vinext 0.0.21 → 0.0.23

package/dist/index.js

@@ -1,14 +1,17 @@
 import { loadEnv, parseAst } from "vite";
 import { pagesRouter, apiRouter, invalidateRouteCache, matchRoute, patternToNextFormat as pagesPatternToNextFormat } from "./routing/pages-router.js";
 import { appRouter, invalidateAppRouteCache } from "./routing/app-router.js";
+import { createValidFileMatcher } from "./routing/file-matcher.js";
 import { createSSRHandler } from "./server/dev-server.js";
 import { handleApiRoute } from "./server/api-handler.js";
 import { generateRscEntry, generateSsrEntry, generateBrowserEntry, } from "./server/app-dev-server.js";
 import { loadNextConfig, resolveNextConfig, } from "./config/next-config.js";
 import { findMiddlewareFile, isProxyFile, runMiddleware } from "./server/middleware.js";
+import { logRequest, now } from "./server/request-log.js";
 import { generateSafeRegExpCode, generateMiddlewareMatcherCode, generateNormalizePathCode } from "./server/middleware-codegen.js";
 import { normalizePath } from "./server/normalize-path.js";
 import { findInstrumentationFile, runInstrumentation } from "./server/instrumentation.js";
+import { PHASE_PRODUCTION_BUILD, PHASE_DEVELOPMENT_SERVER } from "./shims/constants.js";
 import { validateDevRequest } from "./server/dev-origin-check.js";
 import { safeRegExp, isExternalUrl, proxyExternalRequest, parseCookies, matchHeaders, matchRedirect, matchRewrite, } from "./config/config-matchers.js";
 import { scanMetadataFiles } from "./server/metadata-routes.js";
@@ -492,6 +495,7 @@ export default function vinext(options = {}) {
     let hasAppDir = false;
     let hasPagesDir = false;
     let nextConfig;
+    let fileMatcher;
     let middlewarePath = null;
     let instrumentationPath = null;
     let hasCloudflarePlugin = false;
@@ -505,8 +509,8 @@ export default function vinext(options = {}) {
      * This is the entry point for `vite build --ssr`.
      */
     async function generateServerEntry() {
-        const pageRoutes = await pagesRouter(pagesDir);
-        const apiRoutes = await apiRouter(pagesDir);
+        const pageRoutes = await pagesRouter(pagesDir, nextConfig?.pageExtensions, fileMatcher);
+        const apiRoutes = await apiRouter(pagesDir, nextConfig?.pageExtensions, fileMatcher);
         // Generate import statements using absolute paths since virtual
         // modules don't have a real file location for relative resolution.
         const pageImports = pageRoutes.map((r, i) => {
@@ -526,16 +530,15 @@ export default function vinext(options = {}) {
             return `  { pattern: ${JSON.stringify(r.pattern)}, isDynamic: ${r.isDynamic}, params: ${JSON.stringify(r.params)}, module: api_${i} }`;
         });
         // Check for _app and _document
-        const hasApp = fs.existsSync(path.join(pagesDir, "_app.tsx")) || fs.existsSync(path.join(pagesDir, "_app.jsx")) || fs.existsSync(path.join(pagesDir, "_app.ts")) || fs.existsSync(path.join(pagesDir, "_app.js"));
-        const hasDoc = fs.existsSync(path.join(pagesDir, "_document.tsx")) || fs.existsSync(path.join(pagesDir, "_document.jsx")) || fs.existsSync(path.join(pagesDir, "_document.ts")) || fs.existsSync(path.join(pagesDir, "_document.js"));
-        // Use absolute paths for _app and _document too
-        const appFileBase = path.join(pagesDir, "_app").replace(/\\/g, "/");
-        const docFileBase = path.join(pagesDir, "_document").replace(/\\/g, "/");
