vinext 1.2.0 → 1.3.0

package/dist/plugins/rsc-client-reference-loaders.js

@@ -1,46 +1,364 @@
+import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
+import { CLIENT_REFERENCE_GROUP_MAX_COST_BYTES, collectClientReferencePreloadPlan, collectClientReferenceRouteSignatures, measureClientReferenceGroupCosts, planClientReferenceGroups, readClientModuleBindings } from "../build/client-reference-groups.js";
+import { hasUserClientChunkGroups } from "../build/client-build-config.js";
+import fs from "node:fs";
+import { isCSSRequest } from "vite";
 //#region src/plugins/rsc-client-reference-loaders.ts
 const CLIENT_REFERENCES_ID = "\0virtual:vite-rsc/client-references";
 const RESOLVED_ID_PROXY_PREFIX = "virtual:vite-rsc/resolved-id/";
+const RESOLVED_CLIENT_REFERENCE_GROUP_PREFIX = `\0virtual:vinext-client-reference-group-`;
+const CLIENT_REFERENCES_ID_RE = /^\0virtual:vite-rsc\/client-references$/;
+const CLIENT_REFERENCE_GROUP_RE = /^virtual:vinext-client-reference-group-/;
+const RESOLVED_CLIENT_REFERENCE_GROUP_RE = /^\0virtual:vinext-client-reference-group-/;
+/**
+* Whether the cost estimate loads a module. Rolldown keeps externals and
+* unresolved `require()`s in `importedIds` under their specifier (a bare name
+* or URL), and never settles a load of one, so only files and `\0` virtual
+* modules are measured.
+*/
+function isMeasured(id) {
+	return id.startsWith("\0") || path.isAbsolute(id);
+}
+/**
+* Whether `id` shares the package `sideEffects` flag of `owner`: it is in the
+* same package, and the package's `sideEffects` field is not a list of files.
+* `uniformSideEffects` caches that last check per package.json path.
+*/
+function isInPackage(id, owner, uniformSideEffects) {
+	const packageJsonPath = owner.packageJsonPath;
+	if (!packageJsonPath) return false;
+	const relative = path.relative(path.dirname(packageJsonPath), id);
+	if (relative.startsWith("..") || relative.split("/").includes("node_modules")) return false;
+	let uniform = uniformSideEffects.get(packageJsonPath);
+	if (uniform === void 0) {
+		try {
+			const { sideEffects } = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+			uniform = sideEffects === void 0 || typeof sideEffects === "boolean";
+		} catch {
+			uniform = false;
+		}
+		uniformSideEffects.set(packageJsonPath, uniform);
+	}
+	return uniform;
+}
 function withResolvedIdProxy(resolvedId) {
 	return resolvedId.startsWith("\0") ? RESOLVED_ID_PROXY_PREFIX + encodeURIComponent(resolvedId) : resolvedId;
 }
-function generateClientReferenceObject(meta) {
-	const exports = meta.renderedExports.slice().sort().map((name) => `      get ${JSON.stringify(name)}() { return m[${JSON.stringify(name)}]; },`).join("\n");
+function sortedRenderedExports(meta) {
+	return meta.renderedExports.slice().sort();
+}
+function groupExportName(slotIndex, exportIndex) {
+	return `r${slotIndex}_${exportIndex}`;
+}
+function generateClientReferenceObject(meta, slot) {
+	const exports = sortedRenderedExports(meta).map((name, exportIndex) => {
+		const value = slot ? `m.${groupExportName(slot.index, exportIndex)}` : `m[${JSON.stringify(name)}]`;
+		return `      get ${JSON.stringify(name)}() { return ${value}; },`;
+	}).join("\n");
 	return exports ? `{\n${exports}\n    }` : "{}";
 }
-function generateDirectClientReferenceLoaders(metas) {
+function generateClientReferenceLoaders(metas, slots = /* @__PURE__ */ new Map()) {
 	return `export default {\n${metas.slice().sort((a, b) => a.referenceKey.localeCompare(b.referenceKey)).map((meta) => {
-		const importId = withResolvedIdProxy(meta.importId);
+		const slot = slots.get(meta);
+		const source = slot ? slot.groupId : withResolvedIdProxy(meta.importId);
 		return [
 			`  ${JSON.stringify(meta.referenceKey)}: async () => {`,
-			`    const m = await import(${JSON.stringify(importId)});`,
-			`    return ${generateClientReferenceObject(meta)};`,
+			`    const m = await import(${JSON.stringify(source)});`,
+			`    return ${generateClientReferenceObject(meta, slot)};`,
 			`  },`
 		].join("\n");
 	}).join("\n")}\n};\n`;
 }
-function createRscClientReferenceLoadersPlugin() {
+/**
+* Re-export only each member's rendered exports, as live bindings, so unused
+* exports and their dependencies still tree-shake as they do with direct
+* loaders. A member without rendered exports is imported for its side effects.
