vinext 0.0.53 → 0.0.55

package/dist/server/app-ssr-entry.d.ts

@@ -23,6 +23,12 @@ declare function handleSsr(rscStream: ReadableStream<Uint8Array>, navContext: Na
   };
   formState?: ReactFormState | null;
   basePath?: string;
+  /**
+   * Allow-list of OpenTelemetry propagation keys (from
+   * `experimental.clientTraceMetadata`) to render as `<meta>` tags in the
+   * SSR head. Undefined or empty disables emission entirely.
+   */
+  clientTraceMetadata?: readonly string[];
   rootParams?: RootParams;
   /** When true, wait for the full React tree (including Suspense boundaries)
    *  to resolve before returning the HTML stream. Used for static prerender

package/dist/server/app-ssr-entry.js

@@ -8,13 +8,14 @@ import { ServerInsertedHTMLContext, appRouterInstance, clearServerInsertedHTML,
 import { runWithNavigationContext } from "../shims/navigation-state.js";
 import { withScriptNonce } from "../shims/script-nonce-context.js";
 import { createInlineScriptTag, createNonceAttribute, escapeHtmlAttr, safeJsonStringify } from "./html.js";
+import { getClientTraceMetadataHTML } from "./client-trace-metadata.js";
 import { ElementsContext, Slot } from "../shims/slot.js";
 import { createNavigationRuntimeRscMetadataScript, createRscEmbedTransform, createTickBufferedTransform } from "./app-ssr-stream.js";
-import { BeforeInteractiveContext } from "../shims/before-interactive-context.js";
-import { runWithRootParamsScope } from "../shims/root-params.js";
 import { RSC_FORM_STATE_GLOBAL } from "./app-browser-hydration.js";
 import { createClientReferencePreloader } from "./app-client-reference-preloader.js";
 import { deferUntilStreamConsumed } from "./app-page-stream.js";
+import { runWithRootParamsScope } from "../shims/root-params.js";
+import { BeforeInteractiveContext } from "../shims/before-interactive-context.js";
 import { createSsrErrorMetaRenderer } from "./app-ssr-error-meta.js";
 import { Fragment, createElement, use } from "react";
 import { renderToReadableStream, renderToStaticMarkup } from "react-dom/server.edge";
@@ -78,15 +79,19 @@ function renderBeforeInteractiveInlineScripts(scripts) {
 	}
 	return html;
 }
-function renderFontHtml(fontData, nonce) {
+function renderFontHtml(fontData, nonce, options = {}) {
 	if (!fontData) return "";
 	let fontHTML = "";
 	const nonceAttr = createNonceAttribute(nonce);
+	const includeStyles = options.includeStyles ?? true;
 	for (const url of fontData.links ?? []) fontHTML += `<link rel="stylesheet"${nonceAttr} href="${escapeHtmlAttr(url)}" />\n`;
 	for (const preload of fontData.preloads ?? []) fontHTML += `<link rel="preload"${nonceAttr} href="${escapeHtmlAttr(preload.href)}" as="font" type="${escapeHtmlAttr(preload.type)}" crossorigin />\n`;
-	if (fontData.styles && fontData.styles.length > 0) fontHTML += `<style data-vinext-fonts${nonceAttr}>${fontData.styles.join("\n")}</style>\n`;
+	if (includeStyles && fontData.styles && fontData.styles.length > 0) fontHTML += `<style data-vinext-fonts${nonceAttr}>${fontData.styles.join("\n")}</style>\n`;
 	return fontHTML;
 }
+function hasInlineCssManifest(manifest) {
+	return manifest !== void 0 && Object.keys(manifest).length > 0;
+}
 /**
 * Extract the bootstrap module URL from the `import("...")` string that
 * `import.meta.viteRsc.loadBootstrapScriptContent("index")` returns.
@@ -168,17 +173,27 @@ async function handleSsr(rscStream, navContext, fontData, options) {
 					}
 				});
 				if (options?.waitForAllReady === true) await htmlStream.allReady;
-				const fontHTML = renderFontHtml(fontData, options?.scriptNonce);
+				const inlineCssManifest = globalThis.__VINEXT_INLINE_CSS__;
+				const fontStyles = fontData?.styles ?? [];
+				const mergeFontStylesIntoInlineCss = fontStyles.length > 0 && hasInlineCssManifest(inlineCssManifest);
+				const inlineCssFontStyles = mergeFontStylesIntoInlineCss ? fontStyles.join("\n") : "";
+				const inlineCssFontStyleFallbackHTML = mergeFontStylesIntoInlineCss ? renderFontHtml({ styles: fontStyles }, options?.scriptNonce) : "";
+				const fontHTML = renderFontHtml(fontData, options?.scriptNonce, { includeStyles: !mergeFontStylesIntoInlineCss });
+				let traceMetaHTML = null;
+				const getTraceMetaHTML = () => {
+					if (traceMetaHTML === null) traceMetaHTML = getClientTraceMetadataHTML(options?.clientTraceMetadata);
+					return traceMetaHTML;
+				};
 				let didInjectHeadHTML = false;
 				const getInsertedHTML = () => {
 					const insertedHTML = renderInsertedHtml(renderServerInsertedHTML());
 					const errorMetaHTML = errorMetaRenderer.flush();
 					if (didInjectHeadHTML) return insertedHTML + errorMetaHTML;
 					didInjectHeadHTML = true;
-					return buildHeadInjectionHtml(navContext, bootstrapModuleUrl, options?.formState ?? null, insertedHTML + errorMetaHTML, fontHTML, options?.scriptNonce);
+					return buildHeadInjectionHtml(navContext, bootstrapModuleUrl, options?.formState ?? null, insertedHTML + errorMetaHTML + getTraceMetaHTML(), fontHTML, options?.scriptNonce);
 				};
 				const getBeforeInteractiveHeadHTML = () => renderBeforeInteractiveInlineScripts(beforeInteractiveInlineScripts);
-				return deferUntilStreamConsumed(htmlStream.pipeThrough(createTickBufferedTransform(rscEmbed, getInsertedHTML, getBeforeInteractiveHeadHTML)), cleanup);
+				return deferUntilStreamConsumed(htmlStream.pipeThrough(createTickBufferedTransform(rscEmbed, getInsertedHTML, getBeforeInteractiveHeadHTML, inlineCssManifest, inlineCssFontStyles, inlineCssFontStyleFallbackHTML, options?.scriptNonce)), cleanup);
 			} catch (error) {
 				cleanup();
 				throw error;

package/dist/server/app-ssr-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-ssr-entry.js","names":["createReactElement"],"sources":["../../src/server/app-ssr-entry.ts"],"sourcesContent":["/// <reference types=\"@vitejs/plugin-rsc/types\" />\n\nimport \"./server-globals.js\";\nimport type { ReactNode } from \"react\";\nimport type { ReactFormState } from \"react-dom/client\";\nimport { Fragment, createElement as createReactElement, use } from \"react\";\nimport { createFromReadableStream } from \"@vitejs/plugin-rsc/ssr\";\nimport { renderToReadableStream, renderToStaticMarkup } from \"react-dom/server.edge\";\nimport clientReferences from \"virtual:vite-rsc/client-references\";\nimport type { NavigationContext } from \"vinext/shims/navigation\";\nimport {\n  ServerInsertedHTMLContext,\n  appRouterInstance,\n  clearServerInsertedHTML,\n  renderServerInsertedHTML,\n  setNavigationContext,\n  useServerInsertedHTML,\n} from \"vinext/shims/navigation\";\nimport { runWithNavigationContext } from \"vinext/shims/navigation-state\";\nimport { runWithRootParamsScope, type RootParams } from \"vinext/shims/root-params\";\nimport { isOpenRedirectShaped } from \"./request-pipeline.js\";\nimport { notFoundResponse } from \"./http-error-responses.js\";\nimport { withScriptNonce } from \"vinext/shims/script-nonce-context\";\nimport {\n  BeforeInteractiveContext,\n  type BeforeInteractiveInlineScript,\n} from \"vinext/shims/before-interactive-context\";\nimport {\n  createInlineScriptTag,\n  createNonceAttribute,\n  escapeHtmlAttr,\n  safeJsonStringify,\n} from \"./html.js\";\nimport {\n  createNavigationRuntimeRscMetadataScript,\n  createRscEmbedTransform,\n  createTickBufferedTransform,\n} from \"./app-ssr-stream.js\";\nimport { deferUntilStreamConsumed } from \"./app-page-stream.js\";\nimport { createSsrErrorMetaRenderer } from \"./app-ssr-error-meta.js\";\nimport { AppElementsWire, type AppWireElements } from \"./app-elements.js\";\nimport { ElementsContext, Slot } from \"vinext/shims/slot\";\nimport { AppRouterContext } from \"vinext/shims/internal/app-router-context\";\nimport { createClientReferencePreloader } from \"./app-client-reference-preloader.js\";\nimport { RSC_FORM_STATE_GLOBAL } from \"./app-browser-hydration.js\";\n\nexport type FontPreload = {\n  href: string;\n  type: string;\n};\n\nexport type FontData = {\n  links?: string[];\n  styles?: string[];\n  preloads?: FontPreload[];\n};\n\nconst clientReferencePreloader = createClientReferencePreloader({\n  getReferences() {\n    return clientReferences;\n  },\n  getClientRequire() {\n    return globalThis.__vite_rsc_client_require__;\n  },\n  onPreloadError(id, error) {\n    if (process.env.NODE_ENV !== \"production\") {\n      console.warn(\"[vinext] failed to preload client ref:\", id, error);\n    }\n  },\n});\n\nfunction ssrErrorDigest(input: string): string {\n  let hash = 5381;\n  for (let i = input.length - 1; i >= 0; i--) {\n    hash = (hash * 33) ^ input.charCodeAt(i);\n  }\n  return (hash >>> 0).toString();\n}\n\nfunction getErrorMessage(error: unknown): string {\n  if (error instanceof Error) return error.message;\n  if (typeof error === \"string\") return error;\n  return Object.prototype.toString.call(error);\n}\n\nfunction renderInsertedHtml(insertedElements: readonly unknown[]): string {\n  let insertedHTML = \"\";\n\n  for (const element of insertedElements) {\n    try {\n      insertedHTML += renderToStaticMarkup(\n        createReactElement(Fragment, null, element as ReactNode),\n      );\n    } catch {\n      // Ignore individual callback failures so the rest of the page can render.\n    }\n  }\n\n  return insertedHTML;\n}\n\n/**\n * Render captured `<Script strategy=\"beforeInteractive\">` inline scripts to\n * HTML, ready to splice immediately after `<head ...>` opens. Each entry has\n * already had its inline content escaped via `escapeInlineContent(..., \"script\")`\n * inside the Script shim, so this function only quotes the attributes that\n * actually go on the tag (id, nonce, plus the residual passthroughs).