vinext 1.0.0-beta.1 → 1.0.0-beta.3

package/dist/server/headers.d.ts

@@ -1,4 +1,4 @@
-import { MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER } from "../utils/protocol-headers.js";
+import { MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
 
 //#region src/server/headers.d.ts
 /**
@@ -107,4 +107,4 @@ declare const INTERNAL_HEADERS: string[];
 /** Vinext-only internal headers stripped alongside Next.js protocol internals. */
 declare const VINEXT_INTERNAL_HEADERS: string[];
 //#endregion
-export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };
+export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_REVALIDATE_HOST_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };

package/dist/server/headers.js

@@ -1,4 +1,4 @@
-import { MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_OVERRIDE_HEADERS, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER } from "../utils/protocol-headers.js";
+import { MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_OVERRIDE_HEADERS, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
 //#region src/server/headers.ts
 /**
 * Internal HTTP header name constants used throughout vinext.
@@ -127,7 +127,8 @@ const INTERNAL_HEADERS = [
 const VINEXT_INTERNAL_HEADERS = [
 	VINEXT_PRERENDER_ROUTE_PARAMS_HEADER,
 	VINEXT_PRERENDER_SPECULATIVE_HEADER,
-	VINEXT_PRERENDER_CACHE_LIFE_HEADER
+	VINEXT_PRERENDER_CACHE_LIFE_HEADER,
+	VINEXT_REVALIDATE_HOST_HEADER
 ];
 //#endregion
-export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };
+export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_REVALIDATE_HOST_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };

package/dist/server/isr-cache.d.ts

@@ -1,38 +1,11 @@
 import { OnRequestErrorContext } from "./instrumentation.js";
 import { RenderObservation } from "./cache-proof.js";
+import { AppRscRenderMode } from "./app-rsc-render-mode.js";
+import { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER } from "../utils/protocol-headers.js";
 import { normalizeMountedSlotsHeader } from "./app-mounted-slots-header.js";
 import { CacheHandlerValue, CachedAppPageValue, CachedPagesValue, IncrementalCacheValue } from "../shims/cache-handler.js";
-import { AppRscRenderMode } from "./app-rsc-render-mode.js";
 
