vinext 1.0.0-beta.1 → 1.0.0-beta.2

package/dist/server/pages-request-pipeline.js

@@ -1,10 +1,13 @@
 import { addBasePathToPathname, hasBasePath } from "../utils/base-path.js";
 import { patternToNextFormat } from "../routing/route-validation.js";
-import { applyMiddlewareRequestHeaders, isExternalUrl, matchRedirect, matchRewrite, preserveRedirectDestinationQuery, proxyExternalRequest, requestContextFromRequest, sanitizeDestination } from "../config/config-matchers.js";
-import { applyConfigHeadersToHeaderRecord, cloneRequestWithUrl, normalizeTrailingSlash } from "./request-pipeline.js";
+import { requestContextFromRequest } from "../config/request-context.js";
+import { isExternalUrl } from "../utils/external-url.js";
+import { applyMiddlewareRequestHeaders, matchRedirect, matchRewrite, preserveRedirectDestinationQuery, proxyExternalRequest, sanitizeDestination } from "../config/config-matchers.js";
+import { cloneRequestWithUrl, normalizeTrailingSlash } from "./request-pipeline.js";
 import { mergeRewriteQuery } from "../utils/query.js";
 import { normalizeDefaultLocalePathname, stripI18nLocaleForApiRoute } from "./pages-i18n.js";
 import { buildMiddlewarePrefetchSkipResponse } from "./pages-data-route.js";
+import { applyConfigHeadersToHeaderRecord } from "./config-headers.js";
 import { mergeHeaders } from "./worker-utils.js";
 //#region src/server/pages-request-pipeline.ts
 async function fetchWorkerFilesystemRoute(request, requestPathname, phase, fetchAsset) {
@@ -53,6 +56,7 @@ async function runPagesRequest(request, deps) {
 	const url = new URL(request.url);
 	let pathname = url.pathname;
 	const search = url.search;
+	const requestConfigPathname = deps.configMatchPathname ?? pathname;
 	const basePathState = {
 		basePath,
 		hadBasePath
@@ -66,9 +70,9 @@ async function runPagesRequest(request, deps) {
 	}
 	const reqCtx = requestContextFromRequest(request);
 	const requestHostname = i18nConfig ? url.hostname : "";
-	const matchPathname = i18nConfig ? normalizeDefaultLocalePathname(pathname, i18nConfig, { hostname: requestHostname }) : pathname;
+	const requestConfigMatchPathname = i18nConfig ? normalizeDefaultLocalePathname(requestConfigPathname, i18nConfig, { hostname: requestHostname }) : requestConfigPathname;
 	if (configRedirects.length) {
-		const redirect = matchRedirect(matchPathname, configRedirects, reqCtx, basePathState);
+		const redirect = matchRedirect(requestConfigMatchPathname, configRedirects, reqCtx, basePathState);
 		if (redirect) {
 			const location = preserveRedirectDestinationQuery(sanitizeDestination(basePath && hadBasePath && !isExternalUrl(redirect.destination) && !hasBasePath(redirect.destination, basePath) ? basePath + redirect.destination : redirect.destination), deps.rawSearch ?? search);
 			return {
@@ -82,6 +86,7 @@ async function runPagesRequest(request, deps) {
 	}
 	const originalResolvedUrl = pathname + search;
 	let resolvedUrl = originalResolvedUrl;
+	let resolvedPathnameIsRequestPathname = true;
 	const middlewareHeaders = {};
 	let middlewareStatus;
 	const serveFilesystemRoute = async (requestPathname, phase) => {
@@ -131,7 +136,10 @@ async function runPagesRequest(request, deps) {
 			else if (existing) middlewareHeaders[key] = [existing, value];
 			else middlewareHeaders[key] = [value];
 		} else middlewareHeaders[key] = value;
-		if (result.rewriteUrl) resolvedUrl = result.rewriteUrl;
+		if (result.rewriteUrl) {
+			resolvedUrl = result.rewriteUrl;
+			resolvedPathnameIsRequestPathname = false;
+		}
 		middlewareStatus = result.status ?? result.rewriteStatus;
 	}
 	const { postMwReqCtx, request: postMwReq } = applyMiddlewareRequestHeaders(middlewareHeaders, request, { preserveCredentialHeaders: isExternalUrl(resolvedUrl) });
@@ -143,6 +151,7 @@ async function runPagesRequest(request, deps) {
 	});
 	let resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
 	const matchResolvedPathname = (p) => i18nConfig ? normalizeDefaultLocalePathname(p, i18nConfig, { hostname: requestHostname }) : p;
+	const configSourcePathname = () => resolvedPathnameIsRequestPathname ? requestConfigMatchPathname : matchResolvedPathname(resolvedPathname);
 	const matchedPathnameForRoute = (routePattern) => {
 		const matchedPathname = routePattern ? patternToNextFormat(routePattern) : resolvedPathname;
 		if (!i18nConfig) return matchedPathname;
@@ -161,7 +170,7 @@ async function runPagesRequest(request, deps) {
 	};
 	if (configHeaders.length) applyConfigHeadersToHeaderRecord(middlewareHeaders, {
 		configHeaders,
-		pathname: matchPathname,
+		pathname: requestConfigMatchPathname,
 		requestContext: reqCtx,
 		basePathState
 	});
@@ -173,7 +182,7 @@ async function runPagesRequest(request, deps) {
 	if (directFilesystemResult) return directFilesystemResult;
 	let configRewriteFired = false;
 	for (const rewrite of configRewrites.beforeFiles ?? []) {
-		const rewritten = matchRewrite(matchResolvedPathname(resolvedPathname), [rewrite], rewriteRequestContext(), basePathState);
