@semiont/frontend 0.3.2 → 0.3.4

package/standalone/node_modules/next/dist/server/lib/router-utils/block-cross-site-dev.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "blockCrossSiteDEV", {
+    enumerable: true,
+    get: function() {
+        return blockCrossSiteDEV;
+    }
+});
+const _url = require("../../../lib/url");
+const _log = require("../../../build/output/log");
+const _csrfprotection = require("../../app-render/csrf-protection");
+const allowedDevOriginsDocs = 'https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins';
+function getBlockedResourcePath(req) {
+    var _parseUrl;
+    return ((_parseUrl = (0, _url.parseUrl)(req.url ?? '')) == null ? void 0 : _parseUrl.pathname) ?? req.url ?? '/_next/*';
+}
+function formatBlockedCrossSiteMessage(source, resourcePath) {
+    const lines = [
+        `Blocked cross-origin request to Next.js dev resource ${resourcePath}${getBlockedSourceDescription(source)}.`,
+        'Cross-origin access to Next.js dev resources is blocked by default for safety.'
+    ];
+    // `source` has 3 meanings here:
+    // - `'null'`: browser explicitly sent `Origin: null` for an opaque/sandboxed origin
+    // - hostname string: we parsed an allowlistable host from Origin/Referer
+    // - `undefined` (and effectively empty string): the request did not include a usable host
+    if (source === 'null') {
+        lines.push('', 'This request came from a privacy-sensitive or opaque origin, so Next.js cannot determine which host to allow.', 'If you need it to succeed, load the dev server from a normal origin and add that host to "allowedDevOrigins".');
+    } else if (source) {
+        lines.push('', 'To allow this host in development, add it to "allowedDevOrigins" in next.config.js and restart the dev server:', '', '// next.config.js', 'module.exports = {', `  allowedDevOrigins: ['${source}'],`, '}');
+    } else {
+        lines.push('', 'This request did not include an allowlistable source host.', 'If you need it to succeed, make sure the browser sends an Origin or Referer from a host listed in "allowedDevOrigins".');
+    }
+    lines.push('', `Read more: ${allowedDevOriginsDocs}`);
+    return lines.join('\n');
+}
+function getBlockedSourceDescription(source) {
+    if (source === 'null') {
+        return ' from a privacy-sensitive or opaque origin';
+    }
+    if (source) {
+        return ` from "${source}"`;
+    }
+    return ' from an unknown source';
+}
+function blockRequest(req, res, source) {
+    (0, _log.warnOnce)(formatBlockedCrossSiteMessage(source, getBlockedResourcePath(req)));
+    if ('statusCode' in res) {
+        res.statusCode = 403;
+    }
+    res.end('Unauthorized');
+    return true;
+}
+function parseHostnameFromHeader(header) {
+    const headerValue = Array.isArray(header) ? header[0] : header;
+    if (!headerValue || headerValue === 'null') {
+        return;
+    }
+    const parsedHeader = (0, _url.parseUrl)(headerValue);
+    return parsedHeader == null ? void 0 : parsedHeader.hostname.toLowerCase();
+}
+function isInternalEndpoint(req) {
+    if (!req.url) return false;
+    try {
+        // TODO: We should standardize on a single prefix for this
+        const isMiddlewareRequest = req.url.includes('/__nextjs');
+        const isInternalAsset = req.url.includes('/_next');
+        // Static media requests are excluded, as they might be loaded via CSS and would fail
+        // CORS checks.
+        const isIgnoredRequest = req.url.includes('/_next/image') || req.url.includes('/_next/static/media');
+        return !isIgnoredRequest && (isInternalAsset || isMiddlewareRequest);
+    } catch (err) {
+        return false;
+    }
+}
+const blockCrossSiteDEV = (req, res, allowedDevOrigins, hostname)=>{
+    const allowedOrigins = [
+        '*.localhost',
+        'localhost',
+        ...allowedDevOrigins ?? []
+    ];
+    if (hostname) {
+        allowedOrigins.push(hostname);
+    }
+    // only process internal URLs/middleware
+    if (!isInternalEndpoint(req)) {
+        return false;
+    }
+    // block non-cors request from cross-site e.g. script tag on
+    // different host
+    if (req.headers['sec-fetch-mode'] === 'no-cors' && req.headers['sec-fetch-site'] === 'cross-site') {
+        // no-cors requests do not send an Origin header, so fall back to Referer
+        // when validating configured cross-site script loads.
