vinext 0.0.20 → 0.0.22

package/dist/index.js

@@ -6,6 +6,7 @@ import { handleApiRoute } from "./server/api-handler.js";
 import { generateRscEntry, generateSsrEntry, generateBrowserEntry, } from "./server/app-dev-server.js";
 import { loadNextConfig, resolveNextConfig, } from "./config/next-config.js";
 import { findMiddlewareFile, isProxyFile, runMiddleware } from "./server/middleware.js";
+import { logRequest, now } from "./server/request-log.js";
 import { generateSafeRegExpCode, generateMiddlewareMatcherCode, generateNormalizePathCode } from "./server/middleware-codegen.js";
 import { normalizePath } from "./server/normalize-path.js";
 import { findInstrumentationFile, runInstrumentation } from "./server/instrumentation.js";
@@ -1026,6 +1027,12 @@ function createReqRes(request, url, query, body) {
       else { res.writeHead(statusOrUrl, { Location: url2 }); }
       res.end();
     },
+    getHeaders: function() {
+      var h = Object.assign({}, resHeaders);
+      if (setCookieHeaders.length > 0) h["set-cookie"] = setCookieHeaders;
+      return h;
+    },
+    get headersSent() { return ended; },
   };
 
   return { req, res, responsePromise };
@@ -1140,8 +1147,9 @@ export async function renderPage(request, url, manifest) {
     }
 
     let pageProps = {};
+    var gsspRes = null;
     if (typeof pageModule.getServerSideProps === "function") {
-      const { req, res } = createReqRes(request, routeUrl, parseQuery(routeUrl), undefined);
+      const { req, res, responsePromise } = createReqRes(request, routeUrl, parseQuery(routeUrl), undefined);
       const ctx = {
         params, req, res,
         query: parseQuery(routeUrl),
@@ -1151,6 +1159,10 @@ export async function renderPage(request, url, manifest) {
         defaultLocale: i18nConfig ? i18nConfig.defaultLocale : undefined,
       };
       const result = await pageModule.getServerSideProps(ctx);
+      // If gSSP called res.end() directly (short-circuit), return that response.
+      if (res.headersSent) {
+        return await responsePromise;
+      }
       if (result && result.props) pageProps = result.props;
       if (result && result.redirect) {
         var gsspStatus = result.redirect.statusCode != null ? result.redirect.statusCode : (result.redirect.permanent ? 308 : 307);
@@ -1159,6 +1171,9 @@ export async function renderPage(request, url, manifest) {
       if (result && result.notFound) {
         return new Response("404", { status: 404 });
       }
+      // Preserve the res object so headers/status/cookies set by gSSP
+      // can be merged into the final HTML response.
+      gsspRes = res;
     }
     // Build font Link header early so it's available for ISR cached responses too.
     // Font preloads are module-level state populated at import time and persist across requests.
@@ -1335,16 +1350,33 @@ export async function renderPage(request, url, manifest) {
       await isrSet(isrCacheKey, { kind: "PAGES", html: fullHtml, pageData: pageProps, headers: undefined, status: undefined }, isrRevalidateSeconds);
     }
 
-    const responseHeaders = { "Content-Type": "text/html" };
+    // Merge headers/status/cookies set by getServerSideProps on the res object.
+    // gSSP commonly uses res.setHeader("Set-Cookie", ...) or res.status(304).
+    var finalStatus = 200;
+    const responseHeaders = new Headers({ "Content-Type": "text/html" });
+    if (gsspRes) {
+      finalStatus = gsspRes.statusCode;
+      var gsspHeaders = gsspRes.getHeaders();
+      for (var hk of Object.keys(gsspHeaders)) {
+        var hv = gsspHeaders[hk];
+        if (hk === "set-cookie" && Array.isArray(hv)) {
+          for (var sc of hv) responseHeaders.append("set-cookie", sc);
+        } else if (hv != null) {
+          responseHeaders.set(hk, String(hv));
+        }
+      }
+      // Ensure Content-Type stays text/html (gSSP shouldn't override it for page renders)
+      responseHeaders.set("Content-Type", "text/html");
+    }
     if (isrRevalidateSeconds) {
-      responseHeaders["Cache-Control"] = "s-maxage=" + isrRevalidateSeconds + ", stale-while-revalidate";
-      responseHeaders["X-Vinext-Cache"] = "MISS";
+      responseHeaders.set("Cache-Control", "s-maxage=" + isrRevalidateSeconds + ", stale-while-revalidate");
+      responseHeaders.set("X-Vinext-Cache", "MISS");
     }
     // Set HTTP Link header for font preloading
     if (_fontLinkHeader) {
-      responseHeaders["Link"] = _fontLinkHeader;
+      responseHeaders.set("Link", _fontLinkHeader);
     }
-    return new Response(compositeStream, { status: 200, headers: responseHeaders });
+    return new Response(compositeStream, { status: finalStatus, headers: responseHeaders });
   } catch (e) {
     console.error("[vinext] SSR error:", e);
     return new Response("Internal Server Error", { status: 500 });
@@ -1559,6 +1591,9 @@ hydrate();
         });
     }
     const imageImportDimCache = new Map();
+    // Shared state for the MDX proxy plugin. Populated during config() if MDX
+    // files are detected and @mdx-js/rollup is installed.
