vinext 1.1.0 → 1.2.1

package/dist/plugins/cloudflare-dev-module-urls.js

@@ -0,0 +1,271 @@
+import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
+import { isCSSRequest } from "vite";
+//#region src/plugins/cloudflare-dev-module-urls.ts
+/**
+* Serve Vite's module URLs before the Cloudflare plugin applies
+* `assets.runWorkerFirst` during development.
+*
+* `vinext init` generates `runWorkerFirst: ["/*", "!/_next/static/*", ...]` so
+* middleware runs for `public/` files. In dev, the Cloudflare plugin sends every
+* request matching those patterns to the Worker before Vite's own middlewares
+* run. That includes Vite's module URLs (`/@vite/client`, `/@id/*`, `/@fs/*`,
+* source files such as `/app/globals.css`), which have no production
+* equivalent, so the Worker answers them with the app's 404 page and nothing
+* hydrates.
+*
+* This plugin registers a pre-middleware ahead of the Cloudflare plugin's and
+* gives Vite's module-serving middlewares the first chance to handle each
+* request. Vite decides what it serves: page navigations, non-GET requests, and
+* unknown paths fall through to the Cloudflare plugin unchanged.
+*
+* The same change was made in the Cloudflare plugin itself in
+* https://github.com/cloudflare/workers-sdk/pull/16281.
+*
+* See https://github.com/cloudflare/vinext/issues/4005.
+*/
+/**
+* Vite's internal middlewares that serve module requests (`/@vite/client`,
+* `/@id/*`, JS and CSS source files) and `/@fs/*` paths, preceded by the one
+* that strips a non-root `base` from the URL and the one that answers the HMR
+* client's reconnect ping (`Accept: text/x-vite-ping`) with a 204 instead of
+* the Worker rendering a page for it. If Vite renames them, none are found and
+* every request falls through, which is the behavior without this plugin.
+*
+* `viteServePublicMiddleware` is deliberately excluded so that `public/` files
+* reach the Worker and middleware, as they do in production. Without it, the
+* transform middleware reports a public `.js` or `.css` file as an
+* `ERR_LOAD_PUBLIC_URL` error, which is treated as a fall-through.
+*/
+const VITE_MODULE_MIDDLEWARE_NAMES = /* @__PURE__ */ new Set([
+	"viteBaseMiddleware",
+	"viteHMRPingMiddleware",
+	"viteTransformMiddleware",
+	"viteServeRawFsMiddleware"
+]);
+/**
+* Vite's internal middleware that serves files under the project root. Vite
+* gives imported assets root-relative URLs (`import logo from "./logo.svg"`
+* and CSS `url(./bg.png)` both resolve to paths like `/app/logo.svg`), and only
+* this middleware serves them. It also serves every other project file, and a
+* Worker route can share its path with one (e.g. an `api/` directory and an
+* `/api/*` route handler), so it only runs for referenced assets. See
+* `isReferencedAsset`. Navigations to a referenced asset
+* are served too: in production its URL is under `/_next/static/`, which never
+* reaches the Worker.
+*/
+const VITE_STATIC_MIDDLEWARE_NAME = "viteServeStaticMiddleware";
+/**
+* The Cloudflare plugin's middleware that sends requests matching
+* `runWorkerFirst` to the Worker. It's only registered when `runWorkerFirst` is
+* set, and without it Vite's middlewares already run in their usual order.
+*/
+const CLOUDFLARE_PRE_MIDDLEWARE_NAME = "cloudflarePreMiddleware";
+/**
+* Creates the plugin that lets Vite serve its module URLs before the Cloudflare
+* plugin's `runWorkerFirst` routing in dev.
+*
+* @param options - Plugin options
+* @returns The Vite plugin
+*/
+function createCloudflareDevModuleUrlsPlugin(options) {
+	return {
+		name: "vinext:cloudflare-dev-module-urls",
+		apply: "serve",
+		enforce: "pre",
+		configureServer(server) {
+			if (!options.isEnabled()) return;
