veryfront 0.1.1127 → 0.1.1128

package/esm/src/server/handlers/dev/files/esbuild-plugins.js

@@ -236,6 +236,13 @@ function isBareImport(path) {
         !path.startsWith("http://") &&
         !path.startsWith("https://"));
 }
+/**
+ * A Node built-in module specifier (`node:crypto`, `node:fs`, …). These are
+ * server-only and must never be rewritten to an esm.sh URL for a browser bundle.
+ */
+function isNodeBuiltinSpecifier(path) {
+    return path === "node" || path.startsWith("node:");
+}
 function toEsmUrl(path) {
     return ESM_PACKAGE_MAP[path] ?? `https://esm.sh/${path}`;
 }
@@ -292,6 +299,21 @@ export function createBareExternalPlugin(options = false) {
                     return undefined;
                 if (args.kind !== "import-statement" && args.kind !== "dynamic-import")
                     return undefined;
+                // Fail closed on Node built-ins. This plugin only runs for browser
+                // bundles (platform: "browser"), where a server-only `node:*` import can
+                // never work: rewriting it to an esm.sh URL silently ships a module that
+                // 404s on esm.sh and throws (e.g. `createHash is not a function`) at
+                // hydration. Surface a clear build error instead of a broken rewrite.
+                if (isNodeBuiltinSpecifier(args.path)) {
+                    return {
+                        errors: [{
+                                text: `Cannot bundle server-only import "${args.path}" for the browser. ` +
+                                    `Node built-in modules are not available on the client. Move it into a ` +
+                                    `server component, an API route, or middleware — or gate the code behind a ` +
+                                    `"use client" boundary that does not import it.`,
+                            }],
+                    };
+                }
                 // Keep import-map-resolved specifiers as bare externals — the browser's
                 // <script type="importmap"> resolves them to the correct CDN URL.
                 if (importMapOwnsSpecifier(args.path, importMapImports)) {

package/esm/src/server/handlers/request/module/page-data-endpoint-handler.js

@@ -239,16 +239,39 @@ function refreshStalePageData(cacheKey, resolve, cachePolicy) {
         }
     });
 }
+/**
+ * Only http(s) and root-relative destinations may be encoded for the client to
+ * follow. The client follows the destination with `window.location.href`, which
+ * would EXECUTE a `javascript:`/`data:` URL — unlike the full-page 302 path where
+ * the browser ignores such a Location. Protocol-relative `//host` is rejected too
+ * (it is easy to smuggle past a naive "starts with /" check). Blocked
+ * destinations fall through to normal error handling instead of being followed.
+ */
+function isFollowableRedirect(destination) {
+    if (destination.startsWith("/")) {
+        const baseOrigin = "https://veryfront.local";
+        try {
+            return new URL(destination, baseOrigin).origin === baseOrigin;
+        }
+        catch {
+            return false;
+        }
+    }
+    return /^https?:\/\//i.test(destination);
+}
 /**
  * A redirect() from getServerData is thrown up the pipeline as a VeryfrontError
  * whose `context.redirect` holds the destination (mirrors extractRedirectLocation
- * in the SSR service). Returns null for any other error.
+ * in the SSR service). Returns null for any other error, or for a redirect whose
+ * destination is not safe to hand to the client to follow.
  */
 function extractRedirectFromError(error) {
     const context = error?.context;
     const redirect = context?.redirect;
     if (!redirect || typeof redirect.destination !== "string")
         return null;
+    if (!isFollowableRedirect(redirect.destination))
+        return null;
     return { destination: redirect.destination, permanent: redirect.permanent === true };
 }
 function buildPageDataCacheKey(ctx, slug, url) {

package/esm/src/server/handlers/response/not-found.d.ts

@@ -3,6 +3,5 @@ import type { HandlerContext, HandlerMetadata, HandlerResult } from "../types.js
 export declare class NotFoundHandler extends BaseHandler {
     metadata: HandlerMetadata;
     handle(req: Request, ctx: HandlerContext): Promise<HandlerResult>;
-    private generate404Html;
 }
 //# sourceMappingURL=not-found.d.ts.map