+		const rewritten = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), basePathState);
 		if (rewritten) {
 			if (isExternalUrl(rewritten)) return {
 				type: "response",
@@ -181,6 +190,7 @@ async function runPagesRequest(request, deps) {
 			};
 			resolvedUrl = mergeRewriteQuery(resolvedUrl, rewritten);
 			resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
+			resolvedPathnameIsRequestPathname = false;
 			configRewriteFired = true;
 		}
 	}
@@ -227,7 +237,7 @@ async function runPagesRequest(request, deps) {
 	let pageMatch = !isOutsideBasePathUnclaimed() && deps.matchPageRoute ? deps.matchPageRoute(resolvedPathname, request) : null;
 	let resolvedPathnameChanged = false;
 	if (!pageMatch || pageMatch.route.isDynamic) for (const rewrite of configRewrites.afterFiles ?? []) {
-		const rewritten = matchRewrite(matchResolvedPathname(resolvedPathname), [rewrite], rewriteRequestContext(), basePathState);
+		const rewritten = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), basePathState);
 		if (rewritten) {
 			if (isExternalUrl(rewritten)) return {
 				type: "response",
@@ -235,6 +245,7 @@ async function runPagesRequest(request, deps) {
 			};
 			resolvedUrl = mergeRewriteQuery(resolvedUrl, rewritten);
 			resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
+			resolvedPathnameIsRequestPathname = false;
 			configRewriteFired = true;
 			resolvedPathnameChanged = true;
 			const afterFilesFilesystemResult = await serveFilesystemRoute(resolvedPathname, "afterFiles");
@@ -253,7 +264,7 @@ async function runPagesRequest(request, deps) {
 	if (typeof deps.renderPage === "function") {
 		let renderPageMatch = pageMatch;
 		if ((isOutsideBasePathUnclaimed() || isDataReq || isDataRequest) && !renderPageMatch && configRewrites.fallback?.length) for (const rewrite of configRewrites.fallback) {
-			const fallbackRewrite = matchRewrite(matchResolvedPathname(resolvedPathname), [rewrite], rewriteRequestContext(), basePathState);
+			const fallbackRewrite = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), basePathState);
 			if (!fallbackRewrite) continue;
 			if (isExternalUrl(fallbackRewrite)) return {
 				type: "response",
@@ -261,6 +272,7 @@ async function runPagesRequest(request, deps) {
 			};
 			resolvedUrl = mergeRewriteQuery(resolvedUrl, fallbackRewrite);
 			resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
+			resolvedPathnameIsRequestPathname = false;
 			configRewriteFired = true;
 			const fallbackFilesystemResult = await serveFilesystemRoute(resolvedPathname, "fallback");
 			if (fallbackFilesystemResult) return fallbackFilesystemResult;
@@ -281,7 +293,7 @@ async function runPagesRequest(request, deps) {
 		let response = await deps.renderPage(request, resolvedUrl, initialRenderOptions, stagedHeaders);
 		let matchedFallbackRewrite = false;
 		if (response.status === 404 && shouldDeferErrorPageOnMiss && configRewrites.fallback?.length) for (const rewrite of configRewrites.fallback) {
-			const fallbackRewrite = matchRewrite(matchResolvedPathname(resolvedPathname), [rewrite], rewriteRequestContext(), basePathState);
+			const fallbackRewrite = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), basePathState);
 			if (!fallbackRewrite) continue;
 			if (isExternalUrl(fallbackRewrite)) return {
 				type: "response",
@@ -289,6 +301,7 @@ async function runPagesRequest(request, deps) {
 			};
 			resolvedUrl = mergeRewriteQuery(resolvedUrl, fallbackRewrite);
 			resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
+			resolvedPathnameIsRequestPathname = false;
 			configRewriteFired = true;
 			const fallbackFilesystemResult = await serveFilesystemRoute(resolvedPathname, "fallback");
 			if (fallbackFilesystemResult) return fallbackFilesystemResult;
@@ -325,7 +338,7 @@ async function runPagesRequest(request, deps) {
 	}
 	let devPageMatch = isOutsideBasePathUnclaimed() ? null : resolvedPathnameChanged ? deps.matchPageRoute ? deps.matchPageRoute(resolvedPathname, request) : null : pageMatch;
 	if (!devPageMatch && configRewrites.fallback?.length) for (const rewrite of configRewrites.fallback) {
-		const fallbackRewrite = matchRewrite(matchResolvedPathname(resolvedPathname), [rewrite], rewriteRequestContext(), basePathState);
+		const fallbackRewrite = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), basePathState);
 		if (!fallbackRewrite) continue;
 		if (isExternalUrl(fallbackRewrite)) return {
 			type: "response",
@@ -333,6 +346,7 @@ async function runPagesRequest(request, deps) {
 		};
 		resolvedUrl = mergeRewriteQuery(resolvedUrl, fallbackRewrite);
 		resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
+		resolvedPathnameIsRequestPathname = false;
 		configRewriteFired = true;
 		const fallbackFilesystemResult = await serveFilesystemRoute(resolvedPathname, "fallback");
 		if (fallbackFilesystemResult) return fallbackFilesystemResult;

