@nuxt/nitro-server 3.21.0 → 3.21.2

package/README.md

@@ -1,15 +1,15 @@
-[![Nuxt banner](https://github.com/nuxt/nuxt/blob/main/.github/assets/banner.svg)](https://nuxt.com)
+<a href="https://nuxt.com"><img width="830" height="213" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/banner.svg" alt="Nuxt banner"></a>
 
 # Nuxt
 
 <p>
-  <a href="https://www.npmjs.com/package/nuxt"><img src="https://img.shields.io/npm/v/nuxt.svg?style=flat&colorA=18181B&colorB=28CF8D" alt="Version"></a>
-  <a href="https://www.npmjs.com/package/nuxt"><img src="https://img.shields.io/npm/dm/nuxt.svg?style=flat&colorA=18181B&colorB=28CF8D" alt="Downloads"></a>
+  <a href="https://npmx.dev/package/nuxt"><img src="https://npmx.dev/api/registry/badge/version/nuxt" alt="Version"></a>
+  <a href="https://npmx.dev/package/nuxt"><img src="https://npmx.dev/api/registry/badge/downloads/nuxt" alt="Downloads"></a>
   <a href="https://github.com/nuxt/nuxt/blob/main/LICENSE"><img src="https://img.shields.io/github/license/nuxt/nuxt.svg?style=flat&colorA=18181B&colorB=28CF8D" alt="License"></a>
   <a href="https://nuxt.com/modules"><img src="https://img.shields.io/badge/dynamic/json?url=https://nuxt.com/api/v1/modules&query=$.stats.modules&label=Modules&style=flat&colorA=18181B&colorB=28CF8D" alt="Modules"></a>
   <a href="https://nuxt.com"><img src="https://img.shields.io/badge/Nuxt%20Docs-18181B?logo=nuxt" alt="Website"></a>
   <a href="https://chat.nuxt.dev"><img src="https://img.shields.io/badge/Nuxt%20Discord-18181B?logo=discord" alt="Discord"></a>
-  <a href="https://securityscorecards.dev/"><img src="https://api.securityscorecards.dev/projects/github.com/nuxt/nuxt/badge" alt="Nuxt openssf scorecard score"></a>
+  <a href="https://securityscorecards.dev/viewer/?uri=github.com/nuxt/nuxt"><img src="https://api.securityscorecards.dev/projects/github.com/nuxt/nuxt/badge" alt="Nuxt openssf scorecard score"></a>
   <a href="https://deepwiki.com/nuxt/nuxt"><img src="https://deepwiki.com/badge.svg" alt="Ask DeepWiki"></a>
 </p>
 
@@ -111,7 +111,7 @@ Follow the docs to [Set Up Your Local Development Environment](https://nuxt.com/
 ## <a name="follow-us">🔗 Follow Us</a>
 
 <p valign="center">
-  <a href="https://go.nuxt.com/discord"><img width="20px" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/discord.svg" alt="Discord"></a>&nbsp;&nbsp;<a href="https://go.nuxt.com/x"><img width="20px" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/twitter.svg" alt="Twitter"></a>&nbsp;&nbsp;<a href="https://go.nuxt.com/github"><img width="20px" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/github.svg" alt="GitHub"></a>&nbsp;&nbsp;<a href="https://go.nuxt.com/bluesky"><img width="20px" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/bluesky.svg" alt="Bluesky"></a>
+  <a href="https://go.nuxt.com/discord"><img width="20" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/discord.svg" alt="Discord"></a>&nbsp;&nbsp;<a href="https://go.nuxt.com/x"><img width="20" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/twitter.svg" alt="Twitter"></a>&nbsp;&nbsp;<a href="https://go.nuxt.com/github"><img width="20" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/github.svg" alt="GitHub"></a>&nbsp;&nbsp;<a href="https://go.nuxt.com/bluesky"><img width="20" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/bluesky.svg" alt="Bluesky"></a>
 </p>
 
 ## <a name="license">⚖️ License</a>

package/dist/THIRD-PARTY-LICENSES.md

@@ -0,0 +1,11 @@
+# Licenses of Bundled Dependencies
+
+The published artifact additionally contains code with the following licenses:
+MIT
+
+# Bundled Dependencies
+
+## nuxt
+
+License: MIT
+Repository: https://github.com/nuxt/nuxt

package/dist/index.d.mts

@@ -246,7 +246,7 @@ declare module "nuxt/schema" {
     * @example
     * ```js
     * serverHandlers: [
-    *   { route: '/path/foo/**:name', handler: '~/server/foohandler.ts' }
+    *   { route: '/path/foo/**:name', handler: '#server/foohandler.ts' }
     * ]
     * ```
     */