 //#region src/server/isr-cache.d.ts
-/**
- * Header set on the internal request that `res.revalidate()` issues to
- * trigger on-demand ISR regeneration of a Pages Router route. Mirrors Next.js's
- * `PRERENDER_REVALIDATE_HEADER` (`x-prerender-revalidate`) — see
- * `.nextjs-ref/packages/next/src/lib/constants.ts`.
- *
- * SECURITY: in Next.js this header is NOT a presence flag — it carries the
- * secret `previewModeId`, and `checkIsOnDemandRevalidate`
- * (`.nextjs-ref/packages/next/src/server/api-utils/index.ts`) only treats a
- * request as on-demand revalidation when the value *equals* that secret. If we
- * gated on presence alone, any external client could send
- * `x-prerender-revalidate: <anything>` to force synchronous regeneration of any
- * ISR page, bypassing the fresh/stale cache short-circuits — a
- * cache-stampede/DoS vector. We therefore validate the value against
- * {@link getRevalidateSecret} (a build-time secret shared across all Workers
- * isolates) with a constant-time comparison, and only the matching value (sent
- * by our own `res.revalidate()`) is honored.
- */
-declare const PRERENDER_REVALIDATE_HEADER = "x-prerender-revalidate";
-/**
- * Companion header to {@link PRERENDER_REVALIDATE_HEADER}. When set,
- * `res.revalidate(path, { unstable_onlyGenerated: true })` only revalidates the
- * path if it was already generated, and a 404 response counts as a successful
- * no-op. Mirrors Next.js's `PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER`
- * (`x-prerender-revalidate-if-generated`) — see
- * `.nextjs-ref/packages/next/src/lib/constants.ts`.
- */
-declare const PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER = "x-prerender-revalidate-if-generated";
 declare function getRevalidateSecret(): string;
 declare function isRevalidateSecret(value: string | null | undefined): boolean;
 /**
@@ -44,20 +17,22 @@ declare function isRevalidateSecret(value: string | null | undefined): boolean;
 declare function isOnDemandRevalidateRequest(headerValue: string | string[] | null | undefined): boolean;
 type ISRCacheEntry = {
   value: CacheHandlerValue;
-  isStale: boolean;
+  isStale: boolean; /** The entry crossed its hard expire boundary and must not be served. */
+  isExpired?: boolean;
 };
 /**
  * Get a cache entry with staleness information.
  *
  * Returns { value, isStale: false } for fresh entries,
- * { value, isStale: true } for expired-but-usable entries,
- * or null for cache misses.
+ * { value, isStale: true } for stale-but-usable entries,
+ * { value, isStale: true, isExpired: true } for entries that must be retained
+ * as regeneration input but not served, or null for cache misses.
  */
 declare function isrGet(key: string): Promise<ISRCacheEntry | null>;
 /**
  * Store a value in the ISR cache with a revalidation period.
  */
-declare function isrSet(key: string, data: IncrementalCacheValue, revalidateSeconds: number, tags?: string[], expireSeconds?: number): Promise<void>;
+declare function isrSet(key: string, data: IncrementalCacheValue | null, revalidateSeconds: number | false, tags?: string[], expireSeconds?: number): Promise<void>;
 declare function isrSetPrerenderedAppPage(key: string, data: CachedAppPageValue, metadata: {
   expireSeconds?: number;
   revalidateSeconds?: number;
@@ -70,6 +45,8 @@ declare function isrSetPrerenderedAppPage(key: string, data: CachedAppPageValue,
    */
   tags?: string[];
 }): Promise<void>;
+/** Coalesce same-key synchronous on-demand revalidations. */
+declare function coalesceOnDemandRevalidation<T>(key: string, renderFn: () => Promise<T>): Promise<T>;
 /**
  * Trigger a background regeneration for a cache key.
  *
@@ -133,4 +110,4 @@ declare function setRevalidateDuration(key: string, seconds: number): void;
  */
 declare function getRevalidateDuration(key: string): number | undefined;
 //#endregion
-export { ISRCacheEntry, PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrCacheKey, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, getRevalidateDuration, getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, setRevalidateDuration, triggerBackgroundRegeneration };
+export { ISRCacheEntry, PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrCacheKey, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, coalesceOnDemandRevalidation, getRevalidateDuration, getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, setRevalidateDuration, triggerBackgroundRegeneration };