+        const appFilePath = findFileWithExts(pagesDir, "_app", fileMatcher);
+        const docFilePath = findFileWithExts(pagesDir, "_document", fileMatcher);
+        const hasApp = appFilePath !== null;
+        const hasDoc = docFilePath !== null;
         const appImportCode = hasApp
-            ? `import { default as AppComponent } from ${JSON.stringify(appFileBase)};`
+            ? `import { default as AppComponent } from ${JSON.stringify(appFilePath.replace(/\\/g, "/"))};`
             : `const AppComponent = null;`;
         const docImportCode = hasDoc
-            ? `import { default as DocumentComponent } from ${JSON.stringify(docFileBase)};`
+            ? `import { default as DocumentComponent } from ${JSON.stringify(docFilePath.replace(/\\/g, "/"))};`
             : `const DocumentComponent = null;`;
         // Serialize i18n config for embedding in the server entry
         const i18nConfigJson = nextConfig?.i18n
@@ -1026,6 +1029,12 @@ function createReqRes(request, url, query, body) {
       else { res.writeHead(statusOrUrl, { Location: url2 }); }
       res.end();
     },
+    getHeaders: function() {
+      var h = Object.assign({}, resHeaders);
+      if (setCookieHeaders.length > 0) h["set-cookie"] = setCookieHeaders;
+      return h;
+    },
+    get headersSent() { return ended; },
   };
 
   return { req, res, responsePromise };
@@ -1140,8 +1149,9 @@ export async function renderPage(request, url, manifest) {
     }
 
     let pageProps = {};
+    var gsspRes = null;
     if (typeof pageModule.getServerSideProps === "function") {
-      const { req, res } = createReqRes(request, routeUrl, parseQuery(routeUrl), undefined);
+      const { req, res, responsePromise } = createReqRes(request, routeUrl, parseQuery(routeUrl), undefined);
       const ctx = {
         params, req, res,
         query: parseQuery(routeUrl),
@@ -1151,6 +1161,10 @@ export async function renderPage(request, url, manifest) {
         defaultLocale: i18nConfig ? i18nConfig.defaultLocale : undefined,
       };
       const result = await pageModule.getServerSideProps(ctx);
+      // If gSSP called res.end() directly (short-circuit), return that response.
+      if (res.headersSent) {
+        return await responsePromise;
+      }
       if (result && result.props) pageProps = result.props;
       if (result && result.redirect) {
         var gsspStatus = result.redirect.statusCode != null ? result.redirect.statusCode : (result.redirect.permanent ? 308 : 307);
@@ -1159,6 +1173,9 @@ export async function renderPage(request, url, manifest) {
       if (result && result.notFound) {
         return new Response("404", { status: 404 });
       }
+      // Preserve the res object so headers/status/cookies set by gSSP
+      // can be merged into the final HTML response.
+      gsspRes = res;
     }
     // Build font Link header early so it's available for ISR cached responses too.
     // Font preloads are module-level state populated at import time and persist across requests.
@@ -1335,16 +1352,33 @@ export async function renderPage(request, url, manifest) {
       await isrSet(isrCacheKey, { kind: "PAGES", html: fullHtml, pageData: pageProps, headers: undefined, status: undefined }, isrRevalidateSeconds);
     }
 
-    const responseHeaders = { "Content-Type": "text/html" };
+    // Merge headers/status/cookies set by getServerSideProps on the res object.
+    // gSSP commonly uses res.setHeader("Set-Cookie", ...) or res.status(304).
