vinext 1.0.1 → 1.2.0

package/dist/plugins/cache-flight-codec.js

@@ -0,0 +1,68 @@
+import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
+import { magicStringTransformResult } from "./transform-result.js";
+import fs from "node:fs";
+import MagicString from "magic-string";
+//#region src/plugins/cache-flight-codec.ts
+const CLIENT_CODEC = /\/react-server-dom-(?:webpack|turbopack)-client\.edge\.(?:development|production)\.js$/;
+const ELEMENT_CASE = /case REACT_ELEMENT_TYPE:[\s\S]*?throw Error\(\s*"React Element cannot be passed/;
+/**
+* Version of the Flight codec package that owns `id`. plugin-rsc resolves the
+* app's own react-server-dom-webpack when installed and its vendored copy
+* otherwise; reading the codec file's own package.json follows that choice.
+*/
+function readFlightCodecVersion(id) {
+	for (let dir = path.dirname(id);; dir = path.dirname(dir)) {
+		const manifest = path.join(dir, "package.json");
+		if (fs.existsSync(manifest)) {
+			const pkg = JSON.parse(fs.readFileSync(manifest, "utf8"));
+			if (/^react-server-dom-(?:webpack|turbopack)$/.test(pkg.name ?? "") && pkg.version) return pkg.version;
+		}
+		if (path.dirname(dir) === dir) throw new Error(`vinext: cannot find the react-server-dom package version for ${id}`);
+	}
+}
+/** React 19.3 ships the branch; 0.0.0-* experimental builds track main. */
+function needsElementTemporaryReferenceBackport(version) {
+	const match = /^(\d+)\.(\d+)\./.exec(version);
+	if (!match || version.startsWith("0.0.0-")) return false;
+	const [major, minor] = [Number(match[1]), Number(match[2])];
+	return major < 19 || major === 19 && minor < 3;
+}
+/**
+* Backport React 19.3's root-element temporary reference branch to older Flight
+* codecs, so a "use cache" argument like `Promise<ReactElement>` encodes as a
+* temporary reference instead of throwing. Remove it once React 19.3 is the
+* minimum supported version.
+* https://github.com/facebook/react/blob/v19.3.0/packages/react-client/src/ReactFlightReplyClient.js#L486
+*/
+function patchCacheFlightCodec(code, id, version = readFlightCodecVersion(id)) {
+	if (!needsElementTemporaryReferenceBackport(version)) return null;
+	const elementCase = ELEMENT_CASE.exec(code);
+	if (!elementCase) throw new Error(`vinext: react-server-dom-webpack ${version} (${id}) is not supported. Upgrade react, react-dom, and react-server-dom-webpack to 19.3 or later. If your app does not depend on react-server-dom-webpack directly, upgrade @vitejs/plugin-rsc to 0.5.35 or later instead.`);
+	const output = new MagicString(code);
+	output.appendLeft(elementCase.index + elementCase[0].lastIndexOf("throw Error("), "if (void 0 !== temporaryReferences && modelRoot === value) return (modelRoot = null), \"$T\";\n");
+	return magicStringTransformResult(output, {
+		hires: "boundary",
+		source: id
+	});
+}
+function cacheFlightCodecPlugin() {
+	const transform = {
+		filter: { id: CLIENT_CODEC },
+		handler: (code, id) => patchCacheFlightCodec(code, id)
+	};
+	return {
+		name: "vinext:cache-flight-codec",
+		enforce: "pre",
+		applyToEnvironment: (environment) => environment.name === "rsc",
+		configEnvironment(name) {
+			if (name !== "rsc") return;
+			return { optimizeDeps: { rolldownOptions: { plugins: [{
+				name: "vinext:cache-flight-codec-optimizer",
+				transform
+			}] } } };
+		},
+		transform
+	};
+}
+//#endregion
+export { cacheFlightCodecPlugin, patchCacheFlightCodec, readFlightCodecVersion };

