vinext 0.0.39 → 0.0.41

package/dist/shims/server.js

@@ -77,6 +77,14 @@ var NextRequest = class extends Request {
 		return this._nextUrl.buildId;
 	}
 };
+/** Valid HTTP redirect status codes, matching Next.js's REDIRECTS set. */
+const REDIRECT_STATUSES = new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
 var NextResponse = class NextResponse extends Response {
 	_cookies;
 	constructor(body, init) {
@@ -102,6 +110,7 @@ var NextResponse = class NextResponse extends Response {
 	*/
 	static redirect(url, init) {
 		const status = typeof init === "number" ? init : init?.status ?? 307;
+		if (!REDIRECT_STATUSES.has(status)) throw new RangeError(`Failed to execute "redirect" on "response": Invalid status code`);
 		const destination = typeof url === "string" ? url : url.toString();
 		const headers = new Headers(typeof init === "object" ? init?.headers : void 0);
 		headers.set("Location", destination);
@@ -338,16 +347,21 @@ var RequestCookies = class {
 			cookieName = nameOrOptions.name;
 			cookieValue = nameOrOptions.value;
 		}
+		validateCookieName(cookieName);
 		this._parsed.set(cookieName, cookieValue);
 		this._syncHeader();
 		return this;
 	}
 	delete(names) {
 		if (Array.isArray(names)) {
-			const results = names.map((name) => this._parsed.delete(name));
+			const results = names.map((name) => {
+				validateCookieName(name);
+				return this._parsed.delete(name);
+			});
 			this._syncHeader();
 			return results;
 		}
+		validateCookieName(names);
 		const result = this._parsed.delete(names);
 		this._syncHeader();
 		return result;
@@ -390,54 +404,11 @@ function validateCookieAttributeValue(value, attributeName) {
 }
 var ResponseCookies = class {
 	_headers;
+	/** Internal map keyed by cookie name — single source of truth. */
+	_parsed = /* @__PURE__ */ new Map();
 	constructor(headers) {
 		this._headers = headers;
-	}
-	set(name, value, options) {
-		validateCookieName(name);
-		const parts = [`${name}=${encodeURIComponent(value)}`];
-		if (options?.path) {
-			validateCookieAttributeValue(options.path, "Path");
-			parts.push(`Path=${options.path}`);
-		}
-		if (options?.domain) {
-			validateCookieAttributeValue(options.domain, "Domain");
-			parts.push(`Domain=${options.domain}`);
-		}
-		if (options?.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
-		if (options?.expires) parts.push(`Expires=${options.expires.toUTCString()}`);
-		if (options?.httpOnly) parts.push("HttpOnly");
-		if (options?.secure) parts.push("Secure");
-		if (options?.sameSite) parts.push(`SameSite=${options.sameSite}`);
-		this._headers.append("Set-Cookie", parts.join("; "));
-		return this;
-	}
-	get(name) {
-		for (const header of this._headers.getSetCookie()) {
-			const eq = header.indexOf("=");
-			if (eq === -1) continue;
-			if (header.slice(0, eq) === name) {
-				const semi = header.indexOf(";", eq);
-				const raw = header.slice(eq + 1, semi === -1 ? void 0 : semi);
-				let value;
-				try {
-					value = decodeURIComponent(raw);
-				} catch {
-					value = raw;
-				}
-				return {
-					name,
-					value
-				};
-			}
-		}
-	}
-	has(name) {
-		return this.get(name) !== void 0;
-	}
-	getAll() {
-		const entries = [];
-		for (const header of this._headers.getSetCookie()) {
+		for (const header of headers.getSetCookie()) {
 			const eq = header.indexOf("=");
 			if (eq === -1) continue;
 			const cookieName = header.slice(0, eq);
@@ -449,43 +420,95 @@ var ResponseCookies = class {
 			} catch {
 				value = raw;
 			}
-			entries.push({
-				name: cookieName,
-				value
+			this._parsed.set(cookieName, {
+				serialized: header,
+				entry: {
+					name: cookieName,
+					value
+				}
 			});
 		}
-		return entries;
 	}
-	delete(name) {
-		this.set(name, "", {
-			maxAge: 0,
-			path: "/"
+	set(...args) {
+		const [name, value, opts] = parseCookieSetArgs(args);
+		validateCookieName(name);
+		const parts = [`${name}=${encodeURIComponent(value)}`];
+		const path = opts?.path ?? "/";
+		validateCookieAttributeValue(path, "Path");
+		parts.push(`Path=${path}`);
+		if (opts?.domain) {
+			validateCookieAttributeValue(opts.domain, "Domain");
+			parts.push(`Domain=${opts.domain}`);
+		}
+		if (opts?.maxAge !== void 0) parts.push(`Max-Age=${opts.maxAge}`);
+		if (opts?.expires) parts.push(`Expires=${opts.expires.toUTCString()}`);
+		if (opts?.httpOnly) parts.push("HttpOnly");
+		if (opts?.secure) parts.push("Secure");
+		if (opts?.sameSite) parts.push(`SameSite=${opts.sameSite}`);
+		this._parsed.set(name, {
+			serialized: parts.join("; "),
+			entry: {
+				name,
+				value
+			}
 		});
+		this._syncHeaders();
 		return this;
 	}
+	get(...args) {
+		const key = typeof args[0] === "string" ? args[0] : args[0].name;
+		return this._parsed.get(key)?.entry;
+	}
+	has(name) {
+		return this._parsed.has(name);
+	}
+	getAll(...args) {
+		const all = [...this._parsed.values()].map((v) => v.entry);
+		if (args.length === 0) return all;
+		const key = typeof args[0] === "string" ? args[0] : args[0].name;
+		return all.filter((c) => c.name === key);
+	}
+	delete(...args) {
+		const [name, opts] = typeof args[0] === "string" ? [args[0], void 0] : [args[0].name, args[0]];
+		return this.set({
+			name,
+			value: "",
+			expires: /* @__PURE__ */ new Date(0),
+			path: opts?.path,
+			domain: opts?.domain,
+			httpOnly: opts?.httpOnly,
+			secure: opts?.secure,
+			sameSite: opts?.sameSite
+		});
+	}
 	[Symbol.iterator]() {
-		const entries = [];
-		for (const header of this._headers.getSetCookie()) {
-			const eq = header.indexOf("=");
-			if (eq === -1) continue;
-			const cookieName = header.slice(0, eq);
-			const semi = header.indexOf(";", eq);
-			const raw = header.slice(eq + 1, semi === -1 ? void 0 : semi);
-			let value;
-			try {
-				value = decodeURIComponent(raw);
-			} catch {
-				value = raw;
-			}
-			entries.push([cookieName, {
-				name: cookieName,
-				value
-			}]);
-		}
-		return entries[Symbol.iterator]();
+		return [...this._parsed.values()].map((v) => [v.entry.name, v.entry])[Symbol.iterator]();
+	}
+	/** Delete all Set-Cookie headers and re-append from the internal map. */
+	_syncHeaders() {
+		this._headers.delete("Set-Cookie");
+		for (const { serialized } of this._parsed.values()) this._headers.append("Set-Cookie", serialized);
 	}
 };
 /**
+* Parse the overloaded arguments for ResponseCookies.set():
+*   - (name, value, options?) — positional form
+*   - ({ name, value, ...options }) — object form
+*/
+function parseCookieSetArgs(args) {
+	if (typeof args[0] === "string") return [
+		args[0],
+		args[1],
+		args[2]
+	];
+	const { name, value, ...opts } = args[0];
+	return [
+		name,
+		value,
+		opts
+	];
+}
+/**
 * Minimal NextFetchEvent — extends FetchEvent where available,
 * otherwise provides the waitUntil pattern standalone.
 */

package/dist/shims/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","names":[],"sources":["../../src/shims/server.ts"],"sourcesContent":["/**\n * next/server shim\n *\n * Provides NextRequest, NextResponse, and related types that work with\n * standard Web APIs (Request/Response). This means they work on Node,\n * Cloudflare Workers, Deno, and any WinterCG-compatible runtime.\n *\n * This is a pragmatic subset — we implement the most commonly used APIs\n * rather than bug-for-bug parity with Next.js internals.\n */\n\nimport { encodeMiddlewareRequestHeaders } from \"../server/middleware-request-headers.js\";\nimport { parseCookieHeader } from \"./internal/parse-cookie-header.js\";\nimport { getRequestExecutionContext } from \"./request-context.js\";\n\n// ---------------------------------------------------------------------------\n// Inlined cache-scope guard for after()\n//\n// We cannot statically import throwIfInsideCacheScope from headers.ts here\n// because headers.ts contains the \"use cache\" directive string in its error\n// message, which causes Vite's use-cache transform to include it in the module\n// graph. If headers.ts is pulled in via static import from server.ts, the\n// transform fires on it in Pages Router fixtures that lack @vitejs/plugin-rsc.\n//\n// The connection() function in this file avoids the same problem by using\n// `await import(\"./headers.js\")` (dynamic import, async function). after()\n// must remain synchronous, so we inline the check using the same Symbol.for\n// keys that cache-runtime.ts and cache.ts register their ALS instances with.\n// ---------------------------------------------------------------------------\n\nconst _USE_CACHE_ALS_KEY = Symbol.for(\"vinext.cacheRuntime.contextAls\");\nconst _UNSTABLE_CACHE_ALS_KEY = Symbol.for(\"vinext.unstableCache.als\");\nconst _g = globalThis as unknown as Record<PropertyKey, unknown>;\n\nfunction _throwIfInsideCacheScope(apiName: string): void {\n  const cacheAls = _g[_USE_CACHE_ALS_KEY] as { getStore(): unknown } | undefined;\n  if (cacheAls?.getStore() != null) {\n    throw new Error(\n      `\\`${apiName}\\` cannot be called inside \"use cache\". ` +\n        `If you need this data inside a cached function, call \\`${apiName}\\` ` +\n        \"outside and pass the required data as an argument.\",\n    );\n  }\n  const unstableAls = _g[_UNSTABLE_CACHE_ALS_KEY] as { getStore(): unknown } | undefined;\n  if (unstableAls?.getStore() === true) {\n    throw new Error(\n      `\\`${apiName}\\` cannot be called inside a function cached with \\`unstable_cache()\\`. ` +\n        `If you need this data inside a cached function, call \\`${apiName}\\` ` +\n        \"outside and pass the required data as an argument.\",\n    );\n  }\n}\n\n// ---------------------------------------------------------------------------\n// NextRequest\n// ---------------------------------------------------------------------------\n\nexport class NextRequest extends Request {\n  private _nextUrl: NextURL;\n  private _cookies: RequestCookies;\n\n  constructor(\n    input: URL | RequestInfo,\n    init?: RequestInit & {\n      nextConfig?: {\n        basePath?: string;\n        i18n?: { locales: string[]; defaultLocale: string };\n      };\n    },\n  ) {\n    // Strip nextConfig before passing to super() — it's vinext-internal,\n    // not a valid RequestInit property.\n    const { nextConfig: _nextConfig, ...requestInit } = init ?? {};\n    // Handle the case where input is a Request object - we need to extract URL and init\n    // to avoid Node.js undici issues with passing Request objects directly to super()\n    if (input instanceof Request) {\n      const req = input;\n      super(req.url, {\n        method: req.method,\n        headers: req.headers,\n        body: req.body,\n        // @ts-expect-error - duplex is not in RequestInit type but needed for streams\n        duplex: req.body ? \"half\" : undefined,\n        ...requestInit,\n      });\n    } else {\n      super(input, requestInit);\n    }\n    const url =\n      typeof input === \"string\"\n        ? new URL(input, \"http://localhost\")\n        : input instanceof URL\n          ? input\n          : new URL(input.url, \"http://localhost\");\n    const urlConfig: NextURLConfig | undefined = _nextConfig\n      ? { basePath: _nextConfig.basePath, nextConfig: { i18n: _nextConfig.i18n } }\n      : undefined;\n    this._nextUrl = new NextURL(url, undefined, urlConfig);\n    this._cookies = new RequestCookies(this.headers);\n  }\n\n  get nextUrl(): NextURL {\n    return this._nextUrl;\n  }\n\n  get cookies(): RequestCookies {\n    return this._cookies;\n  }\n\n  /**\n   * Client IP address. Prefers Cloudflare's trusted CF-Connecting-IP header\n   * over the spoofable X-Forwarded-For. Returns undefined if unavailable.\n   */\n  get ip(): string | undefined {\n    return (\n      this.headers.get(\"cf-connecting-ip\") ??\n      this.headers.get(\"x-real-ip\") ??\n      this.headers.get(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ??\n      undefined\n    );\n  }\n\n  /**\n   * Geolocation data. Platform-dependent (e.g., Cloudflare, Vercel).