vinext 0.0.55 → 0.1.1

package/dist/server/isr-cache.d.ts

@@ -5,6 +5,42 @@ import { normalizeMountedSlotsHeader } from "./app-mounted-slots-header.js";
 import { AppRscRenderMode } from "./app-rsc-render-mode.js";
 
 //#region src/server/isr-cache.d.ts
+/**
+ * Header set on the internal request that `res.revalidate()` issues to
+ * trigger on-demand ISR regeneration of a Pages Router route. Mirrors Next.js's
+ * `PRERENDER_REVALIDATE_HEADER` (`x-prerender-revalidate`) — see
+ * `.nextjs-ref/packages/next/src/lib/constants.ts`.
+ *
+ * SECURITY: in Next.js this header is NOT a presence flag — it carries the
+ * secret `previewModeId`, and `checkIsOnDemandRevalidate`
+ * (`.nextjs-ref/packages/next/src/server/api-utils/index.ts`) only treats a
+ * request as on-demand revalidation when the value *equals* that secret. If we
+ * gated on presence alone, any external client could send
+ * `x-prerender-revalidate: <anything>` to force synchronous regeneration of any
+ * ISR page, bypassing the fresh/stale cache short-circuits — a
+ * cache-stampede/DoS vector. We therefore validate the value against
+ * {@link getRevalidateSecret} (a build-time secret shared across all Workers
+ * isolates) with a constant-time comparison, and only the matching value (sent
+ * by our own `res.revalidate()`) is honored.
+ */
+declare const PRERENDER_REVALIDATE_HEADER = "x-prerender-revalidate";
+/**
+ * Companion header to {@link PRERENDER_REVALIDATE_HEADER}. When set,
+ * `res.revalidate(path, { unstable_onlyGenerated: true })` only revalidates the
+ * path if it was already generated, and a 404 response counts as a successful
+ * no-op. Mirrors Next.js's `PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER`
+ * (`x-prerender-revalidate-if-generated`) — see
+ * `.nextjs-ref/packages/next/src/lib/constants.ts`.
+ */
+declare const PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER = "x-prerender-revalidate-if-generated";
+declare function getRevalidateSecret(): string;
+/**
+ * Authorize an incoming request as an on-demand revalidation trigger. Mirrors
+ * Next.js's `checkIsOnDemandRevalidate`: the {@link PRERENDER_REVALIDATE_HEADER}
+ * value must *equal* the process revalidate secret. Header presence alone is
+ * NOT sufficient — see the security note on {@link PRERENDER_REVALIDATE_HEADER}.
+ */
+declare function isOnDemandRevalidateRequest(headerValue: string | string[] | null | undefined): boolean;
 type ISRCacheEntry = {
   value: CacheHandlerValue;
   isStale: boolean;
@@ -24,6 +60,14 @@ declare function isrSet(key: string, data: IncrementalCacheValue, revalidateSeco
 declare function isrSetPrerenderedAppPage(key: string, data: CachedAppPageValue, metadata: {
   expireSeconds?: number;
   revalidateSeconds?: number;
+  /**
+   * Implicit/path tags to attach to the seeded entry. Required so that
+   * `revalidatePath()` (and `revalidateTag()`) can invalidate prerender-seeded
+   * cache entries — without tags the entry is unreachable by tag-based
+   * invalidation and remains stale until natural `revalidateAt` expiry.
+   * See cloudflare/vinext#1486.
+   */
+  tags?: string[];
 }): Promise<void>;
 /**
  * Trigger a background regeneration for a cache key.
@@ -56,7 +100,7 @@ declare function buildAppPageCacheValue(html: string, rscData?: ArrayBuffer, sta
  * Compute an ISR cache key for a given router type and pathname.
  * Long pathnames are hashed to stay within KV key-length limits (512 bytes).
  */
-declare function isrCacheKey(router: "pages" | "app", pathname: string, buildId?: string): string;
+declare function isrCacheKey(router: string, pathname: string, buildId?: string): string;
 declare function appIsrHtmlKey(pathname: string): string;
 /**
  * Build the ISR cache key for an RSC payload.
@@ -80,5 +124,4 @@ declare function setRevalidateDuration(key: string, seconds: number): void;
  */
 declare function getRevalidateDuration(key: string): number | undefined;
 //#endregion
-export { ISRCacheEntry, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, getRevalidateDuration, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, setRevalidateDuration, triggerBackgroundRegeneration };
-//# sourceMappingURL=isr-cache.d.ts.map
+export { ISRCacheEntry, PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, getRevalidateDuration, getRevalidateSecret, isOnDemandRevalidateRequest, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, setRevalidateDuration, triggerBackgroundRegeneration };