\n *\n * Keeping this function colocated with the rest of the head-injection\n * helpers makes it obvious where the boundary is: anything passed through\n * here is being concatenated directly into HTML; treat the inputs\n * accordingly.\n */\n// Conservative subset of the HTML attribute-name grammar. Must start with a\n// letter and contain only letters, digits, underscores, hyphens, or dots —\n// enough to round-trip data-* and standard attributes (`async`, `defer`,\n// `type`, `crossorigin`, etc.) without ever splicing a `\"`/`>`/whitespace\n// into the unquoted *name* position where escaping wouldn't help.\nconst VALID_ATTR_NAME = /^[a-zA-Z][\\w.-]*$/;\n\nfunction renderBeforeInteractiveInlineScripts(\n  scripts: readonly BeforeInteractiveInlineScript[],\n): string {\n  if (scripts.length === 0) return \"\";\n  let html = \"\";\n  for (const script of scripts) {\n    let attrs = \"\";\n    if (script.id) {\n      attrs += ` id=\"${escapeHtmlAttr(script.id)}\"`;\n    }\n    attrs += createNonceAttribute(script.nonce);\n    if (script.attributes) {\n      for (const [key, value] of Object.entries(script.attributes)) {\n        // Attribute *values* go through escapeHtmlAttr below. The *name*\n        // can't be escaped — a malformed key would break the tag — so we\n        // gate at the boundary instead of trying to neutralise it.\n        if (!VALID_ATTR_NAME.test(key)) continue;\n        if (value === true) {\n          attrs += ` ${key}`;\n        } else if (typeof value === \"string\") {\n          attrs += ` ${key}=\"${escapeHtmlAttr(value)}\"`;\n        }\n      }\n    }\n    html += `<script${attrs}>${script.innerHTML}</script>`;\n  }\n  return html;\n}\n\nfunction renderFontHtml(fontData?: FontData, nonce?: string): string {\n  if (!fontData) return \"\";\n\n  let fontHTML = \"\";\n  const nonceAttr = createNonceAttribute(nonce);\n\n  for (const url of fontData.links ?? []) {\n    fontHTML += `<link rel=\"stylesheet\"${nonceAttr} href=\"${escapeHtmlAttr(url)}\" />\\n`;\n  }\n\n  for (const preload of fontData.preloads ?? []) {\n    fontHTML += `<link rel=\"preload\"${nonceAttr} href=\"${escapeHtmlAttr(preload.href)}\" as=\"font\" type=\"${escapeHtmlAttr(preload.type)}\" crossorigin />\\n`;\n  }\n\n  if (fontData.styles && fontData.styles.length > 0) {\n    fontHTML += `<style data-vinext-fonts${nonceAttr}>${fontData.styles.join(\"\\n\")}</style>\\n`;\n  }\n\n  return fontHTML;\n}\n\n/**\n * Extract the bootstrap module URL from the `import(\"...\")` string that\n * `import.meta.viteRsc.loadBootstrapScriptContent(\"index\")` returns.\n *\n * The plugin-rsc helper returns the bootstrap as an inline call so we can\n * inject it via `bootstrapScriptContent`. We instead pass the URL to\n * React's `bootstrapModules` option so a real\n * `<script type=\"module\" src=\"…\">` tag ends up in the streamed HTML —\n * this exposes the URL to anything that reads `script.attribs.src` (e.g.\n * the Next.js asset-prefix fixture test). The same URL also feeds the\n * `<link rel=\"modulepreload\">` we emit ahead of the bootstrap.\n *\n * Returns `undefined` when the helper produced no URL (older plugin-rsc\n * versions, or a custom client entry that disables bootstrap content).\n */\nfunction extractBootstrapModuleUrl(bootstrapScriptContent?: string): string | undefined {\n  if (!bootstrapScriptContent) return undefined;\n  // Accept either quote style — plugin-rsc currently emits double quotes\n  // (`import(\"…\")`) but a future version could switch to single quotes,\n  // and there's no public contract documenting which is used.\n  const match = bootstrapScriptContent.match(/import\\([\"']([^\"']+)[\"']\\)/);\n  return match?.[1] ?? undefined;\n}\n\nfunction buildModulePreloadHtml(bootstrapModuleUrl?: string, nonce?: string): string {\n  if (!bootstrapModuleUrl) return \"\";\n  return `<link rel=\"modulepreload\"${createNonceAttribute(nonce)} href=\"${escapeHtmlAttr(bootstrapModuleUrl)}\" />\\n`;\n}\n\nfunction buildHeadInjectionHtml(\n  navContext: NavigationContext | null,\n  bootstrapModuleUrl: string | undefined,\n  formState: ReactFormState | null,\n  insertedHTML: string,\n  fontHTML: string,\n  scriptNonce?: string,\n): string {\n  const navPayload = {\n    pathname: navContext?.pathname ?? \"/\",\n    searchParams: navContext?.searchParams ? [...navContext.searchParams.entries()] : [],\n  };\n  const rscMetadataScript = createInlineScriptTag(\n    createNavigationRuntimeRscMetadataScript(navContext?.params ?? {}, navPayload),\n    scriptNonce,\n  );\n  const formStateScript =\n    formState === null\n      ? \"\"\n      : createInlineScriptTag(\n          \"self[\" + safeJsonStringify(RSC_FORM_STATE_GLOBAL) + \"]=\" + safeJsonStringify(formState),\n          scriptNonce,\n        );\n\n  return (\n    rscMetadataScript +\n    formStateScript +\n    buildModulePreloadHtml(bootstrapModuleUrl, scriptNonce) +\n    insertedHTML +\n    fontHTML\n  );\n}\n\nexport async function handleSsr(\n  rscStream: ReadableStream<Uint8Array>,\n  navContext: NavigationContext | null,\n  fontData?: FontData,\n  options?: {\n    scriptNonce?: string;\n    /** Pre-split side stream for embed+capture fusion. When provided,\n     *  rscStream is fed directly to createFromReadableStream (no internal tee).\n     *  The embed transform accumulates raw bytes. */\n    sideStream?: ReadableStream<Uint8Array>;\n    /** Out-parameter: filled with accumulated raw RSC bytes when sideStream is consumed. */\n    capturedRscDataRef?: { value: Promise<ArrayBuffer> | null };\n    formState?: ReactFormState | null;\n    basePath?: string;\n    rootParams?: RootParams;\n    /** When true, wait for the full React tree (including Suspense boundaries)\n     *  to resolve before returning the HTML stream. Used for static prerender\n     *  and ISR cache writes to avoid caching fallback content. */\n    waitForAllReady?: boolean;\n  },\n): Promise<ReadableStream<Uint8Array>> {\n  return runWithNavigationContext(async () => {\n    await clientReferencePreloader.preload();\n\n    if (navContext) {\n      setNavigationContext(navContext);\n    }\n\n    clearServerInsertedHTML();\n\n    const cleanup = (): void => {\n      setNavigationContext(null);\n      clearServerInsertedHTML();\n    };\n\n    const rootParams = options?.rootParams ?? {};\n    return runWithRootParamsScope(rootParams, async () => {\n      try {\n        // Fused tee path (#981): caller pre-split the stream. No internal tee needed.\n        // sideStream carries both the embed transform and raw byte accumulation.\n        // rscStream is used directly for createFromReadableStream (SSR).\n        let ssrStream: ReadableStream<Uint8Array>;\n        let rscEmbed;\n\n        if (options?.sideStream) {\n          ssrStream = rscStream;\n          rscEmbed = createRscEmbedTransform(options.sideStream, options?.scriptNonce);\n          if (options.capturedRscDataRef) {\n            options.capturedRscDataRef.value = rscEmbed.getRawBuffer();\n          }\n        } else {\n          const [s1, s2] = rscStream.tee();\n          ssrStream = s1;\n          rscEmbed = createRscEmbedTransform(s2, options?.scriptNonce);\n        }\n\n        let flightRoot: PromiseLike<AppWireElements> | null = null;\n\n        function VinextFlightRoot(): ReactNode {\n          if (!flightRoot) {\n            flightRoot = createFromReadableStream<AppWireElements>(ssrStream);\n          }\n          const wireElements = use(flightRoot);\n          const elements = AppElementsWire.decode(wireElements);\n          const metadata = AppElementsWire.readMetadata(elements);\n          return createReactElement(\n            ElementsContext.Provider,\n            { value: elements },\n            createReactElement(Slot, { id: metadata.routeId }),\n          );\n        }\n\n        const flightRootElement = createReactElement(VinextFlightRoot);\n        const root = AppRouterContext\n          ? createReactElement(\n              AppRouterContext.Provider,\n              { value: appRouterInstance },\n              flightRootElement,\n            )\n          : flightRootElement;\n        const ssrTree = ServerInsertedHTMLContext\n          ? createReactElement(\n              ServerInsertedHTMLContext.Provider,\n              { value: useServerInsertedHTML },\n              root,\n            )\n          : root;\n\n        // Capture inline `<Script strategy=\"beforeInteractive\">` content so the\n        // SSR stream transform can emit it immediately after `<head ...>`\n        // opens — ahead of every React-emitted resource hint. The Script shim\n        // pushes here when it sees an inline beforeInteractive Script and\n        // returns `null` from its render so React does not also serialize the\n        // tag where the user wrote it (where Fizz would push it *after* the\n        // hoisted stylesheets/modulepreloads). See\n        // packages/vinext/src/shims/script.tsx for the capture side.