package/esm/src/server/handlers/response/not-found.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"not-found.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/response/not-found.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AASnG,qBAAa,eAAgB,SAAQ,WAAW;IAC9C,QAAQ,EAAE,eAAe,CAIvB;IAEF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA8BjE,OAAO,CAAC,eAAe;CA4GxB"}
+{"version":3,"file":"not-found.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/response/not-found.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAUnG,qBAAa,eAAgB,SAAQ,WAAW;IAC9C,QAAQ,EAAE,eAAe,CAIvB;IAEF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CAmClE"}

package/esm/src/server/handlers/response/not-found.js

@@ -1,7 +1,8 @@
 import { BaseHandler } from "./base.js";
 import { ResponseBuilder } from "../../../security/index.js";
 import { HTTP_INTERNAL_SERVER_ERROR, HTTP_NOT_FOUND, PRIORITY_FALLBACK, } from "../../../utils/constants/index.js";
-import { buildNonceAttribute, escapeHtml } from "../../../html/html-escape.js";
+import { ErrorPages } from "../../utils/error-html.js";
+import { addNonceToHtmlTags } from "../../../html/nonce-injection.js";
 export class NotFoundHandler extends BaseHandler {
     metadata = {
         name: "NotFoundHandler",
@@ -12,7 +13,13 @@ export class NotFoundHandler extends BaseHandler {
         const pathname = new URL(req.url).pathname;
         try {
             const builder = this.createResponseBuilder(ctx);
-            const html = this.generate404Html(pathname, builder.nonce);
+            // Render the SAME 404 page as the SSR miss path (ssr.handler /
+            // ssr.service) so every not-found — including a fallthrough like
+            // /_veryfront/<missing> that never reaches SSR — looks identical.
+            // Nonce the inline <style>/<script> exactly like the SSR response builder
+            // (ssr-response-builder addNonceToHtmlTags) so the page still renders
+            // styled under a strict nonce-based CSP.
+            const html = addNonceToHtmlTags(ErrorPages.notFound(pathname), builder.nonce);
             const response = builder
                 .withCORS(req, ctx.securityConfig?.cors)
                 .withSecurity(ctx.securityConfig ?? undefined, req)
@@ -29,112 +36,4 @@ export class NotFoundHandler extends BaseHandler {
             return Promise.resolve(this.respond(response));
         }
     }
-    generate404Html(pathname, nonce) {
-        const nonceAttr = buildNonceAttribute(nonce);
-        return `<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="utf-8"/>
-    <meta name="viewport" content="width=device-width, initial-scale=1"/>
-    <title>404 Not Found</title>
-    <style${nonceAttr}>
-        body {
-            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
-            margin: 0;
-            padding: 40px;
-            background: #f5f5f5;
-            color: #333;
-            display: flex;
-            flex-direction: column;
-            align-items: center;
-            justify-content: center;
-            min-height: 100vh;
-            box-sizing: border-box;
-        }
-        .container {
-            background: white;
-            border-radius: 8px;
-            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
-            padding: 40px;
-            max-width: 600px;
-            text-align: center;
-        }
-        h1 {
-            font-size: 48px;
-            margin: 0 0 16px 0;
-            color: #000;
-        }
-        h2 {
-            font-size: 24px;
-            font-weight: normal;
-            margin: 0 0 24px 0;
-            color: #666;
-        }
-        p {
-            line-height: 1.6;
-            margin: 0 0 32px 0;
-            color: #666;
-        }
-        code {
-            background: #f5f5f5;
-            padding: 2px 6px;
-            border-radius: 3px;
-            font-family: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
-            font-size: 14px;
-        }
-        a {
-            color: #0066cc;
-            text-decoration: none;
-            font-weight: 500;
-            transition: color 0.2s;
-        }
-        a:hover {
-            color: #0052a3;
-            text-decoration: underline;
-        }
-        .actions {
-            display: flex;
-            gap: 16px;
-            justify-content: center;
-            flex-wrap: wrap;
-        }
-        .button {
-            display: inline-block;
-            padding: 12px 24px;
-            background: #0066cc;
-            color: white;
-            border-radius: 6px;
-            font-weight: 500;
-            transition: background 0.2s;
-        }
-        .button:hover {
-            background: #0052a3;
-            text-decoration: none;
-        }
-        .secondary {
-            background: transparent;
-            color: #0066cc;
-            border: 2px solid #0066cc;
-        }
-        .secondary:hover {
-            background: #0066cc;
-            color: white;
-        }
-    </style>
-</head>
-<body>
-    <div class="container">
-        <h1>404</h1>
-        <h2>Page Not Found</h2>
-        <p>
-            The path <code>${escapeHtml(pathname)}</code> was not found on this server.
-        </p>
-        <div class="actions">
-            <a href="/" class="button">Go Home</a>
-            <a href=".." class="button secondary">Go Back</a>
-        </div>
-    </div>
-</body>
-</html>`;
-    }
 }

