vinext 1.2.1 → 1.3.1

package/dist/build/module-dependency-cache.d.ts

@@ -1,3 +1,35 @@
 //#region src/build/module-dependency-cache.d.ts
 export declare function createModuleDependencyCache<T>(collect: (moduleId: string) => Promise<T>): (moduleId: string) => Promise<T>;
-//#endregion
+export type ModuleDependencyEntry<T> = {
+  dependencies: T[];
+  /** Files the module's imports resolved to, without Vite queries. */
+  resolvedFiles: string[];
+  /**
+   * False when an import did not resolve. Vite only caches modules that
+   * transformed, so it retries those imports on every request. So does the store.
+   */
+  cacheable: boolean;
+};
+type FileEvent = {
+  files: readonly string[];
+  event: "create" | "update" | "delete";
+};
+/**
+ * Dependency lists of source modules, kept across loads of a dev virtual
+ * module. An entry is dropped by the file events that make Vite transform the
+ * module again: an edit, creation or deletion of the module's own file, and
+ * deletion of a file one of its imports resolved to.
+ */
+export declare class ModuleDependencyStore<T> {
+  private readonly entries;
+  private readonly pendingReads;
+  read(moduleId: string, collect: (moduleId: string) => Promise<ModuleDependencyEntry<T>>): Promise<T[]>;
+  /**
+   * `files` holds every spelling of one file, such as its symlinked and real
+   * path. Returns whether an entry was dropped.
+   */
+  invalidate(files: readonly string[], event: FileEvent["event"]): boolean;
+  clear(): void;
+}
+//#endregion
+export {};

package/dist/build/module-dependency-cache.js

@@ -1,3 +1,4 @@
+import { stripViteModuleQuery } from "../utils/path.js";
 //#region src/build/module-dependency-cache.ts
 function createModuleDependencyCache(collect) {
 	const cache = /* @__PURE__ */ new Map();
@@ -9,5 +10,54 @@ function createModuleDependencyCache(collect) {
 		return pending;
 	};
 }
+function isOutdatedBy(moduleId, entry, { files, event }) {
+	return files.includes(stripViteModuleQuery(moduleId)) || event === "delete" && entry.resolvedFiles.some((file) => files.includes(file));
+}
+/**
+* Dependency lists of source modules, kept across loads of a dev virtual
+* module. An entry is dropped by the file events that make Vite transform the
+* module again: an edit, creation or deletion of the module's own file, and
+* deletion of a file one of its imports resolved to.
+*/
+var ModuleDependencyStore = class {
+	entries = /* @__PURE__ */ new Map();
+	pendingReads = /* @__PURE__ */ new Set();
+	async read(moduleId, collect) {
+		const cached = this.entries.get(moduleId);
+		if (cached) return cached.dependencies;
+		const pending = { events: [] };
+		this.pendingReads.add(pending);
+		let entry;
+		try {
+			entry = await collect(moduleId);
+		} finally {
+			this.pendingReads.delete(pending);
+		}
+		if (entry.cacheable && pending.events && !pending.events.some((event) => isOutdatedBy(moduleId, entry, event))) this.entries.set(moduleId, entry);
+		return entry.dependencies;
+	}
+	/**
+	* `files` holds every spelling of one file, such as its symlinked and real
+	* path. Returns whether an entry was dropped.
+	*/
+	invalidate(files, event) {
+		const fileEvent = {
+			files,
+			event
+		};
+		for (const pending of this.pendingReads) pending.events?.push(fileEvent);
+		let dropped = false;
+		for (const [moduleId, entry] of this.entries) {
+			if (!isOutdatedBy(moduleId, entry, fileEvent)) continue;
+			this.entries.delete(moduleId);
+			dropped = true;
+		}
+		return dropped;
+	}
+	clear() {
+		for (const pending of this.pendingReads) pending.events = null;
+		this.entries.clear();
+	}
+};
 //#endregion
-export { createModuleDependencyCache };
+export { ModuleDependencyStore, createModuleDependencyCache };

