vinext 1.0.0-beta.1 → 1.0.0-beta.3

package/README.md

@@ -206,7 +206,10 @@ vinext works everywhere. It natively supports Cloudflare Workers (with `npx @vin
 vinext is a Vite plugin that reimplements the public Next.js API — routing, server rendering, `next/*` module imports, the CLI — so you can run Next.js applications on Vite instead of the Next.js compiler toolchain. It can be deployed anywhere: Cloudflare Workers is the first natively supported target, with other platforms available via Nitro. Native adapters for more platforms are [planned](https://github.com/cloudflare/vinext/issues/80).
 
 **Is this a fork of Next.js?**
-No. vinext is an alternative implementation of the Next.js API surface built on Vite. It does import some Next.js types and utilities, but the core is written from scratch. The goal is not to create a competing framework or add features beyond what Next.js offers; it is to provide the same well-defined API surface on Vite's toolchain.
+No. vinext is an alternative implementation of the Next.js API surface built on Vite. The core is written from scratch. The goal is not to create a competing framework or add features beyond what Next.js offers; it is to provide the same well-defined API surface on Vite's toolchain.
+
+**Does vinext require Next.js to be installed?**
+No. vinext ships fallback declarations for the supported `next` and `next/*` APIs, so applications can run and type-check without the `next` package. If both packages are installed, vinext keeps using Next.js's authoritative types and adds only its own extensions. Compatibility features that consume Next.js internals, such as `styled-jsx`, may still require a matching Next.js installation when used.
 
 **How is this different from OpenNext?**
 [OpenNext](https://opennext.js.org/) adapts the _output_ of a standard `next build` to run on various platforms. Because it builds on Next.js's own output, it inherits broad API coverage and has been well-tested for much longer. vinext takes a different approach: it reimplements the Next.js APIs on Vite from scratch, which means faster builds and smaller bundles, but less coverage of the long tail of Next.js features. If you need a mature, well-tested way to run Next.js outside Vercel, OpenNext is the safer choice. If you want a lighter Vite-based toolchain and do not need every Next.js API, vinext may be a good fit.
@@ -342,24 +345,16 @@ Requires a custom domain (zone analytics are unavailable on `*.workers.dev`) and
 
 #### Custom Vite configuration
 
-If you need to customize the Vite config, create a `vite.config.ts`. vinext will merge its config with yours. This is required for Cloudflare Workers deployment with the App Router (RSC needs explicit plugin configuration):
+If you need to customize the Vite config, create a `vite.config.ts`. vinext will merge its config with yours. For Cloudflare Workers deployment with the App Router, configure `@cloudflare/vite-plugin` so the RSC environment runs in workerd:
 
 ```ts
 import { defineConfig } from "vite";
 import vinext from "vinext";
-import rsc from "@vitejs/plugin-rsc";
 import { cloudflare } from "@cloudflare/vite-plugin";
 
 export default defineConfig({
   plugins: [
     vinext(),
-    rsc({
-      entries: {
-        rsc: "virtual:vinext-rsc-entry",
-        ssr: "virtual:vinext-app-ssr-entry",
-        client: "virtual:vinext-app-browser-entry",
-      },
-    }),
     cloudflare({
       viteEnvironment: { name: "rsc", childEnvironments: ["ssr"] },
     }),
@@ -367,6 +362,11 @@ export default defineConfig({
 });
 ```
 
+> **Do not register `@vitejs/plugin-rsc` yourself.** It is an optional peer dependency, so it must be
+> _installed_ in your project, but vinext auto-registers it whenever an `app/` directory is detected.
+> Adding an explicit `rsc()` call fails the build with `[vinext] Duplicate @vitejs/plugin-rsc detected`.
+> Pass `rsc: false` to `vinext()` only if you want to own that registration.
+
 See the [examples](#live-examples) for complete working configurations.
 
 ### Other platforms (via Nitro)

package/dist/build/client-build-config.js

@@ -6,6 +6,7 @@ const ROUTE_OWNED_CLIENT_SHIMS = /* @__PURE__ */ new Set([
 	"dynamic-preload-chunks",
 	"form",
 	"image",
+	"internal/hybrid-client-route-owner",
 	"layout-segment-context",
 	"legacy-image",
 	"link",
@@ -88,7 +89,13 @@ function createClientManualChunks(shimsDir, preserveRouteBoundaries = false) {
 		if (id.includes("node_modules")) {
 			const pkg = getPackageName(id);
 			if (!pkg) return void 0;
-			if (pkg === "react" || pkg === "react-dom" || pkg === "scheduler") return "framework";
+			if (pkg === "react-dom") {
+				const slashedId = toSlash(id);
+				const sub = slashedId.slice(slashedId.lastIndexOf("react-dom/") + 10);
+				if (sub.startsWith("server.") || sub.startsWith("static.") || sub.startsWith("cjs/react-dom-server")) return "react-dom-server";
+				return "framework";
+			}
+			if (pkg === "react" || pkg === "scheduler") return "framework";
 			return;
 		}
 		const slashedId = toSlash(id);