+    var finalStatus = 200;
+    const responseHeaders = new Headers({ "Content-Type": "text/html" });
+    if (gsspRes) {
+      finalStatus = gsspRes.statusCode;
+      var gsspHeaders = gsspRes.getHeaders();
+      for (var hk of Object.keys(gsspHeaders)) {
+        var hv = gsspHeaders[hk];
+        if (hk === "set-cookie" && Array.isArray(hv)) {
+          for (var sc of hv) responseHeaders.append("set-cookie", sc);
+        } else if (hv != null) {
+          responseHeaders.set(hk, String(hv));
+        }
+      }
+      // Ensure Content-Type stays text/html (gSSP shouldn't override it for page renders)
+      responseHeaders.set("Content-Type", "text/html");
+    }
     if (isrRevalidateSeconds) {
-      responseHeaders["Cache-Control"] = "s-maxage=" + isrRevalidateSeconds + ", stale-while-revalidate";
-      responseHeaders["X-Vinext-Cache"] = "MISS";
+      responseHeaders.set("Cache-Control", "s-maxage=" + isrRevalidateSeconds + ", stale-while-revalidate");
+      responseHeaders.set("X-Vinext-Cache", "MISS");
     }
     // Set HTTP Link header for font preloading
     if (_fontLinkHeader) {
-      responseHeaders["Link"] = _fontLinkHeader;
+      responseHeaders.set("Link", _fontLinkHeader);
     }
-    return new Response(compositeStream, { status: 200, headers: responseHeaders });
+    return new Response(compositeStream, { status: finalStatus, headers: responseHeaders });
   } catch (e) {
     console.error("[vinext] SSR error:", e);
     return new Response("Internal Server Error", { status: 500 });
@@ -1428,8 +1462,9 @@ ${middlewareExportCode}
      * __NEXT_DATA__ to determine which page to hydrate.
      */
     async function generateClientEntry() {
-        const pageRoutes = await pagesRouter(pagesDir);
-        const hasApp = fs.existsSync(path.join(pagesDir, "_app.tsx")) || fs.existsSync(path.join(pagesDir, "_app.jsx")) || fs.existsSync(path.join(pagesDir, "_app.ts")) || fs.existsSync(path.join(pagesDir, "_app.js"));
+        const pageRoutes = await pagesRouter(pagesDir, nextConfig?.pageExtensions, fileMatcher);
+        const appFilePath = findFileWithExts(pagesDir, "_app", fileMatcher);
+        const hasApp = appFilePath !== null;
         // Build a map of route pattern -> dynamic import.
         // Keys must use Next.js bracket format (e.g. "/user/[id]") to match
         // __NEXT_DATA__.page which is set via patternToNextFormat() during SSR.
@@ -1441,7 +1476,7 @@ ${middlewareExportCode}
             // lgtm[js/bad-code-sanitization]
             return `  ${JSON.stringify(nextFormatPattern)}: () => import(${JSON.stringify(absPath)})`;
         });
-        const appFileBase = path.join(pagesDir, "_app").replace(/\\/g, "/");
+        const appFileBase = appFilePath?.replace(/\\/g, "/");
         return `
 import React from "react";
 import { hydrateRoot } from "react-dom/client";
@@ -1634,8 +1669,10 @@ hydrate();
                 middlewarePath = findMiddlewareFile(root);
                 instrumentationPath = findInstrumentationFile(root);
                 // Load next.config.js if present (always from project root, not src/)
-                const rawConfig = await loadNextConfig(root);
+                const phase = env?.command === "build" ? PHASE_PRODUCTION_BUILD : PHASE_DEVELOPMENT_SERVER;
+                const rawConfig = await loadNextConfig(root, phase);
                 nextConfig = await resolveNextConfig(rawConfig);
+                fileMatcher = createValidFileMatcher(nextConfig.pageExtensions);
                 // Merge env from next.config.js with NEXT_PUBLIC_* env vars
                 const defines = getNextPublicEnvDefines();
                 if (!config.define ||
@@ -2078,10 +2115,10 @@ hydrate();
                 }
                 // App Router virtual modules
                 if (id === RESOLVED_RSC_ENTRY && hasAppDir) {
-                    const routes = await appRouter(appDir);
+                    const routes = await appRouter(appDir, nextConfig?.pageExtensions, fileMatcher);
                     const metaRoutes = scanMetadataFiles(appDir);
                     // Check for global-error.tsx at app root
-                    const globalErrorPath = findFileWithExts(appDir, "global-error");
+                    const globalErrorPath = findFileWithExts(appDir, "global-error", fileMatcher);
                     return generateRscEntry(appDir, routes, middlewarePath, metaRoutes, globalErrorPath, nextConfig?.basePath, nextConfig?.trailingSlash, {
                         redirects: nextConfig?.redirects,
                         rewrites: nextConfig?.rewrites,
@@ -2184,15 +2221,14 @@ hydrate();
             hotUpdate(options) {
                 if (!hasPagesDir || hasAppDir)
                     return;
-                const ext = /\.(tsx?|jsx?|mdx)$/;
-                if (options.file.startsWith(pagesDir) && ext.test(options.file)) {
+                if (options.file.startsWith(pagesDir) && fileMatcher.extensionRegex.test(options.file)) {
                     options.server.environments.client.hot.send({ type: "full-reload" });
                     return [];
                 }
             },
             configureServer(server) {
                 // Watch pages directory for file additions/removals to invalidate route cache.