package/esm/src/server/services/rsc/orchestrators/handler.d.ts

@@ -16,6 +16,7 @@ export declare class RSCDevServerHandler {
     private renderer;
     private clientManifest;
     private rendererPromise;
+    private reactVersionPromise;
     private invalidationGeneration;
     private readonly manifestHandler;
     private readonly renderHandler;
@@ -25,8 +26,8 @@ export declare class RSCDevServerHandler {
     private readonly appDir;
     private readonly isLocalProject;
     private readonly mode;
-    private readonly reactVersionPromise;
     private readonly fs?;
+    private readonly config?;
     handleManifest(): Promise<Response>;
     handleRender(pathname: string, searchParams: URLSearchParams, request?: Request): Promise<Response>;
     handleStream(pathname: string, searchParams: URLSearchParams): Promise<Response>;
@@ -34,5 +35,6 @@ export declare class RSCDevServerHandler {
     invalidate(): void;
     private ensureRenderer;
     private initializeRenderer;
+    private getReactVersion;
 }
 //# sourceMappingURL=handler.d.ts.map

package/esm/src/server/services/rsc/orchestrators/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/services/rsc/orchestrators/handler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAE5E,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,aAAa,GAAG,YAAY,CAAC;IACpC,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,4BAA4B,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAKzF;AAED,qBAAa,mBAAmB;IAY5B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAX7B,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,cAAc,CAAiD;IACvE,OAAO,CAAC,eAAe,CAA8B;IACrD,OAAO,CAAC,sBAAsB,CAAK;IAEnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,WAAW,CAA4B;gBAG5B,UAAU,EAAE,MAAM,EACnC,OAAO,GAAE,uBAA4B;IAqCvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IACpD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAkB;IACtD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAuB;IAE3C,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC;IAI7B,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,eAAe,EAC7B,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,QAAQ,CAAC;IAKd,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC;IAKhF,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,eAAe,EAC7B,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,CAAC;IAWpB,UAAU,IAAI,IAAI;YAOJ,cAAc;YAed,kBAAkB;CAejC"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/services/rsc/orchestrators/handler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAE5E,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,aAAa,GAAG,YAAY,CAAC;IACpC,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,4BAA4B,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAKzF;AAED,qBAAa,mBAAmB;IAa5B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAZ7B,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,cAAc,CAAiD;IACvE,OAAO,CAAC,eAAe,CAA8B;IACrD,OAAO,CAAC,mBAAmB,CAAgC;IAC3D,OAAO,CAAC,sBAAsB,CAAK;IAEnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,WAAW,CAA4B;gBAG5B,UAAU,EAAE,MAAM,EACnC,OAAO,GAAE,uBAA4B;IAkCvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IACpD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAkB;IAE1C,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC;IAI7B,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,eAAe,EAC7B,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,QAAQ,CAAC;IAKd,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC;IAKhF,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,eAAe,EAC7B,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,CAAC;IAWpB,UAAU,IAAI,IAAI;YAOJ,cAAc;YAed,kBAAkB;IAgBhC,OAAO,CAAC,eAAe;CAOxB"}

