@nuxt/nitro-server 4.3.0 → 4.4.2

package/README.md

@@ -1,15 +1,15 @@
-[![Nuxt banner](https://github.com/nuxt/nuxt/blob/main/.github/assets/banner.svg)](https://nuxt.com)
+<a href="https://nuxt.com"><img width="830" height="213" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/banner.svg" alt="Nuxt banner"></a>
 
 # Nuxt
 
 <p>
-  <a href="https://www.npmjs.com/package/nuxt"><img src="https://img.shields.io/npm/v/nuxt.svg?style=flat&colorA=18181B&colorB=28CF8D" alt="Version"></a>
-  <a href="https://www.npmjs.com/package/nuxt"><img src="https://img.shields.io/npm/dm/nuxt.svg?style=flat&colorA=18181B&colorB=28CF8D" alt="Downloads"></a>
+  <a href="https://npmx.dev/package/nuxt"><img src="https://npmx.dev/api/registry/badge/version/nuxt" alt="Version"></a>
+  <a href="https://npmx.dev/package/nuxt"><img src="https://npmx.dev/api/registry/badge/downloads/nuxt" alt="Downloads"></a>
   <a href="https://github.com/nuxt/nuxt/blob/main/LICENSE"><img src="https://img.shields.io/github/license/nuxt/nuxt.svg?style=flat&colorA=18181B&colorB=28CF8D" alt="License"></a>
   <a href="https://nuxt.com/modules"><img src="https://img.shields.io/badge/dynamic/json?url=https://nuxt.com/api/v1/modules&query=$.stats.modules&label=Modules&style=flat&colorA=18181B&colorB=28CF8D" alt="Modules"></a>
   <a href="https://nuxt.com"><img src="https://img.shields.io/badge/Nuxt%20Docs-18181B?logo=nuxt" alt="Website"></a>
   <a href="https://chat.nuxt.dev"><img src="https://img.shields.io/badge/Nuxt%20Discord-18181B?logo=discord" alt="Discord"></a>
-  <a href="https://securityscorecards.dev/"><img src="https://api.securityscorecards.dev/projects/github.com/nuxt/nuxt/badge" alt="Nuxt openssf scorecard score"></a>
+  <a href="https://securityscorecards.dev/viewer/?uri=github.com/nuxt/nuxt"><img src="https://api.securityscorecards.dev/projects/github.com/nuxt/nuxt/badge" alt="Nuxt openssf scorecard score"></a>
   <a href="https://deepwiki.com/nuxt/nuxt"><img src="https://deepwiki.com/badge.svg" alt="Ask DeepWiki"></a>
 </p>
 
@@ -111,7 +111,7 @@ Follow the docs to [Set Up Your Local Development Environment](https://nuxt.com/
 ## <a name="follow-us">🔗 Follow Us</a>
 
 <p valign="center">
-  <a href="https://go.nuxt.com/discord"><img width="20px" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/discord.svg" alt="Discord"></a>&nbsp;&nbsp;<a href="https://go.nuxt.com/x"><img width="20px" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/twitter.svg" alt="Twitter"></a>&nbsp;&nbsp;<a href="https://go.nuxt.com/github"><img width="20px" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/github.svg" alt="GitHub"></a>&nbsp;&nbsp;<a href="https://go.nuxt.com/bluesky"><img width="20px" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/bluesky.svg" alt="Bluesky"></a>
+  <a href="https://go.nuxt.com/discord"><img width="20" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/discord.svg" alt="Discord"></a>&nbsp;&nbsp;<a href="https://go.nuxt.com/x"><img width="20" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/twitter.svg" alt="Twitter"></a>&nbsp;&nbsp;<a href="https://go.nuxt.com/github"><img width="20" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/github.svg" alt="GitHub"></a>&nbsp;&nbsp;<a href="https://go.nuxt.com/bluesky"><img width="20" src="https://github.com/nuxt/nuxt/blob/main/.github/assets/bluesky.svg" alt="Bluesky"></a>
 </p>
 
 ## <a name="license">⚖️ License</a>

package/dist/THIRD-PARTY-LICENSES.md

@@ -0,0 +1,11 @@
+# Licenses of Bundled Dependencies
+
+The published artifact additionally contains code with the following licenses:
+MIT
+
+# Bundled Dependencies
+
+## nuxt
+
+License: MIT
+Repository: https://github.com/nuxt/nuxt

package/dist/index.d.mts

@@ -150,7 +150,7 @@ declare module "@nuxt/schema" {
     * @example
     * ```js
     * serverHandlers: [
-    *   { route: '/path/foo/**:name', handler: '~/server/foohandler.ts' }
+    *   { route: '/path/foo/**:name', handler: '#server/foohandler.ts' }
     * ]
     * ```
     */

