vinext 1.0.0-beta.2 → 1.0.0-beta.3

package/dist/server/headers.d.ts

@@ -1,4 +1,4 @@
-import { MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER } from "../utils/protocol-headers.js";
+import { MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
 
 //#region src/server/headers.d.ts
 /**
@@ -107,4 +107,4 @@ declare const INTERNAL_HEADERS: string[];
 /** Vinext-only internal headers stripped alongside Next.js protocol internals. */
 declare const VINEXT_INTERNAL_HEADERS: string[];
 //#endregion
-export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };
+export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_REVALIDATE_HOST_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };

package/dist/server/headers.js

@@ -1,4 +1,4 @@
-import { MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_OVERRIDE_HEADERS, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER } from "../utils/protocol-headers.js";
+import { MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_OVERRIDE_HEADERS, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
 //#region src/server/headers.ts
 /**
 * Internal HTTP header name constants used throughout vinext.
@@ -127,7 +127,8 @@ const INTERNAL_HEADERS = [
 const VINEXT_INTERNAL_HEADERS = [
 	VINEXT_PRERENDER_ROUTE_PARAMS_HEADER,
 	VINEXT_PRERENDER_SPECULATIVE_HEADER,
-	VINEXT_PRERENDER_CACHE_LIFE_HEADER
+	VINEXT_PRERENDER_CACHE_LIFE_HEADER,
+	VINEXT_REVALIDATE_HOST_HEADER
 ];
 //#endregion
-export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };
+export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_REVALIDATE_HOST_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };

package/dist/server/isr-cache.d.ts

@@ -1,38 +1,11 @@
 import { OnRequestErrorContext } from "./instrumentation.js";
 import { RenderObservation } from "./cache-proof.js";
 import { AppRscRenderMode } from "./app-rsc-render-mode.js";
+import { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER } from "../utils/protocol-headers.js";
 import { normalizeMountedSlotsHeader } from "./app-mounted-slots-header.js";
 import { CacheHandlerValue, CachedAppPageValue, CachedPagesValue, IncrementalCacheValue } from "../shims/cache-handler.js";
 