package/dist/build/next-client-runtime-manifests.d.ts

@@ -1,3 +1,4 @@
+import { ValidFileMatcher } from "../routing/file-matcher.js";
 import { ResolvedNextConfig } from "../config/next-config.js";
 //#region src/build/next-client-runtime-manifests.d.ts
 type EmitNextClientRuntimeManifestsOptions = {
@@ -5,8 +6,17 @@ type EmitNextClientRuntimeManifestsOptions = {
   assetsSubdir: string;
   buildId: string;
   rewrites: ResolvedNextConfig["rewrites"];
+  /** Next.js-format paths of every `pages/` page and API route, e.g. "/posts/[id]". */
+  pages: readonly string[];
 };
-export declare function buildNextClientBuildManifestContent(rewrites: ResolvedNextConfig["rewrites"]): string;
+/**
+ * Next.js page key for a `pages/` file, e.g. "/posts/[id]". Keeps the raw file
+ * name (no decoding), so `pages/caf%C3%A9.js` stays "/caf%C3%A9".
+ * Ported from Next.js: packages/next/src/build/route-discovery.ts (`getPageFromPath`).
+ */
+export declare function getPagesManifestPage(pagesDir: string, filePath: string, matcher: Pick<ValidFileMatcher, "stripExtension">): string;
+export declare function buildNextClientBuildManifestContent(rewrites: ResolvedNextConfig["rewrites"], pages: readonly string[]): string;
 export declare function buildNextClientSsgManifestContent(): string;
 export declare function emitNextClientRuntimeManifests(options: EmitNextClientRuntimeManifestsOptions): void;
-//#endregion
+//#endregion
+export {};

package/dist/build/next-client-runtime-manifests.js

@@ -1,11 +1,26 @@
 import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
+import { getSortedRoutes } from "../routing/route-validation.js";
 import { toClientRewrites } from "../client/client-rewrites.js";
 import fs from "node:fs";
 //#region src/build/next-client-runtime-manifests.ts
-function buildNextClientBuildManifestContent(rewrites) {
+/**
+* Next.js page key for a `pages/` file, e.g. "/posts/[id]". Keeps the raw file
+* name (no decoding), so `pages/caf%C3%A9.js` stays "/caf%C3%A9".
+* Ported from Next.js: packages/next/src/build/route-discovery.ts (`getPageFromPath`).
+*/
+function getPagesManifestPage(pagesDir, filePath, matcher) {
+	const page = `/${matcher.stripExtension(path.relative(pagesDir, filePath))}`;
+	const withoutIndex = page.endsWith("/index") ? page.slice(0, -6) : page;
+	return withoutIndex === "" ? "/" : withoutIndex;
+}
+function buildNextClientBuildManifestContent(rewrites, pages) {
 	const manifest = {
 		__rewrites: toClientRewrites(rewrites),
-		sortedPages: []
+		sortedPages: getSortedRoutes([
+			...pages,
+			"/_app",
+			"/_error"
+		])
 	};
 	return `self.__BUILD_MANIFEST = ${JSON.stringify(manifest)};self.__BUILD_MANIFEST_CB && self.__BUILD_MANIFEST_CB()`;
 }
@@ -15,8 +30,8 @@ function buildNextClientSsgManifestContent() {
 function emitNextClientRuntimeManifests(options) {
 	const manifestDir = path.join(options.clientDir, options.assetsSubdir, options.buildId);
 	fs.mkdirSync(manifestDir, { recursive: true });
-	fs.writeFileSync(path.join(manifestDir, "_buildManifest.js"), buildNextClientBuildManifestContent(options.rewrites), "utf-8");
+	fs.writeFileSync(path.join(manifestDir, "_buildManifest.js"), buildNextClientBuildManifestContent(options.rewrites, options.pages), "utf-8");
 	fs.writeFileSync(path.join(manifestDir, "_ssgManifest.js"), buildNextClientSsgManifestContent(), "utf-8");
 }
 //#endregion
-export { buildNextClientBuildManifestContent, buildNextClientSsgManifestContent, emitNextClientRuntimeManifests };
+export { buildNextClientBuildManifestContent, buildNextClientSsgManifestContent, emitNextClientRuntimeManifests, getPagesManifestPage };