+			server.middlewares.use(function vinextCloudflareDevModuleUrls(req, res, next) {
+				runViteModuleMiddlewares(server, req, res, next);
+			});
+		}
+	};
+}
+/**
+* Runs Vite's module-serving middlewares in order, calling `next` once none of
+* them handle the request.
+*
+* @param server - The Vite dev server whose middleware stack is searched
+* @param req - The incoming request
+* @param res - The outgoing response
+* @param next - Called when no middleware handles the request, or with an error
+*/
+function runViteModuleMiddlewares(server, req, res, next) {
+	const url = req.url;
+	if (req.method !== "GET" && req.method !== "HEAD" || !url?.startsWith(server.config.base)) {
+		next();
+		return;
+	}
+	const stack = server.middlewares.stack;
+	if (!stack.some((layer) => getHandleName(layer.handle) === CLOUDFLARE_PRE_MIDDLEWARE_NAME)) {
+		next();
+		return;
+	}
+	const handles = stack.flatMap((layer) => {
+		const handle = layer.handle;
+		if (typeof handle !== "function") return [];
+		if (VITE_MODULE_MIDDLEWARE_NAMES.has(handle.name)) return [handle];
+		if (handle.name === "viteServeStaticMiddleware") {
+			const serveStatic = handle;
+			return [(req, res, next) => isReferencedAsset(server, req.url) ? serveStatic(req, res, next) : next()];
+		}
+		return [];
+	});
+	let index = 0;
+	const tryNext = (error) => {
+		if (isPublicFileLoadError(error)) {
+			req.url = url;
+			next();
+			return;
+		}
+		if (error) {
+			next(error);
+			return;
+		}
+		const handle = handles[index++];
+		if (!handle) {
+			req.url = url;
+			next();
+			return;
+		}
+		try {
+			const result = handle(req, res, tryNext);
+			if (result instanceof Promise) result.catch(next);
+		} catch (e) {
+			next(e);
+		}
+	};
+	tryNext();
+}
+function getHandleName(handle) {
+	return typeof handle === "function" ? handle.name : void 0;
+}
+/**
+* Whether the transform middleware rejected a request because it is for a
+* `public/` file, which `viteServePublicMiddleware` would normally serve.
+*/
+function isPublicFileLoadError(error) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === "ERR_LOAD_PUBLIC_URL";
+}
+/**
+* Whether a request URL, with any `base` already stripped, is the URL of an
+* asset that Vite gave to a module.
+*
+* The browser only learns an asset URL from a module Vite has transformed:
+* - The asset's own JS module (`import logo from "./logo.svg"` or `?url`),
+*   whose code is `export default "<url>"`, possibly followed by a query or
+*   fragment (`?t=` after HMR). Only files Vite treats as assets and `?url`
+*   imports count: other modules, such as JSON or `?raw` and `?inline`
+*   imports, export the file's contents, which could look like a URL.
+* - A JS module that uses `new URL("./logo.svg", import.meta.url)`, which Vite
+*   rewrites to `new URL("<url>", '' + import.meta.url)`.
+* - A stylesheet whose `url()` or `image-set()` Vite resolved.
+*
+* The importers of the asset's file in the module graph cover the last two.
+* Other project files can also be in the graph (Tailwind reports every file it
+* scans as a dependency of the stylesheet), and other imports name the file
+* with a query (`?raw` inlines its contents), but no module's code contains
+* their bare URL in one of these forms, so they keep reaching the Worker.
+*
+* @param server - The Vite dev server whose module graphs are searched
+* @param url - The request URL, with any `base` stripped
+* @returns `true` if a module emitted the URL for the file
+*/
+function isReferencedAsset(server, url) {
+	if (!url) return false;
+	const { pathname } = new URL(url, "http://localhost");
+	let decodedPathname;
+	try {
+		decodedPathname = decodeURI(pathname);
+	} catch {
+		return false;
+	}
+	const base = server.config.base;
+	let decodedBase = base;