+        const refererHostname = parseHostnameFromHeader(req.headers['referer']);
+        if (refererHostname && (0, _csrfprotection.isCsrfOriginAllowed)(refererHostname, allowedOrigins)) {
+            return false;
+        }
+        return blockRequest(req, res, refererHostname);
+    }
+    // ensure websocket requests are only fulfilled from allowed origin
+    const rawOrigin = req.headers['origin'];
+    const originHeader = Array.isArray(rawOrigin) ? rawOrigin[0] : rawOrigin;
+    const parsedOrigin = originHeader && originHeader !== 'null' ? (0, _url.parseUrl)(originHeader) : originHeader;
+    const originLowerCase = parsedOrigin === undefined || typeof parsedOrigin === 'string' ? parsedOrigin : parsedOrigin.hostname.toLowerCase();
+    // Allow requests with no origin since those are just GET requests from same-site
+    return originLowerCase !== undefined && !(0, _csrfprotection.isCsrfOriginAllowed)(originLowerCase, allowedOrigins) && blockRequest(req, res, originLowerCase);
+};
+
+//# sourceMappingURL=block-cross-site-dev.js.map

package/standalone/node_modules/next/dist/server/lib/router-utils/filesystem.js

@@ -119,7 +119,10 @@ const buildCustomRoute = (type, item, basePath, caseSensitive)=>{
 };
 async function setupFsCheck(opts) {
     const getItemsLru = !opts.dev ? new _lrucache.LRUCache(1024 * 1024, function length(value) {
-        if (!value) return 0;
+        if (!value) {
+            // Null entries (negative cache) still need a non-zero size for LRU eviction
+            return 1;
+        }
         return (value.fsPath || '').length + value.itemPath.length + value.type.length;
     }) : undefined;
     // routes that have _next/data endpoints (SSG/SSP)
@@ -151,10 +154,11 @@ async function setupFsCheck(opts) {
             afterFiles: [],
             fallback: []
         },
+        onMatchHeaders: [],
         headers: []
     };
     let buildId = 'development';
-    let prerenderManifest;
+    let previewProps;
     if (!opts.dev) {
         var _middlewareManifest_middleware_, _middlewareManifest_middleware;
         const buildIdPath = _path.default.join(opts.dir, opts.config.distDir, _constants.BUILD_ID_FILE);
@@ -204,7 +208,7 @@ async function setupFsCheck(opts) {
         const pagesManifestPath = _path.default.join(distDir, 'server', _constants.PAGES_MANIFEST);
         const appRoutesManifestPath = _path.default.join(distDir, _constants.APP_PATH_ROUTES_MANIFEST);
         const routesManifest = JSON.parse(await _promises.default.readFile(routesManifestPath, 'utf8'));
-        prerenderManifest = JSON.parse(await _promises.default.readFile(prerenderManifestPath, 'utf8'));
+        previewProps = JSON.parse(await _promises.default.readFile(prerenderManifestPath, 'utf8')).preview;
         const middlewareManifest = JSON.parse(await _promises.default.readFile(middlewareManifestPath, 'utf8').catch(()=>'{}'));
         const functionsConfigManifest = JSON.parse(await _promises.default.readFile(functionsConfigManifestPath, 'utf8').catch(()=>'{}'));
         const pagesManifest = JSON.parse(await _promises.default.readFile(pagesManifestPath, 'utf8'));
@@ -274,24 +278,20 @@ async function setupFsCheck(opts) {
                 afterFiles: [],
                 fallback: []
             },
-            headers: routesManifest.headers
+            headers: routesManifest.headers,
+            onMatchHeaders: routesManifest.onMatchHeaders
         };
     } else {
         // dev handling
         customRoutes = await (0, _loadcustomroutes.default)(opts.config);
-        prerenderManifest = {
-            version: 4,
-            routes: {},
-            dynamicRoutes: {},
-            notFoundRoutes: [],
-            preview: {
-                previewModeId: require('crypto').randomBytes(16).toString('hex'),
-                previewModeSigningKey: require('crypto').randomBytes(32).toString('hex'),
-                previewModeEncryptionKey: require('crypto').randomBytes(32).toString('hex')
-            }
+        previewProps = {
+            previewModeId: require('crypto').randomBytes(16).toString('hex'),
+            previewModeSigningKey: require('crypto').randomBytes(32).toString('hex'),
+            previewModeEncryptionKey: require('crypto').randomBytes(32).toString('hex')
         };
     }
     const headers = customRoutes.headers.map((item)=>buildCustomRoute('header', item, opts.config.basePath, opts.config.experimental.caseSensitiveRoutes));
+    const onMatchHeaders = customRoutes.onMatchHeaders.map((item)=>buildCustomRoute('header', item, opts.config.basePath, opts.config.experimental.caseSensitiveRoutes));
     const redirects = customRoutes.redirects.map((item)=>buildCustomRoute('redirect', item, opts.config.basePath, opts.config.experimental.caseSensitiveRoutes));