package/dist/server/isr-cache.js

@@ -1,4 +1,5 @@
 import { getRequestExecutionContext } from "../shims/request-context.js";
+import { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER } from "../utils/protocol-headers.js";
 import { reportRequestError } from "./instrumentation.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { fnv1a64 } from "../utils/hash.js";
@@ -7,34 +8,6 @@ import { APP_RSC_RENDER_MODE_NAVIGATION, getRscRenderModeCacheVariant } from "./
 import { normalizeAppPageInterceptionProofPathname } from "./app-page-render-identity.js";
 //#region src/server/isr-cache.ts
 /**
-* Header set on the internal request that `res.revalidate()` issues to
-* trigger on-demand ISR regeneration of a Pages Router route. Mirrors Next.js's
-* `PRERENDER_REVALIDATE_HEADER` (`x-prerender-revalidate`) — see
-* `.nextjs-ref/packages/next/src/lib/constants.ts`.
-*
-* SECURITY: in Next.js this header is NOT a presence flag — it carries the
-* secret `previewModeId`, and `checkIsOnDemandRevalidate`
-* (`.nextjs-ref/packages/next/src/server/api-utils/index.ts`) only treats a
-* request as on-demand revalidation when the value *equals* that secret. If we
-* gated on presence alone, any external client could send
-* `x-prerender-revalidate: <anything>` to force synchronous regeneration of any
-* ISR page, bypassing the fresh/stale cache short-circuits — a
-* cache-stampede/DoS vector. We therefore validate the value against
-* {@link getRevalidateSecret} (a build-time secret shared across all Workers
-* isolates) with a constant-time comparison, and only the matching value (sent
-* by our own `res.revalidate()`) is honored.
-*/
-const PRERENDER_REVALIDATE_HEADER = "x-prerender-revalidate";
-/**
-* Companion header to {@link PRERENDER_REVALIDATE_HEADER}. When set,
-* `res.revalidate(path, { unstable_onlyGenerated: true })` only revalidates the
-* path if it was already generated, and a 404 response counts as a successful
-* no-op. Mirrors Next.js's `PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER`
-* (`x-prerender-revalidate-if-generated`) — see
-* `.nextjs-ref/packages/next/src/lib/constants.ts`.
-*/
-const PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER = "x-prerender-revalidate-if-generated";
-/**
 * Build-time secret that authenticates on-demand revalidation requests, the
 * vinext analog of Next.js's prerender-manifest `previewModeId`.
 *
@@ -54,19 +27,22 @@ const PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER = "x-prerender-revalidate-if-ge
 *
 * When the build-time define is absent — dev mode, and any path that doesn't
 * run through `vinext build` — we fall back to a lazily-generated random secret.
-* Those paths are single-process, so a module-scoped value is shared by sender
-* and receiver there — no regression.
+* Those paths are single-process, but Vite can evaluate this module separately
+* in its RSC and SSR module graphs. Store the fallback on `globalThis` under a
+* registry symbol so every module copy in the process reads the same value.
 */
-let devRevalidateSecret;
+const _DEV_REVALIDATE_SECRET_KEY = Symbol.for("vinext.isrCache.devRevalidateSecret");
 function getRevalidateSecret() {
 	const baked = process.env.__VINEXT_REVALIDATE_SECRET;
 	if (baked) return baked;
-	if (devRevalidateSecret === void 0) {
-		const bytes = /* @__PURE__ */ new Uint8Array(32);
-		crypto.getRandomValues(bytes);
-		devRevalidateSecret = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
-	}
-	return devRevalidateSecret;
+	const globals = globalThis;
+	const existing = globals[_DEV_REVALIDATE_SECRET_KEY];
+	if (typeof existing === "string") return existing;
+	const bytes = /* @__PURE__ */ new Uint8Array(32);
+	crypto.getRandomValues(bytes);
+	const secret = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+	globals[_DEV_REVALIDATE_SECRET_KEY] = secret;
+	return secret;
 }
 /**
 * Constant-time string equality. Avoids leaking secret length / prefix via
@@ -98,16 +74,18 @@ function isOnDemandRevalidateRequest(headerValue) {
 * Get a cache entry with staleness information.
 *
 * Returns { value, isStale: false } for fresh entries,
-* { value, isStale: true } for expired-but-usable entries,
-* or null for cache misses.
+* { value, isStale: true } for stale-but-usable entries,
+* { value, isStale: true, isExpired: true } for entries that must be retained
+* as regeneration input but not served, or null for cache misses.
 */
 async function isrGet(key) {
 	const result = await getCdnCacheAdapter().get(key);
-	if (!result || !result.value) return null;
-	if (result.cacheState === "expired") return null;
+	if (!result) return null;
+	const isExpired = result.cacheState === "expired";
 	return {
 		value: result,
-		isStale: result.cacheState === "stale"
+		isStale: isExpired || result.cacheState === "stale",
+		...isExpired ? { isExpired: true } : {}
 	};
 }
 /**
@@ -142,6 +120,18 @@ async function isrSetPrerenderedAppPage(key, data, metadata) {
 const _PENDING_REGEN_KEY = Symbol.for("vinext.isrCache.pendingRegenerations");
 const _g = globalThis;
 const pendingRegenerations = _g[_PENDING_REGEN_KEY] ??= /* @__PURE__ */ new Map();
+const _PENDING_ON_DEMAND_REGEN_KEY = Symbol.for("vinext.isrCache.pendingOnDemandRegenerations");
+const pendingOnDemandRegenerations = _g[_PENDING_ON_DEMAND_REGEN_KEY] ??= /* @__PURE__ */ new Map();
+/** Coalesce same-key synchronous on-demand revalidations. */
+function coalesceOnDemandRevalidation(key, renderFn) {
+	const pending = pendingOnDemandRegenerations.get(key);
+	if (pending) return pending;
+	const promise = Promise.resolve().then(renderFn).finally(() => {
+		if (pendingOnDemandRegenerations.get(key) === promise) pendingOnDemandRegenerations.delete(key);
+	});
+	pendingOnDemandRegenerations.set(key, promise);
+	return promise;
+}
 /**
 * Trigger a background regeneration for a cache key.
 *
@@ -283,4 +273,4 @@ function getRevalidateDuration(key) {
 	return revalidateDurations.get(key);
 }
 //#endregion
-export { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrCacheKey, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, getRevalidateDuration, getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, setRevalidateDuration, triggerBackgroundRegeneration };
+export { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrCacheKey, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, coalesceOnDemandRevalidation, getRevalidateDuration, getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, setRevalidateDuration, triggerBackgroundRegeneration };

