vinext 1.0.0-beta.0 → 1.0.0-beta.2

package/dist/server/pages-page-response.d.ts

@@ -33,11 +33,11 @@ type PagesFontPreload = {
 /**
  * The `__NEXT_DATA__` fields beyond the always-present core that the Pages
  * renderer serializes: the `__vinext` block plus the readiness flags
- * (gssp/gsp/gip/appGip/autoExport/isExperimentalCompile) the client uses to
+ * (gssp/gsp/gip/appGip/autoExport/nextExport/isExperimentalCompile) the client uses to
  * recompute the initial `router.isReady`. Shared by every render path
  * (initial, ISR regeneration) so they emit identical readiness state.
  */
-type PagesNextDataExtras = Pick<VinextNextData, "__vinext" | "appGip" | "autoExport" | "gip" | "gsp" | "gssp" | "isExperimentalCompile">;
+type PagesNextDataExtras = Pick<VinextNextData, "__vinext" | "appGip" | "autoExport" | "gip" | "gsp" | "gssp" | "isExperimentalCompile" | "nextExport">;
 type PagesI18nRenderContext = {
   locale?: string;
   locales?: string[];

package/dist/server/pages-page-response.js

@@ -72,7 +72,7 @@ function buildPagesNextDataScript(options) {
 	const nextDataPayload = {
 		props: options.props ?? { pageProps: options.pageProps },
 		page: options.routePattern,
-		query: options.params,
+		query: options.isFallback === true ? {} : options.params,
 		buildId: options.buildId,
 		isFallback: options.isFallback === true
 	};

package/dist/server/pages-preview.d.ts

@@ -0,0 +1,26 @@
+//#region src/server/pages-preview.d.ts
+declare const PAGES_PREVIEW_CACHE_CONTROL = "private, no-cache, no-store, max-age=0, must-revalidate";
+type PagesPreviewData = object | string;
+type PagesPreviewState = {
+  data: PagesPreviewData | false;
+  shouldClear: boolean;
+};
+type PreviewResponse = {
+  getHeader(name: string): string | number | boolean | string[] | undefined;
+  setHeader(name: string, value: string | number | boolean | string[]): unknown;
+};
+declare function getPagesPreviewModeId(): string;
+declare function getPagesPreviewState(cookieHeader: string | string[] | null | undefined, options?: {
+  isOnDemandRevalidate?: boolean;
+}): PagesPreviewState;
+declare function setPagesDraftMode(response: PreviewResponse, enabled: boolean): void;
+declare function setPagesPreviewData(response: PreviewResponse, data: PagesPreviewData, options?: {
+  maxAge?: number;
+  path?: string;
+}): void;
+declare function clearPagesPreviewData(response: PreviewResponse, options?: {
+  path?: string;
+}): void;
+declare function appendPagesPreviewClearCookies(headers: Headers): void;
+//#endregion
+export { PAGES_PREVIEW_CACHE_CONTROL, PagesPreviewData, PagesPreviewState, appendPagesPreviewClearCookies, clearPagesPreviewData, getPagesPreviewModeId, getPagesPreviewState, setPagesDraftMode, setPagesPreviewData };

