vinext 1.0.0-beta.11 → 1.0.0-beta.13

package/dist/plugins/og-assets.js

@@ -1,5 +1,6 @@
 import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { magicStringTransformResult } from "./transform-result.js";
+import { resolveHarfbuzzWasmPath } from "./og-harfbuzz.js";
 import { OgAssetOwnership } from "./og-asset-ownership.js";
 import { createRequire } from "node:module";
 import fs from "node:fs";
@@ -94,7 +95,11 @@ function createOgInlineFetchAssetsPlugin() {
 		}
 	};
 }
-const OG_WASM_ASSETS = ["resvg.wasm", "yoga.wasm"];
+const OG_WASM_ASSETS = [
+	"resvg.wasm",
+	"yoga.wasm",
+	"hb.wasm"
+];
 /**
 * Find an emitted WASM asset in the output bundle whose name corresponds to the
 * given base file (e.g. base `resvg.wasm` matches the emitted `resvg-HASH.wasm`).
@@ -105,15 +110,20 @@ const OG_WASM_ASSETS = ["resvg.wasm", "yoga.wasm"];
 *
 * @returns the emitted asset's `fileName` (relative to outDir), or null.
 */
-function findEmittedWasmAsset(bundle, baseName) {
+function findEmittedWasmAsset(bundle, baseName, expectedSource) {
 	const stem = baseName.replace(/\.wasm$/, "");
 	const re = new RegExp(`^${stem}(?:[-.][\\w-]+)?\\.wasm$`);
 	for (const output of Object.values(bundle)) {
 		if (output.type !== "asset") continue;
-		if (re.test(path.basename(output.fileName))) return output.fileName;
+		if (!re.test(path.basename(output.fileName))) continue;
+		if (expectedSource && !isSameBytes(output.source, expectedSource)) continue;
+		return output.fileName;
 	}
 	return null;
 }
+function isSameBytes(source, expected) {
+	return source instanceof Uint8Array && Buffer.from(source).equals(expected);
+}
 /**
 * Build the regex that matches the Node.js fallback reference
 * `new URL("./<base>", import.meta.url)` for a given WASM base name.
@@ -162,7 +172,7 @@ function copyMissingOgWasm(opts) {
 * target — so it helps Node/self-hosted builds as well as Cloudflare Workers.
 */
 function createOgAssetsPlugin() {
-	let dedupedBases = /* @__PURE__ */ new Set();
+	const dedupedBasesByEnvironment = /* @__PURE__ */ new Map();
 	return {
 		name: "vinext:og-assets",
 		apply: "build",
@@ -170,17 +180,18 @@ function createOgAssetsPlugin() {
 		generateBundle: {
 			order: "post",
 			handler(_options, bundle) {
-				if (this.environment?.name !== "rsc") return;
-				dedupedBases = /* @__PURE__ */ new Set();
+				const envName = this.environment?.name;
+				if (envName !== "rsc" && envName !== "ssr") return;
+				const dedupedBases = /* @__PURE__ */ new Set();
+				dedupedBasesByEnvironment.set(envName, dedupedBases);
 				const chunks = Object.values(bundle).filter((o) => o.type === "chunk");
 				for (const base of OG_WASM_ASSETS) {
 					if (!chunks.some((c) => c.code.includes(base))) continue;
-					const emitted = findEmittedWasmAsset(bundle, base);
-					if (!emitted) continue;
+					const emitted = findEmittedWasmAsset(bundle, base, base === "hb.wasm" ? fs.readFileSync(resolveHarfbuzzWasmPath(createRequire(import.meta.url).resolve("@vercel/og"))) : void 0);
 					for (const chunk of chunks) {
 						const re = fallbackUrlRegex(base);
 						const chunkDir = path.dirname(chunk.fileName);
-						const rel = path.relative(chunkDir, emitted);
+						const rel = path.relative(chunkDir, emitted ?? base);
 						const ref = rel.startsWith(".") ? rel : `./${rel}`;
 						const s = new MagicString(chunk.code);
 						let edited = false;
@@ -197,7 +208,7 @@ function createOgAssetsPlugin() {
 							source: chunk.fileName
 						});
 					}
-					dedupedBases.add(base);
+					if (emitted) dedupedBases.add(base);
 				}
 			}
 		},
@@ -205,18 +216,26 @@ function createOgAssetsPlugin() {
 			sequential: true,
 			order: "post",
 			async handler(options, bundle) {
-				if (this.environment?.name !== "rsc") return;
+				const envName = this.environment?.name;
+				if (envName !== "rsc" && envName !== "ssr") return;
 				const outDir = options.dir;
 				if (!outDir) return;
 				const chunkCode = Object.values(bundle).map((output) => output.type === "chunk" ? output.code : "").join("\n");
-				const referencedAssets = OG_WASM_ASSETS.filter((asset) => chunkCode.includes(asset) && !dedupedBases.has(asset));
+				const dedupedBases = dedupedBasesByEnvironment.get(envName);
+				dedupedBasesByEnvironment.delete(envName);
+				const referencedAssets = OG_WASM_ASSETS.filter((asset) => chunkCode.includes(asset) && !dedupedBases?.has(asset));
 				if (referencedAssets.length === 0) return;
 				try {
 					const ogPkgPath = createRequire(import.meta.url).resolve("@vercel/og/package.json");
 					copyMissingOgWasm({
 						outDir,
 						sourceDir: path.join(path.dirname(ogPkgPath), "dist"),
-						assets: referencedAssets
+						assets: referencedAssets.filter((asset) => asset !== "hb.wasm")
+					});
+					if (referencedAssets.includes("hb.wasm")) copyMissingOgWasm({
+						outDir,
+						sourceDir: path.dirname(resolveHarfbuzzWasmPath(ogPkgPath)),
+						assets: ["hb.wasm"]
 					});
 				} catch {}
 			}