     const rewrites = {
         beforeFiles: customRoutes.rewrites.beforeFiles.map((item)=>buildCustomRoute('before_files_rewrite', item)),
@@ -326,6 +326,7 @@ async function setupFsCheck(opts) {
     };
     return {
         headers,
+        onMatchHeaders,
         rewrites,
         redirects,
         buildId,
@@ -337,7 +338,7 @@ async function setupFsCheck(opts) {
         nextDataRoutes,
         exportPathMapRoutes: undefined,
         devVirtualFsItems: new Set(),
-        prerenderManifest,
+        previewProps,
         middlewareMatcher: middlewareMatcher,
         ensureCallback (fn) {
             ensureFn = fn;

package/standalone/node_modules/next/dist/server/lib/router-utils/resolve-routes.js

@@ -8,7 +8,6 @@ Object.defineProperty(exports, "getResolveRoutes", {
         return getResolveRoutes;
     }
 });
-const _url = /*#__PURE__*/ _interop_require_default(require("url"));
 const _nodepath = /*#__PURE__*/ _interop_require_default(require("node:path"));
 const _debug = /*#__PURE__*/ _interop_require_default(require("next/dist/compiled/debug"));
 const _bodystreams = require("../../body-streams");
@@ -23,6 +22,7 @@ const _utils2 = require("../../../shared/lib/utils");
 const _relativizeurl = require("../../../shared/lib/router/utils/relativize-url");
 const _addpathprefix = require("../../../shared/lib/router/utils/add-path-prefix");
 const _pathhasprefix = require("../../../shared/lib/router/utils/path-has-prefix");
+const _parseurl = require("../../../shared/lib/router/utils/parse-url");
 const _detectdomainlocale = require("../../../shared/lib/i18n/detect-domain-locale");
 const _normalizelocalepath = require("../../../shared/lib/i18n/normalize-locale-path");
 const _removepathprefix = require("../../../shared/lib/router/utils/remove-path-prefix");
@@ -38,6 +38,12 @@ function _interop_require_default(obj) {
 }
 const debug = (0, _debug.default)('next:router-server:resolve-routes');
 function getResolveRoutes(fsChecker, config, opts, renderServer, renderServerOpts, ensureMiddleware) {
+    let clientHashes = undefined;
+    if (process.env.__NEXT_TEST_MODE && process.env.IS_TURBOPACK_TEST) {
+        try {
+            clientHashes = JSON.parse(require('fs').readFileSync(_nodepath.default.join(opts.dir, config.distDir, 'immutable-static-hashes.json'), 'utf8'));
+        } catch  {}
+    }
     let routes = null;
     const calculateRoutes = ()=>{
         return [
@@ -81,7 +87,7 @@ function getResolveRoutes(fsChecker, config, opts, renderServer, renderServerOpt
         let finished = false;
         let resHeaders = {};
         let matchedOutput = null;
-        let parsedUrl = _url.default.parse(req.url || '', true);
+        let parsedUrl = (0, _parseurl.parseUrl)(req.url || '');
         let didRewrite = false;
         const urlParts = (req.url || '').split('?', 1);
         const urlNoQuery = urlParts[0];
@@ -96,7 +102,7 @@ function getResolveRoutes(fsChecker, config, opts, renderServer, renderServerOpt
         // handle trailing slash as that is handled the same as a next.config.js
         // redirect
         if (urlNoQuery == null ? void 0 : urlNoQuery.match(/(\\|\/\/)/)) {
-            parsedUrl = _url.default.parse((0, _utils2.normalizeRepeatedSlashes)(req.url), true);
+            parsedUrl = (0, _parseurl.parseUrl)((0, _utils2.normalizeRepeatedSlashes)(req.url));
             return {
                 parsedUrl,
                 resHeaders,
@@ -288,6 +294,19 @@ function getResolveRoutes(fsChecker, config, opts, renderServer, renderServerOpt
                             if (output.locale) {
                                 (0, _requestmeta.addRequestMeta)(req, 'locale', output.locale);
                             }
+                            if (process.env.__NEXT_TEST_MODE && process.env.IS_TURBOPACK_TEST && output.type === 'nextStaticFolder' && config.deploymentId) {
+                                let useImmutableToken = config.experimental.immutableAssetToken && clientHashes[`static${decodeURI(output.itemPath)}`];
+                                const expectedToken = useImmutableToken ? config.experimental.immutableAssetToken : config.deploymentId;
+                                if (parsedUrl.query.dpl !== expectedToken) {
+                                    console.error(`Invalid dpl query param: ${req.url}, expected: ${expectedToken}`);
+                                    return {
+                                        finished: true,
+                                        parsedUrl,
+                                        resHeaders,
+                                        matchedOutput: null
+                                    };
+                                }
+                            }