package/dist/build/nitro-public-files.d.ts

@@ -0,0 +1,24 @@
+//#region src/build/nitro-public-files.d.ts
+/** The Nitro options this integration reads and updates. */
+export type NitroPublicFilesOptions = {
+  dev?: boolean;
+  preset?: string;
+  baseURL?: string;
+  serveStatic?: boolean | string;
+  plugins?: string[];
+  virtual?: Record<string, string | (() => string)>;
+  output?: {
+    publicDir?: string;
+  };
+};
+/**
+ * Register vinext's Nitro runtime plugin on presets whose server serves the
+ * static output, so requests for public files run through vinext, including
+ * its middleware, and vinext can serve the public files its router resolves.
+ *
+ * Nitro serves the static output from its root, so this applies only when
+ * Nitro's `baseURL` is the root; vinext applies its own `basePath`. Returns
+ * whether the plugin is registered.
+ */
+export declare function registerNitroPublicFiles(options: NitroPublicFilesOptions, pluginModule: string, getPublicFiles: () => string[]): boolean;
+//#endregion

package/dist/build/nitro-public-files.js

@@ -0,0 +1,60 @@
+import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
+import fs from "node:fs";
+//#region src/build/nitro-public-files.ts
+const NITRO_PUBLIC_FILES_PLUGIN = "#vinext/nitro-public-files";
+const CDN_STATIC_PRESETS = /* @__PURE__ */ new Set(["aws-amplify"]);
+const COMPRESSED_EXTENSIONS = [
+	".br",
+	".gz",
+	".zst"
+];
+function toNitroAssetId(relativePath) {
+	let decoded = relativePath;
+	try {
+		decoded = decodeURIComponent(relativePath);
+	} catch {}
+	return "/" + decoded.replace(/^\.?\//, "");
+}
+/**
+* List the static files Nitro serves for the files in `public/`, keyed as
+* Nitro's static handler keys them: each file that Nitro copied to its output
+* directory, and the compressed copies of it that Nitro wrote there.
+*/
+function listNitroPublicAssets(publicFiles, outputPublicDir) {
+	if (!outputPublicDir) return [];
+	const assets = [];
+	for (const file of publicFiles) {
+		const relativePath = file.slice(1);
+		for (const extension of ["", ...COMPRESSED_EXTENSIONS]) if (fs.statSync(path.join(outputPublicDir, relativePath + extension), { throwIfNoEntry: false })?.isFile()) assets.push(toNitroAssetId(relativePath + extension));
+	}
+	return [...new Set(assets)].sort();
+}
+/**
+* Register vinext's Nitro runtime plugin on presets whose server serves the
+* static output, so requests for public files run through vinext, including
+* its middleware, and vinext can serve the public files its router resolves.
+*
+* Nitro serves the static output from its root, so this applies only when
+* Nitro's `baseURL` is the root; vinext applies its own `basePath`. Returns
+* whether the plugin is registered.
+*/
+function registerNitroPublicFiles(options, pluginModule, getPublicFiles) {
+	if (options.dev || !options.serveStatic) return false;
+	if (options.preset && CDN_STATIC_PRESETS.has(options.preset.replaceAll("_", "-"))) return false;
+	if ((options.baseURL ?? "/") !== "/") return false;
+	options.virtual ??= {};
+	options.virtual[NITRO_PUBLIC_FILES_PLUGIN] = () => [
+		"import { fetchViteEnv } from \"nitro/vite/runtime\";",
+		`import { createNitroPublicFilesPlugin } from ${JSON.stringify(pluginModule)};`,
+		"export default createNitroPublicFilesPlugin({",
+		`  publicAssets: ${JSON.stringify(listNitroPublicAssets(getPublicFiles(), options.output?.publicDir))},`,
+		"  fetchApp: (request) => fetchViteEnv(\"ssr\", request),",
+		"});",
+		""
+	].join("\n");
+	options.plugins ??= [];
+	if (!options.plugins.includes(NITRO_PUBLIC_FILES_PLUGIN)) options.plugins.push(NITRO_PUBLIC_FILES_PLUGIN);
+	return true;
+}
+//#endregion
+export { registerNitroPublicFiles };

package/dist/build/pages-client-assets-module.js

@@ -6,7 +6,7 @@ import fs from "node:fs";
 //#region src/build/pages-client-assets-module.ts
 const PAGES_CLIENT_ASSETS_MODULE = "vinext-client-assets.js";
 function buildPagesClientAssetsModule(assets) {
-	const prepared = assets.ssrManifest ? {
+	const prepared = assets.ssrManifest && !assets.sharedChunks ? {
 		...assets,
 		sharedChunks: getSharedChunkFiles(assets.ssrManifest)
 	} : assets;