package/dist/build/report.d.ts

@@ -44,6 +44,13 @@ declare function hasExportedName(code: string, name: string): boolean;
  */
 declare function extractExportConstString(code: string, name: string): string | null;
 declare function extractMiddlewareMatcherConfig(filePath: string): StaticMiddlewareMatcher | undefined;
+/**
+ * Extract the statically analyzable `config.matcher` value without first
+ * narrowing it to vinext's runtime matcher type. Build validation needs the
+ * raw value so malformed matcher objects are rejected instead of disappearing
+ * as though no matcher had been configured.
+ */
+declare function extractMiddlewareMatcherConfigValue(filePath: string): unknown;
 /**
  * Extracts the numeric value of `export const <name> = <number|false>`.
  * Supports integers, decimals, negative values, `Infinity`, and `false`.
@@ -137,4 +144,4 @@ declare function printBuildReport(options: {
   prerenderResult?: PrerenderResult;
 }): Promise<void>;
 //#endregion
-export { RouteRow, RouteType, StaticMiddlewareMatcher, buildReportRows, classifyAppRoute, classifyLayoutSegmentConfig, classifyPagesRoute, extractExportConstNumber, extractExportConstString, extractGetStaticPropsRevalidate, extractMiddlewareMatcherConfig, formatBuildReport, getAppRouteRenderEntryPath, hasExportedName, hasNamedExport, printBuildReport };
+export { RouteRow, RouteType, StaticMiddlewareMatcher, buildReportRows, classifyAppRoute, classifyLayoutSegmentConfig, classifyPagesRoute, extractExportConstNumber, extractExportConstString, extractGetStaticPropsRevalidate, extractMiddlewareMatcherConfig, extractMiddlewareMatcherConfigValue, formatBuildReport, getAppRouteRenderEntryPath, hasExportedName, hasNamedExport, printBuildReport };

package/dist/build/report.js

@@ -135,6 +135,16 @@ function extractStringFromConstInitializer(initializer) {
 	return null;
 }
 function extractMiddlewareMatcherConfig(filePath) {
+	const value = extractMiddlewareMatcherConfigValue(filePath);
+	return isStaticMiddlewareMatcher(value) ? value : void 0;
+}
+/**
+* Extract the statically analyzable `config.matcher` value without first
+* narrowing it to vinext's runtime matcher type. Build validation needs the
+* raw value so malformed matcher objects are rejected instead of disappearing
+* as though no matcher had been configured.
+*/
+function extractMiddlewareMatcherConfigValue(filePath) {
 	let code;
 	try {
 		code = fs.readFileSync(filePath, "utf8");
@@ -148,7 +158,7 @@ function extractMiddlewareMatcherConfig(filePath) {
 	const matcherExpression = objectPropertyValue(config, "matcher");
 	if (!matcherExpression) return void 0;
 	const value = extractStaticJsonValue(matcherExpression);
-	return isStaticMiddlewareMatcher(value) ? value : void 0;
+	return value === UNSUPPORTED_STATIC_VALUE ? void 0 : value;
 }
 function objectPropertyValue(object, key) {
 	for (const property of object.properties) {
@@ -596,4 +606,4 @@ async function printBuildReport(options) {
 	}
 }
 //#endregion
-export { buildReportRows, classifyAppRoute, classifyLayoutSegmentConfig, classifyPagesRoute, extractExportConstNumber, extractExportConstString, extractGetStaticPropsRevalidate, extractMiddlewareMatcherConfig, formatBuildReport, getAppRouteRenderEntryPath, hasExportedName, hasNamedExport, printBuildReport };
+export { buildReportRows, classifyAppRoute, classifyLayoutSegmentConfig, classifyPagesRoute, extractExportConstNumber, extractExportConstString, extractGetStaticPropsRevalidate, extractMiddlewareMatcherConfig, extractMiddlewareMatcherConfigValue, formatBuildReport, getAppRouteRenderEntryPath, hasExportedName, hasNamedExport, printBuildReport };