package/dist/server/isr-decision.d.ts

@@ -33,7 +33,7 @@ type DecideIsrOptions = {
    * For `"dev"` call sites this is the only source of the revalidate value —
    * dev never has metadata attached to a cache entry.
    */
-  revalidateSeconds: number;
+  revalidateSeconds: number | false;
   /**
    * The expire ceiling (seconds from epoch) read from the route config.
    * Absent when the route pre-dates expire metadata support.
@@ -63,7 +63,7 @@ declare function decideIsr(options: DecideIsrOptions): IsrDecision;
  * therefore never has `cacheControlMeta`. `expireSeconds` here is the route
  * config ceiling passed directly from the caller (not a per-entry fallback).
  */
-declare function buildMissIsrCacheControl(revalidateSeconds: number, expireSeconds?: number): string;
+declare function buildMissIsrCacheControl(revalidateSeconds: number | false, expireSeconds?: number): string;
 /**
  * Build the `Cache-Control` string for a fresh (MISS) app-route response.
  *

package/dist/server/middleware-matcher-pattern.d.ts

@@ -0,0 +1,22 @@
+import { HasCondition } from "../config/next-config.js";
+
+//#region src/server/middleware-matcher-pattern.d.ts
+type CompiledMiddlewareMatcherPattern = {
+  regexp: RegExp;
+  error?: never;
+} | {
+  regexp?: never;
+  error: string;
+  kind: "invalid" | "unsafe";
+};
+type MiddlewareMatcherObject = {
+  source: string;
+  locale?: false;
+  has?: HasCondition[];
+  missing?: HasCondition[];
+};
+declare function isValidMiddlewareMatcherObjectConfig(value: unknown): value is MiddlewareMatcherObject;
+declare function compileMiddlewareMatcherPattern(source: string): CompiledMiddlewareMatcherPattern;
+declare function validateMiddlewareMatcherPatterns(value: unknown): void;
+//#endregion
+export { CompiledMiddlewareMatcherPattern, MiddlewareMatcherObject, compileMiddlewareMatcherPattern, isValidMiddlewareMatcherObjectConfig, validateMiddlewareMatcherPatterns };