                             return {
                                 parsedUrl,
                                 resHeaders,
@@ -431,7 +450,7 @@ function getResolveRoutes(fsChecker, config, opts, renderServer, renderServerOpt
                             const value = middlewareHeaders['x-middleware-rewrite'];
                             const destination = (0, _relativizeurl.getRelativeURL)(value, initUrl);
                             resHeaders['x-middleware-rewrite'] = destination;
-                            parsedUrl = _url.default.parse(destination, true);
+                            parsedUrl = (0, _parseurl.parseUrl)(destination);
                             if (parsedUrl.protocol) {
                                 return {
                                     parsedUrl,
@@ -455,7 +474,7 @@ function getResolveRoutes(fsChecker, config, opts, renderServer, renderServerOpt
                                 // Process as redirect: update parsedUrl and convert to relative URL
                                 const rel = (0, _relativizeurl.getRelativeURL)(value, initUrl);
                                 resHeaders['location'] = rel;
-                                parsedUrl = _url.default.parse(rel, true);
+                                parsedUrl = (0, _parseurl.parseUrl)(rel);
                                 return {
                                     parsedUrl,
                                     resHeaders,
@@ -497,11 +516,9 @@ function getResolveRoutes(fsChecker, config, opts, renderServer, renderServerOpt
                     delete parsedDestination.query;
                     parsedDestination.search = (0, _serverrouteutils.stringifyQuery)(req, query);
                     parsedDestination.pathname = (0, _utils2.normalizeRepeatedSlashes)(parsedDestination.pathname);
-                    // @ts-expect-error // custom ParsedUrl
-                    const unsafeParsedUrl = parsedDestination;
                     return {
                         finished: true,
-                        parsedUrl: unsafeParsedUrl,
+                        parsedUrl: parsedDestination,
                         resHeaders: null,
                         statusCode: (0, _redirectstatus.getRedirectStatus)(route)
                     };
@@ -557,10 +574,8 @@ function getResolveRoutes(fsChecker, config, opts, renderServer, renderServerOpt
                         }
                     }
                     if (parsedDestination.protocol) {
-                        // @ts-expect-error // custom ParsedUrl
-                        const unsafeParsedUrl = parsedDestination;
                         return {
-                            parsedUrl: unsafeParsedUrl,
+                            parsedUrl: parsedDestination,
                             resHeaders: null,
                             finished: true
                         };
@@ -592,6 +607,12 @@ function getResolveRoutes(fsChecker, config, opts, renderServer, renderServerOpt
         for (const route of routes){
             const result = await handleRoute(route);
             if (result) {
+                if (result.matchedOutput) {
+                    // handle onMatchHeaders
+                    for (const onMatchHeaders of fsChecker.onMatchHeaders){
+                        await handleRoute(onMatchHeaders);
+                    }
+                }
                 return result;
             }
         }

package/standalone/node_modules/next/dist/server/lib/router-utils/route-types-utils.js

@@ -266,21 +266,21 @@ async function writeRouteTypesManifest(manifest, filePath, config) {
         });
     }
     // Write the main routes.d.ts file
-    await _fs.default.promises.writeFile(filePath, (0, _typegen.generateRouteTypesFile)(manifest));
+    await _fs.default.promises.writeFile(filePath, config.experimental.strictRouteTypes ? (0, _typegen.generateRouteTypesFileStrict)(manifest) : (0, _typegen.generateRouteTypesFile)(manifest));
     // Write the link.d.ts file if typedRoutes is enabled
     if (config.typedRoutes === true) {
         const linkTypesPath = _path.default.join(dirname, 'link.d.ts');
         await _fs.default.promises.writeFile(linkTypesPath, (0, _typegen.generateLinkTypesFile)(manifest));
     }
 }
-async function writeValidatorFile(manifest, filePath) {
+async function writeValidatorFile(manifest, filePath, strict) {
     const dirname = _path.default.dirname(filePath);
     if (!_fs.default.existsSync(dirname)) {
         await _fs.default.promises.mkdir(dirname, {
             recursive: true
         });
     }
-    await _fs.default.promises.writeFile(filePath, (0, _typegen.generateValidatorFile)(manifest));
+    await _fs.default.promises.writeFile(filePath, strict ? (0, _typegen.generateValidatorFileStrict)(manifest) : (0, _typegen.generateValidatorFile)(manifest));