package/dist/check.js

@@ -230,6 +230,10 @@ const CONFIG_SUPPORT = {
 		status: "supported",
 		detail: "server actions via 'use server' directive"
 	},
+	"experimental.allowedRevalidateHeaderKeys": {
+		status: "supported",
+		detail: "forwards explicitly allowed request headers during Pages Router revalidation"
+	},
 	"experimental.prefetchInlining": {
 		status: "partial",
 		detail: "config recognized; Link prefetch preserves pending/dedup semantics, but vinext does not implement per-segment cache storage"
@@ -390,6 +394,19 @@ function findSourceFiles(dir, extensions = [
 	}
 	return results;
 }
+/**
+* Find files that can contribute to the application compatibility surface.
+* Test modules and test-runner configuration are executed by their own runners
+* rather than bundled into the vinext application, so reporting their imports
+* or CJS globals as migration blockers produces false positives.
+*/
+function findRuntimeSourceFiles(root) {
+	return findSourceFiles(root).filter((file) => {
+		const basename = path.basename(file);
+		const isTestRunnerConfig = /^(?:jest|playwright|vitest)\.config\.[cm]?[jt]sx?$/.test(basename);
+		return !/\.(?:test|spec)\.[cm]?[jt]sx?$/.test(basename) && !isTestRunnerConfig;
+	});
+}
 function isIdentStart(c) {
 	return c >= "a" && c <= "z" || c >= "A" && c <= "Z" || c === "_" || c === "$";
 }
@@ -588,7 +605,7 @@ function hasFreeCjsGlobal(content) {
 * Scan source files for `import ... from 'next/...'` statements.
 */
 function scanImports(root) {
-	const files = findSourceFiles(root);
+	const files = findRuntimeSourceFiles(root);
 	const importUsage = /* @__PURE__ */ new Map();
 	const importRegex = /(?:import\s+(?:[\w{},\s*]+\s+from\s+)?|require\s*\()['"]([^'"]+)['"]\)?/g;
 	const typeOnlyImportRegex = /import\s+type\s+/;
@@ -911,7 +928,7 @@ function checkConventions(root) {
 			detail: "required for Vite — vinext init will add it automatically"
 		});
 	}
-	const allSourceFiles = findSourceFiles(root);
+	const allSourceFiles = findRuntimeSourceFiles(root);
 	const viewTransitionRegex = /import\s+\{[^}]*\bViewTransition\b[^}]*\}\s+from\s+['"]react['"]/;
 	const viewTransitionFiles = [];
 	const cjsGlobalFiles = [];

package/dist/cli.js

@@ -482,11 +482,12 @@ async function typegen() {
 		root,
 		mode: "production"
 	});
-	const outputPath = await generateRouteTypes({
+	const result = await generateRouteTypes({
 		root,
 		pageExtensions: (await resolveNextConfig(await loadNextConfig(root, PHASE_PRODUCTION_BUILD), root)).pageExtensions
 	});
-	console.log(`\n  Generated route types at ${path.relative(root, outputPath)}\n`);
+	const nextEnvMessage = result.nextEnvStatus === "unchanged" ? `${path.relative(root, result.nextEnvPath)} is up to date` : `${result.nextEnvStatus === "created" ? "Created" : "Updated"} ${path.relative(root, result.nextEnvPath)}`;
+	console.log(`\n  Generated route types at ${path.relative(root, result.routeTypesPath)}\n  ${nextEnvMessage}\n`);
 }
 async function initCommand() {
 	const parsed = parseArgs(rawArgs);

package/dist/config/config-matchers.d.ts

@@ -1,17 +1,20 @@
 import { HasCondition, NextHeader, NextI18nConfig, NextRedirect, NextRewrite } from "./next-config.js";
+import { RequestContext, normalizeHost, parseCookies, requestContextFromRequest } from "./request-context.js";
+import { isExternalUrl } from "../utils/external-url.js";
 