package/dist/build/precompress.d.ts

@@ -28,4 +28,5 @@ export declare function precompressAssets(clientDir: string, options?: {
   assetsDir?: string;
   onProgress?: (completed: number, total: number, file: string) => void;
 }): Promise<PrecompressResult>;
-//#endregion
+//#endregion
+export {};

package/dist/build/precompress.js

@@ -2,8 +2,8 @@ import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { ASSET_PREFIX_URL_DIR } from "../utils/asset-prefix.js";
 import { isPrecompressedVariantBeneficial } from "../utils/precompressed-variant.js";
 import fsp from "node:fs/promises";
-import { randomUUID } from "node:crypto";
 import os from "node:os";
+import { randomUUID } from "node:crypto";
 import zlib from "node:zlib";
 import { promisify } from "node:util";
 //#region src/build/precompress.ts

package/dist/build/prerender-paths.d.ts

@@ -94,4 +94,5 @@ type PrerenderPathDiscoveryOptions = {
 export declare function matchesMiddlewareWarmPath(pathname: string, matcher: MatcherConfig | undefined, i18n: ResolvedNextConfig["i18n"]): boolean;
 export declare function discoverPrerenderPathManifest(options: PrerenderPathDiscoveryOptions): Promise<PrerenderPathManifest | null>;
 export declare function emitPrerenderPathManifest(options: PrerenderPathDiscoveryOptions): Promise<PrerenderPathManifest | null>;
-//#endregion
+//#endregion
+export {};

package/dist/build/prerender-paths.js

@@ -9,7 +9,7 @@ import { loadNextConfig, resolveNextConfig } from "../config/next-config.js";
 import { appRouteHasMainTreeLoadingBoundary, appRouter, matchAppRoute } from "../routing/app-router.js";
 import { apiRouter, matchRoute, pagesRouter } from "../routing/pages-router.js";
 import { matchesMiddlewarePathname } from "../server/middleware-matcher.js";
-import { extractLocaleFromUrl, normalizeDefaultLocalePathname } from "../server/pages-i18n.js";
+import { extractLocaleFromUrl, normalizeDefaultLocalePathname, shouldRestoreLocaleRootTrailingSlash } from "../server/pages-i18n.js";
 import { classifyAppRoute, classifyAppRouteHandler, classifyPagesRoute, extractExportConstString, extractMiddlewareMatcherConfig, getAppRouteRenderEntryPath } from "./report.js";
 import { normalizeStaticPathname, normalizeStaticPathsEntry } from "../routing/route-pattern.js";
 import { buildPagesDataHref } from "../shims/internal/pages-data-url.js";
@@ -578,7 +578,10 @@ async function resolveAppWarmPaths(options) {
 function cachePolicyRuleMatchesWarmPath(pathname, rule, config) {
 	const canonicalPathname = normalizePathTrailingSlash(pathname, config.trailingSlash);
 	return [void 0, ...config.i18n?.domains?.map((domain) => domain.domain) ?? []].some((hostname) => {
-		const matchPathname = normalizeDefaultLocalePathname(canonicalPathname, config.i18n, { hostname });
+		const matchPathname = normalizeDefaultLocalePathname(canonicalPathname, config.i18n, {
+			hostname,
+			restoreRootTrailingSlash: shouldRestoreLocaleRootTrailingSlash(canonicalPathname, config)
+		});
 		let sourceMatched = false;
 		matchHeaders(matchPathname, [rule], {
 			cookies: {},

package/dist/build/prerender-phase.d.ts

@@ -11,4 +11,5 @@ type PrerenderPhaseEnv = {
  * overwriting the caller's prior phase when they finish.
  */
 export declare function enterPrerenderPhase(env?: PrerenderPhaseEnv): () => void;
-//#endregion
+//#endregion
+export {};

package/dist/build/prerender-server-pool.js

@@ -2,8 +2,8 @@ import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { PHASE_PRODUCTION_BUILD } from "../shims/constants.js";
 import fs from "node:fs";
 import { fileURLToPath } from "node:url";
-import { fork } from "node:child_process";
 import os from "node:os";
+import { fork } from "node:child_process";
 //#region src/build/prerender-server-pool.ts
 /**
 * Parallel prerender server pool.