\n   * Returns undefined if not available.\n   */\n  get geo():\n    | { city?: string; country?: string; region?: string; latitude?: string; longitude?: string }\n    | undefined {\n    // Check Cloudflare-style headers, Vercel-style headers\n    const country =\n      this.headers.get(\"cf-ipcountry\") ?? this.headers.get(\"x-vercel-ip-country\") ?? undefined;\n    if (!country) return undefined;\n    return {\n      country,\n      city: this.headers.get(\"cf-ipcity\") ?? this.headers.get(\"x-vercel-ip-city\") ?? undefined,\n      region:\n        this.headers.get(\"cf-region\") ??\n        this.headers.get(\"x-vercel-ip-country-region\") ??\n        undefined,\n      latitude:\n        this.headers.get(\"cf-iplatitude\") ?? this.headers.get(\"x-vercel-ip-latitude\") ?? undefined,\n      longitude:\n        this.headers.get(\"cf-iplongitude\") ??\n        this.headers.get(\"x-vercel-ip-longitude\") ??\n        undefined,\n    };\n  }\n\n  /**\n   * The build ID of the Next.js application.\n   * Delegates to `nextUrl.buildId` to match Next.js API surface.\n   * Can be used in middleware to detect deployment skew between client and server.\n   */\n  get buildId(): string | undefined {\n    return this._nextUrl.buildId;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// NextResponse\n// ---------------------------------------------------------------------------\n\nexport class NextResponse<_Body = unknown> extends Response {\n  private _cookies: ResponseCookies;\n\n  constructor(body?: BodyInit | null, init?: ResponseInit) {\n    super(body, init);\n    this._cookies = new ResponseCookies(this.headers);\n  }\n\n  get cookies(): ResponseCookies {\n    return this._cookies;\n  }\n\n  /**\n   * Create a JSON response.\n   */\n  static json<JsonBody>(body: JsonBody, init?: ResponseInit): NextResponse<JsonBody> {\n    const headers = new Headers(init?.headers);\n    if (!headers.has(\"content-type\")) {\n      headers.set(\"content-type\", \"application/json\");\n    }\n    return new NextResponse(JSON.stringify(body), {\n      ...init,\n      headers,\n    }) as NextResponse<JsonBody>;\n  }\n\n  /**\n   * Create a redirect response.\n   */\n  static redirect(url: string | URL, init?: number | ResponseInit): NextResponse {\n    const status = typeof init === \"number\" ? init : (init?.status ?? 307);\n    const destination = typeof url === \"string\" ? url : url.toString();\n    const headers = new Headers(typeof init === \"object\" ? init?.headers : undefined);\n    headers.set(\"Location\", destination);\n    return new NextResponse(null, { status, headers });\n  }\n\n  /**\n   * Create a rewrite response (middleware pattern).\n   * Sets the x-middleware-rewrite header.\n   */\n  static rewrite(destination: string | URL, init?: MiddlewareResponseInit): NextResponse {\n    const url = typeof destination === \"string\" ? destination : destination.toString();\n    const headers = new Headers(init?.headers);\n    headers.set(\"x-middleware-rewrite\", url);\n    if (init?.request?.headers) {\n      encodeMiddlewareRequestHeaders(headers, init.request.headers);\n    }\n    return new NextResponse(null, { ...init, headers });\n  }\n\n  /**\n   * Continue to the next handler (middleware pattern).\n   * Sets the x-middleware-next header.\n   */\n  static next(init?: MiddlewareResponseInit): NextResponse {\n    const headers = new Headers(init?.headers);\n    headers.set(\"x-middleware-next\", \"1\");\n    if (init?.request?.headers) {\n      encodeMiddlewareRequestHeaders(headers, init.request.headers);\n    }\n    return new NextResponse(null, { ...init, headers });\n  }\n}\n\n// ---------------------------------------------------------------------------\n// NextURL — lightweight URL wrapper with pathname helpers\n// ---------------------------------------------------------------------------\n\nexport type NextURLConfig = {\n  basePath?: string;\n  nextConfig?: {\n    i18n?: {\n      locales: string[];\n      defaultLocale: string;\n    };\n  };\n};\n\nexport class NextURL {\n  /** Internal URL stores the pathname WITHOUT basePath or locale prefix. */\n  private _url: URL;\n  private _basePath: string;\n  private _locale: string | undefined;\n  private _defaultLocale: string | undefined;\n  private _locales: string[] | undefined;\n\n  constructor(input: string | URL, base?: string | URL, config?: NextURLConfig) {\n    this._url = new URL(input.toString(), base);\n    this._basePath = config?.basePath ?? \"\";\n    this._stripBasePath();\n    const i18n = config?.nextConfig?.i18n;\n    if (i18n) {\n      this._locales = [...i18n.locales];\n      this._defaultLocale = i18n.defaultLocale;\n      this._analyzeLocale(this._locales);\n    }\n  }\n\n  /** Strip basePath prefix from the internal pathname. */\n  private _stripBasePath(): void {\n    if (!this._basePath) return;\n    const { pathname } = this._url;\n    if (pathname === this._basePath || pathname.startsWith(this._basePath + \"/\")) {\n      this._url.pathname = pathname.slice(this._basePath.length) || \"/\";\n    }\n  }\n\n  /** Extract locale from pathname, stripping it from the internal URL. */\n  private _analyzeLocale(locales: string[]): void {\n    const segments = this._url.pathname.split(\"/\");\n    const candidate = segments[1]?.toLowerCase();\n    const match = locales.find((l) => l.toLowerCase() === candidate);\n    if (match) {\n      this._locale = match;\n      this._url.pathname = \"/\" + segments.slice(2).join(\"/\");\n    } else {\n      this._locale = this._defaultLocale;\n    }\n  }\n\n  /**\n   * Reconstruct the full pathname with basePath + locale prefix.\n   * Mirrors Next.js's internal formatPathname().\n   */\n  private _formatPathname(): string {\n    // Build prefix: basePath + locale (skip defaultLocale — Next.js omits it)\n    let prefix = this._basePath;\n    if (this._locale && this._locale !== this._defaultLocale) {\n      prefix += \"/\" + this._locale;\n    }\n    if (!prefix) return this._url.pathname;\n    const inner = this._url.pathname;\n    return inner === \"/\" ? prefix : prefix + inner;\n  }\n\n  get href(): string {\n    const formatted = this._formatPathname();\n    if (formatted === this._url.pathname) return this._url.href;\n    // Replace pathname in href via string slicing — avoids URL allocation.\n    // URL.href is always <origin+auth><pathname><search><hash>.\n    const { href, pathname, search, hash } = this._url;\n    const baseEnd = href.length - pathname.length - search.length - hash.length;\n    return href.slice(0, baseEnd) + formatted + search + hash;\n  }\n  set href(value: string) {\n    this._url.href = value;\n    this._stripBasePath();\n    if (this._locales) this._analyzeLocale(this._locales);\n  }\n\n  get origin(): string {\n    return this._url.origin;\n  }\n\n  get protocol(): string {\n    return this._url.protocol;\n  }\n  set protocol(value: string) {\n    this._url.protocol = value;\n  }\n\n  get username(): string {\n    return this._url.username;\n  }\n  set username(value: string) {\n    this._url.username = value;\n  }\n\n  get password(): string {\n    return this._url.password;\n  }\n  set password(value: string) {\n    this._url.password = value;\n  }\n\n  get host(): string {\n    return this._url.host;\n  }\n  set host(value: string) {\n    this._url.host = value;\n  }\n\n  get hostname(): string {\n    return this._url.hostname;\n  }\n  set hostname(value: string) {\n    this._url.hostname = value;\n  }\n\n  get port(): string {\n    return this._url.port;\n  }\n  set port(value: string) {\n    this._url.port = value;\n  }\n\n  /** Returns the pathname WITHOUT basePath or locale prefix. */\n  get pathname(): string {\n    return this._url.pathname;\n  }\n  set pathname(value: string) {\n    this._url.pathname = value;\n  }\n\n  get search(): string {\n    return this._url.search;\n  }\n  set search(value: string) {\n    this._url.search = value;\n  }\n\n  get searchParams(): URLSearchParams {\n    return this._url.searchParams;\n  }\n\n  get hash(): string {\n    return this._url.hash;\n  }\n  set hash(value: string) {\n    this._url.hash = value;\n  }\n\n  get basePath(): string {\n    return this._basePath;\n  }\n  set basePath(value: string) {\n    this._basePath = value === \"\" ? \"\" : value.startsWith(\"/\") ? value : \"/\" + value;\n  }\n\n  get locale(): string {\n    return this._locale ?? \"\";\n  }\n  set locale(value: string | undefined) {\n    if (this._locales) {\n      if (!value) {\n        this._locale = this._defaultLocale;\n        return;\n      }\n      if (!this._locales.includes(value)) {\n        throw new TypeError(\n          `The locale \"${value}\" is not in the configured locales: ${this._locales.join(\", \")}`,\n        );\n      }\n    }\n    this._locale = this._locales ? value : this._locale;\n  }\n\n  get defaultLocale(): string | undefined {\n    return this._defaultLocale;\n  }\n\n  get locales(): string[] | undefined {\n    return this._locales ? [...this._locales] : undefined;\n  }\n\n  clone(): NextURL {\n    const config: NextURLConfig = {\n      basePath: this._basePath,\n      nextConfig: this._locales\n        ? { i18n: { locales: [...this._locales], defaultLocale: this._defaultLocale! } }\n        : undefined,\n    };\n    // Pass the full href (with locale/basePath re-added) so the constructor\n    // can re-analyze and extract locale correctly.\n    return new NextURL(this.href, undefined, config);\n  }\n\n  toString(): string {\n    return this.href;\n  }\n\n  /**\n   * The build ID of the Next.js application.\n   * Set from `generateBuildId` in next.config.js, or a random UUID if not configured.\n   * Can be used in middleware to detect deployment skew between client and server.\n   * Matches the Next.js API: `request.nextUrl.buildId`.\n   */\n  get buildId(): string | undefined {\n    return process.env.__VINEXT_BUILD_ID ?? undefined;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Cookie helpers (minimal implementations)\n// ---------------------------------------------------------------------------\n\ntype CookieEntry = {\n  name: string;\n  value: string;\n};\n\nexport class RequestCookies {\n  private _headers: Headers;\n  private _parsed: Map<string, string>;\n\n  constructor(headers: Headers) {\n    this._headers = headers;\n    this._parsed = parseCookieHeader(headers.get(\"cookie\") ?? \"\");\n  }\n\n  get(name: string): CookieEntry | undefined {\n    const value = this._parsed.get(name);\n    return value !== undefined ? { name, value } : undefined;\n  }\n\n  getAll(nameOrOptions?: string | CookieEntry): CookieEntry[] {\n    const name = typeof nameOrOptions === \"string\" ? nameOrOptions : nameOrOptions?.name;\n    return [...this._parsed.entries()]\n      .filter(([cookieName]) => name === undefined || cookieName === name)\n      .map(([cookieName, value]) => ({ name: cookieName, value }));\n  }\n\n  has(name: string): boolean {\n    return this._parsed.has(name);\n  }\n\n  set(nameOrOptions: string | CookieEntry, value?: string): this {\n    let cookieName: string;\n    let cookieValue: string;\n    if (typeof nameOrOptions === \"string\") {\n      cookieName = nameOrOptions;\n      cookieValue = value ?? \"\";\n    } else {\n      cookieName = nameOrOptions.name;\n      cookieValue = nameOrOptions.value;\n    }\n    this._parsed.set(cookieName, cookieValue);\n    this._syncHeader();\n    return this;\n  }\n\n  delete(names: string | string[]): boolean | boolean[] {\n    if (Array.isArray(names)) {\n      const results = names.map((name) => this._parsed.delete(name));\n      this._syncHeader();\n      return results;\n    }\n    const result = this._parsed.delete(names);\n    this._syncHeader();\n    return result;\n  }\n\n  clear(): this {\n    this._parsed.clear();\n    this._syncHeader();\n    return this;\n  }\n\n  get size(): number {\n    return this._parsed.size;\n  }\n\n  toString(): string {\n    return this._serialize();\n  }\n\n  private _serialize(): string {\n    return [...this._parsed.entries()].map(([n, v]) => `${n}=${encodeURIComponent(v)}`).join(\"; \");\n  }\n\n  private _syncHeader(): void {\n    if (this._parsed.size === 0) {\n      this._headers.delete(\"cookie\");\n    } else {\n      this._headers.set(\"cookie\", this._serialize());\n    }\n  }\n\n  [Symbol.iterator](): IterableIterator<[string, CookieEntry]> {\n    const entries = this.getAll().map((c) => [c.name, c] as [string, CookieEntry]);\n    return entries[Symbol.iterator]();\n  }\n}\n\n/**\n * RFC 6265 §4.1.1: cookie-name is a token (RFC 2616 §2.2).