 //#region src/config/config-matchers.d.ts
 /**
  * Detect regex patterns vulnerable to catastrophic backtracking (ReDoS).
  *
- * Uses a lightweight heuristic: scans the pattern string for nested quantifiers
- * (a quantifier applied to a group that itself contains a quantifier). This
- * catches the most common pathological patterns like `(a+)+`, `(.*)*`,
- * `([^/]+)+`, `(a|a+)+` without needing a full regex parser.
+ * Uses the same deterministic structural analysis as middleware matcher
+ * validation. Nested bounded repetition is accepted only when its repeated
+ * language has fixed width and unambiguous branches; a fixed outer count can
+ * otherwise still cause polynomially catastrophic backtracking on long near
+ * misses.
  *
  * Returns true if the pattern appears safe, false if it's potentially dangerous.
  */
-declare function isSafeRegex(pattern: string): boolean;
+declare function isSafeRegex(pattern: string, flags?: string): boolean;
 /**
  * Compile a regex pattern safely. Returns the compiled RegExp or null if the
  * pattern is invalid or vulnerable to ReDoS.
@@ -27,16 +30,6 @@ declare function safeRegExp(pattern: string, flags?: string): RegExp | null;
  * which CodeQL flags as incomplete sanitization), then groups are restored.
  */
 declare function escapeHeaderSource(source: string): string;
-/**
- * Request context needed for evaluating has/missing conditions.
- * Callers extract the relevant parts from the incoming Request.
- */
-type RequestContext = {
-  readonly headers: Headers;
-  readonly cookies: Record<string, string>;
-  readonly query: URLSearchParams;
-  readonly host: string;
-};
 /**
  * basePath gating state passed alongside the pathname to every matcher.
  *
@@ -59,22 +52,6 @@ type BasePathMatchState = {
    */
   hadBasePath: boolean;
 };
-/**
- * Parse a Cookie header string into a key-value record.
- */
-declare function parseCookies(cookieHeader: string | null): Record<string, string>;
-/**
- * Build a RequestContext from a Web Request object.
- *
- * `cookies` and `query` are lazy memoized getters: they are consumed only by
- * `has`/`missing` condition evaluation (`checkHasConditions` /
- * `matchesRuleConditions`), and most apps configure no such conditions. The
- * cookie split and `searchParams` access are therefore deferred until first
- * read and computed at most once. Mirrors `headersContextFromRequest` in
- * `shims/headers.ts`.
- */
-declare function requestContextFromRequest(request: Request): RequestContext;
-declare function normalizeHost(hostHeader: string | null, fallbackHostname: string): string;
 /**
  * Unpack `x-middleware-request-*` headers from the collected middleware
  * response headers into the actual request, and strip all `x-middleware-*`
@@ -147,7 +124,7 @@ declare function matchRedirect(pathname: string, redirects: NextRedirect[], ctx:
  * to evaluate has/missing conditions. Next.js always has request context
  * when evaluating rewrites, so this parameter is required.
  */
-declare function matchRewrite(pathname: string, rewrites: NextRewrite[], ctx: RequestContext, basePathState?: BasePathMatchState): string | null;
+declare function matchRewrite(pathname: string, rewrites: NextRewrite[], ctx: RequestContext, basePathState?: BasePathMatchState, paramsPathname?: string): string | null;
 /**
  * Check whether a rewrite source can match a pathname without evaluating its
  * request-dependent `has` / `missing` conditions.
@@ -175,7 +152,6 @@ declare function sanitizeDestination(dest: string): string;
  * Detects any URL scheme (http:, https:, data:, javascript:, blob:, etc.)
  * per RFC 3986, plus protocol-relative URLs (//).
  */
-declare function isExternalUrl(url: string): boolean;
 /**
  * Merge the original request's query params into a config-redirect
  * destination, preserving them on the resulting `Location`.
@@ -218,8 +194,8 @@ declare function matchHeaders(pathname: string, headers: NextHeader[], ctx: Requ
   value: string;
 }>;
 /**
- * Apply Next.js i18n locale-prefix transformation to a set of redirect or
- * rewrite rules. Mirrors the relevant slice of Next.js's `processRoutes`
+ * Apply Next.js i18n locale-prefix transformation to a set of redirect,
+ * rewrite, or header rules. Mirrors the relevant slice of Next.js's `processRoutes`
  * (load-custom-routes.ts) with one deliberate divergence noted below.
  *
  * For each rule:
@@ -250,8 +226,8 @@ declare function matchHeaders(pathname: string, headers: NextHeader[], ctx: Requ
  * Mirrors the Next.js reference in
  * packages/next/src/lib/load-custom-routes.ts — see `processRoutes`.
  */
-declare function applyLocaleToRoutes<T extends NextRedirect | NextRewrite>(routes: T[], i18n: NextI18nConfig | null | undefined, type: "redirect" | "rewrite", options?: {
+declare function applyLocaleToRoutes<T extends NextRedirect | NextRewrite | NextHeader>(routes: T[], i18n: NextI18nConfig | null | undefined, type: "redirect" | "rewrite" | "header", options?: {
   trailingSlash?: boolean;
 }): T[];
 //#endregion
-export { BasePathMatchState, RequestContext, applyLocaleToRoutes, applyMiddlewareRequestHeaders, checkHasConditions, escapeHeaderSource, isExternalUrl, isSafeRegex, matchConfigPattern, matchHeaders, matchRedirect, matchRewrite, matchesRewriteSource, normalizeHost, parseCookies, preserveRedirectDestinationQuery, proxyExternalRequest, requestContextFromRequest, safeRegExp, sanitizeDestination };
+export { BasePathMatchState, type RequestContext, applyLocaleToRoutes, applyMiddlewareRequestHeaders, checkHasConditions, escapeHeaderSource, isExternalUrl, isSafeRegex, matchConfigPattern, matchHeaders, matchRedirect, matchRewrite, matchesRewriteSource, normalizeHost, parseCookies, preserveRedirectDestinationQuery, proxyExternalRequest, requestContextFromRequest, safeRegExp, sanitizeDestination };