 //#region src/server/isr-cache.d.ts
-/**
- * Header set on the internal request that `res.revalidate()` issues to
- * trigger on-demand ISR regeneration of a Pages Router route. Mirrors Next.js's
- * `PRERENDER_REVALIDATE_HEADER` (`x-prerender-revalidate`) — see
- * `.nextjs-ref/packages/next/src/lib/constants.ts`.
- *
- * SECURITY: in Next.js this header is NOT a presence flag — it carries the
- * secret `previewModeId`, and `checkIsOnDemandRevalidate`
- * (`.nextjs-ref/packages/next/src/server/api-utils/index.ts`) only treats a
- * request as on-demand revalidation when the value *equals* that secret. If we
- * gated on presence alone, any external client could send
- * `x-prerender-revalidate: <anything>` to force synchronous regeneration of any
- * ISR page, bypassing the fresh/stale cache short-circuits — a
- * cache-stampede/DoS vector. We therefore validate the value against
- * {@link getRevalidateSecret} (a build-time secret shared across all Workers
- * isolates) with a constant-time comparison, and only the matching value (sent
- * by our own `res.revalidate()`) is honored.
- */
-declare const PRERENDER_REVALIDATE_HEADER = "x-prerender-revalidate";
-/**
- * Companion header to {@link PRERENDER_REVALIDATE_HEADER}. When set,
- * `res.revalidate(path, { unstable_onlyGenerated: true })` only revalidates the
- * path if it was already generated, and a 404 response counts as a successful
- * no-op. Mirrors Next.js's `PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER`
- * (`x-prerender-revalidate-if-generated`) — see
- * `.nextjs-ref/packages/next/src/lib/constants.ts`.
- */
-declare const PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER = "x-prerender-revalidate-if-generated";
 declare function getRevalidateSecret(): string;
 declare function isRevalidateSecret(value: string | null | undefined): boolean;
 /**
@@ -44,20 +17,22 @@ declare function isRevalidateSecret(value: string | null | undefined): boolean;
 declare function isOnDemandRevalidateRequest(headerValue: string | string[] | null | undefined): boolean;
 type ISRCacheEntry = {
   value: CacheHandlerValue;
-  isStale: boolean;
+  isStale: boolean; /** The entry crossed its hard expire boundary and must not be served. */
+  isExpired?: boolean;
 };
 /**
  * Get a cache entry with staleness information.
  *
  * Returns { value, isStale: false } for fresh entries,
- * { value, isStale: true } for expired-but-usable entries,
- * or null for cache misses.
+ * { value, isStale: true } for stale-but-usable entries,
+ * { value, isStale: true, isExpired: true } for entries that must be retained
+ * as regeneration input but not served, or null for cache misses.
  */
 declare function isrGet(key: string): Promise<ISRCacheEntry | null>;
 /**
  * Store a value in the ISR cache with a revalidation period.
  */
-declare function isrSet(key: string, data: IncrementalCacheValue, revalidateSeconds: number, tags?: string[], expireSeconds?: number): Promise<void>;
+declare function isrSet(key: string, data: IncrementalCacheValue | null, revalidateSeconds: number | false, tags?: string[], expireSeconds?: number): Promise<void>;
 declare function isrSetPrerenderedAppPage(key: string, data: CachedAppPageValue, metadata: {
   expireSeconds?: number;
   revalidateSeconds?: number;
@@ -70,6 +45,8 @@ declare function isrSetPrerenderedAppPage(key: string, data: CachedAppPageValue,
    */
   tags?: string[];
 }): Promise<void>;
+/** Coalesce same-key synchronous on-demand revalidations. */
+declare function coalesceOnDemandRevalidation<T>(key: string, renderFn: () => Promise<T>): Promise<T>;
 /**
  * Trigger a background regeneration for a cache key.
  *
@@ -133,4 +110,4 @@ declare function setRevalidateDuration(key: string, seconds: number): void;
  */
 declare function getRevalidateDuration(key: string): number | undefined;
 //#endregion
-export { ISRCacheEntry, PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrCacheKey, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, getRevalidateDuration, getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, setRevalidateDuration, triggerBackgroundRegeneration };
+export { ISRCacheEntry, PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrCacheKey, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, coalesceOnDemandRevalidation, getRevalidateDuration, getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, setRevalidateDuration, triggerBackgroundRegeneration };