+	try {
+		decodedBase = decodeURI(base);
+	} catch {}
+	const origin = server.config.server.origin?.replace(/\/+$/, "");
+	const urls = [...new Set([pathname, decodedPathname].flatMap((p) => {
+		const underBase = [base, decodedBase].map((b) => b + p.slice(1));
+		return [
+			p,
+			...underBase,
+			...origin ? underBase.map((u) => origin + u) : []
+		];
+	}))];
+	const file = resolveStaticFile(server, decodedPathname);
+	const isAsset = server.config.assetsInclude(file);
+	for (const environment of Object.values(server.environments)) for (const module of environment.moduleGraph.getModulesByFile(file) ?? []) {
+		const code = module.transformResult?.code;
+		if (code && isAssetUrlModule(module.url, isAsset) && urls.some((u) => containsAssetUrl(code, u))) return true;
+		for (const importer of module.importers) {
+			const code = importer.transformResult?.code;
+			if (!code) continue;
+			const css = isCSSRequest(importer.url);
+			if (urls.some((u) => css ? containsCssUrl(code, u) : code.includes(`new URL("${u}", '' + import.meta.url)`))) return true;
+		}
+	}
+	return false;
+}
+/**
+* Whether a module for the file exports the file's URL: a `?url` import, or an
+* import of an asset without Vite's `raw` or `inline` queries, which export its
+* contents.
+*/
+function isAssetUrlModule(moduleUrl, isAsset) {
+	if (/[?&]url(?:&|$)/.test(moduleUrl)) return true;
+	return isAsset && !/[?&](?:raw|inline)(?:&|$)/.test(moduleUrl);
+}
+/**
+* Whether an asset module's code exports `url` as a JS string, possibly with a
+* query or fragment, as Vite's asset plugin emits it.
+*/
+function containsAssetUrl(code, url) {
+	return [
+		`"${url}"`,
+		`"${url}?`,
+		`"${url}#`
+	].some((literal) => code.includes(literal));
+}
+/**
+* The file `viteServeStaticMiddleware` serves for a decoded pathname, applying
+* `resolve.alias` the same way it does, so the file checked is the file served.
+*
+* @param server - The Vite dev server
+* @param pathname - The decoded request pathname, with any `base` stripped
+* @returns The absolute file path
+*/
+function resolveStaticFile(server, pathname) {
+	const root = server.config.root;
+	for (const { find, replacement } of server.config.resolve.alias) if (typeof find === "string" ? pathname.startsWith(find) : find.test(pathname)) {
+		const redirected = pathname.replace(find, replacement);
+		return path.join(root, redirected.startsWith(root + "/") ? redirected.slice(root.length) : redirected);
+	}
+	return path.join(root, pathname);
+}
+/**
+* Whether stylesheet code contains `url` as a resolved `url()` or `image-set()`
+* reference, the only places Vite rewrites asset URLs in CSS. The code may be
+* the CSS itself or a JS string of it, and the URL may be quoted and may keep a
+* query or fragment from the source.
+*
+* @param code - Transformed stylesheet code
+* @param url - The URL path to look for
+* @returns `true` if the URL appears as a CSS URL
+*/
+function containsCssUrl(code, url) {
+	for (let index = code.indexOf(url); index !== -1; index = code.indexOf(url, index + 1)) {
+		const after = code[index + url.length];
+		if (after === void 0 || !/[)"',?#\\\s]/.test(after)) continue;
+		const start = Math.max(0, index - 32);
+		const before = code.slice(start, index);
+		const urlFunction = /(^|[^\w\-\u0080-\uffff])url\(\s*\\?["']?$/.exec(before);
+		if (urlFunction && (urlFunction[1] !== "" || start === 0)) return true;
+		if (!/["']$/.test(before)) continue;
+		const imageSet = code.lastIndexOf("image-set(", index);
+		if (imageSet !== -1 && !/[;{}]/.test(code.slice(imageSet, index))) return true;
+	}
+	return false;
+}
+//#endregion
+export { VITE_MODULE_MIDDLEWARE_NAMES, VITE_STATIC_MIDDLEWARE_NAME, createCloudflareDevModuleUrlsPlugin };