package/dist/plugins/commonjs-esm-facade.d.ts

@@ -0,0 +1,35 @@
+import { Plugin } from "vite";
+//#region src/plugins/commonjs-esm-facade.d.ts
+/**
+ * Removes the export facade vite-plugin-commonjs appended to `output` when the
+ * module it transformed is ESM. Returns `undefined` when there is nothing to
+ * remove.
+ *
+ * Next.js treats a module with ESM syntax as ESM: `require()` still works, but
+ * `module` / `exports` never become its exports. The plugin's analyzer is not
+ * scope-aware, so for bundled ESM that inlines CommonJS wrappers
+ * (`__commonJS((exports, module) => …)`) it exports the wrappers' assignments
+ * too, which duplicates the module's own exports. Its `require()` rewrite and
+ * its local `module` / `exports` polyfill stay, so free CommonJS assignments
+ * still run without becoming exports.
+ *
+ * Besides the facade, the plugin only prepends imports and its polyfill and
+ * rewrites `require()` calls, so the module's own top-level exports are still
+ * in `output`. Classifying the output rather than rereading the source keeps
+ * the decision tied to the exact code the plugin transformed.
+ *
+ * The facade is appended after the module's code (only dynamic-require
+ * runtimes, which have no source mappings, may follow it), so removing it
+ * leaves the plugin's source map valid.
+ */
+export declare function stripEsmCommonJsExportFacade(output: string): string | undefined;
+/**
+ * Applies {@link stripEsmCommonJsExportFacade} in the client dependency
+ * optimizer's Rolldown builds (scan and pre-bundle). vite-plugin-commonjs's
+ * pre-bundle plugin loads and converts files there without vinext's transform
+ * wrapper, so its output reaches this hook as the loaded code. That code is
+ * the optimizer's source, so the removal needs its own map for anything the
+ * plugin appended after the facade.
+ */
+export declare const commonJsEsmFacadeOptimizeDepsPlugin: Plugin;
+//#endregion

package/dist/plugins/commonjs-esm-facade.js

@@ -0,0 +1,80 @@
+import { parseAst } from "vite";
+import MagicString from "magic-string";
+//#region src/plugins/commonjs-esm-facade.ts
+const EXPORT_FACADE_START = "/* [vite-plugin-commonjs] export-statement-S */";
+const EXPORT_FACADE_END = "/* [vite-plugin-commonjs] export-statement-E */";
+const EXPORT_KEYWORD_RE = /\bexport\b(?!-)/;
+/** Whether `code` has a top-level ESM export statement. */
+function hasEsmExports(code) {
+	if (!EXPORT_KEYWORD_RE.test(code)) return false;
+	let ast;
+	try {
+		ast = parseAst(code);
+	} catch {
+		return false;
+	}
+	return ast.body.some((statement) => statement.type === "ExportNamedDeclaration" || statement.type === "ExportDefaultDeclaration" || statement.type === "ExportAllDeclaration");
+}
+/**
+* Removes the export facade vite-plugin-commonjs appended to `output` when the
+* module it transformed is ESM. Returns `undefined` when there is nothing to
+* remove.
+*
+* Next.js treats a module with ESM syntax as ESM: `require()` still works, but
+* `module` / `exports` never become its exports. The plugin's analyzer is not
+* scope-aware, so for bundled ESM that inlines CommonJS wrappers
+* (`__commonJS((exports, module) => …)`) it exports the wrappers' assignments
+* too, which duplicates the module's own exports. Its `require()` rewrite and
+* its local `module` / `exports` polyfill stay, so free CommonJS assignments
+* still run without becoming exports.
+*
+* Besides the facade, the plugin only prepends imports and its polyfill and
+* rewrites `require()` calls, so the module's own top-level exports are still
+* in `output`. Classifying the output rather than rereading the source keeps
+* the decision tied to the exact code the plugin transformed.
+*
+* The facade is appended after the module's code (only dynamic-require
+* runtimes, which have no source mappings, may follow it), so removing it
+* leaves the plugin's source map valid.
+*/
+function stripEsmCommonJsExportFacade(output) {
+	const facade = findEsmCommonJsExportFacade(output);
+	return facade && output.slice(0, facade[0]) + output.slice(facade[1]);
+}
+/** The `[start, end)` range of the facade {@link stripEsmCommonJsExportFacade} removes. */
+function findEsmCommonJsExportFacade(output) {
+	const start = output.lastIndexOf(EXPORT_FACADE_START);
+	if (start === -1) return void 0;
+	const end = output.indexOf(EXPORT_FACADE_END, start);
+	if (end === -1) return void 0;
+	const facadeEnd = end + 47;
+	return hasEsmExports(output.slice(0, start) + output.slice(facadeEnd)) ? [start, facadeEnd] : void 0;
+}
+/**
+* Applies {@link stripEsmCommonJsExportFacade} in the client dependency
+* optimizer's Rolldown builds (scan and pre-bundle). vite-plugin-commonjs's
+* pre-bundle plugin loads and converts files there without vinext's transform
+* wrapper, so its output reaches this hook as the loaded code. That code is
+* the optimizer's source, so the removal needs its own map for anything the
+* plugin appended after the facade.
+*/
+const commonJsEsmFacadeOptimizeDepsPlugin = {
+	name: "vinext:commonjs-esm-facade:optimize-deps",
+	transform: {
+		filter: { code: { include: EXPORT_FACADE_START } },
+		handler(code, id) {
+			const facade = findEsmCommonJsExportFacade(code);
+			if (!facade) return null;
+			const output = new MagicString(code).remove(facade[0], facade[1]);
+			return {
+				code: output.toString(),
+				map: output.generateMap({
+					source: id,
+					hires: "boundary"
+				})
+			};
+		}
+	}
+};
+//#endregion
+export { commonJsEsmFacadeOptimizeDepsPlugin, stripEsmCommonJsExportFacade };

