vinext 1.0.0-beta.1 → 1.0.0-beta.3

package/dist/server/pages-request-pipeline.js

@@ -1,10 +1,15 @@
 import { addBasePathToPathname, hasBasePath } from "../utils/base-path.js";
 import { patternToNextFormat } from "../routing/route-validation.js";
-import { applyMiddlewareRequestHeaders, isExternalUrl, matchRedirect, matchRewrite, preserveRedirectDestinationQuery, proxyExternalRequest, requestContextFromRequest, sanitizeDestination } from "../config/config-matchers.js";
-import { applyConfigHeadersToHeaderRecord, cloneRequestWithUrl, normalizeTrailingSlash } from "./request-pipeline.js";
+import { PRERENDER_REVALIDATE_HEADER } from "../utils/protocol-headers.js";
+import { requestContextFromRequest } from "../config/request-context.js";
+import { isExternalUrl } from "../utils/external-url.js";
+import { applyMiddlewareRequestHeaders, matchRedirect, matchRewrite, preserveRedirectDestinationQuery, proxyExternalRequest, sanitizeDestination } from "../config/config-matchers.js";
+import { cloneRequestWithUrl, normalizeTrailingSlash } from "./request-pipeline.js";
+import { isOnDemandRevalidateRequest } from "./isr-cache.js";
 import { mergeRewriteQuery } from "../utils/query.js";
 import { normalizeDefaultLocalePathname, stripI18nLocaleForApiRoute } from "./pages-i18n.js";
 import { buildMiddlewarePrefetchSkipResponse } from "./pages-data-route.js";
+import { applyConfigHeadersToHeaderRecord } from "./config-headers.js";
 import { mergeHeaders } from "./worker-utils.js";
 //#region src/server/pages-request-pipeline.ts
 async function fetchWorkerFilesystemRoute(request, requestPathname, phase, fetchAsset) {
@@ -53,6 +58,9 @@ async function runPagesRequest(request, deps) {
 	const url = new URL(request.url);
 	let pathname = url.pathname;
 	const search = url.search;
+	const revalidateHeader = request.headers.get(PRERENDER_REVALIDATE_HEADER);
+	const isOnDemandRevalidate = deps.authorizeOnDemandRevalidate ? deps.authorizeOnDemandRevalidate(revalidateHeader) : isOnDemandRevalidateRequest(revalidateHeader);
+	const requestConfigPathname = deps.configMatchPathname ?? pathname;
 	const basePathState = {
 		basePath,
 		hadBasePath
@@ -66,9 +74,9 @@ async function runPagesRequest(request, deps) {
 	}
 	const reqCtx = requestContextFromRequest(request);
 	const requestHostname = i18nConfig ? url.hostname : "";
-	const matchPathname = i18nConfig ? normalizeDefaultLocalePathname(pathname, i18nConfig, { hostname: requestHostname }) : pathname;
+	const requestConfigMatchPathname = i18nConfig ? normalizeDefaultLocalePathname(requestConfigPathname, i18nConfig, { hostname: requestHostname }) : requestConfigPathname;
 	if (configRedirects.length) {
-		const redirect = matchRedirect(matchPathname, configRedirects, reqCtx, basePathState);
+		const redirect = matchRedirect(requestConfigMatchPathname, configRedirects, reqCtx, basePathState);
 		if (redirect) {
 			const location = preserveRedirectDestinationQuery(sanitizeDestination(basePath && hadBasePath && !isExternalUrl(redirect.destination) && !hasBasePath(redirect.destination, basePath) ? basePath + redirect.destination : redirect.destination), deps.rawSearch ?? search);
 			return {
@@ -82,6 +90,7 @@ async function runPagesRequest(request, deps) {
 	}
 	const originalResolvedUrl = pathname + search;
 	let resolvedUrl = originalResolvedUrl;
+	let resolvedPathnameIsRequestPathname = true;
 	const middlewareHeaders = {};
 	let middlewareStatus;
 	const serveFilesystemRoute = async (requestPathname, phase) => {
@@ -93,7 +102,7 @@ async function runPagesRequest(request, deps) {
 		};
 		return served ? { type: "handled" } : null;
 	};
-	if (typeof deps.runMiddleware === "function") {
+	if (!isOnDemandRevalidate && typeof deps.runMiddleware === "function") {
 		const result = await deps.runMiddleware(request, deps.ctx ?? null, { isDataRequest });
 		if (result.waitUntilPromises && result.waitUntilPromises.length > 0) {
 			const ctx = deps.ctx;
@@ -131,7 +140,10 @@ async function runPagesRequest(request, deps) {
 			else if (existing) middlewareHeaders[key] = [existing, value];
 			else middlewareHeaders[key] = [value];
 		} else middlewareHeaders[key] = value;
-		if (result.rewriteUrl) resolvedUrl = result.rewriteUrl;
+		if (result.rewriteUrl) {
+			resolvedUrl = result.rewriteUrl;
+			resolvedPathnameIsRequestPathname = false;
+		}
 		middlewareStatus = result.status ?? result.rewriteStatus;
 	}
 	const { postMwReqCtx, request: postMwReq } = applyMiddlewareRequestHeaders(middlewareHeaders, request, { preserveCredentialHeaders: isExternalUrl(resolvedUrl) });
@@ -143,6 +155,7 @@ async function runPagesRequest(request, deps) {
 	});
 	let resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
 	const matchResolvedPathname = (p) => i18nConfig ? normalizeDefaultLocalePathname(p, i18nConfig, { hostname: requestHostname }) : p;
+	const configSourcePathname = () => resolvedPathnameIsRequestPathname ? requestConfigMatchPathname : matchResolvedPathname(resolvedPathname);
 	const matchedPathnameForRoute = (routePattern) => {
 		const matchedPathname = routePattern ? patternToNextFormat(routePattern) : resolvedPathname;
 		if (!i18nConfig) return matchedPathname;
@@ -161,7 +174,7 @@ async function runPagesRequest(request, deps) {
 	};
 	if (configHeaders.length) applyConfigHeadersToHeaderRecord(middlewareHeaders, {
 		configHeaders,