package/dist/server/pages-preview.js

@@ -0,0 +1,165 @@
+import { parseCookieHeader } from "../utils/parse-cookie.js";
+import { createCipheriv, createDecipheriv, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+//#region src/server/pages-preview.ts
+const PAGES_PREVIEW_CACHE_CONTROL = "private, no-cache, no-store, max-age=0, must-revalidate";
+const pagesPreviewCookiesCleared = Symbol("__prerender_bypass");
+let devCredentials;
+function decodeKey(value) {
+	if (!value || !/^[0-9a-f]{64}$/i.test(value)) return null;
+	return Buffer.from(value, "hex");
+}
+function getPagesPreviewCredentials() {
+	const bypassId = process.env.__VINEXT_PREVIEW_MODE_ID;
+	const encryptionKey = decodeKey(process.env.__VINEXT_PREVIEW_MODE_ENCRYPTION_KEY);
+	const signingKey = decodeKey(process.env.__VINEXT_PREVIEW_MODE_SIGNING_KEY);
+	if (bypassId && encryptionKey && signingKey) return {
+		bypassId,
+		encryptionKey,
+		signingKey
+	};
+	if (!devCredentials) devCredentials = {
+		bypassId: randomBytes(16).toString("hex"),
+		encryptionKey: randomBytes(32),
+		signingKey: randomBytes(32)
+	};
+	return devCredentials;
+}
+function getPagesPreviewModeId() {
+	return getPagesPreviewCredentials().bypassId;
+}
+function serializeCookie(name, value, options = {}) {
+	const parts = [
+		`${name}=${encodeURIComponent(value)}`,
+		"HttpOnly",
+		`Path=${options.path ?? "/"}`,
+		process.env.NODE_ENV !== "development" ? "SameSite=None" : "SameSite=Lax"
+	];
+	if (process.env.NODE_ENV !== "development") parts.push("Secure");
+	if (options.maxAge !== void 0) parts.push(`Max-Age=${Math.trunc(options.maxAge)}`);
+	return parts.join("; ");
+}
+function serializeClearedCookie(name, options = {}) {
+	return [
+		`${name}=`,
+		"Expires=Thu, 01 Jan 1970 00:00:00 GMT",
+		"HttpOnly",
+		`Path=${options.path ?? "/"}`,
+		process.env.NODE_ENV !== "development" ? "SameSite=None" : "SameSite=Lax",
+		...process.env.NODE_ENV !== "development" ? ["Secure"] : []
+	].join("; ");
+}
+function normalizeSetCookie(value) {
+	if (value === void 0) return [];
+	return Array.isArray(value) ? value.map(String) : [String(value)];
+}
+function encodePayload(data, maxAge) {
+	const iv = randomBytes(12);
+	const credentials = getPagesPreviewCredentials();
+	const cipher = createCipheriv("aes-256-gcm", credentials.encryptionKey, iv);
+	const plaintext = JSON.stringify({
+		data,
+		...maxAge === void 0 ? {} : { expiresAt: Date.now() + maxAge * 1e3 }
+	});
+	const encryptedToken = [
+		iv,
+		Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]),
+		cipher.getAuthTag()
+	].map((part) => part.toString("base64url")).join(".");
+	return `${encryptedToken}.${createHmac("sha256", credentials.signingKey).update(encryptedToken).digest("base64url")}`;
+}
+function decodePayload(payload) {
+	try {
+		const [ivValue, encryptedValue, tagValue, signatureValue, ...extra] = payload.split(".");
+		if (!ivValue || !encryptedValue || !tagValue || !signatureValue || extra.length > 0) return false;
+		const encryptedToken = `${ivValue}.${encryptedValue}.${tagValue}`;
+		const credentials = getPagesPreviewCredentials();
+		const expected = createHmac("sha256", credentials.signingKey).update(encryptedToken).digest();
+		const signature = Buffer.from(signatureValue, "base64url");
+		if (signature.length !== expected.length || !timingSafeEqual(signature, expected)) return false;
+		const decipher = createDecipheriv("aes-256-gcm", credentials.encryptionKey, Buffer.from(ivValue, "base64url"));
+		decipher.setAuthTag(Buffer.from(tagValue, "base64url"));
+		const decoded = Buffer.concat([decipher.update(Buffer.from(encryptedValue, "base64url")), decipher.final()]).toString("utf8");
+		const value = JSON.parse(decoded);
+		if (typeof value !== "object" || value === null || !("data" in value)) return false;
+		const expiresAt = "expiresAt" in value ? value.expiresAt : void 0;
+		if (typeof expiresAt === "number" && Date.now() >= expiresAt) return false;
+		const data = value.data;
+		return typeof data === "object" && data !== null ? data : String(data);
+	} catch {
+		return false;
+	}
+}
+function getPagesPreviewState(cookieHeader, options = {}) {
+	if (options.isOnDemandRevalidate) return {
+		data: false,
+		shouldClear: false
+	};
+	const cookies = parseCookieHeader(Array.isArray(cookieHeader) ? cookieHeader.join("; ") : cookieHeader);
+	const bypass = cookies.__prerender_bypass;
+	const payload = cookies.__next_preview_data;
+	if (!bypass && !payload) return {
+		data: false,
+		shouldClear: false
+	};
+	if (!bypass || bypass !== getPagesPreviewCredentials().bypassId) return {
+		data: false,
+		shouldClear: true
+	};
+	if (!payload) return {
+		data: {},
+		shouldClear: false
+	};
+	const data = decodePayload(payload);
+	return {
+		data,
+		shouldClear: data === false
+	};
+}
+function setPagesDraftMode(response, enabled) {
+	const cookie = enabled ? serializeCookie("__prerender_bypass", getPagesPreviewModeId()) : serializeClearedCookie("__prerender_bypass");
+	response.setHeader("Set-Cookie", [...normalizeSetCookie(response.getHeader("Set-Cookie")), cookie]);
+}
+function setPagesPreviewData(response, data, options = {}) {
+	const payload = encodePayload(data, options.maxAge);
+	if (payload.length > 2048) throw new Error("Preview data is limited to 2KB currently, reduce how much data you are storing as preview data to continue");
+	response.setHeader("Set-Cookie", [
+		...normalizeSetCookie(response.getHeader("Set-Cookie")),
+		serializeCookie("__prerender_bypass", getPagesPreviewModeId(), options),
+		serializeCookie("__next_preview_data", payload, options)
+	]);
+}
+function clearPagesPreviewData(response, options = {}) {
+	if (pagesPreviewCookiesCleared in response) return;
+	response.setHeader("Set-Cookie", [
+		...normalizeSetCookie(response.getHeader("Set-Cookie")),
+		serializeClearedCookie("__prerender_bypass", options),
+		serializeClearedCookie("__next_preview_data", options)
+	]);
+	Object.defineProperty(response, pagesPreviewCookiesCleared, {
+		value: true,
+		enumerable: false
+	});
+}
+function appendPagesPreviewClearCookies(headers) {
+	const cookies = headers.getSetCookie();
+	const hasExpiredCookie = (name) => cookies.some((cookie) => {
+		const [cookieValue, ...attributes] = cookie.split(";").map((part) => part.trim());
+		if (!cookieValue?.startsWith(`${name}=`)) return false;
+		let expiresAtEpoch = false;
+		let path;
+		let hasDomain = false;
+		for (const attribute of attributes) {
+			const separator = attribute.indexOf("=");
+			const attributeName = (separator === -1 ? attribute : attribute.slice(0, separator)).trim().toLowerCase();
+			const attributeValue = separator === -1 ? "" : attribute.slice(separator + 1).trim();
+			if (attributeName === "expires") expiresAtEpoch = Date.parse(attributeValue) === 0;
+			if (attributeName === "path") path = attributeValue;
+			if (attributeName === "domain") hasDomain = true;
+		}
+		return expiresAtEpoch && path === "/" && !hasDomain;
+	});
+	if (!hasExpiredCookie("__prerender_bypass")) headers.append("Set-Cookie", serializeClearedCookie("__prerender_bypass"));
+	if (!hasExpiredCookie("__next_preview_data")) headers.append("Set-Cookie", serializeClearedCookie("__next_preview_data"));
+}
+//#endregion
+export { PAGES_PREVIEW_CACHE_CONTROL, appendPagesPreviewClearCookies, clearPagesPreviewData, getPagesPreviewModeId, getPagesPreviewState, setPagesDraftMode, setPagesPreviewData };