package/dist/index.mjs

@@ -19,10 +19,8 @@ import { isWindows } from "std-env";
 import { ImpoundPlugin } from "impound";
 import { resolveModulePath } from "exsolve";
 import { runtimeDependencies } from "nitropack/runtime/meta";
-
 //#region package.json
-var version = "3.21.0";
-
+var version = "3.21.2";
 //#endregion
 //#region src/utils.ts
 function toArray(value) {
@@ -31,13 +29,11 @@ function toArray(value) {
 let _distDir = dirname(fileURLToPath(import.meta.url));
 if (/(?:chunks|shared)$/.test(_distDir)) _distDir = dirname(_distDir);
 const distDir = _distDir;
-
 //#endregion
 //#region ../ui-templates/dist/templates/spa-loading-icon.ts
 const template = () => {
 	return "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"80\" fill=\"none\" class=\"nuxt-spa-loading\" viewBox=\"0 0 37 25\"><path d=\"M24.236 22.006h10.742L25.563 5.822l-8.979 14.31a4 4 0 0 1-3.388 1.874H2.978l11.631-20 5.897 10.567\"/></svg><style>.nuxt-spa-loading{left:50%;position:fixed;top:50%;transform:translate(-50%,-50%)}.nuxt-spa-loading>path{animation:nuxt-spa-loading-move 3s linear infinite;fill:none;stroke:#00dc82;stroke-dasharray:128;stroke-dashoffset:128;stroke-linecap:round;stroke-linejoin:round;stroke-width:4px}@keyframes nuxt-spa-loading-move{to{stroke-dashoffset:-128}}</style>";
 };
-
 //#endregion
 //#region ../nuxt/src/core/plugins/import-protection.ts
 function createImportProtectionPatterns(nuxt, options) {
@@ -46,7 +42,7 @@ function createImportProtectionPatterns(nuxt, options) {
 	patterns.push([/^(nuxt|nuxt3|nuxt-nightly)$/, `\`nuxt\`, or \`nuxt-nightly\` cannot be imported directly in ${context}.` + (options.context === "nuxt-app" ? " Instead, import runtime Nuxt composables from `#app` or `#imports`." : "")]);
 	patterns.push([/^((~|~~|@|@@)?\/)?nuxt\.config(\.|$)/, "Importing directly from a `nuxt.config` file is not allowed. Instead, use runtime config or a module."]);
 	patterns.push([/(^|node_modules\/)@vue\/composition-api/]);
-	for (const mod of nuxt.options._installedModules) if (mod.entryPath) patterns.push([/* @__PURE__ */ new RegExp(`^${escapeRE(mod.entryPath)}$`), "Importing directly from module entry-points is not allowed."]);
+	for (const mod of nuxt.options._installedModules) if (mod.entryPath) patterns.push([new RegExp(`^${escapeRE(mod.entryPath)}$`), "Importing directly from module entry-points is not allowed."]);
 	for (const i of [
 		/(^|node_modules\/)@nuxt\/(cli|kit|test-utils)/,
 		/(^|node_modules\/)nuxi/,
@@ -55,7 +51,7 @@ function createImportProtectionPatterns(nuxt, options) {
 	]) patterns.push([i, `This module cannot be imported in ${context}.`]);
 	if (options.context === "nitro-app" || options.context === "shared") for (const i of ["#app", /^#build(\/|$)/]) patterns.push([i, `Vue app aliases are not allowed in ${context}.`]);
 	if (options.context === "nuxt-app" || options.context === "shared") {
-		patterns.push([/* @__PURE__ */ new RegExp(escapeRE(relative(nuxt.options.srcDir, resolve(nuxt.options.srcDir, nuxt.options.serverDir || "server"))) + "\\/(api|routes|middleware|plugins)\\/"), `Importing from server is not allowed in ${context}.`]);
+		patterns.push([new RegExp(escapeRE(relative(nuxt.options.srcDir, resolve(nuxt.options.srcDir, nuxt.options.serverDir || "server"))) + "\\/(api|routes|middleware|plugins)\\/"), `Importing from server is not allowed in ${context}.`]);
 		patterns.push([/^#server(\/|$)/, `Server aliases are not allowed in ${context}.`]);
 	}
 	return patterns;
@@ -65,7 +61,6 @@ const contextFlags = {
 	"nuxt-app": "the Vue part of your app",
 	"shared": "the #shared directory"
 };
-
 //#endregion
 //#region src/templates.ts
 const nitroSchemaTemplate = {
@@ -77,12 +72,9 @@ const nitroSchemaTemplate = {
 			references,
 			declarations
 		});
-		const sourceDir = join(nuxt.options.buildDir, "types");
+		const typesDir = join(nuxt.options.buildDir, "types");
 		return `
-${[...references.map((ref) => {
-			if ("path" in ref && isAbsolute(ref.path)) ref.path = relative(sourceDir, ref.path);
-			return `/// <reference ${renderAttrs(ref)} />`;
-		}), ...declarations].join("\n")}
+${[...references.map((ref) => renderReference(ref, typesDir)), ...declarations].join("\n")}
 /// <reference path="./schema.d.ts" />
 