 }
 
 //# sourceMappingURL=route-types-utils.js.map

package/standalone/node_modules/next/dist/server/lib/router-utils/setup-dev-bundler.js

@@ -23,7 +23,6 @@ _export(exports, {
 const _swc = require("../../../build/swc");
 const _installbindings = require("../../../build/swc/install-bindings");
 const _fs = /*#__PURE__*/ _interop_require_default(require("fs"));
-const _url = /*#__PURE__*/ _interop_require_default(require("url"));
 const _path = /*#__PURE__*/ _interop_require_default(require("path"));
 const _querystring = /*#__PURE__*/ _interop_require_default(require("querystring"));
 const _watchpack = /*#__PURE__*/ _interop_require_default(require("next/dist/compiled/watchpack"));
@@ -38,7 +37,6 @@ const _sortbypageexts = require("../../../build/sort-by-page-exts");
 const _verifytypescriptsetup = require("../../../lib/verify-typescript-setup");
 const _verifypartytownsetup = require("../../../lib/verify-partytown-setup");
 const _routeregex = require("../../../shared/lib/router/utils/route-regex");
-const _apppaths = require("../../../shared/lib/router/utils/app-paths");
 const _builddataroute = require("./build-data-route");
 const _routematcher = require("../../../shared/lib/router/utils/route-matcher");
 const _normalizepathsep = require("../../../shared/lib/page-path/normalize-path-sep");
@@ -61,9 +59,11 @@ const _defineenv = require("../../../build/define-env");
 const _internalerror = require("../../../shared/lib/turbopack/internal-error");
 const _normalizepath = require("../../../lib/normalize-path");
 const _constants1 = require("../../../lib/constants");
+const _url = require("../../../lib/url");
 const _routetypesutils = require("./route-types-utils");
 const _cachelifetypeutils = require("./cache-life-type-utils");
-const _segment = require("../../../shared/lib/segment");
+const _fileclassifier = require("../../../build/file-classifier");
+const _apppaths = require("../../../shared/lib/router/utils/app-paths");
 const _ensureleadingslash = require("../../../shared/lib/page-path/ensure-leading-slash");
 const _lockfile = require("../../../build/lockfile");
 const _magicidentifier = require("../../../shared/lib/magic-identifier");
@@ -114,15 +114,16 @@ function _interop_require_wildcard(obj, nodeInterop) {
     return newObj;
 }
 async function verifyTypeScript(opts) {
-    const verifyResult = await (0, _verifytypescriptsetup.verifyTypeScriptSetup)({
+    const verifyResult = await (0, _verifytypescriptsetup.verifyAndRunTypeScript)({
         dir: opts.dir,
         distDir: opts.nextConfig.distDir,
-        typeCheckPreflight: false,
+        strictRouteTypes: Boolean(opts.nextConfig.experimental.strictRouteTypes),
+        shouldRunTypeCheck: false,
         tsconfigPath: opts.nextConfig.typescript.tsconfigPath,
+        typedRoutes: Boolean(opts.nextConfig.typedRoutes),
         disableStaticImages: opts.nextConfig.images.disableStaticImages,
         hasAppDir: !!opts.appDir,
         hasPagesDir: !!opts.pagesDir,
-        isolatedDevBuild: opts.nextConfig.experimental.isolatedDevBuild,
         appDir: opts.appDir,
         pagesDir: opts.pagesDir
     });
@@ -146,7 +147,17 @@ async function startWatcher(opts) {
         _fs.default.mkdirSync(distDir, {
             recursive: true
         });
-        lockfile = await _lockfile.Lockfile.acquireWithRetriesOrExit(_path.default.join(distDir, 'lock'), 'next dev');
+        // Create server info to store in the lockfile itself
+        // This allows other processes to discover the running server
+        const appUrl = `http://localhost:${opts.port}`;
+        const serverInfo = {
+            pid: process.pid,
+            port: opts.port,
+            hostname: 'localhost',
+            appUrl,
+            startedAt: Date.now()
+        };
+        lockfile = await _lockfile.Lockfile.acquireWithRetriesOrExit(_path.default.join(distDir, 'lock'), 'next dev', true, JSON.stringify(serverInfo), opts.dir, opts.nextConfig.distDir);
     }
     const validFileMatcher = (0, _findpagefile.createValidFileMatcher)(nextConfig.pageExtensions, appDir);
     const serverFields = {};
@@ -156,7 +167,7 @@ async function startWatcher(opts) {
     });
     const hotReloader = opts.turbo ? await (async ()=>{
         const createHotReloaderTurbopack = require('../../dev/hot-reloader-turbopack').createHotReloaderTurbopack;
-        return await createHotReloaderTurbopack(opts, serverFields, distDir, resetFetch, lockfile);
+        return await createHotReloaderTurbopack(opts, serverFields, distDir, resetFetch, lockfile, opts.serverFastRefresh);
     })() : await (async ()=>{
         const HotReloader = process.env.NEXT_RSPACK ? require('../../dev/hot-reloader-rspack').default : require('../../dev/hot-reloader-webpack').default;