package/dist/build/prerender.d.ts

@@ -171,8 +171,9 @@ type PrerenderAppOptionsInternal = PrerenderAppOptions & {
  * Throws on partial or malformed embeds (chunks present but no done marker,
  * tampered chunk JSON, etc.) — those are real vinext-internal regressions.
  *
- * Safe regex usage: safeJsonStringify (used by createRscEmbedTransform) escapes
- * all '<' and '>' in the embedded JSON, preventing false </script> matches.
+ * Safe regex usage: scriptSafeJsonStringify (used by createRscEmbedTransform)
+ * escapes every '<' that begins "</script" (case-insensitive) in the embedded
+ * JSON, preventing false </script> matches.
  */
 export declare function extractRscPayloadFromPrerenderedHtml(html: string): Uint8Array | null;
 /**

package/dist/build/prerender.js

@@ -18,10 +18,10 @@ import { buildPregeneratedConcretePathTable } from "../server/prerender-manifest
 import { concatUint8Arrays, decodeRscEmbeddedChunk } from "../server/app-rsc-embedded-chunks.js";
 import { navigationRuntimeRscBootstrapExpression } from "../server/app-ssr-stream.js";
 import { encodePrerenderRouteParams, serializePrerenderRouteParamsHeader } from "../server/prerender-route-params.js";
-import { createAppPprFallbackShells, markAppPprDynamicFallbackShellHtml } from "../server/app-ppr-fallback-shell.js";
-import { getAppRouteOutputPath, getOutputPath, getRscOutputPath } from "../utils/prerender-output-paths.js";
 import { startProdServer } from "../server/prod-server.js";
 import { prerenderPoolAvailable, resolvePrerenderPoolSize, startPrerenderServerPool } from "./prerender-server-pool.js";
+import { getAppRouteOutputPath, getOutputPath, getRscOutputPath } from "../utils/prerender-output-paths.js";
+import { createAppPprFallbackShells, markAppPprDynamicFallbackShellHtml } from "../server/app-ppr-fallback-shell.js";
 import { enterPrerenderPhase } from "./prerender-phase.js";
 import { buildAppRouteCacheValue } from "../server/app-route-handler-response.js";
 import fs from "node:fs";
@@ -92,8 +92,9 @@ const RSC_RUNTIME_DONE_SCRIPT = `${RSC_RUNTIME_BOOTSTRAP_EXPRESSION}.done=true`;
 * Throws on partial or malformed embeds (chunks present but no done marker,
 * tampered chunk JSON, etc.) — those are real vinext-internal regressions.
 *
-* Safe regex usage: safeJsonStringify (used by createRscEmbedTransform) escapes
-* all '<' and '>' in the embedded JSON, preventing false <\/script> matches.
+* Safe regex usage: scriptSafeJsonStringify (used by createRscEmbedTransform)
+* escapes every '<' that begins "<\/script" (case-insensitive) in the embedded
+* JSON, preventing false <\/script> matches.
 */
 function extractRscPayloadFromPrerenderedHtml(html) {
 	const scriptPattern = /<script(?:\s[^>]*)?>([\s\S]*?)<\/script>/gi;

package/dist/build/report.d.ts

@@ -163,4 +163,5 @@ export declare function printBuildReport(options: {
   pageExtensions: string[];
   prerenderResult?: PrerenderResult;
 }): Promise<void>;
-//#endregion
+//#endregion
+export {};

package/dist/build/route-classification-injector.d.ts

@@ -29,4 +29,5 @@ type PlanRouteClassificationInjectionOptions = {
   moduleInfo: ModuleInfoProvider;
 };
 export declare function planRouteClassificationInjection(options: PlanRouteClassificationInjectionOptions): RouteClassificationInjectionPlan;
-//#endregion
+//#endregion
+export {};

package/dist/build/route-classification-manifest.d.ts

@@ -50,4 +50,5 @@ export declare function buildClassificationReplacement(manifest: RouteClassifica
  * layout index.
  */
 export declare function buildReasonsReplacement(manifest: RouteClassificationManifest, layer2PerRoute: ReadonlyMap<number, ReadonlyMap<number, ModuleGraphStaticReason>>): string;
-//#endregion
+//#endregion
+export {};