+*/
+function generateClientReferenceGroupModule(metas) {
+	return `${metas.map((meta, slotIndex) => {
+		const source = JSON.stringify(withResolvedIdProxy(meta.importId));
+		const specifiers = sortedRenderedExports(meta).map((name, exportIndex) => {
+			return `${/^[A-Za-z_$][\w$]*$/.test(name) ? name : JSON.stringify(name)} as ${groupExportName(slotIndex, exportIndex)}`;
+		});
+		return specifiers.length > 0 ? `export { ${specifiers.join(", ")} } from ${source};` : `import ${source};`;
+	}).join("\n")}\n`;
+}
+/**
+* The SSR build's `routeClientReferences` export: the reference keys each route
+* preloads before it renders (see server/app-client-reference-preloader.ts),
+* stored as indices into `references`. Client references the plan doesn't know
+* join `always`.
+*/
+function generateRouteClientReferencesExport(plan, metaEntries) {
+	if (!plan) return "export const routeClientReferences = null;\n";
+	const metaById = new Map(metaEntries);
+	const references = [];
+	const indices = /* @__PURE__ */ new Map();
+	const toIndices = (referenceIds) => referenceIds.flatMap((referenceId) => {
+		const meta = metaById.get(referenceId);
+		if (!meta) return [];
+		let index = indices.get(referenceId);
+		if (index === void 0) {
+			index = references.length;
+			indices.set(referenceId, index);
+			references.push(meta.referenceKey);
+		}
+		return [index];
+	});
+	const manifest = {
+		references,
+		always: toIndices([...plan.preloads.always, ...metaEntries.map(([referenceId]) => referenceId).filter((referenceId) => !plan.referenceIds.has(referenceId))]),
+		files: plan.preloads.files.map(toIndices),
+		routes: Object.fromEntries(plan.preloads.routes),
+		routeless: plan.preloads.routeless
+	};
+	return `export const routeClientReferences = ${JSON.stringify(manifest)};\n`;
+}
+/**
+* Replaces @vitejs/plugin-rsc's client-reference facades with per-reference
+* loaders. With `routes`, the SSR build also exports the client references
+* each App Router route preloads. With `grouping`, production client builds
+* additionally load references that the same App Router routes reach through
+* one shared route group module (see build/client-reference-groups.ts), so a
+* page fetches one chunk per route group instead of one per `"use client"`
+* module.
+*/
+function createRscClientReferenceLoadersPlugin(options = {}) {
+	const { routes: routeOptions } = options;
+	const grouping = routeOptions && options.grouping;
 	let rscApi;
+	let root = "";
+	let groupingEnabled = false;
+	let routeSignatures = /* @__PURE__ */ new Map();
+	// @vitejs/plugin-rsc also builds before the SSR environment.