package/dist/index.mjs

@@ -1,3 +1,4 @@
+import { performance } from "node:perf_hooks";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { existsSync, promises, readFileSync } from "node:fs";
 import { cpus } from "node:os";
@@ -15,14 +16,13 @@ import { addPlugin, addTemplate, addVitePlugin, createIsIgnored, findPath, getDi
 import escapeRE from "escape-string-regexp";
 import { defu } from "defu";
 import { defineEventHandler, dynamicEventHandler, handleCors, setHeader } from "h3";
-import { isWindows } from "std-env";
+import { addDependency } from "nypm";
+import { hasTTY, isCI, isWindows } from "std-env";
 import { ImpoundPlugin } from "impound";
 import { resolveModulePath } from "exsolve";
 import { runtimeDependencies } from "nitropack/runtime/meta";
-
 //#region package.json
-var version = "4.3.0";
-
+var version = "4.4.2";
 //#endregion
 //#region src/utils.ts
 function toArray(value) {
@@ -31,32 +31,63 @@ function toArray(value) {
 let _distDir = dirname(fileURLToPath(import.meta.url));
 if (/(?:chunks|shared)$/.test(_distDir)) _distDir = dirname(_distDir);
 const distDir = _distDir;
-
 //#endregion
 //#region ../ui-templates/dist/templates/spa-loading-icon.ts
 const template = () => {
 	return "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"80\" fill=\"none\" class=\"nuxt-spa-loading\" viewBox=\"0 0 37 25\"><path d=\"M24.236 22.006h10.742L25.563 5.822l-8.979 14.31a4 4 0 0 1-3.388 1.874H2.978l11.631-20 5.897 10.567\"/></svg><style>.nuxt-spa-loading{left:50%;position:fixed;top:50%;transform:translate(-50%,-50%)}.nuxt-spa-loading>path{animation:nuxt-spa-loading-move 3s linear infinite;fill:none;stroke:#00dc82;stroke-dasharray:128;stroke-dashoffset:128;stroke-linecap:round;stroke-linejoin:round;stroke-width:4px}@keyframes nuxt-spa-loading-move{to{stroke-dashoffset:-128}}</style>";
 };
-
 //#endregion
 //#region ../nuxt/src/core/plugins/import-protection.ts
 function createImportProtectionPatterns(nuxt, options) {
 	const patterns = [];
 	const context = contextFlags[options.context];
-	patterns.push([/^(nuxt|nuxt3|nuxt-nightly)$/, `\`nuxt\`, or \`nuxt-nightly\` cannot be imported directly in ${context}.` + (options.context === "nuxt-app" ? " Instead, import runtime Nuxt composables from `#app` or `#imports`." : "")]);
-	patterns.push([/^((~|~~|@|@@)?\/)?nuxt\.config(\.|$)/, "Importing directly from a `nuxt.config` file is not allowed. Instead, use runtime config or a module."]);
+	patterns.push([
+		/^(nuxt|nuxt3|nuxt-nightly)$/,
+		`\`nuxt\` or \`nuxt-nightly\` cannot be imported directly in ${context}.`,
+		options.context === "nuxt-app" ? ["Import runtime Nuxt composables from `#app` or `#imports` instead."] : ["Use `#app` or `#imports` for runtime composables in your Vue app code."]
+	]);
+	patterns.push([
+		/^((~|~~|@|@@)?\/)?nuxt\.config(\.|$)/,
+		"Importing directly from a `nuxt.config` file is not allowed.",
+		[
+			"Use `useRuntimeConfig()` to access runtime config in your app.",
+			"Use `useAppConfig()` to access config that doesn't need to be changed at runtime.",
+			"Use a Nuxt module to access build-time configuration."
+		]
+	]);
 	patterns.push([/(^|node_modules\/)@vue\/composition-api/]);
-	for (const mod of nuxt.options._installedModules) if (mod.entryPath) patterns.push([/* @__PURE__ */ new RegExp(`^${escapeRE(mod.entryPath)}$`), "Importing directly from module entry-points is not allowed."]);
+	for (const mod of nuxt.options._installedModules) if (mod.entryPath) patterns.push([
+		new RegExp(`^${escapeRE(mod.entryPath)}$`),
+		"Importing directly from module entry-points is not allowed.",
+		["Import from the module's runtime directory instead (e.g. `my-module/runtime/...`)."]
+	]);
 	for (const i of [
 		/(^|node_modules\/)@nuxt\/(cli|kit|test-utils)/,
 		/(^|node_modules\/)nuxi/,
 		/(^|node_modules\/)nitro(?:pack)?(?:-nightly)?(?:$|\/)(?!(?:dist\/)?(?:node_modules|presets|runtime|types))/,
 		/(^|node_modules\/)nuxt\/(config|kit|schema)/
-	]) patterns.push([i, `This module cannot be imported in ${context}.`]);
-	if (options.context === "nitro-app" || options.context === "shared") for (const i of ["#app", /^#build(\/|$)/]) patterns.push([i, `Vue app aliases are not allowed in ${context}.`]);
+	]) patterns.push([
+		i,
+		`This module cannot be imported in ${context}.`,
+		["These are build-time only packages and cannot be used at runtime."]
+	]);
+	if (options.context === "nitro-app" || options.context === "shared") for (const i of ["#app", /^#build(\/|$)/]) patterns.push([
+		i,
+		`Vue app aliases are not allowed in ${context}.`,
+		["Move this code to your Vue app directory or use a shared utility."]
+	]);
 	if (options.context === "nuxt-app" || options.context === "shared") {
-		patterns.push([/* @__PURE__ */ new RegExp(escapeRE(relative(nuxt.options.srcDir, resolve(nuxt.options.srcDir, nuxt.options.serverDir || "server"))) + "\\/(api|routes|middleware|plugins)\\/"), `Importing from server is not allowed in ${context}.`]);
-		patterns.push([/^#server(\/|$)/, `Server aliases are not allowed in ${context}.`]);
+		const serverRelative = escapeRE(relative(nuxt.options.rootDir, resolve(nuxt.options.srcDir, nuxt.options.serverDir || "server")));
+		patterns.push([
+			new RegExp("^" + serverRelative + "\\/(api|routes|middleware|plugins)\\/"),
+			`Importing from server is not allowed in ${context}.`,
+			["Use `$fetch()` or `useFetch()` to fetch data from server routes.", "Move shared logic to the `shared/` directory."]
+		]);
+		patterns.push([
+			/^#server(\/|$)/,
+			`Server aliases are not allowed in ${context}.`,
+			["Use `$fetch()` or `useFetch()` to call server endpoints.", "Move shared logic to the `shared/` directory."]
+		]);
 	}
 	return patterns;
 }
@@ -65,7 +96,6 @@ const contextFlags = {
 	"nuxt-app": "the Vue part of your app",
 	"shared": "the #shared directory"
 };
-
 //#endregion
 //#region src/templates.ts
 const nitroSchemaTemplate = {
@@ -77,12 +107,9 @@ const nitroSchemaTemplate = {
 			references,
 			declarations
 		});
-		const sourceDir = join(nuxt.options.buildDir, "types");
+		const typesDir = join(nuxt.options.buildDir, "types");
 		return `
-${[...references.map((ref) => {
-			if ("path" in ref && isAbsolute(ref.path)) ref.path = relative(sourceDir, ref.path);
-			return `/// <reference ${renderAttrs(ref)} />`;
-		}), ...declarations].join("\n")}
+${[...references.map((ref) => renderReference(ref, typesDir)), ...declarations].join("\n")}
 