         return new HotReloader(opts.dir, {
@@ -172,15 +183,13 @@ async function startWatcher(opts) {
             }),
             telemetry: opts.telemetry,
             rewrites: opts.fsChecker.rewrites,
-            previewProps: opts.fsChecker.prerenderManifest.preview,
+            previewProps: opts.fsChecker.previewProps,
             resetFetch,
             lockfile,
             onDevServerCleanup: opts.onDevServerCleanup
         });
     })();
     await hotReloader.start();
-    // have to write this after starting hot-reloader since that
-    // cleans the dist dir
     const distTypesDir = _path.default.join(distDir, 'types');
     await (0, _routetypesutils.writeRouteTypesManifest)({
         appRoutes: {},
@@ -204,12 +213,19 @@ async function startWatcher(opts) {
         rewrites: opts.fsChecker.rewrites,
         redirects: opts.fsChecker.redirects,
         headers: opts.fsChecker.headers,
+        onMatchHeaders: opts.fsChecker.onMatchHeaders,
         i18n: nextConfig.i18n || undefined,
         skipProxyUrlNormalize: nextConfig.skipProxyUrlNormalize
     };
     await _fs.default.promises.writeFile(routesManifestPath, JSON.stringify(routesManifest));
     const prerenderManifestPath = _path.default.join(distDir, _constants.PRERENDER_MANIFEST);
-    await _fs.default.promises.writeFile(prerenderManifestPath, JSON.stringify(opts.fsChecker.prerenderManifest, null, 2));
+    await _fs.default.promises.writeFile(prerenderManifestPath, JSON.stringify({
+        version: 4,
+        routes: {},
+        dynamicRoutes: {},
+        notFoundRoutes: [],
+        preview: opts.fsChecker.previewProps
+    }, null, 2));
     if (opts.nextConfig.experimental.nextScriptWorkers) {
         await (0, _verifypartytownsetup.verifyPartytownSetup)(opts.dir, _path.default.join(distDir, _constants.CLIENT_STATIC_FILES_PATH));
     }
@@ -433,88 +449,69 @@ async function startWatcher(opts) {
                     continue;
                 }
                 if (isAppPath) {
-                    const isRootNotFound = validFileMatcher.isRootNotFound(fileName);
-                    hasRootAppNotFound = true;
-                    if (isRootNotFound) {
+                    // Track root not-found
+                    if (validFileMatcher.isRootNotFound(fileName)) {
+                        hasRootAppNotFound = true;
                         continue;
                     }
-                    // Ignore files/directories starting with `_` in the app directory
-                    if ((0, _normalizepathsep.normalizePathSep)(pageName).includes('/_')) {
-                        continue;
-                    }
-                    // Record parallel route slots for layout typing
-                    // May run multiple times (e.g. if a parallel route
-                    // has both a layout and a page, and children) but that's fine
-                    const segments = (0, _normalizepathsep.normalizePathSep)(pageName).split('/');
-                    for(let i = segments.length - 1; i >= 0; i--){
-                        const segment = segments[i];
-                        if ((0, _segment.isParallelRouteSegment)(segment)) {
-                            const parentPath = (0, _apppaths.normalizeAppPath)(segments.slice(0, i).join('/'));
-                            const slotName = segment.slice(1);
-                            // check if the slot already exists
-                            if (slots.some((s)=>s.name === slotName && s.parent === parentPath)) continue;
-                            slots.push({
-                                name: slotName,
-                                parent: parentPath
-                            });
-                            break;
-                        }
-                    }
-                    // Record layouts
+                    const normalizedPageName = (0, _normalizepathsep.normalizePathSep)(pageName);
+                    // Skip files/directories starting with `_` in the app directory
+                    if (normalizedPageName.includes('/_')) continue;
+                    // Record parallel route slots
+                    (0, _fileclassifier.addSlotIfNew)(slots, normalizedPageName);
+                    // Handle layouts separately - they don't get added to appPaths
                     if (validFileMatcher.isAppLayoutPage(fileName)) {
+                        const layoutRoute = (0, _ensureleadingslash.ensureLeadingSlash)((0, _apppaths.normalizeAppPath)(normalizedPageName).replace(/\/layout$/, ''));
                         layoutRoutes.push({
-                            route: (0, _ensureleadingslash.ensureLeadingSlash)((0, _apppaths.normalizeAppPath)((0, _normalizepathsep.normalizePathSep)(pageName)).replace(/\/layout$/, '')),