package/dist/plugins/og-harfbuzz.d.ts

@@ -0,0 +1,24 @@
+import { Plugin } from "vite";
+//#region src/plugins/og-harfbuzz.d.ts
+/**
+ * Resolve the `hb.wasm` binary that matches the glue inlined in @vercel/og.
+ * @vercel/og and satori pin exact versions, so resolving through
+ * @vercel/og → satori → harfbuzzjs yields the build the bundle was made from.
+ */
+export declare function resolveHarfbuzzWasmPath(ogEntry: string): string;
+/**
+ * Read every function type in a WASM binary as an Emscripten signature (result
+ * letter, or `v` for none, then parameters). Any callback HarfBuzz calls
+ * through its function table must have one of these types, so adapters for
+ * all of them cover every callback the glue can register.
+ */
+export declare function readWasmFunctionSignatures(wasm: Uint8Array): string[];
+/**
+ * Build the module Emscripten's `convertJsFunctionToWasm` compiles for a
+ * signature: it imports a JavaScript function as `e.f` and re-exports it as
+ * `f`. Every section in it is shorter than 128 bytes, so each length and count
+ * is a single LEB128 byte.
+ */
+export declare function createHarfbuzzCallbackWasm(signature: string): Uint8Array<ArrayBuffer>;
+export declare function createOgHarfbuzzPlugin(): Plugin;
+//#endregion