 import type { RuntimeConfig } from 'nuxt/schema'
 import type { H3Event } from 'h3'
@@ -144,15 +171,9 @@ declare module 'nitropack/types' {
 `;
 	}
 };
-function renderAttr(key, value) {
-	return value ? `${key}="${value}"` : "";
-}
-function renderAttrs(obj) {
-	const attrs = [];
-	for (const key in obj) attrs.push(renderAttr(key, obj[key]));
-	return attrs.join(" ");
+function renderReference(ref, baseDir) {
+	return `/// <reference ${"path" in ref ? `path="${isAbsolute(ref.path) ? relative(baseDir, ref.path) : ref.path}"` : `types="${ref.types}"`} />`;
 }
-
 //#endregion
 //#region src/index.ts
 const logLevelMapReverse = {
@@ -171,7 +192,7 @@ async function bundle(nuxt) {
 	}
 	const layerPublicAssetsDirs = [];
 	for (const dirs of layerDirs) if (existsSync(dirs.public)) layerPublicAssetsDirs.push({ dir: dirs.public });
-	const excludePattern = excludePaths.length ? [/* @__PURE__ */ new RegExp(`node_modules\\/(?!${excludePaths.join("|")})`)] : [/node_modules/];
+	const excludePattern = excludePaths.length ? [new RegExp(`node_modules\\/(?!${excludePaths.join("|")})`)] : [/node_modules/];
 	const rootDirWithSlash = withTrailingSlash(nuxt.options.rootDir);
 	const moduleEntryPaths = [];
 	for (const m of nuxt.options._installedModules) {
@@ -294,7 +315,8 @@ async function bundle(nuxt) {
 					`export const NUXT_JSON_PAYLOADS = ${!!nuxt.options.experimental.renderJsonPayloads}`,
 					`export const NUXT_ASYNC_CONTEXT = ${!!nuxt.options.experimental.asyncContext}`,
 					`export const NUXT_SHARED_DATA = ${!!nuxt.options.experimental.sharedPrerenderData}`,
-					`export const NUXT_PAYLOAD_EXTRACTION = ${!!nuxt.options.experimental.payloadExtraction}`,
+					`export const NUXT_PAYLOAD_EXTRACTION = ${nuxt.options.experimental.payloadExtraction !== false}`,
+					`export const NUXT_PAYLOAD_INLINE = ${nuxt.options.experimental.payloadExtraction !== true}`,
 					`export const NUXT_RUNTIME_PAYLOAD_EXTRACTION = ${hasCachedRoutes}`
 				].join("\n");
 			}
@@ -399,7 +421,8 @@ async function bundle(nuxt) {
 		"appLayout",
 		"cache",
 		"isr",
-		"swr"
+		"swr",
+		"ssr"
 	];
 	function getRouteRulesRouter() {
 		const routeRulesRouter = createRouter();
@@ -448,18 +471,19 @@ async function bundle(nuxt) {
 		}
 	});
 	if (nuxt.options.experimental.payloadExtraction) {
-		if (nuxt.options.dev) nuxt.hook("nitro:config", (nitroConfig$1) => {
-			nitroConfig$1.prerender ||= {};
-			nitroConfig$1.prerender.routes ||= [];
-			nitroConfig$1.routeRules ||= {};
-			for (const route of nitroConfig$1.prerender.routes) {
+		if (nuxt.options.dev) nuxt.hook("nitro:config", (nitroConfig) => {
+			nitroConfig.prerender ||= {};
+			nitroConfig.prerender.routes ||= [];
+			nitroConfig.routeRules ||= {};
+			for (const route of nitroConfig.prerender.routes) {
 				if (!route) continue;
-				nitroConfig$1.routeRules[route] = defu(nitroConfig$1.routeRules[route], { prerender: true });
+				nitroConfig.routeRules[route] = defu(nitroConfig.routeRules[route], { prerender: true });
 			}
 		});
-		nuxt.hook("nitro:init", (nitro$1) => {
-			nitro$1.hooks.hook("build:before", (nitro$2) => {
-				for (const [route, value] of Object.entries(nitro$2.options.routeRules)) if (!route.endsWith("*") && !route.endsWith("/_payload.json")) {
+		nuxt.hook("nitro:init", (nitro) => {
+			nitro.hooks.hook("build:before", (nitro) => {
+				for (const [route, value] of Object.entries(nitro.options.routeRules)) if (!route.endsWith("*") && !route.endsWith("/_payload.json")) {
+					if (value.ssr === false) continue;
 					if (value.isr || value.cache || value.prerender && nuxt.options.dev) {
 						const payloadKey = route + "/_payload.json";
 						const defaults = {};
@@ -468,7 +492,7 @@ async function bundle(nuxt) {
 							"cache",
 							...nuxt.options.dev ? ["prerender"] : []
 						]) if (key in value) defaults[key] = value[key];
-						nitro$2.options.routeRules[payloadKey] = defu(nitro$2.options.routeRules[payloadKey], defaults);
+						nitro.options.routeRules[payloadKey] = defu(nitro.options.routeRules[payloadKey], defaults);
 					}
 				}
 			});
@@ -500,13 +524,13 @@ async function bundle(nuxt) {
 			config.alias ||= {};
 			config.alias["#app-manifest"] = join(tempDir, `meta/${buildId}.json`);
 		});
-		nuxt.hook("nitro:init", (nitro$1) => {
-			nitro$1.hooks.hook("rollup:before", async (nitro$2) => {
+		nuxt.hook("nitro:init", (nitro) => {
+			nitro.hooks.hook("rollup:before", async (nitro) => {
 				const prerenderedRoutes = /* @__PURE__ */ new Set();
 				const routeRulesMatcher = getRouteRulesRouter();
-				if (nitro$2._prerenderedRoutes?.length) {
+				if (nitro._prerenderedRoutes?.length) {
 					const payloadSuffix = nuxt.options.experimental.renderJsonPayloads ? "/_payload.json" : "/_payload.js";
-					for (const route of nitro$2._prerenderedRoutes) if (!route.error && route.route.endsWith(payloadSuffix)) {
+					for (const route of nitro._prerenderedRoutes) if (!route.error && route.route.endsWith(payloadSuffix)) {
 						const url = route.route.slice(0, -payloadSuffix.length) || "/";
 						if (!defu({}, ...findAllRoutes(routeRulesMatcher, void 0, url).reverse()).prerender) prerenderedRoutes.add(url);
 					}
@@ -535,21 +559,72 @@ async function bundle(nuxt) {
 		nitroConfig.virtual["#build/dist/server/styles.mjs"] = "export default {}";
 		if (process.platform === "win32") nitroConfig.virtual["#build/dist/server/styles.mjs".replace(FORWARD_SLASH_RE, "\\")] = "export default {}";
 	}
+	if (nuxt.options.experimental.decorators) {
+		const nitroDecoratorDeps = ["@rollup/plugin-babel", "@babel/plugin-proposal-decorators"];
+		let hasDeps = true;
+		for (const pkg of nitroDecoratorDeps) try {
+			await import(pkg);
+		} catch (_err) {
+			const err = _err;
+			if (err.code !== "ERR_MODULE_NOT_FOUND" && err.code !== "MODULE_NOT_FOUND") throw err;
+			if (!isCI && hasTTY) {
+				logger.info("Decorator support requires additional dependencies.");
+				if (await logger.prompt(`Install \`${nitroDecoratorDeps.join("` and `")}\`?`, {
+					type: "confirm",
+					initial: true
+				})) {
+					logger.start(`Installing ${nitroDecoratorDeps.map((d) => `\`${d}\``).join(" and ")}...`);
+					await addDependency(nitroDecoratorDeps, {
+						dev: true,
+						cwd: nuxt.options.rootDir,
+						silent: true
+					});
+					logger.info("Rerun Nuxt to enable decorator support.");
+					process.exit(1);
+				}
+			}
+			logger.warn(`Cannot find \`${pkg}\`. Install \`${nitroDecoratorDeps.join("` and `")}\` to enable decorator support.`);
+			hasDeps = false;
+			break;
+		}
+		if (hasDeps) {
+			const { babel } = await import("@rollup/plugin-babel");
+			nitroConfig.rollupConfig.plugins = toArray(await nitroConfig.rollupConfig.plugins || []);
+			nitroConfig.rollupConfig.plugins.unshift(babel({
+				babelHelpers: "bundled",
+				configFile: false,
+				extensions: [
+					".ts",
+					".js",
+					".mjs",
+					".mts"
+				],
+				plugins: [["@babel/plugin-syntax-typescript", { isTSX: false }], ["@babel/plugin-proposal-decorators", { version: "2023-11" }]]
+			}), babel({
+				babelHelpers: "bundled",
+				configFile: false,
+				extensions: [".tsx", ".jsx"],
+				plugins: [["@babel/plugin-syntax-typescript", { isTSX: true }], ["@babel/plugin-proposal-decorators", { version: "2023-11" }]]
+			}));
+		}
+	}
 	nitroConfig.rollupConfig.plugins = await nitroConfig.rollupConfig.plugins || [];
 	nitroConfig.rollupConfig.plugins = toArray(nitroConfig.rollupConfig.plugins);
 	const sharedDir = withTrailingSlash(resolve(nuxt.options.rootDir, nuxt.options.dir.shared));
 	const relativeSharedDir = withTrailingSlash(relative(nuxt.options.rootDir, resolve(nuxt.options.rootDir, nuxt.options.dir.shared)));
 	const sharedPatterns = [
 		/^#shared\//,
-		/* @__PURE__ */ new RegExp("^" + escapeRE(sharedDir)),
-		/* @__PURE__ */ new RegExp("^" + escapeRE(relativeSharedDir))
+		new RegExp("^" + escapeRE(sharedDir)),
+		new RegExp("^" + escapeRE(relativeSharedDir))
 	];
 	nitroConfig.rollupConfig.plugins.push(ImpoundPlugin.rollup({
 		cwd: nuxt.options.rootDir,
+		trace: true,
 		include: sharedPatterns,
 		patterns: createImportProtectionPatterns(nuxt, { context: "shared" })
 	}), ImpoundPlugin.rollup({
 		cwd: nuxt.options.rootDir,
+		trace: true,
 		patterns: createImportProtectionPatterns(nuxt, { context: "nitro-app" }),
 		exclude: [/node_modules[\\/]nitro(?:pack)?(?:-nightly)?[\\/]|(packages|@nuxt)[\\/]nitro-server(?:-nightly)?[\\/](src|dist)[\\/]runtime[\\/]/, ...sharedPatterns]
 	}));
@@ -600,10 +675,12 @@ async function bundle(nuxt) {
 		tsConfig.compilerOptions.paths[alias] = [absolutePath];
 		if (isDirectory) tsConfig.compilerOptions.paths[`${alias}/*`] = [`${absolutePath}/*`];
 	}
+	nuxt._perf?.startPhase("nitro:createNitro");
 	const nitro = await createNitro(nitroConfig, {