package/dist/server/isr-cache.js

@@ -1,25 +1,95 @@
 import { getRequestExecutionContext } from "../shims/request-context.js";
 import { reportRequestError } from "./instrumentation.js";
 import { fnv1a64 } from "../utils/hash.js";
-import { getCacheHandler } from "../shims/cache.js";
+import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { normalizeMountedSlotsHeader } from "./app-mounted-slots-header.js";
 import { APP_RSC_RENDER_MODE_NAVIGATION, getRscRenderModeCacheVariant } from "./app-rsc-render-mode.js";
 import { normalizeAppPageInterceptionProofPathname } from "./app-page-render-identity.js";
 //#region src/server/isr-cache.ts
 /**
-* ISR (Incremental Static Regeneration) cache layer.
+* Header set on the internal request that `res.revalidate()` issues to
+* trigger on-demand ISR regeneration of a Pages Router route. Mirrors Next.js's
+* `PRERENDER_REVALIDATE_HEADER` (`x-prerender-revalidate`) — see
+* `.nextjs-ref/packages/next/src/lib/constants.ts`.
 *
-* Wraps the pluggable CacheHandler with stale-while-revalidate semantics:
-* - Fresh hit: serve immediately
-* - Stale hit: serve immediately + trigger background regeneration
-* - Miss: render synchronously, cache, serve
+* SECURITY: in Next.js this header is NOT a presence flag — it carries the
+* secret `previewModeId`, and `checkIsOnDemandRevalidate`
+* (`.nextjs-ref/packages/next/src/server/api-utils/index.ts`) only treats a
+* request as on-demand revalidation when the value *equals* that secret. If we
+* gated on presence alone, any external client could send
+* `x-prerender-revalidate: <anything>` to force synchronous regeneration of any
+* ISR page, bypassing the fresh/stale cache short-circuits — a
+* cache-stampede/DoS vector. We therefore validate the value against
+* {@link getRevalidateSecret} (a build-time secret shared across all Workers
+* isolates) with a constant-time comparison, and only the matching value (sent
+* by our own `res.revalidate()`) is honored.
+*/
+const PRERENDER_REVALIDATE_HEADER = "x-prerender-revalidate";
+/**
+* Companion header to {@link PRERENDER_REVALIDATE_HEADER}. When set,
+* `res.revalidate(path, { unstable_onlyGenerated: true })` only revalidates the
+* path if it was already generated, and a 404 response counts as a successful
+* no-op. Mirrors Next.js's `PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER`
+* (`x-prerender-revalidate-if-generated`) — see
+* `.nextjs-ref/packages/next/src/lib/constants.ts`.
+*/
+const PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER = "x-prerender-revalidate-if-generated";
+/**
+* Build-time secret that authenticates on-demand revalidation requests, the
+* vinext analog of Next.js's prerender-manifest `previewModeId`.
 *
-* Background regeneration is deduped — only one regeneration per cache key
-* runs at a time, preventing thundering herd on popular pages.
+* `res.revalidate()` loops back into the server via an internal `fetch()`. On
+* Cloudflare Workers that loopback can land on a *different* isolate than the
+* sender, so a per-process random secret would mismatch across isolates and
+* false-reject legitimate revalidations (and, symmetrically, two isolates with
+* independently-rolled secrets could never agree). The fix mirrors Next.js's
+* `previewModeId`: the secret is generated once at BUILD time and baked
+* (server-only — never into the client bundle) into every server bundle via the
+* `__VINEXT_REVALIDATE_SECRET` Vite `define`, so it is byte-for-byte identical in
+* every isolate. See `vinext build` CLI (`__VINEXT_SHARED_REVALIDATE_SECRET`) and
+* the `vinext:compiler-define-server` plugin. The sender attaches it as the
+* {@link PRERENDER_REVALIDATE_HEADER} value; the receiver authorizes a request
+* only when the incoming value equals this secret (see
+* {@link isOnDemandRevalidateRequest}).
 *
-* This layer works with any CacheHandler backend (memory, Redis, KV, etc.)
-* because it only uses the standard get/set interface.
+* When the build-time define is absent — dev mode, and any path that doesn't
+* run through `vinext build` — we fall back to a lazily-generated random secret.
+* Those paths are single-process, so a module-scoped value is shared by sender
+* and receiver there — no regression.
 */
+let devRevalidateSecret;
+function getRevalidateSecret() {
+	const baked = process.env.__VINEXT_REVALIDATE_SECRET;