package/dist/build/run-prerender.d.ts

@@ -59,4 +59,5 @@ export declare function assertNoFatalPrerenderRoutes(routes: readonly PrerenderR
  * Statically generate routes and return the prerender result.
  */
 export declare function runPrerender(options: RunPrerenderOptions): Promise<PrerenderResult | null>;
-//#endregion
+//#endregion
+export {};

package/dist/build/server-actions-encryption-key.d.ts

@@ -0,0 +1,24 @@
+//#region src/build/server-actions-encryption-key.d.ts
+type LoadEncryptionKeyOptions = {
+  root: string;
+  isBuild: boolean;
+  /** Defaults to `process.env.NEXT_SERVER_ACTIONS_ENCRYPTION_KEY`. */
+  providedKey?: string;
+  now?: number;
+  /** Defaults to Docker detection; Docker filesystems are likely ephemeral. */
+  hasPersistentStorage?: boolean;
+};
+/**
+ * Return NEXT_SERVER_ACTIONS_ENCRYPTION_KEY when set, otherwise a generated
+ * key that is cached in `.vinext/cache` for 14 days.
+ */
+export declare function loadOrGenerateServerActionsEncryptionKey(options: LoadEncryptionKeyOptions): string;
+/**
+ * The cached key lives inside the project root, which the dev server serves.
+ * Return the `server.fs.deny` entries that keep it private, preserving Vite's
+ * defaults and any configured entries. Like `.env` files, it is only exposed
+ * when `server.fs.strict` is false, which turns off Vite's file restrictions.
+ */
+export declare function getServerActionsKeyCacheFsDeny(configuredDeny: string[] | undefined): string[];
+//#endregion
+export {};

package/dist/build/server-actions-encryption-key.js

@@ -0,0 +1,101 @@
+import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
+import fs from "node:fs";
+import { randomBytes } from "node:crypto";
+//#region src/build/server-actions-encryption-key.ts
+/**
+* Ported from Next.js: packages/next/src/server/app-render/encryption-utils-server.ts
+* https://github.com/vercel/next.js/blob/canary/packages/next/src/server/app-render/encryption-utils-server.ts
+*
+* Next salts server-reference IDs with this key, so keeping it stable keeps
+* client chunk names stable across rebuilds of identical source. Next caches
+* a generated key under `<distDir>/cache` for builds and `<distDir>/dev/cache`
+* for dev; vinext uses `<root>/.vinext/cache` and `<root>/.vinext/dev/cache`
+* because `dist/` is wiped by every build.
+*/
+const CONFIG_FILE = ".rscinfo";
+const ENCRYPTION_KEY = "encryption.key";
+const ENCRYPTION_EXPIRE_AT = "encryption.expire_at";
+const EXPIRATION = 12096e5;
+const VITE_DEFAULT_FS_DENY = [
+	".env",
+	".env.*",
+	"*.{crt,pem,key,p12,pfx,cer,der}",
+	".npmrc",
+	".yarnrc.yml",
+	"**/.git/**"
+];
+const KEY_CACHE_FS_DENY = `**/.vinext/**/${CONFIG_FILE}`;
+let isDockerResult;
+function isDocker() {
+	if (isDockerResult === void 0) {
+		let hasDockerEnv = false;