package/dist/plugins/dynamic-preload-metadata.d.ts

@@ -7,5 +7,5 @@ type TransformResult = {
 };
 type ResolveDynamicImport = (specifier: string, importer: string) => Promise<string | null>;
 export declare function transformNextDynamicPreloadMetadata(code: string, id: string, root: string, resolveDynamicImport: ResolveDynamicImport): Promise<TransformResult | null>;
-export declare function createDynamicPreloadMetadataPlugin(): Plugin;
+export declare function createDynamicPreloadMetadataPlugin(getTranspiledPackages: () => readonly string[]): Plugin;
 //#endregion

package/dist/plugins/dynamic-preload-metadata.js

@@ -3,7 +3,8 @@ import { collectBindingNames, forEachAstChild, stringLiteralValue, walkAst } fro
 import { hasTrailingComma } from "../utils/has-trailing-comma.js";
 import { magicStringTransformResult } from "./transform-result.js";
 import { stripViteModuleQuery } from "../utils/path.js";
-import { relativeWithinRoot, tryRealpathSync } from "../build/ssr-manifest.js";
+import { isForeignNodeModule } from "../utils/package-name.js";
+import { relativeToRoot, relativeWithinRoot, tryRealpathSync } from "../build/ssr-manifest.js";
 import { parseAst } from "vite";
 import MagicString from "magic-string";
 //#region src/plugins/dynamic-preload-metadata.ts
@@ -204,7 +205,7 @@ function toManifestModuleId(root, resolvedId) {
 		const relative = relativeWithinRoot(rootCandidate, moduleCandidate);
 		if (relative) return relative;
 	}
-	return null;
+	return relativeToRoot(root, cleaned) || null;
 }
 async function resolveManifestModuleIds(specifiers, importer, root, resolveDynamicImport) {
 	const resolvedIds = [];
@@ -262,24 +263,24 @@ async function transformNextDynamicPreloadMetadata(code, id, root, resolveDynami
 	if (!changed) return null;
 	return magicStringTransformResult(output);
 }
-function createDynamicPreloadMetadataPlugin() {
+function createDynamicPreloadMetadataPlugin(getTranspiledPackages) {
 	let root = toSlash(process.cwd());
+	let isBuild = false;
 	return {
 		name: "vinext:dynamic-preload-metadata",
 		configResolved(config) {
 			root = config.root;
+			isBuild = config.command === "build";
 		},
 		transform: {
 			filter: {
-				id: {
-					include: /\.(tsx?|jsx?|mjs)$/,
-					exclude: /node_modules/
-				},
+				id: /\.(tsx?|jsx?|mjs)$/,
 				code: "next/dynamic"
 			},
 			async handler(code, id) {
-				if (id.includes("node_modules") || id.startsWith("\0")) return null;
+				if (id.startsWith("\0")) return null;
 				if (!/\.(tsx?|jsx?|mjs)$/.test(id)) return null;
+				if (id.includes("node_modules") && (!isBuild || isForeignNodeModule(id, getTranspiledPackages()))) return null;
 				const result = await transformNextDynamicPreloadMetadata(code, id, root, async (specifier, importer) => {
 					return (await this.resolve(specifier, importer, { skipSelf: true }))?.id ?? null;
 				});