-                const pageExtensions = /\.(tsx?|jsx?|mdx)$/;
+                const pageExtensions = fileMatcher.extensionRegex;
                 /**
                  * Invalidate the virtual RSC entry module in Vite's module graph.
                  *
@@ -2236,8 +2272,135 @@ hydrate();
                         console.error("[vinext] Instrumentation error:", err);
                     });
                 }
+                // ── Dev request origin check ─────────────────────────────────────
+                // Registered directly (not in the returned function) so it runs
+                // BEFORE Vite's built-in middleware. This ensures all requests
+                // (including /@*, /__vite*, /node_modules* paths) are validated
+                // before Vite serves any content.
+                server.middlewares.use((req, res, next) => {
+                    const blockReason = validateDevRequest({
+                        origin: req.headers.origin,
+                        host: req.headers.host,
+                        "x-forwarded-host": req.headers["x-forwarded-host"],
+                        "sec-fetch-site": req.headers["sec-fetch-site"],
+                        "sec-fetch-mode": req.headers["sec-fetch-mode"],
+                    }, nextConfig?.serverActionsAllowedOrigins);
+                    if (blockReason) {
+                        console.warn(`[vinext] Blocked dev request: ${blockReason} (${req.url})`);
+                        res.writeHead(403, { "Content-Type": "text/plain" });
+                        res.end("Forbidden");
+                        return;
+                    }
+                    next();
+                });
                 // Return a function to register middleware AFTER Vite's built-in middleware
                 return () => {
+                    // App Router request logging in dev server
+                    //
+                    // For App Router, the RSC plugin handles requests internally.
+                    // We install a timing middleware here that:
+                    //   1. Intercepts writeHead() to pluck the X-Vinext-Timing header
+                    //      (compileMs,renderMs) that the RSC entry attaches before
+                    //      it is flushed to the client.
+                    //   2. Logs the full request after res finishes, using those timings.
+                    if (hasAppDir) {
+                        server.middlewares.use((req, res, next) => {
+                            const url = req.url ?? "/";
+                            // Skip Vite internals, HMR, and static assets.
+                            // Do NOT skip .rsc-suffixed URLs or RSC wire requests (Accept: text/x-component)
+                            // — those are soft navigations and should be logged like any other page request.
+                            const [pathname] = url.split("?");
+                            if (url.startsWith("/@") ||
+                                url.startsWith("/__vite") ||
+                                url.startsWith("/node_modules") ||
+                                (url.includes(".") && !pathname.endsWith(".html") && !pathname.endsWith(".rsc"))) {
+                                return next();
+                            }
+                            const _reqStart = now();
+                            let _compileMs;
+                            let _renderMs;
+                            // Intercept setHeader and writeHead so we can strip X-Vinext-Timing
+                            // before it reaches the client and capture the compile/render split.
+                            // The RSC plugin may set headers either way depending on its version.
+                            // Parse the three-part X-Vinext-Timing header:
+                            //   "handlerStart,inHandlerCompileMs,renderMs"
+                            //
+                            // True compile time = time the RSC plugin spent loading/transforming
+                            // modules before our handler code ran, plus any in-handler work before
+                            // renderToReadableStream. Concretely:
+                            //   compileMs = (handlerStart - _reqStart) + inHandlerCompileMs
+                            //   renderMs  = renderMs from header, or -1 for RSC-only (soft-nav)
+                            //               responses where rendering is not measured in the handler.