+                            route: layoutRoute,
                             filePath: fileName
                         });
-                    }
-                    if (!validFileMatcher.isAppRouterPage(fileName)) {
                         continue;
                     }
+                    // Skip non-router pages (loading.tsx, error.tsx, etc.)
+                    if (!validFileMatcher.isAppRouterPage(fileName)) continue;
                     const originalPageName = pageName;
                     pageName = (0, _apppaths.normalizeAppPath)(pageName).replace(/%5F/g, '_');
+                    const appRoute = (0, _normalizepathsep.normalizePathSep)(pageName);
                     if (!appPaths[pageName]) {
                         appPaths[pageName] = [];
                     }
                     appPaths[pageName].push(opts.turbo ? originalPageName.replace(/%5F/g, '_') : originalPageName);
                     if (useFileSystemPublicRoutes) {
-                        // Static metadata files will be served from filesystem.
                         if (appDir && (0, _ismetadataroute.isStaticMetadataFile)(fileName.replace(appDir, ''))) {
-                            staticMetadataFiles.set(pageName, fileName);
+                            const segment = _path.default.posix.dirname(pageName);
+                            const lastSegment = _path.default.posix.basename(pageName);
+                            const normalizedPath = (0, _getmetadataroute.fillMetadataSegment)(segment, {}, lastSegment, true);
+                            staticMetadataFiles.set(normalizedPath, fileName);
                         } else {
                             appFiles.add(pageName);
                         }
                     }
+                    const routeEntry = {
+                        route: appRoute,
+                        filePath: fileName
+                    };
                     if (validFileMatcher.isAppRouterRoute(fileName)) {
-                        appRouteHandlers.push({
-                            route: (0, _normalizepathsep.normalizePathSep)(pageName),
-                            filePath: fileName
-                        });
+                        appRouteHandlers.push(routeEntry);
                     } else {
-                        appRoutes.push({
-                            route: (0, _normalizepathsep.normalizePathSep)(pageName),
-                            filePath: fileName
-                        });
-                    }
-                    if (routedPages.includes(pageName)) {
-                        continue;
+                        appRoutes.push(routeEntry);
                     }
+                    if (routedPages.includes(pageName)) continue;
                 } else {
+                    // Pages router
                     if (useFileSystemPublicRoutes) {
                         pageFiles.add(pageName);
-                        // always add to nextDataRoutes for now but in future only add
-                        // entries that actually use getStaticProps/getServerSideProps
                         opts.fsChecker.nextDataRoutes.add(pageName);
                     }
+                    const route = (0, _normalizepathsep.normalizePathSep)(pageName);
+                    const routeEntry = {
+                        route,
+                        filePath: fileName
+                    };
                     if (pageName.startsWith('/api/')) {
-                        pageApiRoutes.push({
-                            route: (0, _normalizepathsep.normalizePathSep)(pageName),
-                            filePath: fileName
-                        });
+                        pageApiRoutes.push(routeEntry);
                     } else {
-                        pageRoutes.push({
-                            route: (0, _normalizepathsep.normalizePathSep)(pageName),
-                            filePath: fileName
-                        });
+                        pageRoutes.push(routeEntry);
                     }
                 }
                 // Record pages
@@ -548,7 +545,7 @@ async function startWatcher(opts) {
                         errorMessage += `  "${pagesPath}" - "${appPath}"\n`;
                     }
                     hotReloader.setHmrServerError(Object.defineProperty(new Error(errorMessage), "__NEXT_ERROR_CODE", {
-                        value: "E394",
+                        value: "E1010",
                         enumerable: false,
                         configurable: true
                     }));
@@ -695,7 +692,7 @@ async function startWatcher(opts) {
             // Make sure to sort parallel routes to make the result deterministic.