package/dist/plugins/commonjs-esm-facade.js

@@ -1,4 +1,4 @@
-import { parseAst } from "vite";
+import { parseProgram } from "./ast-utils.js";
 import MagicString from "magic-string";
 //#region src/plugins/commonjs-esm-facade.ts
 const EXPORT_FACADE_START = "/* [vite-plugin-commonjs] export-statement-S */";
@@ -9,7 +9,7 @@ function hasEsmExports(code) {
 	if (!EXPORT_KEYWORD_RE.test(code)) return false;
 	let ast;
 	try {
-		ast = parseAst(code);
+		ast = parseProgram(code);
 	} catch {
 		return false;
 	}

package/dist/plugins/css-module-imports.js

@@ -1,32 +1,25 @@
-import { SCRIPT_MODULE_ID_RE, scriptParserLanguage } from "./ast-utils.js";
+import { LEADING_TRIVIA_RE, SCRIPT_MODULE_ID_RE, hasImportAttributes, parseModuleRecord, scriptParserLanguage } from "./ast-utils.js";
 import { magicStringTransformResult } from "./transform-result.js";
-import { parseAst } from "vite";
 import MagicString from "magic-string";
 //#region src/plugins/css-module-imports.ts
 const CSS_MODULE_RE = /\.module\.(?:css|scss|sass)$/i;
 const CSS_MODULE_HINT_RE = /\.module\.(?:css|scss|sass)/i;
 const MDX_RE = /\.mdx$/i;
 function rewriteCssModuleNamespaceImports(code, lang = "js") {
-	let ast;
-	try {
-		ast = parseAst(code, { lang });
-	} catch {
-		return null;
-	}
+	const record = parseModuleRecord(code, lang);
+	if (!record) return null;
 	let output = null;
-	for (const statement of ast.body) {
-		if (statement.type !== "ImportDeclaration") continue;
-		if (statement.importKind === "type") continue;
-		if (typeof statement.source?.value !== "string") continue;
-		if (!CSS_MODULE_RE.test(statement.source.value)) continue;
-		if (statement.attributes && statement.attributes.length > 0) continue;
-		if (statement.specifiers?.length !== 1) continue;
-		const specifier = statement.specifiers[0];
-		if (specifier.type !== "ImportNamespaceSpecifier") continue;
-		if (typeof specifier.start !== "number" || typeof specifier.end !== "number") continue;
-		if (typeof specifier.local?.name !== "string") continue;
+	for (const statement of record.staticImports) {
+		if (!CSS_MODULE_RE.test(statement.moduleRequest.value)) continue;
+		if (hasImportAttributes(code, statement.moduleRequest.end, statement.end)) continue;
+		if (statement.entries.length !== 1) continue;
+		const [entry] = statement.entries;
+		if (entry.isType || entry.importName.kind !== "NamespaceObject") continue;
+		const afterImport = statement.start + 6;
+		const starIndex = afterImport + (LEADING_TRIVIA_RE.exec(code.slice(afterImport, entry.localName.start))?.[0].length ?? 0);
+		if (code[starIndex] !== "*") continue;
 		output ??= new MagicString(code);
-		output.overwrite(specifier.start, specifier.end, specifier.local.name);
+		output.overwrite(starIndex, entry.localName.end, entry.localName.value);
 	}
 	if (!output) return null;
 	return magicStringTransformResult(output, { hires: true });

package/dist/plugins/dynamic-preload-metadata.d.ts

@@ -7,5 +7,5 @@ type TransformResult = {
 };
 type ResolveDynamicImport = (specifier: string, importer: string) => Promise<string | null>;
 export declare function transformNextDynamicPreloadMetadata(code: string, id: string, root: string, resolveDynamicImport: ResolveDynamicImport): Promise<TransformResult | null>;
-export declare function createDynamicPreloadMetadataPlugin(): Plugin;
+export declare function createDynamicPreloadMetadataPlugin(getTranspiledPackages: () => readonly string[]): Plugin;
 //#endregion