 import type { RuntimeConfig } from 'nuxt/schema'
@@ -119,15 +111,9 @@ declare module 'nitropack' {
 `;
 	}
 };
-function renderAttr(key, value) {
-	return value ? `${key}="${value}"` : "";
-}
-function renderAttrs(obj) {
-	const attrs = [];
-	for (const key in obj) attrs.push(renderAttr(key, obj[key]));
-	return attrs.join(" ");
+function renderReference(ref, baseDir) {
+	return `/// <reference ${"path" in ref ? `path="${isAbsolute(ref.path) ? relative(baseDir, ref.path) : ref.path}"` : `types="${ref.types}"`} />`;
 }
-
 //#endregion
 //#region src/index.ts
 const logLevelMapReverse = {
@@ -146,7 +132,7 @@ async function bundle(nuxt) {
 	}
 	const layerPublicAssetsDirs = [];
 	for (const dirs of layerDirs) if (existsSync(dirs.public)) layerPublicAssetsDirs.push({ dir: dirs.public });
-	const excludePattern = excludePaths.length ? [/* @__PURE__ */ new RegExp(`node_modules\\/(?!${excludePaths.join("|")})`)] : [/node_modules/];
+	const excludePattern = excludePaths.length ? [new RegExp(`node_modules\\/(?!${excludePaths.join("|")})`)] : [/node_modules/];
 	const rootDirWithSlash = withTrailingSlash(nuxt.options.rootDir);
 	const moduleEntryPaths = [];
 	for (const m of nuxt.options._installedModules) {
@@ -376,7 +362,8 @@ async function bundle(nuxt) {
 		"appLayout",
 		"cache",
 		"isr",
-		"swr"
+		"swr",
+		"ssr"
 	];
 	function getRouteRulesRouter() {
 		const routeRulesRouter = createRouter();
@@ -425,18 +412,19 @@ async function bundle(nuxt) {
 		}
 	});
 	if (nuxt.options.experimental.payloadExtraction) {
-		if (nuxt.options.dev) nuxt.hook("nitro:config", (nitroConfig$1) => {
-			nitroConfig$1.prerender ||= {};
-			nitroConfig$1.prerender.routes ||= [];
-			nitroConfig$1.routeRules ||= {};
-			for (const route of nitroConfig$1.prerender.routes) {
+		if (nuxt.options.dev) nuxt.hook("nitro:config", (nitroConfig) => {
+			nitroConfig.prerender ||= {};
+			nitroConfig.prerender.routes ||= [];
+			nitroConfig.routeRules ||= {};
+			for (const route of nitroConfig.prerender.routes) {
 				if (!route) continue;
-				nitroConfig$1.routeRules[route] = defu(nitroConfig$1.routeRules[route], { prerender: true });
+				nitroConfig.routeRules[route] = defu(nitroConfig.routeRules[route], { prerender: true });
 			}
 		});
-		nuxt.hook("nitro:init", (nitro$1) => {
-			nitro$1.hooks.hook("build:before", (nitro$2) => {
-				for (const [route, value] of Object.entries(nitro$2.options.routeRules)) if (!route.endsWith("*") && !route.endsWith("/_payload.json")) {
+		nuxt.hook("nitro:init", (nitro) => {
+			nitro.hooks.hook("build:before", (nitro) => {
+				for (const [route, value] of Object.entries(nitro.options.routeRules)) if (!route.endsWith("*") && !route.endsWith("/_payload.json")) {
+					if (value.ssr === false) continue;
 					if (value.isr || value.cache || value.prerender && nuxt.options.dev) {
 						const payloadKey = route + "/_payload.json";
 						const defaults = {};
@@ -445,7 +433,7 @@ async function bundle(nuxt) {
 							"cache",
 							...nuxt.options.dev ? ["prerender"] : []
 						]) if (key in value) defaults[key] = value[key];
-						nitro$2.options.routeRules[payloadKey] = defu(nitro$2.options.routeRules[payloadKey], defaults);
+						nitro.options.routeRules[payloadKey] = defu(nitro.options.routeRules[payloadKey], defaults);
 					}
 				}
 			});
@@ -483,13 +471,13 @@ async function bundle(nuxt) {
 			config.alias ||= {};
 			config.alias["#app-manifest"] = join(tempDir, `meta/${buildId}.json`);
 		});