 		compatibilityDate: nuxt.options.compatibilityDate,
 		dotenv: nuxt.options._loadOptions?.dotenv
 	});
+	nuxt._perf?.endPhase("nitro:createNitro");
 	if (nuxt.options.experimental.serverAppConfig === false && nitro.options.imports) {
 		nitro.options.imports.presets ||= [];
 		nitro.options.imports.presets = nitro.options.imports.presets.map((preset) => typeof preset === "string" || !("imports" in preset) ? preset : {
@@ -611,10 +688,7 @@ async function bundle(nuxt) {
 			imports: preset.imports.filter((i) => i !== "useAppConfig")
 		});
 	}
-	if (nitro.options.static && nuxt.options.experimental.payloadExtraction === void 0) {
-		logger.warn("Using experimental payload extraction for full-static output. You can opt-out by setting `experimental.payloadExtraction` to `false`.");
-		nuxt.options.experimental.payloadExtraction = true;
-	}
+	if (nitro.options.static && nuxt.options.experimental.payloadExtraction === false) logger.warn("Payload extraction is recommended for full-static output. You can enable it by setting `experimental.payloadExtraction` to `true` or `'client'`.");
 	const spaLoadingTemplateFilePath = await spaLoadingTemplatePath(nuxt);
 	nuxt.hook("builder:watch", async (_event, relativePath) => {
 		if (resolve(nuxt.options.srcDir, relativePath) === spaLoadingTemplateFilePath) await nitro.hooks.callHook("rollup:reload");
@@ -631,8 +705,52 @@ async function bundle(nuxt) {
 	} });
 	nuxt._nitro = nitro;
 	await nuxt.callHook("nitro:init", nitro);
+	if (nuxt._perf) nitro.hooks.hook("rollup:before", (_nitro, rollupConfig) => {
+		const plugins = rollupConfig.plugins || [];
+		for (const plugin of plugins) {
+			if (!plugin || !plugin.name) continue;
+			const pluginName = `nitro:${plugin.name}`;
+			for (const hookName of [
+				"transform",
+				"resolveId",
+				"load"
+			]) {
+				const original = plugin[hookName];
+				if (typeof original !== "function") continue;
+				plugin[hookName] = function(...args) {
+					const start = performance.now();
+					const record = () => nuxt._perf?.recordBundlerPluginHook(pluginName, hookName, performance.now() - start, start);
+					try {
+						const result = original.apply(this, args);
+						if (result && typeof result === "object" && "then" in result) return result.finally(record);
+						record();
+						return result;
+					} catch (err) {
+						record();
+						throw err;
+					}
+				};
+			}
+		}
+	});
 	nuxt["~runtimeDependencies"] ||= [];
 	nuxt["~runtimeDependencies"].push(...runtimeDependencies, "unhead", "@unhead/vue", "@nuxt/devalue", "unstorage", ...nitro.options.inlineDynamicImports ? ["vue", "@vue/server-renderer"] : []);
+	addVitePlugin({
+		name: "nuxt:nitro:ssr-conditions",
+		configEnvironment(name, config) {
+			if (name === "ssr") {
+				config.resolve ||= {};
+				config.resolve.conditions = [...nitro.options.exportConditions || [], "import"];
+			}
+		}
+	});
+	addVitePlugin({
+		name: "nuxt:nitro:vue-feature-flags",
+		applyToEnvironment: (environment) => environment.name === "ssr" && environment.config.isProduction,
+		configResolved(config) {
+			for (const key in config.define) if (key.startsWith("__VUE")) nitro.options.replace[key] = config.define[key];
+		}
+	});
 	nitro.vfs = nuxt.vfs = nitro.vfs || nuxt.vfs || {};
 	nuxt.hook("close", () => nitro.hooks.callHook("close"));
 	nitro.hooks.hook("prerender:routes", (routes) => {
@@ -666,12 +784,12 @@ async function bundle(nuxt) {
 		handler: resolve(distDir, "runtime/handlers/renderer")
 	});
 	if (nuxt.options.experimental.chromeDevtoolsProjectSettings) {
-		const cacheDir$1 = resolve(nuxt.options.rootDir, "node_modules/.cache/nuxt");
-		let projectConfiguration = await readFile(join(cacheDir$1, "chrome-workspace.json"), "utf-8").then((r) => JSON.parse(r)).catch(() => null);
+		const cacheDir = resolve(nuxt.options.rootDir, "node_modules/.cache/nuxt");
+		let projectConfiguration = await readFile(join(cacheDir, "chrome-workspace.json"), "utf-8").then((r) => JSON.parse(r)).catch(() => null);
 		if (!projectConfiguration) {
 			projectConfiguration = { uuid: randomUUID() };
-			await mkdir(cacheDir$1, { recursive: true });
-			await writeFile(join(cacheDir$1, "chrome-workspace.json"), JSON.stringify(projectConfiguration), "utf-8");
+			await mkdir(cacheDir, { recursive: true });
+			await writeFile(join(cacheDir, "chrome-workspace.json"), JSON.stringify(projectConfiguration), "utf-8");
 		}
 		nitro.options.devHandlers.push({
 			route: "/.well-known/appspecific/com.chrome.devtools.json",
@@ -681,14 +799,14 @@ async function bundle(nuxt) {
 			} }))
 		});
 	}
-	if (!nuxt.options.dev && nuxt.options.experimental.noVueServer) nitro.hooks.hook("rollup:before", (nitro$1) => {
-		if (nitro$1.options.preset === "nitro-prerender") {
-			nitro$1.options.errorHandler = resolve(distDir, "runtime/handlers/error");
+	if (!nuxt.options.dev && nuxt.options.experimental.noVueServer) nitro.hooks.hook("rollup:before", (nitro) => {
+		if (nitro.options.preset === "nitro-prerender") {
+			nitro.options.errorHandler = resolve(distDir, "runtime/handlers/error");
 			return;
 		}
-		const nuxtErrorHandler = nitro$1.options.handlers.findIndex((h) => h.route === "/__nuxt_error");
-		if (nuxtErrorHandler >= 0) nitro$1.options.handlers.splice(nuxtErrorHandler, 1);
-		nitro$1.options.renderer = void 0;
+		const nuxtErrorHandler = nitro.options.handlers.findIndex((h) => h.route === "/__nuxt_error");
+		if (nuxtErrorHandler >= 0) nitro.options.handlers.splice(nuxtErrorHandler, 1);
+		nitro.options.renderer = void 0;
 	});
 	nitro.hooks.hook("types:extend", (types) => {
 		types.tsConfig ||= {};
@@ -716,26 +834,17 @@ async function bundle(nuxt) {
 		for (const route of ["/200.html", "/404.html"]) routes.add(route);
 		if (!nuxt.options.ssr) routes.add("/index.html");
 	});
-	if (!nuxt.options.dev) nitro.hooks.hook("rollup:before", async (nitro$1) => {
-		await copyPublicAssets(nitro$1);
-		await nuxt.callHook("nitro:build:public-assets", nitro$1);
+	if (!nuxt.options.dev) nitro.hooks.hook("rollup:before", async (nitro) => {
+		await copyPublicAssets(nitro);
+		await nuxt.callHook("nitro:build:public-assets", nitro);
 	});
 	async function symlinkDist() {
 		if (nitro.options.static) {
-			const distDir$1 = resolve(nuxt.options.rootDir, "dist");
-			if (!existsSync(distDir$1)) await promises.symlink(nitro.options.output.publicDir, distDir$1, "junction").catch(() => {});
+			const distDir = resolve(nuxt.options.rootDir, "dist");
+			if (!existsSync(distDir)) await promises.symlink(nitro.options.output.publicDir, distDir, "junction").catch(() => {});
 		}
 	}
-	nuxt.hook("build:done", async () => {
-		await nuxt.callHook("nitro:build:before", nitro);
-		await prepare(nitro);
-		if (nuxt.options.dev) return build(nitro);
-		await prerender(nitro);
-		logger.restoreAll();
-		await build(nitro);
-		logger.wrapAll();
-		await symlinkDist();
-	});
+	let waitUntilCompile;
 	if (nuxt.options.dev) {
 		for (const builder of ["webpack", "rspack"]) {
 			nuxt.hook(`${builder}:compile`, ({ name, compiler }) => {
@@ -761,9 +870,27 @@ async function bundle(nuxt) {
 			}));
 		});
 		nuxt.server = createDevServer(nitro);
-		const waitUntilCompile = new Promise((resolve$1) => nitro.hooks.hook("compiled", () => resolve$1()));
-		nuxt.hook("build:done", () => waitUntilCompile);
+		waitUntilCompile = new Promise((resolve) => nitro.hooks.hook("compiled", () => resolve()));
 	}
+	nuxt.hook("build:done", async () => {
+		nuxt._perf?.startPhase("nitro:build");
+		try {
+			await nuxt.callHook("nitro:build:before", nitro);
+			await prepare(nitro);
+			if (nuxt.options.dev) {
+				await build(nitro);
+				await waitUntilCompile;
+				return;
+			}
+			await prerender(nitro);
+			logger.restoreAll();
+			await build(nitro);
+			logger.wrapAll();
+			await symlinkDist();
+		} finally {
+			nuxt._perf?.endPhase("nitro:build");
+		}
+	});
 }
 const RELATIVE_RE = /^([^.])/;
 function relativeWithDot(from, to) {
@@ -775,14 +902,13 @@ async function spaLoadingTemplatePath(nuxt) {
 }
 async function spaLoadingTemplate(nuxt) {
 	if (nuxt.options.spaLoadingTemplate === false) return "";
-	const spaLoadingTemplate$1 = await spaLoadingTemplatePath(nuxt);
+	const spaLoadingTemplate = await spaLoadingTemplatePath(nuxt);
 	try {
-		if (existsSync(spaLoadingTemplate$1)) return readFileSync(spaLoadingTemplate$1, "utf-8").trim();
+		if (existsSync(spaLoadingTemplate)) return readFileSync(spaLoadingTemplate, "utf-8").trim();
 	} catch {}
 	if (nuxt.options.spaLoadingTemplate === true) return template();
 	if (nuxt.options.spaLoadingTemplate) logger.warn(`Could not load custom \`spaLoadingTemplate\` path as it does not exist: \`${nuxt.options.spaLoadingTemplate}\`.`);
 	return "";
 }
-
 //#endregion
-export { bundle };
+export { bundle };