package/dist/server/pages-router-entry.js

@@ -1,3 +1,4 @@
+import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { notFoundStaticAssetResponse } from "./http-error-responses.js";
 import { isOpenRedirectShaped } from "./open-redirect.js";
@@ -52,6 +53,11 @@ async function handleRequest(request, env, ctx) {
 	try {
 		let pathname = new URL(request.url).pathname;
 		if (isOpenRedirectShaped(pathname)) return new Response("This page could not be found", { status: 404 });
+		try {
+			normalizePathnameForRouteMatchStrict(pathname);
+		} catch {
+			return new Response("Bad Request", { status: 400 });
+		}
 		const missingBuildAsset = isNextStaticPath(pathname, basePath, assetPathPrefix);
 		request = cloneRequestWithHeaders(request, filterInternalHeaders(request.headers));
 		const hadBasePath = !basePath || hasBasePath(pathname, basePath);

package/dist/server/prerender-route-params.js

@@ -58,11 +58,11 @@ function decodedPrerenderRouteParamEquals(prerenderValue, matchedValue) {
 		if (prerenderValue.length !== matchedValue.length) return false;
 		return prerenderValue.every((item, index) => {
 			const decoded = decodePrerenderRouteParam(item);
-			return decoded !== null && decoded === matchedValue[index];
+			return item === matchedValue[index] || decoded !== null && decoded === matchedValue[index];
 		});
 	}
 	const decoded = decodePrerenderRouteParam(prerenderValue);
-	return decoded !== null && decoded === matchedValue;
+	return prerenderValue === matchedValue || decoded !== null && decoded === matchedValue;
 }
 function prerenderRouteParamsPayloadMatchesRoute(payload, routePattern, params) {
 	return matchPrerenderRouteParamsPayload(payload, routePattern, params)?.kind === "exact";

package/dist/server/prod-server.d.ts

@@ -101,10 +101,7 @@ declare function tryServeStatic(req: IncomingMessage, res: ServerResponse, clien
  * Convert a Node.js IncomingMessage to a Web Request object.
  *
  * When `urlOverride` is provided, it is used as the path + query string
- * instead of `req.url`. This avoids redundant path normalization when the
- * caller has already decoded and normalized the pathname (e.g. the App
- * Router prod server normalizes before static-asset lookup, and can pass
- * the result here so the downstream RSC handler doesn't re-normalize).
+ * instead of `req.url`.
  */
 declare function nodeToWebRequest(req: IncomingMessage, urlOverride?: string, prerenderSecret?: string): Request;
 /**