+	if (baked) return baked;
+	if (devRevalidateSecret === void 0) {
+		const bytes = new Uint8Array(32);
+		crypto.getRandomValues(bytes);
+		devRevalidateSecret = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+	}
+	return devRevalidateSecret;
+}
+/**
+* Constant-time string equality. Avoids leaking secret length / prefix via
+* early-exit timing on the on-demand revalidation auth check. Returns false
+* for length mismatch (the only safe option without revealing the secret
+* length, and equality is impossible anyway).
+*/
+function safeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let mismatch = 0;
+	for (let i = 0; i < a.length; i++) mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return mismatch === 0;
+}
+/**
+* Authorize an incoming request as an on-demand revalidation trigger. Mirrors
+* Next.js's `checkIsOnDemandRevalidate`: the {@link PRERENDER_REVALIDATE_HEADER}
+* value must *equal* the process revalidate secret. Header presence alone is
+* NOT sufficient — see the security note on {@link PRERENDER_REVALIDATE_HEADER}.
+*/
+function isOnDemandRevalidateRequest(headerValue) {
+	if (typeof headerValue !== "string" || headerValue.length === 0) return false;
+	return safeEqual(headerValue, getRevalidateSecret());
+}
 /**
 * Get a cache entry with staleness information.
 *
@@ -28,7 +98,7 @@ import { normalizeAppPageInterceptionProofPathname } from "./app-page-render-ide
 * or null for cache misses.
 */
 async function isrGet(key) {
-	const result = await getCacheHandler().get(key);
+	const result = await getCdnCacheAdapter().get(key);
 	if (!result || !result.value) return null;
 	if (result.cacheState === "expired") return null;
 	return {
@@ -40,7 +110,7 @@ async function isrGet(key) {
 * Store a value in the ISR cache with a revalidation period.
 */
 async function isrSet(key, data, revalidateSeconds, tags, expireSeconds) {
-	await getCacheHandler().set(key, data, {
+	await getCdnCacheAdapter().set(key, data, {
 		cacheControl: expireSeconds === void 0 ? { revalidate: revalidateSeconds } : {
 			revalidate: revalidateSeconds,
 			expire: expireSeconds
@@ -50,19 +120,19 @@ async function isrSet(key, data, revalidateSeconds, tags, expireSeconds) {
 	});
 }
 async function isrSetPrerenderedAppPage(key, data, metadata) {
-	const handler = getCacheHandler();
 	const revalidateSeconds = metadata.revalidateSeconds;
+	const tags = metadata.tags;
 	if (process.env.NEXT_PRIVATE_DEBUG_CACHE) console.debug("[vinext] ISR: seed", key);
-	await handler.set(key, data, revalidateSeconds === void 0 ? {} : metadata.expireSeconds === void 0 ? {
-		cacheControl: { revalidate: revalidateSeconds },
-		revalidate: revalidateSeconds
-	} : {
-		cacheControl: {
+	const ctx = {};
+	if (revalidateSeconds !== void 0) {
+		ctx.revalidate = revalidateSeconds;
+		ctx.cacheControl = metadata.expireSeconds === void 0 ? { revalidate: revalidateSeconds } : {
 			revalidate: revalidateSeconds,
 			expire: metadata.expireSeconds
-		},
-		revalidate: revalidateSeconds
-	});
+		};
+	}
+	if (tags && tags.length > 0) ctx.tags = tags;
+	await getCdnCacheAdapter().set(key, data, ctx);
 	if (revalidateSeconds !== void 0) setRevalidateDuration(key, revalidateSeconds);
 }
 const _PENDING_REGEN_KEY = Symbol.for("vinext.isrCache.pendingRegenerations");
@@ -83,6 +153,7 @@ const pendingRegenerations = _g[_PENDING_REGEN_KEY] ??= /* @__PURE__ */ new Map(
 * `revalidateReason: "stale"`.
 */
 function triggerBackgroundRegeneration(key, renderFn, errorContext) {
+	if (!getCdnCacheAdapter().ownsBackgroundRevalidation) return;
 	if (pendingRegenerations.has(key)) return;
 	const promise = renderFn().catch((err) => {
 		console.error(`[vinext] ISR background regeneration failed for ${key}:`, err);
@@ -208,6 +279,4 @@ function getRevalidateDuration(key) {
 	return revalidateDurations.get(key);
 }
 //#endregion
-export { appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, getRevalidateDuration, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, setRevalidateDuration, triggerBackgroundRegeneration };
-
-//# sourceMappingURL=isr-cache.js.map
+export { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, getRevalidateDuration, getRevalidateSecret, isOnDemandRevalidateRequest, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, setRevalidateDuration, triggerBackgroundRegeneration };