package/dist/plugins/dynamic-preload-metadata.js

@@ -1,10 +1,10 @@
 import path, { toSlash } from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
-import { collectBindingNames, forEachAstChild, stringLiteralValue, walkAst } from "./ast-utils.js";
+import { collectBindingNames, forEachAstChild, parseProgram, stringLiteralValue, walkAst } from "./ast-utils.js";
 import { hasTrailingComma } from "../utils/has-trailing-comma.js";
 import { magicStringTransformResult } from "./transform-result.js";
 import { stripViteModuleQuery } from "../utils/path.js";
-import { relativeWithinRoot, tryRealpathSync } from "../build/ssr-manifest.js";
-import { parseAst } from "vite";
+import { isForeignNodeModule } from "../utils/package-name.js";
+import { relativeToRoot, relativeWithinRoot, tryRealpathSync } from "../build/ssr-manifest.js";
 import MagicString from "magic-string";
 //#region src/plugins/dynamic-preload-metadata.ts
 function isNextDynamicSource(source) {
@@ -204,7 +204,7 @@ function toManifestModuleId(root, resolvedId) {
 		const relative = relativeWithinRoot(rootCandidate, moduleCandidate);
 		if (relative) return relative;
 	}
-	return null;
+	return relativeToRoot(root, cleaned) || null;
 }
 async function resolveManifestModuleIds(specifiers, importer, root, resolveDynamicImport) {
 	const resolvedIds = [];
@@ -238,7 +238,7 @@ async function transformNextDynamicPreloadMetadata(code, id, root, resolveDynami
 	if (!code.includes("next/dynamic")) return null;
 	let ast;
 	try {
-		ast = parseAst(code);
+		ast = parseProgram(code);
 	} catch (error) {
 		if (typeof process !== "undefined" && process.env?.DEBUG?.includes("vinext")) console.debug(`[vinext] dynamic-preload-metadata: failed to parse ${id}:`, error);
 		return null;
@@ -262,24 +262,24 @@ async function transformNextDynamicPreloadMetadata(code, id, root, resolveDynami
 	if (!changed) return null;
 	return magicStringTransformResult(output);
 }
-function createDynamicPreloadMetadataPlugin() {
+function createDynamicPreloadMetadataPlugin(getTranspiledPackages) {
 	let root = toSlash(process.cwd());
+	let isBuild = false;
 	return {
 		name: "vinext:dynamic-preload-metadata",
 		configResolved(config) {
 			root = config.root;
+			isBuild = config.command === "build";
 		},
 		transform: {
 			filter: {
-				id: {
-					include: /\.(tsx?|jsx?|mjs)$/,
-					exclude: /node_modules/
-				},
+				id: /\.(tsx?|jsx?|mjs)$/,
 				code: "next/dynamic"
 			},
 			async handler(code, id) {
-				if (id.includes("node_modules") || id.startsWith("\0")) return null;
+				if (id.startsWith("\0")) return null;
 				if (!/\.(tsx?|jsx?|mjs)$/.test(id)) return null;
+				if (id.includes("node_modules") && (!isBuild || isForeignNodeModule(id, getTranspiledPackages()))) return null;
 				const result = await transformNextDynamicPreloadMetadata(code, id, root, async (specifier, importer) => {
 					return (await this.resolve(specifier, importer, { skipSelf: true }))?.id ?? null;
 				});

package/dist/plugins/extensionless-dynamic-import.js

@@ -1,13 +1,12 @@
 import path, { toSlash } from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { escapeRegExp } from "../utils/regex.js";
-import { DYNAMIC_IMPORT_PRESCAN, SCRIPT_MODULE_ID_RE, scriptParserLanguage, walkAst } from "./ast-utils.js";
+import { DYNAMIC_IMPORT_PRESCAN, SCRIPT_MODULE_ID_RE, parseProgram, scriptParserLanguage, walkAst } from "./ast-utils.js";
 import { isUnknownRecord } from "../utils/record.js";
 import { magicStringTransformResult } from "./transform-result.js";
 import { NODE_MODULES_PATH_RE } from "../utils/path.js";
 import { createTransformCache } from "./transform-cache.js";
 import { createRequire } from "node:module";
 import fs from "node:fs";
-import { parseAst } from "vite";
 import MagicString from "magic-string";
 //#region src/plugins/extensionless-dynamic-import.ts
 const MODULE_EXTENSIONS = [
@@ -63,7 +62,7 @@ function transformExtensionlessImports(code, id, config) {
 	const lang = scriptParserLanguage(id);
 	let ast;
 	try {
-		ast = parseAst(code, { lang });
+		ast = parseProgram(code, { lang });
 	} catch {
 		return null;
 	}

package/dist/plugins/fonts.d.ts

@@ -31,7 +31,7 @@ export declare const RESOLVED_VIRTUAL_GOOGLE_FONTS: string;
 export declare function _rewriteCachedFontCssToServedUrls(css: string, assetsDir?: string): string;
 /**
  * Safely parse a static JS object literal string into a plain object.
- * Uses Vite's parseAst (Rollup/acorn) so no code is ever evaluated.
+ * Uses Vite's bundled oxc parser so no code is ever evaluated.
  * Returns null if the expression contains anything dynamic (function calls,
  * template literals, identifiers, computed properties, etc.).
  *