\n        const beforeInteractiveInlineScripts: BeforeInteractiveInlineScript[] = [];\n        const registerBeforeInteractiveInlineScript = (\n          script: BeforeInteractiveInlineScript,\n        ): void => {\n          beforeInteractiveInlineScripts.push(script);\n        };\n        const treeWithBeforeInteractive = createReactElement(\n          BeforeInteractiveContext.Provider,\n          { value: registerBeforeInteractiveInlineScript },\n          ssrTree,\n        );\n        const ssrRoot = withScriptNonce(treeWithBeforeInteractive, options?.scriptNonce);\n\n        // plugin-rsc returns the bootstrap as `import(\"<url>\")` so callers can\n        // inject it via `bootstrapScriptContent`. We hand the URL to React's\n        // `bootstrapModules` option instead so the streamed HTML contains a\n        // real `<script type=\"module\" src=\"<url>\">` tag — exposing the URL\n        // to anything that inspects `script.attribs.src` (e.g. the Next.js\n        // asset-prefix fixture test \"bundles should return 200 on served\n        // assetPrefix\"). Mirrors Next.js's app-render path which passes\n        // `bootstrapScripts: [{ src }]` for the same reason; we use\n        // `bootstrapModules` because vinext's chunks are native ES modules\n        // (Vite output) so a `type=\"module\"` tag is the correct loader.\n        //\n        // In dev, `<url>` is a Vite dev URL like\n        // `/@id/__x00__virtual:vinext-app-browser-entry`; the browser fetches\n        // it as a module from the dev server. In prod it's the hashed bundle\n        // URL (e.g. `/_next/static/index-abc123.js`, optionally prefixed by\n        // `assetPrefix`). Both are valid `<script type=\"module\" src=…>` targets.\n        const bootstrapScriptContent = await import.meta.viteRsc.loadBootstrapScriptContent(\n          \"index\",\n        );\n        const bootstrapModuleUrl = extractBootstrapModuleUrl(bootstrapScriptContent);\n        const errorMetaRenderer = createSsrErrorMetaRenderer({\n          basePath: options?.basePath,\n        });\n\n        const htmlStream = await renderToReadableStream(ssrRoot, {\n          // `bootstrapScriptContent` was previously how vinext injected the\n          // dynamic-import call. `bootstrapModules` performs the same work\n          // natively (and exposes the URL in the DOM), so passing both would\n          // load the bootstrap module twice.\n          //\n          // CSP implications of using `bootstrapModules` instead of inline\n          // `bootstrapScriptContent`:\n          //  - Apps no longer need `script-src 'unsafe-inline'` to load the\n          //    bootstrap (improvement — inline imports required `'unsafe-inline'`).\n          //  - Apps that restrict script sources need `'self'` for the\n          //    common case, or the CDN origin when `assetPrefix` is an\n          //    absolute URL like `https://cdn.example.com`.\n          //  - React still applies `nonce` to the emitted\n          //    `<script type=\"module\" src=…>` tag, so nonce-based CSP\n          //    (`script-src 'nonce-…' 'strict-dynamic'`) keeps working.\n          bootstrapModules: bootstrapModuleUrl ? [bootstrapModuleUrl] : undefined,\n          formState: options?.formState ?? null,\n          nonce: options?.scriptNonce,\n          onError(error) {\n            errorMetaRenderer.capture(error);\n\n            if (error && typeof error === \"object\" && \"digest\" in error) {\n              return String(error.digest);\n            }\n\n            if (process.env.NODE_ENV === \"production\" && error) {\n              const message = getErrorMessage(error);\n              const stack = error instanceof Error ? (error.stack ?? \"\") : \"\";\n              return ssrErrorDigest(message + stack);\n            }\n\n            return undefined;\n          },\n        });\n\n        // When producing static output (prerender / ISR cache writes), wait for\n        // the full React tree to resolve before emitting bytes. This prevents\n        // Suspense fallback content from being serialized to the cache.\n        // Matches Next.js waitForAllReady forkpoint in renderToNodeFizzStream.\n        if (options?.waitForAllReady === true) {\n          await htmlStream.allReady;\n        }\n\n        const fontHTML = renderFontHtml(fontData, options?.scriptNonce);\n        let didInjectHeadHTML = false;\n        const getInsertedHTML = (): string => {\n          const insertedHTML = renderInsertedHtml(renderServerInsertedHTML());\n          const errorMetaHTML = errorMetaRenderer.flush();\n          if (didInjectHeadHTML) return insertedHTML + errorMetaHTML;\n\n          didInjectHeadHTML = true;\n          return buildHeadInjectionHtml(\n            navContext,\n            bootstrapModuleUrl,\n            options?.formState ?? null,\n            insertedHTML + errorMetaHTML,\n            fontHTML,\n            options?.scriptNonce,\n          );\n        };\n\n        // The transform calls this once when it splices after `<head ...>`.\n        // By that point React Fizz has rendered the layout's `<head>` children\n        // (which is where the Script shim registers), so the captured array is\n        // populated. We deliberately return a snapshot — `flushBuffered` will\n        // not re-invoke us, and any beforeInteractive Script that renders\n        // later (inside a Suspense boundary further down the tree) falls back\n        // to its inline location, matching the documented guarantee that\n        // ordering applies to scripts rendered in the initial shell.\n        const getBeforeInteractiveHeadHTML = (): string =>\n          renderBeforeInteractiveInlineScripts(beforeInteractiveInlineScripts);\n\n        return deferUntilStreamConsumed(\n          htmlStream.pipeThrough(\n            createTickBufferedTransform(rscEmbed, getInsertedHTML, getBeforeInteractiveHeadHTML),\n          ),\n          cleanup,\n        );\n      } catch (error) {\n        cleanup();\n        throw error;\n      }\n    });\n  }) as Promise<ReadableStream<Uint8Array>>;\n}\n\nexport default {\n  async fetch(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    // Block protocol-relative URL open redirects (including percent-encoded\n    // variants like /%5Cevil.com/). See request-pipeline.ts for details.\n    if (isOpenRedirectShaped(url.pathname)) {\n      return notFoundResponse();\n    }\n\n    const rscModule = await import.meta.viteRsc.loadModule<{\n      default(request: Request): Promise<Response | string | null | undefined>;\n    }>(\"rsc\", \"index\");\n    const result = await rscModule.default(request);\n\n    if (result instanceof Response) {\n      return result;\n    }\n\n    if (result == null) {\n      return notFoundResponse();\n    }\n\n    return new Response(String(result), { status: 200 });\n  },\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAyDA,MAAM,2BAA2B,+BAA+B;CAC9D,gBAAgB;EACd,OAAO;;CAET,mBAAmB;EACjB,OAAO,WAAW;;CAEpB,eAAe,IAAI,OAAO;EACxB,IAAI,QAAQ,IAAI,aAAa,cAC3B,QAAQ,KAAK,0CAA0C,IAAI,MAAM;;CAGtE,CAAC;AAEF,SAAS,eAAe,OAAuB;CAC7C,IAAI,OAAO;CACX,KAAK,IAAI,IAAI,MAAM,SAAS,GAAG,KAAK,GAAG,KACrC,OAAQ,OAAO,KAAM,MAAM,WAAW,EAAE;CAE1C,QAAQ,SAAS,GAAG,UAAU;;AAGhC,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,iBAAiB,OAAO,OAAO,MAAM;CACzC,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,OAAO,OAAO,UAAU,SAAS,KAAK,MAAM;;AAG9C,SAAS,mBAAmB,kBAA8C;CACxE,IAAI,eAAe;CAEnB,KAAK,MAAM,WAAW,kBACpB,IAAI;EACF,gBAAgB,qBACdA,cAAmB,UAAU,MAAM,QAAqB,CACzD;SACK;CAKV,OAAO;;;;;;;;;;;;;;AAoBT,MAAM,kBAAkB;AAExB,SAAS,qCACP,SACQ;CACR,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,IAAI,OAAO;CACX,KAAK,MAAM,UAAU,SAAS;EAC5B,IAAI,QAAQ;EACZ,IAAI,OAAO,IACT,SAAS,QAAQ,eAAe,OAAO,GAAG,CAAC;EAE7C,SAAS,qBAAqB,OAAO,MAAM;EAC3C,IAAI,OAAO,YACT,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,WAAW,EAAE;GAI5D,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE;GAChC,IAAI,UAAU,MACZ,SAAS,IAAI;QACR,IAAI,OAAO,UAAU,UAC1B,SAAS,IAAI,IAAI,IAAI,eAAe,MAAM,CAAC;;EAIjD,QAAQ,UAAU,MAAM,GAAG,OAAO,UAAU;;CAE9C,OAAO;;AAGT,SAAS,eAAe,UAAqB,OAAwB;CACnE,IAAI,CAAC,UAAU,OAAO;CAEtB,IAAI,WAAW;CACf,MAAM,YAAY,qBAAqB,MAAM;CAE7C,KAAK,MAAM,OAAO,SAAS,SAAS,EAAE,EACpC,YAAY,yBAAyB,UAAU,SAAS,eAAe,IAAI,CAAC;CAG9E,KAAK,MAAM,WAAW,SAAS,YAAY,EAAE,EAC3C,YAAY,sBAAsB,UAAU,SAAS,eAAe,QAAQ,KAAK,CAAC,oBAAoB,eAAe,QAAQ,KAAK,CAAC;CAGrI,IAAI,SAAS,UAAU,SAAS,OAAO,SAAS,GAC9C,YAAY,2BAA2B,UAAU,GAAG,SAAS,OAAO,KAAK,KAAK,CAAC;CAGjF,OAAO;;;;;;;;;;;;;;;;;AAkBT,SAAS,0BAA0B,wBAAqD;CACtF,IAAI,CAAC,wBAAwB,OAAO,KAAA;CAKpC,OADc,uBAAuB,MAAM,6BAC/B,GAAG,MAAM,KAAA;;AAGvB,SAAS,uBAAuB,oBAA6B,OAAwB;CACnF,IAAI,CAAC,oBAAoB,OAAO;CAChC,OAAO,4BAA4B,qBAAqB,MAAM,CAAC,SAAS,eAAe,mBAAmB,CAAC;;AAG7G,SAAS,uBACP,YACA,oBACA,WACA,cACA,UACA,aACQ;CACR,MAAM,aAAa;EACjB,UAAU,YAAY,YAAY;EAClC,cAAc,YAAY,eAAe,CAAC,GAAG,WAAW,aAAa,SAAS,CAAC,GAAG,EAAE;EACrF;CAaD,OAZ0B,sBACxB,yCAAyC,YAAY,UAAU,EAAE,EAAE,WAAW,EAC9E,YAWiB,IARjB,cAAc,OACV,KACA,sBACE,UAAU,kBAAkB,sBAAsB,GAAG,OAAO,kBAAkB,UAAU,EACxF,YACD,IAKL,uBAAuB,oBAAoB,YAAY,GACvD,eACA;;AAIJ,eAAsB,UACpB,WACA,YACA,UACA,SAgBqC;CACrC,OAAO,yBAAyB,YAAY;EAC1C,MAAM,yBAAyB,SAAS;EAExC,IAAI,YACF,qBAAqB,WAAW;EAGlC,yBAAyB;EAEzB,MAAM,gBAAsB;GAC1B,qBAAqB,KAAK;GAC1B,yBAAyB;;EAI3B,OAAO,uBADY,SAAS,cAAc,EAAE,EACF,YAAY;GACpD,IAAI;IAIF,IAAI;IACJ,IAAI;IAEJ,IAAI,SAAS,YAAY;KACvB,YAAY;KACZ,WAAW,wBAAwB,QAAQ,YAAY,SAAS,YAAY;KAC5E,IAAI,QAAQ,oBACV,QAAQ,mBAAmB,QAAQ,SAAS,cAAc;WAEvD;KACL,MAAM,CAAC,IAAI,MAAM,UAAU,KAAK;KAChC,YAAY;KACZ,WAAW,wBAAwB,IAAI,SAAS,YAAY;;IAG9D,IAAI,aAAkD;IAEtD,SAAS,mBAA8B;KACrC,IAAI,CAAC,YACH,aAAa,yBAA0C,UAAU;KAEnE,MAAM,eAAe,IAAI,WAAW;KACpC,MAAM,WAAW,gBAAgB,OAAO,aAAa;KACrD,MAAM,WAAW,gBAAgB,aAAa,SAAS;KACvD,OAAOA,cACL,gBAAgB,UAChB,EAAE,OAAO,UAAU,EACnBA,cAAmB,MAAM,EAAE,IAAI,SAAS,SAAS,CAAC,CACnD;;IAGH,MAAM,oBAAoBA,cAAmB,iBAAiB;IAC9D,MAAM,OAAO,mBACTA,cACE,iBAAiB,UACjB,EAAE,OAAO,mBAAmB,EAC5B,kBACD,GACD;IACJ,MAAM,UAAU,4BACZA,cACE,0BAA0B,UAC1B,EAAE,OAAO,uBAAuB,EAChC,KACD,GACD;IAUJ,MAAM,iCAAkE,EAAE;IAC1E,MAAM,yCACJ,WACS;KACT,+BAA+B,KAAK,OAAO;;IAO7C,MAAM,UAAU,gBALkBA,cAChC,yBAAyB,UACzB,EAAE,OAAO,uCAAuC,EAChD,QAEuD,EAAE,SAAS,YAAY;IAqBhF,MAAM,qBAAqB,0BAA0B,MAHhB,OAAO,KAAK,QAAQ,2BACvD,QACD,CAC2E;IAC5E,MAAM,oBAAoB,2BAA2B,EACnD,UAAU,SAAS,UACpB,CAAC;IAEF,MAAM,aAAa,MAAM,uBAAuB,SAAS;KAgBvD,kBAAkB,qBAAqB,CAAC,mBAAmB,GAAG,KAAA;KAC9D,WAAW,SAAS,aAAa;KACjC,OAAO,SAAS;KAChB,QAAQ,OAAO;MACb,kBAAkB,QAAQ,MAAM;MAEhC,IAAI,SAAS,OAAO,UAAU,YAAY,YAAY,OACpD,OAAO,OAAO,MAAM,OAAO;MAG7B,IAAI,QAAQ,IAAI,aAAa,gBAAgB,OAG3C,OAAO,eAFS,gBAAgB,MAEH,IADf,iBAAiB,QAAS,MAAM,SAAS,KAAM,IACvB;;KAK3C,CAAC;IAMF,IAAI,SAAS,oBAAoB,MAC/B,MAAM,WAAW;IAGnB,MAAM,WAAW,eAAe,UAAU,SAAS,YAAY;IAC/D,IAAI,oBAAoB;IACxB,MAAM,wBAAgC;KACpC,MAAM,eAAe,mBAAmB,0BAA0B,CAAC;KACnE,MAAM,gBAAgB,kBAAkB,OAAO;KAC/C,IAAI,mBAAmB,OAAO,eAAe;KAE7C,oBAAoB;KACpB,OAAO,uBACL,YACA,oBACA,SAAS,aAAa,MACtB,eAAe,eACf,UACA,SAAS,YACV;;IAWH,MAAM,qCACJ,qCAAqC,+BAA+B;IAEtE,OAAO,yBACL,WAAW,YACT,4BAA4B,UAAU,iBAAiB,6BAA6B,CACrF,EACD,QACD;YACM,OAAO;IACd,SAAS;IACT,MAAM;;IAER;GACF;;AAGJ,IAAA,wBAAe,EACb,MAAM,MAAM,SAAqC;CAI/C,IAAI,qBAAqB,IAHT,IAAI,QAAQ,IAGA,CAAC,SAAS,EACpC,OAAO,kBAAkB;CAM3B,MAAM,SAAS,OAAM,MAHG,OAAO,KAAK,QAAQ,WAEzC,OAAO,QAAQ,EACa,QAAQ,QAAQ;CAE/C,IAAI,kBAAkB,UACpB,OAAO;CAGT,IAAI,UAAU,MACZ,OAAO,kBAAkB;CAG3B,OAAO,IAAI,SAAS,OAAO,OAAO,EAAE,EAAE,QAAQ,KAAK,CAAC;GAEvD"}