package/dist/runtime/h3-compat.d.mts

@@ -0,0 +1,4 @@
+/**
+* h3 compatibility layer for Nuxt runtime code.
+*/
+export * from "h3";

package/dist/runtime/h3-compat.mjs

@@ -0,0 +1,4 @@
+/**
+* h3 compatibility layer for Nuxt runtime code.
+*/
+export * from "h3";

package/dist/runtime/handlers/error.mjs

@@ -25,8 +25,8 @@ export default (async function errorhandler(error, event, { defaultHandler }) {
 	// remove proto/hostname/port from URL
 	const url = new URL(errorObject.url);
 	errorObject.url = withoutBase(url.pathname, useRuntimeConfig(event).app.baseURL) + url.search + url.hash;
-	// add default server message
-	errorObject.message ||= "Server Error";
+	// add default server message (keep sanitized for unhandled errors)
+	errorObject.message = error.unhandled ? errorObject.message || "Server Error" : error.message || errorObject.message || "Server Error";
 	// we will be rendering this error internally so we can pass along the error.data safely
 	errorObject.data ||= error.data;
 	errorObject.statusText ||= error.statusText || error.statusMessage;

package/dist/runtime/handlers/island.d.mts

@@ -1,2 +1,3 @@
-declare const _default;
-export default _default;
+import type { EventHandler } from "h3";
+declare const handler: EventHandler;
+export default handler;

package/dist/runtime/handlers/island.mjs

@@ -1,6 +1,6 @@
 import { useNitroApp } from "nitropack/runtime";
 import { destr } from "destr";
-import { defineEventHandler, getQuery, readBody, setResponseHeaders } from "h3";
+import { createError, defineEventHandler, getQuery, readBody, setResponseHeaders } from "h3";
 import { resolveUnrefHeadInput } from "@unhead/vue";
 import { getRequestDependencies } from "vue-bundle-renderer/runtime";
 import { getQuery as getURLQuery } from "ufo";
@@ -10,7 +10,7 @@ import { getSSRRenderer } from "../utils/renderer/build-files.mjs";
 import { renderInlineStyles } from "../utils/renderer/inline-styles.mjs";
 import { getClientIslandResponse, getServerComponentHTML, getSlotIslandResponse } from "../utils/renderer/islands.mjs";
 const ISLAND_SUFFIX_RE = /\.json(?:\?.*)?$/;
-export default defineEventHandler(async (event) => {
+const handler = defineEventHandler(async (event) => {
 	const nitroApp = useNitroApp();
 	setResponseHeaders(event, {
 		"content-type": "application/json;charset=utf-8",
@@ -95,26 +95,38 @@ export default defineEventHandler(async (event) => {
 	}
 	return islandResponse;
 });
+export default handler;
+const ISLAND_PATH_PREFIX = "/__nuxt_island/";
+const VALID_COMPONENT_NAME_RE = /^[a-z][\w.-]*$/i;
 async function getIslandContext(event) {
-	// TODO: Strict validation for url
 	let url = event.path || "";
 	if (import.meta.prerender && event.path && await islandPropCache.hasItem(event.path)) {
 		// rehydrate props from cache so we can rerender island if cache does not have it any more
 		url = await islandPropCache.getItem(event.path);
 	}
-	const componentParts = url.substring("/__nuxt_island".length + 1).replace(ISLAND_SUFFIX_RE, "").split("_");
+	if (!url.startsWith(ISLAND_PATH_PREFIX)) {
+		throw createError({
+			statusCode: 400,
+			statusMessage: "Invalid island request path"
+		});
+	}
+	const componentParts = url.substring(ISLAND_PATH_PREFIX.length).replace(ISLAND_SUFFIX_RE, "").split("_");
 	const hashId = componentParts.length > 1 ? componentParts.pop() : undefined;
 	const componentName = componentParts.join("_");
-	// TODO: Validate context
+	if (!componentName || !VALID_COMPONENT_NAME_RE.test(componentName)) {
+		throw createError({
+			statusCode: 400,
+			statusMessage: "Invalid island component name"
+		});
+	}
 	const context = event.method === "GET" ? getQuery(event) : await readBody(event);
-	const ctx = {
-		url: "/",
-		...context,
+	// Only extract known context fields to prevent arbitrary data injection
+	return {
+		url: typeof context?.url === "string" ? context.url : "/",
 		id: hashId,
 		name: componentName,
 		props: destr(context.props) || {},
 		slots: {},
 		components: {}
 	};
-	return ctx;
 }

package/dist/runtime/handlers/renderer.d.mts

@@ -1,2 +1,3 @@
-declare const _default;
-export default _default;
+import type { EventHandler } from "h3";
+declare const handler: EventHandler;
+export default handler;