package/dist/config/config-matchers.js

@@ -1,6 +1,8 @@
-import { VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER } from "../utils/protocol-headers.js";
+import { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
 import { buildRequestHeadersFromMiddlewareResponse } from "../utils/middleware-request-headers.js";
-import { parseCookieHeader } from "../utils/parse-cookie.js";
+import { analyzeRegexSafety } from "../utils/regex-safety.js";
+import { normalizeHost, parseCookies, requestContextFromRequest } from "./request-context.js";
+import { isExternalUrl } from "../utils/external-url.js";
 //#region src/config/config-matchers.ts
 /**
 * Cache for compiled regex patterns in matchConfigPattern.
@@ -191,75 +193,16 @@ function stripHopByHopRequestHeaders(headers) {
 /**
 * Detect regex patterns vulnerable to catastrophic backtracking (ReDoS).
 *
-* Uses a lightweight heuristic: scans the pattern string for nested quantifiers
-* (a quantifier applied to a group that itself contains a quantifier). This
-* catches the most common pathological patterns like `(a+)+`, `(.*)*`,
-* `([^/]+)+`, `(a|a+)+` without needing a full regex parser.
+* Uses the same deterministic structural analysis as middleware matcher
+* validation. Nested bounded repetition is accepted only when its repeated
+* language has fixed width and unambiguous branches; a fixed outer count can
+* otherwise still cause polynomially catastrophic backtracking on long near
+* misses.
 *
 * Returns true if the pattern appears safe, false if it's potentially dangerous.
 */
-function isSafeRegex(pattern) {
-	const quantifierAtDepth = [];
-	let depth = 0;
-	let i = 0;
-	while (i < pattern.length) {
-		const ch = pattern[i];
-		if (ch === "\\") {
-			i += 2;
-			continue;
-		}
-		if (ch === "[") {
-			i++;
-			while (i < pattern.length && pattern[i] !== "]") {
-				if (pattern[i] === "\\") i++;
-				i++;
-			}
-			i++;
-			continue;
-		}
-		if (ch === "(") {
-			depth++;
-			if (quantifierAtDepth.length <= depth) quantifierAtDepth.push(false);
-			else quantifierAtDepth[depth] = false;
-			i++;
-			continue;
-		}
-		if (ch === ")") {
-			const hadQuantifier = depth > 0 && quantifierAtDepth[depth];
-			if (depth > 0) depth--;
-			const next = pattern[i + 1];
-			if (next === "+" || next === "*" || next === "{") {
-				if (hadQuantifier) return false;
-				if (depth >= 0 && depth < quantifierAtDepth.length) quantifierAtDepth[depth] = true;
-			}
-			i++;
-			continue;
-		}
-		if (ch === "+" || ch === "*") {
-			if (depth > 0) quantifierAtDepth[depth] = true;
-			i++;
-			continue;
-		}
-		if (ch === "?") {
-			const prev = i > 0 ? pattern[i - 1] : "";
-			if (prev !== "+" && prev !== "*" && prev !== "?" && prev !== "}") {
-				if (depth > 0) quantifierAtDepth[depth] = true;
-			}
-			i++;
-			continue;
-		}
-		if (ch === "{") {
-			let j = i + 1;
-			while (j < pattern.length && /[\d,]/.test(pattern[j])) j++;
-			if (j < pattern.length && pattern[j] === "}" && j > i + 1) {
-				if (depth > 0) quantifierAtDepth[depth] = true;
-				i = j + 1;
-				continue;
-			}
-		}
-		i++;
-	}
-	return true;
+function isSafeRegex(pattern, flags) {
+	return analyzeRegexSafety(pattern, { ignoreCase: flags?.includes("i") }) === null;
 }
 /**
 * Compile a regex pattern safely. Returns the compiled RegExp or null if the
@@ -268,8 +211,8 @@ function isSafeRegex(pattern) {
 * Logs a warning when a pattern is rejected so developers can fix their config.
 */