package/esm/src/server/services/rsc/orchestrators/handler.js

@@ -16,6 +16,7 @@ export class RSCDevServerHandler {
     renderer = null;
     clientManifest = null;
     rendererPromise = null;
+    reactVersionPromise = null;
     invalidationGeneration = 0;
     manifestHandler;
     renderHandler;
@@ -34,28 +35,25 @@ export class RSCDevServerHandler {
             fs: options.adapter?.fs,
             contentSourceId,
         });
-        this.reactVersionPromise = resolveProjectReactVersion({
-            projectDir,
-            config: options.config,
-        });
         this.renderHandler = new RenderHandler(projectDir, () => this.renderer, mode, appDir, {
             adapter: options.adapter,
             projectId: options.projectId,
             projectSlug: options.projectSlug,
             contentSourceId,
-            reactVersion: this.reactVersionPromise,
+            reactVersion: () => this.getReactVersion(),
         });
         this.streamHandler = new StreamHandler(this.renderHandler);
         this.appDir = appDir;
         this.isLocalProject = isLocalProject;
         this.mode = mode;
         this.fs = options.adapter?.fs;
+        this.config = options.config;
     }
     appDir;
     isLocalProject;
     mode;
-    reactVersionPromise;
     fs;
+    config;
     handleManifest() {
         return this.manifestHandler.handle(this.clientManifest);
     }
@@ -69,7 +67,7 @@ export class RSCDevServerHandler {
     }
     async handlePage(pathname, searchParams, nonce) {
         if (!this.pageHandler) {
-            this.pageHandler = new PageHandler(this.mode === "development", await this.reactVersionPromise, this.isLocalProject ? "fs" : "rsc-module");
+            this.pageHandler = new PageHandler(this.mode === "development", await this.getReactVersion(), this.isLocalProject ? "fs" : "rsc-module");
         }
         return this.pageHandler.handle(pathname, searchParams, nonce);
     }
@@ -96,7 +94,7 @@ export class RSCDevServerHandler {
     }
     async initializeRenderer(generation) {
         const clientManifest = await buildClientManifest(this.projectDir, this.appDir, this.fs);
-        const reactVersion = await this.reactVersionPromise;
+        const reactVersion = await this.getReactVersion();
         if (generation !== this.invalidationGeneration)
             return;
         this.clientManifest = clientManifest;
@@ -109,4 +107,11 @@ export class RSCDevServerHandler {
             reactVersion,
         });
     }
+    getReactVersion() {
+        this.reactVersionPromise ??= resolveProjectReactVersion({
+            projectDir: this.projectDir,
+            config: this.config,
+        });
+        return this.reactVersionPromise;
+    }
 }

package/esm/src/server/services/rsc/orchestrators/render-handler.d.ts

@@ -5,7 +5,7 @@ interface RenderHandlerModuleOptions {
     projectId?: string;
     projectSlug?: string;
     contentSourceId?: string;
-    reactVersion?: Promise<string>;
+    reactVersion?: () => Promise<string>;
 }
 export declare class RenderHandler {
     private projectDir;

package/esm/src/server/services/rsc/orchestrators/render-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/services/rsc/orchestrators/render-handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AActF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAM5E,UAAU,0BAA0B;IAClC,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;CAChC;AASD,qBAAa,aAAa;IAEtB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,aAAa;gBAJb,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,WAAW,GAAG,IAAI,EACrC,IAAI,GAAE,aAAa,GAAG,YAA2B,EACjD,MAAM,GAAE,MAAc,EACtB,aAAa,GAAE,0BAA+B;IAGlD,MAAM,CACV,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,eAAe,EAC7B,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,QAAQ,CAAC;YAWN,aAAa;YA+Bb,mBAAmB;IA2CjC,OAAO,CAAC,UAAU;YAOJ,aAAa;IA2B3B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,YAAY;IAmBpB,OAAO,CAAC,mBAAmB;CA6B5B"}
+{"version":3,"file":"render-handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/services/rsc/orchestrators/render-handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AActF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAM5E,UAAU,0BAA0B;IAClC,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACtC;AASD,qBAAa,aAAa;IAEtB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,WAAW;IACnB,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,aAAa;gBAJb,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,WAAW,GAAG,IAAI,EACrC,IAAI,GAAE,aAAa,GAAG,YAA2B,EACjD,MAAM,GAAE,MAAc,EACtB,aAAa,GAAE,0BAA+B;IAGlD,MAAM,CACV,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,eAAe,EAC7B,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,QAAQ,CAAC;YAWN,aAAa;YA+Bb,mBAAmB;IA2CjC,OAAO,CAAC,UAAU;YAOJ,aAAa;IA2B3B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,YAAY;IAmBpB,OAAO,CAAC,mBAAmB;CA6B5B"}