package/dist/runtime/handlers/renderer.mjs

@@ -14,9 +14,9 @@ import { replaceIslandTeleports } from "../utils/renderer/islands.mjs";
 // @ts-expect-error virtual file
 import { renderSSRHeadOptions } from "#internal/unhead.config.mjs";
 // @ts-expect-error virtual file
-import { NUXT_ASYNC_CONTEXT, NUXT_EARLY_HINTS, NUXT_INLINE_STYLES, NUXT_JSON_PAYLOADS, NUXT_NO_SCRIPTS, NUXT_PAYLOAD_EXTRACTION, NUXT_RUNTIME_PAYLOAD_EXTRACTION, PARSE_ERROR_DATA } from "#internal/nuxt/nitro-config.mjs";
+import { NUXT_ASYNC_CONTEXT, NUXT_EARLY_HINTS, NUXT_INLINE_STYLES, NUXT_JSON_PAYLOADS, NUXT_NO_SCRIPTS, NUXT_PAYLOAD_EXTRACTION, NUXT_PAYLOAD_INLINE, NUXT_RUNTIME_PAYLOAD_EXTRACTION, PARSE_ERROR_DATA } from "#internal/nuxt/nitro-config.mjs";
 // @ts-expect-error virtual file
-import { appHead, appTeleportAttrs, appTeleportTag, componentIslands, appManifest as isAppManifestEnabled } from "#internal/nuxt.config.mjs";
+import { appHead, appTeleportAttrs, appTeleportTag, componentIslands } from "#internal/nuxt.config.mjs";
 // @ts-expect-error virtual file
 import entryIds from "#internal/nuxt/entry-ids.mjs";
 // @ts-expect-error virtual file
@@ -38,7 +38,7 @@ const APP_TELEPORT_CLOSE_TAG = HAS_APP_TELEPORTS ? `</${appTeleportTag}>` : "";
 const PAYLOAD_URL_RE = NUXT_JSON_PAYLOADS ? /^[^?]*\/_payload.json(?:\?.*)?$/ : /^[^?]*\/_payload.js(?:\?.*)?$/;
 const PAYLOAD_FILENAME = NUXT_JSON_PAYLOADS ? "_payload.json" : "_payload.js";
 let entryPath;
-export default defineRenderHandler(async (event) => {
+const handler = defineRenderHandler(async (event) => {
 	const nitroApp = useNitroApp();
 	// Whether we're rendering an error page
 	const ssrError = event.path.startsWith("/__nuxt_error") ? getQuery(event) : null;
@@ -72,12 +72,16 @@ export default defineRenderHandler(async (event) => {
 	const routeOptions = getRouteRules(event);
 	// Whether we are prerendering route or using ISR/SWR caching
 	const _PAYLOAD_EXTRACTION = !ssrContext.noSSR && (import.meta.prerender && NUXT_PAYLOAD_EXTRACTION || NUXT_RUNTIME_PAYLOAD_EXTRACTION && (routeOptions.isr || routeOptions.cache));
+	// When NUXT_PAYLOAD_INLINE is true (payloadExtraction: 'client'), we inline the full payload
+	// in the HTML to avoid a separate _payload.json fetch on initial load (which would trigger a
+	// second render or lambda invocation). The _payload.json endpoint still works for client-side nav.
+	const _PAYLOAD_INLINE = !_PAYLOAD_EXTRACTION || NUXT_PAYLOAD_INLINE;
 	const isRenderingPayload = (_PAYLOAD_EXTRACTION || import.meta.dev && routeOptions.prerender) && PAYLOAD_URL_RE.test(ssrContext.url);
 	if (isRenderingPayload) {
 		const url = ssrContext.url.substring(0, ssrContext.url.lastIndexOf("/")) || "/";
 		ssrContext.url = url;
 		event._path = event.node.req.url = url;
-		if (import.meta.prerender && await payloadCache.hasItem(url)) {
+		if (payloadCache && await payloadCache.hasItem(url)) {
 			return payloadCache.getItem(url);
 		}
 	}
@@ -128,16 +132,21 @@ export default defineRenderHandler(async (event) => {
 	// Directly render payload routes
 	if (isRenderingPayload) {
 		const response = renderPayloadResponse(ssrContext);
-		if (import.meta.prerender) {
+		if (payloadCache) {
 			await payloadCache.setItem(ssrContext.url, response);
 		}
 		return response;
 	}
-	if (_PAYLOAD_EXTRACTION && import.meta.prerender) {
-		// Hint nitro to prerender payload for this route
-		appendResponseHeader(event, "x-nitro-prerender", joinURL(ssrContext.url.replace(/\?.*$/, ""), PAYLOAD_FILENAME));
-		// Use same ssr context to generate payload for this route
-		await payloadCache.setItem(ssrContext.url === "/" ? "/" : ssrContext.url.replace(/\/$/, ""), renderPayloadResponse(ssrContext));
+	if (_PAYLOAD_EXTRACTION) {
+		if (import.meta.prerender) {
+			// Hint nitro to prerender payload for this route
+			appendResponseHeader(event, "x-nitro-prerender", joinURL(ssrContext.url.replace(/\?.*$/, ""), PAYLOAD_FILENAME));
+		}
+		// Cache payload from the current SSR context so _payload.json requests can be served
+		// without a full re-render (during prerender via LRU+FS, at runtime via in-memory TTL cache)
+		if (payloadCache) {
+			await payloadCache.setItem(ssrContext.url === "/" ? "/" : ssrContext.url.replace(/\/$/, ""), renderPayloadResponse(ssrContext));
+		}
 	}
 	const NO_SCRIPTS = NUXT_NO_SCRIPTS || routeOptions.noScripts;
 	// Setup head
@@ -167,7 +176,8 @@ export default defineRenderHandler(async (event) => {
 		}] }, headEntryOptions);
 	}
 	// 1. Preload payloads and app manifest
-	if (_PAYLOAD_EXTRACTION && !NO_SCRIPTS) {
+	// Skip preload when inlining full payload in HTML (no separate fetch needed for initial load)
+	if (_PAYLOAD_EXTRACTION && !_PAYLOAD_INLINE && !NO_SCRIPTS) {
 		ssrContext.head.push({ link: [NUXT_JSON_PAYLOADS ? {
 			rel: "preload",
 			as: "fetch",
@@ -179,18 +189,6 @@ export default defineRenderHandler(async (event) => {
 			href: payloadURL
 		}] }, headEntryOptions);
 	}
-	if (isAppManifestEnabled && ssrContext["~preloadManifest"] && !NO_SCRIPTS) {
-		ssrContext.head.push({ link: [{
-			rel: "preload",
-			as: "fetch",
-			fetchpriority: "low",
-			crossorigin: "anonymous",
-			href: buildAssetsURL(`builds/meta/${ssrContext.runtimeConfig.app.buildId}.json`)
-		}] }, {
-			...headEntryOptions,
-			tagPriority: "low"
-		});
-	}
 	// 2. Styles
 	if (inlinedStyles.length) {
 		ssrContext.head.push({ style: inlinedStyles });
@@ -225,7 +223,14 @@ export default defineRenderHandler(async (event) => {
 		ssrContext.head.push({ link: getPreloadLinks(ssrContext, renderer.rendererContext) }, headEntryOptions);
 		ssrContext.head.push({ link: getPrefetchLinks(ssrContext, renderer.rendererContext) }, headEntryOptions);
 		// 5. Payloads
-		ssrContext.head.push({ script: _PAYLOAD_EXTRACTION ? NUXT_JSON_PAYLOADS ? renderPayloadJsonScript({
+		ssrContext.head.push({ script: _PAYLOAD_INLINE ? NUXT_JSON_PAYLOADS ? renderPayloadJsonScript({
+			ssrContext,
+			data: ssrContext.payload
+		}) : renderPayloadScript({
+			ssrContext,
+			data: ssrContext.payload,
+			routeOptions
+		}) : NUXT_JSON_PAYLOADS ? renderPayloadJsonScript({
 			ssrContext,
 			data: splitPayload(ssrContext).initial,
 			src: payloadURL
@@ -234,13 +239,6 @@ export default defineRenderHandler(async (event) => {
 			data: splitPayload(ssrContext).initial,
 			routeOptions,
 			src: payloadURL
-		}) : NUXT_JSON_PAYLOADS ? renderPayloadJsonScript({
-			ssrContext,
-			data: ssrContext.payload
-		}) : renderPayloadScript({
-			ssrContext,
-			data: ssrContext.payload,
-			routeOptions
 		}) }, {
 			...headEntryOptions,
 			tagPosition: "bodyClose",
@@ -249,7 +247,7 @@ export default defineRenderHandler(async (event) => {
 	}
 	// 6. Scripts
 	if (!routeOptions.noScripts) {
-		const tagPosition = _PAYLOAD_EXTRACTION && !NUXT_JSON_PAYLOADS ? "bodyClose" : "head";
+		const tagPosition = _PAYLOAD_EXTRACTION && !_PAYLOAD_INLINE && !NUXT_JSON_PAYLOADS ? "bodyClose" : "head";
 		ssrContext.head.push({ script: Object.values(scripts).map((resource) => ({
 			type: resource.module ? "module" : null,
 			src: renderer.rendererContext.buildAssetsURL(resource.file),
@@ -281,6 +279,7 @@ export default defineRenderHandler(async (event) => {
 		}
 	};
 });
+export default handler;
 function normalizeChunks(chunks) {
 	const result = [];
 	for (const _chunk of chunks) {