+	let preloadPlan = null;
+	const groupModules = /* @__PURE__ */ new Map();
 	return {
 		name: "vinext:rsc-client-reference-loaders",
 		enforce: "post",
 		configResolved(config) {
+			root = config.root;
 			rscApi = config.plugins.find((plugin) => plugin.name === "rsc:minimal")?.api;
 		},
-		transform(_code, id) {
-			if (id !== CLIENT_REFERENCES_ID) return null;
+		outputOptions: {
+			order: "post",
+			handler(output) {
+				if (this.environment?.name !== "client") return;
+				groupingEnabled = !!grouping && !hasUserClientChunkGroups(output, grouping.ownClientChunkGroups);
+			}
+		},
+		buildStart() {
+			if (this.environment.name === "rsc") {
+				routeSignatures = /* @__PURE__ */ new Map();
+				preloadPlan = null;
+			}
+			if (this.environment.name === "client") groupModules.clear();
+		},
+		buildEnd(error) {
+			if (error || !routeOptions) return;
+			if (this.environment.name !== "rsc" || this.environment.mode !== "build") return;
 			const manager = rscApi?.manager;
-			if (!manager || manager.isScanBuild) return null;
-			const metaEntries = Object.entries(manager.clientReferenceMetaMap).filter(([, meta]) => meta.serverChunk);
-			const metas = metaEntries.map(([, meta]) => meta);
-			if (metas.length === 0) return null;
-			for (const [id, meta] of metaEntries) meta.groupChunkId = id;
-			return {
-				code: generateDirectClientReferenceLoaders(metas),
-				map: null
+			const routes = routeOptions.getRoutes();
+			if (!manager || manager.isScanBuild || !routes) return;
+			const clientReferenceIds = new Set(Object.keys(manager.clientReferenceMetaMap));
+			const getModuleInfo = (id) => this.getModuleInfo(id);
+			preloadPlan = {
+				referenceIds: clientReferenceIds,
+				preloads: collectClientReferencePreloadPlan({
+					alwaysRoots: routeOptions.getAlwaysRenderedFiles(),
+					canonicalizeModuleId: routeOptions.canonicalizeModuleId,
+					clientReferenceIds,
+					entryIds: [...this.getModuleIds()].filter((id) => this.getModuleInfo(id)?.isEntry),
+					getModuleInfo,
+					routelessFiles: routeOptions.getRoutelessFiles(),
+					routes
+				})
 			};
+			if (!grouping) return;
+			routeSignatures = collectClientReferenceRouteSignatures({
+				canonicalizeModuleId: routeOptions.canonicalizeModuleId,
+				clientReferenceIds,
+				getModuleInfo,
+				root,
+				routes,
+				sharedRoots: routeOptions.getSharedRoots()
+			});
+		},
+		resolveId: {
+			filter: { id: CLIENT_REFERENCE_GROUP_RE },
+			handler(source) {
+				return groupModules.has(`\0${source}`) ? `\0${source}` : null;
+			}
+		},
+		load: {
+			filter: { id: RESOLVED_CLIENT_REFERENCE_GROUP_RE },
+			handler(id) {
+				return groupModules.get(id) ?? null;
+			}
+		},
+		transform: {
+			filter: { id: CLIENT_REFERENCES_ID_RE },
+			async handler(code) {
+				const manager = rscApi?.manager;
+				if (!manager || manager.isScanBuild) return null;
+				const isServer = this.environment.config.consumer === "server";
+				const metaEntries = Object.entries(manager.clientReferenceMetaMap).filter(([, meta]) => meta.serverChunk);
+				const metas = metaEntries.map(([, meta]) => meta);
+				const routeClientReferencesExport = isServer ? generateRouteClientReferencesExport(preloadPlan, metaEntries) : "";
+				if (metas.length === 0) return isServer ? {
+					code: `${code}\n${routeClientReferencesExport}`,
+					map: null
+				} : null;
+				for (const [id, meta] of metaEntries) meta.groupChunkId = id;
+				const slots = /* @__PURE__ */ new Map();
+				const referenceIds = new Set(metaEntries.map(([referenceId]) => referenceId));
+				const referenceKeys = new Map(metaEntries.map(([referenceId, meta]) => [referenceId, meta.referenceKey]));
+				if (grouping && groupingEnabled && this.environment.name === "client" && this.environment.mode === "build" && planClientReferenceGroups({
+					referenceIds,
+					referenceKeys,
+					signatures: routeSignatures,
+					costs: new Map([...referenceIds].map((referenceId) => [referenceId, 0])),
+					maxCostBytes: 0
+				}).length > 0) {
+					const references = /* @__PURE__ */ new Map();
+					const resolutions = /* @__PURE__ */ new Map();
+					const packages = /* @__PURE__ */ new Map();
+					const externalIds = /* @__PURE__ */ new Set();
+					const uniformSideEffects = /* @__PURE__ */ new Map();
+					const resolveCache = /* @__PURE__ */ new Map();
+					const addResolution = (resolved) => {
+						resolutions.set(resolved.id, resolved);
+						packages.set(resolved.id, resolved);
+					};
+					await Promise.all(metaEntries.map(async ([referenceId, meta]) => {