package/dist/server/isr-cache.js

@@ -1,4 +1,5 @@
 import { getRequestExecutionContext } from "../shims/request-context.js";
+import { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER } from "../utils/protocol-headers.js";
 import { reportRequestError } from "./instrumentation.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { fnv1a64 } from "../utils/hash.js";
@@ -7,34 +8,6 @@ import { APP_RSC_RENDER_MODE_NAVIGATION, getRscRenderModeCacheVariant } from "./
 import { normalizeAppPageInterceptionProofPathname } from "./app-page-render-identity.js";
 //#region src/server/isr-cache.ts
 /**
-* Header set on the internal request that `res.revalidate()` issues to
-* trigger on-demand ISR regeneration of a Pages Router route. Mirrors Next.js's
-* `PRERENDER_REVALIDATE_HEADER` (`x-prerender-revalidate`) — see
-* `.nextjs-ref/packages/next/src/lib/constants.ts`.
-*
-* SECURITY: in Next.js this header is NOT a presence flag — it carries the
-* secret `previewModeId`, and `checkIsOnDemandRevalidate`
-* (`.nextjs-ref/packages/next/src/server/api-utils/index.ts`) only treats a
-* request as on-demand revalidation when the value *equals* that secret. If we
-* gated on presence alone, any external client could send
-* `x-prerender-revalidate: <anything>` to force synchronous regeneration of any
-* ISR page, bypassing the fresh/stale cache short-circuits — a
-* cache-stampede/DoS vector. We therefore validate the value against
-* {@link getRevalidateSecret} (a build-time secret shared across all Workers
-* isolates) with a constant-time comparison, and only the matching value (sent
-* by our own `res.revalidate()`) is honored.
-*/
-const PRERENDER_REVALIDATE_HEADER = "x-prerender-revalidate";
-/**
-* Companion header to {@link PRERENDER_REVALIDATE_HEADER}. When set,
-* `res.revalidate(path, { unstable_onlyGenerated: true })` only revalidates the
-* path if it was already generated, and a 404 response counts as a successful
-* no-op. Mirrors Next.js's `PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER`
-* (`x-prerender-revalidate-if-generated`) — see
-* `.nextjs-ref/packages/next/src/lib/constants.ts`.
-*/
-const PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER = "x-prerender-revalidate-if-generated";
-/**
 * Build-time secret that authenticates on-demand revalidation requests, the
 * vinext analog of Next.js's prerender-manifest `previewModeId`.
 *
@@ -54,19 +27,22 @@ const PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER = "x-prerender-revalidate-if-ge
 *
 * When the build-time define is absent — dev mode, and any path that doesn't
 * run through `vinext build` — we fall back to a lazily-generated random secret.
-* Those paths are single-process, so a module-scoped value is shared by sender
-* and receiver there — no regression.
+* Those paths are single-process, but Vite can evaluate this module separately
+* in its RSC and SSR module graphs. Store the fallback on `globalThis` under a
+* registry symbol so every module copy in the process reads the same value.
 */
-let devRevalidateSecret;
+const _DEV_REVALIDATE_SECRET_KEY = Symbol.for("vinext.isrCache.devRevalidateSecret");
 function getRevalidateSecret() {
 	const baked = process.env.__VINEXT_REVALIDATE_SECRET;
 	if (baked) return baked;
-	if (devRevalidateSecret === void 0) {
-		const bytes = /* @__PURE__ */ new Uint8Array(32);
-		crypto.getRandomValues(bytes);
-		devRevalidateSecret = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
-	}
-	return devRevalidateSecret;
+	const globals = globalThis;
+	const existing = globals[_DEV_REVALIDATE_SECRET_KEY];
+	if (typeof existing === "string") return existing;
+	const bytes = /* @__PURE__ */ new Uint8Array(32);
+	crypto.getRandomValues(bytes);
+	const secret = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+	globals[_DEV_REVALIDATE_SECRET_KEY] = secret;
+	return secret;
 }
 /**
 * Constant-time string equality. Avoids leaking secret length / prefix via
@@ -98,16 +74,18 @@ function isOnDemandRevalidateRequest(headerValue) {
 * Get a cache entry with staleness information.
 *
 * Returns { value, isStale: false } for fresh entries,
-* { value, isStale: true } for expired-but-usable entries,
-* or null for cache misses.
+* { value, isStale: true } for stale-but-usable entries,
+* { value, isStale: true, isExpired: true } for entries that must be retained
+* as regeneration input but not served, or null for cache misses.
 */
 async function isrGet(key) {
 	const result = await getCdnCacheAdapter().get(key);
-	if (!result || !result.value) return null;
-	if (result.cacheState === "expired") return null;
+	if (!result) return null;
+	const isExpired = result.cacheState === "expired";
 	return {
 		value: result,
-		isStale: result.cacheState === "stale"
+		isStale: isExpired || result.cacheState === "stale",
+		...isExpired ? { isExpired: true } : {}
 	};
 }
 /**
@@ -142,6 +120,18 @@ async function isrSetPrerenderedAppPage(key, data, metadata) {
 const _PENDING_REGEN_KEY = Symbol.for("vinext.isrCache.pendingRegenerations");
 const _g = globalThis;
 const pendingRegenerations = _g[_PENDING_REGEN_KEY] ??= /* @__PURE__ */ new Map();
+const _PENDING_ON_DEMAND_REGEN_KEY = Symbol.for("vinext.isrCache.pendingOnDemandRegenerations");
+const pendingOnDemandRegenerations = _g[_PENDING_ON_DEMAND_REGEN_KEY] ??= /* @__PURE__ */ new Map();
+/** Coalesce same-key synchronous on-demand revalidations. */
+function coalesceOnDemandRevalidation(key, renderFn) {
+	const pending = pendingOnDemandRegenerations.get(key);
+	if (pending) return pending;
+	const promise = Promise.resolve().then(renderFn).finally(() => {
+		if (pendingOnDemandRegenerations.get(key) === promise) pendingOnDemandRegenerations.delete(key);
+	});
+	pendingOnDemandRegenerations.set(key, promise);
+	return promise;
+}
 /**
 * Trigger a background regeneration for a cache key.
 *
@@ -283,4 +273,4 @@ function getRevalidateDuration(key) {
 	return revalidateDurations.get(key);
 }
 //#endregion
-export { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrCacheKey, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, getRevalidateDuration, getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, setRevalidateDuration, triggerBackgroundRegeneration };
+export { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrCacheKey, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, coalesceOnDemandRevalidation, getRevalidateDuration, getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, setRevalidateDuration, triggerBackgroundRegeneration };