package/dist/server/pages-readiness.d.ts

@@ -7,9 +7,9 @@ import { PagesPageModule } from "./pages-page-data.js";
  *
  * The initial `router.isReady` value for the `next/navigation` compat hooks is
  * derived from the page/_app data-fetching exports plus the configured-rewrites
- * flag, serialized into `__NEXT_DATA__`. The dev SSR handler and the production
- * Pages page handler must compute this identically so server HTML and client
- * hydration agree — see `getPagesNavigationIsReadyFromSerializedState` in
+ * flag. The client recomputes readiness from those flags and its live URL,
+ * matching the Pages Router constructor; server-only readiness remains in the
+ * request context. See `getPagesNavigationIsReadyFromSerializedState` in
  * `shims/router.ts`.
  */
 /**
@@ -18,7 +18,7 @@ import { PagesPageModule } from "./pages-page-data.js";
  * The field names/types are projected from the canonical `VinextNextData` so
  * this stays in lockstep with the `__NEXT_DATA__` shape it feeds into.
  */
-type PagesReadinessNextData = Pick<VinextNextData, "gssp" | "gsp" | "gip" | "appGip" | "autoExport"> & {
+type PagesReadinessNextData = Pick<VinextNextData, "gssp" | "gsp" | "gip" | "appGip" | "autoExport" | "nextExport"> & {
   __vinext: Pick<NonNullable<VinextNextData["__vinext"]>, "hasRewrites">;
 };
 /**
@@ -29,6 +29,7 @@ declare function buildPagesReadinessNextData(options: {
   pageModule: PagesPageModule;
   appComponent: {
     getInitialProps?: unknown;
+    origGetInitialProps?: unknown;
   } | null | undefined;
   hasRewrites: boolean;
 }): PagesReadinessNextData;

package/dist/server/pages-readiness.js

@@ -7,13 +7,15 @@ function buildPagesReadinessNextData(options) {
 	const hasPageGssp = typeof options.pageModule.getServerSideProps === "function";
 	const hasPageGsp = typeof options.pageModule.getStaticProps === "function";
 	const hasPageGip = typeof options.pageModule.default?.getInitialProps === "function";
-	const hasAppGip = typeof options.appComponent?.getInitialProps === "function";
+	const hasAppGip = typeof options.appComponent?.getInitialProps === "function" && options.appComponent.getInitialProps !== options.appComponent.origGetInitialProps;
+	const autoExport = !hasPageGssp && !hasPageGsp && !hasPageGip && !hasAppGip;
 	return {
 		gssp: hasPageGssp,
 		gsp: hasPageGsp ? true : void 0,
 		gip: hasPageGip,
 		appGip: hasAppGip,
-		autoExport: !hasPageGssp && !hasPageGsp && !hasPageGip && !hasAppGip,
+		autoExport,
+		nextExport: autoExport ? true : void 0,
 		__vinext: { hasRewrites: options.hasRewrites }
 	};
 }