+						if (meta.importId.startsWith("\0")) {
+							references.set(referenceId, meta.importId);
+							return;
+						}
+						const resolved = await this.resolve(meta.importId);
+						if (!resolved || resolved.external) return;
+						references.set(referenceId, resolved.id);
+						addResolution(resolved);
+					}));
+					const { external } = this.environment.config.build.rolldownOptions;
+					const moduleInfos = /* @__PURE__ */ new Map();
+					const excludedById = /* @__PURE__ */ new Map();
+					const isExcludedById = (moduleId) => {
+						let excluded = excludedById.get(moduleId);
+						if (excluded === void 0) {
+							excluded = !isMeasured(moduleId) || moduleId === CLIENT_REFERENCES_ID || moduleId.startsWith(RESOLVED_CLIENT_REFERENCE_GROUP_PREFIX) || isCSSRequest(moduleId) || grouping.isAlwaysLoadedClientModule(moduleId);
+							excludedById.set(moduleId, excluded);
+						}
+						return excluded;
+					};
+					const costs = await measureClientReferenceGroupCosts({
+						references,
+						loadModule: async (moduleId) => {
+							if (external && !resolutions.has(moduleId) && !moduleId.startsWith("\0")) {
+								const resolved = await this.resolve(moduleId);
+								if (!resolved || resolved.external) return {
+									code: "",
+									importedIds: []
+								};
+							}
+							const info = await this.load(resolutions.get(moduleId) ?? { id: moduleId });
+							moduleInfos.set(moduleId, info);
+							const { code, importedIds } = info;
+							if (code === null) return {
+								code,
+								importedIds
+							};
+							const importedIdSet = new Set(importedIds);
+							const owner = packages.get(moduleId);
+							return {
+								code,
+								importedIds,
+								bindings: await readClientModuleBindings({
+									code,
+									importedIds,
+									resolve: async (specifier) => {
+										if (owner && path.isAbsolute(moduleId) && (specifier.startsWith("./") || specifier.startsWith("../"))) {
+											const candidate = path.resolve(path.dirname(moduleId), specifier);
+											if (importedIdSet.has(candidate) && isInPackage(candidate, owner, uniformSideEffects)) {
+												packages.set(candidate, owner);
+												return candidate;
+											}
+										}
+										const key = `${path.dirname(moduleId)}\0${specifier}`;
+										let resolving = resolveCache.get(key);
+										if (!resolving) {
+											resolving = this.resolve(specifier, moduleId).then((resolved) => {
+												if (!resolved) return null;
+												if (resolved.external) externalIds.add(resolved.id);
+												else addResolution(resolved);
+												return resolved.id;
+											});
+											resolveCache.set(key, resolving);
+										}
+										return resolving;
+									}
+								})
+							};
+						},
+						isSideEffectFree: (moduleId) => packages.get(moduleId)?.moduleSideEffects === false,
+						isExcluded: (moduleId) => externalIds.has(moduleId) || isExcludedById(moduleId)
+					});
+					for (const [referenceId, meta] of metaEntries) {
+						const moduleId = references.get(referenceId);
+						const info = moduleId === void 0 ? void 0 : moduleInfos.get(moduleId);
+						if (!info || info.inputFormat === "cjs") continue;
+						if (meta.renderedExports.some((name) => !info.exports.includes(name))) costs.set(referenceId, null);
+					}
+					const groups = planClientReferenceGroups({
+						referenceIds,
+						referenceKeys,
+						signatures: routeSignatures,
+						costs,
+						maxCostBytes: CLIENT_REFERENCE_GROUP_MAX_COST_BYTES
+					});
+					const metaById = new Map(metaEntries);
+					for (const group of groups) {
+						const groupMetas = group.referenceIds.map((referenceId) => metaById.get(referenceId));
+						const resolvedGroupId = `${RESOLVED_CLIENT_REFERENCE_GROUP_PREFIX}${group.key}`;
+						groupModules.set(resolvedGroupId, generateClientReferenceGroupModule(groupMetas));
+						groupMetas.forEach((meta, index) => {
+							meta.groupChunkId = resolvedGroupId;
+							slots.set(meta, {
+								groupId: resolvedGroupId.slice(1),
+								index
+							});
+						});
+					}
+				}
+				return {
+					code: generateClientReferenceLoaders(metas, slots) + routeClientReferencesExport,
+					map: null
+				};
+			}
+		}
+	};
+}
+/**
+* Exports a null preload plan from the client-references virtual module when
+* the app registers @vitejs/plugin-rsc itself (`rsc: false`), where vinext
+* doesn't add the loaders plugin above. The App Router SSR entry imports the
+* plan, and null makes it preload every client reference.