package/dist/server/middleware-matcher-pattern.js

@@ -0,0 +1,219 @@
+import { analyzeRegexSafety, regexAtomsMayOverlap } from "../utils/regex-safety.js";
+import { middlewarePathTokensToRegExp, normalizeMiddlewarePathTokens, parseMiddlewarePath } from "./middleware-path-to-regexp.js";
+//#region src/server/middleware-matcher-pattern.ts
+const MATCHER_OBJECT_KEYS = /* @__PURE__ */ new Set([
+	"source",
+	"locale",
+	"has",
+	"missing"
+]);
+const CONDITION_TYPES_WITH_KEY = /* @__PURE__ */ new Set([
+	"header",
+	"query",
+	"cookie"
+]);
+function invalidConditionReason(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return "has and missing entries must be objects";
+	const condition = value;
+	const type = condition.type;
+	if (typeof type === "string" && CONDITION_TYPES_WITH_KEY.has(type)) {
+		for (const key of Object.keys(condition)) if (key !== "type" && key !== "key" && key !== "value") return `condition contains unsupported field "${key}"`;
+		if (typeof condition.key !== "string") return `condition type "${type}" requires a string key`;
+		if (condition.value !== void 0 && typeof condition.value !== "string") return `condition type "${type}" requires value to be a string`;
+		return null;
+	}
+	if (type === "host") {
+		for (const key of Object.keys(condition)) if (key !== "type" && key !== "value") return `host condition contains unsupported field "${key}"`;
+		return typeof condition.value === "string" ? null : "host condition requires a string value";
+	}
+	return "condition type must be header, query, cookie, or host";
+}
+function invalidConditionsReason(value, field) {
+	if (value === void 0) return null;
+	if (!Array.isArray(value)) return `${field} must be an array`;
+	for (const condition of value) {
+		const reason = invalidConditionReason(condition);
+		if (reason) return `${field} ${reason}`;
+	}
+	return null;
+}
+function matcherObjectSource(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return { error: "matcher entries must be strings or objects" };
+	const matcher = value;
+	for (const key of Object.keys(matcher)) if (!MATCHER_OBJECT_KEYS.has(key)) return { error: `matcher object contains unsupported field "${key}"` };
+	if (typeof matcher.source !== "string") return { error: "matcher object requires a string source" };
+	if (matcher.locale !== void 0 && matcher.locale !== false) return { error: "matcher object locale must be false when provided" };
+	const invalidHas = invalidConditionsReason(matcher.has, "has");
+	if (invalidHas) return { error: invalidHas };
+	const invalidMissing = invalidConditionsReason(matcher.missing, "missing");
+	if (invalidMissing) return { error: invalidMissing };
+	return { source: matcher.source };
+}
+function isValidMiddlewareMatcherObjectConfig(value) {
+	return matcherObjectSource(value).error === void 0;
+}
+function patternMatches(pattern, value) {
+	try {
+		return new RegExp(`^(?:${pattern})$`).test(value);
+	} catch {
+		return false;
+	}
+}
+function atomsOverlap(left, right) {
+	return regexAtomsMayOverlap(left, right, true);
+}
+function groupCanMatchEmpty(group) {
+	if (/^\?(?:[=!]|<[=!])/.test(group)) return true;
+	return patternMatches(group.startsWith("?:") ? group.slice(2) : group, "");
+}
+function hasOverlappingSequentialRepetition(pattern) {
+	const repeatedAtDepth = [[]];
+	const groupStarts = [];
+	let depth = 0;
+	for (let index = 0; index < pattern.length; index++) {
+		const character = pattern[index];
+		if (character === "(") {
+			groupStarts.push(index);
+			depth++;
+			repeatedAtDepth[depth] = [];
+			if (pattern[index + 1] === "?") {
+				index++;
+				if (pattern[index + 1] === "<" && /[=!]/.test(pattern[index + 2] ?? "")) index += 2;
+				else if (/[=:!]/.test(pattern[index + 1] ?? "")) index++;
+			}
+			continue;
+		}
+		if (character === ")") {
+			const groupStart = groupStarts.pop();
+			repeatedAtDepth[depth] = [];
+			depth = Math.max(0, depth - 1);
+			if (groupStart !== void 0) {
+				const modifier = pattern[index + 1];
+				if (!(modifier === "*" || modifier === "?" || modifier === "{" && /^\{0(?:,\d*)?\}/.test(pattern.slice(index + 1))) && !groupCanMatchEmpty(pattern.slice(groupStart + 1, index))) repeatedAtDepth[depth] = [];
+			}
+			continue;
+		}
+		if (character === "|") {
+			repeatedAtDepth[depth] = [];
+			continue;
+		}
+		if (character === "^" || character === "$") continue;
+		if (character === "*" || character === "+" || character === "?" || character === "{") continue;