package/dist/server/metadata-route-build-data.d.ts

@@ -21,5 +21,4 @@ declare function createMetadataRouteEntryData(route: MetadataFileRoute): Metadat
 declare function createMetadataRouteEntrySource(input: MetadataRouteEntrySourceInput): string;
 declare function createMetadataRouteEntriesSource(routes: readonly MetadataFileRoute[], moduleNames: ReadonlyMap<string, string>): string[];
 //#endregion
-export { createMetadataRouteEntriesSource, createMetadataRouteEntryData, createMetadataRouteEntrySource };
-//# sourceMappingURL=metadata-route-build-data.d.ts.map
+export { createMetadataRouteEntriesSource, createMetadataRouteEntryData, createMetadataRouteEntrySource };

package/dist/server/metadata-route-build-data.js

@@ -146,5 +146,3 @@ function createMetadataRouteEntriesSource(routes, moduleNames) {
 }
 //#endregion
 export { createMetadataRouteEntriesSource, createMetadataRouteEntryData, createMetadataRouteEntrySource };
-
-//# sourceMappingURL=metadata-route-build-data.js.map

package/dist/server/metadata-route-response.d.ts

@@ -13,5 +13,4 @@ type MetadataRouteRequestOptions = {
 };
 declare function handleMetadataRouteRequest(options: MetadataRouteRequestOptions): Promise<Response | null>;
 //#endregion
-export { handleMetadataRouteRequest };
-//# sourceMappingURL=metadata-route-response.d.ts.map
+export { handleMetadataRouteRequest };

package/dist/server/metadata-route-response.js

@@ -201,5 +201,3 @@ async function handleMetadataRouteRequest(options) {
 }
 //#endregion
 export { handleMetadataRouteRequest };
-
-//# sourceMappingURL=metadata-route-response.js.map

package/dist/server/metadata-routes.d.ts

@@ -136,5 +136,4 @@ declare function matchMetadataFileBaseName(metaType: string, baseName: string):
  */
 declare function scanMetadataFiles(appDir: string): MetadataFileRoute[];
 //#endregion
-export { METADATA_FILE_MAP, ManifestConfig, MetadataFileRoute, MetadataRouteHeadData, RobotsConfig, RobotsRule, SitemapEntry, fillStaticMetadataSegment, getMetadataImageRouteKind, getMetadataRouteKind, isValidMetadataImageId, manifestToJson, matchMetadataFileBaseName, matchMetadataRoutePattern, robotsToText, scanMetadataFiles, sitemapToXml };
-//# sourceMappingURL=metadata-routes.d.ts.map
+export { METADATA_FILE_MAP, ManifestConfig, MetadataFileRoute, MetadataRouteHeadData, RobotsConfig, SitemapEntry, fillStaticMetadataSegment, getMetadataImageRouteKind, getMetadataRouteKind, isValidMetadataImageId, manifestToJson, matchMetadataFileBaseName, matchMetadataRoutePattern, robotsToText, scanMetadataFiles, sitemapToXml };

package/dist/server/metadata-routes.js

@@ -431,5 +431,3 @@ function getStaticContentType(ext, fallback) {
 }
 //#endregion
 export { METADATA_FILE_MAP, fillStaticMetadataSegment, getMetadataImageRouteKind, getMetadataRouteKind, isValidMetadataImageId, manifestToJson, matchMetadataFileBaseName, matchMetadataRoutePattern, robotsToText, scanMetadataFiles, sitemapToXml };
-
-//# sourceMappingURL=metadata-routes.js.map

package/dist/server/middleware-matcher.d.ts

@@ -11,5 +11,4 @@ type MatcherConfig = string | Array<string | MiddlewareMatcherObject>;
 declare function matchesMiddleware(pathname: string, matcher: MatcherConfig | undefined, request?: Request, i18nConfig?: NextI18nConfig | null): boolean;
 declare function matchPattern(pathname: string, pattern: string): boolean;
 //#endregion
-export { MatcherConfig, MiddlewareMatcherObject, matchPattern, matchesMiddleware };
-//# sourceMappingURL=middleware-matcher.d.ts.map
+export { MatcherConfig, matchPattern, matchesMiddleware };

package/dist/server/middleware-matcher.js

@@ -98,5 +98,3 @@ function compileMatcherPattern(pattern) {
 }
 //#endregion
 export { matchPattern, matchesMiddleware };
-
-//# sourceMappingURL=middleware-matcher.js.map

package/dist/server/middleware-request-headers.d.ts

@@ -8,5 +8,4 @@ declare function encodeMiddlewareRequestHeaders(targetHeaders: Headers, requestH
 declare function buildRequestHeadersFromMiddlewareResponse(baseHeaders: Headers, middlewareHeaders: MiddlewareHeaderSource, options?: BuildRequestHeadersOptions): Headers | null;
 declare function shouldKeepMiddlewareHeader(key: string): boolean;
 //#endregion
-export { buildRequestHeadersFromMiddlewareResponse, encodeMiddlewareRequestHeaders, shouldKeepMiddlewareHeader };
-//# sourceMappingURL=middleware-request-headers.d.ts.map
+export { buildRequestHeadersFromMiddlewareResponse, encodeMiddlewareRequestHeaders, shouldKeepMiddlewareHeader };