package/dist/runtime/middleware/no-ssr.d.mts

@@ -1,2 +1,3 @@
-declare const _default;
-export default _default;
+import type { EventHandler } from "h3";
+declare const handler: EventHandler;
+export default handler;

package/dist/runtime/middleware/no-ssr.mjs

@@ -1,7 +1,8 @@
 import { defineEventHandler, getRequestHeader } from "h3";
-export default defineEventHandler((event) => {
+const handler = defineEventHandler((event) => {
 	if (getRequestHeader(event, "x-nuxt-no-ssr")) {
 		event.context.nuxt ||= {};
 		event.context.nuxt.noSSR = true;
 	}
 });
+export default handler;

package/dist/runtime/plugins/dev-server-logs.d.mts

@@ -1,2 +1,3 @@
-declare const _default;
+import type { NitroApp } from "nitropack/types";
+declare const _default: (nitroApp: NitroApp) => void;
 export default _default;

package/dist/runtime/utils/cache.d.mts

@@ -1,5 +1,11 @@
-export declare const payloadCache: unknown;
-export declare const islandCache: unknown;
-export declare const islandPropCache: unknown;
-export declare const sharedPrerenderPromises: unknown;
-export declare const sharedPrerenderCache: unknown;
+import type { Storage } from "unstorage";
+export declare const payloadCache: Storage | null;
+export declare const islandCache: Storage | null;
+export declare const islandPropCache: Storage | null;
+export declare const sharedPrerenderPromises: Map<string, Promise<any>> | null;
+interface SharedPrerenderCache {
+	get<T = unknown>(key: string): Promise<T> | undefined;
+	set<T>(key: string, value: Promise<T>): Promise<void>;
+}
+export declare const sharedPrerenderCache: SharedPrerenderCache | null;
+export {};

package/dist/runtime/utils/cache.mjs

@@ -1,7 +1,7 @@
 import { useStorage } from "nitropack/runtime";
 // @ts-expect-error virtual file
-import { NUXT_SHARED_DATA } from "#internal/nuxt/nitro-config.mjs";
-export const payloadCache = import.meta.prerender ? useStorage("internal:nuxt:prerender:payload") : null;
+import { NUXT_RUNTIME_PAYLOAD_EXTRACTION, NUXT_SHARED_DATA } from "#internal/nuxt/nitro-config.mjs";
+export const payloadCache = import.meta.prerender ? useStorage("internal:nuxt:prerender:payload") : NUXT_RUNTIME_PAYLOAD_EXTRACTION ? useStorage("cache:nuxt:payload") : null;
 export const islandCache = import.meta.prerender ? useStorage("internal:nuxt:prerender:island") : null;
 export const islandPropCache = import.meta.prerender ? useStorage("internal:nuxt:prerender:island-props") : null;
 export const sharedPrerenderPromises = import.meta.prerender && NUXT_SHARED_DATA ? new Map() : null;

package/dist/runtime/utils/config.d.mts

@@ -1 +1 @@
-export declare const defineAppConfig: unknown;
+export declare const defineAppConfig: (config: any) => any;

package/dist/runtime/utils/dev.mjs

@@ -357,7 +357,7 @@ function webComponentScript(base64HTML, startMinimized) {
     iframe.id = 'frame';
     iframe.src = 'data:text/html;base64,${base64HTML}';
     iframe.title = 'Detailed error stack trace';
-    iframe.setAttribute('sandbox', 'allow-scripts allow-same-origin');
+    iframe.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-top-navigation-by-user-activation');
 
     const preview = el('div');
     preview.id = 'preview';

package/dist/runtime/utils/error.d.mts

@@ -3,4 +3,4 @@ import type { H3Event } from "h3";
 * Nitro internal functions extracted from https://github.com/nitrojs/nitro/blob/v2/src/runtime/internal/utils.ts
 */
 export declare function isJsonRequest(event: H3Event): boolean;
-export declare function hasReqHeader(event: H3Event, name: string, includes: string);
+export declare function hasReqHeader(event: H3Event, name: string, includes: string): boolean;

package/dist/runtime/utils/error.mjs

@@ -11,5 +11,5 @@ export function isJsonRequest(event) {
 }
 export function hasReqHeader(event, name, includes) {
 	const value = getRequestHeader(event, name);
-	return value && typeof value === "string" && value.toLowerCase().includes(includes);
+	return !!(value && typeof value === "string" && value.toLowerCase().includes(includes));
 }

package/dist/runtime/utils/renderer/app.mjs

@@ -1,4 +1,3 @@
-import { decodePath } from "ufo";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { createHead } from "@unhead/vue/server";
 import { sharedPrerenderCache } from "../cache.mjs";
@@ -13,7 +12,7 @@ const PRERENDER_NO_SSR_ROUTES = new Set([
 ]);
 export function createSSRContext(event) {
 	const ssrContext = {
-		url: decodePath(event.path),
+		url: event.path,
 		event,
 		runtimeConfig: useRuntimeConfig(event),
 		noSSR: !!NUXT_NO_SSR || event.context.nuxt?.noSSR || (import.meta.prerender ? PRERENDER_NO_SSR_ROUTES.has(event.path) : false),

package/dist/runtime/utils/renderer/build-files.d.mts

@@ -10,9 +10,7 @@ interface Renderer {
 		renderScripts: () => string;
 	}>;
 }
-// -- SSR Renderer --
-export declare const getSSRRenderer: unknown;
+export declare const getSSRRenderer: () => Promise<Renderer>;
 export declare function getRenderer(ssrContext: NuxtSSRContext): Promise<Renderer>;
-// @ts-expect-error file will be produced after app build
-export declare const getSSRStyles: unknown;
+export declare const getSSRStyles: () => Promise<Record<string, () => Promise<string[]>>>;
 export {};