+    let mdxDelegate = null;
     const plugins = [
         // Resolve tsconfig paths/baseUrl aliases so real-world Next.js repos
         // that use @/*, #/*, or baseUrl imports work out of the box.
@@ -1753,11 +1788,10 @@ hydrate();
                 // already configured. Applies remark/rehype plugins from next.config.
                 const hasMdxPlugin = pluginsFlat.some((p) => p && typeof p === "object" && typeof p.name === "string" &&
                     (p.name === "@mdx-js/rollup" || p.name === "mdx"));
-                const mdxPlugins = [];
                 if (!hasMdxPlugin && hasMdxFiles(root, hasAppDir ? appDir : null, hasPagesDir ? pagesDir : null)) {
                     try {
                         const mdxRollup = await import("@mdx-js/rollup");
-                        const mdxPlugin = mdxRollup.default ?? mdxRollup;
+                        const mdxFactory = mdxRollup.default ?? mdxRollup;
                         const mdxOpts = {};
                         if (nextConfig.mdx) {
                             if (nextConfig.mdx.remarkPlugins)
@@ -1767,7 +1801,7 @@ hydrate();
                             if (nextConfig.mdx.recmaPlugins)
                                 mdxOpts.recmaPlugins = nextConfig.mdx.recmaPlugins;
                         }
-                        mdxPlugins.push(mdxPlugin(mdxOpts));
+                        mdxDelegate = mdxFactory(mdxOpts);
                         if (nextConfig.mdx) {
                             console.log("[vinext] Auto-injected @mdx-js/rollup with remark/rehype plugins from next.config");
                         }
@@ -1991,10 +2025,6 @@ hydrate();
                         },
                     };
                 }
-                // Add auto-injected MDX plugin if needed
-                if (mdxPlugins.length > 0) {
-                    viteConfig.plugins = mdxPlugins;
-                }
                 return viteConfig;
             },
             configResolved(config) {
@@ -2100,6 +2130,31 @@ hydrate();
                 }
             },
         },
+        // Proxy plugin for @mdx-js/rollup. The real MDX plugin is created lazily
+        // during vinext:config's config() (when MDX files are detected), but
+        // plugins returned from config() hooks run too late in the pipeline —
+        // after vite:import-analysis. This top-level proxy with enforce:"pre"
+        // ensures MDX transforms run at the correct stage. Both vinext:config
+        // and this proxy are enforce:"pre", and vinext:config comes first in
+        // the array, so mdxDelegate is already set when this proxy's hooks fire.
+        {
+            name: "vinext:mdx",
+            enforce: "pre",
+            config(config, env) {
+                if (!mdxDelegate?.config)
+                    return;
+                const hook = mdxDelegate.config;
+                const fn = typeof hook === "function" ? hook : hook.handler;
+                return fn.call(this, config, env);
+            },
+            transform(code, id, options) {
+                if (!mdxDelegate?.transform)
+                    return;
+                const hook = mdxDelegate.transform;
+                const fn = typeof hook === "function" ? hook : hook.handler;
+                return fn.call(this, code, id, options);
+            },
+        },
         // Shim React canary/experimental APIs (ViewTransition, addTransitionType)
         // that exist in Next.js's bundled React canary but not in stable React 19.
         // Provides graceful no-op fallbacks so projects using these APIs degrade
@@ -2213,8 +2268,135 @@ hydrate();
                         console.error("[vinext] Instrumentation error:", err);
                     });
                 }
+                // ── Dev request origin check ─────────────────────────────────────
+                // Registered directly (not in the returned function) so it runs
+                // BEFORE Vite's built-in middleware. This ensures all requests
+                // (including /@*, /__vite*, /node_modules* paths) are validated
+                // before Vite serves any content.
+                server.middlewares.use((req, res, next) => {
+                    const blockReason = validateDevRequest({
+                        origin: req.headers.origin,
+                        host: req.headers.host,
+                        "x-forwarded-host": req.headers["x-forwarded-host"],
+                        "sec-fetch-site": req.headers["sec-fetch-site"],
+                        "sec-fetch-mode": req.headers["sec-fetch-mode"],
+                    }, nextConfig?.serverActionsAllowedOrigins);
+                    if (blockReason) {
+                        console.warn(`[vinext] Blocked dev request: ${blockReason} (${req.url})`);
+                        res.writeHead(403, { "Content-Type": "text/plain" });
+                        res.end("Forbidden");
+                        return;
+                    }
+                    next();
+                });
                 // Return a function to register middleware AFTER Vite's built-in middleware
                 return () => {
+                    // App Router request logging in dev server
+                    //
+                    // For App Router, the RSC plugin handles requests internally.