package/dist/server/middleware-request-headers.js

@@ -63,5 +63,3 @@ function shouldKeepMiddlewareHeader(key) {
 }
 //#endregion
 export { buildRequestHeadersFromMiddlewareResponse, encodeMiddlewareRequestHeaders, shouldKeepMiddlewareHeader };
-
-//# sourceMappingURL=middleware-request-headers.js.map

package/dist/server/middleware-response-headers.d.ts

@@ -9,5 +9,4 @@ declare function mergeVaryHeader(target: Headers, value: string): void;
  */
 declare function mergeMiddlewareResponseHeaders(target: Headers, middlewareHeaders: Headers | null): void;
 //#endregion
-export { mergeMiddlewareResponseHeaders, mergeVaryHeader };
-//# sourceMappingURL=middleware-response-headers.d.ts.map
+export { mergeMiddlewareResponseHeaders, mergeVaryHeader };

package/dist/server/middleware-response-headers.js

@@ -40,5 +40,3 @@ function mergeMiddlewareResponseHeaders(target, middlewareHeaders) {
 }
 //#endregion
 export { mergeMiddlewareResponseHeaders, mergeVaryHeader };
-
-//# sourceMappingURL=middleware-response-headers.js.map

package/dist/server/middleware-runtime.d.ts

@@ -51,5 +51,4 @@ declare function resolveMiddlewareModuleHandler(mod: MiddlewareModule, options:
 declare function executeMiddleware(options: ExecuteMiddlewareOptions): Promise<MiddlewareResult>;
 declare function runGeneratedMiddleware(options: RunGeneratedMiddlewareOptions): Promise<MiddlewareResult>;
 //#endregion
-export { MiddlewareModule, MiddlewareResult, executeMiddleware, resolveMiddlewareModuleHandler, runGeneratedMiddleware };
-//# sourceMappingURL=middleware-runtime.d.ts.map
+export { MiddlewareModule, MiddlewareResult, executeMiddleware, resolveMiddlewareModuleHandler, runGeneratedMiddleware };

package/dist/server/middleware-runtime.js

@@ -154,15 +154,26 @@ async function executeMiddleware(options) {
 		const location = response.headers.get("Location") ?? response.headers.get("location");
 		if (location) {
 			const relativeLocation = relativizeLocation(location, options.request.url);
+			let normalizedLocation = relativeLocation;
+			if (options.trailingSlash !== void 0) try {
+				const loc = new URL(relativeLocation, options.request.url);
+				if (loc.origin === new URL(options.request.url).origin) {
+					const p = loc.pathname;
+					let normalized = null;
+					if (p !== "" && p !== "/") if (options.trailingSlash) normalized = p.endsWith("/") ? null : p + "/";
+					else normalized = p.endsWith("/") ? p.slice(0, -1) : null;
+					if (normalized !== null) normalizedLocation = normalized + loc.search + loc.hash;
+				}
+			} catch {}
 			if (options.isDataRequest) return {
 				continue: false,
-				response: dataRedirectResponse(relativeLocation, response),
+				response: dataRedirectResponse(normalizedLocation, response),
 				waitUntilPromises
 			};
 			const responseHeaders = new Headers();
 			for (const [key, value] of response.headers) if (!key.startsWith("x-middleware-") && key.toLowerCase() !== "location") responseHeaders.append(key, value);
 			const relativizedResponseHeaders = new Headers(response.headers);
-			relativizedResponseHeaders.set("Location", relativeLocation);
+			relativizedResponseHeaders.set("Location", normalizedLocation);
 			const relativizedResponse = new Response(response.body, {
 				status: response.status,
 				statusText: response.statusText,
@@ -170,7 +181,7 @@ async function executeMiddleware(options) {
 			});
 			return {
 				continue: false,
-				redirectUrl: relativeLocation,
+				redirectUrl: normalizedLocation,
 				redirectStatus: response.status,
 				response: stripMiddlewareHeadersFromResponse(relativizedResponse),
 				responseHeaders,
@@ -210,5 +221,3 @@ async function runGeneratedMiddleware(options) {
 }
 //#endregion
 export { executeMiddleware, resolveMiddlewareModuleHandler, runGeneratedMiddleware };
-
-//# sourceMappingURL=middleware-runtime.js.map