package/dist/plugins/fonts.js

@@ -1,5 +1,6 @@
 import path, { toSlash } from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { escapeRegExp } from "../utils/regex.js";
+import { parseProgram } from "./ast-utils.js";
 import { lastSignificantChar } from "../utils/has-trailing-comma.js";
 import { magicStringTransformResult } from "./transform-result.js";
 import { buildFallbackFontFace, getFallbackFontOverrideMetrics } from "../build/google-fonts/fallback-metrics.js";
@@ -10,7 +11,6 @@ import { findFontFilesInCss } from "../build/google-fonts/find-font-files-in-css
 import { ASSET_PREFIX_URL_DIR } from "../utils/asset-prefix.js";
 import { CONTENT_TYPES } from "../server/static-file-cache.js";
 import fs from "node:fs";
-import { parseAst } from "vite";
 import MagicString from "magic-string";
 //#region src/plugins/fonts.ts
 /**
@@ -127,7 +127,7 @@ function _rewriteCachedFontCssToServedUrls(css, assetsDir = DEFAULT_ASSETS_DIR)
 const DEFAULT_ASSETS_DIR = ASSET_PREFIX_URL_DIR;
 /**
 * Safely parse a static JS object literal string into a plain object.
-* Uses Vite's parseAst (Rollup/acorn) so no code is ever evaluated.
+* Uses Vite's bundled oxc parser so no code is ever evaluated.
 * Returns null if the expression contains anything dynamic (function calls,
 * template literals, identifiers, computed properties, etc.).
 *
@@ -137,7 +137,7 @@ const DEFAULT_ASSETS_DIR = ASSET_PREFIX_URL_DIR;
 function parseStaticObjectLiteral(objectStr) {
 	let ast;
 	try {
-		ast = parseAst(`(${objectStr})`);
+		ast = parseProgram(`(${objectStr})`);
 	} catch {
 		return null;
 	}

package/dist/plugins/ignore-dynamic-requests.d.ts

@@ -11,7 +11,7 @@ import { Plugin } from "vite";
  * identifiers, falls through to the AST pass.
  */
 declare function mayContainVeryDynamicRequest(code: string): boolean;
-declare function transformVeryDynamicRequests(code: string, id: string): MagicStringTransformResult | null;
+declare function transformVeryDynamicRequests(code: string, id: string): MagicStringTransformResult<import("magic-string").SourceMap> | null;
 export declare function createIgnoreDynamicRequestsPlugin(getTranspiledPackages?: () => readonly string[]): Plugin;
 export declare const _transformVeryDynamicRequests: typeof transformVeryDynamicRequests;
 export declare const _mayContainVeryDynamicRequest: typeof mayContainVeryDynamicRequest;

package/dist/plugins/ignore-dynamic-requests.js

@@ -1,11 +1,11 @@
-import path, { toSlash } from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
-import { DYNAMIC_IMPORT_PRESCAN, SCRIPT_MODULE_ID_RE, collectBindingNames, forEachAstChild, isIdentifierNamed, mayContainDynamicImport, scriptParserLanguage, stringLiteralValue, unwrapExpression } from "./ast-utils.js";
+import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
+import { DYNAMIC_IMPORT_PRESCAN, SCRIPT_MODULE_ID_RE, collectBindingNames, forEachAstChild, isIdentifierNamed, mayContainDynamicImport, parseProgram, scriptParserLanguage, stringLiteralValue, unwrapExpression } from "./ast-utils.js";
 import { magicStringTransformResult, omitUnusedBuildSourcemap } from "./transform-result.js";
 import { stripViteModuleQuery } from "../utils/path.js";
+import { isForeignNodeModule } from "../utils/package-name.js";
 import { collectDirectScopeBindings, collectLoopScopeBindings, collectSwitchScopeBindings, collectVarScopeBindings, hasAstBinding, isFunctionNode } from "./ast-scope.js";
 import { createTransformCache } from "./transform-cache.js";
 import { fileURLToPath } from "node:url";
-import { parseAst } from "vite";
 import MagicString from "magic-string";
 //#region src/plugins/ignore-dynamic-requests.ts
 const DYNAMIC_REQUEST_ERROR = "Cannot find module as expression is too dynamic";
@@ -410,7 +410,7 @@ function transformVeryDynamicRequests(code, id) {
 	const lang = scriptParserLanguage(id) ?? "js";
 	let ast;
 	try {
-		ast = parseAst(code, { lang });
+		ast = parseProgram(code, { lang });
 	} catch {
 		return null;
 	}
@@ -543,9 +543,7 @@ function createIgnoreDynamicRequestsPlugin(getTranspiledPackages = () => []) {
 }
 function shouldTransformVeryDynamicRequests(environment, id, transpiledPackages) {
 	if (environment.config.consumer === "server") return true;
-	const normalizedId = toSlash(id);
-	if (!normalizedId.includes("/node_modules/")) return false;
-	return !transpiledPackages.some((packageName) => normalizedId.includes(`/node_modules/${packageName}/`));
+	return isForeignNodeModule(id, transpiledPackages);
 }
 const _transformVeryDynamicRequests = transformVeryDynamicRequests;
 const _mayContainVeryDynamicRequest = mayContainVeryDynamicRequest;