package/dist/plugins/og-harfbuzz.js

@@ -0,0 +1,260 @@
+import path, { toSlash } from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
+import { magicStringTransformResult } from "./transform-result.js";
+import { forEachAstChild, getAstName, staticStringValue } from "./ast-utils.js";
+import { isFunctionNode } from "./ast-scope.js";
+import { createRequire } from "node:module";
+import fs from "node:fs";
+import { parseAst } from "vite";
+import MagicString from "magic-string";
+//#region src/plugins/og-harfbuzz.ts
+/**
+* vinext:og-harfbuzz — load @vercel/og's bundled HarfBuzz under vinext.
+*
+* @vercel/og 1.x inlines harfbuzzjs's Emscripten glue into both entry bundles.
+* Unmodified, that glue cannot start:
+*
+*   - Node ESM: its Node branch calls esbuild's `__require("fs")` and reads
+*     `__dirname`, neither of which exists in an ES module.
+*   - workerd: it reads `self.location.href`, takes the Node branch under
+*     `nodejs_compat`, and fetches `hb.wasm` from a relative URL. Workers also
+*     forbid compiling WASM from bytes, which Emscripten does for every
+*     JavaScript callback it adds to the WASM function table.
+*
+* The transform locates the HarfBuzz factory by syntax (the function that
+* names `"hb.wasm"` and reads Emscripten's `instantiateWasm` hook) and, inside
+* it only:
+*
+*   1. sets every `ENVIRONMENT_IS_*` flag to `false`, so no host branch runs;
+*   2. replaces `instantiateWasm` reads with a vinext loader that instantiates
+*      `hb.wasm` synchronously (a `?module` import on workerd, a disk read on
+*      Node), so a bad binary rejects initialization instead of hanging it;
+*   3. on workerd, serves callback modules from precompiled adapters instead
+*      of `new WebAssembly.Module(bytes)`.
+*
+* Whitespace, esbuild's renames and harfbuzzjs's wrapper code can change
+* freely. If a patch site is missing, the build fails with an explicit error
+* instead of shipping an OG route that breaks at runtime.
+*/
+const HARFBUZZ_WASM = "hb.wasm";
+const VALUE_TYPES = {
+	i: 127,
+	j: 126,
+	f: 125,
+	d: 124
+};
+const VALUE_TYPE_LETTERS = new Map(Object.entries(VALUE_TYPES).map(([k, v]) => [v, k]));
+/**
+* Resolve the `hb.wasm` binary that matches the glue inlined in @vercel/og.
+* @vercel/og and satori pin exact versions, so resolving through
+* @vercel/og → satori → harfbuzzjs yields the build the bundle was made from.
+*/
+function resolveHarfbuzzWasmPath(ogEntry) {
+	const satoriEntry = createRequire(ogEntry).resolve("satori");
+	return toSlash(createRequire(satoriEntry).resolve(`harfbuzzjs/${HARFBUZZ_WASM}`));
+}
+/**
+* Read every function type in a WASM binary as an Emscripten signature (result
+* letter, or `v` for none, then parameters). Any callback HarfBuzz calls
+* through its function table must have one of these types, so adapters for
+* all of them cover every callback the glue can register.
+*/
+function readWasmFunctionSignatures(wasm) {
+	let offset = 8;
+	const readU32 = () => {
+		let result = 0;
+		for (let shift = 0;; shift += 7) {
+			const byte = wasm[offset++];
+			result |= (byte & 127) << shift;
+			if (!(byte & 128)) return result >>> 0;
+		}
+	};
+	const readTypes = () => {
+		let letters = "";
+		for (let count = readU32(); count > 0; count--) {
+			const letter = VALUE_TYPE_LETTERS.get(wasm[offset++]);
+			letters = letter && letters !== null ? letters + letter : null;
+		}
+		return letters;
+	};
+	const signatures = /* @__PURE__ */ new Set();
+	while (offset < wasm.length) {
+		const sectionId = wasm[offset++];
+		const sectionEnd = readU32() + offset;
+		if (sectionId === 1) for (let count = readU32(); count > 0; count--) {
+			offset++;
+			const params = readTypes();
+			const results = readTypes();
+			if (params !== null && results !== null && results.length <= 1) signatures.add((results || "v") + params);
+		}
+		offset = sectionEnd;
+	}
+	return [...signatures];
+}
+/**
+* Build the module Emscripten's `convertJsFunctionToWasm` compiles for a
+* signature: it imports a JavaScript function as `e.f` and re-exports it as
+* `f`. Every section in it is shorter than 128 bytes, so each length and count
+* is a single LEB128 byte.
+*/
+function createHarfbuzzCallbackWasm(signature) {
+	const typeCode = (letter) => {
+		const code = VALUE_TYPES[letter];
+		if (code === void 0) throw new Error(`[vinext] Invalid WASM callback signature: ${signature}`);
+		return code;
+	};
+	const [result, ...params] = signature;
+	const results = result === "v" ? [] : [typeCode(result)];
+	const functionType = [
+		96,
+		params.length,
+		...params.map(typeCode),
+		results.length,
+		...results
+	];
+	if (functionType.length > 64) throw new Error(`[vinext] WASM callback signature too long: ${signature}`);
+	const section = (id, contents) => [
+		id,
+		contents.length,
+		...contents
+	];
+	return Uint8Array.from([
+		0,
+		97,
+		115,
+		109,
+		1,
+		0,
+		0,
+		0,
+		...section(1, [1, ...functionType]),
+		...section(2, [
+			1,
+			1,
+			101,
+			1,
+			102,
+			0,
+			0
+		]),
+		...section(7, [
+			1,
+			1,
+			102,
+			0,
+			0
+		])
+	]);
+}
+/** Write each callback adapter once and return its path by signature. */
+function writeHarfbuzzCallbackModules(harfbuzzWasm, outDir) {
+	fs.mkdirSync(outDir, { recursive: true });
+	const modules = /* @__PURE__ */ new Map();
+	for (const signature of readWasmFunctionSignatures(fs.readFileSync(harfbuzzWasm))) {
+		const filePath = path.join(outDir, `harfbuzz-callback-${signature}.wasm`);
+		if (!fs.existsSync(filePath)) {
+			const tempPath = `${filePath}.${process.pid}.tmp`;
+			fs.writeFileSync(tempPath, createHarfbuzzCallbackWasm(signature));
+			fs.renameSync(tempPath, filePath);