package/esm/src/server/services/rsc/orchestrators/render-handler.js

@@ -61,7 +61,7 @@ export class RenderHandler {
                 : await fs.readTextFile(componentPath);
             const { body, frontmatter } = extractFrontmatter(source);
             const compiled = await compileContent(this.mode, this.projectDir, body, frontmatter, componentPath, "server");
-            return await mdxRenderer.loadModuleESM(compiled.compiledCode, adapter, this.moduleOptions.projectId ?? this.projectDir, this.projectDir, this.moduleOptions.projectSlug, this.moduleOptions.contentSourceId, await this.moduleOptions.reactVersion);
+            return await mdxRenderer.loadModuleESM(compiled.compiledCode, adapter, this.moduleOptions.projectId ?? this.projectDir, this.projectDir, this.moduleOptions.projectSlug, this.moduleOptions.contentSourceId, await this.moduleOptions.reactVersion?.());
         }
         if (!adapter) {
             return (await import(componentPath));
@@ -73,7 +73,7 @@ export class RenderHandler {
             contentSourceId: this.moduleOptions.contentSourceId,
             dev: this.mode === "development",
             mode: this.mode === "development" ? "preview" : "production",
-            reactVersion: await this.moduleOptions.reactVersion,
+            reactVersion: await this.moduleOptions.reactVersion?.(),
         });
     }
     buildProps(pathname, searchParams) {

package/esm/src/transforms/esm/http-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-cache.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/http-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzE,OAAO,EAGL,KAAK,YAAY,EAKjB,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EAElB,gBAAgB,EAEhB,KAAK,OAAO,EACb,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAA2B,MAAM,4BAA4B,CAAC;AACxF,OAAO,EACL,0BAA0B,EAO3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,sBAAsB,EAKvB,MAAM,uBAAuB,CAAC;AAe/B,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,GACnB,CAAC;AAGF,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAwTlC,wEAAwE;AACxE,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,sBAAsB,CAAC,CAkCjC;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,wBAAwB,GAClC,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAClD,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,wBAAwB,GAClC,OAAO,CAAC,MAAM,EAAE,CAAC,CAEnB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAErF;AAGD,eAAO,MAAM,wBAAwB,0BAAoB,CAAC"}
+{"version":3,"file":"http-cache.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/http-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgBH,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzE,OAAO,EAGL,KAAK,YAAY,EAKjB,wBAAwB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EAElB,gBAAgB,EAEhB,KAAK,OAAO,EACb,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAA2B,MAAM,4BAA4B,CAAC;AACxF,OAAO,EACL,0BAA0B,EAO3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,sBAAsB,EAKvB,MAAM,uBAAuB,CAAC;AAqJ/B,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,GACnB,CAAC;AAGF,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAmRlC,wEAAwE;AACxE,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,sBAAsB,CAAC,CAkCjC;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,wBAAwB,GAClC,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAClD,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,wBAAwB,GAClC,OAAO,CAAC,MAAM,EAAE,CAAC,CAEnB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAErF;AAGD,eAAO,MAAM,wBAAwB,0BAAoB,CAAC"}