-		pathname: matchPathname,
+		pathname: requestConfigMatchPathname,
 		requestContext: reqCtx,
 		basePathState
 	});
@@ -173,7 +186,7 @@ async function runPagesRequest(request, deps) {
 	if (directFilesystemResult) return directFilesystemResult;
 	let configRewriteFired = false;
 	for (const rewrite of configRewrites.beforeFiles ?? []) {
-		const rewritten = matchRewrite(matchResolvedPathname(resolvedPathname), [rewrite], rewriteRequestContext(), basePathState);
+		const rewritten = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), basePathState);
 		if (rewritten) {
 			if (isExternalUrl(rewritten)) return {
 				type: "response",
@@ -181,6 +194,7 @@ async function runPagesRequest(request, deps) {
 			};
 			resolvedUrl = mergeRewriteQuery(resolvedUrl, rewritten);
 			resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
+			resolvedPathnameIsRequestPathname = false;
 			configRewriteFired = true;
 		}
 	}
@@ -227,7 +241,7 @@ async function runPagesRequest(request, deps) {
 	let pageMatch = !isOutsideBasePathUnclaimed() && deps.matchPageRoute ? deps.matchPageRoute(resolvedPathname, request) : null;
 	let resolvedPathnameChanged = false;
 	if (!pageMatch || pageMatch.route.isDynamic) for (const rewrite of configRewrites.afterFiles ?? []) {
-		const rewritten = matchRewrite(matchResolvedPathname(resolvedPathname), [rewrite], rewriteRequestContext(), basePathState);
+		const rewritten = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), basePathState);
 		if (rewritten) {
 			if (isExternalUrl(rewritten)) return {
 				type: "response",
@@ -235,6 +249,7 @@ async function runPagesRequest(request, deps) {
 			};
 			resolvedUrl = mergeRewriteQuery(resolvedUrl, rewritten);
 			resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
+			resolvedPathnameIsRequestPathname = false;
 			configRewriteFired = true;
 			resolvedPathnameChanged = true;
 			const afterFilesFilesystemResult = await serveFilesystemRoute(resolvedPathname, "afterFiles");
@@ -253,7 +268,7 @@ async function runPagesRequest(request, deps) {
 	if (typeof deps.renderPage === "function") {
 		let renderPageMatch = pageMatch;
 		if ((isOutsideBasePathUnclaimed() || isDataReq || isDataRequest) && !renderPageMatch && configRewrites.fallback?.length) for (const rewrite of configRewrites.fallback) {
-			const fallbackRewrite = matchRewrite(matchResolvedPathname(resolvedPathname), [rewrite], rewriteRequestContext(), basePathState);
+			const fallbackRewrite = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), basePathState);
 			if (!fallbackRewrite) continue;
 			if (isExternalUrl(fallbackRewrite)) return {
 				type: "response",
@@ -261,6 +276,7 @@ async function runPagesRequest(request, deps) {
 			};
 			resolvedUrl = mergeRewriteQuery(resolvedUrl, fallbackRewrite);
 			resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
+			resolvedPathnameIsRequestPathname = false;
 			configRewriteFired = true;
 			const fallbackFilesystemResult = await serveFilesystemRoute(resolvedPathname, "fallback");
 			if (fallbackFilesystemResult) return fallbackFilesystemResult;
@@ -281,7 +297,7 @@ async function runPagesRequest(request, deps) {
 		let response = await deps.renderPage(request, resolvedUrl, initialRenderOptions, stagedHeaders);
 		let matchedFallbackRewrite = false;
 		if (response.status === 404 && shouldDeferErrorPageOnMiss && configRewrites.fallback?.length) for (const rewrite of configRewrites.fallback) {
-			const fallbackRewrite = matchRewrite(matchResolvedPathname(resolvedPathname), [rewrite], rewriteRequestContext(), basePathState);
+			const fallbackRewrite = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), basePathState);
 			if (!fallbackRewrite) continue;
 			if (isExternalUrl(fallbackRewrite)) return {
 				type: "response",
@@ -289,6 +305,7 @@ async function runPagesRequest(request, deps) {
 			};
 			resolvedUrl = mergeRewriteQuery(resolvedUrl, fallbackRewrite);
 			resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
+			resolvedPathnameIsRequestPathname = false;
 			configRewriteFired = true;
 			const fallbackFilesystemResult = await serveFilesystemRoute(resolvedPathname, "fallback");
 			if (fallbackFilesystemResult) return fallbackFilesystemResult;
@@ -325,7 +342,7 @@ async function runPagesRequest(request, deps) {
 	}
 	let devPageMatch = isOutsideBasePathUnclaimed() ? null : resolvedPathnameChanged ? deps.matchPageRoute ? deps.matchPageRoute(resolvedPathname, request) : null : pageMatch;
 	if (!devPageMatch && configRewrites.fallback?.length) for (const rewrite of configRewrites.fallback) {
-		const fallbackRewrite = matchRewrite(matchResolvedPathname(resolvedPathname), [rewrite], rewriteRequestContext(), basePathState);
+		const fallbackRewrite = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), basePathState);
 		if (!fallbackRewrite) continue;
 		if (isExternalUrl(fallbackRewrite)) return {
 			type: "response",
@@ -333,6 +350,7 @@ async function runPagesRequest(request, deps) {
 		};
 		resolvedUrl = mergeRewriteQuery(resolvedUrl, fallbackRewrite);
 		resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
+		resolvedPathnameIsRequestPathname = false;
 		configRewriteFired = true;
 		const fallbackFilesystemResult = await serveFilesystemRoute(resolvedPathname, "fallback");
 		if (fallbackFilesystemResult) return fallbackFilesystemResult;