package/dist/server/middleware.d.ts

@@ -1,5 +1,5 @@
-import { ValidFileMatcher } from "../routing/file-matcher.js";
 import { NextI18nConfig } from "../config/next-config.js";
+import { ValidFileMatcher } from "../routing/file-matcher.js";
 import { MiddlewareModule, MiddlewareResult } from "./middleware-runtime.js";
 import { matchPattern, matchesMiddleware } from "./middleware-matcher.js";
 import { ModuleRunner } from "vite/module-runner";
@@ -59,5 +59,4 @@ declare function findMiddlewareFile(root: string, fileMatcher: ValidFileMatcher)
  */
 declare function runMiddleware(runner: ModuleRunner, middlewarePath: string, request: Request, i18nConfig?: NextI18nConfig | null, basePath?: string, trailingSlash?: boolean, isDataRequest?: boolean): Promise<MiddlewareResult>;
 //#endregion
-export { findMiddlewareFile, isProxyFile, matchPattern, matchesMiddleware, resolveMiddlewareHandler, runMiddleware };
-//# sourceMappingURL=middleware.d.ts.map
+export { findMiddlewareFile, isProxyFile, matchPattern, matchesMiddleware, resolveMiddlewareHandler, runMiddleware };

package/dist/server/middleware.js

@@ -96,5 +96,3 @@ async function runMiddleware(runner, middlewarePath, request, i18nConfig, basePa
 }
 //#endregion
 export { findMiddlewareFile, isProxyFile, matchPattern, matchesMiddleware, resolveMiddlewareHandler, runMiddleware };
-
-//# sourceMappingURL=middleware.js.map

package/dist/server/navigation-planner.d.ts

@@ -126,6 +126,21 @@ declare function classifyRootBoundaryTransition(currentRootBoundaryId: string |
 declare function resolveSameLayoutAncestorPersistence(currentSnapshot: RouteSnapshotV0, targetSnapshot: RouteSnapshotV0): readonly string[];
 declare function resolveMountedParallelSlotPersistence(currentSnapshot: RouteSnapshotV0, targetSnapshot: RouteSnapshotV0): readonly string[];
 declare function resolveCurrentRootBoundaryElementPersistence(currentSnapshot: RouteSnapshotV0, targetSnapshot: RouteSnapshotV0): readonly string[];
+/**
+ * Default/unmatched slot preservation law:
+ *
+ * A target default/unmatched slot may reuse previous content only when:
+ * - the slot's owner layout is part of the preserved layout ancestor set;
+ * - the current visible snapshot proves the same slot had renderable content;
+ * - the navigation is not a traversal.
+ *
+ * Wire absence and UNMATCHED_SLOT markers are not semantic proof.
+ */
+declare function resolveDefaultOrUnmatchedSlotPersistenceForLayouts(options: {
+  currentSlotBindings: readonly ParallelSlotBindingSnapshotV0[];
+  preservedLayoutIds: readonly string[];
+  targetSlotBindings: readonly ParallelSlotBindingSnapshotV0[];
+}): readonly string[];
 declare function planNavigation(input: NavigationPlannerInput): NavigationDecisionV0;
 declare const navigationPlanner: {
   classifyRootBoundaryTransition: typeof classifyRootBoundaryTransition;
@@ -135,5 +150,4 @@ declare const navigationPlanner: {
   resolveSameLayoutAncestorPersistence: typeof resolveSameLayoutAncestorPersistence;
 };
 //#endregion
-export { CommitProposal, FlightResultV0, HardNavigationReason, InterceptionSnapshotV0, MountedParallelSlotSnapshotV0, NavigationDecisionV0, NavigationEvent, NavigationPlannerInput, NavigationPlannerStateV0, NoCommitReason, OperationLane, OperationToken, ParallelSlotBindingSnapshotV0, RefreshScope, RequestedWork, RootBoundaryTransition, RouteSnapshotV0, TraverseDirection, navigationPlanner };
-//# sourceMappingURL=navigation-planner.d.ts.map
+export { FlightResultV0, InterceptionSnapshotV0, MountedParallelSlotSnapshotV0, NavigationDecisionV0, NavigationEvent, NavigationPlannerInput, NavigationPlannerStateV0, OperationLane, OperationToken, ParallelSlotBindingSnapshotV0, RefreshScope, RootBoundaryTransition, RouteSnapshotV0, TraverseDirection, navigationPlanner, resolveDefaultOrUnmatchedSlotPersistenceForLayouts };