package/dist/plugins/import-meta-url.js

@@ -1,11 +1,10 @@
 import path, { toSlash } from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
-import { SCRIPT_MODULE_ID_RE, collectBindingNames, forEachAstChild, isIdentifierNamed, scriptParserLanguage } from "./ast-utils.js";
+import { SCRIPT_MODULE_ID_RE, collectBindingNames, forEachAstChild, isIdentifierNamed, parseProgram, scriptParserLanguage } from "./ast-utils.js";
 import { magicStringTransformResult, omitUnusedBuildSourcemap } from "./transform-result.js";
 import { canonicalizeFilePath, isPathInsideOrEqual, stripViteModuleQuery } from "../utils/path.js";
 import { VIRTUAL_MODULE_ID_RE } from "../utils/virtual-module.js";
 import fs from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { parseAst } from "vite";
 import { randomUUID } from "node:crypto";
 import MagicString from "magic-string";
 //#region src/plugins/import-meta-url.ts
@@ -254,14 +253,14 @@ function finalizeEmittedModuleIdentity(code, emittedIdentitySentinels, fileName)
 function rewriteModuleIdentity(code, options) {
 	let ast;
 	try {
-		ast = parseAst(code, {
+		ast = parseProgram(code, {
 			lang: scriptParserLanguage(options.id) ?? "jsx",
 			sourceType: options.cjsGlobalInitializers ? "commonjs" : void 0
 		});
 	} catch {
 		if (!options.cjsGlobalInitializers) return null;
 		try {
-			ast = parseAst(code, { lang: scriptParserLanguage(options.id) ?? "jsx" });
+			ast = parseProgram(code, { lang: scriptParserLanguage(options.id) ?? "jsx" });
 		} catch {
 			return null;
 		}

package/dist/plugins/instrumentation-client.js

@@ -1,10 +1,11 @@
+import { parseProgram } from "./ast-utils.js";
 import { magicStringTransformResult } from "./transform-result.js";
 import { stripViteModuleQuery } from "../utils/path.js";
-import { normalizePath, parseAst } from "vite";
+import { normalizePath } from "vite";
 import MagicString from "magic-string";
 //#region src/plugins/instrumentation-client.ts
 function insertionPositionAfterDirectives(code) {
-	const ast = parseAst(code);
+	const ast = parseProgram(code);
 	let insertPos = 0;
 	for (const node of ast.body) {
 		if (node.type !== "ExpressionStatement" || node.directive === void 0) break;

package/dist/plugins/middleware-export-validation.js

@@ -1,9 +1,8 @@
-import { getAstName, scriptParserLanguage } from "./ast-utils.js";
+import { getAstName, parseProgram, scriptParserLanguage } from "./ast-utils.js";
 import { createMiddlewareMissingExportError } from "../server/middleware-runtime.js";
-import { parseAst } from "vite";
 //#region src/plugins/middleware-export-validation.ts
 function hasValidMiddlewareModuleExport(source, id, isProxy) {
-	const ast = parseAst(source, { lang: scriptParserLanguage(id) ?? "jsx" });
+	const ast = parseProgram(source, { lang: scriptParserLanguage(id) ?? "jsx" });
 	const expectedExport = isProxy ? "proxy" : "middleware";
 	for (const statement of ast.body) {
 		if (statement.type === "ExportDefaultDeclaration") return true;