 function safeRegExp(pattern, flags) {
-	if (!isSafeRegex(pattern)) {
-		console.warn(`[vinext] Rejecting potentially unsafe regex pattern (ReDoS risk): ${pattern}\n  Patterns with nested quantifiers (e.g. (a+)+) can cause catastrophic backtracking.\n  Simplify the pattern to avoid nested repetition.`);
+	if (!isSafeRegex(pattern, flags)) {
+		console.warn(`[vinext] Rejecting potentially unsafe regex pattern (ReDoS risk): ${pattern}\n  Nested or ambiguous repetition can cause catastrophic backtracking.\n  Simplify the pattern to make repeated matches fixed and unambiguous.`);
 		return null;
 	}
 	try {
@@ -342,40 +285,6 @@ function shouldEvaluateRule(ruleBasePath, state) {
 	return ruleBasePath === false ? !state.hadBasePath : state.hadBasePath;
 }
 /**
-* Parse a Cookie header string into a key-value record.
-*/
-function parseCookies(cookieHeader) {
-	return parseCookieHeader(cookieHeader);
-}
-/**
-* Build a RequestContext from a Web Request object.
-*
-* `cookies` and `query` are lazy memoized getters: they are consumed only by
-* `has`/`missing` condition evaluation (`checkHasConditions` /
-* `matchesRuleConditions`), and most apps configure no such conditions. The
-* cookie split and `searchParams` access are therefore deferred until first
-* read and computed at most once. Mirrors `headersContextFromRequest` in
-* `shims/headers.ts`.
-*/
-function requestContextFromRequest(request) {
-	const url = new URL(request.url);
-	let cookies;
-	let query;
-	return {
-		headers: request.headers,
-		get cookies() {
-			return cookies ??= parseCookies(request.headers.get("cookie"));
-		},
-		get query() {
-			return query ??= url.searchParams;
-		},
-		host: normalizeHost(request.headers.get("host"), url.hostname)
-	};
-}
-function normalizeHost(hostHeader, fallbackHostname) {
-	return (hostHeader ?? fallbackHostname).split(":", 1)[0].toLowerCase();
-}
-/**
 * Unpack `x-middleware-request-*` headers from the collected middleware
 * response headers into the actual request, and strip all `x-middleware-*`
 * internal signals so they never reach clients.
@@ -410,7 +319,7 @@ function _emptyParams() {
 	return Object.create(null);
 }
 function _matchConditionValue(actualValue, expectedValue) {
-	if (expectedValue === void 0) return _emptyParams();
+	if (!expectedValue) return actualValue ? _emptyParams() : null;
 	const re = _cachedConditionRegex(expectedValue);
 	if (re) {
 		const match = re.exec(actualValue);
@@ -440,9 +349,10 @@ function matchSingleCondition(condition, ctx) {
 			return _matchConditionValue(cookieValue, condition.value);
 		}
 		case "query": {
-			const queryValue = ctx.query.get(condition.key);
-			if (queryValue === null) return null;
-			return _matchConditionValue(queryValue, condition.value);
+			const queryValues = ctx.query.getAll(condition.key);
+			if (queryValues.length === 0) return null;
+			if (!condition.value && queryValues.length > 1) return _emptyParams();
+			return _matchConditionValue(queryValues[queryValues.length - 1], condition.value);
 		}
 		case "host":
 			if (condition.value !== void 0) return _matchConditionValue(ctx.host, condition.value);
@@ -710,11 +620,12 @@ function matchRedirect(pathname, redirects, ctx, basePathState = _BASEPATH_DEFAU
 * to evaluate has/missing conditions. Next.js always has request context
 * when evaluating rewrites, so this parameter is required.
 */
-function matchRewrite(pathname, rewrites, ctx, basePathState = _BASEPATH_DEFAULT) {