+                            //               In that case the middleware computes render time as
+                            //               totalMs - compileMs.
+                            //
+                            // handlerStart is performance.now() recorded at the very top of
+                            // _handleRequest in the generated RSC entry. _reqStart is recorded
+                            // here in the Node middleware, one stack frame before the RSC plugin
+                            // loads the module. The gap between them is exactly the Vite
+                            // compile/transform cost.
+                            function _parseTiming(raw) {
+                                const [handlerStart, inHandlerCompileMs, renderMs] = String(raw).split(",").map((v) => Number(v));
+                                if (!Number.isNaN(handlerStart) && !Number.isNaN(inHandlerCompileMs) && inHandlerCompileMs !== -1) {
+                                    _compileMs = Math.max(0, Math.round(handlerStart - _reqStart)) + inHandlerCompileMs;
+                                }
+                                if (!Number.isNaN(renderMs) && renderMs !== -1) {
+                                    _renderMs = renderMs;
+                                }
+                            }
+                            const _origSetHeader = res.setHeader.bind(res);
+                            res.setHeader = function (name, value) {
+                                if (name.toLowerCase() === "x-vinext-timing") {
+                                    _parseTiming(value);
+                                    return res; // drop the header — don't forward to client
+                                }
+                                return _origSetHeader(name, value);
+                            };
+                            const _origWriteHead = res.writeHead.bind(res);
+                            res.writeHead = function (statusCode, ...args) {
+                                // Normalise the optional headers argument (may be reason, headers object, or both).
+                                let headers;
+                                const [reasonOrHeaders, maybeHeaders] = args;
+                                if (typeof reasonOrHeaders === "string") {
+                                    headers = maybeHeaders;
+                                }
+                                else {
+                                    headers = reasonOrHeaders;
+                                }
+                                // Pull timing out of the headers object when present.
+                                if (headers && typeof headers === "object" && !Array.isArray(headers)) {
+                                    const timingKey = Object.keys(headers).find((k) => k.toLowerCase() === "x-vinext-timing");
+                                    if (timingKey) {
+                                        _parseTiming(headers[timingKey]);
+                                        delete headers[timingKey];
+                                    }
+                                }
+                                return _origWriteHead(statusCode, ...args);
+                            };
+                            res.on("finish", () => {
+                                // Strip .rsc suffix — it's an internal RSC protocol detail,
+                                // not part of the actual page path the user navigated to.
+                                const logUrl = url.replace(/\.rsc(\?|$)/, "$1");
+                                const totalMs = now() - _reqStart;
+                                // For RSC-only responses (soft nav), renderMs is -1 (sentinel meaning
+                                // "not measured in the handler"). Compute it as totalMs - compileMs,
+                                // which is how long the RSC stream took to fully flush to the client —
+                                // matching what Next.js shows for soft navigations.
+                                const resolvedRenderMs = _renderMs !== undefined
+                                    ? _renderMs
+                                    : (_compileMs !== undefined ? Math.max(0, Math.round(totalMs - _compileMs)) : undefined);
+                                logRequest({
+                                    method: req.method ?? "GET",
+                                    url: logUrl,
+                                    status: res.statusCode,
+                                    totalMs,
+                                    compileMs: _compileMs,
+                                    renderMs: resolvedRenderMs,
+                                });
+                            });
+                            next();
+                        });
+                    }
                     server.middlewares.use(async (req, res, next) => {
                         try {
                             let url = req.url ?? "/";
@@ -2255,9 +2418,12 @@ hydrate();
                             if (url.split("?")[0].endsWith(".rsc")) {
                                 return next();
                             }
-                            // ── Cross-origin request protection ─────────────────────────
-                            // Block requests from non-localhost origins to prevent
-                            // cross-origin data exfiltration from the dev server.
+                            // ── Cross-origin request protection (defense-in-depth) ──────
+                            // The pre-Vite middleware above already blocks cross-origin
+                            // requests before Vite serves any content. This second check
+                            // guards the Pages Router handler specifically, in case the
+                            // middleware ordering changes or new middleware is added between
+                            // the two. Both calls use the same validateDevRequest() function.