+*/
+function createRouteClientReferencesFallbackPlugin() {
+	return {
+		name: "vinext:route-client-references-fallback",
+		enforce: "post",
+		transform: {
+			filter: { id: CLIENT_REFERENCES_ID_RE },
+			handler(code) {
+				if (this.environment.config.consumer !== "server") return null;
+				return {
+					code: `${code}\n${generateRouteClientReferencesExport(null, [])}`,
+					map: null
+				};
+			}
 		}
 	};
 }
 //#endregion
-export { createRscClientReferenceLoadersPlugin };
+export { createRouteClientReferencesFallbackPlugin, createRscClientReferenceLoadersPlugin };

package/dist/plugins/strip-server-exports.js

@@ -1,7 +1,6 @@
-import { getAstName } from "./ast-utils.js";
+import { getAstName, parseProgram } from "./ast-utils.js";
 import { magicStringTransformResult } from "./transform-result.js";
 import { findAstBindingScope, walkAstScopes } from "./ast-scope.js";
-import { parseAst } from "vite";
 import MagicString from "magic-string";
 //#region src/plugins/strip-server-exports.ts
 const SERVER_EXPORTS = /* @__PURE__ */ new Set([
@@ -225,7 +224,7 @@ function validatePageExports(code) {
 	if (!hasExportAllCandidate(code)) return;
 	let ast;
 	try {
-		ast = parseAst(code);
+		ast = parseProgram(code);
 	} catch {
 		return;
 	}
@@ -243,7 +242,7 @@ function stripServerExports(code) {
 	if (!hasServerExportCandidate(code) && !hasExportAllCandidate(code)) return null;
 	let ast;
 	try {
-		ast = parseAst(code);
+		ast = parseProgram(code);
 	} catch {
 		return null;
 	}

package/dist/plugins/styled-jsx.js

@@ -1,9 +1,8 @@
 import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
-import { SCRIPT_MODULE_ID_RE, walkAst } from "./ast-utils.js";
+import { SCRIPT_MODULE_ID_RE, parseProgram, walkAst } from "./ast-utils.js";
 import { NODE_MODULES_PATH_RE, stripViteModuleQuery } from "../utils/path.js";
 import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
-import { parseAst } from "vite";
 //#region src/plugins/styled-jsx.ts
 const STYLED_JSX_IMPORT_RE = /^styled-jsx(?:\/.*)?$/;
 const STYLED_JSX_SOURCE_RE = /(?:<style\b|from\s+["']styled-jsx\/css["']|require\s*\(\s*["']styled-jsx\/css["']\s*\))/;
@@ -14,7 +13,7 @@ function hasStyledJsxTag(source, id) {
 	const lang = extension === ".ts" || extension === ".mts" || extension === ".cts" ? "ts" : "tsx";
 	let ast;
 	try {
-		ast = parseAst(source, { lang });
+		ast = parseProgram(source, { lang });
 	} catch {
 		return false;
 	}

package/dist/plugins/use-cache-callable.d.ts

@@ -1,9 +1,33 @@
 import { Plugin } from "vite";
 //#region src/plugins/use-cache-callable.d.ts
+type RscTransforms = typeof import("@vitejs/plugin-rsc/transforms");
 type Options = {
   projectRoot: string;
   cacheRuntime: string;
   allowMissingRsc?: boolean;
+  /**
+   * The Server Actions encryption key vinext loaded for an auto-registered
+   * @vitejs/plugin-rsc, so reference names derive from the same key.