package/dist/server/pages-revalidate.d.ts

@@ -10,6 +10,6 @@ type RevalidateOptions = {
    */
   unstable_onlyGenerated?: boolean;
 };
-declare function performOnDemandRevalidate(source: IncomingMessage | Headers, urlPath: string, opts?: RevalidateOptions): Promise<void>;
+declare function performOnDemandRevalidate(source: IncomingMessage | Headers, urlPath: string, opts?: RevalidateOptions, trustedOrigin?: string, allowedRevalidateHeaderKeys?: readonly string[], dev?: boolean): Promise<void>;
 //#endregion
 export { RevalidateOptions, performOnDemandRevalidate };

package/dist/server/pages-revalidate.js

@@ -1,19 +1,65 @@
+import { getRequestExecutionContext } from "../shims/request-context.js";
+import { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
 import "./headers.js";
-import { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, getRevalidateSecret } from "./isr-cache.js";
+import { getRevalidateSecret, isOnDemandRevalidateRequest } from "./isr-cache.js";
+import { normalizeDomainHostname } from "../utils/domain-locale.js";
 import { resolveRequestHost, resolveRequestProtocol } from "./proxy-trust.js";
 //#region src/server/pages-revalidate.ts
-async function performOnDemandRevalidate(source, urlPath, opts = {}) {
+async function performOnDemandRevalidate(source, urlPath, opts = {}, trustedOrigin, allowedRevalidateHeaderKeys = [], dev = false) {
 	if (typeof urlPath !== "string" || !urlPath.startsWith("/")) throw new Error(`Invalid urlPath provided to revalidate(), must be a path e.g. /blog/post-1, received ${urlPath}`);
-	const proto = resolveRequestProtocol(source);
-	const host = resolveRequestHost(source, "localhost");
-	const target = new URL(urlPath, `${proto}://${host}`);
+	if (isSourceRevalidationRequest(source)) throw new Error(`Cannot revalidate ${urlPath} from an internal revalidation request`);
+	const executionContext = getRequestExecutionContext();
+	const dispatchRevalidate = executionContext?.dispatchPagesRevalidate;
+	const target = createRevalidateTarget(source, urlPath, trustedOrigin);
 	const headers = { [PRERENDER_REVALIDATE_HEADER]: getRevalidateSecret() };
+	if (trustedOrigin && !dispatchRevalidate) {
+		const logicalHostname = normalizeDomainHostname(resolveRequestHost(source, "localhost"));
+		if (logicalHostname) headers[VINEXT_REVALIDATE_HOST_HEADER] = logicalHostname;
+	}
 	if (opts.unstable_onlyGenerated) headers[PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER] = "1";
-	const res = await fetch(target, {
+	const allowedHeaders = new Set(allowedRevalidateHeaderKeys.map((key) => key.toLowerCase()));
+	if (dev) allowedHeaders.add("cookie");
+	for (const key of allowedHeaders) {
+		const value = readSourceHeader(source, key);
+		if (value !== void 0) headers[key] = value;
+	}
+	if (dispatchRevalidate && executionContext.isInternalPagesRevalidation) throw new Error(`Cannot revalidate ${urlPath} from an internal revalidation request`);
+	const res = await fetchRevalidateTarget(target, headers, dispatchRevalidate);
+	if (!((res.headers.get("x-vercel-cache") ?? res.headers.get("x-nextjs-cache"))?.toUpperCase() === "REVALIDATED" || res.status === 200 || res.status === 404 && opts.unstable_onlyGenerated === true)) throw new Error(`Failed to revalidate ${urlPath}: ${res.status}`);
+}
+function readSourceHeader(source, key) {
+	if (isWebHeaders(source)) return source.get(key) ?? void 0;
+	const value = source.headers[key];
+	return Array.isArray(value) ? value.join(", ") : value;
+}
+function isSourceRevalidationRequest(source) {
+	return isOnDemandRevalidateRequest(isWebHeaders(source) ? source.get(PRERENDER_REVALIDATE_HEADER) : source.headers[PRERENDER_REVALIDATE_HEADER]);
+}
+function isWebHeaders(source) {
+	return typeof source.get === "function";
+}
+async function fetchRevalidateTarget(initialTarget, headers, dispatchRevalidate) {
+	const request = new Request(initialTarget, {
 		method: "HEAD",
-		headers
+		headers,
+		redirect: "manual"
 	});
-	if (!(res.headers.get("x-nextjs-cache")?.toUpperCase() === "REVALIDATED" || res.status === 200 || res.status === 404 && opts.unstable_onlyGenerated === true)) throw new Error(`Failed to revalidate ${urlPath}: ${res.status}`);
+	return dispatchRevalidate ? await dispatchRevalidate(request) : await fetch(request);
+}
+function createRevalidateTarget(source, urlPath, trustedOrigin) {
+	const origin = resolveRevalidateOrigin(source, trustedOrigin);
+	const target = new URL(`${origin}${urlPath}`);
+	if (target.origin !== origin) throw new Error(`Invalid urlPath provided to revalidate(), resolved outside application origin`);
+	return target;
+}
+function resolveRevalidateOrigin(source, trustedOrigin) {
+	if (trustedOrigin) return normalizeRevalidateOrigin(trustedOrigin);
+	return normalizeRevalidateOrigin(`${resolveRequestProtocol(source)}://${resolveRequestHost(source, "localhost")}`);
+}
+function normalizeRevalidateOrigin(origin) {
+	const parsed = new URL(origin);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`Invalid revalidate origin protocol: ${parsed.protocol}`);
+	return parsed.origin;
 }
 //#endregion
 export { performOnDemandRevalidate };