+		}
+		modules.set(signature, filePath);
+	}
+	return modules;
+}
+const contains = (outer, inner) => outer.start <= inner.start && inner.end <= outer.end;
+/**
+* Find the HarfBuzz factory — the innermost function that both names
+* `"hb.wasm"` and reads `instantiateWasm` — and the patch sites inside it.
+* Scoping edits to that function keeps yoga's own Emscripten module, which
+* also reads `instantiateWasm`, untouched.
+*/
+function findHarfbuzzPatchSites(program) {
+	const functionStack = [];
+	const wasmNameScopes = [];
+	const instantiateWasmMembers = [];
+	const environmentFlags = [];
+	const moduleCompilations = [];
+	const visit = (node) => {
+		const isFunction = isFunctionNode(node);
+		if (isFunction) functionStack.push(node);
+		if (staticStringValue(node) === HARFBUZZ_WASM) wasmNameScopes.push([...functionStack]);
+		else if (node.type === "MemberExpression" && getAstName(node.property) === "instantiateWasm") instantiateWasmMembers.push(node);
+		else if (node.type === "VariableDeclarator" && node.id.type === "Identifier" && node.id.name.startsWith("ENVIRONMENT_IS_") && node.init) environmentFlags.push({
+			declarator: node,
+			init: node.init
+		});
+		else if (node.type === "NewExpression" && node.callee.type === "MemberExpression" && getAstName(node.callee.object) === "WebAssembly" && getAstName(node.callee.property) === "Module" && functionStack.length > 0) moduleCompilations.push({
+			node,
+			enclosingFunction: functionStack[functionStack.length - 1]
+		});
+		forEachAstChild(node, visit);
+		if (isFunction) functionStack.pop();
+	};
+	visit(program);
+	const factories = /* @__PURE__ */ new Set();
+	for (const scopes of wasmNameScopes) {
+		const factory = [...scopes].reverse().find((scope) => instantiateWasmMembers.some((member) => contains(scope, member)));
+		if (factory) factories.add(factory);
+	}
+	if (factories.size !== 1) return `expected one function that names "${HARFBUZZ_WASM}" and reads instantiateWasm, found ${factories.size}`;
+	const [factory] = factories;
+	const flags = environmentFlags.filter(({ declarator }) => contains(factory, declarator));
+	if (!flags.some(({ declarator }) => getAstName(declarator.id) === "ENVIRONMENT_IS_NODE")) return "the factory does not declare ENVIRONMENT_IS_NODE";
+	return {
+		instantiateWasmReads: instantiateWasmMembers.filter((member) => contains(factory, member)),
+		environmentFlags: flags.map(({ init }) => init),
+		moduleCompilations: moduleCompilations.filter(({ node }) => contains(factory, node))
+	};
+}
+const INSTANTIATE_WASM = `function __vi_hb_instantiateWasm(imports, receiveInstance) {
+  var instance = new WebAssembly.Instance(__vi_hb_module(), imports);
+  receiveInstance(instance);
+  return instance.exports;
+}`;
+function createOgHarfbuzzPlugin() {
+	let callbackModuleDir;
+	let isBuild = false;
+	return {
+		name: "vinext:og-harfbuzz",
+		enforce: "pre",
+		configResolved(config) {
+			callbackModuleDir = path.join(toSlash(config.root), ".vinext", "og-assets");
+			isBuild = config.command === "build";
+		},
+		transform: {
+			filter: {
+				id: /[\\/]@vercel[\\/]og[\\/]dist[\\/]index\.(?:edge|node)\.js(?:\?.*)?$/,
+				code: /["'`]hb\.wasm["'`]/
+			},
+			handler(code, id) {
+				const ogEntry = toSlash(id.split("?", 1)[0]);
+				const isWorkerd = ogEntry.endsWith("/index.edge.js");
+				const fail = (reason) => this.error(`[vinext] Unsupported @vercel/og HarfBuzz bundle in ${ogEntry}: ${reason}. vinext must be updated to support this @vercel/og version.`);
+				const sites = findHarfbuzzPatchSites(parseAst(code, { lang: "js" }));
+				if (typeof sites === "string") return fail(sites);
+				const output = new MagicString(code);
+				for (const flag of sites.environmentFlags) output.overwrite(flag.start, flag.end, "false");
+				for (const member of sites.instantiateWasmReads) output.overwrite(member.start, member.end, "__vi_hb_instantiateWasm");
+				const harfbuzzWasm = resolveHarfbuzzWasmPath(ogEntry);
+				const preamble = [];
+				if (isWorkerd) {
+					if (sites.moduleCompilations.length === 0) return fail("no callback module compilation (new WebAssembly.Module) was found");
+					for (const { node, enclosingFunction } of sites.moduleCompilations) {
+						const signature = isFunctionNode(enclosingFunction) ? enclosingFunction.params[1] : void 0;
+						if (signature?.type !== "Identifier") return fail("the callback compiler does not take a (func, sig) signature");
+						output.prependLeft(node.start, `(__vi_hb_callbacks[${signature.name}.replace(/p/g, "i")] || `);
+						output.appendRight(node.end, ")");
+					}
+					const callbacks = [...writeHarfbuzzCallbackModules(harfbuzzWasm, callbackModuleDir)];
+					preamble.push(`import __vi_hb_wasm from ${JSON.stringify(`${harfbuzzWasm}?module`)};`, ...callbacks.map(([, file], index) => `import __vi_hb_callback_${index} from ${JSON.stringify(`${file}?module`)};`), `var __vi_hb_callbacks = { ${callbacks.map(([signature], index) => `${signature}: __vi_hb_callback_${index}`).join(", ")} };`, "function __vi_hb_module() { return __vi_hb_wasm; }");
+				} else {
+					const location = isBuild ? `new URL("./${HARFBUZZ_WASM}", import.meta.url)` : JSON.stringify(harfbuzzWasm);
+					preamble.push(`import { readFileSync as __vi_hb_readFileSync } from "node:fs";`, `function __vi_hb_module() { return new WebAssembly.Module(__vi_hb_readFileSync(${location})); }`);
+				}
+				output.prepend(`${preamble.join("\n")}\n${INSTANTIATE_WASM}\n`);
+				return magicStringTransformResult(output);
+			}
+		}
+	};
+}
+//#endregion
+export { createHarfbuzzCallbackWasm, createOgHarfbuzzPlugin, readWasmFunctionSignatures, resolveHarfbuzzWasmPath };