package/dist/server/prod-server.js

@@ -6,9 +6,9 @@ import { VINEXT_STATIC_FILE_HEADER } from "./headers.js";
 import { normalizePath } from "./normalize-path.js";
 import { notFoundResponse } from "./http-error-responses.js";
 import { isOpenRedirectShaped } from "./open-redirect.js";
-import { filterInternalHeaders } from "./request-pipeline.js";
+import { canonicalizeRequestPathname, filterInternalHeaders } from "./request-pipeline.js";
 import { isUnknownRecord } from "../utils/record.js";
-import { buildNextDataNotFoundResponse, isNextDataPathname, normalizeNextDataPagePathname, parseNextDataPathname } from "./pages-data-route.js";
+import { buildNextDataNotFoundResponse, encodeUrlParserIgnoredCharacters, isNextDataPathname, normalizeNextDataPagePathname, parseNextDataPathname, urlParserCreatesPagesDataPath } from "./pages-data-route.js";
 import { ASSET_PREFIX_URL_DIR, assetPrefixPathname, isAbsoluteAssetPrefix } from "../utils/asset-prefix.js";
 import { setPagesClientAssets } from "./pages-client-assets.js";
 import { resolveRequestHost, resolveRequestProtocol, trustProxy, trustedHosts } from "./proxy-trust.js";
@@ -555,10 +555,7 @@ async function statIfFile(filePath) {
 * Convert a Node.js IncomingMessage to a Web Request object.
 *
 * When `urlOverride` is provided, it is used as the path + query string
-* instead of `req.url`. This avoids redundant path normalization when the
-* caller has already decoded and normalized the pathname (e.g. the App
-* Router prod server normalizes before static-asset lookup, and can pass
-* the result here so the downstream RSC handler doesn't re-normalize).
+* instead of `req.url`.
 */
 function nodeToWebRequest(req, urlOverride, prerenderSecret) {
 	const origin = `${resolveRequestProtocol(req)}://${resolveRequestHost(req, "localhost")}`;
@@ -873,9 +870,14 @@ async function startAppRouterServer(options) {
 			return;
 		}
 		try {
-			const qs = rawUrl.includes("?") ? rawUrl.slice(rawUrl.indexOf("?")) : "";
-			const request = nodeToWebRequest(req, pathname + qs, prerenderSecret);
+			const request = nodeToWebRequest(req, rawUrl, prerenderSecret);
 			const response = await rscHandler(request);
+			if (missingBuildAsset && response.status === 404) {
+				cancelResponseBody(response);
+				res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+				res.end("Not Found");
+				return;
+			}
 			const staticFileSignal = response.headers.get(VINEXT_STATIC_FILE_HEADER);
 			if (staticFileSignal) {
 				let staticFilePath = "/";
@@ -891,12 +893,6 @@ async function startAppRouterServer(options) {
 				await sendWebResponse(notFoundResponse({ headers: toWebHeaders(staticResponseHeaders) }), req, res, compress);
 				return;
 			}
-			if (missingBuildAsset && response.status === 404) {
-				cancelResponseBody(response);
-				res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
-				res.end("Not Found");
-				return;
-			}
 			await sendWebResponse(response, req, res, compress);
 		} catch (e) {
 			console.error("[vinext] Server error:", e);
@@ -987,8 +983,9 @@ async function startPagesRouterServer(options) {
 			res.end("This page could not be found");
 			return;
 		}
-		const rawPagesPathname = rawPagesPathnameBeforeNormalize.replaceAll("\\", "/");
+		const rawPagesPathname = canonicalizeRequestPathname(rawPagesPathnameBeforeNormalize.replaceAll("\\", "/"));