package/dist/server/isr-decision.d.ts

@@ -33,7 +33,7 @@ type DecideIsrOptions = {
    * For `"dev"` call sites this is the only source of the revalidate value —
    * dev never has metadata attached to a cache entry.
    */
-  revalidateSeconds: number;
+  revalidateSeconds: number | false;
   /**
    * The expire ceiling (seconds from epoch) read from the route config.
    * Absent when the route pre-dates expire metadata support.
@@ -63,7 +63,7 @@ declare function decideIsr(options: DecideIsrOptions): IsrDecision;
  * therefore never has `cacheControlMeta`. `expireSeconds` here is the route
  * config ceiling passed directly from the caller (not a per-entry fallback).
  */
-declare function buildMissIsrCacheControl(revalidateSeconds: number, expireSeconds?: number): string;
+declare function buildMissIsrCacheControl(revalidateSeconds: number | false, expireSeconds?: number): string;
 /**
  * Build the `Cache-Control` string for a fresh (MISS) app-route response.
  *

package/dist/server/pages-api-route.d.ts

@@ -74,9 +74,11 @@ type HandlePagesApiRouteOptions = {
   url: string;
   nextConfig?: {
     basePath?: string;
+    allowedRevalidateHeaderKeys?: readonly string[];
     i18n?: NextI18nConfig | null;
     trailingSlash?: boolean;
   };
+  trustedRevalidateOrigin?: string;
 };
 declare function handlePagesApiRoute(options: HandlePagesApiRouteOptions): Promise<Response>;
 //#endregion

package/dist/server/pages-api-route.js

@@ -48,10 +48,13 @@ async function _handlePagesApiRoute(options) {
 		if (!isNodeApiRouteModule(route.module)) return new Response("API route does not export a default function", { status: 500 });
 		const query = buildPagesApiQuery(options.url, params);
 		const bodyParserConfig = resolveBodyParserConfig(route.module.config);
+		const body = bodyParserConfig.enabled ? await parsePagesApiBody(options.request, bodyParserConfig.sizeLimit) : void 0;
 		const { req, res, responsePromise } = createPagesReqRes({
-			body: bodyParserConfig.enabled ? await parsePagesApiBody(options.request, bodyParserConfig.sizeLimit) : void 0,
+			allowedRevalidateHeaderKeys: options.nextConfig?.allowedRevalidateHeaderKeys,
+			body,
 			query,
 			request: options.request,
+			trustedRevalidateOrigin: options.trustedRevalidateOrigin,
 			url: options.url
 		});
 		let resWasPiped = false;