package/esm/src/transforms/esm/http-cache.js

@@ -9,9 +9,10 @@
 import { createFileSystem, exists } from "../../platform/compat/fs.js";
 import { join } from "../../platform/compat/path/index.js";
 import { rendererLogger as logger } from "../../utils/index.js";
-import { BUILD_FAILED, BUNDLE_ERROR, FILE_NOT_FOUND } from "../../errors/index.js";
+import { BUILD_FAILED, BUNDLE_ERROR, FILE_NOT_FOUND, retryWithBackoff } from "../../errors/index.js";
 import { SpanNames } from "../../observability/index.js";
 import { withSpan } from "../../observability/tracing/otlp-setup.js";
+import { sanitizeUrlForSpan } from "../../utils/logger/redact.js";
 import { replaceSpecifiers } from "./lexer.js";
 import { createBundleManifest, storeBundleManifest } from "./bundle-manifest.js";
 import { HTTP_MODULE_DISTRIBUTED_TTL_SEC } from "../../utils/constants/cache.js";
@@ -32,8 +33,119 @@ import { buildReplacements, rewriteModuleImports } from "./specifier-resolver.js
 import { ensureHttpBundlesExist as ensureHttpBundlesExistImpl, invalidateHttpBundle as invalidateHttpBundleImpl, recoverHttpBundleByHash as recoverHttpBundleByHashImpl, } from "./bundle-recovery.js";
 /** Threshold in ms above which an HTTP module fetch is considered slow */
 const SLOW_HTTP_FETCH_THRESHOLD_MS = 500;
+const HTTP_MODULE_FETCH_MAX_ATTEMPTS = 3;
+const HTTP_MODULE_FETCH_RETRY_DELAY_MS = 100;
+const HTTP_MODULE_FETCH_WAIT_GRACE_MS = 5_000;
+const HTTP_MODULE_FETCH_MAX_WAIT_MS = HTTP_FETCH_TIMEOUT_MS * HTTP_MODULE_FETCH_MAX_ATTEMPTS +
+    HTTP_MODULE_FETCH_RETRY_DELAY_MS *
+        ((HTTP_MODULE_FETCH_MAX_ATTEMPTS - 1) * HTTP_MODULE_FETCH_MAX_ATTEMPTS / 2) +
+    HTTP_MODULE_FETCH_WAIT_GRACE_MS;
 const httpCacheLog = logger.component("http-cache");
 const contentMetricsLog = logger.component("content-metrics");
+class HttpModuleResponseError extends Error {
+    status;
+    constructor(status) {
+        super(`HTTP module response returned status ${status}`);
+        this.status = status;
+        this.name = "HttpModuleResponseError";
+    }
+}
+class HttpModuleRequestError extends Error {
+    requestErrorType;
+    constructor(requestErrorType) {
+        super(`HTTP module request failed (${requestErrorType})`);
+        this.requestErrorType = requestErrorType;
+        this.name = "HttpModuleRequestError";
+    }
+}
+function shouldRetryHttpModuleFetch(status) {
+    return status === 408 || status === 425 || status === 429 || status >= 500;
+}
+async function discardResponseBody(response) {
+    try {
+        await response.body?.cancel();
+    }
+    catch (_) {
+        // The response is already being discarded.
+    }
+}
+async function fetchHttpModuleAttempt(url, safeUrl, urlObj, signal, attempt) {
+    let response;
+    try {
+        const startedAt = performance.now();
+        response = await fetch(url, {
+            headers: { "user-agent": "Mozilla/5.0 Veryfront/1.0" },
+            signal,
+            redirect: "follow",
+        });
+        const duration = Math.round(performance.now() - startedAt);
+        contentMetricsLog.debug("HTTP_MODULE_FETCH", {
+            url: safeUrl,
+            host: urlObj.host,
+            duration_ms: duration,
+            status: response.status,
+            slow: duration > SLOW_HTTP_FETCH_THRESHOLD_MS,
+            attempt: attempt + 1,
+        });
+        if (!response.ok) {
+            const status = response.status;
+            await discardResponseBody(response);
+            throw new HttpModuleResponseError(status);
+        }
+        return {
+            code: await response.text(),
+            contentType: response.headers.get("content-type") ?? "",
+        };
+    }
+    catch (error) {
+        if (error instanceof HttpModuleResponseError)
+            throw error;
+        if (response)
+            await discardResponseBody(response);
+        const requestErrorType = error instanceof Error ? error.name : typeof error;
+        throw new HttpModuleRequestError(requestErrorType);
+    }
+}
+async function fetchHttpModule(url) {
+    const urlObj = new URL(url);
+    const safeUrl = sanitizeUrlForSpan(url);
+    try {
+        return await retryWithBackoff((signal, attempt) => withSpan(SpanNames.HTTP_CLIENT_FETCH, () => fetchHttpModuleAttempt(url, safeUrl, urlObj, signal, attempt), {
+            "http.method": "GET",
+            "http.url": safeUrl,
+            "http.host": urlObj.host,
+            "http.scheme": urlObj.protocol.replace(":", ""),
+            "esm.package_fetch": true,
+        }), {
+            maxAttempts: HTTP_MODULE_FETCH_MAX_ATTEMPTS,
+            timeoutMs: HTTP_FETCH_TIMEOUT_MS,
+            shouldRetry: (error) => !(error instanceof HttpModuleResponseError) ||