-		nuxt.hook("nitro:init", (nitro$1) => {
-			nitro$1.hooks.hook("rollup:before", async (nitro$2) => {
+		nuxt.hook("nitro:init", (nitro) => {
+			nitro.hooks.hook("rollup:before", async (nitro) => {
 				const prerenderedRoutes = /* @__PURE__ */ new Set();
 				const routeRulesMatcher = getRouteRulesRouter();
-				if (nitro$2._prerenderedRoutes?.length) {
+				if (nitro._prerenderedRoutes?.length) {
 					const payloadSuffix = nuxt.options.experimental.renderJsonPayloads ? "/_payload.json" : "/_payload.js";
-					for (const route of nitro$2._prerenderedRoutes) if (!route.error && route.route.endsWith(payloadSuffix)) {
+					for (const route of nitro._prerenderedRoutes) if (!route.error && route.route.endsWith(payloadSuffix)) {
 						const url = route.route.slice(0, -payloadSuffix.length) || "/";
 						if (!defu({}, ...findAllRoutes(routeRulesMatcher, void 0, url).reverse()).prerender) prerenderedRoutes.add(url);
 					}
@@ -531,8 +519,8 @@ async function bundle(nuxt) {
 	const relativeSharedDir = withTrailingSlash(relative(nuxt.options.rootDir, resolve(nuxt.options.rootDir, nuxt.options.dir.shared)));
 	const sharedPatterns = [
 		/^#shared\//,
-		/* @__PURE__ */ new RegExp("^" + escapeRE(sharedDir)),
-		/* @__PURE__ */ new RegExp("^" + escapeRE(relativeSharedDir))
+		new RegExp("^" + escapeRE(sharedDir)),
+		new RegExp("^" + escapeRE(relativeSharedDir))
 	];
 	nitroConfig.rollupConfig.plugins.push(ImpoundPlugin.rollup({
 		cwd: nuxt.options.rootDir,
@@ -623,6 +611,22 @@ async function bundle(nuxt) {
 	await nuxt.callHook("nitro:init", nitro);
 	nuxt["~runtimeDependencies"] ||= [];
 	nuxt["~runtimeDependencies"].push(...runtimeDependencies, "unhead", "@unhead/vue", "@nuxt/devalue", "unstorage", ...nitro.options.inlineDynamicImports ? ["vue", "@vue/server-renderer"] : []);
+	addVitePlugin({
+		name: "nuxt:nitro:ssr-conditions",
+		configEnvironment(name, config) {
+			if (name === "ssr") {
+				config.resolve ||= {};
+				config.resolve.conditions = [...nitro.options.exportConditions || [], "import"];
+			}
+		}
+	});
+	addVitePlugin({
+		name: "nuxt:nitro:vue-feature-flags",
+		applyToEnvironment: (environment) => environment.name === "ssr" && environment.config.isProduction,
+		configResolved(config) {
+			for (const key in config.define) if (key.startsWith("__VUE")) nitro.options.replace[key] = config.define[key];
+		}
+	});
 	nitro.vfs = nuxt.vfs = nitro.vfs || nuxt.vfs || {};
 	nuxt.hook("close", () => nitro.hooks.callHook("close"));
 	nitro.hooks.hook("prerender:routes", (routes) => {
@@ -656,12 +660,12 @@ async function bundle(nuxt) {
 		handler: resolve(distDir, "runtime/handlers/renderer")
 	});
 	if (nuxt.options.experimental.chromeDevtoolsProjectSettings) {
-		const cacheDir$1 = resolve(nuxt.options.rootDir, "node_modules/.cache/nuxt");
-		let projectConfiguration = await readFile(join(cacheDir$1, "chrome-workspace.json"), "utf-8").then((r) => JSON.parse(r)).catch(() => null);
+		const cacheDir = resolve(nuxt.options.rootDir, "node_modules/.cache/nuxt");
+		let projectConfiguration = await readFile(join(cacheDir, "chrome-workspace.json"), "utf-8").then((r) => JSON.parse(r)).catch(() => null);
 		if (!projectConfiguration) {
 			projectConfiguration = { uuid: randomUUID() };
-			await mkdir(cacheDir$1, { recursive: true });
-			await writeFile(join(cacheDir$1, "chrome-workspace.json"), JSON.stringify(projectConfiguration), "utf-8");
+			await mkdir(cacheDir, { recursive: true });