+		let atom = character;
+		if (character === "\\") {
+			if (index + 1 >= pattern.length) return true;
+			atom += pattern[++index];
+		} else if (character === "[") {
+			let classEnd = index + 1;
+			if (pattern[classEnd] === "^") classEnd++;
+			while (classEnd < pattern.length && pattern[classEnd] !== "]") {
+				if (pattern[classEnd] === "\\") classEnd++;
+				classEnd++;
+			}
+			if (classEnd >= pattern.length) return true;
+			atom = pattern.slice(index, classEnd + 1);
+			index = classEnd;
+		} else if (character === ".") atom = ".";
+		const quantifierStart = index + 1;
+		const quantifier = pattern[quantifierStart];
+		let unbounded = quantifier === "*" || quantifier === "+";
+		let canBeEmpty = quantifier === "*";
+		let quantifierEnd = quantifierStart;
+		if (quantifier === "{") {
+			const match = /^\{(\d+),\}/.exec(pattern.slice(quantifierStart));
+			if (match) {
+				unbounded = true;
+				canBeEmpty = Number(match[1]) === 0;
+				quantifierEnd += match[0].length - 1;
+			}
+		}
+		if (!unbounded) {
+			if (quantifier !== "?") repeatedAtDepth[depth] = [];
+			if (quantifier === "?") index = quantifierStart;
+			continue;
+		}
+		if (repeatedAtDepth[depth].some((previous) => atomsOverlap(previous, atom))) return true;
+		repeatedAtDepth[depth] = canBeEmpty ? [...repeatedAtDepth[depth], atom] : [atom];
+		index = quantifierEnd;
+	}
+	return false;
+}
+function unsafeTokenReason(token) {
+	const regexSafetyIssue = analyzeRegexSafety(token.pattern, { ignoreCase: true });
+	if (regexSafetyIssue) {
+		if (regexSafetyIssue === "analysis budget exceeded") return `parameter "${token.name}" exceeds the regex analysis budget`;
+		return `parameter "${token.name}" contains ${regexSafetyIssue}`;
+	}
+	if (hasOverlappingSequentialRepetition(token.pattern)) return `parameter "${token.name}" contains overlapping sequential repetition`;
+	if (token.modifier !== "*" && token.modifier !== "+") return null;
+	if (patternMatches(token.pattern, "") || patternMatches(token.pattern, "/")) return `repeated parameter "${token.name}" may match an empty value or path delimiter`;
+	return null;
+}
+function validateTokens(tokens) {
+	for (const token of tokens) {
+		if (typeof token === "string") continue;
+		const reason = unsafeTokenReason(token);
+		if (reason) return reason;
+	}
+	return null;
+}
+function compileMiddlewareMatcherPattern(source) {
+	if (!source.startsWith("/")) return {
+		kind: "invalid",
+		error: "source must start with /"
+	};
+	if (source.length > 4096) return {
+		kind: "invalid",
+		error: "source exceeds max built length of 4096"
+	};
+	let tokens;
+	try {
+		tokens = parseMiddlewarePath(source);
+	} catch (error) {
+		return {
+			kind: "invalid",
+			error: error instanceof Error ? error.message : "matcher could not be parsed"
+		};
+	}
+	const unsafeReason = validateTokens(tokens);
+	if (unsafeReason) return {
+		kind: "unsafe",
+		error: unsafeReason
+	};
+	try {
+		return { regexp: middlewarePathTokensToRegExp(tokens) };
+	} catch {
+		const normalizedTokens = normalizeMiddlewarePathTokens(tokens);
+		const normalizedUnsafeReason = validateTokens(normalizedTokens);
+		if (normalizedUnsafeReason) return {
+			kind: "unsafe",
+			error: normalizedUnsafeReason
+		};
+		try {
+			return { regexp: middlewarePathTokensToRegExp(normalizedTokens) };
+		} catch (error) {
+			return {
+				kind: "invalid",
+				error: error instanceof Error ? error.message : "matcher could not be compiled"
+			};
+		}
+	}
+}
+function validateMiddlewareMatcherPatterns(value) {
+	const sources = [];
+	if (typeof value === "string") sources.push(value);
+	else if (Array.isArray(value)) for (const matcher of value) if (typeof matcher === "string") sources.push(matcher);
+	else {
+		const result = matcherObjectSource(matcher);
+		if (result.error) throw new Error(`Invalid middleware matcher config: ${result.error}.`);
+		sources.push(result.source);
+	}
+	else throw new Error("Invalid middleware matcher config: matcher must be a string or an array of strings or objects.");
+	for (const source of sources) {
+		const result = compileMiddlewareMatcherPattern(source);
+		if (result.regexp) continue;
+		throw new Error(`Invalid middleware matcher "${source}": ${result.error}.`);
+	}
+}
+//#endregion
+export { compileMiddlewareMatcherPattern, isValidMiddlewareMatcherObjectConfig, validateMiddlewareMatcherPatterns };