+                    // We install a timing middleware here that:
+                    //   1. Intercepts writeHead() to pluck the X-Vinext-Timing header
+                    //      (compileMs,renderMs) that the RSC entry attaches before
+                    //      it is flushed to the client.
+                    //   2. Logs the full request after res finishes, using those timings.
+                    if (hasAppDir) {
+                        server.middlewares.use((req, res, next) => {
+                            const url = req.url ?? "/";
+                            // Skip Vite internals, HMR, and static assets.
+                            // Do NOT skip .rsc-suffixed URLs or RSC wire requests (Accept: text/x-component)
+                            // — those are soft navigations and should be logged like any other page request.
+                            const [pathname] = url.split("?");
+                            if (url.startsWith("/@") ||
+                                url.startsWith("/__vite") ||
+                                url.startsWith("/node_modules") ||
+                                (url.includes(".") && !pathname.endsWith(".html") && !pathname.endsWith(".rsc"))) {
+                                return next();
+                            }
+                            const _reqStart = now();
+                            let _compileMs;
+                            let _renderMs;
+                            // Intercept setHeader and writeHead so we can strip X-Vinext-Timing
+                            // before it reaches the client and capture the compile/render split.
+                            // The RSC plugin may set headers either way depending on its version.
+                            // Parse the three-part X-Vinext-Timing header:
+                            //   "handlerStart,inHandlerCompileMs,renderMs"
+                            //
+                            // True compile time = time the RSC plugin spent loading/transforming
+                            // modules before our handler code ran, plus any in-handler work before
+                            // renderToReadableStream. Concretely:
+                            //   compileMs = (handlerStart - _reqStart) + inHandlerCompileMs
+                            //   renderMs  = renderMs from header, or -1 for RSC-only (soft-nav)
+                            //               responses where rendering is not measured in the handler.
+                            //               In that case the middleware computes render time as
+                            //               totalMs - compileMs.
+                            //
+                            // handlerStart is performance.now() recorded at the very top of
+                            // _handleRequest in the generated RSC entry. _reqStart is recorded
+                            // here in the Node middleware, one stack frame before the RSC plugin
+                            // loads the module. The gap between them is exactly the Vite
+                            // compile/transform cost.
+                            function _parseTiming(raw) {
+                                const [handlerStart, inHandlerCompileMs, renderMs] = String(raw).split(",").map((v) => Number(v));
+                                if (!Number.isNaN(handlerStart) && !Number.isNaN(inHandlerCompileMs) && inHandlerCompileMs !== -1) {
+                                    _compileMs = Math.max(0, Math.round(handlerStart - _reqStart)) + inHandlerCompileMs;
+                                }
+                                if (!Number.isNaN(renderMs) && renderMs !== -1) {
+                                    _renderMs = renderMs;
+                                }
+                            }
+                            const _origSetHeader = res.setHeader.bind(res);
+                            res.setHeader = function (name, value) {
+                                if (name.toLowerCase() === "x-vinext-timing") {
+                                    _parseTiming(value);
+                                    return res; // drop the header — don't forward to client
+                                }
+                                return _origSetHeader(name, value);
+                            };
+                            const _origWriteHead = res.writeHead.bind(res);
+                            res.writeHead = function (statusCode, ...args) {
+                                // Normalise the optional headers argument (may be reason, headers object, or both).
+                                let headers;
+                                const [reasonOrHeaders, maybeHeaders] = args;
+                                if (typeof reasonOrHeaders === "string") {
+                                    headers = maybeHeaders;
+                                }
+                                else {
+                                    headers = reasonOrHeaders;
+                                }
+                                // Pull timing out of the headers object when present.
+                                if (headers && typeof headers === "object" && !Array.isArray(headers)) {
+                                    const timingKey = Object.keys(headers).find((k) => k.toLowerCase() === "x-vinext-timing");
+                                    if (timingKey) {
+                                        _parseTiming(headers[timingKey]);
+                                        delete headers[timingKey];
+                                    }
+                                }
+                                return _origWriteHead(statusCode, ...args);
+                            };
+                            res.on("finish", () => {
+                                // Strip .rsc suffix — it's an internal RSC protocol detail,
+                                // not part of the actual page path the user navigated to.