\n * Allowed: any visible ASCII (0x21-0x7E) except separators: ()<>@,;:\\\"/[]?={}\n */\nconst VALID_COOKIE_NAME_RE =\n  /^[\\x21\\x23-\\x27\\x2A\\x2B\\x2D\\x2E\\x30-\\x39\\x41-\\x5A\\x5E-\\x7A\\x7C\\x7E]+$/;\n\nfunction validateCookieName(name: string): void {\n  if (!name || !VALID_COOKIE_NAME_RE.test(name)) {\n    throw new Error(`Invalid cookie name: ${JSON.stringify(name)}`);\n  }\n}\n\nfunction validateCookieAttributeValue(value: string, attributeName: string): void {\n  for (let i = 0; i < value.length; i++) {\n    const code = value.charCodeAt(i);\n    if (code <= 0x1f || code === 0x7f || value[i] === \";\") {\n      throw new Error(`Invalid cookie ${attributeName} value: ${JSON.stringify(value)}`);\n    }\n  }\n}\n\nexport class ResponseCookies {\n  private _headers: Headers;\n\n  constructor(headers: Headers) {\n    this._headers = headers;\n  }\n\n  set(name: string, value: string, options?: CookieOptions): this {\n    validateCookieName(name);\n    const parts = [`${name}=${encodeURIComponent(value)}`];\n    if (options?.path) {\n      validateCookieAttributeValue(options.path, \"Path\");\n      parts.push(`Path=${options.path}`);\n    }\n    if (options?.domain) {\n      validateCookieAttributeValue(options.domain, \"Domain\");\n      parts.push(`Domain=${options.domain}`);\n    }\n    if (options?.maxAge !== undefined) parts.push(`Max-Age=${options.maxAge}`);\n    if (options?.expires) parts.push(`Expires=${options.expires.toUTCString()}`);\n    if (options?.httpOnly) parts.push(\"HttpOnly\");\n    if (options?.secure) parts.push(\"Secure\");\n    if (options?.sameSite) parts.push(`SameSite=${options.sameSite}`);\n    this._headers.append(\"Set-Cookie\", parts.join(\"; \"));\n    return this;\n  }\n\n  get(name: string): CookieEntry | undefined {\n    for (const header of this._headers.getSetCookie()) {\n      const eq = header.indexOf(\"=\");\n      if (eq === -1) continue;\n      const cookieName = header.slice(0, eq);\n      if (cookieName === name) {\n        const semi = header.indexOf(\";\", eq);\n        const raw = header.slice(eq + 1, semi === -1 ? undefined : semi);\n        let value: string;\n        try {\n          value = decodeURIComponent(raw);\n        } catch {\n          value = raw;\n        }\n        return { name, value };\n      }\n    }\n    return undefined;\n  }\n\n  has(name: string): boolean {\n    return this.get(name) !== undefined;\n  }\n\n  getAll(): CookieEntry[] {\n    const entries: CookieEntry[] = [];\n    for (const header of this._headers.getSetCookie()) {\n      const eq = header.indexOf(\"=\");\n      if (eq === -1) continue;\n      const cookieName = header.slice(0, eq);\n      const semi = header.indexOf(\";\", eq);\n      const raw = header.slice(eq + 1, semi === -1 ? undefined : semi);\n      let value: string;\n      try {\n        value = decodeURIComponent(raw);\n      } catch {\n        value = raw;\n      }\n      entries.push({ name: cookieName, value });\n    }\n    return entries;\n  }\n\n  delete(name: string): this {\n    this.set(name, \"\", { maxAge: 0, path: \"/\" });\n    return this;\n  }\n\n  [Symbol.iterator](): IterableIterator<[string, CookieEntry]> {\n    const entries: [string, CookieEntry][] = [];\n    for (const header of this._headers.getSetCookie()) {\n      const eq = header.indexOf(\"=\");\n      if (eq === -1) continue;\n      const cookieName = header.slice(0, eq);\n      const semi = header.indexOf(\";\", eq);\n      const raw = header.slice(eq + 1, semi === -1 ? undefined : semi);\n      let value: string;\n      try {\n        value = decodeURIComponent(raw);\n      } catch {\n        value = raw;\n      }\n      entries.push([cookieName, { name: cookieName, value }]);\n    }\n    return entries[Symbol.iterator]();\n  }\n}\n\ntype CookieOptions = {\n  path?: string;\n  domain?: string;\n  maxAge?: number;\n  expires?: Date;\n  httpOnly?: boolean;\n  secure?: boolean;\n  sameSite?: \"Strict\" | \"Lax\" | \"None\";\n};\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport type MiddlewareResponseInit = {\n  request?: {\n    headers?: Headers;\n  };\n} & ResponseInit;\n\nexport type NextMiddlewareResult = NextResponse | Response | null | undefined | void;\n\nexport type NextMiddleware = (\n  request: NextRequest,\n  event: NextFetchEvent,\n) => NextMiddlewareResult | Promise<NextMiddlewareResult>;\n\n/**\n * Minimal NextFetchEvent — extends FetchEvent where available,\n * otherwise provides the waitUntil pattern standalone.\n */\nexport class NextFetchEvent {\n  sourcePage: string;\n  private _waitUntilPromises: Promise<unknown>[] = [];\n\n  constructor(params: { page: string }) {\n    this.sourcePage = params.page;\n  }\n\n  waitUntil(promise: Promise<unknown>): void {\n    this._waitUntilPromises.push(promise);\n  }\n\n  get waitUntilPromises(): Promise<unknown>[] {\n    return this._waitUntilPromises;\n  }\n\n  /** Drain all waitUntil promises. Returns a single promise that settles when all are done. */\n  drainWaitUntil(): Promise<PromiseSettledResult<unknown>[]> {\n    return Promise.allSettled(this._waitUntilPromises);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Utility exports\n// ---------------------------------------------------------------------------\n\n/**\n * Parse user agent string. Minimal implementation — for full UA parsing,\n * apps should use a dedicated library like `ua-parser-js`.\n */\nexport function userAgentFromString(ua: string | undefined): UserAgent {\n  const input = ua ?? \"\";\n  return {\n    isBot: /bot|crawler|spider|crawling/i.test(input),\n    ua: input,\n    browser: {},\n    device: {},\n    engine: {},\n    os: {},\n    cpu: {},\n  };\n}\n\nexport function userAgent({ headers }: { headers: Headers }): UserAgent {\n  return userAgentFromString(headers.get(\"user-agent\") ?? undefined);\n}\n\nexport type UserAgent = {\n  isBot: boolean;\n  ua: string;\n  browser: { name?: string; version?: string; major?: string };\n  device: { model?: string; type?: string; vendor?: string };\n  engine: { name?: string; version?: string };\n  os: { name?: string; version?: string };\n  cpu: { architecture?: string };\n};\n\n/**\n * after() — schedule work after the response is sent.\n *\n * Uses the platform's `waitUntil` (via the per-request ExecutionContext) when\n * available so the task survives past the response on Cloudflare Workers.\n * Falls back to a fire-and-forget microtask on runtimes without an execution\n * context (e.g. Node.js dev server).\n *\n * Throws when called inside a cached scope — request-specific\n * side-effects must not leak into cached results.\n */\nexport function after<T>(task: Promise<T> | (() => T | Promise<T>)): void {\n  _throwIfInsideCacheScope(\"after()\");\n\n  const promise = typeof task === \"function\" ? Promise.resolve().then(task) : task;\n  // NOTE: vinext runs function tasks concurrently with response streaming (next microtask),\n  // whereas Next.js queues them to run strictly after the response is sent via onClose.\n  // This is a known simplification — function tasks here are not guaranteed to run\n  // after the response completes, only after the current synchronous execution.\n  //\n  // `.catch()` is attached synchronously in the same tick as `promise` is created, so\n  // there is no window where a pre-rejected `task` promise could trigger an\n  // `unhandledrejection` event before the handler is in place.\n  const guarded = promise.catch((err) => {\n    console.error(\"[vinext] after() task failed:\", err);\n  });\n\n  // TODO: Next.js throws when after() is called outside a request context or when\n  // waitUntil is unavailable, preventing silent task loss. vinext falls back to\n  // fire-and-forget here, which is correct for the Node.js dev server (where\n  // getRequestExecutionContext() always returns null). On Workers, a misconfigured\n  // entry that omits runWithExecutionContext would silently drop tasks — consider\n  // a one-time console.warn on the fallback path, gated to production only (e.g.\n  // `process.env.NODE_ENV === 'production'` or `typeof caches !== 'undefined'` for\n  // a Workers runtime check) with a module-level `let _warned = false` guard so it\n  // fires at most once and doesn't spam the dev-server console.\n  getRequestExecutionContext()?.waitUntil(guarded);\n}\n\n/**\n * connection() — signals that the response requires a live connection\n * (not a static/cached response). Opts the page out of ISR caching\n * and sets Cache-Control: no-store on the response.\n */\nexport async function connection(): Promise<void> {\n  const { markDynamicUsage, throwIfInsideCacheScope } = await import(\"./headers.js\");\n  throwIfInsideCacheScope(\"connection()\");\n  markDynamicUsage();\n}\n\n/**\n * URLPattern re-export — used in middleware for route matching.\n * Available natively in Node 20+, Cloudflare Workers, Deno.\n * Falls back to urlpattern-polyfill if the global is not available.\n */\nexport const URLPattern: typeof globalThis.URLPattern =\n  globalThis.URLPattern ??\n  (() => {\n    throw new Error(\n      \"URLPattern is not available in this runtime. \" +\n        \"Install the `urlpattern-polyfill` package or upgrade to Node 20+.\",\n    );\n  });\n"],"mappings":";;;;;;;;;;;;;;AA8BA,MAAM,qBAAqB,OAAO,IAAI,iCAAiC;AACvE,MAAM,0BAA0B,OAAO,IAAI,2BAA2B;AACtE,MAAM,KAAK;AAEX,SAAS,yBAAyB,SAAuB;AAEvD,KADiB,GAAG,qBACN,UAAU,IAAI,KAC1B,OAAM,IAAI,MACR,KAAK,QAAQ,iGAC+C,QAAQ,uDAErE;AAGH,KADoB,GAAG,0BACN,UAAU,KAAK,KAC9B,OAAM,IAAI,MACR,KAAK,QAAQ,iIAC+C,QAAQ,uDAErE;;AAQL,IAAa,cAAb,cAAiC,QAAQ;CACvC;CACA;CAEA,YACE,OACA,MAMA;EAGA,MAAM,EAAE,YAAY,aAAa,GAAG,gBAAgB,QAAQ,EAAE;AAG9D,MAAI,iBAAiB,SAAS;GAC5B,MAAM,MAAM;AACZ,SAAM,IAAI,KAAK;IACb,QAAQ,IAAI;IACZ,SAAS,IAAI;IACb,MAAM,IAAI;IAEV,QAAQ,IAAI,OAAO,SAAS,KAAA;IAC5B,GAAG;IACJ,CAAC;QAEF,OAAM,OAAO,YAAY;AAW3B,OAAK,WAAW,IAAI,QARlB,OAAO,UAAU,WACb,IAAI,IAAI,OAAO,mBAAmB,GAClC,iBAAiB,MACf,QACA,IAAI,IAAI,MAAM,KAAK,mBAAmB,EAIb,KAAA,GAHY,cACzC;GAAE,UAAU,YAAY;GAAU,YAAY,EAAE,MAAM,YAAY,MAAM;GAAE,GAC1E,KAAA,EACkD;AACtD,OAAK,WAAW,IAAI,eAAe,KAAK,QAAQ;;CAGlD,IAAI,UAAmB;AACrB,SAAO,KAAK;;CAGd,IAAI,UAA0B;AAC5B,SAAO,KAAK;;;;;;CAOd,IAAI,KAAyB;AAC3B,SACE,KAAK,QAAQ,IAAI,mBAAmB,IACpC,KAAK,QAAQ,IAAI,YAAY,IAC7B,KAAK,QAAQ,IAAI,kBAAkB,EAAE,MAAM,IAAI,CAAC,IAAI,MAAM,IAC1D,KAAA;;;;;;CAQJ,IAAI,MAEU;EAEZ,MAAM,UACJ,KAAK,QAAQ,IAAI,eAAe,IAAI,KAAK,QAAQ,IAAI,sBAAsB,IAAI,KAAA;AACjF,MAAI,CAAC,QAAS,QAAO,KAAA;AACrB,SAAO;GACL;GACA,MAAM,KAAK,QAAQ,IAAI,YAAY,IAAI,KAAK,QAAQ,IAAI,mBAAmB,IAAI,KAAA;GAC/E,QACE,KAAK,QAAQ,IAAI,YAAY,IAC7B,KAAK,QAAQ,IAAI,6BAA6B,IAC9C,KAAA;GACF,UACE,KAAK,QAAQ,IAAI,gBAAgB,IAAI,KAAK,QAAQ,IAAI,uBAAuB,IAAI,KAAA;GACnF,WACE,KAAK,QAAQ,IAAI,iBAAiB,IAClC,KAAK,QAAQ,IAAI,wBAAwB,IACzC,KAAA;GACH;;;;;;;CAQH,IAAI,UAA8B;AAChC,SAAO,KAAK,SAAS;;;AAQzB,IAAa,eAAb,MAAa,qBAAsC,SAAS;CAC1D;CAEA,YAAY,MAAwB,MAAqB;AACvD,QAAM,MAAM,KAAK;AACjB,OAAK,WAAW,IAAI,gBAAgB,KAAK,QAAQ;;CAGnD,IAAI,UAA2B;AAC7B,SAAO,KAAK;;;;;CAMd,OAAO,KAAe,MAAgB,MAA6C;EACjF,MAAM,UAAU,IAAI,QAAQ,MAAM,QAAQ;AAC1C,MAAI,CAAC,QAAQ,IAAI,eAAe,CAC9B,SAAQ,IAAI,gBAAgB,mBAAmB;AAEjD,SAAO,IAAI,aAAa,KAAK,UAAU,KAAK,EAAE;GAC5C,GAAG;GACH;GACD,CAAC;;;;;CAMJ,OAAO,SAAS,KAAmB,MAA4C;EAC7E,MAAM,SAAS,OAAO,SAAS,WAAW,OAAQ,MAAM,UAAU;EAClE,MAAM,cAAc,OAAO,QAAQ,WAAW,MAAM,IAAI,UAAU;EAClE,MAAM,UAAU,IAAI,QAAQ,OAAO,SAAS,WAAW,MAAM,UAAU,KAAA,EAAU;AACjF,UAAQ,IAAI,YAAY,YAAY;AACpC,SAAO,IAAI,aAAa,MAAM;GAAE;GAAQ;GAAS,CAAC;;;;;;CAOpD,OAAO,QAAQ,aAA2B,MAA6C;EACrF,MAAM,MAAM,OAAO,gBAAgB,WAAW,cAAc,YAAY,UAAU;EAClF,MAAM,UAAU,IAAI,QAAQ,MAAM,QAAQ;AAC1C,UAAQ,IAAI,wBAAwB,IAAI;AACxC,MAAI,MAAM,SAAS,QACjB,gCAA+B,SAAS,KAAK,QAAQ,QAAQ;AAE/D,SAAO,IAAI,aAAa,MAAM;GAAE,GAAG;GAAM;GAAS,CAAC;;;;;;CAOrD,OAAO,KAAK,MAA6C;EACvD,MAAM,UAAU,IAAI,QAAQ,MAAM,QAAQ;AAC1C,UAAQ,IAAI,qBAAqB,IAAI;AACrC,MAAI,MAAM,SAAS,QACjB,gCAA+B,SAAS,KAAK,QAAQ,QAAQ;AAE/D,SAAO,IAAI,aAAa,MAAM;GAAE,GAAG;GAAM;GAAS,CAAC;;;AAkBvD,IAAa,UAAb,MAAa,QAAQ;;CAEnB;CACA;CACA;CACA;CACA;CAEA,YAAY,OAAqB,MAAqB,QAAwB;AAC5E,OAAK,OAAO,IAAI,IAAI,MAAM,UAAU,EAAE,KAAK;AAC3C,OAAK,YAAY,QAAQ,YAAY;AACrC,OAAK,gBAAgB;EACrB,MAAM,OAAO,QAAQ,YAAY;AACjC,MAAI,MAAM;AACR,QAAK,WAAW,CAAC,GAAG,KAAK,QAAQ;AACjC,QAAK,iBAAiB,KAAK;AAC3B,QAAK,eAAe,KAAK,SAAS;;;;CAKtC,iBAA+B;AAC7B,MAAI,CAAC,KAAK,UAAW;EACrB,MAAM,EAAE,aAAa,KAAK;AAC1B,MAAI,aAAa,KAAK,aAAa,SAAS,WAAW,KAAK,YAAY,IAAI,CAC1E,MAAK,KAAK,WAAW,SAAS,MAAM,KAAK,UAAU,OAAO,IAAI;;;CAKlE,eAAuB,SAAyB;EAC9C,MAAM,WAAW,KAAK,KAAK,SAAS,MAAM,IAAI;EAC9C,MAAM,YAAY,SAAS,IAAI,aAAa;EAC5C,MAAM,QAAQ,QAAQ,MAAM,MAAM,EAAE,aAAa,KAAK,UAAU;AAChE,MAAI,OAAO;AACT,QAAK,UAAU;AACf,QAAK,KAAK,WAAW,MAAM,SAAS,MAAM,EAAE,CAAC,KAAK,IAAI;QAEtD,MAAK,UAAU,KAAK;;;;;;CAQxB,kBAAkC;EAEhC,IAAI,SAAS,KAAK;AAClB,MAAI,KAAK,WAAW,KAAK,YAAY,KAAK,eACxC,WAAU,MAAM,KAAK;AAEvB,MAAI,CAAC,OAAQ,QAAO,KAAK,KAAK;EAC9B,MAAM,QAAQ,KAAK,KAAK;AACxB,SAAO,UAAU,MAAM,SAAS,SAAS;;CAG3C,IAAI,OAAe;EACjB,MAAM,YAAY,KAAK,iBAAiB;AACxC,MAAI,cAAc,KAAK,KAAK,SAAU,QAAO,KAAK,KAAK;EAGvD,MAAM,EAAE,MAAM,UAAU,QAAQ,SAAS,KAAK;EAC9C,MAAM,UAAU,KAAK,SAAS,SAAS,SAAS,OAAO,SAAS,KAAK;AACrE,SAAO,KAAK,MAAM,GAAG,QAAQ,GAAG,YAAY,SAAS;;CAEvD,IAAI,KAAK,OAAe;AACtB,OAAK,KAAK,OAAO;AACjB,OAAK,gBAAgB;AACrB,MAAI,KAAK,SAAU,MAAK,eAAe,KAAK,SAAS;;CAGvD,IAAI,SAAiB;AACnB,SAAO,KAAK,KAAK;;CAGnB,IAAI,WAAmB;AACrB,SAAO,KAAK,KAAK;;CAEnB,IAAI,SAAS,OAAe;AAC1B,OAAK,KAAK,WAAW;;CAGvB,IAAI,WAAmB;AACrB,SAAO,KAAK,KAAK;;CAEnB,IAAI,SAAS,OAAe;AAC1B,OAAK,KAAK,WAAW;;CAGvB,IAAI,WAAmB;AACrB,SAAO,KAAK,KAAK;;CAEnB,IAAI,SAAS,OAAe;AAC1B,OAAK,KAAK,WAAW;;CAGvB,IAAI,OAAe;AACjB,SAAO,KAAK,KAAK;;CAEnB,IAAI,KAAK,OAAe;AACtB,OAAK,KAAK,OAAO;;CAGnB,IAAI,WAAmB;AACrB,SAAO,KAAK,KAAK;;CAEnB,IAAI,SAAS,OAAe;AAC1B,OAAK,KAAK,WAAW;;CAGvB,IAAI,OAAe;AACjB,SAAO,KAAK,KAAK;;CAEnB,IAAI,KAAK,OAAe;AACtB,OAAK,KAAK,OAAO;;;CAInB,IAAI,WAAmB;AACrB,SAAO,KAAK,KAAK;;CAEnB,IAAI,SAAS,OAAe;AAC1B,OAAK,KAAK,WAAW;;CAGvB,IAAI,SAAiB;AACnB,SAAO,KAAK,KAAK;;CAEnB,IAAI,OAAO,OAAe;AACxB,OAAK,KAAK,SAAS;;CAGrB,IAAI,eAAgC;AAClC,SAAO,KAAK,KAAK;;CAGnB,IAAI,OAAe;AACjB,SAAO,KAAK,KAAK;;CAEnB,IAAI,KAAK,OAAe;AACtB,OAAK,KAAK,OAAO;;CAGnB,IAAI,WAAmB;AACrB,SAAO,KAAK;;CAEd,IAAI,SAAS,OAAe;AAC1B,OAAK,YAAY,UAAU,KAAK,KAAK,MAAM,WAAW,IAAI,GAAG,QAAQ,MAAM;;CAG7E,IAAI,SAAiB;AACnB,SAAO,KAAK,WAAW;;CAEzB,IAAI,OAAO,OAA2B;AACpC,MAAI,KAAK,UAAU;AACjB,OAAI,CAAC,OAAO;AACV,SAAK,UAAU,KAAK;AACpB;;AAEF,OAAI,CAAC,KAAK,SAAS,SAAS,MAAM,CAChC,OAAM,IAAI,UACR,eAAe,MAAM,sCAAsC,KAAK,SAAS,KAAK,KAAK,GACpF;;AAGL,OAAK,UAAU,KAAK,WAAW,QAAQ,KAAK;;CAG9C,IAAI,gBAAoC;AACtC,SAAO,KAAK;;CAGd,IAAI,UAAgC;AAClC,SAAO,KAAK,WAAW,CAAC,GAAG,KAAK,SAAS,GAAG,KAAA;;CAG9C,QAAiB;EACf,MAAM,SAAwB;GAC5B,UAAU,KAAK;GACf,YAAY,KAAK,WACb,EAAE,MAAM;IAAE,SAAS,CAAC,GAAG,KAAK,SAAS;IAAE,eAAe,KAAK;IAAiB,EAAE,GAC9E,KAAA;GACL;AAGD,SAAO,IAAI,QAAQ,KAAK,MAAM,KAAA,GAAW,OAAO;;CAGlD,WAAmB;AACjB,SAAO,KAAK;;;;;;;;CASd,IAAI,UAA8B;AAChC,SAAO,QAAQ,IAAI,qBAAqB,KAAA;;;AAa5C,IAAa,iBAAb,MAA4B;CAC1B;CACA;CAEA,YAAY,SAAkB;AAC5B,OAAK,WAAW;AAChB,OAAK,UAAU,kBAAkB,QAAQ,IAAI,SAAS,IAAI,GAAG;;CAG/D,IAAI,MAAuC;EACzC,MAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK;AACpC,SAAO,UAAU,KAAA,IAAY;GAAE;GAAM;GAAO,GAAG,KAAA;;CAGjD,OAAO,eAAqD;EAC1D,MAAM,OAAO,OAAO,kBAAkB,WAAW,gBAAgB,eAAe;AAChF,SAAO,CAAC,GAAG,KAAK,QAAQ,SAAS,CAAC,CAC/B,QAAQ,CAAC,gBAAgB,SAAS,KAAA,KAAa,eAAe,KAAK,CACnE,KAAK,CAAC,YAAY,YAAY;GAAE,MAAM;GAAY;GAAO,EAAE;;CAGhE,IAAI,MAAuB;AACzB,SAAO,KAAK,QAAQ,IAAI,KAAK;;CAG/B,IAAI,eAAqC,OAAsB;EAC7D,IAAI;EACJ,IAAI;AACJ,MAAI,OAAO,kBAAkB,UAAU;AACrC,gBAAa;AACb,iBAAc,SAAS;SAClB;AACL,gBAAa,cAAc;AAC3B,iBAAc,cAAc;;AAE9B,OAAK,QAAQ,IAAI,YAAY,YAAY;AACzC,OAAK,aAAa;AAClB,SAAO;;CAGT,OAAO,OAA+C;AACpD,MAAI,MAAM,QAAQ,MAAM,EAAE;GACxB,MAAM,UAAU,MAAM,KAAK,SAAS,KAAK,QAAQ,OAAO,KAAK,CAAC;AAC9D,QAAK,aAAa;AAClB,UAAO;;EAET,MAAM,SAAS,KAAK,QAAQ,OAAO,MAAM;AACzC,OAAK,aAAa;AAClB,SAAO;;CAGT,QAAc;AACZ,OAAK,QAAQ,OAAO;AACpB,OAAK,aAAa;AAClB,SAAO;;CAGT,IAAI,OAAe;AACjB,SAAO,KAAK,QAAQ;;CAGtB,WAAmB;AACjB,SAAO,KAAK,YAAY;;CAG1B,aAA6B;AAC3B,SAAO,CAAC,GAAG,KAAK,QAAQ,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,OAAO,GAAG,EAAE,GAAG,mBAAmB,EAAE,GAAG,CAAC,KAAK,KAAK;;CAGhG,cAA4B;AAC1B,MAAI,KAAK,QAAQ,SAAS,EACxB,MAAK,SAAS,OAAO,SAAS;MAE9B,MAAK,SAAS,IAAI,UAAU,KAAK,YAAY,CAAC;;CAIlD,CAAC,OAAO,YAAqD;AAE3D,SADgB,KAAK,QAAQ,CAAC,KAAK,MAAM,CAAC,EAAE,MAAM,EAAE,CAA0B,CAC/D,OAAO,WAAW;;;;;;;AAQrC,MAAM,uBACJ;AAEF,SAAS,mBAAmB,MAAoB;AAC9C,KAAI,CAAC,QAAQ,CAAC,qBAAqB,KAAK,KAAK,CAC3C,OAAM,IAAI,MAAM,wBAAwB,KAAK,UAAU,KAAK,GAAG;;AAInE,SAAS,6BAA6B,OAAe,eAA6B;AAChF,MAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;EACrC,MAAM,OAAO,MAAM,WAAW,EAAE;AAChC,MAAI,QAAQ,MAAQ,SAAS,OAAQ,MAAM,OAAO,IAChD,OAAM,IAAI,MAAM,kBAAkB,cAAc,UAAU,KAAK,UAAU,MAAM,GAAG;;;AAKxF,IAAa,kBAAb,MAA6B;CAC3B;CAEA,YAAY,SAAkB;AAC5B,OAAK,WAAW;;CAGlB,IAAI,MAAc,OAAe,SAA+B;AAC9D,qBAAmB,KAAK;EACxB,MAAM,QAAQ,CAAC,GAAG,KAAK,GAAG,mBAAmB,MAAM,GAAG;AACtD,MAAI,SAAS,MAAM;AACjB,gCAA6B,QAAQ,MAAM,OAAO;AAClD,SAAM,KAAK,QAAQ,QAAQ,OAAO;;AAEpC,MAAI,SAAS,QAAQ;AACnB,gCAA6B,QAAQ,QAAQ,SAAS;AACtD,SAAM,KAAK,UAAU,QAAQ,SAAS;;AAExC,MAAI,SAAS,WAAW,KAAA,EAAW,OAAM,KAAK,WAAW,QAAQ,SAAS;AAC1E,MAAI,SAAS,QAAS,OAAM,KAAK,WAAW,QAAQ,QAAQ,aAAa,GAAG;AAC5E,MAAI,SAAS,SAAU,OAAM,KAAK,WAAW;AAC7C,MAAI,SAAS,OAAQ,OAAM,KAAK,SAAS;AACzC,MAAI,SAAS,SAAU,OAAM,KAAK,YAAY,QAAQ,WAAW;AACjE,OAAK,SAAS,OAAO,cAAc,MAAM,KAAK,KAAK,CAAC;AACpD,SAAO;;CAGT,IAAI,MAAuC;AACzC,OAAK,MAAM,UAAU,KAAK,SAAS,cAAc,EAAE;GACjD,MAAM,KAAK,OAAO,QAAQ,IAAI;AAC9B,OAAI,OAAO,GAAI;AAEf,OADmB,OAAO,MAAM,GAAG,GAAG,KACnB,MAAM;IACvB,MAAM,OAAO,OAAO,QAAQ,KAAK,GAAG;IACpC,MAAM,MAAM,OAAO,MAAM,KAAK,GAAG,SAAS,KAAK,KAAA,IAAY,KAAK;IAChE,IAAI;AACJ,QAAI;AACF,aAAQ,mBAAmB,IAAI;YACzB;AACN,aAAQ;;AAEV,WAAO;KAAE;KAAM;KAAO;;;;CAM5B,IAAI,MAAuB;AACzB,SAAO,KAAK,IAAI,KAAK,KAAK,KAAA;;CAG5B,SAAwB;EACtB,MAAM,UAAyB,EAAE;AACjC,OAAK,MAAM,UAAU,KAAK,SAAS,cAAc,EAAE;GACjD,MAAM,KAAK,OAAO,QAAQ,IAAI;AAC9B,OAAI,OAAO,GAAI;GACf,MAAM,aAAa,OAAO,MAAM,GAAG,GAAG;GACtC,MAAM,OAAO,OAAO,QAAQ,KAAK,GAAG;GACpC,MAAM,MAAM,OAAO,MAAM,KAAK,GAAG,SAAS,KAAK,KAAA,IAAY,KAAK;GAChE,IAAI;AACJ,OAAI;AACF,YAAQ,mBAAmB,IAAI;WACzB;AACN,YAAQ;;AAEV,WAAQ,KAAK;IAAE,MAAM;IAAY;IAAO,CAAC;;AAE3C,SAAO;;CAGT,OAAO,MAAoB;AACzB,OAAK,IAAI,MAAM,IAAI;GAAE,QAAQ;GAAG,MAAM;GAAK,CAAC;AAC5C,SAAO;;CAGT,CAAC,OAAO,YAAqD;EAC3D,MAAM,UAAmC,EAAE;AAC3C,OAAK,MAAM,UAAU,KAAK,SAAS,cAAc,EAAE;GACjD,MAAM,KAAK,OAAO,QAAQ,IAAI;AAC9B,OAAI,OAAO,GAAI;GACf,MAAM,aAAa,OAAO,MAAM,GAAG,GAAG;GACtC,MAAM,OAAO,OAAO,QAAQ,KAAK,GAAG;GACpC,MAAM,MAAM,OAAO,MAAM,KAAK,GAAG,SAAS,KAAK,KAAA,IAAY,KAAK;GAChE,IAAI;AACJ,OAAI;AACF,YAAQ,mBAAmB,IAAI;WACzB;AACN,YAAQ;;AAEV,WAAQ,KAAK,CAAC,YAAY;IAAE,MAAM;IAAY;IAAO,CAAC,CAAC;;AAEzD,SAAO,QAAQ,OAAO,WAAW;;;;;;;AAmCrC,IAAa,iBAAb,MAA4B;CAC1B;CACA,qBAAiD,EAAE;CAEnD,YAAY,QAA0B;AACpC,OAAK,aAAa,OAAO;;CAG3B,UAAU,SAAiC;AACzC,OAAK,mBAAmB,KAAK,QAAQ;;CAGvC,IAAI,oBAAwC;AAC1C,SAAO,KAAK;;;CAId,iBAA2D;AACzD,SAAO,QAAQ,WAAW,KAAK,mBAAmB;;;;;;;AAYtD,SAAgB,oBAAoB,IAAmC;CACrE,MAAM,QAAQ,MAAM;AACpB,QAAO;EACL,OAAO,+BAA+B,KAAK,MAAM;EACjD,IAAI;EACJ,SAAS,EAAE;EACX,QAAQ,EAAE;EACV,QAAQ,EAAE;EACV,IAAI,EAAE;EACN,KAAK,EAAE;EACR;;AAGH,SAAgB,UAAU,EAAE,WAA4C;AACtE,QAAO,oBAAoB,QAAQ,IAAI,aAAa,IAAI,KAAA,EAAU;;;;;;;;;;;;;AAwBpE,SAAgB,MAAS,MAAiD;AACxE,0BAAyB,UAAU;CAWnC,MAAM,WATU,OAAO,SAAS,aAAa,QAAQ,SAAS,CAAC,KAAK,KAAK,GAAG,MASpD,OAAO,QAAQ;AACrC,UAAQ,MAAM,iCAAiC,IAAI;GACnD;AAWF,6BAA4B,EAAE,UAAU,QAAQ;;;;;;;AAQlD,eAAsB,aAA4B;CAChD,MAAM,EAAE,kBAAkB,4BAA4B,MAAM,OAAO;AACnE,yBAAwB,eAAe;AACvC,mBAAkB;;;;;;;AAQpB,MAAa,aACX,WAAW,qBACJ;AACL,OAAM,IAAI,MACR,iHAED"}
+{"version":3,"file":"server.js","names":[],"sources":["../../src/shims/server.ts"],"sourcesContent":["/**\n * next/server shim\n *\n * Provides NextRequest, NextResponse, and related types that work with\n * standard Web APIs (Request/Response). This means they work on Node,\n * Cloudflare Workers, Deno, and any WinterCG-compatible runtime.\n *\n * This is a pragmatic subset — we implement the most commonly used APIs\n * rather than bug-for-bug parity with Next.js internals.\n */\n\nimport { encodeMiddlewareRequestHeaders } from \"../server/middleware-request-headers.js\";\nimport { parseCookieHeader } from \"./internal/parse-cookie-header.js\";\nimport { getRequestExecutionContext } from \"./request-context.js\";\n\n// ---------------------------------------------------------------------------\n// Inlined cache-scope guard for after()\n//\n// We cannot statically import throwIfInsideCacheScope from headers.ts here\n// because headers.ts contains the \"use cache\" directive string in its error\n// message, which causes Vite's use-cache transform to include it in the module\n// graph. If headers.ts is pulled in via static import from server.ts, the\n// transform fires on it in Pages Router fixtures that lack @vitejs/plugin-rsc.\n//\n// The connection() function in this file avoids the same problem by using\n// `await import(\"./headers.js\")` (dynamic import, async function). after()\n// must remain synchronous, so we inline the check using the same Symbol.for\n// keys that cache-runtime.ts and cache.ts register their ALS instances with.\n// ---------------------------------------------------------------------------\n\nconst _USE_CACHE_ALS_KEY = Symbol.for(\"vinext.cacheRuntime.contextAls\");\nconst _UNSTABLE_CACHE_ALS_KEY = Symbol.for(\"vinext.unstableCache.als\");\nconst _g = globalThis as unknown as Record<PropertyKey, unknown>;\n\nfunction _throwIfInsideCacheScope(apiName: string): void {\n  const cacheAls = _g[_USE_CACHE_ALS_KEY] as { getStore(): unknown } | undefined;\n  if (cacheAls?.getStore() != null) {\n    throw new Error(\n      `\\`${apiName}\\` cannot be called inside \"use cache\". ` +\n        `If you need this data inside a cached function, call \\`${apiName}\\` ` +\n        \"outside and pass the required data as an argument.\",\n    );\n  }\n  const unstableAls = _g[_UNSTABLE_CACHE_ALS_KEY] as { getStore(): unknown } | undefined;\n  if (unstableAls?.getStore() === true) {\n    throw new Error(\n      `\\`${apiName}\\` cannot be called inside a function cached with \\`unstable_cache()\\`. ` +\n        `If you need this data inside a cached function, call \\`${apiName}\\` ` +\n        \"outside and pass the required data as an argument.\",\n    );\n  }\n}\n\n// ---------------------------------------------------------------------------\n// NextRequest\n// ---------------------------------------------------------------------------\n\nexport class NextRequest extends Request {\n  private _nextUrl: NextURL;\n  private _cookies: RequestCookies;\n\n  constructor(\n    input: URL | RequestInfo,\n    init?: RequestInit & {\n      nextConfig?: {\n        basePath?: string;\n        i18n?: { locales: string[]; defaultLocale: string };\n      };\n    },\n  ) {\n    // Strip nextConfig before passing to super() — it's vinext-internal,\n    // not a valid RequestInit property.\n    const { nextConfig: _nextConfig, ...requestInit } = init ?? {};\n    // Handle the case where input is a Request object - we need to extract URL and init\n    // to avoid Node.js undici issues with passing Request objects directly to super()\n    if (input instanceof Request) {\n      const req = input;\n      super(req.url, {\n        method: req.method,\n        headers: req.headers,\n        body: req.body,\n        // @ts-expect-error - duplex is not in RequestInit type but needed for streams\n        duplex: req.body ? \"half\" : undefined,\n        ...requestInit,\n      });\n    } else {\n      super(input, requestInit);\n    }\n    const url =\n      typeof input === \"string\"\n        ? new URL(input, \"http://localhost\")\n        : input instanceof URL\n          ? input\n          : new URL(input.url, \"http://localhost\");\n    const urlConfig: NextURLConfig | undefined = _nextConfig\n      ? { basePath: _nextConfig.basePath, nextConfig: { i18n: _nextConfig.i18n } }\n      : undefined;\n    this._nextUrl = new NextURL(url, undefined, urlConfig);\n    this._cookies = new RequestCookies(this.headers);\n  }\n\n  get nextUrl(): NextURL {\n    return this._nextUrl;\n  }\n\n  get cookies(): RequestCookies {\n    return this._cookies;\n  }\n\n  /**\n   * Client IP address. Prefers Cloudflare's trusted CF-Connecting-IP header\n   * over the spoofable X-Forwarded-For. Returns undefined if unavailable.