 		const rawQs = rawUrl.includes("?") ? rawUrl.slice(rawUrl.indexOf("?")) : "";
+		let requestPathname = normalizePath(rawPagesPathname);
 		let pathname;
 		try {
 			pathname = normalizePath(normalizePathnameForRouteMatchStrict(rawPagesPathname));
@@ -997,7 +994,7 @@ async function startPagesRouterServer(options) {
 			res.end("Bad Request");
 			return;
 		}
-		let url = pathname + rawQs;
+		let url = requestPathname + rawQs;
 		if (pathname === "/__vinext/prerender/pages-static-paths") {
 			const secret = req.headers[VINEXT_PRERENDER_SECRET_HEADER];
 			if (!prerenderSecret || secret !== prerenderSecret) {
@@ -1058,18 +1055,31 @@ async function startPagesRouterServer(options) {
 			return;
 		}
 		try {
-			const hadBasePath = !basePath || hasBasePath(pathname, basePath);
+			const hadBasePath = !basePath || hasBasePath(requestPathname, basePath);
+			let configMatchPathname = stripBasePath(requestPathname, basePath);
 			{
-				const stripped = stripBasePath(pathname, basePath);
-				if (stripped !== pathname) {
-					url = stripped + (url.includes("?") ? url.slice(url.indexOf("?")) : "");
-					pathname = stripped;
+				const strippedPathname = stripBasePath(pathname, basePath);
+				const strippedRequestPathname = stripBasePath(requestPathname, basePath);
+				pathname = strippedPathname;
+				if (strippedRequestPathname !== requestPathname) {
+					requestPathname = strippedRequestPathname;
+					url = requestPathname + rawQs;
 				}
 			}
+			if (urlParserCreatesPagesDataPath(pathname)) {
+				res.writeHead(404);
+				res.end("This page could not be found");
+				return;
+			}
+			requestPathname = encodeUrlParserIgnoredCharacters(requestPathname);
+			{
+				const qs = url.includes("?") ? url.slice(url.indexOf("?")) : "";
+				url = requestPathname + qs;
+			}
 			let isDataReq = false;
 			const originalRenderUrl = url;
-			if (isNextDataPathname(pathname)) {
-				const dataMatch = pagesBuildId ? parseNextDataPathname(pathname, pagesBuildId) : null;
+			if (isNextDataPathname(requestPathname)) {
+				const dataMatch = pagesBuildId ? parseNextDataPathname(requestPathname, pagesBuildId) : null;
 				if (!dataMatch) {
 					await sendWebResponse(buildNextDataNotFoundResponse(), req, res, compress);
 					return;
@@ -1078,7 +1088,9 @@ async function startPagesRouterServer(options) {
 				const qs = url.includes("?") ? url.slice(url.indexOf("?")) : "";
 				const pagePathname = normalizeNextDataPagePathname(dataMatch.pagePathname, hasMiddleware && trailingSlash);
 				url = pagePathname + qs;
+				requestPathname = pagePathname;
 				pathname = pagePathname;
+				configMatchPathname = pagePathname;
 			}
 			const protocol = resolveRequestProtocol(req);
 			const hostHeader = resolveRequestHost(req, `${host}:${port}`);
@@ -1105,6 +1117,7 @@ async function startPagesRouterServer(options) {
 				hasMiddleware,
 				ctx: void 0,
 				rawSearch: rawQs,
+				configMatchPathname,
 				matchPageRoute: matchPageRoute ?? null,
 				runMiddleware: typeof runMiddleware === "function" ? wrapMiddlewareWithBasePath(runMiddleware, basePath, hadBasePath) : null,
 				renderPage: typeof renderPage === "function" ? (request, resolvedUrl, options, stagedHeaders) => renderPage(request, resolvedUrl, ssrManifest, void 0, stagedHeaders, {