package/dist/server/pages-router-entry.d.ts

@@ -22,6 +22,7 @@ type PagesWorkerEnv = {
 type PagesWorkerExecutionContext = {
   waitUntil?(promise: Promise<unknown>): void;
   passThroughOnException?(): void;
+  cache?: unknown;
 };
 declare const _default: {
   fetch(request: Request, env?: PagesWorkerEnv, ctx?: PagesWorkerExecutionContext): Promise<Response>;

package/dist/server/pages-router-entry.js

@@ -1,4 +1,6 @@
+import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
+import { VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
 import { notFoundStaticAssetResponse } from "./http-error-responses.js";
 import { isOpenRedirectShaped } from "./open-redirect.js";
 import { cloneRequestWithHeaders, cloneRequestWithUrl, filterInternalHeaders } from "./request-pipeline.js";
@@ -6,6 +8,7 @@ import { assetPrefixPathname, isNextStaticPath } from "../utils/asset-prefix.js"
 import { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, handleConfiguredImageOptimization, isImageOptimizationPath } from "./image-optimization.js";
 import { finalizeMissingStaticAssetResponse } from "./worker-utils.js";
 import { fetchWorkerFilesystemRoute, runPagesRequest, wrapMiddlewareWithBasePath } from "./pages-request-pipeline.js";
+import { createWorkerRevalidationContext } from "./worker-revalidation-context.js";
 import { registerConfiguredCacheAdapters } from "virtual:vinext-cache-adapters";
 import { registerConfiguredImageOptimizer } from "virtual:vinext-image-adapters";
 import * as pagesEntry from "virtual:vinext-server-entry";
@@ -24,7 +27,7 @@ import * as pagesEntry from "virtual:vinext-server-entry";
 *   import handler from "vinext/server/pages-router-entry";
 *   return handler.fetch(request, env, ctx);
 */
-const { handleApiRoute, hasMiddleware, matchPageRoute, normalizeDataRequest, renderPage, runMiddleware, vinextConfig } = pagesEntry;
+const { authorizeOnDemandRevalidate, handleApiRoute, hasMiddleware, matchPageRoute, normalizeDataRequest, renderPage, runMiddleware, vinextConfig } = pagesEntry;
 const basePath = vinextConfig?.basePath ?? "";
 const assetPathPrefix = assetPrefixPathname(vinextConfig?.assetPrefix ?? "");
 const trailingSlash = vinextConfig?.trailingSlash ?? false;
@@ -46,14 +49,22 @@ const imageConfig = vinextConfig?.images ? {
 var pages_router_entry_default = { async fetch(request, env, ctx) {
 	return handleRequest(request, env, ctx);
 } };
-async function handleRequest(request, env, ctx) {
+async function handleRequest(request, env, platformCtx) {
+	const ctx = createWorkerRevalidationContext(platformCtx, (internalRequest, internalCtx) => handleRequest(internalRequest, env, internalCtx));
 	registerConfiguredCacheAdapters(env);
 	registerConfiguredImageOptimizer(env);
 	try {
 		let pathname = new URL(request.url).pathname;
 		if (isOpenRedirectShaped(pathname)) return new Response("This page could not be found", { status: 404 });
+		try {
+			normalizePathnameForRouteMatchStrict(pathname);
+		} catch {
+			return new Response("Bad Request", { status: 400 });
+		}
 		const missingBuildAsset = isNextStaticPath(pathname, basePath, assetPathPrefix);
-		request = cloneRequestWithHeaders(request, filterInternalHeaders(request.headers));
+		const filteredHeaders = ctx.isInternalPagesRevalidation ? new Headers(request.headers) : filterInternalHeaders(request.headers);
+		filteredHeaders.delete(VINEXT_REVALIDATE_HOST_HEADER);
+		request = cloneRequestWithHeaders(request, filteredHeaders);
 		const hadBasePath = !basePath || hasBasePath(pathname, basePath);
 		{
 			const stripped = stripBasePath(pathname, basePath);
@@ -87,10 +98,11 @@ async function handleRequest(request, env, ctx) {
 			isDataRequest: isDataReq,
 			hasMiddleware,
 			ctx,
+			authorizeOnDemandRevalidate: typeof authorizeOnDemandRevalidate === "function" ? authorizeOnDemandRevalidate : void 0,
 			matchPageRoute: typeof matchPageRoute === "function" ? matchPageRoute : null,
 			runMiddleware: typeof runMiddleware === "function" ? wrapMiddlewareWithBasePath(runMiddleware, basePath, hadBasePath) : null,
 			renderPage: typeof renderPage === "function" ? (req, resolvedUrl, options, stagedHeaders) => renderPage(req, resolvedUrl, null, ctx, stagedHeaders, options) : null,
-			handleApi: typeof handleApiRoute === "function" ? (req, apiUrl) => handleApiRoute(req, apiUrl, ctx) : null,
+			handleApi: typeof handleApiRoute === "function" ? (req, apiUrl) => handleApiRoute(req, apiUrl, ctx, new URL(req.url).origin) : null,
 			serveFilesystemRoute: async (requestPathname, _stagedHeaders, phase) => {
 				if (!env?.ASSETS) return false;
 				return fetchWorkerFilesystemRoute(request, requestPathname, phase, (assetRequest) => Promise.resolve(env.ASSETS.fetch(assetRequest)));