package/dist/server/navigation-planner.js

@@ -1,5 +1,5 @@
 import { splitPathnameForRouteMatch } from "../routing/utils.js";
-import { matchRoutePattern, matchRoutePatternPrefix } from "../routing/route-pattern.js";
+import { matchRoutePattern, matchRoutePatternPrefix, matchRoutePatternWithOptionalDynamicSegments } from "../routing/route-pattern.js";
 import { compareAppElementsSlotIds } from "./app-elements-wire.js";
 import "./app-elements.js";
 import { NavigationTraceReasonCodes, createNavigationLifecycleTraceFields, createNavigationTrace } from "./navigation-trace.js";
@@ -119,8 +119,10 @@ function findRouteManifestInterceptionForProof(routeManifest, proof) {
 	const candidateInterceptions = routeManifest.segmentGraph.interceptionsBySlotId.get(proof.slotId) ?? [];
 	for (const interception of candidateInterceptions) {
 		if (!matchRoutePatternPrefix(sourceParts, interception.sourcePatternParts)) continue;
-		if (matchRoutePattern(targetParts, interception.targetPatternParts) === null) continue;
-		if (interception.targetRouteId !== null && targetRoute?.id !== interception.targetRouteId) continue;
+		const exactTargetParams = matchRoutePattern(targetParts, interception.targetPatternParts);
+		const allowsMiddlewareRewriteTarget = exactTargetParams === null && matchRoutePatternWithOptionalDynamicSegments(targetParts, interception.targetPatternParts);
+		if (exactTargetParams === null && !allowsMiddlewareRewriteTarget) continue;
+		if (!allowsMiddlewareRewriteTarget && interception.targetRouteId !== null && targetRoute?.id !== interception.targetRouteId) continue;
 		return interception;
 	}
 	return null;
@@ -500,6 +502,4 @@ const navigationPlanner = {
 	resolveSameLayoutAncestorPersistence
 };
 //#endregion
-export { navigationPlanner };
-
-//# sourceMappingURL=navigation-planner.js.map
+export { navigationPlanner, resolveDefaultOrUnmatchedSlotPersistenceForLayouts };

package/dist/server/navigation-trace.d.ts

@@ -47,5 +47,4 @@ declare function createNavigationLifecycleTraceFields(options: {
 declare function createNavigationTrace(code: NavigationTraceCode, fields?: NavigationTraceFields): NavigationTrace;
 declare function prependNavigationTraceEntry(trace: NavigationTrace, code: NavigationTraceCode, fields?: NavigationTraceFields): NavigationTrace;
 //#endregion
-export { NAVIGATION_TRACE_SCHEMA_VERSION, NavigationTrace, NavigationTraceCode, NavigationTraceEntry, NavigationTraceFieldName, NavigationTraceFieldValue, NavigationTraceFields, NavigationTraceReasonCode, NavigationTraceReasonCodes, NavigationTraceSchemaVersion, NavigationTraceTransactionCode, NavigationTraceTransactionCodes, createNavigationLifecycleTraceFields, createNavigationTrace, prependNavigationTraceEntry };
-//# sourceMappingURL=navigation-trace.d.ts.map
+export { NAVIGATION_TRACE_SCHEMA_VERSION, NavigationTrace, NavigationTraceFields, NavigationTraceReasonCode, NavigationTraceReasonCodes, NavigationTraceTransactionCode, NavigationTraceTransactionCodes, createNavigationLifecycleTraceFields, createNavigationTrace, prependNavigationTraceEntry };

package/dist/server/navigation-trace.js

@@ -51,5 +51,3 @@ function prependNavigationTraceEntry(trace, code, fields = {}) {
 }
 //#endregion
 export { NAVIGATION_TRACE_SCHEMA_VERSION, NavigationTraceReasonCodes, NavigationTraceTransactionCodes, createNavigationLifecycleTraceFields, createNavigationTrace, prependNavigationTraceEntry };
-
-//# sourceMappingURL=navigation-trace.js.map

package/dist/server/next-error-digest.d.ts

@@ -41,5 +41,4 @@ declare function parseNextRedirectDigest(digest: string): NextRedirectDigest | n
  */
 declare function parseNextHttpErrorDigest(digest: string): NextHttpErrorDigest | null;
 //#endregion
-export { getNextErrorDigest, parseNextHttpErrorDigest, parseNextRedirectDigest };
-//# sourceMappingURL=next-error-digest.d.ts.map
+export { getNextErrorDigest, parseNextHttpErrorDigest, parseNextRedirectDigest };

package/dist/server/next-error-digest.js

@@ -38,5 +38,3 @@ function parseNextHttpErrorDigest(digest) {
 }
 //#endregion
 export { getNextErrorDigest, parseNextHttpErrorDigest, parseNextRedirectDigest };
-
-//# sourceMappingURL=next-error-digest.js.map

package/dist/server/normalize-path.d.ts

@@ -43,5 +43,4 @@ declare function isInterceptionMatchedUrlPath(value: string): boolean;
  */
 declare function normalizePath(pathname: string): string;
 //#endregion
-export { decodePathParams, escapePathDelimiters, isInterceptionMatchedUrlPath, normalizePath };
-//# sourceMappingURL=normalize-path.d.ts.map
+export { decodePathParams, escapePathDelimiters, isInterceptionMatchedUrlPath, normalizePath };

package/dist/server/normalize-path.js

@@ -66,5 +66,3 @@ function normalizePath(pathname) {
 }
 //#endregion
 export { decodePathParams, escapePathDelimiters, isInterceptionMatchedUrlPath, normalizePath };
-
-//# sourceMappingURL=normalize-path.js.map