package/dist/server/request-pipeline.d.ts

@@ -1,10 +1,21 @@
-import { NextHeader } from "../config/next-config.js";
-import { BasePathMatchState, RequestContext } from "../config/config-matchers.js";
 import { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS } from "./headers.js";
-import { isOpenRedirectShaped } from "./open-redirect.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
+import { isOpenRedirectShaped } from "./open-redirect.js";
 
 //#region src/server/request-pipeline.d.ts
+/**
+ * Apply the URL Standard's pathname canonicalization without decoding and
+ * re-encoding ordinary percent escapes.
+ *
+ * In particular, WHATWG URLs remove literal and percent-encoded dot segments
+ * (`/%2e/about` becomes `/about`) while preserving unrelated spellings such
+ * as `/%61bout`, `%2F`, `%5C`, and `%252F` byte-for-byte. Node request adapters
+ * must do this before comparing raw route/config/basePath identity so those
+ * comparisons agree with the `Request` that userland eventually receives.
+ */
+declare function canonicalizeRequestPathname(pathname: string): string;
+/** Canonicalize only the pathname portion while preserving the raw query. */
+declare function canonicalizeRequestUrlPathname(url: string): string;
 /**
  * Shared request pipeline utilities.
  *
@@ -44,18 +55,6 @@ import { hasBasePath, stripBasePath } from "../utils/base-path.js";
  */
 declare function guardProtocolRelativeUrl(rawPathname: string): Response | null;
 type HeaderRecord = Record<string, string | string[]>;
-type ApplyConfigHeadersOptions = {
-  configHeaders: NextHeader[];
-  pathname: string;
-  requestContext: RequestContext;
-  /**
-   * basePath gating state. When omitted, every rule is treated as a default
-   * (basePath: true) rule for backward compatibility — callers that need to
-   * support `basePath: false` headers must pass this in.
-   */
-  basePathState?: BasePathMatchState; /** Existing framework-generated headers that matching config rules may replace. */
-  overwriteExisting?: ReadonlySet<string>;
-};
 type StaticFileSignalContext = {
   headers: Headers | null;
   status: number | null;
@@ -67,19 +66,6 @@ type ResolvePublicFileRouteOptions = {
   publicFiles: ReadonlySet<string>;
   request: Request;
 };
-/**
- * Apply matched next.config.js headers to a Web Headers object.
- *
- * Next.js evaluates config header match conditions against the original
- * request snapshot. Middleware response headers still win for the same
- * response key, while multi-value headers are additive.
- */
-declare function applyConfigHeadersToResponse(responseHeaders: Headers, options: ApplyConfigHeadersOptions): void;
-/**
- * Apply matched next.config.js headers to the early response header record used
- * by Node and Worker Pages Router pipelines before a concrete response exists.
- */
-declare function applyConfigHeadersToHeaderRecord(headers: HeaderRecord, options: ApplyConfigHeadersOptions): void;
 declare function createStaticFileSignal(pathname: string, context: StaticFileSignalContext): Response;
 /**
  * Resolve the public/ filesystem-route slot in the Next.js routing order.
@@ -184,4 +170,4 @@ declare function cloneRequestWithHeaders(request: Request, headers: Headers): Re
  */
 declare function cloneRequestWithUrl(request: Request, url: string): Request;
 //#endregion
-export { HeaderRecord, INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, applyConfigHeadersToHeaderRecord, applyConfigHeadersToResponse, cloneRequestWithHeaders, cloneRequestWithUrl, createStaticFileSignal, filterInternalHeaders, guardProtocolRelativeUrl, hasBasePath, isOpenRedirectShaped, isOriginAllowed, normalizeTrailingSlash, normalizeTrailingSlashPathname, processMiddlewareHeaders, resolvePublicFileRoute, stripBasePath, validateCsrfOrigin, validateServerActionPayload };
+export { HeaderRecord, INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, canonicalizeRequestPathname, canonicalizeRequestUrlPathname, cloneRequestWithHeaders, cloneRequestWithUrl, createStaticFileSignal, filterInternalHeaders, guardProtocolRelativeUrl, hasBasePath, isOpenRedirectShaped, isOriginAllowed, normalizeTrailingSlash, normalizeTrailingSlashPathname, processMiddlewareHeaders, resolvePublicFileRoute, stripBasePath, validateCsrfOrigin, validateServerActionPayload };