package/dist/server/middleware-matcher.d.ts

@@ -1,12 +1,7 @@
-import { HasCondition, NextI18nConfig } from "../config/next-config.js";
+import { NextI18nConfig } from "../config/next-config.js";
+import { MiddlewareMatcherObject } from "./middleware-matcher-pattern.js";
 
 //#region src/server/middleware-matcher.d.ts
-type MiddlewareMatcherObject = {
-  source: string;
-  locale?: false;
-  has?: HasCondition[];
-  missing?: HasCondition[];
-};
 type MatcherConfig = string | Array<string | MiddlewareMatcherObject>;
 declare function matchesMiddleware(pathname: string, matcher: MatcherConfig | undefined, request?: Request, i18nConfig?: NextI18nConfig | null): boolean;
 declare function matchPattern(pathname: string, pattern: string): boolean;

package/dist/server/middleware-matcher.js

@@ -1,5 +1,7 @@
 import { removeTrailingSlash } from "../utils/base-path.js";
-import { checkHasConditions, isSafeRegex, requestContextFromRequest, safeRegExp } from "../config/config-matchers.js";
+import { requestContextFromRequest } from "../config/request-context.js";
+import { checkHasConditions } from "../config/config-matchers.js";
+import { compileMiddlewareMatcherPattern, isValidMiddlewareMatcherObjectConfig } from "./middleware-matcher-pattern.js";
 //#region src/server/middleware-matcher.ts
 const EMPTY_MIDDLEWARE_REQUEST_CONTEXT = {
 	headers: new Headers(),
@@ -12,30 +14,20 @@ const _mwPatternCache = /* @__PURE__ */ new Map();
 function matchesMiddleware(pathname, matcher, request, i18nConfig) {
 	if (!matcher) return true;
 	if (typeof matcher === "string") return matchMatcherPattern(pathname, matcher, i18nConfig);
-	if (!Array.isArray(matcher)) return false;
+	if (!Array.isArray(matcher)) return true;
 	const requestContext = request ? requestContextFromRequest(request) : EMPTY_MIDDLEWARE_REQUEST_CONTEXT;
 	for (const m of matcher) {
 		if (typeof m === "string") {
 			if (matchMatcherPattern(pathname, m, i18nConfig)) return true;
 			continue;
 		}
-		if (isValidMiddlewareMatcherObject(m)) {
-			if (!matchObjectMatcher(pathname, m, i18nConfig)) continue;
-			if (!checkHasConditions(m.has, m.missing, requestContext)) continue;
-			return true;
-		}
+		if (!isValidMiddlewareMatcherObjectConfig(m)) return true;
+		if (!matchObjectMatcher(pathname, m, i18nConfig)) continue;
+		if (!checkHasConditions(m.has, m.missing, requestContext)) continue;
+		return true;
 	}
 	return false;
 }
-function isValidMiddlewareMatcherObject(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-	if (!("source" in value) || typeof value.source !== "string") return false;
-	for (const key of Object.keys(value)) if (key !== "source" && key !== "locale" && key !== "has" && key !== "missing") return false;
-	if ("locale" in value && value.locale !== void 0 && value.locale !== false) return false;
-	if ("has" in value && value.has !== void 0 && !Array.isArray(value.has)) return false;
-	if ("missing" in value && value.missing !== void 0 && !Array.isArray(value.missing)) return false;
-	return true;
-}
 function matchMatcherPattern(pathname, pattern, i18nConfig) {
 	if (!i18nConfig) return matchPattern(pathname, pattern);
 	return matchPattern(stripLocalePrefix(pathname, i18nConfig) ?? pathname, pattern);
@@ -58,54 +50,15 @@ function matchPattern(pathname, pattern) {
 		_mwPatternCache.set(normalizedPattern, cached);
 	}
 	if (cached === UNSAFE_MATCHER_PATTERN) return true;
-	if (cached === null) return removeTrailingSlash(pathname) === normalizedPattern;