package/dist/server/pages-api-route.d.ts

@@ -63,5 +63,4 @@ type HandlePagesApiRouteOptions = {
 };
 declare function handlePagesApiRoute(options: HandlePagesApiRouteOptions): Promise<Response>;
 //#endregion
-export { PagesApiRouteMatch, handlePagesApiRoute };
-//# sourceMappingURL=pages-api-route.d.ts.map
+export { PagesApiRouteMatch, handlePagesApiRoute };

package/dist/server/pages-api-route.js

@@ -38,7 +38,7 @@ async function _handlePagesApiRoute(options) {
 		const query = buildPagesApiQuery(options.url, params);
 		const bodyParserConfig = resolveBodyParserConfig(route.module.config);
 		const { req, res, responsePromise } = createPagesReqRes({
-			body: bodyParserConfig.enabled ? await parsePagesApiBody(options.request, bodyParserConfig.sizeLimit) : options.request.body ?? void 0,
+			body: bodyParserConfig.enabled ? await parsePagesApiBody(options.request, bodyParserConfig.sizeLimit) : void 0,
 			query,
 			request: options.request,
 			url: options.url
@@ -57,5 +57,3 @@ async function _handlePagesApiRoute(options) {
 }
 //#endregion
 export { handlePagesApiRoute };
-
-//# sourceMappingURL=pages-api-route.js.map

package/dist/server/pages-asset-tags.d.ts

@@ -0,0 +1,66 @@
+//#region src/server/pages-asset-tags.d.ts
+/**
+ * Pages Router SSR asset-tag helpers.
+ *
+ * Builds the `<link rel="modulepreload">`, `<link rel="stylesheet">`, and
+ * `<script type="module">` tags injected into the SSR HTML response.
+ *
+ * Extracted from `entries/pages-server-entry.ts` so the logic is
+ * unit-testable and lives in a normal typed module rather than a codegen
+ * template string.
+ */
+/**
+ * Resolve the effective SSR manifest: prefer the caller-supplied object (dev
+ * or test) and fall back to the Worker-embedded `globalThis.__VINEXT_SSR_MANIFEST__`
+ * injected by `vinext:cloudflare-build` at build time.
+ */
+declare function resolveSsrManifest(manifest: Record<string, string[]> | null | undefined): Record<string, string[]> | null;
+/**
+ * Look up the asset-file list for a module ID in the SSR manifest.
+ *
+ * The manifest keys may use relative paths while callers supply absolute
+ * paths, so a suffix-match fallback is used when an exact-key lookup fails.
+ */
+declare function getManifestFilesForModule(manifest: Record<string, string[]> | null | undefined, moduleId: string | null | undefined): string[] | null;
+/**
+ * Find the first `.js` file in the manifest for `moduleId` and return its
+ * URL-path form (with a leading `/`). Used to resolve the hydration URL for
+ * the matched page or the `_app` module.
+ */
+declare function resolveClientModuleUrl(manifest: Record<string, string[]> | null | undefined, moduleId: string | null | undefined): string | undefined;
+type CollectAssetTagsOptions = {
+  /**
+   * SSR manifest mapping module file paths to their associated asset list.
+   * When empty/null the Worker-embedded `__VINEXT_SSR_MANIFEST__` is used.
+   */
+  manifest: Record<string, string[]> | null | undefined;
+  /**
+   * Module IDs whose assets should be injected (page + `_app`). When empty
+   * all manifest assets are injected.
+   */
+  moduleIds: (string | null | undefined)[]; /** Script nonce for CSP. */
+  scriptNonce?: string;
+  /**
+   * When `false` (default), page scripts are emitted with the `defer`
+   * attribute mirroring Next.js's `experimental.disableOptimizedLoading`
+   * default.
+   */
+  disableOptimizedLoading: boolean;
+};
+/**
+ * Build the HTML `<link>` and `<script>` tag string for the SSR response.
+ *
+ * Mirrors Next.js `_document` behaviour:
+ * - CSS files → `<link rel="stylesheet">`.
+ * - JS files → `<link rel="modulepreload">` + `<script type="module" defer>`.
+ * - Lazy chunks (behind `React.lazy` / `next/dynamic`) are skipped.
+ * - The Worker-embedded client-entry bootstrap (`__VINEXT_CLIENT_ENTRY__`) is
+ *   injected first so hydration starts as early as possible.
+ * - Shared framework / vinext runtime chunks are always included alongside
+ *   page-specific chunks.
+ *
+ * Extracted from `entries/pages-server-entry.ts`.
+ */
+declare function collectAssetTags(options: CollectAssetTagsOptions): string;
+//#endregion
+export { collectAssetTags, getManifestFilesForModule, resolveClientModuleUrl, resolveSsrManifest };