                             const blockReason = validateDevRequest({
                                 origin: req.headers.origin,
                                 host: req.headers.host,
@@ -2281,7 +2447,14 @@ hydrate();
                                 const imgUrl = rawImgUrl?.replaceAll("\\", "/") ?? null;
                                 // Allowlist: must start with "/" but not "//" — blocks absolute
                                 // URLs, protocol-relative, backslash variants, and exotic schemes.
-                                if (!imgUrl || !imgUrl.startsWith("/") || imgUrl.startsWith("//")) {
+                                // Also block internal Vite paths (/@*, /__vite*, /node_modules*)
+                                // to prevent redirecting to dev server endpoints.
+                                if (!imgUrl ||
+                                    !imgUrl.startsWith("/") ||
+                                    imgUrl.startsWith("//") ||
+                                    imgUrl.startsWith("/@") ||
+                                    imgUrl.startsWith("/__vite") ||
+                                    imgUrl.startsWith("/node_modules")) {
                                     res.writeHead(400);
                                     res.end(!rawImgUrl ? "Missing url parameter" : "Only relative URLs allowed");
                                     return;
@@ -2418,10 +2591,20 @@ hydrate();
                                         return;
                                     }
                                 }
-                                // Apply middleware response headers
+                                // Apply middleware response headers. Unpack
+                                // x-middleware-request-* headers into req.headers so
+                                // config has/missing conditions and downstream handlers
+                                // see middleware-modified cookies and headers.
                                 if (result.responseHeaders) {
+                                    const mwReqPrefix = "x-middleware-request-";
                                     for (const [key, value] of result.responseHeaders) {
-                                        res.appendHeader(key, value);
+                                        if (key.startsWith(mwReqPrefix)) {
+                                            const realName = key.slice(mwReqPrefix.length);
+                                            req.headers[realName] = value;
+                                        }
+                                        else if (!key.startsWith("x-middleware-")) {
+                                            res.appendHeader(key, value);
+                                        }
                                     }
                                 }
                                 // Apply middleware rewrite (URL and optional status code)
@@ -2470,7 +2653,7 @@ hydrate();
                             const resolvedPathname = resolvedUrl.split("?")[0];
                             if (resolvedPathname.startsWith("/api/") ||
                                 resolvedPathname === "/api") {
-                                const apiRoutes = await apiRouter(pagesDir);
+                                const apiRoutes = await apiRouter(pagesDir, nextConfig?.pageExtensions, fileMatcher);
                                 const handled = await handleApiRoute(server, req, res, resolvedUrl, apiRoutes);
                                 if (handled)
                                     return;
@@ -2482,7 +2665,7 @@ hydrate();
                                 res.end("404 - API route not found");
                                 return;
                             }
-                            const routes = await pagesRouter(pagesDir);
+                            const routes = await pagesRouter(pagesDir, nextConfig?.pageExtensions, fileMatcher);
                             // Apply afterFiles rewrites — these run after initial route matching
                             // If beforeFiles already rewrote the URL, afterFiles still run on the
                             // *resolved* pathname. Next.js applies these when route matching succeeds
@@ -2497,7 +2680,7 @@ hydrate();
                                 await proxyExternalRewriteNode(req, res, resolvedUrl);
                                 return;
                             }
-                            const handler = createSSRHandler(server, routes, pagesDir, nextConfig?.i18n);
+                            const handler = createSSRHandler(server, routes, pagesDir, nextConfig?.i18n, fileMatcher);
                             const mwStatus = req.__vinextRewriteStatus;
                             // Try rendering the resolved URL
                             const match = matchRoute(resolvedUrl.split("?")[0], routes);
@@ -2531,6 +2714,41 @@ hydrate();
                 };
             },
         },
+        // Strip server-only data-fetching exports (getServerSideProps, getStaticProps,
+        // getStaticPaths) from page modules in the client bundle. These functions
+        // often import server-only modules (database drivers, fs, etc.) that would
+        // break or bloat the client bundle. Next.js does this via an SWC transform
+        // (next-ssg-transform); we use Vite's parseAst + MagicString.