+   */
+  getEncryptionKey?: () => string | undefined;
 };
-export declare function createUseCacheCallablePlugin(options: Options): Promise<Plugin>;
-//#endregion
+type BrowserTransformOptions = {
+  environmentName: string;
+  reference: {
+    referenceKey: string;
+  };
+  secureExportName: (name: string) => string;
+  createReference: (referenceId: string, name: string) => string;
+};
+type BrowserTransformOutput = NonNullable<ReturnType<RscTransforms["transformDirectiveProxyExport"]>>;
+export type UseCacheCallableApi = {
+  /**
+   * Compile a browser Web Worker module like the client environment does,
+   * with the same reference ids, without claiming references.
+   */
+  transformWorkerModule(code: string, id: string, createReference: BrowserTransformOptions["createReference"]): Promise<BrowserTransformOutput["output"] | undefined>;
+};
+declare const PLUGIN_NAME = "vinext:server-function-directives";
+export declare function createUseCacheCallablePlugin(options: Options): Promise<Plugin<UseCacheCallableApi>>;
+//#endregion
+export { PLUGIN_NAME as USE_CACHE_PLUGIN_NAME };

package/dist/plugins/use-cache-callable.js

@@ -1,10 +1,11 @@
 import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
+import { parseProgramAsync } from "./ast-utils.js";
 import { magicStringTransformResult } from "./transform-result.js";
 import { NODE_MODULES_PATH_RE } from "../utils/path.js";
+import { getServerActionsKeyCacheFsDeny, loadOrGenerateServerActionsEncryptionKey } from "../build/server-actions-encryption-key.js";
 import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
-import { parseAstAsync } from "vite";
-import { createHmac, randomBytes } from "node:crypto";
+import { createHmac } from "node:crypto";
 //#region src/plugins/use-cache-callable.ts
 const PLUGIN_NAME = "vinext:server-function-directives";
 const SOURCE_MODULE_ID_RE = /\.(?:tsx?|jsx?|mjs)(?:\?.*)?$/;
@@ -79,19 +80,105 @@ function getCacheWrapperOptions(meta) {
 		...captureCount === 0 ? {} : { captureCount }
 	};
 }
+/**
+* Compile a module for a browser graph: module-level cache functions become
+* server references, and inline ones are rejected as in Next.js Client
+* Components. Returns undefined when the module is unchanged.
+*/
+function transformBrowserModule(transforms, code, ast, id, moduleDirective, options) {
+	if (!moduleDirective) {
+		transforms.transformHoistInlineDirective(code, ast, {
+			directive: USE_CACHE_DIRECTIVE_CANDIDATE,
+			rejectNonAsyncFunction: true,
+			runtime: (_value, _name, meta) => {
+				matchUseCacheDirective(meta.directiveMatch[0]);
+				throw new Error(`It is not allowed to define inline "use cache" annotated functions in Client Components. Export them from a separate file with a module-level "use cache" or "use server" directive, or pass them down through props from a Server Component. (${options.environmentName}: ${id})`);
+			}
+		});
+		return;
+	}
+	const useServerExportNames = getFunctionDirectiveExportNames(transforms, ast, "use server");
+	const referenceName = (name) => useServerExportNames.has(name) ? name : options.secureExportName(name);
+	const result = transforms.transformDirectiveProxyExport(ast, {
+		code,
+		directive: moduleDirective,
+		filter: (name, meta) => {
+			if (!shouldTransformModuleExport(name, id, meta)) return false;
+			validateModuleExport(transforms, meta);
+			return true;
+		},
+		runtime: (name) => options.createReference(`${options.reference.referenceKey}#${referenceName(name)}`, name)
+	});
+	if (!result?.output.hasChanged()) return;
+	return {
+		output: result.output,
+		referenceNames: result.exportNames.map(referenceName)
+	};
+}
+/**
+* Ported from Next.js: crates/next-custom-transforms/src/transforms/server_actions.rs
+* salts server-reference IDs with the encryption key (`serverReferenceHashSalt`
+* in packages/next/src/build/webpack-config.ts), so rebuilds of identical
+* source emit identical client chunks. See
+* loadOrGenerateServerActionsEncryptionKey for where the key comes from. The
+* secret is derived under a label rather than used directly so the reference
+* names reveal nothing about the key.
