vinext 1.0.0-beta.2 → 1.0.0-beta.4

package/dist/server/edge-api-runtime.d.ts

@@ -1,4 +1,13 @@
 //#region src/server/edge-api-runtime.d.ts
 declare function isEdgeApiRuntime(runtime: string | undefined): boolean;
+type EdgeApiExecutionRuntime = "node" | "worker";
+/**
+ * Remove wire-level body headers after Node's fetch implementation has decoded
+ * an Edge API response. Next.js applies the same boundary in its edge sandbox.
+ *
+ * Workers keep the original response untouched: workerd preserves the encoded
+ * body/header pair and can stream it directly to the client.
+ */
+declare function finalizeEdgeApiResponse(response: Response, runtime: EdgeApiExecutionRuntime): Response;
 //#endregion
-export { isEdgeApiRuntime };
+export { EdgeApiExecutionRuntime, finalizeEdgeApiResponse, isEdgeApiRuntime };

package/dist/server/edge-api-runtime.js

@@ -2,5 +2,33 @@
 function isEdgeApiRuntime(runtime) {
 	return runtime === "edge" || runtime === "experimental-edge";
 }
+const NODE_EDGE_RESPONSE_FORBIDDEN_HEADERS = [
+	"content-length",
+	"content-encoding",
+	"transfer-encoding"
+];
+/**
+* Remove wire-level body headers after Node's fetch implementation has decoded
+* an Edge API response. Next.js applies the same boundary in its edge sandbox.
+*
+* Workers keep the original response untouched: workerd preserves the encoded
+* body/header pair and can stream it directly to the client.
+*/
+function finalizeEdgeApiResponse(response, runtime) {
+	if (runtime === "worker") return response;
+	const headers = new Headers(response.headers);
+	let changed = false;
+	for (const name of NODE_EDGE_RESPONSE_FORBIDDEN_HEADERS) {
+		if (!headers.has(name)) continue;
+		headers.delete(name);
+		changed = true;
+	}
+	if (!changed) return response;
+	return new Response(response.body, {
+		headers,
+		status: response.status,
+		statusText: response.statusText
+	});
+}
 //#endregion
-export { isEdgeApiRuntime };
+export { finalizeEdgeApiResponse, isEdgeApiRuntime };

package/dist/server/headers.d.ts

@@ -1,4 +1,4 @@
-import { MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER } from "../utils/protocol-headers.js";
+import { MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
 
 //#region src/server/headers.d.ts
 /**
@@ -15,6 +15,8 @@ import { MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP
 declare const VINEXT_CACHE_HEADER = "X-Vinext-Cache";
 /** Next.js public ISR / page cache state indicator. */
 declare const NEXTJS_CACHE_HEADER = "x-nextjs-cache";
+/** Next.js cache-tag metadata carried by prerendered App Router responses. */
+declare const NEXT_CACHE_TAGS_HEADER = "x-next-cache-tags";
 /** Static file signal — value is URL-encoded pathname. */
 declare const VINEXT_STATIC_FILE_HEADER = "x-vinext-static-file";
 /** Timing metrics: `handlerStart,compileMs,renderMs`. */
@@ -107,4 +109,4 @@ declare const INTERNAL_HEADERS: string[];
 /** Vinext-only internal headers stripped alongside Next.js protocol internals. */
 declare const VINEXT_INTERNAL_HEADERS: string[];
 //#endregion
-export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };
+export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_CACHE_TAGS_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_REVALIDATE_HOST_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };

package/dist/server/headers.js

@@ -1,4 +1,4 @@
-import { MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_OVERRIDE_HEADERS, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER } from "../utils/protocol-headers.js";
+import { MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_OVERRIDE_HEADERS, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
 //#region src/server/headers.ts
 /**
 * Internal HTTP header name constants used throughout vinext.
@@ -14,6 +14,8 @@ import { MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_OVERRIDE_HEADERS, MIDDLEWARE_SET_C
 const VINEXT_CACHE_HEADER = "X-Vinext-Cache";
 /** Next.js public ISR / page cache state indicator. */
 const NEXTJS_CACHE_HEADER = "x-nextjs-cache";
+/** Next.js cache-tag metadata carried by prerendered App Router responses. */
+const NEXT_CACHE_TAGS_HEADER = "x-next-cache-tags";
 /** Static file signal — value is URL-encoded pathname. */
 const VINEXT_STATIC_FILE_HEADER = "x-vinext-static-file";
 /** Timing metrics: `handlerStart,compileMs,renderMs`. */
@@ -127,7 +129,8 @@ const INTERNAL_HEADERS = [
 const VINEXT_INTERNAL_HEADERS = [
 	VINEXT_PRERENDER_ROUTE_PARAMS_HEADER,
 	VINEXT_PRERENDER_SPECULATIVE_HEADER,
-	VINEXT_PRERENDER_CACHE_LIFE_HEADER
+	VINEXT_PRERENDER_CACHE_LIFE_HEADER,
+	VINEXT_REVALIDATE_HOST_HEADER
 ];
 //#endregion
-export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };
+export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_CACHE_TAGS_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_REVALIDATE_HOST_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };

package/dist/server/isr-cache.d.ts

@@ -1,38 +1,11 @@
 import { OnRequestErrorContext } from "./instrumentation.js";
 import { RenderObservation } from "./cache-proof.js";
 import { AppRscRenderMode } from "./app-rsc-render-mode.js";
+import { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER } from "../utils/protocol-headers.js";
 import { normalizeMountedSlotsHeader } from "./app-mounted-slots-header.js";
 import { CacheHandlerValue, CachedAppPageValue, CachedPagesValue, IncrementalCacheValue } from "../shims/cache-handler.js";
 