\n   */\n  get ip(): string | undefined {\n    return (\n      this.headers.get(\"cf-connecting-ip\") ??\n      this.headers.get(\"x-real-ip\") ??\n      this.headers.get(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ??\n      undefined\n    );\n  }\n\n  /**\n   * Geolocation data. Platform-dependent (e.g., Cloudflare, Vercel).\n   * Returns undefined if not available.\n   */\n  get geo():\n    | { city?: string; country?: string; region?: string; latitude?: string; longitude?: string }\n    | undefined {\n    // Check Cloudflare-style headers, Vercel-style headers\n    const country =\n      this.headers.get(\"cf-ipcountry\") ?? this.headers.get(\"x-vercel-ip-country\") ?? undefined;\n    if (!country) return undefined;\n    return {\n      country,\n      city: this.headers.get(\"cf-ipcity\") ?? this.headers.get(\"x-vercel-ip-city\") ?? undefined,\n      region:\n        this.headers.get(\"cf-region\") ??\n        this.headers.get(\"x-vercel-ip-country-region\") ??\n        undefined,\n      latitude:\n        this.headers.get(\"cf-iplatitude\") ?? this.headers.get(\"x-vercel-ip-latitude\") ?? undefined,\n      longitude:\n        this.headers.get(\"cf-iplongitude\") ??\n        this.headers.get(\"x-vercel-ip-longitude\") ??\n        undefined,\n    };\n  }\n\n  /**\n   * The build ID of the Next.js application.\n   * Delegates to `nextUrl.buildId` to match Next.js API surface.\n   * Can be used in middleware to detect deployment skew between client and server.\n   */\n  get buildId(): string | undefined {\n    return this._nextUrl.buildId;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// NextResponse\n// ---------------------------------------------------------------------------\n\n/** Valid HTTP redirect status codes, matching Next.js's REDIRECTS set. */\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\nexport class NextResponse<_Body = unknown> extends Response {\n  private _cookies: ResponseCookies;\n\n  constructor(body?: BodyInit | null, init?: ResponseInit) {\n    super(body, init);\n    this._cookies = new ResponseCookies(this.headers);\n  }\n\n  get cookies(): ResponseCookies {\n    return this._cookies;\n  }\n\n  /**\n   * Create a JSON response.\n   */\n  static json<JsonBody>(body: JsonBody, init?: ResponseInit): NextResponse<JsonBody> {\n    const headers = new Headers(init?.headers);\n    if (!headers.has(\"content-type\")) {\n      headers.set(\"content-type\", \"application/json\");\n    }\n    return new NextResponse(JSON.stringify(body), {\n      ...init,\n      headers,\n    }) as NextResponse<JsonBody>;\n  }\n\n  /**\n   * Create a redirect response.\n   */\n  static redirect(url: string | URL, init?: number | ResponseInit): NextResponse {\n    const status = typeof init === \"number\" ? init : (init?.status ?? 307);\n    if (!REDIRECT_STATUSES.has(status)) {\n      throw new RangeError(`Failed to execute \"redirect\" on \"response\": Invalid status code`);\n    }\n    const destination = typeof url === \"string\" ? url : url.toString();\n    const headers = new Headers(typeof init === \"object\" ? init?.headers : undefined);\n    headers.set(\"Location\", destination);\n    return new NextResponse(null, { status, headers });\n  }\n\n  /**\n   * Create a rewrite response (middleware pattern).\n   * Sets the x-middleware-rewrite header.\n   */\n  static rewrite(destination: string | URL, init?: MiddlewareResponseInit): NextResponse {\n    const url = typeof destination === \"string\" ? destination : destination.toString();\n    const headers = new Headers(init?.headers);\n    headers.set(\"x-middleware-rewrite\", url);\n    if (init?.request?.headers) {\n      encodeMiddlewareRequestHeaders(headers, init.request.headers);\n    }\n    return new NextResponse(null, { ...init, headers });\n  }\n\n  /**\n   * Continue to the next handler (middleware pattern).\n   * Sets the x-middleware-next header.\n   */\n  static next(init?: MiddlewareResponseInit): NextResponse {\n    const headers = new Headers(init?.headers);\n    headers.set(\"x-middleware-next\", \"1\");\n    if (init?.request?.headers) {\n      encodeMiddlewareRequestHeaders(headers, init.request.headers);\n    }\n    return new NextResponse(null, { ...init, headers });\n  }\n}\n\n// ---------------------------------------------------------------------------\n// NextURL — lightweight URL wrapper with pathname helpers\n// ---------------------------------------------------------------------------\n\nexport type NextURLConfig = {\n  basePath?: string;\n  nextConfig?: {\n    i18n?: {\n      locales: string[];\n      defaultLocale: string;\n    };\n  };\n};\n\nexport class NextURL {\n  /** Internal URL stores the pathname WITHOUT basePath or locale prefix. */\n  private _url: URL;\n  private _basePath: string;\n  private _locale: string | undefined;\n  private _defaultLocale: string | undefined;\n  private _locales: string[] | undefined;\n\n  constructor(input: string | URL, base?: string | URL, config?: NextURLConfig) {\n    this._url = new URL(input.toString(), base);\n    this._basePath = config?.basePath ?? \"\";\n    this._stripBasePath();\n    const i18n = config?.nextConfig?.i18n;\n    if (i18n) {\n      this._locales = [...i18n.locales];\n      this._defaultLocale = i18n.defaultLocale;\n      this._analyzeLocale(this._locales);\n    }\n  }\n\n  /** Strip basePath prefix from the internal pathname. */\n  private _stripBasePath(): void {\n    if (!this._basePath) return;\n    const { pathname } = this._url;\n    if (pathname === this._basePath || pathname.startsWith(this._basePath + \"/\")) {\n      this._url.pathname = pathname.slice(this._basePath.length) || \"/\";\n    }\n  }\n\n  /** Extract locale from pathname, stripping it from the internal URL. */\n  private _analyzeLocale(locales: string[]): void {\n    const segments = this._url.pathname.split(\"/\");\n    const candidate = segments[1]?.toLowerCase();\n    const match = locales.find((l) => l.toLowerCase() === candidate);\n    if (match) {\n      this._locale = match;\n      this._url.pathname = \"/\" + segments.slice(2).join(\"/\");\n    } else {\n      this._locale = this._defaultLocale;\n    }\n  }\n\n  /**\n   * Reconstruct the full pathname with basePath + locale prefix.\n   * Mirrors Next.js's internal formatPathname().\n   */\n  private _formatPathname(): string {\n    // Build prefix: basePath + locale (skip defaultLocale — Next.js omits it)\n    let prefix = this._basePath;\n    if (this._locale && this._locale !== this._defaultLocale) {\n      prefix += \"/\" + this._locale;\n    }\n    if (!prefix) return this._url.pathname;\n    const inner = this._url.pathname;\n    return inner === \"/\" ? prefix : prefix + inner;\n  }\n\n  get href(): string {\n    const formatted = this._formatPathname();\n    if (formatted === this._url.pathname) return this._url.href;\n    // Replace pathname in href via string slicing — avoids URL allocation.\n    // URL.href is always <origin+auth><pathname><search><hash>.\n    const { href, pathname, search, hash } = this._url;\n    const baseEnd = href.length - pathname.length - search.length - hash.length;\n    return href.slice(0, baseEnd) + formatted + search + hash;\n  }\n  set href(value: string) {\n    this._url.href = value;\n    this._stripBasePath();\n    if (this._locales) this._analyzeLocale(this._locales);\n  }\n\n  get origin(): string {\n    return this._url.origin;\n  }\n\n  get protocol(): string {\n    return this._url.protocol;\n  }\n  set protocol(value: string) {\n    this._url.protocol = value;\n  }\n\n  get username(): string {\n    return this._url.username;\n  }\n  set username(value: string) {\n    this._url.username = value;\n  }\n\n  get password(): string {\n    return this._url.password;\n  }\n  set password(value: string) {\n    this._url.password = value;\n  }\n\n  get host(): string {\n    return this._url.host;\n  }\n  set host(value: string) {\n    this._url.host = value;\n  }\n\n  get hostname(): string {\n    return this._url.hostname;\n  }\n  set hostname(value: string) {\n    this._url.hostname = value;\n  }\n\n  get port(): string {\n    return this._url.port;\n  }\n  set port(value: string) {\n    this._url.port = value;\n  }\n\n  /** Returns the pathname WITHOUT basePath or locale prefix. */\n  get pathname(): string {\n    return this._url.pathname;\n  }\n  set pathname(value: string) {\n    this._url.pathname = value;\n  }\n\n  get search(): string {\n    return this._url.search;\n  }\n  set search(value: string) {\n    this._url.search = value;\n  }\n\n  get searchParams(): URLSearchParams {\n    return this._url.searchParams;\n  }\n\n  get hash(): string {\n    return this._url.hash;\n  }\n  set hash(value: string) {\n    this._url.hash = value;\n  }\n\n  get basePath(): string {\n    return this._basePath;\n  }\n  set basePath(value: string) {\n    this._basePath = value === \"\" ? \"\" : value.startsWith(\"/\") ? value : \"/\" + value;\n  }\n\n  get locale(): string {\n    return this._locale ?? \"\";\n  }\n  set locale(value: string | undefined) {\n    if (this._locales) {\n      if (!value) {\n        this._locale = this._defaultLocale;\n        return;\n      }\n      if (!this._locales.includes(value)) {\n        throw new TypeError(\n          `The locale \"${value}\" is not in the configured locales: ${this._locales.join(\", \")}`,\n        );\n      }\n    }\n    this._locale = this._locales ? value : this._locale;\n  }\n\n  get defaultLocale(): string | undefined {\n    return this._defaultLocale;\n  }\n\n  get locales(): string[] | undefined {\n    return this._locales ? [...this._locales] : undefined;\n  }\n\n  clone(): NextURL {\n    const config: NextURLConfig = {\n      basePath: this._basePath,\n      nextConfig: this._locales\n        ? { i18n: { locales: [...this._locales], defaultLocale: this._defaultLocale! } }\n        : undefined,\n    };\n    // Pass the full href (with locale/basePath re-added) so the constructor\n    // can re-analyze and extract locale correctly.\n    return new NextURL(this.href, undefined, config);\n  }\n\n  toString(): string {\n    return this.href;\n  }\n\n  /**\n   * The build ID of the Next.js application.\n   * Set from `generateBuildId` in next.config.js, or a random UUID if not configured.\n   * Can be used in middleware to detect deployment skew between client and server.\n   * Matches the Next.js API: `request.nextUrl.buildId`.\n   */\n  get buildId(): string | undefined {\n    return process.env.__VINEXT_BUILD_ID ?? undefined;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Cookie helpers (minimal implementations)\n// ---------------------------------------------------------------------------\n\ntype CookieEntry = {\n  name: string;\n  value: string;\n};\n\nexport class RequestCookies {\n  private _headers: Headers;\n  private _parsed: Map<string, string>;\n\n  constructor(headers: Headers) {\n    this._headers = headers;\n    this._parsed = parseCookieHeader(headers.get(\"cookie\") ?? \"\");\n  }\n\n  get(name: string): CookieEntry | undefined {\n    const value = this._parsed.get(name);\n    return value !