package/dist/server/pages-dev-hydration.js

@@ -17,7 +17,6 @@ function createPagesDevHydrationScript(options) {
   element = React.createElement(AppComponent, {
     ...props,
     Component: PageComponent,
-    pageProps: rawPageProps,
     router: appRouter,
   });
   ` : `

package/dist/server/pages-get-initial-props.d.ts

@@ -43,7 +43,7 @@ type DevAppInitialPropsResult = {
   kind: "render";
   pageProps: Record<string, unknown>;
   renderProps: Record<string, unknown> & {
-    pageProps: unknown;
+    pageProps?: unknown;
   };
 };
 type DevAppInitialPropsContext = {

package/dist/server/pages-get-initial-props.js

@@ -92,10 +92,7 @@ async function loadDevAppInitialProps(ctx) {
 	return {
 		kind: "render",
 		pageProps: isPropsObject(initialPageProps) ? initialPageProps : {},
-		renderProps: isPropsObject(initialProps) ? {
-			...initialProps,
-			pageProps: initialPageProps
-		} : { pageProps: initialPageProps }
+		renderProps: isPropsObject(initialProps) ? initialProps : {}
 	};
 }
 //#endregion

package/dist/server/pages-i18n.js

@@ -93,23 +93,71 @@ function stripI18nLocaleForApiRoute(url, i18nConfig) {
 */
 function detectLocaleFromAcceptLanguage(acceptLang, i18nConfig) {
 	if (!acceptLang) return null;
-	const langs = acceptLang.split(",").map((part) => {
-		const [lang, qPart] = part.trim().split(";");
-		const q = qPart ? parseFloat(qPart.replace("q=", "")) : 1;
-		return {
-			lang: lang.trim().toLowerCase(),
-			q
-		};
-	}).sort((a, b) => b.q - a.q);
-	for (const { lang } of langs) {
-		const exactMatch = i18nConfig.locales.find((locale) => locale.toLowerCase() === lang);
-		if (exactMatch) return exactMatch;
-		const prefix = lang.split("-")[0];
-		const prefixMatch = i18nConfig.locales.find((locale) => {
-			const lowered = locale.toLowerCase();
-			return lowered === prefix || lowered.startsWith(prefix + "-");
+	const configured = /* @__PURE__ */ new Map();
+	let position = 0;
+	for (const locale of i18nConfig.locales) {
+		const lower = locale.toLowerCase();
+		configured.set(lower, {
+			locale,
+			position: position++
 		});
-		if (prefixMatch) return prefixMatch;
+		const parts = lower.split("-");
+		while (parts.length > 1) {
+			parts.pop();
+			const prefix = parts.join("-");
+			if (!configured.has(prefix)) configured.set(prefix, {
+				locale,
+				position: position++
+			});
+		}
+	}
+	const selections = [];
+	const listedTokens = /* @__PURE__ */ new Set();
+	try {
+		const parts = acceptLang.replace(/[ \t]/g, "").split(",");
+		for (let headerPosition = 0; headerPosition < parts.length; headerPosition++) {
+			const part = parts[headerPosition];
+			if (!part) continue;
+			const params = part.split(";");
+			if (params.length > 2) throw new Error("Invalid Accept-Language header");
+			const token = params[0].toLowerCase();
+			if (!token) throw new Error("Invalid Accept-Language header");
+			const selection = {
+				token,
+				headerPosition,
+				quality: 1
+			};
+			const configuredMatch = configured.get(token);
+			if (configuredMatch) selection.preference = configuredMatch.position;
+			listedTokens.add(token);
+			if (params.length === 2) {
+				const [key, value] = params[1].split("=");
+				if (!value || key !== "q" && key !== "Q") throw new Error("Invalid Accept-Language header");
+				const quality = parseFloat(value);
+				if (quality === 0) continue;
+				if (Number.isFinite(quality) && quality >= .001 && quality <= 1) selection.quality = quality;
+			}
+			selections.push(selection);
+		}
+	} catch {
+		return null;
+	}
+	selections.sort((a, b) => {
+		if (b.quality !== a.quality) return b.quality - a.quality;
+		if (a.preference !== b.preference) {
+			if (a.preference === void 0) return 1;
+			if (b.preference === void 0) return -1;
+			return a.preference - b.preference;
+		}
+		return a.headerPosition - b.headerPosition;
+	});
+	for (const { token } of selections) {
+		if (token === "*") {
+			for (const [preference, { locale }] of configured) if (!listedTokens.has(preference)) return locale;
+			continue;
+		}
+		const match = configured.get(token);
+		if (match) return match.locale;
 	}
 	return null;
 }