package/dist/server/prerender-route-params.js

@@ -58,11 +58,11 @@ function decodedPrerenderRouteParamEquals(prerenderValue, matchedValue) {
 		if (prerenderValue.length !== matchedValue.length) return false;
 		return prerenderValue.every((item, index) => {
 			const decoded = decodePrerenderRouteParam(item);
-			return decoded !== null && decoded === matchedValue[index];
+			return item === matchedValue[index] || decoded !== null && decoded === matchedValue[index];
 		});
 	}
 	const decoded = decodePrerenderRouteParam(prerenderValue);
-	return decoded !== null && decoded === matchedValue;
+	return prerenderValue === matchedValue || decoded !== null && decoded === matchedValue;
 }
 function prerenderRouteParamsPayloadMatchesRoute(payload, routePattern, params) {
 	return matchPrerenderRouteParamsPayload(payload, routePattern, params)?.kind === "exact";

package/dist/server/prod-server.d.ts

@@ -1,3 +1,4 @@
+import { NextI18nConfig } from "../config/next-config.js";
 import { negotiateEncoding } from "./accept-encoding.js";
 import { StaticFileCache } from "./static-file-cache.js";
 import { resolveRequestHost, trustProxy, trustedHosts } from "./proxy-trust.js";
@@ -101,12 +102,9 @@ declare function tryServeStatic(req: IncomingMessage, res: ServerResponse, clien
  * Convert a Node.js IncomingMessage to a Web Request object.
  *
  * When `urlOverride` is provided, it is used as the path + query string
- * instead of `req.url`. This avoids redundant path normalization when the
- * caller has already decoded and normalized the pathname (e.g. the App
- * Router prod server normalizes before static-asset lookup, and can pass
- * the result here so the downstream RSC handler doesn't re-normalize).
+ * instead of `req.url`.
  */
-declare function nodeToWebRequest(req: IncomingMessage, urlOverride?: string, prerenderSecret?: string): Request;
+declare function nodeToWebRequest(req: IncomingMessage, urlOverride?: string, prerenderSecret?: string, i18nConfig?: NextI18nConfig | null, authorizeOnDemandRevalidate?: (headerValue: string | null) => boolean): Request;
 /**
  * Stream a Web Response back to a Node.js ServerResponse.
  * Supports streaming compression for SSR responses.