+function matchRewrite(pathname, rewrites, ctx, basePathState = _BASEPATH_DEFAULT, paramsPathname = pathname) {
 	for (const rewrite of rewrites) {
 		if (!shouldEvaluateRule(rewrite.basePath, basePathState)) continue;
-		const params = matchConfigPattern(pathname, rewrite.source);
-		if (params) {
+		const matchedParams = matchConfigPattern(pathname, rewrite.source);
+		if (matchedParams) {
+			const params = paramsPathname === pathname ? matchedParams : matchConfigPattern(paramsPathname, rewrite.source) ?? matchedParams;
 			const conditionParams = rewrite.has || rewrite.missing ? collectConditionParams(rewrite.has, rewrite.missing, ctx) : _emptyParams();
 			if (!conditionParams) continue;
 			const rewriteParams = {
@@ -868,9 +779,6 @@ function sanitizeDestination(dest) {
 * Detects any URL scheme (http:, https:, data:, javascript:, blob:, etc.)
 * per RFC 3986, plus protocol-relative URLs (//).
 */
-function isExternalUrl(url) {
-	return /^[a-z][a-z0-9+.-]*:/i.test(url) || url.startsWith("//");
-}
 /**
 * Merge the original request's query params into a config-redirect
 * destination, preserving them on the resulting `Location`.
@@ -927,6 +835,9 @@ async function proxyExternalRequest(request, externalUrl) {
 	for (const key of keysToDelete) headers.delete(key);
 	headers.delete(VINEXT_PRERENDER_SECRET_HEADER);
 	headers.delete(VINEXT_PRERENDER_ROUTE_PARAMS_HEADER);
+	headers.delete(PRERENDER_REVALIDATE_HEADER);
+	headers.delete(PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER);
+	headers.delete(VINEXT_REVALIDATE_HOST_HEADER);
 	headers.delete(VINEXT_MW_CTX_HEADER);
 	const method = request.method;
 	const hasBody = method !== "GET" && method !== "HEAD";
@@ -1004,8 +915,8 @@ function _escapeRegexString(value) {
 	return value.replace(/[|\\{}()[\]^$+*?.]/g, "\\$&");
 }
 /**
-* Apply Next.js i18n locale-prefix transformation to a set of redirect or
-* rewrite rules. Mirrors the relevant slice of Next.js's `processRoutes`
+* Apply Next.js i18n locale-prefix transformation to a set of redirect,
+* rewrite, or header rules. Mirrors the relevant slice of Next.js's `processRoutes`
 * (load-custom-routes.ts) with one deliberate divergence noted below.
 *
 * For each rule:
@@ -1048,7 +959,8 @@ function applyLocaleToRoutes(routes, i18n, type, options = {}) {
 			out.push(r);
 			continue;
 		}
-		const isExternal = !!r.destination && !r.destination.startsWith("/");
+		const destination = "destination" in r ? r.destination : void 0;
+		const isExternal = !!destination && !destination.startsWith("/");
 		if (!isExternal) for (const locale of defaultLocales) {
 			const localizedSource = `/${locale}${suffixFor(r.source)}`;
 			out.push({
@@ -1057,13 +969,14 @@ function applyLocaleToRoutes(routes, i18n, type, options = {}) {
 			});
 		}
 		const internalSource = `${internalLocale}${suffixFor(r.source)}`;
-		let internalDestination = r.destination;
+		let internalDestination = destination;
 		if (internalDestination && internalDestination.startsWith("/") && !isExternal) internalDestination = `/:nextInternalLocale${internalDestination === "/" && !trailingSlash ? "" : internalDestination}`;
-		out.push({
+		const internalRoute = {
 			...r,
-			source: internalSource,
-			destination: internalDestination
-		});
+			source: internalSource
+		};
+		if ("destination" in internalRoute && internalDestination !== void 0) internalRoute.destination = internalDestination;
+		out.push(internalRoute);
 		out.push(r);
 	}
 	return out;