package/dist/server/pages-node-compat.d.ts

@@ -49,9 +49,11 @@ type PagesRequestCookiesCarrier = {
   cookies?: unknown;
 };
 type CreatePagesReqResOptions = {
+  allowedRevalidateHeaderKeys?: readonly string[];
   body: unknown;
   query: PagesRequestQuery;
   request: Request;
+  trustedRevalidateOrigin?: string;
   url: string;
 };
 type CreatePagesReqResResult = {

package/dist/server/pages-node-compat.js

@@ -121,6 +121,8 @@ var PagesResponseStream = class extends Writable {
 	resolveResponse;
 	rejectResponse;
 	requestHeaders;
+	trustedRevalidateOrigin;
+	allowedRevalidateHeaderKeys;
 	resStatusCode = 200;
 	resHeaders = {};
 	setCookieHeaders = [];
@@ -128,11 +130,13 @@ var PagesResponseStream = class extends Writable {
 	controller = null;
 	bufferedChunks = [];
 	streamEnded = false;
-	constructor(resolveResponse, rejectResponse, requestHeaders) {
+	constructor(resolveResponse, rejectResponse, requestHeaders, trustedRevalidateOrigin, allowedRevalidateHeaderKeys = []) {
 		super();
 		this.resolveResponse = resolveResponse;
 		this.rejectResponse = rejectResponse;
 		this.requestHeaders = requestHeaders;
+		this.trustedRevalidateOrigin = trustedRevalidateOrigin;
+		this.allowedRevalidateHeaderKeys = allowedRevalidateHeaderKeys;
 		this.once("error", (err) => {
 			if (!this.resolved) {
 				this.resolved = true;
@@ -202,7 +206,7 @@ var PagesResponseStream = class extends Writable {
 		return headers;
 	}
 	async revalidate(urlPath, opts) {
-		await performOnDemandRevalidate(this.requestHeaders, urlPath, opts);
+		await performOnDemandRevalidate(this.requestHeaders, urlPath, opts, this.trustedRevalidateOrigin, this.allowedRevalidateHeaderKeys);
 	}
 	setPreviewData(data, options = {}) {
 		setPagesPreviewData(this, data, options);
@@ -299,7 +303,7 @@ function createPagesReqRes(options) {
 		resolveResponse = resolve;
 		rejectResponse = reject;
 	});
-	const res = new PagesResponseStream(resolveResponse, rejectResponse, options.request.headers);
+	const res = new PagesResponseStream(resolveResponse, rejectResponse, options.request.headers, options.trustedRevalidateOrigin ?? new URL(options.request.url).origin, options.allowedRevalidateHeaderKeys);
 	attachPagesPreviewApi(req, res);
 	return {
 		req,