package/dist/server/prod-server.js

@@ -6,9 +6,9 @@ import { VINEXT_STATIC_FILE_HEADER } from "./headers.js";
 import { normalizePath } from "./normalize-path.js";
 import { notFoundResponse } from "./http-error-responses.js";
 import { isOpenRedirectShaped } from "./open-redirect.js";
-import { filterInternalHeaders } from "./request-pipeline.js";
+import { canonicalizeRequestPathname, filterInternalHeaders } from "./request-pipeline.js";
 import { isUnknownRecord } from "../utils/record.js";
-import { buildNextDataNotFoundResponse, isNextDataPathname, normalizeNextDataPagePathname, parseNextDataPathname } from "./pages-data-route.js";
+import { buildNextDataNotFoundResponse, encodeUrlParserIgnoredCharacters, isNextDataPathname, normalizeNextDataPagePathname, parseNextDataPathname, urlParserCreatesPagesDataPath } from "./pages-data-route.js";
 import { ASSET_PREFIX_URL_DIR, assetPrefixPathname, isAbsoluteAssetPrefix } from "../utils/asset-prefix.js";
 import { setPagesClientAssets } from "./pages-client-assets.js";
 import { resolveRequestHost, resolveRequestProtocol, trustProxy, trustedHosts } from "./proxy-trust.js";
@@ -16,6 +16,7 @@ import { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, isImageOptimizationPath, isS
 import { installSocketErrorBackstop } from "./socket-error-backstop.js";
 import { CONTENT_TYPES, StaticFileCache, etagFromFilenameHash } from "./static-file-cache.js";
 import { collectInlineCssManifest } from "../build/inline-css.js";
+import { readTrustedRevalidationHostname } from "./revalidation-host.js";
 import { mergeHeaders } from "./worker-utils.js";
 import { runPagesRequest, wrapMiddlewareWithBasePath } from "./pages-request-pipeline.js";
 import { computeClientRuntimeMetadata } from "../utils/client-runtime-metadata.js";
@@ -555,18 +556,18 @@ async function statIfFile(filePath) {
 * Convert a Node.js IncomingMessage to a Web Request object.
 *
 * When `urlOverride` is provided, it is used as the path + query string
-* instead of `req.url`. This avoids redundant path normalization when the
-* caller has already decoded and normalized the pathname (e.g. the App
-* Router prod server normalizes before static-asset lookup, and can pass
-* the result here so the downstream RSC handler doesn't re-normalize).
+* instead of `req.url`.
 */
-function nodeToWebRequest(req, urlOverride, prerenderSecret) {
-	const origin = `${resolveRequestProtocol(req)}://${resolveRequestHost(req, "localhost")}`;
-	const url = new URL(urlOverride ?? req.url ?? "/", origin);
+function nodeToWebRequest(req, urlOverride, prerenderSecret, i18nConfig, authorizeOnDemandRevalidate) {
+	const proto = resolveRequestProtocol(req);
 	const rawHeaders = nodeHeadersToWebHeaders(req.headers);
+	const revalidationHostname = readTrustedRevalidationHostname(rawHeaders, i18nConfig, authorizeOnDemandRevalidate);
+	const origin = `${proto}://${revalidationHostname ?? resolveRequestHost(req, "localhost")}`;
+	const url = new URL(urlOverride ?? req.url ?? "/", origin);
 	const prerenderRouteParamsPayload = readTrustedPrerenderRouteParamsFromHeaders(rawHeaders, prerenderSecret);
 	const isTrustedSpeculativePrerender = process.env.VINEXT_PRERENDER === "1" && prerenderSecret !== void 0 && rawHeaders.get("x-vinext-prerender-secret") === prerenderSecret && rawHeaders.get("x-vinext-prerender-speculative") === "1";
 	const headers = filterInternalHeaders(rawHeaders);
+	if (revalidationHostname) headers.set("host", revalidationHostname);
 	const prerenderRouteParamsHeader = serializePrerenderRouteParamsHeader(prerenderRouteParamsPayload);
 	if (prerenderRouteParamsHeader !== null) headers.set(VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, prerenderRouteParamsHeader);
 	if (isTrustedSpeculativePrerender) headers.set(VINEXT_PRERENDER_SPECULATIVE_HEADER, "1");
@@ -663,19 +664,32 @@ async function startProdServer(options = {}) {
 		silent
 	});
 }
-function createNodeExecutionContext() {
+function createNodeExecutionContext(trustedRevalidateOrigin) {
 	return {
 		waitUntil(promise) {
 			Promise.resolve(promise).catch(() => {});
 		},
-		passThroughOnException() {}
+		passThroughOnException() {},
+		trustedRevalidateOrigin
 	};
 }
+function resolveTrustedNodeRevalidateOrigin(req, configuredHost, configuredPort) {
+	const port = req.socket.localPort ?? configuredPort;
+	return `http://${normalizeInternalFetchHost(configuredHost)}:${port}`;
+}
+function normalizeInternalFetchHost(host) {
+	if (!host || host === "0.0.0.0" || host === "::") return "localhost";
+	if (host.includes(":") && !host.startsWith("[")) return `[${host}]`;
+	return host;
+}
 function resolveAppRouterHandler(entry) {
-	if (typeof entry === "function") return (request) => Promise.resolve(entry(request));
+	if (typeof entry === "function") {
+		const handler = entry;