package/dist/server/pages-request-pipeline.d.ts

@@ -44,6 +44,7 @@ type PagesPipelineDeps = {
   hasMiddleware: boolean;
   ctx?: unknown;
   rawSearch?: string;
+  configMatchPathname?: string;
   matchPageRoute?: ((pathname: string, request: Request) => PageRouteMatch | null) | null;
   runMiddleware?: ((request: Request, ctx: unknown, opts: {
     isDataRequest: boolean;

package/dist/server/pages-request-pipeline.js

@@ -1,10 +1,13 @@
 import { addBasePathToPathname, hasBasePath } from "../utils/base-path.js";
 import { patternToNextFormat } from "../routing/route-validation.js";
-import { applyMiddlewareRequestHeaders, isExternalUrl, matchRedirect, matchRewrite, preserveRedirectDestinationQuery, proxyExternalRequest, requestContextFromRequest, sanitizeDestination } from "../config/config-matchers.js";
-import { applyConfigHeadersToHeaderRecord, cloneRequestWithUrl, normalizeTrailingSlash } from "./request-pipeline.js";
+import { requestContextFromRequest } from "../config/request-context.js";
+import { isExternalUrl } from "../utils/external-url.js";
+import { applyMiddlewareRequestHeaders, matchRedirect, matchRewrite, preserveRedirectDestinationQuery, proxyExternalRequest, sanitizeDestination } from "../config/config-matchers.js";
+import { cloneRequestWithUrl, normalizeTrailingSlash } from "./request-pipeline.js";
 import { mergeRewriteQuery } from "../utils/query.js";
 import { normalizeDefaultLocalePathname, stripI18nLocaleForApiRoute } from "./pages-i18n.js";
 import { buildMiddlewarePrefetchSkipResponse } from "./pages-data-route.js";
+import { applyConfigHeadersToHeaderRecord } from "./config-headers.js";
 import { mergeHeaders } from "./worker-utils.js";
 //#region src/server/pages-request-pipeline.ts
 async function fetchWorkerFilesystemRoute(request, requestPathname, phase, fetchAsset) {
@@ -53,6 +56,7 @@ async function runPagesRequest(request, deps) {
 	const url = new URL(request.url);
 	let pathname = url.pathname;
 	const search = url.search;
+	const requestConfigPathname = deps.configMatchPathname ?? pathname;
 	const basePathState = {
 		basePath,
 		hadBasePath
@@ -66,9 +70,9 @@ async function runPagesRequest(request, deps) {
 	}
 	const reqCtx = requestContextFromRequest(request);
 	const requestHostname = i18nConfig ? url.hostname : "";
-	const matchPathname = i18nConfig ? normalizeDefaultLocalePathname(pathname, i18nConfig, { hostname: requestHostname }) : pathname;
+	const requestConfigMatchPathname = i18nConfig ? normalizeDefaultLocalePathname(requestConfigPathname, i18nConfig, { hostname: requestHostname }) : requestConfigPathname;
 	if (configRedirects.length) {
-		const redirect = matchRedirect(matchPathname, configRedirects, reqCtx, basePathState);
+		const redirect = matchRedirect(requestConfigMatchPathname, configRedirects, reqCtx, basePathState);
 		if (redirect) {
 			const location = preserveRedirectDestinationQuery(sanitizeDestination(basePath && hadBasePath && !isExternalUrl(redirect.destination) && !hasBasePath(redirect.destination, basePath) ? basePath + redirect.destination : redirect.destination), deps.rawSearch ?? search);
 			return {
@@ -82,6 +86,7 @@ async function runPagesRequest(request, deps) {
 	}
 	const originalResolvedUrl = pathname + search;
 	let resolvedUrl = originalResolvedUrl;
+	let resolvedPathnameIsRequestPathname = true;
 	const middlewareHeaders = {};
 	let middlewareStatus;
 	const serveFilesystemRoute = async (requestPathname, phase) => {
@@ -131,7 +136,10 @@ async function runPagesRequest(request, deps) {
 			else if (existing) middlewareHeaders[key] = [existing, value];
 			else middlewareHeaders[key] = [value];
 		} else middlewareHeaders[key] = value;
-		if (result.rewriteUrl) resolvedUrl = result.rewriteUrl;
+		if (result.rewriteUrl) {
+			resolvedUrl = result.rewriteUrl;
+			resolvedPathnameIsRequestPathname = false;
+		}
 		middlewareStatus = result.status ?? result.rewriteStatus;
 	}
 	const { postMwReqCtx, request: postMwReq } = applyMiddlewareRequestHeaders(middlewareHeaders, request, { preserveCredentialHeaders: isExternalUrl(resolvedUrl) });
@@ -143,6 +151,7 @@ async function runPagesRequest(request, deps) {
 	});
 	let resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
 	const matchResolvedPathname = (p) => i18nConfig ? normalizeDefaultLocalePathname(p, i18nConfig, { hostname: requestHostname }) : p;
+	const configSourcePathname = () => resolvedPathnameIsRequestPathname ? requestConfigMatchPathname : matchResolvedPathname(resolvedPathname);
 	const matchedPathnameForRoute = (routePattern) => {
 		const matchedPathname = routePattern ? patternToNextFormat(routePattern) : resolvedPathname;
 		if (!i18nConfig) return matchedPathname;
@@ -161,7 +170,7 @@ async function runPagesRequest(request, deps) {
 	};
 	if (configHeaders.length) applyConfigHeadersToHeaderRecord(middlewareHeaders, {
 		configHeaders,
-		pathname: matchPathname,
+		pathname: requestConfigMatchPathname,
 		requestContext: reqCtx,
 		basePathState
 	});
@@ -173,7 +182,7 @@ async function runPagesRequest(request, deps) {
 	if (directFilesystemResult) return directFilesystemResult;