+*/
+function createReferenceSecret(encryptionKey) {
+	return createHmac("sha256", encryptionKey).update("vinext use cache reference").digest();
+}
 async function createUseCacheCallablePlugin(options) {
 	const rscModulePath = resolvePluginRscModule(options.projectRoot, "@vitejs/plugin-rsc");
 	const transformsPath = resolvePluginRscModule(options.projectRoot, "@vitejs/plugin-rsc/transforms");
 	const rscModule = await import(pathToFileURL(rscModulePath).href);
 	const transforms = await import(pathToFileURL(transformsPath).href);
-	const referenceSecret = randomBytes(32);
+	let referenceSecret;
 	let manager;
+	async function analyzeModule(manager, secret, code, id) {
+		const ast = await parseProgramAsync(code);
+		const moduleDirective = findModuleUseCacheDirective(ast);
+		const useServerBoundary = transforms.hasDirective(ast.body, "use server");
+		if (moduleDirective && useServerBoundary) throw new Error(`A module cannot contain both ${JSON.stringify(moduleDirective)} and "use server" directives.`);
+		const reference = manager.serverReferences.resolve(id, "rsc");
+		const relativeImportId = manager.toRelativeId(reference.importId);
+		const secureExportName = (name) => `$$vinext_cache_${createHmac("sha256", secret).update(relativeImportId).update("\0").update(name).digest("hex")}`;
+		return {
+			ast,
+			moduleDirective,
+			useServerBoundary,
+			reference,
+			secureExportName
+		};
+	}
 	return {
 		name: PLUGIN_NAME,
+		api: { async transformWorkerModule(code, id, createReference) {
+			if (!code.includes("use cache")) return;
+			const secret = referenceSecret;
+			if (!manager || !secret) {
+				if (findModuleUseCacheDirective(await parseProgramAsync(code))) throw new Error("vinext: cannot compile a \"use cache\" module in a Web Worker without @vitejs/plugin-rsc.");
+				return;
+			}
+			const { ast, moduleDirective, useServerBoundary, reference, secureExportName } = await analyzeModule(manager, secret, code, id);
+			if (useServerBoundary) return;
+			return transformBrowserModule(transforms, code, ast, id, moduleDirective, {
+				environmentName: "worker",
+				reference,
+				secureExportName,
+				createReference
+			})?.output;
+		} },
+		config(config) {
+			return { server: { fs: { deny: getServerActionsKeyCacheFsDeny(config.server?.fs?.deny) } } };
+		},
 		configResolved(config) {
 			const pluginApi = rscModule.getPluginApi(config);
 			const hasRscPlugin = config.plugins.some((plugin) => plugin.name === "rsc");
 			if (!pluginApi && options.allowMissingRsc && !hasRscPlugin) return;
+			referenceSecret ??= createReferenceSecret(options.getEncryptionKey?.() ?? loadOrGenerateServerActionsEncryptionKey({
+				root: config.root,
+				isBuild: config.command === "build"
+			}));
 			if (!pluginApi?.manager.serverReferences) throw new Error("vinext: callable use cache requires @vitejs/plugin-rsc 0.5.34 or newer.");
 			if (options.allowMissingRsc) {
 				const useCacheIndex = config.plugins.findIndex((plugin) => plugin.name === PLUGIN_NAME);
@@ -106,53 +193,31 @@ async function createUseCacheCallablePlugin(options) {
 				exclude: [NODE_MODULES_PATH_RE, RESOLVED_VIRTUAL_MODULE_ID_RE]
 			} },
 			async handler(code, id) {
-				if (!manager) return;
+				const secret = referenceSecret;
+				if (!manager || !secret) return;
 				if (!code.includes("use cache")) {
 					manager.serverReferences.deleteClaim(PLUGIN_NAME, id);
 					return;
 				}
-				const ast = await parseAstAsync(code);
-				const moduleDirective = findModuleUseCacheDirective(ast);
-				const useServerBoundary = transforms.hasDirective(ast.body, "use server");
-				if (moduleDirective && useServerBoundary) throw new Error(`A module cannot contain both ${JSON.stringify(moduleDirective)} and "use server" directives.`);