+{"version":3,"file":"app-ssr-entry.js","names":["createReactElement"],"sources":["../../src/server/app-ssr-entry.ts"],"sourcesContent":["/// <reference types=\"@vitejs/plugin-rsc/types\" />\n\nimport \"./server-globals.js\";\nimport type { ReactNode } from \"react\";\nimport type { ReactFormState } from \"react-dom/client\";\nimport { Fragment, createElement as createReactElement, use } from \"react\";\nimport { createFromReadableStream } from \"@vitejs/plugin-rsc/ssr\";\nimport { renderToReadableStream, renderToStaticMarkup } from \"react-dom/server.edge\";\nimport clientReferences from \"virtual:vite-rsc/client-references\";\nimport type { NavigationContext } from \"vinext/shims/navigation\";\nimport {\n  ServerInsertedHTMLContext,\n  appRouterInstance,\n  clearServerInsertedHTML,\n  renderServerInsertedHTML,\n  setNavigationContext,\n  useServerInsertedHTML,\n} from \"vinext/shims/navigation\";\nimport { runWithNavigationContext } from \"vinext/shims/navigation-state\";\nimport { runWithRootParamsScope, type RootParams } from \"vinext/shims/root-params\";\nimport { isOpenRedirectShaped } from \"./request-pipeline.js\";\nimport { notFoundResponse } from \"./http-error-responses.js\";\nimport { withScriptNonce } from \"vinext/shims/script-nonce-context\";\nimport {\n  BeforeInteractiveContext,\n  type BeforeInteractiveInlineScript,\n} from \"vinext/shims/before-interactive-context\";\nimport {\n  createInlineScriptTag,\n  createNonceAttribute,\n  escapeHtmlAttr,\n  safeJsonStringify,\n} from \"./html.js\";\nimport {\n  createNavigationRuntimeRscMetadataScript,\n  createRscEmbedTransform,\n  createTickBufferedTransform,\n} from \"./app-ssr-stream.js\";\nimport { deferUntilStreamConsumed } from \"./app-page-stream.js\";\nimport { createSsrErrorMetaRenderer } from \"./app-ssr-error-meta.js\";\nimport { getClientTraceMetadataHTML } from \"./client-trace-metadata.js\";\nimport { AppElementsWire, type AppWireElements } from \"./app-elements.js\";\nimport { ElementsContext, Slot } from \"vinext/shims/slot\";\nimport { AppRouterContext } from \"vinext/shims/internal/app-router-context\";\nimport { createClientReferencePreloader } from \"./app-client-reference-preloader.js\";\nimport { RSC_FORM_STATE_GLOBAL } from \"./app-browser-hydration.js\";\n\nexport type FontPreload = {\n  href: string;\n  type: string;\n};\n\nexport type FontData = {\n  links?: string[];\n  styles?: string[];\n  preloads?: FontPreload[];\n};\n\nconst clientReferencePreloader = createClientReferencePreloader({\n  getReferences() {\n    return clientReferences;\n  },\n  getClientRequire() {\n    return globalThis.__vite_rsc_client_require__;\n  },\n  onPreloadError(id, error) {\n    if (process.env.NODE_ENV !== \"production\") {\n      console.warn(\"[vinext] failed to preload client ref:\", id, error);\n    }\n  },\n});\n\nfunction ssrErrorDigest(input: string): string {\n  let hash = 5381;\n  for (let i = input.length - 1; i >= 0; i--) {\n    hash = (hash * 33) ^ input.charCodeAt(i);\n  }\n  return (hash >>> 0).toString();\n}\n\nfunction getErrorMessage(error: unknown): string {\n  if (error instanceof Error) return error.message;\n  if (typeof error === \"string\") return error;\n  return Object.prototype.toString.call(error);\n}\n\nfunction renderInsertedHtml(insertedElements: readonly unknown[]): string {\n  let insertedHTML = \"\";\n\n  for (const element of insertedElements) {\n    try {\n      insertedHTML += renderToStaticMarkup(\n        createReactElement(Fragment, null, element as ReactNode),\n      );\n    } catch {\n      // Ignore individual callback failures so the rest of the page can render.\n    }\n  }\n\n  return insertedHTML;\n}\n\n/**\n * Render captured `<Script strategy=\"beforeInteractive\">` inline scripts to\n * HTML, ready to splice immediately after `<head ...>` opens. Each entry has\n * already had its inline content escaped via `escapeInlineContent(..., \"script\")`\n * inside the Script shim, so this function only quotes the attributes that\n * actually go on the tag (id, nonce, plus the residual passthroughs).\n *\n * Keeping this function colocated with the rest of the head-injection\n * helpers makes it obvious where the boundary is: anything passed through\n * here is being concatenated directly into HTML; treat the inputs\n * accordingly.\n */\n// Conservative subset of the HTML attribute-name grammar. Must start with a\n// letter and contain only letters, digits, underscores, hyphens, or dots —\n// enough to round-trip data-* and standard attributes (`async`, `defer`,\n// `type`, `crossorigin`, etc.) without ever splicing a `\"`/`>`/whitespace\n// into the unquoted *name* position where escaping wouldn't help.\nconst VALID_ATTR_NAME = /^[a-zA-Z][\\w.-]*$/;\n\nfunction renderBeforeInteractiveInlineScripts(\n  scripts: readonly BeforeInteractiveInlineScript[],\n): string {\n  if (scripts.length === 0) return \"\";\n  let html = \"\";\n  for (const script of scripts) {\n    let attrs = \"\";\n    if (script.id) {\n      attrs += ` id=\"${escapeHtmlAttr(script.id)}\"`;\n    }\n    attrs += createNonceAttribute(script.nonce);\n    if (script.attributes) {\n      for (const [key, value] of Object.entries(script.attributes)) {\n        // Attribute *values* go through escapeHtmlAttr below. The *name*\n        // can't be escaped — a malformed key would break the tag — so we\n        // gate at the boundary instead of trying to neutralise it.\n        if (!VALID_ATTR_NAME.test(key)) continue;\n        if (value === true) {\n          attrs += ` ${key}`;\n        } else if (typeof value === \"string\") {\n          attrs += ` ${key}=\"${escapeHtmlAttr(value)}\"`;\n        }\n      }\n    }\n    html += `<script${attrs}>${script.innerHTML}</script>`;\n  }\n  return html;\n}\n\nfunction renderFontHtml(\n  fontData?: FontData,\n  nonce?: string,\n  options: { includeStyles?: boolean } = {},\n): string {\n  if (!fontData) return \"\";\n\n  let fontHTML = \"\";\n  const nonceAttr = createNonceAttribute(nonce);\n  const includeStyles = options.includeStyles ?? true;\n\n  for (const url of fontData.links ?? []) {\n    fontHTML += `<link rel=\"stylesheet\"${nonceAttr} href=\"${escapeHtmlAttr(url)}\" />\\n`;\n  }\n\n  for (const preload of fontData.preloads ?? []) {\n    fontHTML += `<link rel=\"preload\"${nonceAttr} href=\"${escapeHtmlAttr(preload.href)}\" as=\"font\" type=\"${escapeHtmlAttr(preload.type)}\" crossorigin />\\n`;\n  }\n\n  if (includeStyles && fontData.styles && fontData.styles.length > 0) {\n    fontHTML += `<style data-vinext-fonts${nonceAttr}>${fontData.styles.join(\"\\n\")}</style>\\n`;\n  }\n\n  return fontHTML;\n}\n\nfunction hasInlineCssManifest(manifest: Record<string, string> | undefined): boolean {\n  return manifest !== undefined && Object.keys(manifest).length > 0;\n}\n\n/**\n * Extract the bootstrap module URL from the `import(\"...\")` string that\n * `import.meta.viteRsc.loadBootstrapScriptContent(\"index\")` returns.\n *\n * The plugin-rsc helper returns the bootstrap as an inline call so we can\n * inject it via `bootstrapScriptContent`. We instead pass the URL to\n * React's `bootstrapModules` option so a real\n * `<script type=\"module\" src=\"…\">` tag ends up in the streamed HTML —\n * this exposes the URL to anything that reads `script.attribs.src` (e.g.\n * the Next.js asset-prefix fixture test). The same URL also feeds the\n * `<link rel=\"modulepreload\">` we emit ahead of the bootstrap.\n *\n * Returns `undefined` when the helper produced no URL (older plugin-rsc\n * versions, or a custom client entry that disables bootstrap content).\n */\nfunction extractBootstrapModuleUrl(bootstrapScriptContent?: string): string | undefined {\n  if (!bootstrapScriptContent) return undefined;\n  // Accept either quote style — plugin-rsc currently emits double quotes\n  // (`import(\"…\")`) but a future version could switch to single quotes,\n  // and there's no public contract documenting which is used.\n  const match = bootstrapScriptContent.match(/import\\([\"']([^\"']+)[\"']\\)/);\n  return match?.