 	let configRewriteFired = false;
 	for (const rewrite of configRewrites.beforeFiles ?? []) {
-		const rewritten = matchRewrite(matchResolvedPathname(resolvedPathname), [rewrite], rewriteRequestContext(), basePathState);
+		const rewritten = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), basePathState);
 		if (rewritten) {
 			if (isExternalUrl(rewritten)) return {
 				type: "response",
@@ -181,6 +190,7 @@ async function runPagesRequest(request, deps) {
 			};
 			resolvedUrl = mergeRewriteQuery(resolvedUrl, rewritten);
 			resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
+			resolvedPathnameIsRequestPathname = false;
 			configRewriteFired = true;
 		}
 	}
@@ -227,7 +237,7 @@ async function runPagesRequest(request, deps) {
 	let pageMatch = !isOutsideBasePathUnclaimed() && deps.matchPageRoute ? deps.matchPageRoute(resolvedPathname, request) : null;
 	let resolvedPathnameChanged = false;
 	if (!pageMatch || pageMatch.route.isDynamic) for (const rewrite of configRewrites.afterFiles ?? []) {
-		const rewritten = matchRewrite(matchResolvedPathname(resolvedPathname), [rewrite], rewriteRequestContext(), basePathState);
+		const rewritten = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), basePathState);
 		if (rewritten) {
 			if (isExternalUrl(rewritten)) return {
 				type: "response",
@@ -235,6 +245,7 @@ async function runPagesRequest(request, deps) {
 			};
 			resolvedUrl = mergeRewriteQuery(resolvedUrl, rewritten);
 			resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
+			resolvedPathnameIsRequestPathname = false;
 			configRewriteFired = true;
 			resolvedPathnameChanged = true;
 			const afterFilesFilesystemResult = await serveFilesystemRoute(resolvedPathname, "afterFiles");
@@ -253,7 +264,7 @@ async function runPagesRequest(request, deps) {
 	if (typeof deps.renderPage === "function") {
 		let renderPageMatch = pageMatch;
 		if ((isOutsideBasePathUnclaimed() || isDataReq || isDataRequest) && !renderPageMatch && configRewrites.fallback?.length) for (const rewrite of configRewrites.fallback) {
-			const fallbackRewrite = matchRewrite(matchResolvedPathname(resolvedPathname), [rewrite], rewriteRequestContext(), basePathState);
+			const fallbackRewrite = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), basePathState);
 			if (!fallbackRewrite) continue;
 			if (isExternalUrl(fallbackRewrite)) return {
 				type: "response",
@@ -261,6 +272,7 @@ async function runPagesRequest(request, deps) {
 			};
 			resolvedUrl = mergeRewriteQuery(resolvedUrl, fallbackRewrite);
 			resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
+			resolvedPathnameIsRequestPathname = false;
 			configRewriteFired = true;
 			const fallbackFilesystemResult = await serveFilesystemRoute(resolvedPathname, "fallback");
 			if (fallbackFilesystemResult) return fallbackFilesystemResult;
@@ -281,7 +293,7 @@ async function runPagesRequest(request, deps) {
 		let response = await deps.renderPage(request, resolvedUrl, initialRenderOptions, stagedHeaders);
 		let matchedFallbackRewrite = false;
 		if (response.status === 404 && shouldDeferErrorPageOnMiss && configRewrites.fallback?.length) for (const rewrite of configRewrites.fallback) {
-			const fallbackRewrite = matchRewrite(matchResolvedPathname(resolvedPathname), [rewrite], rewriteRequestContext(), basePathState);
+			const fallbackRewrite = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), basePathState);
 			if (!fallbackRewrite) continue;
 			if (isExternalUrl(fallbackRewrite)) return {
 				type: "response",
@@ -289,6 +301,7 @@ async function runPagesRequest(request, deps) {
 			};
 			resolvedUrl = mergeRewriteQuery(resolvedUrl, fallbackRewrite);
 			resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
+			resolvedPathnameIsRequestPathname = false;
 			configRewriteFired = true;
 			const fallbackFilesystemResult = await serveFilesystemRoute(resolvedPathname, "fallback");
 			if (fallbackFilesystemResult) return fallbackFilesystemResult;
@@ -325,7 +338,7 @@ async function runPagesRequest(request, deps) {
 	}
 	let devPageMatch = isOutsideBasePathUnclaimed() ? null : resolvedPathnameChanged ? deps.matchPageRoute ? deps.matchPageRoute(resolvedPathname, request) : null : pageMatch;
 	if (!devPageMatch && configRewrites.fallback?.length) for (const rewrite of configRewrites.fallback) {
-		const fallbackRewrite = matchRewrite(matchResolvedPathname(resolvedPathname), [rewrite], rewriteRequestContext(), basePathState);
+		const fallbackRewrite = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), basePathState);
 		if (!fallbackRewrite) continue;
 		if (isExternalUrl(fallbackRewrite)) return {
 			type: "response",
@@ -333,6 +346,7 @@ async function runPagesRequest(request, deps) {
 		};
 		resolvedUrl = mergeRewriteQuery(resolvedUrl, fallbackRewrite);
 		resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
+		resolvedPathnameIsRequestPathname = false;
 		configRewriteFired = true;
 		const fallbackFilesystemResult = await serveFilesystemRoute(resolvedPathname, "fallback");
 		if (fallbackFilesystemResult) return fallbackFilesystemResult;