package/dist/plugins/optimize-imports.js

@@ -5,8 +5,8 @@ import { VIRTUAL_MODULE_ID_RE } from "../utils/virtual-module.js";
 import { collectBindingNames, getAstName } from "./ast-utils.js";
 import { createRequire } from "node:module";
 import { parseAst } from "vite";
-import fsp from "node:fs/promises";
 import MagicString from "magic-string";
+import fsp from "node:fs/promises";
 //#region src/plugins/optimize-imports.ts
 /**
 * Read a file's contents, returning null on any error.

package/dist/plugins/require-condition-resolution.js

@@ -1,11 +1,11 @@
 import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
-import { stripViteModuleQuery } from "../utils/path.js";
 import { magicStringTransformResult } from "./transform-result.js";
+import { stripViteModuleQuery } from "../utils/path.js";
 import { SCRIPT_MODULE_ID_RE, collectBindingNames, forEachAstChild, isIdentifierNamed, scriptParserLanguage, staticStringValue, unwrapExpression } from "./ast-utils.js";
 import { collectDirectScopeBindings, collectLoopScopeBindings, collectSwitchScopeBindings, collectVarScopeBindings, createAstScope, hasAstBinding, isFunctionNode } from "./ast-scope.js";
 import { createIdResolver, parseAst } from "vite";
-import { readFile } from "node:fs/promises";
 import MagicString from "magic-string";
+import { readFile } from "node:fs/promises";
 //#region src/plugins/require-condition-resolution.ts
 const LITERAL_REQUIRE_RE = /\brequire\s*\(/;
 const CONDITIONAL_REQUIRE_SCRIPT_ID_RE = /\.vinext-require\.(?:js|jsx|ts|tsx)$/i;

package/dist/plugins/require-context.js

@@ -1,10 +1,10 @@
 import path, { toSlash } from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
-import { stripViteModuleQuery } from "../utils/path.js";
 import { magicStringTransformResult } from "./transform-result.js";
+import { stripViteModuleQuery } from "../utils/path.js";
 import { SCRIPT_MODULE_ID_RE, booleanLiteralValue, scriptParserLanguage, stringLiteralValue, walkAst } from "./ast-utils.js";
 import { parseAst } from "vite";
-import { readdir, realpath, stat } from "node:fs/promises";
 import MagicString from "magic-string";
+import { readdir, realpath, stat } from "node:fs/promises";
 //#region src/plugins/require-context.ts
 function createRequireContextPlugin() {
 	const watchedContexts = /* @__PURE__ */ new WeakMap();

package/dist/plugins/typeof-window.js

@@ -1,6 +1,6 @@
 import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
-import { stripViteModuleQuery } from "../utils/path.js";
 import { magicStringTransformResult } from "./transform-result.js";
+import { stripViteModuleQuery } from "../utils/path.js";
 import { booleanLiteralValue, collectBindingNames, forEachAstChild, isIdentifierNamed, stringLiteralValue } from "./ast-utils.js";
 import { collectDirectScopeBindings, collectLoopScopeBindings, collectSwitchScopeBindings, collectVarScopeBindings, createAstScope, hasAstBinding, isFunctionNode } from "./ast-scope.js";
 import { parseAst } from "vite";