+			await writeFile(join(cacheDir, "chrome-workspace.json"), JSON.stringify(projectConfiguration), "utf-8");
 		}
 		nitro.options.devHandlers.push({
 			route: "/.well-known/appspecific/com.chrome.devtools.json",
@@ -671,12 +675,12 @@ async function bundle(nuxt) {
 			} }))
 		});
 	}
-	if (!nuxt.options.dev && nuxt.options.experimental.noVueServer) nitro.hooks.hook("rollup:before", (nitro$1) => {
-		if (nitro$1.options.preset === "nitro-prerender") return;
-		const nuxtErrorHandler = nitro$1.options.handlers.findIndex((h) => h.route === "/__nuxt_error");
-		if (nuxtErrorHandler >= 0) nitro$1.options.handlers.splice(nuxtErrorHandler, 1);
-		nitro$1.options.renderer = void 0;
-		nitro$1.options.errorHandler = "nitropack/runtime/error";
+	if (!nuxt.options.dev && nuxt.options.experimental.noVueServer) nitro.hooks.hook("rollup:before", (nitro) => {
+		if (nitro.options.preset === "nitro-prerender") return;
+		const nuxtErrorHandler = nitro.options.handlers.findIndex((h) => h.route === "/__nuxt_error");
+		if (nuxtErrorHandler >= 0) nitro.options.handlers.splice(nuxtErrorHandler, 1);
+		nitro.options.renderer = void 0;
+		nitro.options.errorHandler = "nitropack/runtime/error";
 	});
 	nuxt.hook("prepare:types", async (opts) => {
 		if (!nuxt.options.dev) {
@@ -691,14 +695,14 @@ async function bundle(nuxt) {
 		for (const route of ["/200.html", "/404.html"]) routes.add(route);
 		if (!nuxt.options.ssr) routes.add("/index.html");
 	});
-	if (!nuxt.options.dev) nitro.hooks.hook("rollup:before", async (nitro$1) => {
-		await copyPublicAssets(nitro$1);
-		await nuxt.callHook("nitro:build:public-assets", nitro$1);
+	if (!nuxt.options.dev) nitro.hooks.hook("rollup:before", async (nitro) => {
+		await copyPublicAssets(nitro);
+		await nuxt.callHook("nitro:build:public-assets", nitro);
 	});
 	async function symlinkDist() {
 		if (nitro.options.static) {
-			const distDir$1 = resolve(nuxt.options.rootDir, "dist");
-			if (!existsSync(distDir$1)) await promises.symlink(nitro.options.output.publicDir, distDir$1, "junction").catch(() => {});
+			const distDir = resolve(nuxt.options.rootDir, "dist");
+			if (!existsSync(distDir)) await promises.symlink(nitro.options.output.publicDir, distDir, "junction").catch(() => {});
 		}
 	}
 	nuxt.hook("build:done", async () => {
@@ -736,7 +740,7 @@ async function bundle(nuxt) {
 			}));
 		});
 		nuxt.server = createDevServer(nitro);
-		const waitUntilCompile = new Promise((resolve$1) => nitro.hooks.hook("compiled", () => resolve$1()));
+		const waitUntilCompile = new Promise((resolve) => nitro.hooks.hook("compiled", () => resolve()));
 		nuxt.hook("build:done", () => waitUntilCompile);
 	}
 }
@@ -750,14 +754,13 @@ async function spaLoadingTemplatePath(nuxt) {
 }
 async function spaLoadingTemplate(nuxt) {
 	if (nuxt.options.spaLoadingTemplate === false) return "";
-	const spaLoadingTemplate$1 = await spaLoadingTemplatePath(nuxt);
+	const spaLoadingTemplate = await spaLoadingTemplatePath(nuxt);
 	try {
-		if (existsSync(spaLoadingTemplate$1)) return readFileSync(spaLoadingTemplate$1, "utf-8").trim();
+		if (existsSync(spaLoadingTemplate)) return readFileSync(spaLoadingTemplate, "utf-8").trim();
 	} catch {}
 	if (nuxt.options.spaLoadingTemplate === true) return template();
 	if (nuxt.options.spaLoadingTemplate) logger.warn(`Could not load custom \`spaLoadingTemplate\` path as it does not exist: \`${nuxt.options.spaLoadingTemplate}\`.`);
 	return "";
 }
-
 //#endregion
-export { bundle };
+export { bundle };