package/dist/server/pages-router-entry.js

@@ -1,3 +1,4 @@
+import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { notFoundStaticAssetResponse } from "./http-error-responses.js";
 import { isOpenRedirectShaped } from "./open-redirect.js";
@@ -52,6 +53,11 @@ async function handleRequest(request, env, ctx) {
 	try {
 		let pathname = new URL(request.url).pathname;
 		if (isOpenRedirectShaped(pathname)) return new Response("This page could not be found", { status: 404 });
+		try {
+			normalizePathnameForRouteMatchStrict(pathname);
+		} catch {
+			return new Response("Bad Request", { status: 400 });
+		}
 		const missingBuildAsset = isNextStaticPath(pathname, basePath, assetPathPrefix);
 		request = cloneRequestWithHeaders(request, filterInternalHeaders(request.headers));
 		const hadBasePath = !basePath || hasBasePath(pathname, basePath);

package/dist/server/prerender-route-params.js

@@ -58,11 +58,11 @@ function decodedPrerenderRouteParamEquals(prerenderValue, matchedValue) {
 		if (prerenderValue.length !== matchedValue.length) return false;
 		return prerenderValue.every((item, index) => {
 			const decoded = decodePrerenderRouteParam(item);
-			return decoded !== null && decoded === matchedValue[index];
+			return item === matchedValue[index] || decoded !== null && decoded === matchedValue[index];
 		});
 	}
 	const decoded = decodePrerenderRouteParam(prerenderValue);
-	return decoded !== null && decoded === matchedValue;
+	return prerenderValue === matchedValue || decoded !== null && decoded === matchedValue;
 }
 function prerenderRouteParamsPayloadMatchesRoute(payload, routePattern, params) {
 	return matchPrerenderRouteParamsPayload(payload, routePattern, params)?.kind === "exact";

package/dist/server/prod-server.d.ts

@@ -101,10 +101,7 @@ declare function tryServeStatic(req: IncomingMessage, res: ServerResponse, clien
  * Convert a Node.js IncomingMessage to a Web Request object.
  *
  * When `urlOverride` is provided, it is used as the path + query string
- * instead of `req.url`. This avoids redundant path normalization when the
- * caller has already decoded and normalized the pathname (e.g. the App
- * Router prod server normalizes before static-asset lookup, and can pass
- * the result here so the downstream RSC handler doesn't re-normalize).
+ * instead of `req.url`.
  */
 declare function nodeToWebRequest(req: IncomingMessage, urlOverride?: string, prerenderSecret?: string): Request;
 /**