-				const reference = manager.serverReferences.resolve(id, "rsc");
-				const relativeImportId = manager.toRelativeId(reference.importId);
-				const secureExportName = (name) => `$$vinext_cache_${createHmac("sha256", referenceSecret).update(relativeImportId).update("\0").update(name).digest("hex")}`;
+				const { ast, moduleDirective, useServerBoundary, reference, secureExportName } = await analyzeModule(manager, secret, code, id);
 				if (!(this.environment.name === "rsc")) {
 					if (useServerBoundary) {
 						manager.serverReferences.deleteClaim(PLUGIN_NAME, id);
 						return;
 					}
-					if (!moduleDirective) {
-						transforms.transformHoistInlineDirective(code, ast, {
-							directive: USE_CACHE_DIRECTIVE_CANDIDATE,
-							rejectNonAsyncFunction: true,
-							runtime: (_value, _name, meta) => {
-								matchUseCacheDirective(meta.directiveMatch[0]);
-								throw new Error(`It is not allowed to define inline "use cache" annotated functions in Client Components. Export them from a separate file with a module-level "use cache" or "use server" directive, or pass them down through props from a Server Component. (${this.environment.name}: ${id})`);
-							}
-						});
-						manager.serverReferences.deleteClaim(PLUGIN_NAME, id);
-						return;
-					}
-					const useServerExportNames = getFunctionDirectiveExportNames(transforms, ast, "use server");
-					const result = transforms.transformDirectiveProxyExport(ast, {
-						code,
-						directive: moduleDirective,
-						filter: (name, meta) => {
-							if (!shouldTransformModuleExport(name, id, meta)) return false;
-							validateModuleExport(transforms, meta);
-							return true;
-						},
-						runtime: (name) => `$$ReactClient.createServerReference(${JSON.stringify(`${reference.referenceKey}#${useServerExportNames.has(name) ? name : secureExportName(name)}`)},$$ReactClient.callServer,undefined,${this.environment.mode === "dev" ? "$$ReactClient.findSourceMapURL" : "undefined"},${JSON.stringify(name)})`
+					const result = transformBrowserModule(transforms, code, ast, id, moduleDirective, {
+						environmentName: this.environment.name,
+						reference,
+						secureExportName,
+						createReference: (referenceId, name) => `$$ReactClient.createServerReference(${JSON.stringify(referenceId)},$$ReactClient.callServer,undefined,${this.environment.mode === "dev" ? "$$ReactClient.findSourceMapURL" : "undefined"},${JSON.stringify(name)})`
 					});
-					if (!result?.output.hasChanged()) {
+					if (!result) {
 						manager.serverReferences.deleteClaim(PLUGIN_NAME, id);
 						return;
 					}
 					manager.serverReferences.replaceClaim(PLUGIN_NAME, id, {
 						...reference,
-						exportNames: result.exportNames.map((name) => useServerExportNames.has(name) ? name : secureExportName(name))
+						exportNames: result.referenceNames
 					});
 					const runtimeEnvironment = this.environment.name === "client" ? "browser" : "ssr";
 					result.output.prepend(`import * as $$ReactClient from "@vitejs/plugin-rsc/react/${runtimeEnvironment}";\n`);
@@ -223,4 +288,4 @@ async function createUseCacheCallablePlugin(options) {
 	};
 }
 //#endregion
-export { createUseCacheCallablePlugin };
+export { PLUGIN_NAME as USE_CACHE_PLUGIN_NAME, createUseCacheCallablePlugin };

package/dist/plugins/worker-image-imports.d.ts

@@ -1,5 +1,6 @@
 import { Plugin } from "vite";
 //#region src/plugins/worker-image-imports.d.ts
+export declare const WORKER_IMAGE_METADATA_PREFIX = "\0vinext-worker-image-meta:";
 /**
  * Preserve Next.js's StaticImageData shape for dynamic image imports inside
  * Vite worker graphs. Worker builds use their own plugin container, so the