package/dist/runtime/handlers/error.mjs

@@ -26,8 +26,8 @@ export default (async function errorhandler(error, event, { defaultHandler }) {
 	// remove proto/hostname/port from URL
 	const url = new URL(errorObject.url);
 	errorObject.url = withoutBase(url.pathname, useRuntimeConfig(event).app.baseURL) + url.search + url.hash;
-	// add default server message
-	errorObject.message ||= "Server Error";
+	// add default server message (keep sanitized for unhandled errors)
+	errorObject.message = error.unhandled ? errorObject.message || "Server Error" : error.message || errorObject.message || "Server Error";
 	// we will be rendering this error internally so we can pass along the error.data safely
 	errorObject.data ||= error.data;
 	errorObject.statusText ||= error.statusText || error.statusMessage;

package/dist/runtime/handlers/island.d.mts

@@ -1,2 +1,3 @@
-declare const _default;
-export default _default;
+import type { EventHandler } from "h3";
+declare const handler: EventHandler;
+export default handler;

package/dist/runtime/handlers/island.mjs

@@ -1,5 +1,5 @@
 import { destr } from "destr";
-import { defineEventHandler, getQuery, readBody, setResponseHeaders } from "h3";
+import { createError, defineEventHandler, getQuery, readBody, setResponseHeaders } from "h3";
 import { resolveUnrefHeadInput } from "@unhead/vue";
 import { getRequestDependencies } from "vue-bundle-renderer/runtime";
 import { getQuery as getURLQuery } from "ufo";
@@ -10,7 +10,7 @@ import { getSSRRenderer } from "../utils/renderer/build-files.mjs";
 import { renderInlineStyles } from "../utils/renderer/inline-styles.mjs";
 import { getClientIslandResponse, getServerComponentHTML, getSlotIslandResponse } from "../utils/renderer/islands.mjs";
 const ISLAND_SUFFIX_RE = /\.json(?:\?.*)?$/;
-export default defineEventHandler(async (event) => {
+const handler = defineEventHandler(async (event) => {
 	const nitroApp = useNitroApp();
 	setResponseHeaders(event, {
 		"content-type": "application/json;charset=utf-8",
@@ -98,26 +98,38 @@ export default defineEventHandler(async (event) => {
 	}
 	return islandResponse;
 });
+export default handler;
+const ISLAND_PATH_PREFIX = "/__nuxt_island/";
+const VALID_COMPONENT_NAME_RE = /^[a-z][\w.-]*$/i;
 async function getIslandContext(event) {
-	// TODO: Strict validation for url
 	let url = event.path || "";
 	if (import.meta.prerender && event.path && await islandPropCache.hasItem(event.path)) {
 		// rehydrate props from cache so we can rerender island if cache does not have it any more
 		url = await islandPropCache.getItem(event.path);
 	}
-	const componentParts = url.substring("/__nuxt_island".length + 1).replace(ISLAND_SUFFIX_RE, "").split("_");
+	if (!url.startsWith(ISLAND_PATH_PREFIX)) {
+		throw createError({
+			statusCode: 400,
+			statusMessage: "Invalid island request path"
+		});
+	}
+	const componentParts = url.substring(ISLAND_PATH_PREFIX.length).replace(ISLAND_SUFFIX_RE, "").split("_");
 	const hashId = componentParts.length > 1 ? componentParts.pop() : undefined;
 	const componentName = componentParts.join("_");
-	// TODO: Validate context
+	if (!componentName || !VALID_COMPONENT_NAME_RE.test(componentName)) {
+		throw createError({
+			statusCode: 400,
+			statusMessage: "Invalid island component name"
+		});
+	}
 	const context = event.method === "GET" ? getQuery(event) : await readBody(event);
-	const ctx = {
-		url: "/",
-		...context,
+	// Only extract known context fields to prevent arbitrary data injection
+	return {
+		url: typeof context?.url === "string" ? context.url : "/",
 		id: hashId,
 		name: componentName,
 		props: destr(context.props) || {},
 		slots: {},
 		components: {}
 	};
-	return ctx;
 }

package/dist/runtime/handlers/renderer.d.mts

@@ -1,2 +1,3 @@
-declare const _default;
-export default _default;
+import type { EventHandler } from "h3";
+declare const handler: EventHandler;
+export default handler;

package/dist/runtime/handlers/renderer.mjs

@@ -38,7 +38,7 @@ const APP_TELEPORT_CLOSE_TAG = HAS_APP_TELEPORTS ? `</${appTeleportTag}>` : "";
 const PAYLOAD_URL_RE = NUXT_JSON_PAYLOADS ? /^[^?]*\/_payload.json(?:\?.*)?$/ : /^[^?]*\/_payload.js(?:\?.*)?$/;
 const PAYLOAD_FILENAME = NUXT_JSON_PAYLOADS ? "_payload.json" : "_payload.js";
 let entryPath;
-export default defineRenderHandler(async (event) => {
+const handler = defineRenderHandler(async (event) => {
 	const nitroApp = useNitroApp();
 	// Whether we're rendering an error page
 	const ssrError = event.path.startsWith("/__nuxt_error") ? getQuery(event) : null;
@@ -282,6 +282,7 @@ export default defineRenderHandler(async (event) => {
 		}
 	};
 });
+export default handler;
 function normalizeChunks(chunks) {
 	const result = [];
 	for (const _chunk of chunks) {

package/dist/runtime/middleware/no-ssr.d.mts

@@ -1,2 +1,3 @@
-declare const _default;
-export default _default;
+import type { EventHandler } from "h3";
+declare const handler: EventHandler;
+export default handler;

package/dist/runtime/middleware/no-ssr.mjs

@@ -1,7 +1,8 @@
 import { defineEventHandler, getRequestHeader } from "h3";
-export default defineEventHandler((event) => {
+const handler = defineEventHandler((event) => {
 	if (getRequestHeader(event, "x-nuxt-no-ssr")) {
 		event.context.nuxt ||= {};
 		event.context.nuxt.noSSR = true;
 	}
 });
+export default handler;

package/dist/runtime/plugins/dev-server-logs.d.mts

@@ -1,2 +1,3 @@
-declare const _default;
+import type { NitroApp } from "nitropack/runtime/app";
+declare const _default: (nitroApp: NitroApp) => void;
 export default _default;