package/dist/server/prod-server.js

@@ -1,3 +1,4 @@
+import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER } from "../utils/protocol-headers.js";
@@ -5,9 +6,9 @@ import { VINEXT_STATIC_FILE_HEADER } from "./headers.js";
 import { normalizePath } from "./normalize-path.js";
 import { notFoundResponse } from "./http-error-responses.js";
 import { isOpenRedirectShaped } from "./open-redirect.js";
-import { filterInternalHeaders } from "./request-pipeline.js";
+import { canonicalizeRequestPathname, filterInternalHeaders } from "./request-pipeline.js";
 import { isUnknownRecord } from "../utils/record.js";
-import { buildNextDataNotFoundResponse, isNextDataPathname, normalizeNextDataPagePathname, parseNextDataPathname } from "./pages-data-route.js";
+import { buildNextDataNotFoundResponse, encodeUrlParserIgnoredCharacters, isNextDataPathname, normalizeNextDataPagePathname, parseNextDataPathname, urlParserCreatesPagesDataPath } from "./pages-data-route.js";
 import { ASSET_PREFIX_URL_DIR, assetPrefixPathname, isAbsoluteAssetPrefix } from "../utils/asset-prefix.js";
 import { setPagesClientAssets } from "./pages-client-assets.js";
 import { resolveRequestHost, resolveRequestProtocol, trustProxy, trustedHosts } from "./proxy-trust.js";
@@ -23,8 +24,7 @@ import { readPrerenderSecret } from "../build/server-manifest.js";
 import { seedMemoryCacheFromPrerender } from "./seed-cache.js";
 import { negotiateEncoding, parseAcceptedEncodings, selectContentEncoding } from "./accept-encoding.js";
 import fs from "node:fs";
-import path from "node:path";
-import fs$1 from "node:fs/promises";
+import fsp from "node:fs/promises";
 import { pathToFileURL } from "node:url";
 import { Readable, pipeline } from "node:stream";
 import zlib from "node:zlib";
@@ -159,7 +159,7 @@ function readNodeStream(req) {
 	});
 }
 /** Content types that benefit from compression. */
-const COMPRESSIBLE_TYPES = new Set([
+const COMPRESSIBLE_TYPES = /* @__PURE__ */ new Set([
 	"text/html",
 	"text/css",
 	"text/plain",
@@ -237,13 +237,13 @@ function nodeHeadersToWebHeaders(headersRecord) {
 	for (const [key, value] of Object.entries(headersRecord)) appendWebHeader(headers, key, value);
 	return headers;
 }
-const NO_BODY_RESPONSE_STATUSES = new Set([
+const NO_BODY_RESPONSE_STATUSES = /* @__PURE__ */ new Set([
 	204,
 	205,
 	304
 ]);
-const OMIT_BODY_HEADERS = new Set(["content-length", "content-type"]);
-const OMIT_STATIC_RESPONSE_HEADERS = new Set([
+const OMIT_BODY_HEADERS = /* @__PURE__ */ new Set(["content-length", "content-type"]);
+const OMIT_STATIC_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
 	VINEXT_STATIC_FILE_HEADER,
 	"content-encoding",
 	"content-length",
@@ -542,7 +542,7 @@ async function resolveStaticFile(staticFile) {
 }
 async function statIfFile(filePath) {
 	try {
-		const stat = await fs$1.stat(filePath);
+		const stat = await fsp.stat(filePath);
 		return stat.isFile() ? {
 			size: stat.size,
 			mtimeMs: stat.mtimeMs
@@ -555,10 +555,7 @@ async function statIfFile(filePath) {
 * Convert a Node.js IncomingMessage to a Web Request object.
 *
 * When `urlOverride` is provided, it is used as the path + query string
-* instead of `req.url`. This avoids redundant path normalization when the
-* caller has already decoded and normalized the pathname (e.g. the App
-* Router prod server normalizes before static-asset lookup, and can pass
-* the result here so the downstream RSC handler doesn't re-normalize).
+* instead of `req.url`.
 */
 function nodeToWebRequest(req, urlOverride, prerenderSecret) {
 	const origin = `${resolveRequestProtocol(req)}://${resolveRequestHost(req, "localhost")}`;
@@ -873,8 +870,14 @@ async function startAppRouterServer(options) {
 			return;
 		}
 		try {
-			const qs = rawUrl.includes("?") ? rawUrl.slice(rawUrl.indexOf("?")) : "";
-			const response = await rscHandler(nodeToWebRequest(req, pathname + qs, prerenderSecret));
+			const request = nodeToWebRequest(req, rawUrl, prerenderSecret);
+			const response = await rscHandler(request);
+			if (missingBuildAsset && response.status === 404) {
+				cancelResponseBody(response);
+				res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+				res.end("Not Found");
+				return;
+			}