             serverFields.appPathRoutes = Object.fromEntries(Object.entries(appPaths).map(([k, v])=>[
                     k,
-                    v.sort()
+                    v.sort(_apppaths.compareAppPaths)
                 ]));
             await propagateServerField(opts, 'appPathRoutes', serverFields.appPathRoutes);
             // TODO: pass this to fsChecker/next-dev-server?
@@ -842,7 +839,7 @@ async function startWatcher(opts) {
                         pageApiRoutes
                     });
                     await (0, _routetypesutils.writeRouteTypesManifest)(routeTypesManifest, routeTypesFilePath, opts.nextConfig);
-                    await (0, _routetypesutils.writeValidatorFile)(routeTypesManifest, validatorFilePath);
+                    await (0, _routetypesutils.writeValidatorFile)(routeTypesManifest, validatorFilePath, Boolean(nextConfig.experimental.strictRouteTypes));
                     // Generate cache-life types if cacheLife config exists
                     const cacheLifeFilePath = _path.default.join(distTypesDir, 'cache-life.d.ts');
                     (0, _cachelifetypeutils.writeCacheLifeTypes)(opts.nextConfig.cacheLife, cacheLifeFilePath);
@@ -874,9 +871,9 @@ async function startWatcher(opts) {
     const devTurbopackMiddlewareManifestPath = `/_next/${_constants.CLIENT_STATIC_FILES_PATH}/development/${_constants.TURBOPACK_CLIENT_MIDDLEWARE_MANIFEST}`;
     opts.fsChecker.devVirtualFsItems.add(devTurbopackMiddlewareManifestPath);
     async function requestHandler(req, res) {
-        var _parsedUrl_pathname, _parsedUrl_pathname1, _parsedUrl_pathname2;
-        const parsedUrl = _url.default.parse(req.url || '/');
-        if ((_parsedUrl_pathname = parsedUrl.pathname) == null ? void 0 : _parsedUrl_pathname.includes(clientPagesManifestPath)) {
+        const parsedUrl = (0, _url.parseUrl)(req.url || '/');
+        const pathname = parsedUrl !== undefined ? parsedUrl.pathname : null;
+        if (pathname !== null && pathname.includes(clientPagesManifestPath)) {
             res.statusCode = 200;
             res.setHeader('Content-Type', _constants1.JSON_CONTENT_TYPE_HEADER);
             res.end(JSON.stringify({
@@ -886,7 +883,7 @@ async function startWatcher(opts) {
                 finished: true
             };
         }
-        if (((_parsedUrl_pathname1 = parsedUrl.pathname) == null ? void 0 : _parsedUrl_pathname1.includes(devMiddlewareManifestPath)) || ((_parsedUrl_pathname2 = parsedUrl.pathname) == null ? void 0 : _parsedUrl_pathname2.includes(devTurbopackMiddlewareManifestPath))) {
+        if (pathname !== null && (pathname.includes(devMiddlewareManifestPath) || pathname.includes(devTurbopackMiddlewareManifestPath))) {
             var _serverFields_middleware;
             res.statusCode = 200;
             res.setHeader('Content-Type', _constants1.JSON_CONTENT_TYPE_HEADER);
@@ -939,6 +936,9 @@ async function setupDevBundler(opts) {
     var _opts_nextConfig_experimental;
     const isSrcDir = _path.default.relative(opts.dir, opts.pagesDir || opts.appDir || '').startsWith('src');
     await (0, _installbindings.installBindings)((_opts_nextConfig_experimental = opts.nextConfig.experimental) == null ? void 0 : _opts_nextConfig_experimental.useWasmBinary);
+    // Set up code frame renderer for error formatting
+    const { installCodeFrameSupport } = require('../install-code-frame');
+    installCodeFrameSupport();
     const result = await startWatcher({
         ...opts,
         isSrcDir