package/dist/plugins/fonts.d.ts

@@ -3,9 +3,10 @@ import { Plugin } from "vite";
 export declare const VIRTUAL_GOOGLE_FONTS = "virtual:vinext-google-fonts";
 export declare const RESOLVED_VIRTUAL_GOOGLE_FONTS: string;
 /**
- * Rewrite absolute filesystem paths in cached Google Fonts CSS so the
- * `@font-face { src: url(...) }` references point at the served URL the
- * plugin's `writeBundle` hook copies the font files to.
+ * Point the `@font-face { src: url(...) }` references of cached Google Fonts
+ * CSS at the served URL the plugin's `writeBundle` hook copies the font
+ * files to (and the dev middleware serves them from), by replacing
+ * `CACHED_FONT_DIR_TOKEN` with `/<assetsDir>/_vinext_fonts`.
  *
  * This is called once per transform, before the CSS string is embedded in
  * the bundle as `_vinext.font.selfHostedCSS`. Every downstream consumer reads
@@ -14,9 +15,9 @@ export declare const RESOLVED_VIRTUAL_GOOGLE_FONTS: string;
  * in `shims/font-google-base.ts`), and the HTTP `Link:` response header
  * (via `buildAppPageFontLinkHeader` in `server/app-page-execution.ts`).
  *
- * Without this rewrite, all three emit the dev-machine filesystem path
- * (e.g. `/home/user/project/.vinext/fonts/geist-<hash>/geist-<hash>.woff2`)
- * and any production request fetches `<origin>/home/user/...` → 404.
+ * The token is substituted with plain split/join: it is a fixed string
+ * vinext wrote itself, so nothing about the checkout's path (spaces, quotes,
+ * parentheses, regex metacharacters, Windows separators) is parsed here.
  *
  * `assetsDir` must match whatever Vite has resolved for
  * `build.assetsDir` on the client environment — otherwise the embedded
@@ -26,12 +27,8 @@ export declare const RESOLVED_VIRTUAL_GOOGLE_FONTS: string;
  * passes the resolved value through from plugin state. The default is
  * kept only so the exported helper can be driven directly from unit
  * tests without synthesizing a full plugin context.
- *
- * Uses split/join rather than regex because `cacheDir` is an absolute
- * filesystem path that may contain regex metacharacters on unusual
- * filesystems.
  */
-export declare function _rewriteCachedFontCssToServedUrls(css: string, cacheDir: string, assetsDir?: string): string;
+export declare function _rewriteCachedFontCssToServedUrls(css: string, assetsDir?: string): string;
 /**
  * Safely parse a static JS object literal string into a plain object.
  * Uses Vite's parseAst (Rollup/acorn) so no code is ever evaluated.