[1] ?? undefined;\n}\n\nfunction buildModulePreloadHtml(bootstrapModuleUrl?: string, nonce?: string): string {\n  if (!bootstrapModuleUrl) return \"\";\n  return `<link rel=\"modulepreload\"${createNonceAttribute(nonce)} href=\"${escapeHtmlAttr(bootstrapModuleUrl)}\" />\\n`;\n}\n\nfunction buildHeadInjectionHtml(\n  navContext: NavigationContext | null,\n  bootstrapModuleUrl: string | undefined,\n  formState: ReactFormState | null,\n  insertedHTML: string,\n  fontHTML: string,\n  scriptNonce?: string,\n): string {\n  const navPayload = {\n    pathname: navContext?.pathname ?? \"/\",\n    searchParams: navContext?.searchParams ? [...navContext.searchParams.entries()] : [],\n  };\n  const rscMetadataScript = createInlineScriptTag(\n    createNavigationRuntimeRscMetadataScript(navContext?.params ?? {}, navPayload),\n    scriptNonce,\n  );\n  const formStateScript =\n    formState === null\n      ? \"\"\n      : createInlineScriptTag(\n          \"self[\" + safeJsonStringify(RSC_FORM_STATE_GLOBAL) + \"]=\" + safeJsonStringify(formState),\n          scriptNonce,\n        );\n\n  return (\n    rscMetadataScript +\n    formStateScript +\n    buildModulePreloadHtml(bootstrapModuleUrl, scriptNonce) +\n    insertedHTML +\n    fontHTML\n  );\n}\n\nexport async function handleSsr(\n  rscStream: ReadableStream<Uint8Array>,\n  navContext: NavigationContext | null,\n  fontData?: FontData,\n  options?: {\n    scriptNonce?: string;\n    /** Pre-split side stream for embed+capture fusion. When provided,\n     *  rscStream is fed directly to createFromReadableStream (no internal tee).\n     *  The embed transform accumulates raw bytes. */\n    sideStream?: ReadableStream<Uint8Array>;\n    /** Out-parameter: filled with accumulated raw RSC bytes when sideStream is consumed. */\n    capturedRscDataRef?: { value: Promise<ArrayBuffer> | null };\n    formState?: ReactFormState | null;\n    basePath?: string;\n    /**\n     * Allow-list of OpenTelemetry propagation keys (from\n     * `experimental.clientTraceMetadata`) to render as `<meta>` tags in the\n     * SSR head. Undefined or empty disables emission entirely.\n     */\n    clientTraceMetadata?: readonly string[];\n    rootParams?: RootParams;\n    /** When true, wait for the full React tree (including Suspense boundaries)\n     *  to resolve before returning the HTML stream. Used for static prerender\n     *  and ISR cache writes to avoid caching fallback content. */\n    waitForAllReady?: boolean;\n  },\n): Promise<ReadableStream<Uint8Array>> {\n  return runWithNavigationContext(async () => {\n    await clientReferencePreloader.preload();\n\n    if (navContext) {\n      setNavigationContext(navContext);\n    }\n\n    clearServerInsertedHTML();\n\n    const cleanup = (): void => {\n      setNavigationContext(null);\n      clearServerInsertedHTML();\n    };\n\n    const rootParams = options?.rootParams ?? {};\n    return runWithRootParamsScope(rootParams, async () => {\n      try {\n        // Fused tee path (#981): caller pre-split the stream. No internal tee needed.\n        // sideStream carries both the embed transform and raw byte accumulation.\n        // rscStream is used directly for createFromReadableStream (SSR).\n        let ssrStream: ReadableStream<Uint8Array>;\n        let rscEmbed;\n\n        if (options?.sideStream) {\n          ssrStream = rscStream;\n          rscEmbed = createRscEmbedTransform(options.sideStream, options?.scriptNonce);\n          if (options.capturedRscDataRef) {\n            options.capturedRscDataRef.value = rscEmbed.getRawBuffer();\n          }\n        } else {\n          const [s1, s2] = rscStream.tee();\n          ssrStream = s1;\n          rscEmbed = createRscEmbedTransform(s2, options?.scriptNonce);\n        }\n\n        let flightRoot: PromiseLike<AppWireElements> | null = null;\n\n        function VinextFlightRoot(): ReactNode {\n          if (!flightRoot) {\n            flightRoot = createFromReadableStream<AppWireElements>(ssrStream);\n          }\n          const wireElements = use(flightRoot);\n          const elements = AppElementsWire.decode(wireElements);\n          const metadata = AppElementsWire.readMetadata(elements);\n          return createReactElement(\n            ElementsContext.Provider,\n            { value: elements },\n            createReactElement(Slot, { id: metadata.routeId }),\n          );\n        }\n\n        const flightRootElement = createReactElement(VinextFlightRoot);\n        const root = AppRouterContext\n          ? createReactElement(\n              AppRouterContext.Provider,\n              { value: appRouterInstance },\n              flightRootElement,\n            )\n          : flightRootElement;\n        const ssrTree = ServerInsertedHTMLContext\n          ? createReactElement(\n              ServerInsertedHTMLContext.Provider,\n              { value: useServerInsertedHTML },\n              root,\n            )\n          : root;\n\n        // Capture inline `<Script strategy=\"beforeInteractive\">` content so the\n        // SSR stream transform can emit it immediately after `<head ...>`\n        // opens — ahead of every React-emitted resource hint. The Script shim\n        // pushes here when it sees an inline beforeInteractive Script and\n        // returns `null` from its render so React does not also serialize the\n        // tag where the user wrote it (where Fizz would push it *after* the\n        // hoisted stylesheets/modulepreloads). See\n        // packages/vinext/src/shims/script.tsx for the capture side.\n        const beforeInteractiveInlineScripts: BeforeInteractiveInlineScript[] = [];\n        const registerBeforeInteractiveInlineScript = (\n          script: BeforeInteractiveInlineScript,\n        ): void => {\n          beforeInteractiveInlineScripts.push(script);\n        };\n        const treeWithBeforeInteractive = createReactElement(\n          BeforeInteractiveContext.Provider,\n          { value: registerBeforeInteractiveInlineScript },\n          ssrTree,\n        );\n        const ssrRoot = withScriptNonce(treeWithBeforeInteractive, options?.scriptNonce);\n\n        // plugin-rsc returns the bootstrap as `import(\"<url>\")` so callers can\n        // inject it via `bootstrapScriptContent`. We hand the URL to React's\n        // `bootstrapModules` option instead so the streamed HTML contains a\n        // real `<script type=\"module\" src=\"<url>\">` tag — exposing the URL\n        // to anything that inspects `script.attribs.src` (e.g. the Next.js\n        // asset-prefix fixture test \"bundles should return 200 on served\n        // assetPrefix\"). Mirrors Next.js's app-render path which passes\n        // `bootstrapScripts: [{ src }]` for the same reason; we use\n        // `bootstrapModules` because vinext's chunks are native ES modules\n        // (Vite output) so a `type=\"module\"` tag is the correct loader.\n        //\n        // In dev, `<url>` is a Vite dev URL like\n        // `/@id/__x00__virtual:vinext-app-browser-entry`; the browser fetches\n        // it as a module from the dev server. In prod it's the hashed bundle\n        // URL (e.g. `/_next/static/index-abc123.js`, optionally prefixed by\n        // `assetPrefix`). Both are valid `<script type=\"module\" src=…>` targets.\n        const bootstrapScriptContent = await import.meta.viteRsc.loadBootstrapScriptContent(\n          \"index\",\n        );\n        const bootstrapModuleUrl = extractBootstrapModuleUrl(bootstrapScriptContent);\n        const errorMetaRenderer = createSsrErrorMetaRenderer({\n          basePath: options?.basePath,\n        });\n\n        const htmlStream = await renderToReadableStream(ssrRoot, {\n          // `bootstrapScriptContent` was previously how vinext injected the\n          // dynamic-import call. `bootstrapModules` performs the same work\n          // natively (and exposes the URL in the DOM), so passing both would\n          // load the bootstrap module twice.\n          //\n          // CSP implications of using `bootstrapModules` instead of inline\n          // `bootstrapScriptContent`:\n          //  - Apps no longer need `script-src 'unsafe-inline'` to load the\n          //    bootstrap (improvement — inline imports required `'unsafe-inline'`).\n          //  - Apps that restrict script sources need `'self'` for the\n          //    common case, or the CDN origin when `assetPrefix` is an\n          //    absolute URL like `https://cdn.example.com`.\n          //  - React still applies `nonce` to the emitted\n          //    `<script type=\"module\" src=…>` tag, so nonce-based CSP\n          //    (`script-src 'nonce-…' 'strict-dynamic'`) keeps working.\n          bootstrapModules: bootstrapModuleUrl ? [bootstrapModuleUrl] : undefined,\n          formState: options?.formState ?? null,\n          nonce: options?.scriptNonce,\n          onError(error) {\n            errorMetaRenderer.capture(error);\n\n            if (error && typeof error === \"object\" && \"digest\" in error) {\n              return String(error.digest);\n            }\n\n            if (process.env.NODE_ENV === \"production\" && error) {\n              const message = getErrorMessage(error);\n              const stack = error instanceof Error ? (error.stack ?? \"\") : \"\";\n              return ssrErrorDigest(message + stack);\n            }\n\n            return undefined;\n          },\n        });\n\n        // When producing static output (prerender / ISR cache writes), wait for\n        // the full React tree to resolve before emitting bytes. This prevents\n        // Suspense fallback content from being serialized to the cache.\n        // Matches Next.js waitForAllReady forkpoint in renderToNodeFizzStream.\n        if (options?.waitForAllReady === true) {\n          await htmlStream.allReady;\n        }\n\n        // Populated before any SSR request runs: at prod-server startup\n        // (prod-server.ts) or via build-time bundle injection (index.ts). Left\n        // undefined in dev, which naturally disables inline CSS there.