+		try {
+			fs.statSync("/.dockerenv");
+			hasDockerEnv = true;
+		} catch {}
+		let hasDockerCGroup = false;
+		if (!hasDockerEnv) try {
+			hasDockerCGroup = fs.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
+		} catch {}
+		isDockerResult = hasDockerEnv || hasDockerCGroup;
+	}
+	return isDockerResult;
+}
+function readCachedKey(configPath, isBuild, providedKey, now) {
+	if (!fs.existsSync(configPath)) return void 0;
+	try {
+		const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
+		if (typeof config !== "object" || config === null) return void 0;
+		const cachedKey = config[ENCRYPTION_KEY];
+		const expireAt = config[ENCRYPTION_EXPIRE_AT];
+		if (typeof cachedKey !== "string" || typeof expireAt !== "number") return void 0;
+		if (isBuild && expireAt < now) return void 0;
+		if (cachedKey && providedKey && cachedKey !== providedKey) return void 0;
+		return cachedKey;
+	} catch {
+		return;
+	}
+}
+/**
+* Return NEXT_SERVER_ACTIONS_ENCRYPTION_KEY when set, otherwise a generated
+* key that is cached in `.vinext/cache` for 14 days.
+*/
+function loadOrGenerateServerActionsEncryptionKey(options) {
+	const providedKey = "providedKey" in options ? options.providedKey : process.env.NEXT_SERVER_ACTIONS_ENCRYPTION_KEY;
+	const generateKey = () => providedKey || randomBytes(32).toString("base64");
+	if (!(options.hasPersistentStorage ?? !isDocker())) return generateKey();
+	const now = options.now ?? Date.now();
+	const cacheDir = options.isBuild ? path.join(options.root, ".vinext", "cache") : path.join(options.root, ".vinext", "dev", "cache");
+	const configPath = path.join(cacheDir, CONFIG_FILE);
+	const cachedKey = readCachedKey(configPath, options.isBuild, providedKey, now);
+	if (cachedKey !== void 0) {
+		restrictKeyCacheMode(configPath);
+		return cachedKey;
+	}
+	const key = generateKey();
+	try {
+		fs.mkdirSync(cacheDir, { recursive: true });
+		fs.writeFileSync(configPath, JSON.stringify({
+			[ENCRYPTION_KEY]: key,
+			[ENCRYPTION_EXPIRE_AT]: now + EXPIRATION
+		}), { mode: 384 });
+		restrictKeyCacheMode(configPath);
+	} catch {}
+	return key;
+}
+function restrictKeyCacheMode(configPath) {
+	try {
+		fs.chmodSync(configPath, 384);
+	} catch {}
+}
+/**
+* The cached key lives inside the project root, which the dev server serves.
+* Return the `server.fs.deny` entries that keep it private, preserving Vite's
+* defaults and any configured entries. Like `.env` files, it is only exposed
+* when `server.fs.strict` is false, which turns off Vite's file restrictions.
+*/
+function getServerActionsKeyCacheFsDeny(configuredDeny) {
+	return configuredDeny ? [KEY_CACHE_FS_DENY] : [...VITE_DEFAULT_FS_DENY, KEY_CACHE_FS_DENY];
+}
+//#endregion
+export { getServerActionsKeyCacheFsDeny, loadOrGenerateServerActionsEncryptionKey };