 			const staticFileSignal = response.headers.get(VINEXT_STATIC_FILE_HEADER);
 			if (staticFileSignal) {
 				let staticFilePath = "/";
@@ -890,12 +893,6 @@ async function startAppRouterServer(options) {
 				await sendWebResponse(notFoundResponse({ headers: toWebHeaders(staticResponseHeaders) }), req, res, compress);
 				return;
 			}
-			if (missingBuildAsset && response.status === 404) {
-				cancelResponseBody(response);
-				res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
-				res.end("Not Found");
-				return;
-			}
 			await sendWebResponse(response, req, res, compress);
 		} catch (e) {
 			console.error("[vinext] Server error:", e);
@@ -986,8 +983,9 @@ async function startPagesRouterServer(options) {
 			res.end("This page could not be found");
 			return;
 		}
-		const rawPagesPathname = rawPagesPathnameBeforeNormalize.replaceAll("\\", "/");
+		const rawPagesPathname = canonicalizeRequestPathname(rawPagesPathnameBeforeNormalize.replaceAll("\\", "/"));
 		const rawQs = rawUrl.includes("?") ? rawUrl.slice(rawUrl.indexOf("?")) : "";
+		let requestPathname = normalizePath(rawPagesPathname);
 		let pathname;
 		try {
 			pathname = normalizePath(normalizePathnameForRouteMatchStrict(rawPagesPathname));
@@ -996,7 +994,7 @@ async function startPagesRouterServer(options) {
 			res.end("Bad Request");
 			return;
 		}
-		let url = pathname + rawQs;
+		let url = requestPathname + rawQs;
 		if (pathname === "/__vinext/prerender/pages-static-paths") {
 			const secret = req.headers[VINEXT_PRERENDER_SECRET_HEADER];
 			if (!prerenderSecret || secret !== prerenderSecret) {
@@ -1057,18 +1055,31 @@ async function startPagesRouterServer(options) {
 			return;
 		}
 		try {
-			const hadBasePath = !basePath || hasBasePath(pathname, basePath);
+			const hadBasePath = !basePath || hasBasePath(requestPathname, basePath);
+			let configMatchPathname = stripBasePath(requestPathname, basePath);
 			{
-				const stripped = stripBasePath(pathname, basePath);
-				if (stripped !== pathname) {
-					url = stripped + (url.includes("?") ? url.slice(url.indexOf("?")) : "");
-					pathname = stripped;
+				const strippedPathname = stripBasePath(pathname, basePath);
+				const strippedRequestPathname = stripBasePath(requestPathname, basePath);
+				pathname = strippedPathname;
+				if (strippedRequestPathname !== requestPathname) {
+					requestPathname = strippedRequestPathname;
+					url = requestPathname + rawQs;
 				}
 			}
+			if (urlParserCreatesPagesDataPath(pathname)) {
+				res.writeHead(404);
+				res.end("This page could not be found");
+				return;
+			}
+			requestPathname = encodeUrlParserIgnoredCharacters(requestPathname);
+			{
+				const qs = url.includes("?") ? url.slice(url.indexOf("?")) : "";
+				url = requestPathname + qs;
+			}
 			let isDataReq = false;
 			const originalRenderUrl = url;
-			if (isNextDataPathname(pathname)) {
-				const dataMatch = pagesBuildId ? parseNextDataPathname(pathname, pagesBuildId) : null;
+			if (isNextDataPathname(requestPathname)) {
+				const dataMatch = pagesBuildId ? parseNextDataPathname(requestPathname, pagesBuildId) : null;
 				if (!dataMatch) {
 					await sendWebResponse(buildNextDataNotFoundResponse(), req, res, compress);
 					return;
@@ -1077,7 +1088,9 @@ async function startPagesRouterServer(options) {
 				const qs = url.includes("?") ? url.slice(url.indexOf("?")) : "";
 				const pagePathname = normalizeNextDataPagePathname(dataMatch.pagePathname, hasMiddleware && trailingSlash);
 				url = pagePathname + qs;
+				requestPathname = pagePathname;
 				pathname = pagePathname;
+				configMatchPathname = pagePathname;
 			}
 			const protocol = resolveRequestProtocol(req);
 			const hostHeader = resolveRequestHost(req, `${host}:${port}`);
@@ -1104,6 +1117,7 @@ async function startPagesRouterServer(options) {
 				hasMiddleware,
 				ctx: void 0,
 				rawSearch: rawQs,
+				configMatchPathname,
 				matchPageRoute: matchPageRoute ?? null,
 				runMiddleware: typeof runMiddleware === "function" ? wrapMiddlewareWithBasePath(runMiddleware, basePath, hadBasePath) : null,
 				renderPage: typeof renderPage === "function" ? (request, resolvedUrl, options, stagedHeaders) => renderPage(request, resolvedUrl, ssrManifest, void 0, stagedHeaders, {