package/dist/runtime/utils/renderer/payload.mjs

@@ -4,10 +4,10 @@ import { stringify, uneval } from "devalue";
 // @ts-expect-error virtual file
 import { appId, multiApp } from "#internal/nuxt.config.mjs";
 // @ts-expect-error virtual file
-import { NUXT_JSON_PAYLOADS, NUXT_NO_SSR, NUXT_PAYLOAD_EXTRACTION, NUXT_RUNTIME_PAYLOAD_EXTRACTION } from "#internal/nuxt/nitro-config.mjs";
+import { NUXT_JSON_PAYLOADS, NUXT_NO_SSR } from "#internal/nuxt/nitro-config.mjs";
 export function renderPayloadResponse(ssrContext) {
 	return {
-		body: NUXT_JSON_PAYLOADS ? stringify(splitPayload(ssrContext).payload, ssrContext["~payloadReducers"]) : `export default ${devalue(splitPayload(ssrContext).payload)}`,
+		body: NUXT_JSON_PAYLOADS ? encodeForwardSlashes(stringify(splitPayload(ssrContext).payload, ssrContext["~payloadReducers"])) : `export default ${devalue(splitPayload(ssrContext).payload)}`,
 		statusCode: getResponseStatus(ssrContext.event),
 		statusMessage: getResponseStatusText(ssrContext.event),
 		headers: {
@@ -17,7 +17,7 @@ export function renderPayloadResponse(ssrContext) {
 	};
 }
 export function renderPayloadJsonScript(opts) {
-	const contents = opts.data ? stringify(opts.data, opts.ssrContext["~payloadReducers"]) : "";
+	const contents = opts.data ? encodeForwardSlashes(stringify(opts.data, opts.ssrContext["~payloadReducers"])) : "";
 	const payload = {
 		"type": "application/json",
 		"innerHTML": contents,
@@ -33,13 +33,29 @@ export function renderPayloadJsonScript(opts) {
 	const config = uneval(opts.ssrContext.config);
 	return [payload, { innerHTML: multiApp ? `window.__NUXT__=window.__NUXT__||{};window.__NUXT__[${JSON.stringify(appId)}]={config:${config}}` : `window.__NUXT__={};window.__NUXT__.config=${config}` }];
 }
+/**
+* Encode forward slashes as unicode escape sequences to prevent
+* Google from treating them as internal links and trying to crawl them.
+* @see https://github.com/nuxt/nuxt/issues/24175
+*/
+function encodeForwardSlashes(str) {
+	return str.replaceAll("/", "\\u002F");
+}
+/**
+* Escape a string for safe interpolation inside a double-quoted JavaScript string literal.
+* Prevents XSS when user-controlled URLs are embedded in inline `<script>` tags.
+*/
+function escapeJsString(str) {
+	return str.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"").replaceAll("\n", "\\n").replaceAll("\r", "\\r").replaceAll("/", "\\u002F").replaceAll("<", "\\u003C");
+}
 export function renderPayloadScript(opts) {
 	opts.data.config = opts.ssrContext.config;
-	const _PAYLOAD_EXTRACTION = !opts.ssrContext.noSSR && (import.meta.prerender && NUXT_PAYLOAD_EXTRACTION || NUXT_RUNTIME_PAYLOAD_EXTRACTION && (opts.routeOptions.isr || opts.routeOptions.cache));
 	const nuxtData = devalue(opts.data);
-	if (_PAYLOAD_EXTRACTION) {
-		const singleAppPayload = `import p from "${opts.src}";window.__NUXT__={...p,...(${nuxtData})}`;
-		const multiAppPayload = `import p from "${opts.src}";window.__NUXT__=window.__NUXT__||{};window.__NUXT__[${JSON.stringify(appId)}]={...p,...(${nuxtData})}`;
+	if (opts.src) {
+		// Escape the URL to prevent XSS when interpolated into a JS string literal
+		const escapedSrc = escapeJsString(opts.src);
+		const singleAppPayload = `import p from "${escapedSrc}";window.__NUXT__={...p,...(${nuxtData})}`;
+		const multiAppPayload = `import p from "${escapedSrc}";window.__NUXT__=window.__NUXT__||{};window.__NUXT__[${JSON.stringify(appId)}]={...p,...(${nuxtData})}`;
 		return [{
 			type: "module",
 			innerHTML: multiApp ? multiAppPayload : singleAppPayload

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxt/nitro-server",
-  "version": "4.3.0",
+  "version": "4.4.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/nuxt/nuxt.git",
@@ -11,49 +11,71 @@
   "license": "MIT",
   "type": "module",
   "types": "./dist/index.d.mts",
+  "typesVersions": {
+    "*": {
+      "h3": [
+        "./dist/runtime/h3-compat.d.mts"
+      ]
+    }
+  },
   "exports": {
-    ".": "./dist/index.mjs"
+    ".": "./dist/index.mjs",
+    "./h3": "./dist/runtime/h3-compat.mjs"
   },
   "files": [
     "dist"
   ],
   "dependencies": {
+    "@babel/plugin-syntax-typescript": "^7.28.6",
     "@nuxt/devalue": "^2.0.2",
-    "@unhead/vue": "^2.1.2",
-    "@vue/shared": "^3.5.27",
+    "@unhead/vue": "^2.1.12",
+    "@vue/shared": "^3.5.30",
     "consola": "^3.4.2",
     "defu": "^6.1.4",
     "destr": "^2.0.5",
-    "devalue": "^5.6.2",
+    "devalue": "^5.6.3",
     "errx": "^0.1.0",
     "escape-string-regexp": "^5.0.0",
     "exsolve": "^1.0.8",
-    "h3": "^1.15.5",
-    "impound": "^1.0.0",
+    "h3": "^1.15.6",
+    "impound": "^1.1.5",
     "klona": "^2.0.6",
     "mocked-exports": "^0.1.1",
     "nitropack": "^2.13.1",
+    "nypm": "^0.6.5",
     "ohash": "^2.0.11",
     "pathe": "^2.0.3",
     "pkg-types": "^2.3.0",
-    "rou3": "^0.7.12",
-    "std-env": "^3.10.0",
+    "rou3": "^0.8.1",
+    "std-env": "^4.0.0",
     "ufo": "^1.6.3",
     "unctx": "^2.5.0",
     "unstorage": "^1.17.4",
-    "vue": "^3.5.27",
+    "vue": "^3.5.30",
     "vue-bundle-renderer": "^2.2.0",
     "vue-devtools-stub": "^0.1.0",
-    "@nuxt/kit": "4.3.0"
+    "@nuxt/kit": "4.4.2"
   },
   "peerDependencies": {
-    "nuxt": "^4.3.0"
+    "@babel/plugin-proposal-decorators": "^7.25.0",
+    "@rollup/plugin-babel": "^6.0.0 || ^7.0.0",
+    "nuxt": "^4.4.2"
+  },
+  "peerDependenciesMeta": {
+    "@babel/plugin-proposal-decorators": {
+      "optional": true
+    },
+    "@rollup/plugin-babel": {
+      "optional": true
+    }
   },
   "devDependencies": {
-    "obuild": "0.4.14",
-    "vitest": "3.2.4",
-    "@nuxt/schema": "4.3.0",
-    "nuxt": "4.3.0"
+    "@babel/plugin-proposal-decorators": "7.29.0",
+    "@rollup/plugin-babel": "7.0.0",
+    "obuild": "0.4.32",
+    "vitest": "4.0.18",
+    "nuxt": "4.4.2",
+    "@nuxt/schema": "4.4.2"
   },
   "engines": {
     "node": "^20.19.0 || >=22.12.0"