package/dist/server/request-pipeline.js

@@ -1,10 +1,32 @@
 import { hasBasePath, removeTrailingSlash, stripBasePath } from "../utils/base-path.js";
 import "../utils/protocol-headers.js";
 import { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, VINEXT_STATIC_FILE_HEADER } from "./headers.js";
-import { matchHeaders } from "../config/config-matchers.js";
 import { forbiddenResponse, notFoundResponse } from "./http-error-responses.js";
 import { isOpenRedirectShaped } from "./open-redirect.js";
 //#region src/server/request-pipeline.ts
+const PATHNAME_CANONICALIZATION_BASE = new URL("http://vinext.invalid/");
+/**
+* Apply the URL Standard's pathname canonicalization without decoding and
+* re-encoding ordinary percent escapes.
+*
+* In particular, WHATWG URLs remove literal and percent-encoded dot segments
+* (`/%2e/about` becomes `/about`) while preserving unrelated spellings such
+* as `/%61bout`, `%2F`, `%5C`, and `%252F` byte-for-byte. Node request adapters
+* must do this before comparing raw route/config/basePath identity so those
+* comparisons agree with the `Request` that userland eventually receives.
+*/
+function canonicalizeRequestPathname(pathname) {
+	const url = new URL(PATHNAME_CANONICALIZATION_BASE);
+	url.pathname = pathname;
+	return url.pathname;
+}
+/** Canonicalize only the pathname portion while preserving the raw query. */
+function canonicalizeRequestUrlPathname(url) {
+	const queryIndex = url.indexOf("?");
+	const pathname = queryIndex === -1 ? url : url.slice(0, queryIndex);
+	const search = queryIndex === -1 ? "" : url.slice(queryIndex);
+	return canonicalizeRequestPathname(pathname) + search;
+}
 /**
 * Shared request pipeline utilities.
 *
@@ -50,63 +72,6 @@ const FILE_LIKE_PATHNAME_RE = /\.[^/]+\/?$/;
 function isWellKnownPathname(pathname) {
 	return pathname === "/.well-known" || pathname.startsWith("/.well-known/");
 }
-function findHeaderRecordKey(headers, lowerName) {
-	for (const key of Object.keys(headers)) if (key.toLowerCase() === lowerName) return key;
-}
-function appendHeaderRecord(headers, lowerName, value) {
-	const key = findHeaderRecordKey(headers, lowerName) ?? lowerName;
-	const existing = headers[key];
-	if (existing === void 0) {
-		headers[key] = value;
-		return;
-	}
-	if (Array.isArray(existing)) {
-		existing.push(value);
-		return;
-	}
-	headers[key] = [existing, value];
-}
-function appendVaryHeaderRecord(headers, value) {
-	const key = findHeaderRecordKey(headers, "vary") ?? "vary";
-	const existing = headers[key];
-	if (existing === void 0) {
-		headers[key] = value;
-		return;
-	}
-	if (Array.isArray(existing)) {
-		existing.push(value);
-		return;
-	}
-	headers[key] = existing + ", " + value;
-}
-/**
-* Apply matched next.config.js headers to a Web Headers object.
-*
-* Next.js evaluates config header match conditions against the original
-* request snapshot. Middleware response headers still win for the same
-* response key, while multi-value headers are additive.
-*/
-function applyConfigHeadersToResponse(responseHeaders, options) {
-	const matched = matchHeaders(options.pathname, options.configHeaders, options.requestContext, options.basePathState);
-	for (const header of matched) {
-		const lowerName = header.key.toLowerCase();
-		if (lowerName === "vary" || lowerName === "set-cookie") responseHeaders.append(header.key, header.value);
-		else if (options.overwriteExisting?.has(lowerName) || !responseHeaders.has(lowerName)) responseHeaders.set(header.key, header.value);
-	}
-}
-/**
-* Apply matched next.config.js headers to the early response header record used
-* by Node and Worker Pages Router pipelines before a concrete response exists.
-*/
-function applyConfigHeadersToHeaderRecord(headers, options) {
-	const matched = matchHeaders(options.pathname, options.configHeaders, options.requestContext, options.basePathState);
-	for (const header of matched) {
-		const lowerName = header.key.toLowerCase();
-		if (lowerName === "set-cookie") appendHeaderRecord(headers, lowerName, header.value);
-		else if (lowerName === "vary") appendVaryHeaderRecord(headers, header.value);
-		else if (findHeaderRecordKey(headers, lowerName) === void 0) headers[lowerName] = header.value;
-	}
-}
 function createStaticFileSignal(pathname, context) {
 	const headers = new Headers({ [VINEXT_STATIC_FILE_HEADER]: encodeURIComponent(pathname) });
 	if (context.headers) for (const [key, value] of context.headers) headers.append(key, value);
@@ -445,4 +410,4 @@ function cloneRequestWithUrl(request, url) {
 	return cloned;
 }
 //#endregion
-export { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, applyConfigHeadersToHeaderRecord, applyConfigHeadersToResponse, cloneRequestWithHeaders, cloneRequestWithUrl, createStaticFileSignal, filterInternalHeaders, guardProtocolRelativeUrl, hasBasePath, isOpenRedirectShaped, isOriginAllowed, normalizeTrailingSlash, normalizeTrailingSlashPathname, processMiddlewareHeaders, resolvePublicFileRoute, stripBasePath, validateCsrfOrigin, validateServerActionPayload };
+export { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, canonicalizeRequestPathname, canonicalizeRequestUrlPathname, cloneRequestWithHeaders, cloneRequestWithUrl, createStaticFileSignal, filterInternalHeaders, guardProtocolRelativeUrl, hasBasePath, isOpenRedirectShaped, isOriginAllowed, normalizeTrailingSlash, normalizeTrailingSlashPathname, processMiddlewareHeaders, resolvePublicFileRoute, stripBasePath, validateCsrfOrigin, validateServerActionPayload };