== undefined ? { name, value } : undefined;\n  }\n\n  getAll(nameOrOptions?: string | CookieEntry): CookieEntry[] {\n    const name = typeof nameOrOptions === \"string\" ? nameOrOptions : nameOrOptions?.name;\n    return [...this._parsed.entries()]\n      .filter(([cookieName]) => name === undefined || cookieName === name)\n      .map(([cookieName, value]) => ({ name: cookieName, value }));\n  }\n\n  has(name: string): boolean {\n    return this._parsed.has(name);\n  }\n\n  set(nameOrOptions: string | CookieEntry, value?: string): this {\n    let cookieName: string;\n    let cookieValue: string;\n    if (typeof nameOrOptions === \"string\") {\n      cookieName = nameOrOptions;\n      cookieValue = value ?? \"\";\n    } else {\n      cookieName = nameOrOptions.name;\n      cookieValue = nameOrOptions.value;\n    }\n    validateCookieName(cookieName);\n    this._parsed.set(cookieName, cookieValue);\n    this._syncHeader();\n    return this;\n  }\n\n  delete(names: string | string[]): boolean | boolean[] {\n    if (Array.isArray(names)) {\n      const results = names.map((name) => {\n        validateCookieName(name);\n        return this._parsed.delete(name);\n      });\n      this._syncHeader();\n      return results;\n    }\n    validateCookieName(names);\n    const result = this._parsed.delete(names);\n    this._syncHeader();\n    return result;\n  }\n\n  clear(): this {\n    this._parsed.clear();\n    this._syncHeader();\n    return this;\n  }\n\n  get size(): number {\n    return this._parsed.size;\n  }\n\n  toString(): string {\n    return this._serialize();\n  }\n\n  private _serialize(): string {\n    return [...this._parsed.entries()].map(([n, v]) => `${n}=${encodeURIComponent(v)}`).join(\"; \");\n  }\n\n  private _syncHeader(): void {\n    if (this._parsed.size === 0) {\n      this._headers.delete(\"cookie\");\n    } else {\n      this._headers.set(\"cookie\", this._serialize());\n    }\n  }\n\n  [Symbol.iterator](): IterableIterator<[string, CookieEntry]> {\n    const entries = this.getAll().map((c) => [c.name, c] as [string, CookieEntry]);\n    return entries[Symbol.iterator]();\n  }\n}\n\n/**\n * RFC 6265 §4.1.1: cookie-name is a token (RFC 2616 §2.2).\n * Allowed: any visible ASCII (0x21-0x7E) except separators: ()<>@,;:\\\"/[]?={}\n */\nconst VALID_COOKIE_NAME_RE =\n  /^[\\x21\\x23-\\x27\\x2A\\x2B\\x2D\\x2E\\x30-\\x39\\x41-\\x5A\\x5E-\\x7A\\x7C\\x7E]+$/;\n\nfunction validateCookieName(name: string): void {\n  if (!name || !VALID_COOKIE_NAME_RE.test(name)) {\n    throw new Error(`Invalid cookie name: ${JSON.stringify(name)}`);\n  }\n}\n\nfunction validateCookieAttributeValue(value: string, attributeName: string): void {\n  for (let i = 0; i < value.length; i++) {\n    const code = value.charCodeAt(i);\n    if (code <= 0x1f || code === 0x7f || value[i] === \";\") {\n      throw new Error(`Invalid cookie ${attributeName} value: ${JSON.stringify(value)}`);\n    }\n  }\n}\n\nexport class ResponseCookies {\n  private _headers: Headers;\n  /** Internal map keyed by cookie name — single source of truth. */\n  private _parsed: Map<string, { serialized: string; entry: CookieEntry }> = new Map();\n\n  constructor(headers: Headers) {\n    this._headers = headers;\n\n    // Hydrate internal map from any existing Set-Cookie headers\n    for (const header of headers.getSetCookie()) {\n      const eq = header.indexOf(\"=\");\n      if (eq === -1) continue;\n      const cookieName = header.slice(0, eq);\n      const semi = header.indexOf(\";\", eq);\n      const raw = header.slice(eq + 1, semi === -1 ? undefined : semi);\n      let value: string;\n      try {\n        value = decodeURIComponent(raw);\n      } catch {\n        value = raw;\n      }\n      this._parsed.set(cookieName, { serialized: header, entry: { name: cookieName, value } });\n    }\n  }\n\n  set(\n    ...args:\n      | [name: string, value: string, options?: CookieOptions]\n      | [options: CookieOptions & { name: string; value: string }]\n  ): this {\n    const [name, value, opts] = parseCookieSetArgs(args);\n    validateCookieName(name);\n\n    const parts = [`${name}=${encodeURIComponent(value)}`];\n    const path = opts?.path ?? \"/\";\n    validateCookieAttributeValue(path, \"Path\");\n    parts.push(`Path=${path}`);\n    if (opts?.domain) {\n      validateCookieAttributeValue(opts.domain, \"Domain\");\n      parts.push(`Domain=${opts.domain}`);\n    }\n    if (opts?.maxAge !== undefined) parts.push(`Max-Age=${opts.maxAge}`);\n    if (opts?.expires) parts.push(`Expires=${opts.expires.toUTCString()}`);\n    if (opts?.httpOnly) parts.push(\"HttpOnly\");\n    if (opts?.secure) parts.push(\"Secure\");\n    if (opts?.sameSite) parts.push(`SameSite=${opts.sameSite}`);\n\n    this._parsed.set(name, { serialized: parts.join(\"; \"), entry: { name, value } });\n    this._syncHeaders();\n    return this;\n  }\n\n  get(...args: [name: string] | [options: { name: string }]): CookieEntry | undefined {\n    const key = typeof args[0] === \"string\" ? args[0] : args[0].name;\n    return this._parsed.get(key)?.entry;\n  }\n\n  has(name: string): boolean {\n    return this._parsed.has(name);\n  }\n\n  getAll(...args: [name: string] | [options: { name: string }] | []): CookieEntry[] {\n    const all = [...this._parsed.values()].map((v) => v.entry);\n    if (args.length === 0) return all;\n    const key = typeof args[0] === \"string\" ? args[0] : args[0].name;\n    return all.filter((c) => c.name === key);\n  }\n\n  delete(\n    ...args:\n      | [name: string]\n      | [options: Omit<CookieOptions & { name: string }, \"maxAge\" | \"expires\">]\n  ): this {\n    const [name, opts] =\n      typeof args[0] === \"string\" ? [args[0], undefined] : [args[0].name, args[0]];\n    return this.set({\n      name,\n      value: \"\",\n      expires: new Date(0),\n      path: opts?.path,\n      domain: opts?.domain,\n      httpOnly: opts?.httpOnly,\n      secure: opts?.secure,\n      sameSite: opts?.sameSite,\n    });\n  }\n\n  [Symbol.iterator](): IterableIterator<[string, CookieEntry]> {\n    const entries: [string, CookieEntry][] = [...this._parsed.values()].map((v) => [\n      v.entry.name,\n      v.entry,\n    ]);\n    return entries[Symbol.iterator]();\n  }\n\n  /** Delete all Set-Cookie headers and re-append from the internal map. */\n  private _syncHeaders(): void {\n    this._headers.delete(\"Set-Cookie\");\n    for (const { serialized } of this._parsed.values()) {\n      this._headers.append(\"Set-Cookie\", serialized);\n    }\n  }\n}\n\ntype CookieOptions = {\n  path?: string;\n  domain?: string;\n  maxAge?: number;\n  expires?: Date;\n  httpOnly?: boolean;\n  secure?: boolean;\n  sameSite?: \"Strict\" | \"Lax\" | \"None\";\n};\n\n/**\n * Parse the overloaded arguments for ResponseCookies.set():\n *   - (name, value, options?) — positional form\n *   - ({ name, value, ...options }) — object form\n */\nfunction parseCookieSetArgs(\n  args:\n    | [name: string, value: string, options?: CookieOptions]\n    | [options: CookieOptions & { name: string; value: string }],\n): [string, string, CookieOptions | undefined] {\n  if (typeof args[0] === \"string\") {\n    return [args[0], args[1] as string, args[2] as CookieOptions | undefined];\n  }\n  const { name, value, ...opts } = args[0];\n  return [name, value, opts as CookieOptions];\n}\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport type MiddlewareResponseInit = {\n  request?: {\n    headers?: Headers;\n  };\n} & ResponseInit;\n\nexport type NextMiddlewareResult = NextResponse | Response | null | undefined | void;\n\nexport type NextMiddleware = (\n  request: NextRequest,\n  event: NextFetchEvent,\n) => NextMiddlewareResult | Promise<NextMiddlewareResult>;\n\n/**\n * Minimal NextFetchEvent — extends FetchEvent where available,\n * otherwise provides the waitUntil pattern standalone.\n */\nexport class NextFetchEvent {\n  sourcePage: string;\n  private _waitUntilPromises: Promise<unknown>[] = [];\n\n  constructor(params: { page: string }) {\n    this.sourcePage = params.page;\n  }\n\n  waitUntil(promise: Promise<unknown>): void {\n    this._waitUntilPromises.push(promise);\n  }\n\n  get waitUntilPromises(): Promise<unknown>[] {\n    return this._waitUntilPromises;\n  }\n\n  /** Drain all waitUntil promises. Returns a single promise that settles when all are done. */\n  drainWaitUntil(): Promise<PromiseSettledResult<unknown>[]> {\n    return Promise.allSettled(this._waitUntilPromises);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Utility exports\n// ---------------------------------------------------------------------------\n\n/**\n * Parse user agent string. Minimal implementation — for full UA parsing,\n * apps should use a dedicated library like `ua-parser-js`.\n */\nexport function userAgentFromString(ua: string | undefined): UserAgent {\n  const input = ua ?? \"\";\n  return {\n    isBot: /bot|crawler|spider|crawling/i.test(input),\n    ua: input,\n    browser: {},\n    device: {},\n    engine: {},\n    os: {},\n    cpu: {},\n  };\n}\n\nexport function userAgent({ headers }: { headers: Headers }): UserAgent {\n  return userAgentFromString(headers.get(\"user-agent\") ?? undefined);\n}\n\nexport type UserAgent = {\n  isBot: boolean;\n  ua: string;\n  browser: { name?: string; version?: string; major?: string };\n  device: { model?: string; type?: string; vendor?: string };\n  engine: { name?: string; version?: string };\n  os: { name?: string; version?: string };\n  cpu: { architecture?: string };\n};\n\n/**\n * after() — schedule work after the response is sent.\n *\n * Uses the platform's `waitUntil` (via the per-request ExecutionContext) when\n * available so the task survives past the response on Cloudflare Workers.\n * Falls back to a fire-and-forget microtask on runtimes without an execution\n * context (e.g. Node.js dev server).\n *\n * Throws when called inside a cached scope — request-specific\n * side-effects must not leak into cached results.\n */\nexport function after<T>(task: Promise<T> | (() => T | Promise<T>)): void {\n  _throwIfInsideCacheScope(\"after()\");\n\n  const promise = typeof task === \"function\" ? Promise.resolve().then(task) : task;\n  // NOTE: vinext runs function tasks concurrently with response streaming (next microtask),\n  // whereas Next.js queues them to run strictly after the response is sent via onClose.\n  // This is a known simplification — function tasks here are not guaranteed to run\n  // after the response completes, only after the current synchronous execution.\n  //\n  // `.catch()` is attached synchronously in the same tick as `promise` is created, so\n  // there is no window where a pre-rejected `task` promise could trigger an\n  // `unhandledrejection` event before the handler is in place.\n  const guarded = promise.catch((err) => {\n    console.error(\"[vinext] after() task failed:\", err);\n  });\n\n  // TODO: Next.js throws when after() is called outside a request context or when\n  // waitUntil is unavailable, preventing silent task loss. vinext falls back to\n  // fire-and-forget here, which is correct for the Node.js dev server (where\n  // getRequestExecutionContext() always returns null). On Workers, a misconfigured\n  // entry that omits runWithExecutionContext would silently drop tasks — consider\n  // a one-time console.warn on the fallback path, gated to production only (e.g.\n  // `process.env.NODE_ENV === 'production'` or `typeof caches !== 'undefined'` for\n  // a Workers runtime check) with a module-level `let _warned = false` guard so it\n  // fires at most once and doesn't spam the dev-server console.\n  getRequestExecutionContext()?.waitUntil(guarded);\n}\n\n/**\n * connection() — signals that the response requires a live connection\n * (not a static/cached response). Opts the page out of ISR caching\n * and sets Cache-Control: no-store on the response.\n */\nexport async function connection(): Promise<void> {\n  const { markDynamicUsage, throwIfInsideCacheScope } = await import(\"./headers.js\");\n  throwIfInsideCacheScope(\"connection()\");\n  markDynamicUsage();\n}\n\n/**\n * URLPattern re-export — used in middleware for route matching.