+                shouldRetryHttpModuleFetch(error.status),
+            computeDelay: (attempt) => HTTP_MODULE_FETCH_RETRY_DELAY_MS * (attempt + 1),
+            onRetry: ({ error, attempt }) => {
+                httpCacheLog.warn("HTTP module fetch failed, retrying", {
+                    url: safeUrl,
+                    status: error instanceof HttpModuleResponseError ? error.status : undefined,
+                    errorType: error instanceof HttpModuleRequestError
+                        ? error.requestErrorType
+                        : error.name,
+                    attempt: attempt + 1,
+                });
+            },
+        });
+    }
+    catch (error) {
+        if (error instanceof HttpModuleResponseError) {
+            throw BUILD_FAILED.create({ detail: `Failed to fetch ${safeUrl}: ${error.status}` });
+        }
+        if (error instanceof HttpModuleRequestError) {
+            throw BUILD_FAILED.create({
+                detail: `Failed to fetch ${safeUrl}: ${error.requestErrorType}`,
+            });
+        }
+        throw error;
+    }
+}
 // Re-export for backwards compatibility
 export { CACHE_DIR_TOKEN, detokenizeAllCachePaths, detokenizeCachePaths, tokenizeAllCachePaths, tokenizeCachePaths, };
 export { extractBundleDeps, hasIncompatibleFilePaths, normalizeHttpUrl };
@@ -42,6 +154,7 @@ export { embedSourceUrl, extractSourceUrl };
 export { __injectCachesForTests };
 async function cacheHttpModuleInternal(url, options) {
     const normalizedUrl = normalizeHttpUrl(url);
+    const safeUrl = sanitizeUrlForSpan(normalizedUrl);
     const cacheDir = ensureAbsoluteDir(options.cacheDir);
     const cacheIdentity = await buildHttpCacheIdentity(normalizedUrl, options);
     const identityMetadata = await buildHttpCacheIdentityMetadata(normalizedUrl, options);
@@ -62,7 +175,7 @@ async function cacheHttpModuleInternal(url, options) {
             // dependency could not be prefetched. Retry the prefetch instead of
             // handing the degradation on.
             httpCacheLog.debug("Local cache holds a degraded artifact, will re-fetch", {
-                url: normalizedUrl,
+                url: safeUrl,
                 hash,
             });
         }
@@ -72,7 +185,7 @@ async function cacheHttpModuleInternal(url, options) {
                 const depsValid = await validateBundleDepsExist(deps, cacheDir);
                 if (!depsValid) {
                     httpCacheLog.debug("Local cache has missing deps, will re-fetch", {
-                        url: normalizedUrl,
+                        url: safeUrl,
                         hash,
                         missingDeps: deps.length,
                     });
@@ -96,12 +209,12 @@ async function cacheHttpModuleInternal(url, options) {
     if (processingStack.has(cacheIdentity)) {
         if (await exists(cachePath)) {
             httpCacheLog.debug("Circular dependency detected, file exists", {
-                url: normalizedUrl,
+                url: safeUrl,
             });
         }
         else {
             httpCacheLog.debug("Circular dependency detected, file pending write", {
-                url: normalizedUrl,
+                url: safeUrl,
                 cachePath,
             });
         }
@@ -109,7 +222,7 @@ async function cacheHttpModuleInternal(url, options) {
     }
     let inFlight = inFlightHttpFetches.get(cacheKey);
     while (inFlight) {
-        const result = await waitForInFlightFetch(inFlight, cacheKey);
+        const result = await waitForInFlightFetch(inFlight, HTTP_MODULE_FETCH_MAX_WAIT_MS);
         if (result !== undefined)
             return result;
         if (inFlightHttpFetches.get(cacheKey) === inFlight) {
@@ -127,7 +240,7 @@ async function cacheHttpModuleInternal(url, options) {
                 const depsExist = await validateBundleDepsExist(deps, cacheDir);
                 if (!depsExist) {
                     httpCacheLog.debug("Cached code has missing bundle deps, will re-fetch", {
-                        url: normalizedUrl,
+                        url: safeUrl,
                         hash,
                         missingDeps: deps.length,
                     });
@@ -135,7 +248,7 @@ async function cacheHttpModuleInternal(url, options) {
                 else {
                     logger.debug(cacheResult.wasGzipped
                         ? "[HTTP-CACHE] Distributed cache hit (gzip decoded)"
-                        : "[HTTP-CACHE] Distributed cache hit", { url: normalizedUrl, hash });
+                        : "[HTTP-CACHE] Distributed cache hit", { url: safeUrl, hash });