\n        const inlineCssManifest = globalThis.__VINEXT_INLINE_CSS__;\n        const fontStyles = fontData?.styles ?? [];\n        const mergeFontStylesIntoInlineCss =\n          fontStyles.length > 0 && hasInlineCssManifest(inlineCssManifest);\n        const inlineCssFontStyles = mergeFontStylesIntoInlineCss ? fontStyles.join(\"\\n\") : \"\";\n        const inlineCssFontStyleFallbackHTML = mergeFontStylesIntoInlineCss\n          ? renderFontHtml({ styles: fontStyles }, options?.scriptNonce)\n          : \"\";\n        const fontHTML = renderFontHtml(fontData, options?.scriptNonce, {\n          includeStyles: !mergeFontStylesIntoInlineCss,\n        });\n        // Trace meta tags only need to land in the document head once.\n        // Read the active OTel context lazily so the value reflects the\n        // span that was active when the SSR shell rendered. When\n        // clientTraceMetadata is unset (the common case) this is empty.\n        let traceMetaHTML: string | null = null;\n        const getTraceMetaHTML = (): string => {\n          if (traceMetaHTML === null) {\n            traceMetaHTML = getClientTraceMetadataHTML(options?.clientTraceMetadata);\n          }\n          return traceMetaHTML;\n        };\n        let didInjectHeadHTML = false;\n        const getInsertedHTML = (): string => {\n          const insertedHTML = renderInsertedHtml(renderServerInsertedHTML());\n          const errorMetaHTML = errorMetaRenderer.flush();\n          if (didInjectHeadHTML) return insertedHTML + errorMetaHTML;\n\n          didInjectHeadHTML = true;\n          return buildHeadInjectionHtml(\n            navContext,\n            bootstrapModuleUrl,\n            options?.formState ?? null,\n            insertedHTML + errorMetaHTML + getTraceMetaHTML(),\n            fontHTML,\n            options?.scriptNonce,\n          );\n        };\n\n        // The transform calls this once when it splices after `<head ...>`.\n        // By that point React Fizz has rendered the layout's `<head>` children\n        // (which is where the Script shim registers), so the captured array is\n        // populated. We deliberately return a snapshot — `flushBuffered` will\n        // not re-invoke us, and any beforeInteractive Script that renders\n        // later (inside a Suspense boundary further down the tree) falls back\n        // to its inline location, matching the documented guarantee that\n        // ordering applies to scripts rendered in the initial shell.\n        const getBeforeInteractiveHeadHTML = (): string =>\n          renderBeforeInteractiveInlineScripts(beforeInteractiveInlineScripts);\n\n        return deferUntilStreamConsumed(\n          htmlStream.pipeThrough(\n            createTickBufferedTransform(\n              rscEmbed,\n              getInsertedHTML,\n              getBeforeInteractiveHeadHTML,\n              inlineCssManifest,\n              inlineCssFontStyles,\n              inlineCssFontStyleFallbackHTML,\n              options?.scriptNonce,\n            ),\n          ),\n          cleanup,\n        );\n      } catch (error) {\n        cleanup();\n        throw error;\n      }\n    });\n  }) as Promise<ReadableStream<Uint8Array>>;\n}\n\nexport default {\n  async fetch(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    // Block protocol-relative URL open redirects (including percent-encoded\n    // variants like /%5Cevil.com/). See request-pipeline.ts for details.\n    if (isOpenRedirectShaped(url.pathname)) {\n      return notFoundResponse();\n    }\n\n    const rscModule = await import.meta.viteRsc.loadModule<{\n      default(request: Request): Promise<Response | string | null | undefined>;\n    }>(\"rsc\", \"index\");\n    const result = await rscModule.default(request);\n\n    if (result instanceof Response) {\n      return result;\n    }\n\n    if (result == null) {\n      return notFoundResponse();\n    }\n\n    return new Response(String(result), { status: 200 });\n  },\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA0DA,MAAM,2BAA2B,+BAA+B;CAC9D,gBAAgB;EACd,OAAO;;CAET,mBAAmB;EACjB,OAAO,WAAW;;CAEpB,eAAe,IAAI,OAAO;EACxB,IAAI,QAAQ,IAAI,aAAa,cAC3B,QAAQ,KAAK,0CAA0C,IAAI,MAAM;;CAGtE,CAAC;AAEF,SAAS,eAAe,OAAuB;CAC7C,IAAI,OAAO;CACX,KAAK,IAAI,IAAI,MAAM,SAAS,GAAG,KAAK,GAAG,KACrC,OAAQ,OAAO,KAAM,MAAM,WAAW,EAAE;CAE1C,QAAQ,SAAS,GAAG,UAAU;;AAGhC,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,iBAAiB,OAAO,OAAO,MAAM;CACzC,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,OAAO,OAAO,UAAU,SAAS,KAAK,MAAM;;AAG9C,SAAS,mBAAmB,kBAA8C;CACxE,IAAI,eAAe;CAEnB,KAAK,MAAM,WAAW,kBACpB,IAAI;EACF,gBAAgB,qBACdA,cAAmB,UAAU,MAAM,QAAqB,CACzD;SACK;CAKV,OAAO;;;;;;;;;;;;;;AAoBT,MAAM,kBAAkB;AAExB,SAAS,qCACP,SACQ;CACR,IAAI,QAAQ,WAAW,GAAG,OAAO;CACjC,IAAI,OAAO;CACX,KAAK,MAAM,UAAU,SAAS;EAC5B,IAAI,QAAQ;EACZ,IAAI,OAAO,IACT,SAAS,QAAQ,eAAe,OAAO,GAAG,CAAC;EAE7C,SAAS,qBAAqB,OAAO,MAAM;EAC3C,IAAI,OAAO,YACT,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,WAAW,EAAE;GAI5D,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE;GAChC,IAAI,UAAU,MACZ,SAAS,IAAI;QACR,IAAI,OAAO,UAAU,UAC1B,SAAS,IAAI,IAAI,IAAI,eAAe,MAAM,CAAC;;EAIjD,QAAQ,UAAU,MAAM,GAAG,OAAO,UAAU;;CAE9C,OAAO;;AAGT,SAAS,eACP,UACA,OACA,UAAuC,EAAE,EACjC;CACR,IAAI,CAAC,UAAU,OAAO;CAEtB,IAAI,WAAW;CACf,MAAM,YAAY,qBAAqB,MAAM;CAC7C,MAAM,gBAAgB,QAAQ,iBAAiB;CAE/C,KAAK,MAAM,OAAO,SAAS,SAAS,EAAE,EACpC,YAAY,yBAAyB,UAAU,SAAS,eAAe,IAAI,CAAC;CAG9E,KAAK,MAAM,WAAW,SAAS,YAAY,EAAE,EAC3C,YAAY,sBAAsB,UAAU,SAAS,eAAe,QAAQ,KAAK,CAAC,oBAAoB,eAAe,QAAQ,KAAK,CAAC;CAGrI,IAAI,iBAAiB,SAAS,UAAU,SAAS,OAAO,SAAS,GAC/D,YAAY,2BAA2B,UAAU,GAAG,SAAS,OAAO,KAAK,KAAK,CAAC;CAGjF,OAAO;;AAGT,SAAS,qBAAqB,UAAuD;CACnF,OAAO,aAAa,KAAA,KAAa,OAAO,KAAK,SAAS,CAAC,SAAS;;;;;;;;;;;;;;;;;AAkBlE,SAAS,0BAA0B,wBAAqD;CACtF,IAAI,CAAC,wBAAwB,OAAO,KAAA;CAKpC,OADc,uBAAuB,MAAM,6BAC/B,GAAG,MAAM,KAAA;;AAGvB,SAAS,uBAAuB,oBAA6B,OAAwB;CACnF,IAAI,CAAC,oBAAoB,OAAO;CAChC,OAAO,4BAA4B,qBAAqB,MAAM,CAAC,SAAS,eAAe,mBAAmB,CAAC;;AAG7G,SAAS,uBACP,YACA,oBACA,WACA,cACA,UACA,aACQ;CACR,MAAM,aAAa;EACjB,UAAU,YAAY,YAAY;EAClC,cAAc,YAAY,eAAe,CAAC,GAAG,WAAW,aAAa,SAAS,CAAC,GAAG,EAAE;EACrF;CAaD,OAZ0B,sBACxB,yCAAyC,YAAY,UAAU,EAAE,EAAE,WAAW,EAC9E,YAWiB,IARjB,cAAc,OACV,KACA,sBACE,UAAU,kBAAkB,sBAAsB,GAAG,OAAO,kBAAkB,UAAU,EACxF,YACD,IAKL,uBAAuB,oBAAoB,YAAY,GACvD,eACA;;AAIJ,eAAsB,UACpB,WACA,YACA,UACA,SAsBqC;CACrC,OAAO,yBAAyB,YAAY;EAC1C,MAAM,yBAAyB,SAAS;EAExC,IAAI,YACF,qBAAqB,WAAW;EAGlC,yBAAyB;EAEzB,MAAM,gBAAsB;GAC1B,qBAAqB,KAAK;GAC1B,yBAAyB;;EAI3B,OAAO,uBADY,SAAS,cAAc,EAAE,EACF,YAAY;GACpD,IAAI;IAIF,IAAI;IACJ,IAAI;IAEJ,IAAI,SAAS,YAAY;KACvB,YAAY;KACZ,WAAW,wBAAwB,QAAQ,YAAY,SAAS,YAAY;KAC5E,IAAI,QAAQ,oBACV,QAAQ,mBAAmB,QAAQ,SAAS,cAAc;WAEvD;KACL,MAAM,CAAC,IAAI,MAAM,UAAU,KAAK;KAChC,YAAY;KACZ,WAAW,wBAAwB,IAAI,SAAS,YAAY;;IAG9D,IAAI,aAAkD;IAEtD,SAAS,mBAA8B;KACrC,IAAI,CAAC,YACH,aAAa,yBAA0C,UAAU;KAEnE,MAAM,eAAe,IAAI,WAAW;KACpC,MAAM,WAAW,gBAAgB,OAAO,aAAa;KACrD,MAAM,WAAW,gBAAgB,aAAa,SAAS;KACvD,OAAOA,cACL,gBAAgB,UAChB,EAAE,OAAO,UAAU,EACnBA,cAAmB,MAAM,EAAE,IAAI,SAAS,SAAS,CAAC,CACnD;;IAGH,MAAM,oBAAoBA,cAAmB,iBAAiB;IAC9D,MAAM,OAAO,mBACTA,cACE,iBAAiB,UACjB,EAAE,OAAO,mBAAmB,EAC5B,kBACD,GACD;IACJ,MAAM,UAAU,4BACZA,cACE,0BAA0B,UAC1B,EAAE,OAAO,uBAAuB,EAChC,KACD,GACD;IAUJ,MAAM,iCAAkE,EAAE;IAC1E,MAAM,yCACJ,WACS;KACT,+BAA+B,KAAK,OAAO;;IAO7C,MAAM,UAAU,gBALkBA,cAChC,yBAAyB,UACzB,EAAE,OAAO,uCAAuC,EAChD,QAEuD,EAAE,SAAS,YAAY;IAqBhF,MAAM,qBAAqB,0BAA0B,MAHhB,OAAO,KAAK,QAAQ,2BACvD,QACD,CAC2E;IAC5E,MAAM,oBAAoB,2BAA2B,EACnD,UAAU,SAAS,UACpB,CAAC;IAEF,MAAM,aAAa,MAAM,uBAAuB,SAAS;KAgBvD,kBAAkB,qBAAqB,CAAC,mBAAmB,GAAG,KAAA;KAC9D,WAAW,SAAS,aAAa;KACjC,OAAO,SAAS;KAChB,QAAQ,OAAO;MACb,kBAAkB,QAAQ,MAAM;MAEhC,IAAI,SAAS,OAAO,UAAU,YAAY,YAAY,OACpD,OAAO,OAAO,MAAM,OAAO;MAG7B,IAAI,QAAQ,IAAI,aAAa,gBAAgB,OAG3C,OAAO,eAFS,gBAAgB,MAEH,IADf,iBAAiB,QAAS,MAAM,SAAS,KAAM,IACvB;;KAK3C,CAAC;IAMF,IAAI,SAAS,oBAAoB,MAC/B,MAAM,WAAW;IAMnB,MAAM,oBAAoB,WAAW;IACrC,MAAM,aAAa,UAAU,UAAU,EAAE;IACzC,MAAM,+BACJ,WAAW,SAAS,KAAK,qBAAqB,kBAAkB;IAClE,MAAM,sBAAsB,+BAA+B,WAAW,KAAK,KAAK,GAAG;IACnF,MAAM,iCAAiC,+BACnC,eAAe,EAAE,QAAQ,YAAY,EAAE,SAAS,YAAY,GAC5D;IACJ,MAAM,WAAW,eAAe,UAAU,SAAS,aAAa,EAC9D,eAAe,CAAC,8BACjB,CAAC;IAKF,IAAI,gBAA+B;IACnC,MAAM,yBAAiC;KACrC,IAAI,kBAAkB,MACpB,gBAAgB,2BAA2B,SAAS,oBAAoB;KAE1E,OAAO;;IAET,IAAI,oBAAoB;IACxB,MAAM,wBAAgC;KACpC,MAAM,eAAe,mBAAmB,0BAA0B,CAAC;KACnE,MAAM,gBAAgB,kBAAkB,OAAO;KAC/C,IAAI,mBAAmB,OAAO,eAAe;KAE7C,oBAAoB;KACpB,OAAO,uBACL,YACA,oBACA,SAAS,aAAa,MACtB,eAAe,gBAAgB,kBAAkB,EACjD,UACA,SAAS,YACV;;IAWH,MAAM,qCACJ,qCAAqC,+BAA+B;IAEtE,OAAO,yBACL,WAAW,YACT,4BACE,UACA,iBACA,8BACA,mBACA,qBACA,gCACA,SAAS,YACV,CACF,EACD,QACD;YACM,OAAO;IACd,SAAS;IACT,MAAM;;IAER;GACF;;AAGJ,IAAA,wBAAe,EACb,MAAM,MAAM,SAAqC;CAI/C,IAAI,qBAAqB,IAHT,IAAI,QAAQ,IAGA,CAAC,SAAS,EACpC,OAAO,kBAAkB;CAM3B,MAAM,SAAS,OAAM,MAHG,OAAO,KAAK,QAAQ,WAEzC,OAAO,QAAQ,EACa,QAAQ,QAAQ;CAE/C,IAAI,kBAAkB,UACpB,OAAO;CAGT,IAAI,UAAU,MACZ,OAAO,kBAAkB;CAG3B,OAAO,IAAI,SAAS,OAAO,OAAO,EAAE,EAAE,QAAQ,KAAK,CAAC;GAEvD"}

package/dist/server/app-ssr-error-meta.js

@@ -14,15 +14,15 @@ function renderSsrErrorMetaTag(error, options) {
 	const digest = getNextErrorDigest(error);
 	if (!digest) return "";
 	if (parseNextHttpErrorDigest(digest)) {
-		let html = "<meta name=\"robots\" content=\"noindex\" />";
-		if ((options.nodeEnv ?? process.env.NODE_ENV) === "development") html += "<meta name=\"next-error\" content=\"not-found\" />";
+		let html = "<meta name=\"robots\" content=\"noindex\"/>";
+		if ((options.nodeEnv ?? process.env.NODE_ENV) === "development") html += "<meta name=\"next-error\" content=\"not-found\"/>";