package/dist/runtime/utils/cache.d.mts

@@ -1,5 +1,11 @@
-export declare const payloadCache: unknown;
-export declare const islandCache: unknown;
-export declare const islandPropCache: unknown;
-export declare const sharedPrerenderPromises: unknown;
-export declare const sharedPrerenderCache: unknown;
+import type { Storage } from "unstorage";
+export declare const payloadCache: Storage | null;
+export declare const islandCache: Storage | null;
+export declare const islandPropCache: Storage | null;
+export declare const sharedPrerenderPromises: Map<string, Promise<any>> | null;
+interface SharedPrerenderCache {
+	get<T = unknown>(key: string): Promise<T> | undefined;
+	set<T>(key: string, value: Promise<T>): Promise<void>;
+}
+export declare const sharedPrerenderCache: SharedPrerenderCache | null;
+export {};

package/dist/runtime/utils/config.d.mts

@@ -1 +1 @@
-export declare const defineAppConfig: unknown;
+export declare const defineAppConfig: (config: any) => any;

package/dist/runtime/utils/dev.mjs

@@ -357,7 +357,7 @@ function webComponentScript(base64HTML, startMinimized) {
     iframe.id = 'frame';
     iframe.src = 'data:text/html;base64,${base64HTML}';
     iframe.title = 'Detailed error stack trace';
-    iframe.setAttribute('sandbox', 'allow-scripts allow-same-origin');
+    iframe.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-top-navigation-by-user-activation');
 
     const preview = el('div');
     preview.id = 'preview';

package/dist/runtime/utils/error.d.mts

@@ -3,4 +3,4 @@ import type { H3Event } from "h3";
 * Nitro internal functions extracted from https://github.com/nitrojs/nitro/blob/v2/src/runtime/internal/utils.ts
 */
 export declare function isJsonRequest(event: H3Event): boolean;
-export declare function hasReqHeader(event: H3Event, name: string, includes: string);
+export declare function hasReqHeader(event: H3Event, name: string, includes: string): boolean;

package/dist/runtime/utils/error.mjs

@@ -11,5 +11,5 @@ export function isJsonRequest(event) {
 }
 export function hasReqHeader(event, name, includes) {
 	const value = getRequestHeader(event, name);
-	return value && typeof value === "string" && value.toLowerCase().includes(includes);
+	return !!(value && typeof value === "string" && value.toLowerCase().includes(includes));
 }

package/dist/runtime/utils/renderer/app.mjs

@@ -1,4 +1,3 @@
-import { decodePath } from "ufo";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { createHead } from "@unhead/vue/server";
 import { sharedPrerenderCache } from "../cache.mjs";
@@ -13,7 +12,7 @@ const PRERENDER_NO_SSR_ROUTES = new Set([
 ]);
 export function createSSRContext(event) {
 	const ssrContext = {
-		url: decodePath(event.path),
+		url: event.path,
 		event,
 		runtimeConfig: useRuntimeConfig(event),
 		noSSR: !!NUXT_NO_SSR || event.context.nuxt?.noSSR || (import.meta.prerender ? PRERENDER_NO_SSR_ROUTES.has(event.path) : false),

package/dist/runtime/utils/renderer/build-files.d.mts

@@ -10,9 +10,7 @@ interface Renderer {
 		renderScripts: () => string;
 	}>;
 }
-// -- SSR Renderer --
-export declare const getSSRRenderer: unknown;
+export declare const getSSRRenderer: () => Promise<Renderer>;
 export declare function getRenderer(ssrContext: NuxtSSRContext): Promise<Renderer>;
-// @ts-expect-error file will be produced after app build
-export declare const getSSRStyles: unknown;
+export declare const getSSRStyles: () => Promise<Record<string, () => Promise<string[]>>>;
 export {};