                     await fs.mkdir(cacheDir, { recursive: true });
                     await fs.writeTextFile(cachePath, cachedCode);
                     if (!(await exists(cachePath))) {
@@ -150,7 +263,7 @@ async function cacheHttpModuleInternal(url, options) {
             else {
                 logger.debug(cacheResult.wasGzipped
                     ? "[HTTP-CACHE] Distributed cache hit (gzip decoded, no deps)"
-                    : "[HTTP-CACHE] Distributed cache hit", { url: normalizedUrl, hash });
+                    : "[HTTP-CACHE] Distributed cache hit", { url: safeUrl, hash });
                 await fs.mkdir(cacheDir, { recursive: true });
                 await fs.writeTextFile(cachePath, cachedCode);
                 if (!(await exists(cachePath))) {
@@ -164,49 +277,22 @@ async function cacheHttpModuleInternal(url, options) {
         }
         else if (cacheResult.failReason && cacheResult.failReason !== "not_found") {
             httpCacheLog.debug("Distributed cache get failed", {
-                url: normalizedUrl,
+                url: safeUrl,
                 reason: cacheResult.failReason,
             });
         }
-        httpCacheLog.debug("Fetching from network", { url: normalizedUrl });
-        const urlObj = new URL(normalizedUrl);
-        const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), HTTP_FETCH_TIMEOUT_MS);
-        const httpFetchStartTime = performance.now();
-        const response = await withSpan(SpanNames.HTTP_CLIENT_FETCH, () => fetch(normalizedUrl, {
-            headers: { "user-agent": "Mozilla/5.0 Veryfront/1.0" },
-            signal: controller.signal,
-            redirect: "follow",
-        }), {
-            "http.method": "GET",
-            "http.url": normalizedUrl,
-            "http.host": urlObj.host,
-            "http.scheme": urlObj.protocol.replace(":", ""),
-            "esm.package_fetch": true,
-        });
-        clearTimeout(timeout);
-        const httpFetchDuration = Math.round(performance.now() - httpFetchStartTime);
-        contentMetricsLog.debug("HTTP_MODULE_FETCH", {
-            url: normalizedUrl.substring(0, 120),
-            host: urlObj.host,
-            duration_ms: httpFetchDuration,
-            status: response.status,
-            slow: httpFetchDuration > SLOW_HTTP_FETCH_THRESHOLD_MS,
-        });
-        if (!response.ok) {
-            throw BUILD_FAILED.create({ detail: `Failed to fetch ${normalizedUrl}: ${response.status}` });
-        }
-        let code = await response.text();
-        const contentType = response.headers.get("content-type") ?? "";
+        httpCacheLog.debug("Fetching from network", { url: safeUrl });
+        const fetchedModule = await fetchHttpModule(normalizedUrl);
+        let code = fetchedModule.code;
+        const contentType = fetchedModule.contentType;
         const isHtmlContent = contentType.includes("text/html") || looksLikeHtmlNotJs(code);
         if (isHtmlContent) {
             logger.error("[HTTP-CACHE] Received HTML instead of JavaScript, likely an esm.sh error page", {
-                url: normalizedUrl,
+                url: safeUrl,
                 contentType,
-                preview: code.slice(0, 200),
             });
             throw BUNDLE_ERROR.create({
-                detail: `Received HTML instead of JavaScript from ${normalizedUrl}. The package may not exist or failed to build on esm.sh.`,
+                detail: `Received HTML instead of JavaScript from ${safeUrl}. The package may not exist or failed to build on esm.sh.`,
             });
         }
         processingStack.add(cacheIdentity);
@@ -236,9 +322,9 @@ async function cacheHttpModuleInternal(url, options) {
             // retries the prefetch instead of inheriting one upstream blip for the
             // lifetime of the distributed entry.
             httpCacheLog.warn("Not caching a module with unresolved dynamic imports", {
-                url: normalizedUrl,
+                url: safeUrl,
                 hash,
-                degraded,
+                degraded: degraded.map(sanitizeUrlForSpan),
             });
             return cachePath;
         }
@@ -249,7 +335,7 @@ async function cacheHttpModuleInternal(url, options) {
             if (error instanceof VeryfrontError && error.slug === "cache-invariant-violation") {
                 throw error;
             }
-            httpCacheLog.debug("Distributed cache set failed", { url: normalizedUrl, error });
+            httpCacheLog.debug("Distributed cache set failed", { url: safeUrl, error });
         }
         getCachedPaths().set(cacheKey, cachePath);
         const accumulator = bundleAccumulatorStorage.getStore();