+		return (request, ctx) => Promise.resolve(handler(request, ctx));
+	}
 	if (entry && typeof entry === "object" && "fetch" in entry) {
 		const workerEntry = entry;
-		if (typeof workerEntry.fetch === "function") return (request) => Promise.resolve(workerEntry.fetch(request, void 0, createNodeExecutionContext()));
+		if (typeof workerEntry.fetch === "function") return (request, ctx) => Promise.resolve(workerEntry.fetch(request, void 0, ctx));
 	}
 	console.error("[vinext] App Router entry must export either a default handler function or a Worker-style default export with fetch()");
 	process.exit(1);
@@ -796,6 +810,8 @@ async function startAppRouterServer(options) {
 	const appRouterBasePath = typeof rscModule.__basePath === "string" ? rscModule.__basePath : "";
 	const appRouterInlineCss = rscModule.__inlineCss === true;
 	const appRouterHasPagesDir = rscModule.__hasPagesDir === true;
+	const appRouterI18nConfig = rscModule.__i18nConfig ?? null;
+	const appRouterAuthorizeOnDemandRevalidate = typeof rscModule.authorizeOnDemandRevalidate === "function" ? rscModule.authorizeOnDemandRevalidate : void 0;
 	const appImageAllowedWidths = Array.isArray(rscModule.__imageAllowedWidths) ? rscModule.__imageAllowedWidths : [...DEFAULT_DEVICE_SIZES, ...DEFAULT_IMAGE_SIZES];
 	let imageConfig = typeof rscModule.__imageConfig === "object" && rscModule.__imageConfig !== null ? rscModule.__imageConfig : void 0;
 	if (imageConfig === void 0) {
@@ -873,9 +889,14 @@ async function startAppRouterServer(options) {
 			return;
 		}
 		try {
-			const qs = rawUrl.includes("?") ? rawUrl.slice(rawUrl.indexOf("?")) : "";
-			const request = nodeToWebRequest(req, pathname + qs, prerenderSecret);
-			const response = await rscHandler(request);
+			const request = nodeToWebRequest(req, rawUrl, prerenderSecret, appRouterI18nConfig, appRouterAuthorizeOnDemandRevalidate);
+			const response = await rscHandler(request, createNodeExecutionContext(resolveTrustedNodeRevalidateOrigin(req, host, port)));
+			if (missingBuildAsset && response.status === 404) {
+				cancelResponseBody(response);
+				res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+				res.end("Not Found");
+				return;
+			}
 			const staticFileSignal = response.headers.get(VINEXT_STATIC_FILE_HEADER);
 			if (staticFileSignal) {
 				let staticFilePath = "/";
@@ -891,12 +912,6 @@ async function startAppRouterServer(options) {
 				await sendWebResponse(notFoundResponse({ headers: toWebHeaders(staticResponseHeaders) }), req, res, compress);
 				return;
 			}
-			if (missingBuildAsset && response.status === 404) {
-				cancelResponseBody(response);
-				res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
-				res.end("Not Found");
-				return;
-			}
 			await sendWebResponse(response, req, res, compress);
 		} catch (e) {
 			console.error("[vinext] Server error:", e);
@@ -939,14 +954,16 @@ function readPagesServerEntryPageRoutes(value) {
 *
 * Uses the server entry (dist/server/entry.js) which exports:
 * - renderPage(request, url, manifest, ctx?, middlewareHeaders?) — SSR rendering (Web Request → Response)
-* - handleApiRoute(request, url, ctx?) — API route handling (ctx optional; pass for ctx.waitUntil() on Workers)
+* - handleApiRoute(request, url, ctx?, trustedRevalidateOrigin?) — API route handling
+*   (ctx optional; pass for ctx.waitUntil() on Workers)
+* - authorizeOnDemandRevalidate(header) — validates against the bundled build secret
 * - runMiddleware(request, ctx?) — middleware execution (ctx optional; pass for ctx.waitUntil() on Workers)
 * - vinextConfig — embedded next.config.js settings
 */
 async function startPagesRouterServer(options) {
 	const { port, host, clientDir, serverEntryPath, compress, purpose, silent } = options;
 	const serverEntry = await importServerEntryModule(serverEntryPath);
-	const { renderPage, handleApiRoute: handleApi, runMiddleware, vinextConfig, buildId: pagesBuildId } = serverEntry;
+	const { renderPage, handleApiRoute: handleApi, authorizeOnDemandRevalidate, runMiddleware, vinextConfig, buildId: pagesBuildId } = serverEntry;
 	const matchPageRoute = typeof serverEntry.matchPageRoute === "function" ? serverEntry.matchPageRoute : void 0;
 	const hasMiddleware = serverEntry.hasMiddleware === true;
 	const pageRoutes = readPagesServerEntryPageRoutes(serverEntry.pageRoutes);
@@ -987,8 +1004,9 @@ async function startPagesRouterServer(options) {
 			res.end("This page could not be found");
 			return;
 		}
-		const rawPagesPathname = rawPagesPathnameBeforeNormalize.replaceAll("\\", "/");
+		const rawPagesPathname = canonicalizeRequestPathname(rawPagesPathnameBeforeNormalize.replaceAll("\\", "/"));
 		const rawQs = rawUrl.includes("?") ? rawUrl.slice(rawUrl.indexOf("?")) : "";
+		let requestPathname = normalizePath(rawPagesPathname);
 		let pathname;
 		try {