 	if (cached.test(pathname)) return true;
 	return pathname.endsWith("/") && cached.test(removeTrailingSlash(pathname));
 }
-function extractConstraint(str, re) {
-	if (str[re.lastIndex] !== "(") return null;
-	const start = re.lastIndex + 1;
-	let depth = 1;
-	let i = start;
-	while (i < str.length && depth > 0) {
-		if (str[i] === "(") depth++;
-		else if (str[i] === ")") depth--;
-		i++;
-	}
-	if (depth !== 0) return null;
-	re.lastIndex = i;
-	return str.slice(start, i - 1);
-}
 function compileMatcherPattern(pattern) {
-	const hasConstraints = /:[\w-]+[*+]?\(/.test(pattern);
-	if (!hasConstraints && (pattern.includes("(") || pattern.includes("\\"))) return compileMatcherRegExp("^" + pattern + "$", pattern);
-	let regexStr = "";
-	const tokenRe = /\/:([\w-]+)\*|\/:([\w-]+)\+|:([\w-]+)|[.]|[^/:.]+|./g;
-	let tok;
-	while ((tok = tokenRe.exec(pattern)) !== null) if (tok[1] !== void 0) {
-		const constraint = hasConstraints ? extractConstraint(pattern, tokenRe) : null;
-		regexStr += constraint !== null ? `(?:/(${constraint}))?` : "(?:/.*)?";
-	} else if (tok[2] !== void 0) {
-		const constraint = hasConstraints ? extractConstraint(pattern, tokenRe) : null;
-		regexStr += constraint !== null ? `(?:/(${constraint}))` : "(?:/.+)";
-	} else if (tok[3] !== void 0) {
-		const constraint = hasConstraints ? extractConstraint(pattern, tokenRe) : null;
-		const isOptional = pattern[tokenRe.lastIndex] === "?";
-		if (isOptional) tokenRe.lastIndex += 1;
-		const group = constraint !== null ? `(${constraint})` : "([^/]+)";
-		if (isOptional && regexStr.endsWith("/")) regexStr = regexStr.slice(0, -1) + `(?:/${group})?`;
-		else if (isOptional) regexStr += `${group}?`;
-		else regexStr += group;
-	} else if (tok[0] === ".") regexStr += "\\.";
-	else regexStr += tok[0];
-	return compileMatcherRegExp("^" + regexStr + "$", pattern);
-}
-function compileMatcherRegExp(regexPattern, sourcePattern) {
-	if (!isSafeRegex(regexPattern)) {
-		console.warn(`[vinext] Rejecting potentially unsafe middleware matcher (ReDoS risk): ${sourcePattern}\n  Middleware will run for all paths to avoid bypassing request guards.\n  Simplify the matcher to avoid nested repetition.`);
-		return UNSAFE_MATCHER_PATTERN;
-	}
-	return safeRegExp(regexPattern);
+	const result = compileMiddlewareMatcherPattern(pattern);
+	if (result.regexp) return result.regexp;
+	const problem = result.kind === "unsafe" ? "potentially unsafe" : "invalid";
+	console.warn(`[vinext] Rejecting ${problem} middleware matcher: ${pattern}\n  ${result.error}.\n  Middleware will run for all paths to avoid bypassing request guards.`);
+	return UNSAFE_MATCHER_PATTERN;
 }
 //#endregion
 export { matchPattern, matchesMiddleware };

package/dist/server/middleware-path-to-regexp.d.ts

@@ -0,0 +1,14 @@
+//#region src/server/middleware-path-to-regexp.d.ts
+type MiddlewarePathToken = string | MiddlewarePathKey;
+type MiddlewarePathKey = {
+  name: string | number;
+  prefix: string;
+  suffix: string;
+  pattern: string;
+  modifier: string;
+};
+declare function parseMiddlewarePath(value: string): MiddlewarePathToken[];
+declare function normalizeMiddlewarePathTokens(tokens: MiddlewarePathToken[]): MiddlewarePathToken[];
+declare function middlewarePathTokensToRegExp(tokens: MiddlewarePathToken[]): RegExp;
+//#endregion
+export { MiddlewarePathKey, MiddlewarePathToken, middlewarePathTokensToRegExp, normalizeMiddlewarePathTokens, parseMiddlewarePath };