package/dist/server/pages-page-data.d.ts

@@ -1,6 +1,6 @@
 import { Route } from "../routing/pages-router.js";
 import { VinextNextData } from "../client/vinext-next-data.js";
-import { CachedPagesValue } from "../shims/cache-handler.js";
+import { CachedPagesValue, CachedRedirectValue } from "../shims/cache-handler.js";
 import { ISRCacheEntry } from "./isr-cache.js";
 import { PagesPreviewData } from "./pages-preview.js";
 import { PagesGetInitialPropsRouter } from "./pages-get-initial-props.js";
@@ -12,6 +12,12 @@ type PagesRedirectResult = {
   destination: string;
   permanent?: boolean;
   statusCode?: number;
+  basePath?: boolean;
+};
+type ResolvedPagesRedirect = {
+  destination: string;
+  statusCode: number;
+  basePath?: boolean;
 };
 type PagesStaticPathsEntry = string | {
   params?: Record<string, unknown>;
@@ -22,11 +28,23 @@ type PagesStaticPathsResult = {
   paths?: PagesStaticPathsEntry[];
 };
 type PagesPagePropsResult = {
-  props?: Record<string, unknown>;
+  props?: Record<string, unknown> | Promise<Record<string, unknown>>;
   redirect?: PagesRedirectResult;
   notFound?: boolean;
-  revalidate?: number;
+  revalidate?: unknown;
 };
+declare function assertPages404DoesNotReturnNotFound(routePattern: string, result: Pick<PagesPagePropsResult, "notFound"> | null | undefined): void;
+/**
+ * Next.js preserves an omitted/false Pages `revalidate` result as an indefinite
+ * cache lifetime. The one-year sentinel is only an HTTP Cache-Control detail;
+ * storing it as a revalidation deadline would incorrectly regenerate static
+ * pages after one year.
+ *
+ * Next.js source:
+ * - packages/next/src/server/render.tsx (`metadata.cacheControl`)
+ * - packages/next/src/server/route-modules/pages/pages-handler.ts
+ */
+declare function resolvePagesRevalidateSeconds(result: PagesPagePropsResult, routeUrl?: string): number | false;
 type PagesMutableGsspResponse = {
   headersSent: boolean;
 } & PagesGsspResponse;
@@ -36,8 +54,16 @@ type PagesGsspContextResponse = {
   responsePromise: Promise<Response>;
 };
 type PagesRenderProps = Record<string, unknown> & {
-  pageProps: unknown;
+  pageProps?: unknown;
 };
+/**
+ * Merge gSP/gSSP data into the custom App's raw pageProps value.
+ *
+ * Next.js deliberately uses Object.assign rather than object spread, so
+ * enumerable keys from arrays and primitive wrapper objects are retained.
+ * https://github.com/vercel/next.js/blob/canary/packages/next/src/server/render.tsx
+ */
+declare function mergePagesDataProps(appPageProps: unknown, dataProps: unknown): Record<string, unknown>;
 type PagesPageModule = {
   default?: unknown;
   getStaticPaths?: (context: {
@@ -106,6 +132,7 @@ type RenderPagesIsrHtmlOptions = {
 };
 type ResolvePagesPageDataOptions = {
   applyRequestContexts: () => void;
+  basePath?: string;
   buildId: string | null;
   /**
    * When true, this is a `/_next/data/<buildId>/<page>.json` request. Callers
@@ -124,7 +151,7 @@ type ResolvePagesPageDataOptions = {
   i18n: PagesI18nRenderContext;
   isrCacheKey: (router: string, pathname: string) => string;
   isrGet: (key: string) => Promise<ISRCacheEntry | null>;
-  isrSet: (key: string, data: CachedPagesValue, revalidateSeconds: number, tags?: string[], expireSeconds?: number) => Promise<void>;
+  isrSet: (key: string, data: CachedPagesValue | CachedRedirectValue | null, revalidateSeconds: number | false, tags?: string[], expireSeconds?: number) => Promise<void>;
   expireSeconds?: number;
   /**
    * When true, this dispatch corresponds to a build-time prerender (the
@@ -152,6 +179,12 @@ type ResolvePagesPageDataOptions = {
    * presence — see the security note in `isr-cache.ts`.