package/dist/config/next-config.d.ts

@@ -54,7 +54,8 @@ type NextHeader = {
     key: string;
     value: string;
   }>; /** See {@link NextRedirect.basePath}. */
-  basePath?: false;
+  basePath?: false; /** See {@link NextRedirect.locale}. */
+  locale?: false;
 };
 type NextI18nConfig = {
   /** List of supported locales */locales: string[]; /** The default locale (used when no locale prefix is in the URL) */
@@ -71,7 +72,7 @@ type NextI18nConfig = {
     domain: string;
     defaultLocale: string;
     locales?: string[];
-    http?: boolean;
+    http?: true;
   }>;
 };
 /**
@@ -99,7 +100,11 @@ type NextConfig = {
    * @see https://nextjs.org/docs/app/api-reference/config/next-config-js/assetPrefix
    */
   assetPrefix?: string; /** Whether to add trailing slashes */
-  trailingSlash?: boolean; /** Internationalization routing config */
+  trailingSlash?: boolean; /** TypeScript build settings. */
+  typescript?: {
+    /** Project-relative path to the TypeScript configuration file. */tsconfigPath?: string;
+    [key: string]: unknown;
+  }; /** Internationalization routing config */
   i18n?: NextI18nConfig; /** URL redirect rules */
   redirects?: () => Promise<NextRedirect[]> | NextRedirect[]; /** URL rewrite rules */
   rewrites?: () => Promise<NextRewrite[] | {
@@ -216,7 +221,8 @@ type NextConfig = {
     prefetchInlining?: boolean | {
       maxBundleSize?: number;
       maxSize?: number;
-    };
+    }; /** Header names forwarded by Pages Router `res.revalidate()` internal requests. */
+    allowedRevalidateHeaderKeys?: string[];
     [key: string]: unknown;
   };
   /**
@@ -265,6 +271,9 @@ type ResolvedNextConfig = {
    */
   assetPrefix: string;
   trailingSlash: boolean;
+  typescript: {
+    tsconfigPath?: string;
+  };
   output: "" | "export" | "standalone";
   pageExtensions: string[];
   resolveExtensions: string[] | null;
@@ -294,7 +303,8 @@ type ResolvedNextConfig = {
   mdx: MdxOptions | null; /** Explicit module aliases preserved from wrapped next.config plugins. */
   aliases: Record<string, string>; /** Extra allowed origins for dev server access (from allowedDevOrigins). */
   allowedDevOrigins: string[]; /** Extra allowed origins for server action CSRF validation (from experimental.serverActions.allowedOrigins). */
-  serverActionsAllowedOrigins: string[]; /** Packages whose barrel imports should be optimized (from experimental.optimizePackageImports). */
+  serverActionsAllowedOrigins: string[]; /** Header names forwarded by Pages Router `res.revalidate()` internal requests. */
+  allowedRevalidateHeaderKeys: string[]; /** Packages whose barrel imports should be optimized (from experimental.optimizePackageImports). */
   optimizePackageImports: string[]; /** Packages explicitly requested for server/client transpilation. */
   transpilePackages: string[]; /** Packages treated as application code by Turbopack's foreign-code condition. */
   turbopackTranspilePackages: string[]; /** Inline app CSS into production HTML (from experimental.inlineCss). */

package/dist/config/next-config.js

@@ -1,6 +1,7 @@
 import path, { toSlash } from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { normalizePageExtensions } from "../routing/file-matcher.js";
-import { applyLocaleToRoutes, isExternalUrl } from "./config-matchers.js";
+import { isExternalUrl } from "../utils/external-url.js";
+import { applyLocaleToRoutes } from "./config-matchers.js";
 import { isUnknownRecord } from "../utils/record.js";
 import { getHtmlLimitedBotRegex } from "../utils/html-limited-bots.js";
 import { flattenPluginOptions } from "../utils/plugin-options.js";
@@ -657,6 +658,7 @@ async function resolveNextConfig(config, root = toSlash(process.cwd()), options
 			basePath: "",
 			assetPrefix: "",
 			trailingSlash: false,
+			typescript: {},
 			output: "",
 			pageExtensions: normalizePageExtensions(),
 			resolveExtensions: null,
@@ -678,6 +680,7 @@ async function resolveNextConfig(config, root = toSlash(process.cwd()), options
 			aliases: {},
 			allowedDevOrigins: [],
 			serverActionsAllowedOrigins: [],
+			allowedRevalidateHeaderKeys: [],
 			optimizePackageImports: [],
 			transpilePackages: [],
 			turbopackTranspilePackages: [...DEFAULT_TRANSPILED_PACKAGES],
@@ -815,6 +818,7 @@ async function resolveNextConfig(config, root = toSlash(process.cwd()), options
 			afterFiles: applyLocaleToRoutes(rewrites.afterFiles, i18n, "rewrite", opts),
 			fallback: applyLocaleToRoutes(rewrites.fallback, i18n, "rewrite", opts)
 		};
+		headers = applyLocaleToRoutes(headers, i18n, "header", opts);
 	}
 	const images = config.images ? {
 		...config.images,
@@ -831,6 +835,7 @@ async function resolveNextConfig(config, root = toSlash(process.cwd()), options
 		basePath: config.basePath ?? "",
 		assetPrefix: normalizeAssetPrefix(config.assetPrefix),
 		trailingSlash: config.trailingSlash ?? false,
+		typescript: typeof config.typescript?.tsconfigPath === "string" ? { tsconfigPath: config.typescript.tsconfigPath } : {},
 		output: output === "export" || output === "standalone" ? output : "",
 		pageExtensions,
 		resolveExtensions: resolveExtensions ?? webpackProbe.resolveExtensions,
@@ -849,6 +854,7 @@ async function resolveNextConfig(config, root = toSlash(process.cwd()), options
 		aliases,
 		allowedDevOrigins,
 		serverActionsAllowedOrigins,
+		allowedRevalidateHeaderKeys: Array.isArray(experimental?.allowedRevalidateHeaderKeys) ? experimental.allowedRevalidateHeaderKeys.filter((value) => typeof value === "string").map((value) => value.toLowerCase()) : [],
 		optimizePackageImports,
 		transpilePackages,
 		turbopackTranspilePackages,