package/dist/plugins/use-cache-callable.d.ts

@@ -3,8 +3,6 @@ import { Plugin } from "vite";
 type Options = {
   projectRoot: string;
   cacheRuntime: string;
-  getAppDir: () => string | undefined;
-  matchesPageExtension: (fileName: string) => boolean;
   allowMissingRsc?: boolean;
 };
 export declare function createUseCacheCallablePlugin(options: Options): Promise<Plugin>;

package/dist/plugins/use-cache-callable.js

@@ -1,9 +1,10 @@
 import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
-import { NODE_MODULES_PATH_RE, isPathInside, stripViteModuleQuery } from "../utils/path.js";
 import { magicStringTransformResult } from "./transform-result.js";
+import { NODE_MODULES_PATH_RE } from "../utils/path.js";
 import { createRequire } from "node:module";
 import { parseAstAsync } from "vite";
 import { pathToFileURL } from "node:url";
+import { createHmac, randomBytes } from "node:crypto";
 //#region src/plugins/use-cache-callable.ts
 const PLUGIN_NAME = "vinext:server-function-directives";
 const SOURCE_MODULE_ID_RE = /\.(?:tsx?|jsx?|mjs)(?:\?.*)?$/;
@@ -43,13 +44,6 @@ function acceptsSecondArgument(meta) {
 	if (node?.type !== "FunctionDeclaration" && node?.type !== "FunctionExpression" && node?.type !== "ArrowFunctionExpression") return true;
 	return node.params.length >= 2 || node.params.some((parameter) => parameter.type === "RestElement");
 }
-function isAppPageDefaultExport(options, id, name, isModuleDirective) {
-	const appDir = options.getAppDir();
-	if (!isModuleDirective || name !== "default" || !appDir) return false;
-	const modulePath = stripViteModuleQuery(id);
-	const moduleFileName = path.basename(modulePath);
-	return isPathInside(appDir, modulePath) && path.parse(moduleFileName).name === "page" && options.matchesPageExtension(moduleFileName);
-}
 function shouldTransformModuleExport(name, id, meta) {
 	if (meta.isFunction === false && (name !== "default" && meta.valueNode?.type === "Literal" || meta.valueNode?.type === "ObjectExpression" || meta.valueNode?.type === "ArrayExpression")) return false;
 	if (/\/(layout|template)\.(tsx?|jsx?|mjs)$/.test(id) && name === "default") return false;
@@ -65,11 +59,21 @@ function hasFunctionDirective(meta, directive) {
 	if (node?.type !== "FunctionDeclaration" && node?.type !== "FunctionExpression" && node?.type !== "ArrowFunctionExpression" || node.body.type !== "BlockStatement") return false;
 	return node.body.body.some((statement) => statement.type === "ExpressionStatement" && "directive" in statement && statement.directive === directive);
 }
-function getCacheWrapperOptions(options, id, name, isModuleDirective, meta) {
+function getFunctionDirectiveExportNames(transforms, ast, directive) {
+	const names = /* @__PURE__ */ new Set();
+	for (const group of transforms.scanModuleExports(ast)) {
+		const entries = group.type === "declaration" ? [group.export] : group.type === "variable-declaration" ? group.declarators.flatMap((declarator) => declarator.exports) : group.type === "specifiers" ? group.exports : group.type === "default" ? [{
+			exportName: "default",
+			meta: group.meta
+		}] : [];
+		for (const entry of entries) if (hasFunctionDirective(entry.meta, directive)) names.add(entry.exportName);
+	}
+	return names;
+}
+function getCacheWrapperOptions(meta) {
 	const argumentCount = getArgumentCount(meta);
 	return {
 		acceptsSecondArgument: acceptsSecondArgument(meta),
-		...isAppPageDefaultExport(options, id, name, isModuleDirective) ? { appPageDefaultExport: true } : {},
 		...argumentCount === void 0 ? {} : { argumentCount }
 	};
 }
@@ -78,6 +82,7 @@ async function createUseCacheCallablePlugin(options) {
 	const transformsPath = resolvePluginRscModule(options.projectRoot, "@vitejs/plugin-rsc/transforms");
 	const rscModule = await import(pathToFileURL(rscModulePath).href);
 	const transforms = await import(pathToFileURL(transformsPath).href);
+	const referenceSecret = randomBytes(32);
 	let manager;
 	return {
 		name: PLUGIN_NAME,
@@ -109,6 +114,8 @@ async function createUseCacheCallablePlugin(options) {
 				const useServerBoundary = transforms.hasDirective(ast.body, "use server");
 				if (moduleDirective && useServerBoundary) throw new Error(`A module cannot contain both ${JSON.stringify(moduleDirective)} and "use server" directives.`);
 				const reference = manager.serverReferences.resolve(id, "rsc");
+				const relativeImportId = manager.toRelativeId(reference.importId);
+				const secureExportName = (name) => `$$vinext_cache_${createHmac("sha256", referenceSecret).update(relativeImportId).update("\0").update(name).digest("hex")}`;
 				if (!(this.environment.name === "rsc")) {
 					if (useServerBoundary) {
 						manager.serverReferences.deleteClaim(PLUGIN_NAME, id);
@@ -126,6 +133,7 @@ async function createUseCacheCallablePlugin(options) {
 						manager.serverReferences.deleteClaim(PLUGIN_NAME, id);
 						return;
 					}
+					const useServerExportNames = getFunctionDirectiveExportNames(transforms, ast, "use server");
 					const result = transforms.transformDirectiveProxyExport(ast, {
 						code,
 						directive: moduleDirective,
@@ -134,7 +142,7 @@ async function createUseCacheCallablePlugin(options) {
