrailingSlashUrls } from '../routing/href'
 import { resolveExternalLoadTarget, resolveImport, workspacePackageRoots } from '../resolve/imports'
@@ -481,15 +482,16 @@ const materializedSegment = `${path.sep}cache${path.sep}server${path.sep}`
  * Where a transform of `file` is remembered across restarts. Only for the
  * materialized `cache/server` modules: they are hash-named build output under
  * our own cache root, so the key (path + mtime + size + the define/extension
- * inputs of the transform) is complete, and the whole tree is discarded when
- * a build or a config change rewrites it.
+ * inputs of the transform, and pnext's generation, which shapes the rewrite) is
+ * complete, and the whole tree is discarded when a build or a config change
+ * rewrites it.
  */
-function transformCacheFile(file: string, fileStat: { mtimeMs: number; size: number }) {
+export function transformCacheFile(file: string, fileStat: { mtimeMs: number; size: number }) {
   if (transformDiskCacheDisabled) return undefined
   const at = file.lastIndexOf(materializedSegment)
   if (at === -1) return undefined
   const cacheRoot = file.slice(0, at + materializedSegment.length)
-  const key = `${file}\0${fileStat.mtimeMs}\0${fileStat.size}\0${currentLoadExtras().join(',')}\0${JSON.stringify(serverDefineOptions())}`
+  const key = `${file}\0${fileStat.mtimeMs}\0${fileStat.size}\0${currentLoadExtras().join(',')}\0${JSON.stringify(serverDefineOptions())}\0${frameworkFingerprint()}`
   return path.join(cacheRoot, 'transform', `${hashBundleSpecifier(key)}.js`)
 }
 
@@ -628,7 +630,7 @@ function nodeModuleBundleRecordFile(file: string, fileStat: { mtimeMs: number; s
   if (transformDiskCacheDisabled) return undefined
   const outPath = (runtimeConfigForFile(file) ?? firstRuntimeConfig())?.resolved.outPath
   if (!outPath) return undefined
-  const key = `${file}\0${fileStat.mtimeMs}\0${fileStat.size}\0${currentLoadExtras().join(',')}\0${JSON.stringify(serverDefineOptions())}`
+  const key = `${file}\0${fileStat.mtimeMs}\0${fileStat.size}\0${currentLoadExtras().join(',')}\0${JSON.stringify(serverDefineOptions())}\0${frameworkFingerprint()}`
   return path.join(cacheRoot(outPath), 'node-module-bundle', `${hashBundleSpecifier(key)}.json`)
 }
 

package/src/runtime/module-cache.ts

@@ -7,8 +7,9 @@
 //
 // The graph the hash walks is read from a persisted index keyed by (mtime, size, content hash), so a
 // restart re-derives it with one stat per source instead of re-scanning and re-resolving every import.
-import { mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs'
+import { mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs'
 import { cachedExistsSync } from '../utils/fs-cache'
+import { frameworkFingerprint } from './fingerprint'
 import { mkdir, readFile, stat } from 'node:fs/promises'
 import { createHash, randomUUID } from 'node:crypto'
 import path from 'node:path'
@@ -220,7 +221,7 @@ function createDevModuleCache(
   const generated = (file: string) =>
     file.startsWith(outRoot) || file.includes(`${path.sep}pnext-pages-compat${path.sep}`)
   const key = createHash('sha256')
-    .update(`${options.compileKey}\0${frameworkFingerprint()}`)
+    .update(`${options.compileKey}\0${frameworkFingerprint(root)}`)
     .digest('hex')
     .slice(0, 16)
   establishCacheTrust(root)
@@ -747,37 +748,3 @@ function serializeIndex(key: string, records: Map<string, SourceRecord>, workspa
   }
   return JSON.stringify({ version: INDEX_VERSION, key, files } satisfies IndexFile)
 }
-
-// pnext's own compiler sources shape every artifact, so editing the framework must invalidate the cache the
-// same way editing app code does - but ONLY an edit. Fingerprinting mtimes threw the whole cache away
-// whenever a file was merely touched (a reinstall, a checkout, a staged copy, a no-op save), so this reads
-// the files that actually emit compiled output. A few dozen small files, once per process, off the boot
-// path - the first compile pays it.
-let fingerprint: string | undefined
-
-function frameworkFingerprint() {
-  if (fingerprint !== undefined) return fingerprint
-  const hash = createHash('sha256')
-  for (const dir of ['.', '..', '../runtime', '../compat/bundler', '../resolve']) {
-    const root = new URL(`${dir}/`, import.meta.url).pathname
-    let entries: string[]
-    try {
-      entries = readdirSync(root).sort()
-    } catch {
-      continue
-    }
-    for (const entry of entries) {
-      // Declarations emit nothing, and a deployed build ships without them
-      // (the vercel adapter drops `.d.ts`) — hashing one would key the cache to
-      // a file that is provably absent where the artifacts are replayed.
-      if (!entry.endsWith('.ts') || /\.d\.[cm]?ts$/.test(entry)) continue
-      try {
-        hash.update(`${entry}:${Bun.hash(readFileSync(path.join(root, entry))).toString(36)}\0`)
-      } catch {
-        // ignore unreadable entries
-      }
-    }
-  }
-  fingerprint = hash.digest('hex').slice(0, 16)
-  return fingerprint
-}