 		return html;
 	}
 	const redirect = parseNextRedirectDigest(digest);
 	if (!redirect) return "";
 	const delay = redirect.status === PERMANENT_REDIRECT_STATUS ? 0 : 1;
 	const location = prefixRedirectLocation(redirect.url, options.basePath);
-	return "<meta id=\"__next-page-redirect\" http-equiv=\"refresh\" content=\"" + delay + ";url=" + escapeHtmlAttr(location) + "\" />";
+	return "<meta id=\"__next-page-redirect\" http-equiv=\"refresh\" content=\"" + delay + ";url=" + escapeHtmlAttr(location) + "\"/>";
 }
 function renderSsrErrorMetaTags(errors, options = {}) {
 	let html = "";

package/dist/server/app-ssr-error-meta.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-ssr-error-meta.js","names":[],"sources":["../../src/server/app-ssr-error-meta.ts"],"sourcesContent":["import { addBasePathToPathname } from \"../utils/base-path.js\";\nimport { escapeHtmlAttr } from \"./html.js\";\nimport {\n  getNextErrorDigest,\n  parseNextHttpErrorDigest,\n  parseNextRedirectDigest,\n} from \"./next-error-digest.js\";\n\ntype SsrErrorMetaRenderOptions = {\n  basePath?: string;\n  nodeEnv?: string;\n};\n\ntype SsrErrorMetaRenderer = {\n  capture: (error: unknown) => void;\n  flush: () => string;\n};\n\nconst PERMANENT_REDIRECT_STATUS = 308;\n\nfunction prefixRedirectLocation(location: string, basePath?: string): string {\n  if (!basePath || !location.startsWith(\"/\")) {\n    return location;\n  }\n\n  const hashIndex = location.indexOf(\"#\");\n  const queryIndex = location.indexOf(\"?\");\n  const pathnameEnd =\n    queryIndex === -1\n      ? hashIndex === -1\n        ? location.length\n        : hashIndex\n      : hashIndex === -1\n        ? queryIndex\n        : Math.min(queryIndex, hashIndex);\n  const pathname = location.slice(0, pathnameEnd);\n\n  return addBasePathToPathname(pathname, basePath) + location.slice(pathnameEnd);\n}\n\nfunction renderSsrErrorMetaTag(error: unknown, options: SsrErrorMetaRenderOptions): string {\n  const digest = getNextErrorDigest(error);\n  if (!digest) return \"\";\n\n  const httpError = parseNextHttpErrorDigest(digest);\n  if (httpError) {\n    let html = '<meta name=\"robots\" content=\"noindex\" />';\n    if ((options.nodeEnv ?? process.env.NODE_ENV) === \"development\") {\n      html += '<meta name=\"next-error\" content=\"not-found\" />';\n    }\n    return html;\n  }\n\n  const redirect = parseNextRedirectDigest(digest);\n  if (!redirect) return \"\";\n\n  const delay = redirect.status === PERMANENT_REDIRECT_STATUS ? 0 : 1;\n  const location = prefixRedirectLocation(redirect.url, options.basePath);\n  return (\n    '<meta id=\"__next-page-redirect\" http-equiv=\"refresh\" content=\"' +\n    delay +\n    \";url=\" +\n    escapeHtmlAttr(location) +\n    '\" />'\n  );\n}\n\nexport function renderSsrErrorMetaTags(\n  errors: readonly unknown[],\n  options: SsrErrorMetaRenderOptions = {},\n): string {\n  let html = \"\";\n\n  for (const error of errors) {\n    html += renderSsrErrorMetaTag(error, options);\n  }\n\n  return html;\n}\n\nexport function createSsrErrorMetaRenderer(\n  options: SsrErrorMetaRenderOptions = {},\n): SsrErrorMetaRenderer {\n  const capturedErrors: unknown[] = [];\n  let flushedUntil = 0;\n\n  return {\n    capture(error) {\n      capturedErrors.push(error);\n    },\n    flush() {\n      if (flushedUntil >= capturedErrors.length) return \"\";\n\n      const html = renderSsrErrorMetaTags(capturedErrors.slice(flushedUntil), options);\n      flushedUntil = capturedErrors.length;\n      return html;\n    },\n  };\n}\n"],"mappings":";;;;AAkBA,MAAM,4BAA4B;AAElC,SAAS,uBAAuB,UAAkB,UAA2B;CAC3E,IAAI,CAAC,YAAY,CAAC,SAAS,WAAW,IAAI,EACxC,OAAO;CAGT,MAAM,YAAY,SAAS,QAAQ,IAAI;CACvC,MAAM,aAAa,SAAS,QAAQ,IAAI;CACxC,MAAM,cACJ,eAAe,KACX,cAAc,KACZ,SAAS,SACT,YACF,cAAc,KACZ,aACA,KAAK,IAAI,YAAY,UAAU;CAGvC,OAAO,sBAFU,SAAS,MAAM,GAAG,YAEE,EAAE,SAAS,GAAG,SAAS,MAAM,YAAY;;AAGhF,SAAS,sBAAsB,OAAgB,SAA4C;CACzF,MAAM,SAAS,mBAAmB,MAAM;CACxC,IAAI,CAAC,QAAQ,OAAO;CAGpB,IADkB,yBAAyB,OAC9B,EAAE;EACb,IAAI,OAAO;EACX,KAAK,QAAQ,WAAW,QAAQ,IAAI,cAAc,eAChD,QAAQ;EAEV,OAAO;;CAGT,MAAM,WAAW,wBAAwB,OAAO;CAChD,IAAI,CAAC,UAAU,OAAO;CAEtB,MAAM,QAAQ,SAAS,WAAW,4BAA4B,IAAI;CAClE,MAAM,WAAW,uBAAuB,SAAS,KAAK,QAAQ,SAAS;CACvE,OACE,wEACA,QACA,UACA,eAAe,SAAS,GACxB;;AAIJ,SAAgB,uBACd,QACA,UAAqC,EAAE,EAC/B;CACR,IAAI,OAAO;CAEX,KAAK,MAAM,SAAS,QAClB,QAAQ,sBAAsB,OAAO,QAAQ;CAG/C,OAAO;;AAGT,SAAgB,2BACd,UAAqC,EAAE,EACjB;CACtB,MAAM,iBAA4B,EAAE;CACpC,IAAI,eAAe;CAEnB,OAAO;EACL,QAAQ,OAAO;GACb,eAAe,KAAK,MAAM;;EAE5B,QAAQ;GACN,IAAI,gBAAgB,eAAe,QAAQ,OAAO;GAElD,MAAM,OAAO,uBAAuB,eAAe,MAAM,aAAa,EAAE,QAAQ;GAChF,eAAe,eAAe;GAC9B,OAAO;;EAEV"}
+{"version":3,"file":"app-ssr-error-meta.js","names":[],"sources":["../../src/server/app-ssr-error-meta.ts"],"sourcesContent":["import { addBasePathToPathname } from \"../utils/base-path.js\";\nimport { escapeHtmlAttr } from \"./html.js\";\nimport {\n  getNextErrorDigest,\n  parseNextHttpErrorDigest,\n  parseNextRedirectDigest,\n} from \"./next-error-digest.js\";\n\ntype SsrErrorMetaRenderOptions = {\n  basePath?: string;\n  nodeEnv?: string;\n};\n\ntype SsrErrorMetaRenderer = {\n  capture: (error: unknown) => void;\n  flush: () => string;\n};\n\nconst PERMANENT_REDIRECT_STATUS = 308;\n\nfunction prefixRedirectLocation(location: string, basePath?: string): string {\n  if (!basePath || !location.startsWith(\"/\")) {\n    return location;\n  }\n\n  const hashIndex = location.indexOf(\"#\");\n  const queryIndex = location.indexOf(\"?\");\n  const pathnameEnd =\n    queryIndex === -1\n      ? hashIndex === -1\n        ? location.length\n        : hashIndex\n      : hashIndex === -1\n        ? queryIndex\n        : Math.min(queryIndex, hashIndex);\n  const pathname = location.slice(0, pathnameEnd);\n\n  return addBasePathToPathname(pathname, basePath) + location.slice(pathnameEnd);\n}\n\nfunction renderSsrErrorMetaTag(error: unknown, options: SsrErrorMetaRenderOptions): string {\n  const digest = getNextErrorDigest(error);\n  if (!digest) return \"\";\n\n  const httpError = parseNextHttpErrorDigest(digest);\n  if (httpError) {\n    // Output format matches Next.js's `make-get-server-inserted-html.tsx`,\n    // which serializes these meta tags via React's HTML renderer. React's\n    // void-element output uses no space before `/>`, and Next.js tests assert\n    // on that exact substring (e.g. `'<meta name=\"robots\" content=\"noindex\"/>'`).\n    // https://github.com/vercel/next.js/blob/canary/packages/next/src/server/app-render/make-get-server-inserted-html.tsx\n    let html = '<meta name=\"robots\" content=\"noindex\"/>';\n    if ((options.nodeEnv ?? process.env.NODE_ENV) === \"development\") {\n      html += '<meta name=\"next-error\" content=\"not-found\"/>';\n    }\n    return html;\n  }\n\n  const redirect = parseNextRedirectDigest(digest);\n  if (!redirect) return \"\";\n\n  const delay = redirect.status === PERMANENT_REDIRECT_STATUS ? 0 : 1;\n  const location = prefixRedirectLocation(redirect.url, options.basePath);\n  return (\n    '<meta id=\"__next-page-redirect\" http-equiv=\"refresh\" content=\"' +\n    delay +\n    \";url=\" +\n    escapeHtmlAttr(location) +\n    '\"/>'\n  );\n}\n\nexport function renderSsrErrorMetaTags(\n  errors: readonly unknown[],\n  options: SsrErrorMetaRenderOptions = {},\n): string {\n  let html = \"\";\n\n  for (const error of errors) {\n    html += renderSsrErrorMetaTag(error, options);\n  }\n\n  return html;\n}\n\nexport function createSsrErrorMetaRenderer(\n  options: SsrErrorMetaRenderOptions = {},\n): SsrErrorMetaRenderer {\n  const capturedErrors: unknown[] = [];\n  let flushedUntil = 0;\n\n  return {\n    capture(error) {\n      capturedErrors.push(error);\n    },\n    flush() {\n      if (flushedUntil >= capturedErrors.length) return \"\";\n\n      const html = renderSsrErrorMetaTags(capturedErrors.slice(flushedUntil), options);\n      flushedUntil = capturedErrors.length;\n      return html;\n    },\n  };\n}\n"],"mappings":";;;;AAkBA,MAAM,4BAA4B;AAElC,SAAS,uBAAuB,UAAkB,UAA2B;CAC3E,IAAI,CAAC,YAAY,CAAC,SAAS,WAAW,IAAI,EACxC,OAAO;CAGT,MAAM,YAAY,SAAS,QAAQ,IAAI;CACvC,MAAM,aAAa,SAAS,QAAQ,IAAI;CACxC,MAAM,cACJ,eAAe,KACX,cAAc,KACZ,SAAS,SACT,YACF,cAAc,KACZ,aACA,KAAK,IAAI,YAAY,UAAU;CAGvC,OAAO,sBAFU,SAAS,MAAM,GAAG,YAEE,EAAE,SAAS,GAAG,SAAS,MAAM,YAAY;;AAGhF,SAAS,sBAAsB,OAAgB,SAA4C;CACzF,MAAM,SAAS,mBAAmB,MAAM;CACxC,IAAI,CAAC,QAAQ,OAAO;CAGpB,IADkB,yBAAyB,OAC9B,EAAE;EAMb,IAAI,OAAO;EACX,KAAK,QAAQ,WAAW,QAAQ,IAAI,cAAc,eAChD,QAAQ;EAEV,OAAO;;CAGT,MAAM,WAAW,wBAAwB,OAAO;CAChD,IAAI,CAAC,UAAU,OAAO;CAEtB,MAAM,QAAQ,SAAS,WAAW,4BAA4B,IAAI;CAClE,MAAM,WAAW,uBAAuB,SAAS,KAAK,QAAQ,SAAS;CACvE,OACE,wEACA,QACA,UACA,eAAe,SAAS,GACxB;;AAIJ,SAAgB,uBACd,QACA,UAAqC,EAAE,EAC/B;CACR,IAAI,OAAO;CAEX,KAAK,MAAM,SAAS,QAClB,QAAQ,sBAAsB,OAAO,QAAQ;CAG/C,OAAO;;AAGT,SAAgB,2BACd,UAAqC,EAAE,EACjB;CACtB,MAAM,iBAA4B,EAAE;CACpC,IAAI,eAAe;CAEnB,OAAO;EACL,QAAQ,OAAO;GACb,eAAe,KAAK,MAAM;;EAE5B,QAAQ;GACN,IAAI,gBAAgB,eAAe,QAAQ,OAAO;GAElD,MAAM,OAAO,uBAAuB,eAAe,MAAM,aAAa,EAAE,QAAQ;GAChF,eAAe,eAAe;GAC9B,OAAO;;EAEV"}

package/dist/server/app-ssr-stream.d.ts

@@ -5,6 +5,7 @@ type RscEmbedTransform = {
   getRawBuffer(): Promise<ArrayBuffer>;
 };
 type HtmlInsertion = string | (() => string);
+type InlineCssManifest = Record<string, string>;
 declare function navigationRuntimeRscBootstrapExpression(): string;
 declare function createNavigationRuntimeRscMetadataScript(params: Record<string, string | string[]>, nav: {
   pathname: string;
@@ -54,7 +55,7 @@ declare function fixPreloadAs(html: string): string;
  *    to no-op and let the user-rendered Script (in its source-order
  *    position) ship as-is.