 							validateModuleExport(transforms, meta);
 							return true;
 						},
-						runtime: (name) => `$$ReactClient.createServerReference(${JSON.stringify(`${reference.referenceKey}#${name}`)},$$ReactClient.callServer,undefined,${this.environment.mode === "dev" ? "$$ReactClient.findSourceMapURL" : "undefined"},${JSON.stringify(name)})`
+						runtime: (name) => `$$ReactClient.createServerReference(${JSON.stringify(`${reference.referenceKey}#${useServerExportNames.has(name) ? name : secureExportName(name)}`)},$$ReactClient.callServer,undefined,${this.environment.mode === "dev" ? "$$ReactClient.findSourceMapURL" : "undefined"},${JSON.stringify(name)})`
 					});
 					if (!result?.output.hasChanged()) {
 						manager.serverReferences.deleteClaim(PLUGIN_NAME, id);
@@ -142,7 +150,7 @@ async function createUseCacheCallablePlugin(options) {
 					}
 					manager.serverReferences.replaceClaim(PLUGIN_NAME, id, {
 						...reference,
-						exportNames: result.exportNames
+						exportNames: result.exportNames.map((name) => useServerExportNames.has(name) ? name : secureExportName(name))
 					});
 					const runtimeEnvironment = this.environment.name === "client" ? "browser" : "ssr";
 					result.output.prepend(`import * as $$ReactClient from "@vitejs/plugin-rsc/react/${runtimeEnvironment}";\n`);
@@ -151,19 +159,23 @@ async function createUseCacheCallablePlugin(options) {
 						source: id
 					});
 				}
-				const wrap = (value, name, directiveMatch, meta, isModuleDirective) => {
+				const secureExports = /* @__PURE__ */ new Set();
+				const wrap = (value, name, directiveMatch, meta) => {
 					const variant = directiveMatch[1] ?? "";
+					const secureName = secureExportName(name);
+					secureExports.add(secureName);
 					const wrapperOptions = {
-						...getCacheWrapperOptions(options, id, name, isModuleDirective, meta),
-						serverReferenceId: `${reference.referenceKey}#${name}`
+						...getCacheWrapperOptions(meta),
+						serverReferenceId: `${reference.referenceKey}#${secureName}`
 					};
 					return `$$cacheRuntime.registerCachedFunction(${value}, ${JSON.stringify(`${id}:${name}`)}, ${JSON.stringify(variant)}, ${JSON.stringify(wrapperOptions)})`;
 				};
 				let needsReactServer = false;
-				const runtime = (value, name, directiveMatch, meta, isModuleDirective) => {
-					const cached = wrap(value, name, directiveMatch, meta, isModuleDirective);
+				const runtime = (value, name, directiveMatch, meta) => {
+					const cached = wrap(value, name, directiveMatch, meta);
+					const secureName = secureExportName(name);
 					needsReactServer = true;
-					return `$$VinextReactServer.registerServerReference(${cached}, ${JSON.stringify(reference.referenceKey)}, ${JSON.stringify(name)})`;
+					return `(${secureName} = $$VinextReactServer.registerServerReference(${cached}, ${JSON.stringify(reference.referenceKey)}, ${JSON.stringify(secureName)}))`;
 				};
 				const result = moduleDirective ? transforms.transformWrapExport(code, ast, {
 					filter: (name, meta) => {
@@ -171,12 +183,13 @@ async function createUseCacheCallablePlugin(options) {
 						validateModuleExport(transforms, meta);
 						return true;
 					},
-					runtime: (value, name, meta) => runtime(value, name, matchUseCacheDirective(moduleDirective), meta, true)
+					runtime: (value, name, meta) => runtime(value, name, matchUseCacheDirective(moduleDirective), meta)
 				}) : transforms.transformHoistInlineDirective(code, ast, {
 					directive: USE_CACHE_DIRECTIVE_CANDIDATE,
 					rejectNonAsyncFunction: true,
 					hoistRuntime: true,
-					runtime: (value, name, meta) => runtime(value, name, matchUseCacheDirective(meta.directiveMatch[0]), meta, false),
+					noExport: true,
+					runtime: (value, name, meta) => runtime(value, name, matchUseCacheDirective(meta.directiveMatch[0]), meta),
 					encode: (value) => `$$cacheRuntime.encryptCacheCaptures(${value})`,
 					decode: (value) => value
 				});
@@ -186,10 +199,15 @@ async function createUseCacheCallablePlugin(options) {
 				}
 				manager.serverReferences.replaceClaim(PLUGIN_NAME, id, {
 					...reference,
-					exportNames: "names" in result ? result.names : result.exportNames
+					exportNames: [...secureExports]
 				});
 				const importPosition = ast.body.find((node) => !("directive" in node))?.start ?? code.length;
-				result.output.prependLeft(importPosition, [`import * as $$cacheRuntime from ${JSON.stringify(options.cacheRuntime)};`, needsReactServer && `import * as $$VinextReactServer from "@vitejs/plugin-rsc/react/rsc/server";`].filter(Boolean).join("\n") + "\n");
+				result.output.prependLeft(importPosition, [
+					`import * as $$cacheRuntime from ${JSON.stringify(options.cacheRuntime)};`,
+					needsReactServer && `import * as $$VinextReactServer from "@vitejs/plugin-rsc/react/rsc/server";`,
+					secureExports.size > 0 && `let ${[...secureExports].join(",")};`
+				].filter(Boolean).join("\n") + "\n");
+				if (secureExports.size > 0) result.output.append(`\nexport { ${[...secureExports].join(",")} };\n`);
 				return magicStringTransformResult(result.output, {
 					hires: "boundary",
 					source: id