package/dist/plugins/fonts.js

@@ -43,15 +43,15 @@ const GOOGLE_FONT_UTILITY_EXPORTS = /* @__PURE__ */ new Set([
 /**
 * Served URL prefix for self-hosted Google Font files.
 *
-* `fetchAndCacheFont()` downloads .woff2 files into `<root>/.vinext/fonts/`
+* `fetchAndCacheFont()` downloads font files into `<root>/.vinext/fonts/`
 * and writes an `@font-face` CSS snippet whose `src: url(...)` references
-* the files by absolute filesystem path — convenient for disk, unusable at
-* runtime because browsers resolve relative to the origin. Before the CSS
-* is embedded in the bundle as `_vinext.font.selfHostedCSS`, the filesystem
-* prefix is rewritten to this URL prefix by `_rewriteCachedFontCssToServedUrls()`,
-* and the matching `writeBundle` hook in `createGoogleFontsPlugin` copies
-* the font files into `<clientOutDir>/<assetsDir>/_vinext_fonts/` so the
-* rewritten URL actually resolves against the origin at request time.
+* name each file relative to that cache directory, behind
+* `CACHED_FONT_DIR_TOKEN`. Before the CSS is embedded in the bundle as
+* `_vinext.font.selfHostedCSS`, `_rewriteCachedFontCssToServedUrls()`
+* replaces the token with this URL prefix, and the matching `writeBundle`
+* hook in `createGoogleFontsPlugin` copies the font files into
+* `<clientOutDir>/<assetsDir>/_vinext_fonts/` so the URL actually resolves
+* against the origin at request time.
 *
 * The leading `_` keeps the namespace distinct from Vite's content-hashed
 * asset names (which are emitted flat into `<assetsDir>/`) and from any
@@ -59,6 +59,25 @@ const GOOGLE_FONT_UTILITY_EXPORTS = /* @__PURE__ */ new Set([
 */
 const VINEXT_FONT_URL_NAMESPACE = "_vinext_fonts";
 const MAX_GOOGLE_FONTS_ERROR_BODY_LENGTH = 500;
+/**
+* Stands in for the font cache directory in every `url()` of a cached
+* stylesheet, so the file on disk holds no absolute path and reads the same
+* wherever the checkout's `.vinext/` ends up: a moved or copied project, a
+* CI cache restored into another workspace, or a Docker build that copies
+* in a host's `.vinext/`. Next.js has no such cache (its Google font loader
+* keeps fetched CSS in memory and emits `/_next/static/media` URLs), so the
+* parity target is output that does not depend on where the cache was
+* written.
+*/
+const CACHED_FONT_DIR_TOKEN = "__VINEXT_FONT_CACHE_DIR__";
+/**
+* Cached stylesheet whose `url()` references use `CACHED_FONT_DIR_TOKEN`.
+* The suffix ties the cache to that format: a `style.css` written by an
+* earlier vinext holds the writing checkout's absolute paths, which would
+* 404 once embedded, so it is never read and the font is fetched again.
+* Change the suffix whenever the cached CSS format changes.
+*/
+const CACHED_FONT_CSS_FILE = "style-q7f3kd.css";
 function formatGoogleFontsErrorBody(body) {
 	const trimmed = body.trim();
 	if (!trimmed) return "(empty response body)";
@@ -67,9 +86,10 @@ function formatGoogleFontsErrorBody(body) {
 	return `${trimmed.slice(0, MAX_GOOGLE_FONTS_ERROR_BODY_LENGTH)}\n... (truncated ${omitted} characters)`;
 }
 /**
-* Rewrite absolute filesystem paths in cached Google Fonts CSS so the
-* `@font-face { src: url(...) }` references point at the served URL the
-* plugin's `writeBundle` hook copies the font files to.
+* Point the `@font-face { src: url(...) }` references of cached Google Fonts
+* CSS at the served URL the plugin's `writeBundle` hook copies the font
+* files to (and the dev middleware serves them from), by replacing
+* `CACHED_FONT_DIR_TOKEN` with `/<assetsDir>/_vinext_fonts`.
 *
 * This is called once per transform, before the CSS string is embedded in
 * the bundle as `_vinext.font.selfHostedCSS`. Every downstream consumer reads
@@ -78,9 +98,9 @@ function formatGoogleFontsErrorBody(body) {
 * in `shims/font-google-base.ts`), and the HTTP `Link:` response header
 * (via `buildAppPageFontLinkHeader` in `server/app-page-execution.ts`).
 *
-* Without this rewrite, all three emit the dev-machine filesystem path
-* (e.g. `/home/user/project/.vinext/fonts/geist-<hash>/geist-<hash>.woff2`)
-* and any production request fetches `<origin>/home/user/...` → 404.
+* The token is substituted with plain split/join: it is a fixed string
+* vinext wrote itself, so nothing about the checkout's path (spaces, quotes,
+* parentheses, regex metacharacters, Windows separators) is parsed here.
 *
 * `assetsDir` must match whatever Vite has resolved for
 * `build.assetsDir` on the client environment — otherwise the embedded
@@ -90,16 +110,9 @@ function formatGoogleFontsErrorBody(body) {
 * passes the resolved value through from plugin state. The default is
 * kept only so the exported helper can be driven directly from unit
 * tests without synthesizing a full plugin context.
-*
-* Uses split/join rather than regex because `cacheDir` is an absolute
-* filesystem path that may contain regex metacharacters on unusual