    */
   isOnDemandRevalidate?: boolean;
+  /**
+   * When true alongside an authenticated on-demand request, return a
+   * successful 404 no-op if no cache entry exists instead of generating a new
+   * fallback path. Mirrors Next.js `unstable_onlyGenerated`.
+   */
+  revalidateOnlyGenerated?: boolean;
   previewData?: PagesPreviewData | false;
   /**
    * The deployment ID used for deployment-skew protection. When set, it is
@@ -171,6 +204,12 @@ type ResolvePagesPageDataOptions = {
   route: Pick<Route, "isDynamic">;
   routePattern: string;
   routeUrl: string;
+  /**
+   * Filesystem-route identity used for Pages ISR reads and writes. Error pages
+   * render against the original request URL but cache under /404, /500, or
+   * /_error, matching Next.js's error-page cache-key override.
+   */
+  isrCachePathname?: string;
   runInFreshUnifiedContext: <T>(callback: () => Promise<T>) => Promise<T>;
   safeJsonStringify: (value: unknown) => string;
   sanitizeDestination: (destination: string) => string;
@@ -210,7 +249,8 @@ type ResolvePagesPageDataRenderResult = {
   kind: "render";
   documentReqRes: PagesGsspContextResponse | null;
   gsspRes: PagesGsspResponse | null;
-  isrRevalidateSeconds: number | null;
+  isrRevalidateSeconds: number | false | null;
+  isrExpireSeconds?: number;
   pageProps: Record<string, unknown>;
   props: PagesRenderProps;
   /**
@@ -223,12 +263,24 @@ type ResolvePagesPageDataRenderResult = {
 };
 type ResolvePagesPageDataResponseResult = {
   kind: "response";
-  response: Response;
+  response: Response; /** False when an on-demand request must be reported as a failed revalidation. */
+  onDemandRevalidateSuccess?: boolean;
 };
 type ResolvePagesPageDataNotFoundResult = {
-  kind: "notFound";
+  kind: "notFound"; /** Current getStaticProps cache lifetime, when this is an SSG result. */
+  revalidateSeconds?: number | false;
+  expireSeconds?: number;
+  cacheState?: "MISS" | "HIT" | "STALE";
 };
 type ResolvePagesPageDataResult = ResolvePagesPageDataRenderResult | ResolvePagesPageDataResponseResult | ResolvePagesPageDataNotFoundResult;
+/** Validate and normalize the redirect metadata returned by gSP/gSSP. */
+declare function resolvePagesRedirect(redirect: PagesRedirectResult, options: {
+  method: "getStaticProps" | "getServerSideProps";
+  routeUrl: string;
+  sanitizeDestination: (destination: string) => string;
+}): ResolvedPagesRedirect;
+declare function resolvePagesRedirectLocation(redirect: ResolvedPagesRedirect, configuredBasePath?: string): string;
+declare function buildPagesRedirectProps(redirect: ResolvedPagesRedirect, props: PagesRenderProps): PagesRenderProps;
 /**
  * Compare a `getStaticPaths` entry against the actual request params.
  *
@@ -254,4 +306,4 @@ declare function matchesPagesStaticPath(pathEntry: PagesStaticPathsEntry, params
 declare function renderPagesIsrHtml(options: RenderPagesIsrHtmlOptions): Promise<string>;
 declare function resolvePagesPageData(options: ResolvePagesPageDataOptions): Promise<ResolvePagesPageDataResult>;
 //#endregion
-export { PagesPageModule, PagesRouteParam, PagesStaticPathsEntry, ResolvePagesPageDataOptions, getPagesRouteParams, matchesPagesStaticPath, renderPagesIsrHtml, resolvePagesPageData };
+export { PagesPageModule, PagesRedirectResult, PagesRouteParam, PagesStaticPathsEntry, ResolvePagesPageDataOptions, ResolvedPagesRedirect, assertPages404DoesNotReturnNotFound, buildPagesRedirectProps, getPagesRouteParams, matchesPagesStaticPath, mergePagesDataProps, renderPagesIsrHtml, resolvePagesPageData, resolvePagesRedirect, resolvePagesRedirectLocation, resolvePagesRevalidateSeconds };