package/dist/plugins/middleware-server-only.d.ts

@@ -29,10 +29,11 @@ import { Plugin } from "vite";
  *      to the tainted set. This propagates the taint along the import graph
  *      synchronously, before plugin-rsc's `order: "pre"` validate-imports
  *      handler sees the next `server-only` request.
- *   3. When a tainted module imports `server-only` in a non-RSC environment,
- *      short-circuit to the no-op shim path so plugin-rsc's filter (which
- *      matches the bare `^server-only$` specifier) never fires for that
- *      import.
+ *   3. When a tainted module imports `server-only` in a non-RSC server
+ *      environment, short-circuit to the no-op shim path so plugin-rsc's
+ *      filter (which matches the bare `^server-only$` specifier) never fires
+ *      for that import. Browser environments are skipped entirely, so the
+ *      client `server-only` validators still see every import there.
  *
  * The taint set is scoped to the middleware chain only — `server-only`
  * imports from anywhere else (including client component code traversing

package/dist/plugins/middleware-server-only.js

@@ -1,5 +1,6 @@
 import { toSlash } from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { stripViteModuleQuery } from "../utils/path.js";
+import { isServerEnvironment } from "./environment.js";
 //#region src/plugins/middleware-server-only.ts
 /**
 * Allow `import 'server-only'` from neutral server targets (and any module
@@ -30,10 +31,11 @@ import { stripViteModuleQuery } from "../utils/path.js";
 *      to the tainted set. This propagates the taint along the import graph
 *      synchronously, before plugin-rsc's `order: "pre"` validate-imports
 *      handler sees the next `server-only` request.
-*   3. When a tainted module imports `server-only` in a non-RSC environment,
-*      short-circuit to the no-op shim path so plugin-rsc's filter (which
-*      matches the bare `^server-only$` specifier) never fires for that
-*      import.
+*   3. When a tainted module imports `server-only` in a non-RSC server
+*      environment, short-circuit to the no-op shim path so plugin-rsc's
+*      filter (which matches the bare `^server-only$` specifier) never fires
+*      for that import. Browser environments are skipped entirely, so the
+*      client `server-only` validators still see every import there.
 *
 * The taint set is scoped to the middleware chain only — `server-only`
 * imports from anywhere else (including client component code traversing
@@ -71,7 +73,8 @@ function createMiddlewareServerOnlyPlugin(options) {
 		resolveId: {
 			order: "pre",
 			async handler(id, importer, opts) {
-				if (this.environment?.name === "rsc") return;
+				const environment = this.environment;
+				if (!environment || !isServerEnvironment(environment) || environment.name === "rsc") return;
 				if (!importer) return;
 				if (!isTainted(importer) && !options.isNeutralServerModule?.(canonicalizeId(importer))) return;
 				if (id === "server-only") return {

package/dist/plugins/og-harfbuzz.js

@@ -1,11 +1,10 @@
 import path, { toSlash } from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
-import { forEachAstChild, getAstName, staticStringValue } from "./ast-utils.js";
+import { forEachAstChild, getAstName, parseProgram, staticStringValue } from "./ast-utils.js";
 import { magicStringTransformResult, omitUnusedBuildSourcemap } from "./transform-result.js";
 import { isFunctionNode } from "./ast-scope.js";
 import { createTransformCache } from "./transform-cache.js";
 import { createRequire } from "node:module";
 import fs from "node:fs";
-import { parseAst } from "vite";
 import MagicString from "magic-string";
 //#region src/plugins/og-harfbuzz.ts
 /**
@@ -220,7 +219,7 @@ function patchHarfbuzzBundle(code, id, isBuild, callbackModuleDir, error) {
 	const ogEntry = toSlash(id.split("?", 1)[0]);
 	const isWorkerd = ogEntry.endsWith("/index.edge.js");
 	const fail = (reason) => error(`[vinext] Unsupported @vercel/og HarfBuzz bundle in ${ogEntry}: ${reason}. vinext must be updated to support this @vercel/og version.`);
-	const sites = findHarfbuzzPatchSites(parseAst(code, { lang: "js" }));
+	const sites = findHarfbuzzPatchSites(parseProgram(code, { lang: "js" }));
 	if (typeof sites === "string") return fail(sites);
 	const output = new MagicString(code);
 	for (const flag of sites.environmentFlags) output.overwrite(flag.start, flag.end, "false");