-* filesystems.
 */
-function _rewriteCachedFontCssToServedUrls(css, cacheDir, assetsDir = DEFAULT_ASSETS_DIR) {
-	const normalizedCacheDir = toSlash(cacheDir);
-	if (!normalizedCacheDir || !css.includes(normalizedCacheDir)) return css;
-	const prefix = assetsDir || DEFAULT_ASSETS_DIR;
-	return css.split(normalizedCacheDir).join(`/${prefix}/${VINEXT_FONT_URL_NAMESPACE}`);
+function _rewriteCachedFontCssToServedUrls(css, assetsDir = DEFAULT_ASSETS_DIR) {
+	return css.split(CACHED_FONT_DIR_TOKEN).join(`/${assetsDir || DEFAULT_ASSETS_DIR}/${VINEXT_FONT_URL_NAMESPACE}`);
 }
 /**
 * Default `build.assetsDir` — matches vinext's resolved default in
@@ -274,24 +287,49 @@ function propertyNameToGoogleFontFamily(prop) {
 }
 /**
 * Fetch Google Fonts CSS, download .woff2 files, cache locally, and return
-* @font-face CSS with local file references.
+* @font-face CSS whose `url()` references use `CACHED_FONT_DIR_TOKEN`.
 *
 * Cache dir structure: .vinext/fonts/<family-hash>/
-*   - style.css (the rewritten @font-face CSS)
+*   - style-<suffix>.css (the rewritten @font-face CSS, see `CACHED_FONT_CSS_FILE`)
 *   - *.woff2 (downloaded font files)
 */
 async function fetchAndCacheFont(cssUrl, family, cacheDir) {
 	const { createHash } = await import("node:crypto");
 	const urlHash = createHash("md5").update(cssUrl).digest("hex").slice(0, 12);
-	const fontDir = path.join(cacheDir, `${family.toLowerCase().replace(/\s+/g, "-")}-${urlHash}`);
-	const cachedCSSPath = path.join(fontDir, "style.css");
+	const fontDirName = `${family.toLowerCase().replace(/\s+/g, "-")}-${urlHash}`;
+	const fontDir = path.join(cacheDir, fontDirName);
+	const cachedCSSPath = path.join(fontDir, CACHED_FONT_CSS_FILE);
 	if (fs.existsSync(cachedCSSPath)) return fs.readFileSync(cachedCSSPath, "utf-8");
+	const css = await downloadGoogleFont(cssUrl, family, fontDir, fontDirName);
+	try {
+		writeFileAtomically(cachedCSSPath, css);
+	} catch {}
+	return css;
+}
+/**
+* Write-then-rename, so a write that fails midway never leaves a partial
+* file for a later build to trust: both font files and the stylesheet are
+* reused as soon as they exist.
+*/
+function writeFileAtomically(filePath, data) {
+	const tempPath = `${filePath}.${process.pid}.tmp`;
+	try {
+		fs.writeFileSync(tempPath, data);
+		fs.renameSync(tempPath, filePath);
+	} catch (err) {
+		fs.rmSync(tempPath, { force: true });
+		throw err;
+	}
+}
+async function downloadGoogleFont(cssUrl, family, fontDir, fontDirName) {
+	const { createHash } = await import("node:crypto");
 	const cssResponse = await fetch(cssUrl, { headers: { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" } });
 	if (!cssResponse.ok) {
 		const body = await cssResponse.text().catch(() => "");
 		throw new GoogleFontsHttpError(cssUrl, cssResponse.status, body);
 	}
 	let css = await cssResponse.text();
+	if (!css.trim()) throw new Error(`Google Fonts returned an empty stylesheet: ${cssUrl}`);
 	const urlRe = /url\((https:\/\/fonts\.gstatic\.com\/[^)]+)\)/g;
 	const urls = /* @__PURE__ */ new Map();
 	let urlMatch;
@@ -308,14 +346,13 @@ async function fetchAndCacheFont(cssUrl, family, cacheDir) {
 		const filePath = path.join(fontDir, filename);
 		if (!fs.existsSync(filePath)) {
 			const fontResponse = await fetch(fontUrl);
-			if (fontResponse.ok) {
-				const buffer = Buffer.from(await fontResponse.arrayBuffer());
-				fs.writeFileSync(filePath, buffer);
-			}
+			if (!fontResponse.ok) throw new Error(`Font file download failed with HTTP ${fontResponse.status}: ${fontUrl}`);
+			const buffer = Buffer.from(await fontResponse.arrayBuffer());
+			if (buffer.byteLength === 0) throw new Error(`Font file download returned an empty body: ${fontUrl}`);
+			writeFileAtomically(filePath, buffer);
 		}
-		css = css.split(fontUrl).join(filePath);
+		css = css.split(fontUrl).join(`${CACHED_FONT_DIR_TOKEN}/${fontDirName}/${filename}`);
 	}
-	fs.writeFileSync(cachedCSSPath, css);
 	return css;
 }
 /**
@@ -546,7 +583,7 @@ function createGoogleFontsPlugin(fontGoogleShimPath, shimsDir) {
 						if (err instanceof GoogleFontsHttpError) throw new Error(`[vinext:google-fonts] ${id}: Google Fonts returned HTTP ${err.status} for ${err.url}.\n${formatGoogleFontsErrorBody(err.responseBody)}`);
 						return;
 					}
-					const servedCSS = _rewriteCachedFontCssToServedUrls(localCSS, cacheDir, transformAssetsDir);
+					const servedCSS = _rewriteCachedFontCssToServedUrls(localCSS, transformAssetsDir);
 					const preloadUrls = findFontFilesInCss(servedCSS, validated.preload ? validated.subsets : void 0).filter((file) => file.preloadFontFile).map((file) => file.googleFontFileUrl);
 					const fallbackMetrics = validated.adjustFontFallback === false ? void 0 : getFallbackFontOverrideMetrics(family);
 					const adjustedFallbackCSS = fallbackMetrics ? buildFallbackFontFace(family, fallbackMetrics) : void 0;