  */
-declare function createTickBufferedTransform(rscEmbed: RscEmbedTransform, injectHTML?: HtmlInsertion, injectAfterHeadOpenHTML?: HtmlInsertion): TransformStream<Uint8Array, Uint8Array>;
+declare function createTickBufferedTransform(rscEmbed: RscEmbedTransform, injectHTML?: HtmlInsertion, injectAfterHeadOpenHTML?: HtmlInsertion, inlineCssManifest?: InlineCssManifest, inlineCssPrependCss?: string, inlineCssPrependFallbackHTML?: string, inlineCssScriptNonce?: string): TransformStream<Uint8Array, Uint8Array>;
 //#endregion
 export { createNavigationRuntimeRscMetadataScript, createRscEmbedTransform, createTickBufferedTransform, fixFlightHints, fixPreloadAs, navigationRuntimeRscBootstrapExpression };
 //# sourceMappingURL=app-ssr-stream.d.ts.map

package/dist/server/app-ssr-stream.js

@@ -1,5 +1,5 @@
 import { NAVIGATION_RUNTIME_SYMBOL_DESCRIPTION } from "../client/navigation-runtime.js";
-import { createInlineScriptTag, safeJsonStringify } from "./html.js";
+import { createInlineScriptTag, escapeHtmlAttr, htmlTokenListContains, safeJsonStringify } from "./html.js";
 import { bytesToBase64, concatUint8Arrays } from "./app-rsc-embedded-chunks.js";
 //#region src/server/app-ssr-stream.ts
 const NAVIGATION_RUNTIME_REFERENCE = `self[Symbol.for(${safeJsonStringify(NAVIGATION_RUNTIME_SYMBOL_DESCRIPTION)})]`;
@@ -86,6 +86,130 @@ function createRscEmbedTransform(embedStream, scriptNonce) {
 function fixPreloadAs(html) {
 	return html.replace(/<link(?=[^>]*\srel="preload")[^>]*>/g, (tag) => tag.replace(" as=\"stylesheet\"", " as=\"style\""));
 }
+const LINK_TAG_RE = /<link\b[^>]*>/gi;
+const HTML_REWRITE_EXCLUDED_REGION_RE = /<!--[\s\S]*?-->|<(script|style|textarea|title)\b[^>]*>[\s\S]*?<\/\1\s*>/gi;
+const HTML_REWRITE_EXCLUDED_REGION_START_RE = /<!--|<(script|style|textarea|title)\b[^>]*>/gi;
+function getHtmlAttribute(tag, name) {
+	const attrRe = /\s([^\s"'=<>`]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
+	let match;
+	while ((match = attrRe.exec(tag)) !== null) {
+		if (match[1]?.toLowerCase() !== name.toLowerCase()) continue;
+		return match[2] ?? match[3] ?? match[4] ?? "";
+	}
+	return null;
+}
+function htmlAttributeHasToken(tag, name, token) {
+	return htmlTokenListContains(getHtmlAttribute(tag, name), token);
+}
+function getInlineCss(manifest, href) {
+	if (Object.prototype.hasOwnProperty.call(manifest, href)) return manifest[href] ?? "";
+	try {
+		const pathname = new URL(href).pathname;
+		if (Object.prototype.hasOwnProperty.call(manifest, pathname)) return manifest[pathname] ?? "";
+	} catch {}
+	return null;
+}
+const TRAILING_LINK_OPEN_RE = /<link/gi;
+function splitTrailingIncompleteLinkTag(html) {
+	TRAILING_LINK_OPEN_RE.lastIndex = 0;
+	let lastIndex = -1;
+	let match;
+	while ((match = TRAILING_LINK_OPEN_RE.exec(html)) !== null) lastIndex = match.index;
+	if (lastIndex === -1) return {
+		complete: html,
+		trailing: ""
+	};
+	if (html.indexOf(">", lastIndex) !== -1) return {
+		complete: html,
+		trailing: ""
+	};
+	return {
+		complete: html.slice(0, lastIndex),
+		trailing: html.slice(lastIndex)
+	};
+}
+function findTrailingOpenHtmlRewriteExcludedRegionStart(html) {
+	let match;
+	HTML_REWRITE_EXCLUDED_REGION_START_RE.lastIndex = 0;
+	while ((match = HTML_REWRITE_EXCLUDED_REGION_START_RE.exec(html)) !== null) {
+		const start = match.index;
+		if (match[0] === "<!--") {
+			const close = html.indexOf("-->", HTML_REWRITE_EXCLUDED_REGION_START_RE.lastIndex);
+			if (close === -1) return start;
+			HTML_REWRITE_EXCLUDED_REGION_START_RE.lastIndex = close + 3;
+			continue;
+		}
+		const tagName = match[1]?.toLowerCase();
+		if (!tagName) continue;
+		const close = new RegExp(`</${tagName}\\s*>`, "i").exec(html.slice(HTML_REWRITE_EXCLUDED_REGION_START_RE.lastIndex));
+		if (!close) return start;
+		HTML_REWRITE_EXCLUDED_REGION_START_RE.lastIndex += close.index + close[0].length;
+	}
+	return null;
+}
+function splitTrailingInlineCssRewriteBoundary(html) {
+	const linkSplit = splitTrailingIncompleteLinkTag(html);
+	const incompleteLinkStart = linkSplit.trailing ? linkSplit.complete.length : null;
+	const openRegionStart = findTrailingOpenHtmlRewriteExcludedRegionStart(html);
+	const trailingStart = incompleteLinkStart === null ? openRegionStart : openRegionStart === null ? incompleteLinkStart : Math.min(incompleteLinkStart, openRegionStart);
+	if (trailingStart === null) return {
+		complete: html,
+		trailing: ""
+	};
+	return {
+		complete: html.slice(0, trailingStart),
+		trailing: html.slice(trailingStart)
+	};
+}
+function escapeStyleText(css) {
+	return css.replace(/<\/style/gi, "<\\/style");
+}
+const CSS_PREPEND_UNSAFE_PREAMBLE_RE = /^\uFEFF?(?:\s|\/\*[\s\S]*?\*\/)*@(charset|import|layer|namespace)\b/i;
+function canPrependCss(css) {
+	return !CSS_PREPEND_UNSAFE_PREAMBLE_RE.test(css);
+}
+function replaceLinkTags(html, replaceLinkTag) {
+	LINK_TAG_RE.lastIndex = 0;
+	return html.replace(LINK_TAG_RE, replaceLinkTag);
+}
+function replaceLinkTagsOutsideRawText(html, replaceLinkTag) {
+	let rewritten = "";
+	let cursor = 0;
+	let match;
+	HTML_REWRITE_EXCLUDED_REGION_RE.lastIndex = 0;
+	while ((match = HTML_REWRITE_EXCLUDED_REGION_RE.exec(html)) !== null) {
+		rewritten += replaceLinkTags(html.slice(cursor, match.index), replaceLinkTag);
+		rewritten += match[0];
+		cursor = match.index + match[0].length;
+	}
+	const tail = html.slice(cursor);
+	const openRegionStart = findTrailingOpenHtmlRewriteExcludedRegionStart(tail);
+	if (openRegionStart === null) return rewritten + replaceLinkTags(tail, replaceLinkTag);
+	return rewritten + replaceLinkTags(tail.slice(0, openRegionStart), replaceLinkTag) + tail.slice(openRegionStart);
+}
+function rewriteInlineCssStylesheetLinks(html, inlineCssManifest, prependCss, ssrScriptNonce) {
+	if (!inlineCssManifest || Object.keys(inlineCssManifest).length === 0) return {
+		html,
+		consumedPrependCss: false
+	};
+	let consumedPrependCss = false;
+	return {
+		html: replaceLinkTagsOutsideRawText(html, (tag) => {
+			if (!htmlAttributeHasToken(tag, "rel", "stylesheet")) return tag;
+			const href = getHtmlAttribute(tag, "href");
+			const precedence = getHtmlAttribute(tag, "data-precedence") ?? getHtmlAttribute(tag, "precedence");
+			if (!href || !precedence) return tag;
+			const css = getInlineCss(inlineCssManifest, href);
+			if (css === null) return tag;
+			const effectiveNonce = getHtmlAttribute(tag, "nonce") ?? ssrScriptNonce;
+			const nonceAttr = effectiveNonce ? ` nonce="${escapeHtmlAttr(effectiveNonce)}"` : "";
+			const cssPrefix = !consumedPrependCss && prependCss.length > 0 && canPrependCss(css) ? `${prependCss}\n` : "";
+			consumedPrependCss ||= cssPrefix.length > 0;
+			return `<style data-vinext-inline-css${nonceAttr} data-precedence="${escapeHtmlAttr(precedence)}" data-href="${escapeHtmlAttr(href)}">${escapeStyleText(cssPrefix + css)}</style>`;
+		}),
+		consumedPrependCss
+	};
+}
 /**
 * Match the `<head ...>` opening tag in a chunk. Matches both bare `<head>`
 * and `<head class="foo">` shapes. Used to splice HTML immediately after the
@@ -120,18 +244,25 @@ const HEAD_OPEN_RE = /<head\b[^>]*>/;
 *    to no-op and let the user-rendered Script (in its source-order
 *    position) ship as-is.
 */
-function createTickBufferedTransform(rscEmbed, injectHTML = "", injectAfterHeadOpenHTML = "") {
+function createTickBufferedTransform(rscEmbed, injectHTML = "", injectAfterHeadOpenHTML = "", inlineCssManifest, inlineCssPrependCss = "", inlineCssPrependFallbackHTML = "", inlineCssScriptNonce) {
 	const decoder = new TextDecoder();
 	const encoder = new TextEncoder();
 	const insertsPerFlush = typeof injectHTML === "function";
 	let injected = false;
 	let preHeadInjected = false;
 	let buffered = [];
+	let pendingHtml = "";
 	let timeoutId = null;
+	const hasInlineCssManifest = inlineCssManifest !== void 0 && Object.keys(inlineCssManifest).length > 0;
 	const readInsertion = () => typeof injectHTML === "function" ? injectHTML() : injectHTML;
 	const readPreHeadInsertion = () => typeof injectAfterHeadOpenHTML === "function" ? injectAfterHeadOpenHTML() : injectAfterHeadOpenHTML;
+	const readInlineCssPrependFallback = () => {
+		if (!inlineCssPrependCss || !inlineCssPrependFallbackHTML) return "";
+		inlineCssPrependCss = "";
+		return inlineCssPrependFallbackHTML;
+	};
 	const emitInsertion = (controller) => {
-		const insertion = readInsertion();
+		const insertion = readInlineCssPrependFallback() + readInsertion();
 		if (insertion) controller.enqueue(encoder.encode(insertion));
 	};
 	/**
@@ -140,11 +271,11 @@ function createTickBufferedTransform(rscEmbed, injectHTML = "", injectAfterHeadO
 	* rewritten chunk and a flag indicating whether the splice happened, so the
 	* caller can mark `preHeadInjected` and stop scanning further chunks.
 	*
-	* NOTE: This is called only when `<head ...>` lies fully inside `chunk` —
-	* we deliberately avoid stitching across chunk boundaries because doing so
-	* would force the transform to hold output until it had seen `<head ...>`,
-	* which both delays TTFB and complicates the existing `</head>` injection
-	* path. In practice React Fizz emits the opening shell as a single chunk.
+	* NOTE: This is called only when `<head ...>` lies fully inside the current
+	* tick-buffered batch. We deliberately avoid retaining arbitrary output until
+	* a future chunk completes `<head ...>`, which would delay TTFB and complicate
+	* the existing `</head>` injection path. In practice React Fizz emits the
+	* opening shell as a single batch.
 	*/
 	const spliceAfterHeadOpen = (chunk) => {
 		if (preHeadInjected) return {
@@ -167,35 +298,47 @@ function createTickBufferedTransform(rscEmbed, injectHTML = "", injectAfterHeadO
 			spliced: true
 		};
 	};
-	const flushBuffered = (controller) => {
-		if (buffered.length === 0) return;
+	const flushBuffered = (controller, final = false) => {
+		if (buffered.length === 0 && !pendingHtml) return;
+		const rawHtml = pendingHtml + buffered.join("");
+		buffered = [];
+		pendingHtml = "";
+		const split = final || !hasInlineCssManifest ? {
+			complete: rawHtml,
+			trailing: ""
+		} : splitTrailingInlineCssRewriteBoundary(rawHtml);
+		if (split.trailing) pendingHtml = split.trailing;
+		if (!split.complete) return;
 		if (injected && insertsPerFlush) emitInsertion(controller);
-		for (const chunk of buffered) {
-			let working = chunk;
-			if (!preHeadInjected) {
-				const result = spliceAfterHeadOpen(working);
-				if (result.spliced) {
-					working = result.chunk;
-					preHeadInjected = true;
-				}
+		const preparedHtml = fixPreloadAs(split.complete);
+		const inlineCssResult = hasInlineCssManifest ? rewriteInlineCssStylesheetLinks(preparedHtml, inlineCssManifest, inlineCssPrependCss, inlineCssScriptNonce) : {
+			html: preparedHtml,
+			consumedPrependCss: false
+		};
+		if (inlineCssResult.consumedPrependCss) inlineCssPrependCss = "";
+		let working = inlineCssResult.html;
+		if (!preHeadInjected) {
+			const result = spliceAfterHeadOpen(working);
+			if (result.spliced) {
+				working = result.chunk;
+				preHeadInjected = true;
 			}
-			if (!injected) {
-				const headEnd = working.indexOf("</head>");
-				if (headEnd !== -1) {
-					const before = working.slice(0, headEnd);
-					const after = working.slice(headEnd);
-					controller.enqueue(encoder.encode(before + readInsertion() + after));
-					injected = true;
-					continue;
-				}
+		}
+		if (!injected) {
+			const headEnd = working.indexOf("</head>");
+			if (headEnd !== -1) {
+				const before = working.slice(0, headEnd);
+				const after = working.slice(headEnd);
+				controller.enqueue(encoder.encode(before + readInlineCssPrependFallback() + readInsertion() + after));
+				injected = true;
+				return;
 			}
-			controller.enqueue(encoder.encode(working));
 		}
-		buffered = [];
+		controller.enqueue(encoder.encode(working));
 	};
 	return new TransformStream({
 		transform(chunk, controller) {
-			buffered.push(fixPreloadAs(decoder.decode(chunk, { stream: true })));
+			buffered.push(decoder.decode(chunk, { stream: true }));
 			if (timeoutId !== null) return;
 			timeoutId = setTimeout(() => {
 				try {
@@ -211,7 +354,9 @@ function createTickBufferedTransform(rscEmbed, injectHTML = "", injectAfterHeadO
 				clearTimeout(timeoutId);
 				timeoutId = null;
 			}
-			flushBuffered(controller);
+			const remainder = decoder.decode();
+			if (remainder) buffered.push(remainder);
+			flushBuffered(controller, true);
 			if (!injected) {
 				emitInsertion(controller);
 				injected = true;