package/dist/plugins/worker-image-imports.js

@@ -1,7 +1,7 @@
 import path, { toSlash } from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
+import { magicStringTransformResult } from "./transform-result.js";
 import { appendDeploymentIdQuery } from "../utils/deployment-id.js";
 import { NODE_MODULES_PATH_RE, stripViteModuleQuery } from "../utils/path.js";
-import { magicStringTransformResult } from "./transform-result.js";
 import { staticStringValue, walkAst } from "./ast-utils.js";
 import fs from "node:fs";
 import { parseAst } from "vite";

package/dist/routing/app-route-graph.js

@@ -1,6 +1,6 @@
 import path, { toSlash } from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
-import { decodeRouteSegment, isInvisibleSegment, sortRoutes } from "./utils.js";
 import { findFileWithExts, scanWithExtensions } from "./file-matcher.js";
+import { decodeRouteSegment, isInvisibleSegment, sortRoutes } from "./utils.js";
 import { validateRoutePatterns } from "./route-validation.js";
 import { compareStrings } from "../utils/compare.js";
 import fs from "node:fs";

package/dist/routing/app-router.js

@@ -1,6 +1,6 @@
 import { createValidFileMatcher } from "./file-matcher.js";
-import { createRouteTrieCache, matchRouteWithTrie } from "./route-matching.js";
 import { buildAppRouteGraph, computeAppRouteStaticSiblings, computeRootParamNames, convertSegmentsToRouteParts } from "./app-route-graph.js";
+import { createRouteTrieCache, matchRouteWithTrie } from "./route-matching.js";
 //#region src/routing/app-router.ts
 /**
 * App Router file-system routing.

package/dist/routing/pages-router.js

@@ -1,6 +1,6 @@
 import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
-import { decodeRouteSegment, sortRoutes } from "./utils.js";
 import { createValidFileMatcher, scanWithExtensions } from "./file-matcher.js";
+import { decodeRouteSegment, sortRoutes } from "./utils.js";
 import { patternToNextFormat, validateRoutePatterns } from "./route-validation.js";
 import { createRouteTrieCache, matchRouteWithTrieRawPathname } from "./route-matching.js";
 //#region src/routing/pages-router.ts