\n * Available natively in Node 20+, Cloudflare Workers, Deno.\n * Falls back to urlpattern-polyfill if the global is not available.\n */\nexport const URLPattern: typeof globalThis.URLPattern =\n  globalThis.URLPattern ??\n  (() => {\n    throw new Error(\n      \"URLPattern is not available in this runtime. \" +\n        \"Install the `urlpattern-polyfill` package or upgrade to Node 20+.\",\n    );\n  });\n"],"mappings":";;;;;;;;;;;;;;AA8BA,MAAM,qBAAqB,OAAO,IAAI,iCAAiC;AACvE,MAAM,0BAA0B,OAAO,IAAI,2BAA2B;AACtE,MAAM,KAAK;AAEX,SAAS,yBAAyB,SAAuB;AAEvD,KADiB,GAAG,qBACN,UAAU,IAAI,KAC1B,OAAM,IAAI,MACR,KAAK,QAAQ,iGAC+C,QAAQ,uDAErE;AAGH,KADoB,GAAG,0BACN,UAAU,KAAK,KAC9B,OAAM,IAAI,MACR,KAAK,QAAQ,iIAC+C,QAAQ,uDAErE;;AAQL,IAAa,cAAb,cAAiC,QAAQ;CACvC;CACA;CAEA,YACE,OACA,MAMA;EAGA,MAAM,EAAE,YAAY,aAAa,GAAG,gBAAgB,QAAQ,EAAE;AAG9D,MAAI,iBAAiB,SAAS;GAC5B,MAAM,MAAM;AACZ,SAAM,IAAI,KAAK;IACb,QAAQ,IAAI;IACZ,SAAS,IAAI;IACb,MAAM,IAAI;IAEV,QAAQ,IAAI,OAAO,SAAS,KAAA;IAC5B,GAAG;IACJ,CAAC;QAEF,OAAM,OAAO,YAAY;AAW3B,OAAK,WAAW,IAAI,QARlB,OAAO,UAAU,WACb,IAAI,IAAI,OAAO,mBAAmB,GAClC,iBAAiB,MACf,QACA,IAAI,IAAI,MAAM,KAAK,mBAAmB,EAIb,KAAA,GAHY,cACzC;GAAE,UAAU,YAAY;GAAU,YAAY,EAAE,MAAM,YAAY,MAAM;GAAE,GAC1E,KAAA,EACkD;AACtD,OAAK,WAAW,IAAI,eAAe,KAAK,QAAQ;;CAGlD,IAAI,UAAmB;AACrB,SAAO,KAAK;;CAGd,IAAI,UAA0B;AAC5B,SAAO,KAAK;;;;;;CAOd,IAAI,KAAyB;AAC3B,SACE,KAAK,QAAQ,IAAI,mBAAmB,IACpC,KAAK,QAAQ,IAAI,YAAY,IAC7B,KAAK,QAAQ,IAAI,kBAAkB,EAAE,MAAM,IAAI,CAAC,IAAI,MAAM,IAC1D,KAAA;;;;;;CAQJ,IAAI,MAEU;EAEZ,MAAM,UACJ,KAAK,QAAQ,IAAI,eAAe,IAAI,KAAK,QAAQ,IAAI,sBAAsB,IAAI,KAAA;AACjF,MAAI,CAAC,QAAS,QAAO,KAAA;AACrB,SAAO;GACL;GACA,MAAM,KAAK,QAAQ,IAAI,YAAY,IAAI,KAAK,QAAQ,IAAI,mBAAmB,IAAI,KAAA;GAC/E,QACE,KAAK,QAAQ,IAAI,YAAY,IAC7B,KAAK,QAAQ,IAAI,6BAA6B,IAC9C,KAAA;GACF,UACE,KAAK,QAAQ,IAAI,gBAAgB,IAAI,KAAK,QAAQ,IAAI,uBAAuB,IAAI,KAAA;GACnF,WACE,KAAK,QAAQ,IAAI,iBAAiB,IAClC,KAAK,QAAQ,IAAI,wBAAwB,IACzC,KAAA;GACH;;;;;;;CAQH,IAAI,UAA8B;AAChC,SAAO,KAAK,SAAS;;;;AASzB,MAAM,oBAAoB,IAAI,IAAI;CAAC;CAAK;CAAK;CAAK;CAAK;CAAI,CAAC;AAE5D,IAAa,eAAb,MAAa,qBAAsC,SAAS;CAC1D;CAEA,YAAY,MAAwB,MAAqB;AACvD,QAAM,MAAM,KAAK;AACjB,OAAK,WAAW,IAAI,gBAAgB,KAAK,QAAQ;;CAGnD,IAAI,UAA2B;AAC7B,SAAO,KAAK;;;;;CAMd,OAAO,KAAe,MAAgB,MAA6C;EACjF,MAAM,UAAU,IAAI,QAAQ,MAAM,QAAQ;AAC1C,MAAI,CAAC,QAAQ,IAAI,eAAe,CAC9B,SAAQ,IAAI,gBAAgB,mBAAmB;AAEjD,SAAO,IAAI,aAAa,KAAK,UAAU,KAAK,EAAE;GAC5C,GAAG;GACH;GACD,CAAC;;;;;CAMJ,OAAO,SAAS,KAAmB,MAA4C;EAC7E,MAAM,SAAS,OAAO,SAAS,WAAW,OAAQ,MAAM,UAAU;AAClE,MAAI,CAAC,kBAAkB,IAAI,OAAO,CAChC,OAAM,IAAI,WAAW,kEAAkE;EAEzF,MAAM,cAAc,OAAO,QAAQ,WAAW,MAAM,IAAI,UAAU;EAClE,MAAM,UAAU,IAAI,QAAQ,OAAO,SAAS,WAAW,MAAM,UAAU,KAAA,EAAU;AACjF,UAAQ,IAAI,YAAY,YAAY;AACpC,SAAO,IAAI,aAAa,MAAM;GAAE;GAAQ;GAAS,CAAC;;;;;;CAOpD,OAAO,QAAQ,aAA2B,MAA6C;EACrF,MAAM,MAAM,OAAO,gBAAgB,WAAW,cAAc,YAAY,UAAU;EAClF,MAAM,UAAU,IAAI,QAAQ,MAAM,QAAQ;AAC1C,UAAQ,IAAI,wBAAwB,IAAI;AACxC,MAAI,MAAM,SAAS,QACjB,gCAA+B,SAAS,KAAK,QAAQ,QAAQ;AAE/D,SAAO,IAAI,aAAa,MAAM;GAAE,GAAG;GAAM;GAAS,CAAC;;;;;;CAOrD,OAAO,KAAK,MAA6C;EACvD,MAAM,UAAU,IAAI,QAAQ,MAAM,QAAQ;AAC1C,UAAQ,IAAI,qBAAqB,IAAI;AACrC,MAAI,MAAM,SAAS,QACjB,gCAA+B,SAAS,KAAK,QAAQ,QAAQ;AAE/D,SAAO,IAAI,aAAa,MAAM;GAAE,GAAG;GAAM;GAAS,CAAC;;;AAkBvD,IAAa,UAAb,MAAa,QAAQ;;CAEnB;CACA;CACA;CACA;CACA;CAEA,YAAY,OAAqB,MAAqB,QAAwB;AAC5E,OAAK,OAAO,IAAI,IAAI,MAAM,UAAU,EAAE,KAAK;AAC3C,OAAK,YAAY,QAAQ,YAAY;AACrC,OAAK,gBAAgB;EACrB,MAAM,OAAO,QAAQ,YAAY;AACjC,MAAI,MAAM;AACR,QAAK,WAAW,CAAC,GAAG,KAAK,QAAQ;AACjC,QAAK,iBAAiB,KAAK;AAC3B,QAAK,eAAe,KAAK,SAAS;;;;CAKtC,iBAA+B;AAC7B,MAAI,CAAC,KAAK,UAAW;EACrB,MAAM,EAAE,aAAa,KAAK;AAC1B,MAAI,aAAa,KAAK,aAAa,SAAS,WAAW,KAAK,YAAY,IAAI,CAC1E,MAAK,KAAK,WAAW,SAAS,MAAM,KAAK,UAAU,OAAO,IAAI;;;CAKlE,eAAuB,SAAyB;EAC9C,MAAM,WAAW,KAAK,KAAK,SAAS,MAAM,IAAI;EAC9C,MAAM,YAAY,SAAS,IAAI,aAAa;EAC5C,MAAM,QAAQ,QAAQ,MAAM,MAAM,EAAE,aAAa,KAAK,UAAU;AAChE,MAAI,OAAO;AACT,QAAK,UAAU;AACf,QAAK,KAAK,WAAW,MAAM,SAAS,MAAM,EAAE,CAAC,KAAK,IAAI;QAEtD,MAAK,UAAU,KAAK;;;;;;CAQxB,kBAAkC;EAEhC,IAAI,SAAS,KAAK;AAClB,MAAI,KAAK,WAAW,KAAK,YAAY,KAAK,eACxC,WAAU,MAAM,KAAK;AAEvB,MAAI,CAAC,OAAQ,QAAO,KAAK,KAAK;EAC9B,MAAM,QAAQ,KAAK,KAAK;AACxB,SAAO,UAAU,MAAM,SAAS,SAAS;;CAG3C,IAAI,OAAe;EACjB,MAAM,YAAY,KAAK,iBAAiB;AACxC,MAAI,cAAc,KAAK,KAAK,SAAU,QAAO,KAAK,KAAK;EAGvD,MAAM,EAAE,MAAM,UAAU,QAAQ,SAAS,KAAK;EAC9C,MAAM,UAAU,KAAK,SAAS,SAAS,SAAS,OAAO,SAAS,KAAK;AACrE,SAAO,KAAK,MAAM,GAAG,QAAQ,GAAG,YAAY,SAAS;;CAEvD,IAAI,KAAK,OAAe;AACtB,OAAK,KAAK,OAAO;AACjB,OAAK,gBAAgB;AACrB,MAAI,KAAK,SAAU,MAAK,eAAe,KAAK,SAAS;;CAGvD,IAAI,SAAiB;AACnB,SAAO,KAAK,KAAK;;CAGnB,IAAI,WAAmB;AACrB,SAAO,KAAK,KAAK;;CAEnB,IAAI,SAAS,OAAe;AAC1B,OAAK,KAAK,WAAW;;CAGvB,IAAI,WAAmB;AACrB,SAAO,KAAK,KAAK;;CAEnB,IAAI,SAAS,OAAe;AAC1B,OAAK,KAAK,WAAW;;CAGvB,IAAI,WAAmB;AACrB,SAAO,KAAK,KAAK;;CAEnB,IAAI,SAAS,OAAe;AAC1B,OAAK,KAAK,WAAW;;CAGvB,IAAI,OAAe;AACjB,SAAO,KAAK,KAAK;;CAEnB,IAAI,KAAK,OAAe;AACtB,OAAK,KAAK,OAAO;;CAGnB,IAAI,WAAmB;AACrB,SAAO,KAAK,KAAK;;CAEnB,IAAI,SAAS,OAAe;AAC1B,OAAK,KAAK,WAAW;;CAGvB,IAAI,OAAe;AACjB,SAAO,KAAK,KAAK;;CAEnB,IAAI,KAAK,OAAe;AACtB,OAAK,KAAK,OAAO;;;CAInB,IAAI,WAAmB;AACrB,SAAO,KAAK,KAAK;;CAEnB,IAAI,SAAS,OAAe;AAC1B,OAAK,KAAK,WAAW;;CAGvB,IAAI,SAAiB;AACnB,SAAO,KAAK,KAAK;;CAEnB,IAAI,OAAO,OAAe;AACxB,OAAK,KAAK,SAAS;;CAGrB,IAAI,eAAgC;AAClC,SAAO,KAAK,KAAK;;CAGnB,IAAI,OAAe;AACjB,SAAO,KAAK,KAAK;;CAEnB,IAAI,KAAK,OAAe;AACtB,OAAK,KAAK,OAAO;;CAGnB,IAAI,WAAmB;AACrB,SAAO,KAAK;;CAEd,IAAI,SAAS,OAAe;AAC1B,OAAK,YAAY,UAAU,KAAK,KAAK,MAAM,WAAW,IAAI,GAAG,QAAQ,MAAM;;CAG7E,IAAI,SAAiB;AACnB,SAAO,KAAK,WAAW;;CAEzB,IAAI,OAAO,OAA2B;AACpC,MAAI,KAAK,UAAU;AACjB,OAAI,CAAC,OAAO;AACV,SAAK,UAAU,KAAK;AACpB;;AAEF,OAAI,CAAC,KAAK,SAAS,SAAS,MAAM,CAChC,OAAM,IAAI,UACR,eAAe,MAAM,sCAAsC,KAAK,SAAS,KAAK,KAAK,GACpF;;AAGL,OAAK,UAAU,KAAK,WAAW,QAAQ,KAAK;;CAG9C,IAAI,gBAAoC;AACtC,SAAO,KAAK;;CAGd,IAAI,UAAgC;AAClC,SAAO,KAAK,WAAW,CAAC,GAAG,KAAK,SAAS,GAAG,KAAA;;CAG9C,QAAiB;EACf,MAAM,SAAwB;GAC5B,UAAU,KAAK;GACf,YAAY,KAAK,WACb,EAAE,MAAM;IAAE,SAAS,CAAC,GAAG,KAAK,SAAS;IAAE,eAAe,KAAK;IAAiB,EAAE,GAC9E,KAAA;GACL;AAGD,SAAO,IAAI,QAAQ,KAAK,MAAM,KAAA,GAAW,OAAO;;CAGlD,WAAmB;AACjB,SAAO,KAAK;;;;;;;;CASd,IAAI,UAA8B;AAChC,SAAO,QAAQ,IAAI,qBAAqB,KAAA;;;AAa5C,IAAa,iBAAb,MAA4B;CAC1B;CACA;CAEA,YAAY,SAAkB;AAC5B,OAAK,WAAW;AAChB,OAAK,UAAU,kBAAkB,QAAQ,IAAI,SAAS,IAAI,GAAG;;CAG/D,IAAI,MAAuC;EACzC,MAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK;AACpC,SAAO,UAAU,KAAA,IAAY;GAAE;GAAM;GAAO,GAAG,KAAA;;CAGjD,OAAO,eAAqD;EAC1D,MAAM,OAAO,OAAO,kBAAkB,WAAW,gBAAgB,eAAe;AAChF,SAAO,CAAC,GAAG,KAAK,QAAQ,SAAS,CAAC,CAC/B,QAAQ,CAAC,gBAAgB,SAAS,KAAA,KAAa,eAAe,KAAK,CACnE,KAAK,CAAC,YAAY,YAAY;GAAE,MAAM;GAAY;GAAO,EAAE;;CAGhE,IAAI,MAAuB;AACzB,SAAO,KAAK,QAAQ,IAAI,KAAK;;CAG/B,IAAI,eAAqC,OAAsB;EAC7D,IAAI;EACJ,IAAI;AACJ,MAAI,OAAO,kBAAkB,UAAU;AACrC,gBAAa;AACb,iBAAc,SAAS;SAClB;AACL,gBAAa,cAAc;AAC3B,iBAAc,cAAc;;AAE9B,qBAAmB,WAAW;AAC9B,OAAK,QAAQ,IAAI,YAAY,YAAY;AACzC,OAAK,aAAa;AAClB,SAAO;;CAGT,OAAO,OAA+C;AACpD,MAAI,MAAM,QAAQ,MAAM,EAAE;GACxB,MAAM,UAAU,MAAM,KAAK,SAAS;AAClC,uBAAmB,KAAK;AACxB,WAAO,KAAK,QAAQ,OAAO,KAAK;KAChC;AACF,QAAK,aAAa;AAClB,UAAO;;AAET,qBAAmB,MAAM;EACzB,MAAM,SAAS,KAAK,QAAQ,OAAO,MAAM;AACzC,OAAK,aAAa;AAClB,SAAO;;CAGT,QAAc;AACZ,OAAK,QAAQ,OAAO;AACpB,OAAK,aAAa;AAClB,SAAO;;CAGT,IAAI,OAAe;AACjB,SAAO,KAAK,QAAQ;;CAGtB,WAAmB;AACjB,SAAO,KAAK,YAAY;;CAG1B,aAA6B;AAC3B,SAAO,CAAC,GAAG,KAAK,QAAQ,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,OAAO,GAAG,EAAE,GAAG,mBAAmB,EAAE,GAAG,CAAC,KAAK,KAAK;;CAGhG,cAA4B;AAC1B,MAAI,KAAK,QAAQ,SAAS,EACxB,MAAK,SAAS,OAAO,SAAS;MAE9B,MAAK,SAAS,IAAI,UAAU,KAAK,YAAY,CAAC;;CAIlD,CAAC,OAAO,YAAqD;AAE3D,SADgB,KAAK,QAAQ,CAAC,KAAK,MAAM,CAAC,EAAE,MAAM,EAAE,CAA0B,CAC/D,OAAO,WAAW;;;;;;;AAQrC,MAAM,uBACJ;AAEF,SAAS,mBAAmB,MAAoB;AAC9C,KAAI,CAAC,QAAQ,CAAC,qBAAqB,KAAK,KAAK,CAC3C,OAAM,IAAI,MAAM,wBAAwB,KAAK,UAAU,KAAK,GAAG;;AAInE,SAAS,6BAA6B,OAAe,eAA6B;AAChF,MAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;EACrC,MAAM,OAAO,MAAM,WAAW,EAAE;AAChC,MAAI,QAAQ,MAAQ,SAAS,OAAQ,MAAM,OAAO,IAChD,OAAM,IAAI,MAAM,kBAAkB,cAAc,UAAU,KAAK,UAAU,MAAM,GAAG;;;AAKxF,IAAa,kBAAb,MAA6B;CAC3B;;CAEA,0BAA2E,IAAI,KAAK;CAEpF,YAAY,SAAkB;AAC5B,OAAK,WAAW;AAGhB,OAAK,MAAM,UAAU,QAAQ,cAAc,EAAE;GAC3C,MAAM,KAAK,OAAO,QAAQ,IAAI;AAC9B,OAAI,OAAO,GAAI;GACf,MAAM,aAAa,OAAO,MAAM,GAAG,GAAG;GACtC,MAAM,OAAO,OAAO,QAAQ,KAAK,GAAG;GACpC,MAAM,MAAM,OAAO,MAAM,KAAK,GAAG,SAAS,KAAK,KAAA,IAAY,KAAK;GAChE,IAAI;AACJ,OAAI;AACF,YAAQ,mBAAmB,IAAI;WACzB;AACN,YAAQ;;AAEV,QAAK,QAAQ,IAAI,YAAY;IAAE,YAAY;IAAQ,OAAO;KAAE,MAAM;KAAY;KAAO;IAAE,CAAC;;;CAI5F,IACE,GAAG,MAGG;EACN,MAAM,CAAC,MAAM,OAAO,QAAQ,mBAAmB,KAAK;AACpD,qBAAmB,KAAK;EAExB,MAAM,QAAQ,CAAC,GAAG,KAAK,GAAG,mBAAmB,MAAM,GAAG;EACtD,MAAM,OAAO,MAAM,QAAQ;AAC3B,+BAA6B,MAAM,OAAO;AAC1C,QAAM,KAAK,QAAQ,OAAO;AAC1B,MAAI,MAAM,QAAQ;AAChB,gCAA6B,KAAK,QAAQ,SAAS;AACnD,SAAM,KAAK,UAAU,KAAK,SAAS;;AAErC,MAAI,MAAM,WAAW,KAAA,EAAW,OAAM,KAAK,WAAW,KAAK,SAAS;AACpE,MAAI,MAAM,QAAS,OAAM,KAAK,WAAW,KAAK,QAAQ,aAAa,GAAG;AACtE,MAAI,MAAM,SAAU,OAAM,KAAK,WAAW;AAC1C,MAAI,MAAM,OAAQ,OAAM,KAAK,SAAS;AACtC,MAAI,MAAM,SAAU,OAAM,KAAK,YAAY,KAAK,WAAW;AAE3D,OAAK,QAAQ,IAAI,MAAM;GAAE,YAAY,MAAM,KAAK,KAAK;GAAE,OAAO;IAAE;IAAM;IAAO;GAAE,CAAC;AAChF,OAAK,cAAc;AACnB,SAAO;;CAGT,IAAI,GAAG,MAA6E;EAClF,MAAM,MAAM,OAAO,KAAK,OAAO,WAAW,KAAK,KAAK,KAAK,GAAG;AAC5D,SAAO,KAAK,QAAQ,IAAI,IAAI,EAAE;;CAGhC,IAAI,MAAuB;AACzB,SAAO,KAAK,QAAQ,IAAI,KAAK;;CAG/B,OAAO,GAAG,MAAwE;EAChF,MAAM,MAAM,CAAC,GAAG,KAAK,QAAQ,QAAQ,CAAC,CAAC,KAAK,MAAM,EAAE,MAAM;AAC1D,MAAI,KAAK,WAAW,EAAG,QAAO;EAC9B,MAAM,MAAM,OAAO,KAAK,OAAO,WAAW,KAAK,KAAK,KAAK,GAAG;AAC5D,SAAO,IAAI,QAAQ,MAAM,EAAE,SAAS,IAAI;;CAG1C,OACE,GAAG,MAGG;EACN,MAAM,CAAC,MAAM,QACX,OAAO,KAAK,OAAO,WAAW,CAAC,KAAK,IAAI,KAAA,EAAU,GAAG,CAAC,KAAK,GAAG,MAAM,KAAK,GAAG;AAC9E,SAAO,KAAK,IAAI;GACd;GACA,OAAO;GACP,yBAAS,IAAI,KAAK,EAAE;GACpB,MAAM,MAAM;GACZ,QAAQ,MAAM;GACd,UAAU,MAAM;GAChB,QAAQ,MAAM;GACd,UAAU,MAAM;GACjB,CAAC;;CAGJ,CAAC,OAAO,YAAqD;AAK3D,SAJyC,CAAC,GAAG,KAAK,QAAQ,QAAQ,CAAC,CAAC,KAAK,MAAM,CAC7E,EAAE,MAAM,MACR,EAAE,MACH,CAAC,CACa,OAAO,WAAW;;;CAInC,eAA6B;AAC3B,OAAK,SAAS,OAAO,aAAa;AAClC,OAAK,MAAM,EAAE,gBAAgB,KAAK,QAAQ,QAAQ,CAChD,MAAK,SAAS,OAAO,cAAc,WAAW;;;;;;;;AAoBpD,SAAS,mBACP,MAG6C;AAC7C,KAAI,OAAO,KAAK,OAAO,SACrB,QAAO;EAAC,KAAK;EAAI,KAAK;EAAc,KAAK;EAAgC;CAE3E,MAAM,EAAE,MAAM,OAAO,GAAG,SAAS,KAAK;AACtC,QAAO;EAAC;EAAM;EAAO;EAAsB;;;;;;AAwB7C,IAAa,iBAAb,MAA4B;CAC1B;CACA,qBAAiD,EAAE;CAEnD,YAAY,QAA0B;AACpC,OAAK,aAAa,OAAO;;CAG3B,UAAU,SAAiC;AACzC,OAAK,mBAAmB,KAAK,QAAQ;;CAGvC,IAAI,oBAAwC;AAC1C,SAAO,KAAK;;;CAId,iBAA2D;AACzD,SAAO,QAAQ,WAAW,KAAK,mBAAmB;;;;;;;AAYtD,SAAgB,oBAAoB,IAAmC;CACrE,MAAM,QAAQ,MAAM;AACpB,QAAO;EACL,OAAO,+BAA+B,KAAK,MAAM;EACjD,IAAI;EACJ,SAAS,EAAE;EACX,QAAQ,EAAE;EACV,QAAQ,EAAE;EACV,IAAI,EAAE;EACN,KAAK,EAAE;EACR;;AAGH,SAAgB,UAAU,EAAE,WAA4C;AACtE,QAAO,oBAAoB,QAAQ,IAAI,aAAa,IAAI,KAAA,EAAU;;;;;;;;;;;;;AAwBpE,SAAgB,MAAS,MAAiD;AACxE,0BAAyB,UAAU;CAWnC,MAAM,WATU,OAAO,SAAS,aAAa,QAAQ,SAAS,CAAC,KAAK,KAAK,GAAG,MASpD,OAAO,QAAQ;AACrC,UAAQ,MAAM,iCAAiC,IAAI;GACnD;AAWF,6BAA4B,EAAE,UAAU,QAAQ;;;;;;;AAQlD,eAAsB,aAA4B;CAChD,MAAM,EAAE,kBAAkB,4BAA4B,MAAM,OAAO;AACnE,yBAAwB,eAAe;AACvC,mBAAkB;;;;;;;AAQpB,MAAa,aACX,WAAW,qBACJ;AACL,OAAM,IAAI,MACR,iHAED"}

package/dist/shims/slot.d.ts

@@ -0,0 +1,28 @@
+import * as React$1 from "react";
+import * as react_jsx_runtime0 from "react/jsx-runtime";
+
+//#region src/shims/slot.d.ts
+type Elements = Record<string, React$1.ReactNode | typeof UNMATCHED_SLOT>;
+declare const UNMATCHED_SLOT: unique symbol;
+declare const ElementsContext: React$1.Context<Promise<Elements>>;
+declare const ChildrenContext: React$1.Context<React$1.ReactNode>;
+declare const ParallelSlotsContext: React$1.Context<Readonly<Record<string, React$1.ReactNode>> | null>;
+declare function mergeElementsPromise(prev: Promise<Elements>, next: Promise<Elements>): Promise<Elements>;
+declare function Slot({
+  id,
+  children,
+  parallelSlots
+}: {
+  id: string;
+  children?: React$1.ReactNode;
+  parallelSlots?: Readonly<Record<string, React$1.ReactNode>>;
+}): react_jsx_runtime0.JSX.Element | null;
+declare function Children(): React$1.ReactNode;
+declare function ParallelSlot({
+  name
+}: {
+  name: string;