package/dist/plugins/ignore-dynamic-requests.d.ts

@@ -11,7 +11,7 @@ import { Plugin } from "vite";
  * identifiers, falls through to the AST pass.
  */
 declare function mayContainVeryDynamicRequest(code: string): boolean;
-declare function transformVeryDynamicRequests(code: string, id: string): MagicStringTransformResult | null;
+declare function transformVeryDynamicRequests(code: string, id: string): MagicStringTransformResult<import("magic-string").SourceMap> | null;
 export declare function createIgnoreDynamicRequestsPlugin(getTranspiledPackages?: () => readonly string[]): Plugin;
 export declare const _transformVeryDynamicRequests: typeof transformVeryDynamicRequests;
 export declare const _mayContainVeryDynamicRequest: typeof mayContainVeryDynamicRequest;

package/dist/plugins/ignore-dynamic-requests.js

@@ -1,7 +1,8 @@
-import path, { toSlash } from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
+import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { DYNAMIC_IMPORT_PRESCAN, SCRIPT_MODULE_ID_RE, collectBindingNames, forEachAstChild, isIdentifierNamed, mayContainDynamicImport, scriptParserLanguage, stringLiteralValue, unwrapExpression } from "./ast-utils.js";
 import { magicStringTransformResult, omitUnusedBuildSourcemap } from "./transform-result.js";
 import { stripViteModuleQuery } from "../utils/path.js";
+import { isForeignNodeModule } from "../utils/package-name.js";
 import { collectDirectScopeBindings, collectLoopScopeBindings, collectSwitchScopeBindings, collectVarScopeBindings, hasAstBinding, isFunctionNode } from "./ast-scope.js";
 import { createTransformCache } from "./transform-cache.js";
 import { fileURLToPath } from "node:url";
@@ -543,9 +544,7 @@ function createIgnoreDynamicRequestsPlugin(getTranspiledPackages = () => []) {
 }
 function shouldTransformVeryDynamicRequests(environment, id, transpiledPackages) {
 	if (environment.config.consumer === "server") return true;
-	const normalizedId = toSlash(id);
-	if (!normalizedId.includes("/node_modules/")) return false;
-	return !transpiledPackages.some((packageName) => normalizedId.includes(`/node_modules/${packageName}/`));
+	return isForeignNodeModule(id, transpiledPackages);
 }
 const _transformVeryDynamicRequests = transformVeryDynamicRequests;
 const _mayContainVeryDynamicRequest = mayContainVeryDynamicRequest;

package/dist/plugins/middleware-server-only.d.ts

@@ -29,10 +29,11 @@ import { Plugin } from "vite";
  *      to the tainted set. This propagates the taint along the import graph
  *      synchronously, before plugin-rsc's `order: "pre"` validate-imports
  *      handler sees the next `server-only` request.
- *   3. When a tainted module imports `server-only` in a non-RSC environment,
- *      short-circuit to the no-op shim path so plugin-rsc's filter (which
- *      matches the bare `^server-only$` specifier) never fires for that
- *      import.
+ *   3. When a tainted module imports `server-only` in a non-RSC server
+ *      environment, short-circuit to the no-op shim path so plugin-rsc's
+ *      filter (which matches the bare `^server-only$` specifier) never fires
+ *      for that import. Browser environments are skipped entirely, so the
+ *      client `server-only` validators still see every import there.
  *
  * The taint set is scoped to the middleware chain only — `server-only`
  * imports from anywhere else (including client component code traversing

package/dist/plugins/middleware-server-only.js

@@ -1,5 +1,6 @@
 import { toSlash } from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { stripViteModuleQuery } from "../utils/path.js";
+import { isServerEnvironment } from "./environment.js";
 //#region src/plugins/middleware-server-only.ts
 /**
 * Allow `import 'server-only'` from neutral server targets (and any module
@@ -30,10 +31,11 @@ import { stripViteModuleQuery } from "../utils/path.js";
 *      to the tainted set. This propagates the taint along the import graph
 *      synchronously, before plugin-rsc's `order: "pre"` validate-imports
 *      handler sees the next `server-only` request.
-*   3. When a tainted module imports `server-only` in a non-RSC environment,
-*      short-circuit to the no-op shim path so plugin-rsc's filter (which
-*      matches the bare `^server-only$` specifier) never fires for that
-*      import.
+*   3. When a tainted module imports `server-only` in a non-RSC server
+*      environment, short-circuit to the no-op shim path so plugin-rsc's
+*      filter (which matches the bare `^server-only$` specifier) never fires
+*      for that import. Browser environments are skipped entirely, so the
+*      client `server-only` validators still see every import there.
 *
 * The taint set is scoped to the middleware chain only — `server-only`
 * imports from anywhere else (including client component code traversing
@@ -71,7 +73,8 @@ function createMiddlewareServerOnlyPlugin(options) {
 		resolveId: {
 			order: "pre",
 			async handler(id, importer, opts) {
-				if (this.environment?.name === "rsc") return;
+				const environment = this.environment;
+				if (!environment || !isServerEnvironment(environment) || environment.name === "rsc") return;
 				if (!importer) return;
 				if (!isTainted(importer) && !options.isNeutralServerModule?.(canonicalizeId(importer))) return;
 				if (id === "server-only") return {