+        //
+        // Only applies to client builds (not SSR) and only to files under the
+        // pages/ directory.
+        {
+            name: "vinext:strip-server-exports",
+            transform: {
+                // Only match page source files, not node_modules
+                filter: { id: /\.(tsx?|jsx?|mjs)$/ },
+                handler(code, id) {
+                    const ssr = this.environment?.name !== "client";
+                    if (ssr)
+                        return null;
+                    if (!hasPagesDir)
+                        return null;
+                    // Only transform files under the pages/ directory
+                    if (!id.startsWith(pagesDir))
+                        return null;
+                    // Skip API routes, _app, _document, _error
+                    const relativePath = id.slice(pagesDir.length);
+                    if (relativePath.startsWith("/api/") || relativePath === "/api")
+                        return null;
+                    if (/\/_(?:app|document|error)\b/.test(relativePath))
+                        return null;
+                    const result = stripServerExports(code);
+                    if (!result)
+                        return null;
+                    return { code: result, map: null };
+                },
+            },
+        },
         // Local image import transform:
         // When a source file imports a local image (e.g., `import hero from './hero.jpg'`),
         // this plugin transforms the default import to a StaticImageData object with
@@ -3173,6 +3391,7 @@ hydrate();
                             "  Cache-Control: public, max-age=31536000, immutable",
                             "",
                         ].join("\n");
+                        fs.mkdirSync(clientDir, { recursive: true });
                         fs.writeFileSync(headersPath, headersContent);
                     }
                 },
@@ -3231,6 +3450,101 @@ function extractConstraint(str, re) {
  *   :param+    — matches one or more segments
  *   (regex)    — inline regex patterns in the source
  */
+/**
+ * Strip server-only data-fetching exports from a page module's source code.
+ * Returns the transformed code, or null if no changes were made.
+ *
+ * Handles:
+ * - export (async) function getServerSideProps(...) { ... }
+ * - export const getStaticProps = async (...) => { ... }
+ * - export const getServerSideProps = someHelper;
+ */
+/**
+ * Skip past balanced brackets/parens/braces starting at `pos` (which should
+ * point to the opening bracket). Returns the position AFTER the closing bracket.
+ * Handles nested brackets, string literals, and comments.
+ */
+/**
+ * Strip server-only data-fetching exports (getServerSideProps,
+ * getStaticProps, getStaticPaths) from page modules for the client
+ * bundle. Uses Vite's parseAst (Rollup/acorn) for correct handling
+ * of all export patterns including function expressions, arrow
+ * functions with TS return types, and re-exports.
+ *
+ * Modeled after Next.js's SWC `next-ssg-transform`.
+ */
+function stripServerExports(code) {
+    const SERVER_EXPORTS = new Set(["getServerSideProps", "getStaticProps", "getStaticPaths"]);
+    if (![...SERVER_EXPORTS].some(name => code.includes(name)))
+        return null;
+    let ast;
+    try {
+        ast = parseAst(code);
+    }
+    catch {
+        // If parsing fails (shouldn't happen post-JSX/TS transform), bail out
+        return null;
+    }
+    const s = new MagicString(code);
+    let changed = false;
+    for (const node of ast.body) {
+        if (node.type !== "ExportNamedDeclaration")
+            continue;
+        // Case 1: export function name() {} / export async function name() {}
+        // Case 2: export const/let/var name = ...