+}): string | number | bigint | boolean | React$1.ReactElement<unknown, string | React$1.JSXElementConstructor<any>> | Iterable<React$1.ReactNode> | Promise<string | number | bigint | boolean | React$1.ReactPortal | React$1.ReactElement<unknown, string | React$1.JSXElementConstructor<any>> | Iterable<React$1.ReactNode> | null | undefined> | null;
+//#endregion
+export { Children, ChildrenContext, Elements, ElementsContext, ParallelSlot, ParallelSlotsContext, Slot, UNMATCHED_SLOT, mergeElementsPromise };
+//# sourceMappingURL=slot.d.ts.map

package/dist/shims/slot.js

@@ -0,0 +1,49 @@
+"use client";
+import { notFound } from "./navigation.js";
+import * as React$1 from "react";
+import { jsx } from "react/jsx-runtime";
+//#region src/shims/slot.tsx
+const EMPTY_ELEMENTS_PROMISE = Promise.resolve(Object.freeze({}));
+const mergeCache = /* @__PURE__ */ new WeakMap();
+const UNMATCHED_SLOT = Symbol.for("vinext.unmatchedSlot");
+const ElementsContext = React$1.createContext(EMPTY_ELEMENTS_PROMISE);
+const ChildrenContext = React$1.createContext(null);
+const ParallelSlotsContext = React$1.createContext(null);
+function mergeElementsPromise(prev, next) {
+	let nextCache = mergeCache.get(prev);
+	if (!nextCache) {
+		nextCache = /* @__PURE__ */ new WeakMap();
+		mergeCache.set(prev, nextCache);
+	}
+	const cached = nextCache.get(next);
+	if (cached) return cached;
+	const merged = Promise.all([prev, next]).then(([prevElements, nextElements]) => ({
+		...prevElements,
+		...nextElements
+	}));
+	nextCache.set(next, merged);
+	return merged;
+}
+function Slot({ id, children, parallelSlots }) {
+	const elements = React$1.use(React$1.useContext(ElementsContext));
+	if (!Object.hasOwn(elements, id)) return null;
+	const element = elements[id];
+	if (element === UNMATCHED_SLOT) notFound();
+	return /* @__PURE__ */ jsx(ParallelSlotsContext.Provider, {
+		value: parallelSlots ?? null,
+		children: /* @__PURE__ */ jsx(ChildrenContext.Provider, {
+			value: children ?? null,
+			children: element
+		})
+	});
+}
+function Children() {
+	return React$1.useContext(ChildrenContext);
+}
+function ParallelSlot({ name }) {
+	return React$1.useContext(ParallelSlotsContext)?.[name] ?? null;
+}
+//#endregion
+export { Children, ChildrenContext, ElementsContext, ParallelSlot, ParallelSlotsContext, Slot, UNMATCHED_SLOT, mergeElementsPromise };
+
+//# sourceMappingURL=slot.js.map

package/dist/shims/slot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slot.js","names":["React"],"sources":["../../src/shims/slot.tsx"],"sourcesContent":["\"use client\";\n\nimport * as React from \"react\";\nimport { notFound } from \"./navigation.js\";\n\nexport type Elements = Record<string, React.ReactNode | typeof UNMATCHED_SLOT>;\n\n// Shared across requests — safe because the resolved value is frozen.\n// A Slot rendered outside an ElementsContext.Provider sees {} and returns null for all IDs.\nconst EMPTY_ELEMENTS_PROMISE = Promise.resolve<Elements>(Object.freeze({}));\n// Client-only optimisation: memoises merged promises by identity so React.use() sees a stable\n// reference across re-renders. During SSR each request creates fresh promises so the cache is\n// never hit, but the WeakMap entries are GC-eligible once the request's promises are collected.\nconst mergeCache = new WeakMap<Promise<Elements>, WeakMap<Promise<Elements>, Promise<Elements>>>();\n\nexport const UNMATCHED_SLOT = Symbol.for(\"vinext.unmatchedSlot\");\n\nexport const ElementsContext = React.createContext<Promise<Elements>>(EMPTY_ELEMENTS_PROMISE);\n\nexport const ChildrenContext = React.createContext<React.ReactNode>(null);\n\nexport const ParallelSlotsContext = React.createContext<Readonly<\n  Record<string, React.ReactNode>\n> | null>(null);\n\nexport function mergeElementsPromise(\n  prev: Promise<Elements>,\n  next: Promise<Elements>,\n): Promise<Elements> {\n  let nextCache = mergeCache.get(prev);\n  if (!nextCache) {\n    nextCache = new WeakMap();\n    mergeCache.set(prev, nextCache);\n  }\n\n  const cached = nextCache.get(next);\n  if (cached) {\n    return cached;\n  }\n\n  // Cached permanently including rejections — intentional because these promises come from\n  // createFromFetch() and a rejection means the navigation itself has failed.\n  const merged = Promise.all([prev, next]).then(([prevElements, nextElements]) => ({\n    ...prevElements,\n    ...nextElements,\n  }));\n  nextCache.set(next, merged);\n  return merged;\n}\n\nexport function Slot({\n  id,\n  children,\n  parallelSlots,\n}: {\n  id: string;\n  children?: React.ReactNode;\n  parallelSlots?: Readonly<Record<string, React.ReactNode>>;\n}) {\n  const elements = React.use(React.useContext(ElementsContext));\n\n  if (!Object.hasOwn(elements, id)) {\n    return null;\n  }\n\n  const element = elements[id];\n  if (element === UNMATCHED_SLOT) {\n    notFound(); // throws — never reaches the JSX below\n  }\n\n  return (\n    <ParallelSlotsContext.Provider value={parallelSlots ?? null}>\n      <ChildrenContext.Provider value={children ?? null}>{element}</ChildrenContext.Provider>\n    </ParallelSlotsContext.Provider>\n  );\n}\n\nexport function Children() {\n  return React.useContext(ChildrenContext);\n}\n\nexport function ParallelSlot({ name }: { name: string }) {\n  const slots = React.useContext(ParallelSlotsContext);\n  return slots?.[name] ?? null;\n}\n"],"mappings":";;;;;AASA,MAAM,yBAAyB,QAAQ,QAAkB,OAAO,OAAO,EAAE,CAAC,CAAC;AAI3E,MAAM,6BAAa,IAAI,SAA2E;AAElG,MAAa,iBAAiB,OAAO,IAAI,uBAAuB;AAEhE,MAAa,kBAAkBA,QAAM,cAAiC,uBAAuB;AAE7F,MAAa,kBAAkBA,QAAM,cAA+B,KAAK;AAEzE,MAAa,uBAAuBA,QAAM,cAEhC,KAAK;AAEf,SAAgB,qBACd,MACA,MACmB;CACnB,IAAI,YAAY,WAAW,IAAI,KAAK;AACpC,KAAI,CAAC,WAAW;AACd,8BAAY,IAAI,SAAS;AACzB,aAAW,IAAI,MAAM,UAAU;;CAGjC,MAAM,SAAS,UAAU,IAAI,KAAK;AAClC,KAAI,OACF,QAAO;CAKT,MAAM,SAAS,QAAQ,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,mBAAmB;EAC/E,GAAG;EACH,GAAG;EACJ,EAAE;AACH,WAAU,IAAI,MAAM,OAAO;AAC3B,QAAO;;AAGT,SAAgB,KAAK,EACnB,IACA,UACA,iBAKC;CACD,MAAM,WAAWA,QAAM,IAAIA,QAAM,WAAW,gBAAgB,CAAC;AAE7D,KAAI,CAAC,OAAO,OAAO,UAAU,GAAG,CAC9B,QAAO;CAGT,MAAM,UAAU,SAAS;AACzB,KAAI,YAAY,eACd,WAAU;AAGZ,QACE,oBAAC,qBAAqB,UAAtB;EAA+B,OAAO,iBAAiB;YACrD,oBAAC,gBAAgB,UAAjB;GAA0B,OAAO,YAAY;aAAO;GAAmC,CAAA;EACzD,CAAA;;AAIpC,SAAgB,WAAW;AACzB,QAAOA,QAAM,WAAW,gBAAgB;;AAG1C,SAAgB,aAAa,EAAE,QAA0B;AAEvD,QADcA,QAAM,WAAW,qBAAqB,GACrC,SAAS"}

package/dist/shims/url-safety.js

@@ -7,12 +7,33 @@
 */
 /**
 * Detect dangerous URI schemes that should never be navigated to.
-* Strips leading whitespace and zero-width characters before testing,
-* since browsers ignore these when interpreting the scheme.
+*
+* Adapted from Next.js's javascript URL detector:
+* packages/next/src/client/lib/javascript-url.ts
+* https://github.com/vercel/next.js/blob/canary/packages/next/src/client/lib/javascript-url.ts
+*
+* URL parsing ignores leading C0 control characters / spaces, and treats
+* embedded tab/newline characters in the scheme as insignificant. We mirror
+* that behavior here so obfuscated values like `java\nscript:` and
+* `\x00javascript:` are still blocked.
+*
+* Vinext intentionally extends this handling to `data:` and `vbscript:` too,
+* since both are also dangerous navigation targets.
 */
-const DANGEROUS_SCHEME_RE = /^[\s\u200B\uFEFF]*(javascript|data|vbscript)\s*:/i;
+const LEADING_IGNORED = "[\\u0000-\\u001F \\u200B\\uFEFF]*";
+const SCHEME_IGNORED = "[\\r\\n\\t]*";
+function buildDangerousSchemeRegex(scheme) {
+	const chars = scheme.split("").join(SCHEME_IGNORED);
+	return new RegExp(`^${LEADING_IGNORED}${chars}${SCHEME_IGNORED}:`, "i");
+}
+const DANGEROUS_SCHEME_RES = [
+	buildDangerousSchemeRegex("javascript"),
+	buildDangerousSchemeRegex("data"),
+	buildDangerousSchemeRegex("vbscript")
+];
 function isDangerousScheme(url) {
-	return DANGEROUS_SCHEME_RE.test(url);
+	const str = "" + url;
+	return DANGEROUS_SCHEME_RES.some((re) => re.test(str));
 }
 //#endregion
 export { isDangerousScheme };

package/dist/shims/url-safety.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-safety.js","names":[],"sources":["../../src/shims/url-safety.ts"],"sourcesContent":["/**\n * Shared URL safety utilities for Link, Form, and navigation shims.\n *\n * Centralizes dangerous URI scheme detection so all components and\n * navigation functions use the same validation logic.\n */\n\n/**\n * Detect dangerous URI schemes that should never be navigated to.\n * Strips leading whitespace and zero-width characters before testing,\n * since browsers ignore these when interpreting the scheme.\n */\nconst DANGEROUS_SCHEME_RE = /^[\\s\\u200B\\uFEFF]*(javascript|data|vbscript)\\s*:/i;\n\nexport function isDangerousScheme(url: string): boolean {\n  return DANGEROUS_SCHEME_RE.test(url);\n}\n"],"mappings":";;;;;;;;;;;;AAYA,MAAM,sBAAsB;AAE5B,SAAgB,kBAAkB,KAAsB;AACtD,QAAO,oBAAoB,KAAK,IAAI"}
+{"version":3,"file":"url-safety.js","names":[],"sources":["../../src/shims/url-safety.ts"],"sourcesContent":["/**\n * Shared URL safety utilities for Link, Form, and navigation shims.\n *\n * Centralizes dangerous URI scheme detection so all components and\n * navigation functions use the same validation logic.\n */\n\n/**\n * Detect dangerous URI schemes that should never be navigated to.\n *\n * Adapted from Next.js's javascript URL detector:\n * packages/next/src/client/lib/javascript-url.ts\n * https://github.com/vercel/next.js/blob/canary/packages/next/src/client/lib/javascript-url.ts\n *\n * URL parsing ignores leading C0 control characters / spaces, and treats\n * embedded tab/newline characters in the scheme as insignificant. We mirror\n * that behavior here so obfuscated values like `java\\nscript:` and\n * `\\x00javascript:` are still blocked.\n *\n * Vinext intentionally extends this handling to `data:` and `vbscript:` too,\n * since both are also dangerous navigation targets.\n */\nconst LEADING_IGNORED = \"[\\\\u0000-\\\\u001F \\\\u200B\\\\uFEFF]*\";\nconst SCHEME_IGNORED = \"[\\\\r\\\\n\\\\t]*\";\n\nfunction buildDangerousSchemeRegex(scheme: string): RegExp {\n  const chars = scheme.split(\"\").join(SCHEME_IGNORED);\n  return new RegExp(`^${LEADING_IGNORED}${chars}${SCHEME_IGNORED}:`, \"i\");\n}\n\nconst DANGEROUS_SCHEME_RES = [\n  buildDangerousSchemeRegex(\"javascript\"),\n  buildDangerousSchemeRegex(\"data\"),\n  buildDangerousSchemeRegex(\"vbscript\"),\n];\n\nexport function isDangerousScheme(url: string): boolean {\n  const str = \"\" + (url as unknown as string);\n  return DANGEROUS_SCHEME_RES.some((re) => re.test(str));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAsBA,MAAM,kBAAkB;AACxB,MAAM,iBAAiB;AAEvB,SAAS,0BAA0B,QAAwB;CACzD,MAAM,QAAQ,OAAO,MAAM,GAAG,CAAC,KAAK,eAAe;AACnD,QAAO,IAAI,OAAO,IAAI,kBAAkB,QAAQ,eAAe,IAAI,IAAI;;AAGzE,MAAM,uBAAuB;CAC3B,0BAA0B,aAAa;CACvC,0BAA0B,OAAO;CACjC,0BAA0B,WAAW;CACtC;AAED,SAAgB,kBAAkB,KAAsB;CACtD,MAAM,MAAM,KAAM;AAClB,QAAO,qBAAqB,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vinext",
-  "version": "0.0.39",
+  "version": "0.0.41",
   "description": "Run Next.js apps on Vite. Drop-in replacement for the next CLI.",
   "license": "MIT",
   "repository": {
@@ -58,7 +58,6 @@
     "@unpic/react": "^1.0.2",
     "@vercel/og": "^0.8.6",
     "magic-string": "^0.30.21",
-    "rsc-html-stream": "^0.0.7",
     "vite-plugin-commonjs": "^0.10.4",
     "vite-tsconfig-paths": "^6.1.1"
   },
@@ -67,18 +66,18 @@
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.1",
-    "@vitejs/plugin-rsc": "^0.5.21",
-    "react-server-dom-webpack": "^19.2.4",
+    "@vitejs/plugin-rsc": "^0.5.23",
+    "react-server-dom-webpack": "^19.2.5",
     "vite": "npm:@voidzero-dev/vite-plus-core@0.1.12",
     "vite-plus": "0.1.12"
   },
   "peerDependencies": {
     "@mdx-js/rollup": "^3.0.0",
     "@vitejs/plugin-react": "^5.1.4 || ^6.0.0",
-    "@vitejs/plugin-rsc": "^0.5.21",
-    "react": ">=19.2.0",
-    "react-dom": ">=19.2.0",
-    "react-server-dom-webpack": "^19.2.4",
+    "@vitejs/plugin-rsc": "^0.5.23",
+    "react": "^19.2.5",
+    "react-dom": "^19.2.5",
+    "react-server-dom-webpack": "^19.2.5",
     "vite": "^7.0.0 || ^8.0.0"
   },
   "peerDependenciesMeta": {