package/dist/runtime/utils/renderer/payload.mjs

@@ -7,7 +7,7 @@ import { appId, multiApp } from "#internal/nuxt.config.mjs";
 import { NUXT_JSON_PAYLOADS, NUXT_NO_SSR, NUXT_PAYLOAD_EXTRACTION, NUXT_RUNTIME_PAYLOAD_EXTRACTION } from "#internal/nuxt/nitro-config.mjs";
 export function renderPayloadResponse(ssrContext) {
 	return {
-		body: NUXT_JSON_PAYLOADS ? stringify(splitPayload(ssrContext).payload, ssrContext["~payloadReducers"]) : `export default ${devalue(splitPayload(ssrContext).payload)}`,
+		body: NUXT_JSON_PAYLOADS ? encodeForwardSlashes(stringify(splitPayload(ssrContext).payload, ssrContext["~payloadReducers"])) : `export default ${devalue(splitPayload(ssrContext).payload)}`,
 		statusCode: getResponseStatus(ssrContext.event),
 		statusMessage: getResponseStatusText(ssrContext.event),
 		headers: {
@@ -17,7 +17,7 @@ export function renderPayloadResponse(ssrContext) {
 	};
 }
 export function renderPayloadJsonScript(opts) {
-	const contents = opts.data ? stringify(opts.data, opts.ssrContext["~payloadReducers"]) : "";
+	const contents = opts.data ? encodeForwardSlashes(stringify(opts.data, opts.ssrContext["~payloadReducers"])) : "";
 	const payload = {
 		"type": "application/json",
 		"innerHTML": contents,
@@ -33,13 +33,30 @@ export function renderPayloadJsonScript(opts) {
 	const config = uneval(opts.ssrContext.config);
 	return [payload, { innerHTML: multiApp ? `window.__NUXT__=window.__NUXT__||{};window.__NUXT__[${JSON.stringify(appId)}]={config:${config}}` : `window.__NUXT__={};window.__NUXT__.config=${config}` }];
 }
+/**
+* Encode forward slashes as unicode escape sequences to prevent
+* Google from treating them as internal links and trying to crawl them.
+* @see https://github.com/nuxt/nuxt/issues/24175
+*/
+function encodeForwardSlashes(str) {
+	return str.replaceAll("/", "\\u002F");
+}
+/**
+* Escape a string for safe interpolation inside a double-quoted JavaScript string literal.
+* Prevents XSS when user-controlled URLs are embedded in inline `<script>` tags.
+*/
+function escapeJsString(str) {
+	return str.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"").replaceAll("\n", "\\n").replaceAll("\r", "\\r").replaceAll("/", "\\u002F").replaceAll("<", "\\u003C");
+}
 export function renderPayloadScript(opts) {
 	opts.data.config = opts.ssrContext.config;
 	const _PAYLOAD_EXTRACTION = !opts.ssrContext.noSSR && (import.meta.prerender && NUXT_PAYLOAD_EXTRACTION || NUXT_RUNTIME_PAYLOAD_EXTRACTION && (opts.routeOptions.isr || opts.routeOptions.cache));
 	const nuxtData = devalue(opts.data);
 	if (_PAYLOAD_EXTRACTION) {
-		const singleAppPayload = `import p from "${opts.src}";window.__NUXT__={...p,...(${nuxtData})}`;
-		const multiAppPayload = `import p from "${opts.src}";window.__NUXT__=window.__NUXT__||{};window.__NUXT__[${JSON.stringify(appId)}]={...p,...(${nuxtData})}`;
+		// Escape the URL to prevent XSS when interpolated into a JS string literal
+		const escapedSrc = escapeJsString(opts.src);
+		const singleAppPayload = `import p from "${escapedSrc}";window.__NUXT__={...p,...(${nuxtData})}`;
+		const multiAppPayload = `import p from "${escapedSrc}";window.__NUXT__=window.__NUXT__||{};window.__NUXT__[${JSON.stringify(appId)}]={...p,...(${nuxtData})}`;
 		return [{
 			type: "module",
 			innerHTML: multiApp ? multiAppPayload : singleAppPayload

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxt/nitro-server",
-  "version": "3.21.0",
+  "version": "3.21.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/nuxt/nuxt.git",
@@ -19,41 +19,41 @@
   ],
   "dependencies": {
     "@nuxt/devalue": "^2.0.2",
-    "@unhead/vue": "^2.1.2",
-    "@vue/shared": "^3.5.27",
+    "@unhead/vue": "^2.1.12",
+    "@vue/shared": "^3.5.30",
     "consola": "^3.4.2",
     "defu": "^6.1.4",
     "destr": "^2.0.5",
-    "devalue": "^5.6.2",
+    "devalue": "^5.6.3",
     "errx": "^0.1.0",
     "escape-string-regexp": "^5.0.0",
     "exsolve": "^1.0.8",
-    "h3": "^1.15.5",
-    "impound": "^1.0.0",
+    "h3": "^1.15.6",
+    "impound": "^1.1.5",
     "klona": "^2.0.6",
     "mocked-exports": "^0.1.1",
     "nitropack": "^2.13.1",
     "ohash": "^2.0.11",
     "pathe": "^2.0.3",
     "pkg-types": "^2.3.0",
-    "rou3": "^0.7.12",
-    "std-env": "^3.10.0",
+    "rou3": "^0.8.1",
+    "std-env": "^4.0.0",
     "ufo": "^1.6.3",
     "unctx": "^2.5.0",
     "unstorage": "^1.17.4",
-    "vue": "^3.5.27",
+    "vue": "^3.5.30",
     "vue-bundle-renderer": "^2.2.0",
     "vue-devtools-stub": "^0.1.0",
-    "@nuxt/kit": "3.21.0"
+    "@nuxt/kit": "3.21.2"
   },
   "peerDependencies": {
-    "nuxt": "^3.21.0"
+    "nuxt": "^3.21.2"
   },
   "devDependencies": {
-    "obuild": "0.4.14",
-    "vitest": "3.2.4",
-    "nuxt": "3.21.0",
-    "@nuxt/schema": "3.21.0"
+    "obuild": "0.4.32",
+    "vitest": "4.0.18",
+    "@nuxt/schema": "3.21.2",
+    "nuxt": "3.21.2"
   },
   "engines": {
     "node": "^20.19.0 || >=22.12.0"