+        if (node.declaration) {
+            const decl = node.declaration;
+            if (decl.type === "FunctionDeclaration" && SERVER_EXPORTS.has(decl.id?.name)) {
+                s.overwrite(node.start, node.end, `export function ${decl.id.name}() { return { props: {} }; }`);
+                changed = true;
+            }
+            else if (decl.type === "VariableDeclaration") {
+                for (const declarator of decl.declarations) {
+                    if (declarator.id?.type === "Identifier" && SERVER_EXPORTS.has(declarator.id.name)) {
+                        s.overwrite(node.start, node.end, `export const ${declarator.id.name} = undefined;`);
+                        changed = true;
+                    }
+                }
+            }
+            continue;
+        }
+        // Case 3: export { getServerSideProps } or export { getServerSideProps as gSSP }
+        if (node.specifiers && node.specifiers.length > 0 && !node.source) {
+            const kept = [];
+            const stripped = [];
+            for (const spec of node.specifiers) {
+                // spec.local.name is the binding name, spec.exported.name is the export name
+                const exportedName = spec.exported?.name ?? spec.exported?.value;
+                if (SERVER_EXPORTS.has(exportedName)) {
+                    stripped.push(exportedName);
+                }
+                else {
+                    kept.push(spec);
+                }
+            }
+            if (stripped.length > 0) {
+                // Build replacement: keep non-server specifiers, add stubs for stripped ones
+                const parts = [];
+                if (kept.length > 0) {
+                    const keptStr = kept.map((sp) => {
+                        const local = sp.local.name;
+                        const exported = sp.exported?.name ?? sp.exported?.value;
+                        return local === exported ? local : `${local} as ${exported}`;
+                    }).join(", ");
+                    parts.push(`export { ${keptStr} };`);
+                }
+                for (const name of stripped) {
+                    parts.push(`export const ${name} = undefined;`);
+                }
+                s.overwrite(node.start, node.end, parts.join("\n"));
+                changed = true;
+            }
+        }
+    }
+    if (!changed)
+        return null;
+    return s.toString();
+}
 export function matchConfigPattern(pathname, pattern) {
     // If the pattern contains regex groups like (\\d+) or (.*), use regex matching.
     // Also enter this branch when a catch-all parameter (:param* or :param+) is
@@ -3441,16 +3755,44 @@ function applyRewrites(pathname, rewrites, ctx) {
 function applyHeaders(pathname, res, headers, ctx) {
     const matched = matchHeaders(pathname, headers, ctx);
     for (const header of matched) {
-        res.setHeader(header.key, header.value);
+        // Use append semantics for headers where multiple values must coexist
+        // (Vary, Set-Cookie). Using setHeader() on these would destroy
+        // existing values like "Vary: RSC, Accept".
+        const lk = header.key.toLowerCase();
+        if (lk === "set-cookie") {
+            // Node.js res.getHeader("set-cookie") returns string[] when
+            // multiple Set-Cookie headers have been set. Preserve the array.
+            const existing = res.getHeader(lk);
+            if (Array.isArray(existing)) {
+                res.setHeader(header.key, [...existing, header.value]);
+            }
+            else if (existing) {
+                res.setHeader(header.key, [String(existing), header.value]);
+            }
+            else {
+                res.setHeader(header.key, header.value);
+            }
+        }
+        else if (lk === "vary") {
+            const existing = res.getHeader(lk);
+            if (existing) {
+                res.setHeader(header.key, existing + ", " + header.value);
+            }
+            else {
+                res.setHeader(header.key, header.value);
+            }
+        }
+        else {
+            res.setHeader(header.key, header.value);
+        }
     }
 }
 /**
  * Find a file by name (without extension) in a directory.
- * Checks .tsx, .ts, .jsx, .js extensions.
+ * Checks the configured page extensions.
  */
-function findFileWithExts(dir, name) {
-    const extensions = [".tsx", ".ts", ".jsx", ".js"];
-    for (const ext of extensions) {
+function findFileWithExts(dir, name, matcher) {
+    for (const ext of matcher.dottedExtensions) {
         const filePath = path.join(dir, name + ext);
         if (fs.existsSync(filePath))
             return filePath;
@@ -3495,4 +3837,5 @@ export { staticExportPages, staticExportApp } from "./build/static-export.js";
 export { clientManualChunks, clientOutputConfig, clientTreeshakeConfig, computeLazyChunks };
 export { resolvePostcssStringPlugins as _resolvePostcssStringPlugins };
 export { parseStaticObjectLiteral as _parseStaticObjectLiteral };
+export { stripServerExports as _stripServerExports };
 //# sourceMappingURL=index.js.map