package/dist/plugins/pages-node-externals.js

@@ -1,8 +1,8 @@
 import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { SCRIPT_MODULE_ID_RE, mayContainDynamicImport, scriptParserLanguage, staticStringValue, walkAst } from "./ast-utils.js";
 import { canonicalizeFilePath, isPathInsideOrEqual, stripViteModuleQuery } from "../utils/path.js";
-import { packageNameFromSpecifier } from "../utils/package-name.js";
 import { isServerEnvironment } from "./environment.js";
+import { packageNameFromSpecifier } from "../utils/package-name.js";
 import fs from "node:fs";
 import { parseAst } from "vite";
 //#region src/plugins/pages-node-externals.ts

package/dist/plugins/rsc-scan-glob-imports.d.ts

@@ -0,0 +1,19 @@
+import { Plugin, ResolvedConfig } from "vite";
+import { RscPluginManager } from "@vitejs/plugin-rsc";
+//#region src/plugins/rsc-scan-glob-imports.d.ts
+/**
+ * @vitejs/plugin-rsc 0.5.36 and 0.5.37 reduce scan-build modules to their
+ * import specifiers with es-module-lexer v3, which reports template-literal
+ * dynamic imports as glob patterns (``import(`file://${p}`)`` becomes
+ * `"file://*"`). The scan then emits them as plain imports, which fail to
+ * resolve (e.g. in @module-federation/vite). Other versions skip these
+ * specifiers (0.5.38 via vitejs/vite-plugin-react#1506), so for the affected
+ * ones keep the specifiers that don't resolve external during the scan. A real
+ * module whose specifier contains `*` still resolves and stays in the scan
+ * graph. The scan's output is discarded, so nothing else changes.
+ */
+export declare function isRscScanGlobImportsAffected(version: string): boolean;
+export declare function createRscScanGlobImportsPlugin(options: {
+  getManager: (config: ResolvedConfig) => Promise<RscPluginManager | undefined>;
+}): Plugin;
+//#endregion

package/dist/plugins/rsc-scan-glob-imports.js

@@ -0,0 +1,50 @@
+import { isVersionBelow } from "../utils/react-version.js";
+//#region src/plugins/rsc-scan-glob-imports.ts
+/**
+* @vitejs/plugin-rsc 0.5.36 and 0.5.37 reduce scan-build modules to their
+* import specifiers with es-module-lexer v3, which reports template-literal
+* dynamic imports as glob patterns (``import(`file://${p}`)`` becomes
+* `"file://*"`). The scan then emits them as plain imports, which fail to
+* resolve (e.g. in @module-federation/vite). Other versions skip these
+* specifiers (0.5.38 via vitejs/vite-plugin-react#1506), so for the affected
+* ones keep the specifiers that don't resolve external during the scan. A real
+* module whose specifier contains `*` still resolves and stays in the scan
+* graph. The scan's output is discarded, so nothing else changes.
+*/
+function isRscScanGlobImportsAffected(version) {
+	return !isVersionBelow(version, [
+		0,
+		5,
+		36
+	]) && isVersionBelow(version, [
+		0,
+		5,
+		38
+	]);
+}
+function createRscScanGlobImportsPlugin(options) {
+	return {
+		name: "vinext:rsc-scan-glob-imports",
+		apply: "build",
+		enforce: "pre",
+		resolveId: {
+			filter: { id: /\*/ },
+			async handler(source, importer, resolveOptions) {
+				if (!(await options.getManager(this.environment.config))?.isScanBuild) return;
+				try {
+					const resolved = await this.resolve(source, importer, {
+						...resolveOptions,
+						skipSelf: true
+					});
+					if (resolved) return resolved;
+				} catch {}
+				return {
+					id: source,
+					external: true
+				};
+			}
+		}
+	};
+}
+//#endregion
+export { createRscScanGlobImportsPlugin, isRscScanGlobImportsAffected };