+                                const logUrl = url.replace(/\.rsc(\?|$)/, "$1");
+                                const totalMs = now() - _reqStart;
+                                // For RSC-only responses (soft nav), renderMs is -1 (sentinel meaning
+                                // "not measured in the handler"). Compute it as totalMs - compileMs,
+                                // which is how long the RSC stream took to fully flush to the client —
+                                // matching what Next.js shows for soft navigations.
+                                const resolvedRenderMs = _renderMs !== undefined
+                                    ? _renderMs
+                                    : (_compileMs !== undefined ? Math.max(0, Math.round(totalMs - _compileMs)) : undefined);
+                                logRequest({
+                                    method: req.method ?? "GET",
+                                    url: logUrl,
+                                    status: res.statusCode,
+                                    totalMs,
+                                    compileMs: _compileMs,
+                                    renderMs: resolvedRenderMs,
+                                });
+                            });
+                            next();
+                        });
+                    }
                     server.middlewares.use(async (req, res, next) => {
                         try {
                             let url = req.url ?? "/";
@@ -2232,9 +2414,12 @@ hydrate();
                             if (url.split("?")[0].endsWith(".rsc")) {
                                 return next();
                             }
-                            // ── Cross-origin request protection ─────────────────────────
-                            // Block requests from non-localhost origins to prevent
-                            // cross-origin data exfiltration from the dev server.
+                            // ── Cross-origin request protection (defense-in-depth) ──────
+                            // The pre-Vite middleware above already blocks cross-origin
+                            // requests before Vite serves any content. This second check
+                            // guards the Pages Router handler specifically, in case the
+                            // middleware ordering changes or new middleware is added between
+                            // the two. Both calls use the same validateDevRequest() function.
                             const blockReason = validateDevRequest({
                                 origin: req.headers.origin,
                                 host: req.headers.host,
@@ -2258,7 +2443,14 @@ hydrate();
                                 const imgUrl = rawImgUrl?.replaceAll("\\", "/") ?? null;
                                 // Allowlist: must start with "/" but not "//" — blocks absolute
                                 // URLs, protocol-relative, backslash variants, and exotic schemes.
-                                if (!imgUrl || !imgUrl.startsWith("/") || imgUrl.startsWith("//")) {
+                                // Also block internal Vite paths (/@*, /__vite*, /node_modules*)
+                                // to prevent redirecting to dev server endpoints.
+                                if (!imgUrl ||
+                                    !imgUrl.startsWith("/") ||
+                                    imgUrl.startsWith("//") ||
+                                    imgUrl.startsWith("/@") ||
+                                    imgUrl.startsWith("/__vite") ||
+                                    imgUrl.startsWith("/node_modules")) {
                                     res.writeHead(400);
                                     res.end(!rawImgUrl ? "Missing url parameter" : "Only relative URLs allowed");
                                     return;
@@ -2366,9 +2558,22 @@ hydrate();
                                 const result = await runMiddleware(server, middlewarePath, middlewareRequest);
                                 if (!result.continue) {
                                     if (result.redirectUrl) {
-                                        res.writeHead(result.redirectStatus ?? 307, {
-                                            Location: result.redirectUrl,
-                                        });
+                                        const redirectHeaders = { Location: result.redirectUrl };
+                                        if (result.responseHeaders) {
+                                            for (const [key, value] of result.responseHeaders) {
+                                                const existing = redirectHeaders[key];
+                                                if (existing === undefined) {
+                                                    redirectHeaders[key] = value;
+                                                }
+                                                else if (Array.isArray(existing)) {
+                                                    existing.push(value);
+                                                }
+                                                else {
+                                                    redirectHeaders[key] = [existing, value];
+                                                }
+                                            }
+                                        }
+                                        res.writeHead(result.redirectStatus ?? 307, redirectHeaders);
                                         res.end();
                                         return;
                                     }
@@ -2438,7 +2643,10 @@ hydrate();
                                 const handled = await handleApiRoute(server, req, res, resolvedUrl, apiRoutes);
                                 if (handled)
                                     return;
-                                // No API route matched — fall through to 404
+                                // No API route matched — if app dir exists, let the RSC plugin handle it
+                                // (app/api/* route handlers live there). Otherwise hard-404.
+                                if (hasAppDir)
+                                    return next();
                                 res.statusCode = 404;
                                 res.end("404 - API route not found");
                                 return;
@@ -2479,7 +2687,10 @@ hydrate();
                                     return;
                                 }
                             }
-                            // No fallback matched — render as-is (will hit 404 handler)
+                            // No fallback matched - if app dir exists, let the RSC plugin handle it,
+                            // otherwise render via the pages SSR handler (will 404 for unknown routes).
+                            if (hasAppDir)
+                                return next();
                             await handler(req, res, resolvedUrl, mwStatus);
                         }
                         catch (e) {