 			pathname = normalizePath(normalizePathnameForRouteMatchStrict(rawPagesPathname));
@@ -997,7 +1015,7 @@ async function startPagesRouterServer(options) {
 			res.end("Bad Request");
 			return;
 		}
-		let url = pathname + rawQs;
+		let url = requestPathname + rawQs;
 		if (pathname === "/__vinext/prerender/pages-static-paths") {
 			const secret = req.headers[VINEXT_PRERENDER_SECRET_HEADER];
 			if (!prerenderSecret || secret !== prerenderSecret) {
@@ -1058,18 +1076,31 @@ async function startPagesRouterServer(options) {
 			return;
 		}
 		try {
-			const hadBasePath = !basePath || hasBasePath(pathname, basePath);
+			const hadBasePath = !basePath || hasBasePath(requestPathname, basePath);
+			let configMatchPathname = stripBasePath(requestPathname, basePath);
 			{
-				const stripped = stripBasePath(pathname, basePath);
-				if (stripped !== pathname) {
-					url = stripped + (url.includes("?") ? url.slice(url.indexOf("?")) : "");
-					pathname = stripped;
+				const strippedPathname = stripBasePath(pathname, basePath);
+				const strippedRequestPathname = stripBasePath(requestPathname, basePath);
+				pathname = strippedPathname;
+				if (strippedRequestPathname !== requestPathname) {
+					requestPathname = strippedRequestPathname;
+					url = requestPathname + rawQs;
 				}
 			}
+			if (urlParserCreatesPagesDataPath(pathname)) {
+				res.writeHead(404);
+				res.end("This page could not be found");
+				return;
+			}
+			requestPathname = encodeUrlParserIgnoredCharacters(requestPathname);
+			{
+				const qs = url.includes("?") ? url.slice(url.indexOf("?")) : "";
+				url = requestPathname + qs;
+			}
 			let isDataReq = false;
 			const originalRenderUrl = url;
-			if (isNextDataPathname(pathname)) {
-				const dataMatch = pagesBuildId ? parseNextDataPathname(pathname, pagesBuildId) : null;
+			if (isNextDataPathname(requestPathname)) {
+				const dataMatch = pagesBuildId ? parseNextDataPathname(requestPathname, pagesBuildId) : null;
 				if (!dataMatch) {
 					await sendWebResponse(buildNextDataNotFoundResponse(), req, res, compress);
 					return;
@@ -1078,16 +1109,20 @@ async function startPagesRouterServer(options) {
 				const qs = url.includes("?") ? url.slice(url.indexOf("?")) : "";
 				const pagePathname = normalizeNextDataPagePathname(dataMatch.pagePathname, hasMiddleware && trailingSlash);
 				url = pagePathname + qs;
+				requestPathname = pagePathname;
 				pathname = pagePathname;
+				configMatchPathname = pagePathname;
 			}
 			const protocol = resolveRequestProtocol(req);
 			const hostHeader = resolveRequestHost(req, `${host}:${port}`);
 			const rawReqHeaders = nodeHeadersToWebHeaders(req.headers);
+			const revalidationHostname = readTrustedRevalidationHostname(rawReqHeaders, i18nConfig, typeof authorizeOnDemandRevalidate === "function" ? authorizeOnDemandRevalidate : void 0);
 			const isDataRequest = isDataReq;
 			const reqHeaders = filterInternalHeaders(rawReqHeaders);
+			if (revalidationHostname) reqHeaders.set("host", revalidationHostname);
 			const method = req.method ?? "GET";
 			const hasBody = method !== "GET" && method !== "HEAD";
-			const result = await runPagesRequest(new Request(`${protocol}://${hostHeader}${url}`, {
+			const result = await runPagesRequest(new Request(`${protocol}://${revalidationHostname ?? hostHeader}${url}`, {
 				method,
 				headers: reqHeaders,
 				body: hasBody ? readNodeStream(req) : void 0,
@@ -1105,13 +1140,15 @@ async function startPagesRouterServer(options) {
 				hasMiddleware,
 				ctx: void 0,
 				rawSearch: rawQs,
+				authorizeOnDemandRevalidate: typeof authorizeOnDemandRevalidate === "function" ? authorizeOnDemandRevalidate : void 0,
+				configMatchPathname,
 				matchPageRoute: matchPageRoute ?? null,
 				runMiddleware: typeof runMiddleware === "function" ? wrapMiddlewareWithBasePath(runMiddleware, basePath, hadBasePath) : null,
 				renderPage: typeof renderPage === "function" ? (request, resolvedUrl, options, stagedHeaders) => renderPage(request, resolvedUrl, ssrManifest, void 0, stagedHeaders, {
 					...options,
 					originalUrl: originalRenderUrl
 				}) : null,
-				handleApi: typeof handleApi === "function" ? (request, apiUrl) => handleApi(request, apiUrl, createNodeExecutionContext()) : null,
+				handleApi: typeof handleApi === "function" ? (request, apiUrl) => handleApi(request, apiUrl, createNodeExecutionContext(), resolveTrustedNodeRevalidateOrigin(req, host, port)) : null,
 				serveFilesystemRoute: async (requestPathname, stagedHeaders, phase) => {
 					if (req.method !== "GET" && req.method !== "HEAD" || requestPathname === "/" || requestPathname === "/api" || requestPathname.startsWith("/api/") || phase === "direct" && requestPathname.startsWith(`/_next/static/`)) return false;
 					return tryServeStatic(req, res, clientDir, requestPathname, compress, staticCache, stagedHeaders);