package/dist/build/ssr-manifest.d.ts

@@ -2,6 +2,9 @@
 export type BundleBackfillChunk = {
   type: "chunk";
   fileName: string;
+  name?: string;
+  isEntry?: boolean;
+  facadeModuleId?: string | null;
   imports?: string[];
   modules?: Record<string, unknown>;
   viteMetadata?: {

package/dist/build/ssr-manifest.js

@@ -1,7 +1,13 @@
 import path, { toSlash } from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
-import { collapseDuplicateBase, manifestFileWithBase } from "../utils/manifest-paths.js";
+import { SSR_MANIFEST_SHARED_CHUNKS_KEY, collapseDuplicateBase, isSharedClientChunkName, manifestFileWithBase } from "../utils/manifest-paths.js";
 import fs from "node:fs";
 //#region src/build/ssr-manifest.ts
+const PAGES_CLIENT_ENTRY_ID = "virtual:vinext-client-entry";
+function isPagesClientEntryFacade(facadeModuleId) {
+	if (!facadeModuleId) return false;
+	const id = toSlash(facadeModuleId.startsWith("\0") ? facadeModuleId.slice(1) : facadeModuleId);
+	return id === PAGES_CLIENT_ENTRY_ID || id.endsWith(`/${PAGES_CLIENT_ENTRY_ID}`);
+}
 /**
 * Realpath with NATIVE separators (backslashes on Windows). Callers apply
 * `toSlash` where the result becomes a module id / manifest key.
@@ -50,17 +56,42 @@ function normalizeManifestModuleId(moduleId, root) {
 }
 function augmentSsrManifestFromBundle(ssrManifest, bundle, root, base = "/") {
 	const nextManifest = {};
+	const sharedChunkFiles = /* @__PURE__ */ new Set();
 	for (const [key, files] of Object.entries(ssrManifest)) {
 		const normalizedKey = normalizeManifestModuleId(key, root);
 		if (!nextManifest[normalizedKey]) nextManifest[normalizedKey] = /* @__PURE__ */ new Set();
 		for (const file of files) nextManifest[normalizedKey].add(collapseDuplicateBase(file, base));
 	}
+	const staticImportClosures = /* @__PURE__ */ new Map();
+	const getStaticImportClosure = (fileName) => {
+		let closure = staticImportClosures.get(fileName);
+		if (closure) return closure;
+		const files = /* @__PURE__ */ new Set();
+		const visit = (importer) => {
+			const chunk = bundle[importer];
+			if (chunk?.type !== "chunk") return;
+			for (const importedFile of chunk.imports ?? []) {
+				if (importedFile === fileName || files.has(importedFile)) continue;
+				files.add(importedFile);
+				visit(importedFile);
+			}
+		};
+		visit(fileName);
+		closure = [...files];
+		staticImportClosures.set(fileName, closure);
+		return closure;
+	};
 	for (const item of Object.values(bundle)) {
 		if (item.type !== "chunk") continue;
 		const chunk = item;
+		if (chunk.fileName.endsWith(".js") && isSharedClientChunkName(chunk.name)) sharedChunkFiles.add(manifestFileWithBase(chunk.fileName, base));
+		if (chunk.isEntry && isPagesClientEntryFacade(chunk.facadeModuleId)) {
+			sharedChunkFiles.add(manifestFileWithBase(chunk.fileName, base));
+			for (const importedFile of getStaticImportClosure(chunk.fileName)) sharedChunkFiles.add(manifestFileWithBase(importedFile, base));
+		}
 		const files = /* @__PURE__ */ new Set();
 		files.add(manifestFileWithBase(chunk.fileName, base));
-		for (const importedFile of chunk.imports ?? []) files.add(manifestFileWithBase(importedFile, base));
+		for (const importedFile of getStaticImportClosure(chunk.fileName)) files.add(manifestFileWithBase(importedFile, base));
 		for (const cssFile of chunk.viteMetadata?.importedCss ?? []) files.add(manifestFileWithBase(cssFile, base));
 		for (const assetFile of chunk.viteMetadata?.importedAssets ?? []) files.add(manifestFileWithBase(assetFile, base));
 		for (const moduleId of Object.keys(chunk.modules ?? {})) {
@@ -71,6 +102,7 @@ function augmentSsrManifestFromBundle(ssrManifest, bundle, root, base = "/") {
 			for (const file of files) nextManifest[key].add(file);
 		}
 	}
+	if (sharedChunkFiles.size > 0) nextManifest[SSR_MANIFEST_SHARED_CHUNKS_KEY] = sharedChunkFiles;
 	return Object.fromEntries(Object.entries(nextManifest).map(([key, files]) => [key, [...files]]));
 }
 //#endregion

package/dist/build/standalone.d.ts

@@ -27,4 +27,5 @@ type StandaloneBuildResult = {
  * included.
  */
 export declare function emitStandaloneOutput(options: StandaloneBuildOptions): StandaloneBuildResult;
-//#endregion
+//#endregion
+export {};

package/dist/cache/cache-adapters-virtual.d.ts

@@ -132,4 +132,5 @@ export declare function loadVinextCacheConfigFromViteConfig(vite: ViteConfigLoad
 export declare function generateCacheAdaptersModule(cache?: VinextCacheConfig): string;
 /** Generate request-stage registration without importing a configured data adapter. */
 export declare function generateCdnCacheAdapterModule(cache?: VinextCacheConfig): string;
-//#endregion
+//#endregion
+export {};

package/dist/cache.js

@@ -1,2 +1 @@
-import { cacheForRequest } from "./shims/cache-for-request.js";
-export { cacheForRequest };
+export { cacheForRequest } from "./shims/cache-for-request.js";

package/dist/check.d.ts

@@ -85,4 +85,5 @@ export declare function runCheck(root: string): CheckResult;
 export declare function formatReport(result: CheckResult, opts?: {
   calledFromInit?: boolean;
 }): string;
-//#endregion
+//#endregion
+export {};

package/dist/check.js

@@ -323,6 +323,10 @@ const CONFIG_SUPPORT = {
 		status: "partial",
 		detail: "experimental support; behavior is incomplete"
 	},
+	"experimental.cacheComponents": {
+		status: "partial",
+		detail: "legacy alias of cacheComponents; experimental support, behavior is incomplete"
+	},
 	"experimental.ppr": {
 		status: "unsupported",
 		detail: "removed in Next.js 16 and ignored; use cacheComponents"