package/dist/server/rsc-stream-hints.js

@@ -1,31 +1,135 @@
 //#region src/server/rsc-stream-hints.ts
-const REACT_FLIGHT_STYLESHEET_PRELOAD_HINT = /(\d*:HL\[.*?),"stylesheet"(\]|,)/g;
-/**
-* React Flight emits HL hints with "stylesheet" for CSS preloads, but the
-* HTML spec requires "style" for <link rel="preload">. Rewrite each complete
-* Flight line so SSR embeds, navigation, and server actions see valid hints.
-*/
+const REACT_FLIGHT_STYLESHEET_PRELOAD_HINT = /^([0-9a-f]*:HL\[.*?),"stylesheet"(\]|,)/;
+const STYLESHEET_TO_STYLE_JSON_PADDING = " ".repeat(5);
+const LENGTH_PREFIXED_ROW_TAGS = /* @__PURE__ */ new Set([
+	"T",
+	"A",
+	"O",
+	"o",
+	"b",
+	"U",
+	"S",
+	"s",
+	"L",
+	"l",
+	"G",
+	"g",
+	"M",
+	"m",
+	"V"
+]);
+const NEWLINE_PREFIXED_ROW_TAGS = /* @__PURE__ */ new Set([
+	"I",
+	"H",
+	"E",
+	"N",
+	"D",
+	"J",
+	"W",
+	"R",
+	"r",
+	"X",
+	"x",
+	"C",
+	"P",
+	"#"
+]);
+const decoder = new TextDecoder();
+const encoder = new TextEncoder();
+/** Rewrite only a complete React Flight stylesheet hint row. */
 function normalizeReactFlightHintLine(line) {
-	return line.replace(REACT_FLIGHT_STYLESHEET_PRELOAD_HINT, "$1,\"style\"$2");
+	const text = decoder.decode(line);
+	const normalized = text.replace(REACT_FLIGHT_STYLESHEET_PRELOAD_HINT, `$1,"style"${STYLESHEET_TO_STYLE_JSON_PADDING}$2`);
+	if (normalized === text) return line;
+	const normalizedBytes = encoder.encode(normalized);
+	return normalizedBytes.byteLength === line.byteLength ? normalizedBytes : line;
+}
+function concatBytes(first, second) {
+	if (first.byteLength === 0) return second;
+	const combined = new Uint8Array(first.byteLength + second.byteLength);
+	combined.set(first);
+	combined.set(second, first.byteLength);
+	return combined;
+}
+function indexOfByte(bytes, byte, from = 0) {
+	for (let index = from; index < bytes.byteLength; index++) if (bytes[index] === byte) return index;
+	return -1;
+}
+function parseHexBytes(bytes, start, end) {
+	if (start === end) return null;
+	let value = 0;
+	for (let index = start; index < end; index++) {
+		const byte = bytes[index];
+		const digit = byte >= 48 && byte <= 57 ? byte - 48 : byte >= 97 && byte <= 102 ? byte - 87 : -1;
+		if (digit === -1) return null;
+		value = value * 16 + digit;
+		if (!Number.isSafeInteger(value)) return null;
+	}
+	return value;
+}
+function isUntaggedJsonRowStart(byte) {
+	return byte === 34 || byte === 45 || byte >= 48 && byte <= 57 || byte === 91 || byte === 102 || byte === 110 || byte === 116 || byte === 123;
 }
 function normalizeReactFlightPreloadHints(stream) {
-	const decoder = new TextDecoder();
-	const encoder = new TextEncoder();
-	let carry = "";
+	let carry = /* @__PURE__ */ new Uint8Array();
+	let rawBytesRemaining = 0;
+	let passThrough = false;
 	return stream.pipeThrough(new TransformStream({
 		transform(chunk, controller) {
-			const text = carry + decoder.decode(chunk, { stream: true });
-			const lastNewline = text.lastIndexOf("\n");
-			if (lastNewline === -1) {
-				carry = text;
+			if (passThrough) {
+				controller.enqueue(chunk);
 				return;
 			}
-			carry = text.slice(lastNewline + 1);
-			controller.enqueue(encoder.encode(normalizeReactFlightHintLine(text.slice(0, lastNewline + 1))));
+			let bytes = concatBytes(carry, chunk);
+			carry = /* @__PURE__ */ new Uint8Array();
+			while (bytes.byteLength > 0) {
+				if (rawBytesRemaining > 0) {
+					const length = Math.min(rawBytesRemaining, bytes.byteLength);
+					controller.enqueue(bytes.slice(0, length));
+					rawBytesRemaining -= length;
+					bytes = bytes.subarray(length);
+					continue;
+				}
+				const colon = indexOfByte(bytes, 58);
+				if (colon === -1 || colon + 1 === bytes.byteLength) {
+					carry = bytes.slice();
+					return;
+				}
+				const tag = String.fromCharCode(bytes[colon + 1]);
+				if (LENGTH_PREFIXED_ROW_TAGS.has(tag)) {
+					const comma = indexOfByte(bytes, 44, colon + 2);
+					if (comma === -1) {
+						carry = bytes.slice();
+						return;
+					}
+					const length = parseHexBytes(bytes, colon + 2, comma);
+					if (length != null) {
+						controller.enqueue(bytes.slice(0, comma + 1));
+						rawBytesRemaining = length;
+						bytes = bytes.subarray(comma + 1);
+						continue;
+					}
+					passThrough = true;
+					controller.enqueue(bytes);
+					return;
+				}
+				const tagByte = bytes[colon + 1];
+				if (!NEWLINE_PREFIXED_ROW_TAGS.has(tag) && !isUntaggedJsonRowStart(tagByte)) {
+					passThrough = true;
+					controller.enqueue(bytes);
+					return;
+				}
+				const newline = indexOfByte(bytes, 10);
+				if (newline === -1) {
+					carry = bytes.slice();
+					return;
+				}
+				controller.enqueue(normalizeReactFlightHintLine(bytes.slice(0, newline + 1)));
+				bytes = bytes.subarray(newline + 1);
+			}
 		},
 		flush(controller) {
-			const text = carry + decoder.decode();
-			if (text) controller.enqueue(encoder.encode(normalizeReactFlightHintLine(text)));
+			if (carry.byteLength > 0) controller.enqueue(rawBytesRemaining > 0 ? carry : normalizeReactFlightHintLine(carry));
 		}
 	}));
 }