 //#region src/server/isr-cache.d.ts
-/**
- * Header set on the internal request that `res.revalidate()` issues to
- * trigger on-demand ISR regeneration of a Pages Router route. Mirrors Next.js's
- * `PRERENDER_REVALIDATE_HEADER` (`x-prerender-revalidate`) — see
- * `.nextjs-ref/packages/next/src/lib/constants.ts`.
- *
- * SECURITY: in Next.js this header is NOT a presence flag — it carries the
- * secret `previewModeId`, and `checkIsOnDemandRevalidate`
- * (`.nextjs-ref/packages/next/src/server/api-utils/index.ts`) only treats a
- * request as on-demand revalidation when the value *equals* that secret. If we
- * gated on presence alone, any external client could send
- * `x-prerender-revalidate: <anything>` to force synchronous regeneration of any
- * ISR page, bypassing the fresh/stale cache short-circuits — a
- * cache-stampede/DoS vector. We therefore validate the value against
- * {@link getRevalidateSecret} (a build-time secret shared across all Workers
- * isolates) with a constant-time comparison, and only the matching value (sent
- * by our own `res.revalidate()`) is honored.
- */
-declare const PRERENDER_REVALIDATE_HEADER = "x-prerender-revalidate";
-/**
- * Companion header to {@link PRERENDER_REVALIDATE_HEADER}. When set,
- * `res.revalidate(path, { unstable_onlyGenerated: true })` only revalidates the
- * path if it was already generated, and a 404 response counts as a successful
- * no-op. Mirrors Next.js's `PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER`
- * (`x-prerender-revalidate-if-generated`) — see
- * `.nextjs-ref/packages/next/src/lib/constants.ts`.
- */
-declare const PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER = "x-prerender-revalidate-if-generated";
 declare function getRevalidateSecret(): string;
 declare function isRevalidateSecret(value: string | null | undefined): boolean;
 /**
@@ -44,20 +17,22 @@ declare function isRevalidateSecret(value: string | null | undefined): boolean;
 declare function isOnDemandRevalidateRequest(headerValue: string | string[] | null | undefined): boolean;
 type ISRCacheEntry = {
   value: CacheHandlerValue;
-  isStale: boolean;
+  isStale: boolean; /** The entry crossed its hard expire boundary and must not be served. */
+  isExpired?: boolean;
 };
 /**
  * Get a cache entry with staleness information.
  *
  * Returns { value, isStale: false } for fresh entries,
- * { value, isStale: true } for expired-but-usable entries,
- * or null for cache misses.
+ * { value, isStale: true } for stale-but-usable entries,
+ * { value, isStale: true, isExpired: true } for entries that must be retained
+ * as regeneration input but not served, or null for cache misses.
  */
 declare function isrGet(key: string): Promise<ISRCacheEntry | null>;
 /**
  * Store a value in the ISR cache with a revalidation period.
  */
-declare function isrSet(key: string, data: IncrementalCacheValue, revalidateSeconds: number, tags?: string[], expireSeconds?: number): Promise<void>;
+declare function isrSet(key: string, data: IncrementalCacheValue | null, revalidateSeconds: number | false, tags?: string[], expireSeconds?: number): Promise<void>;
 declare function isrSetPrerenderedAppPage(key: string, data: CachedAppPageValue, metadata: {
   expireSeconds?: number;
   revalidateSeconds?: number;
@@ -70,6 +45,8 @@ declare function isrSetPrerenderedAppPage(key: string, data: CachedAppPageValue,
    */
   tags?: string[];
 }): Promise<void>;
+/** Coalesce same-key synchronous on-demand revalidations. */
+declare function coalesceOnDemandRevalidation<T>(key: string, renderFn: () => Promise<T>): Promise<T>;
 /**
  * Trigger a background regeneration for a cache key.
  *
@@ -133,4 +110,4 @@ declare function setRevalidateDuration(key: string, seconds: number): void;
  */
 declare function getRevalidateDuration(key: string): number | undefined;
 //#endregion
-export { ISRCacheEntry, PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrCacheKey, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, getRevalidateDuration, getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, setRevalidateDuration, triggerBackgroundRegeneration };
+export { ISRCacheEntry, PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrCacheKey, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, coalesceOnDemandRevalidation, getRevalidateDuration, getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, setRevalidateDuration, triggerBackgroundRegeneration };

package/dist/server/isr-cache.js

@@ -1,4 +1,5 @@
 import { getRequestExecutionContext } from "../shims/request-context.js";
+import { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER } from "../utils/protocol-headers.js";
 import { reportRequestError } from "./instrumentation.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { fnv1a64 } from "../utils/hash.js";
@@ -7,34 +8,6 @@ import { APP_RSC_RENDER_MODE_NAVIGATION, getRscRenderModeCacheVariant } from "./
 import { normalizeAppPageInterceptionProofPathname } from "./app-page-render-identity.js";
 //#region src/server/isr-cache.ts
 /**
-* Header set on the internal request that `res.revalidate()` issues to
-* trigger on-demand ISR regeneration of a Pages Router route. Mirrors Next.js's
-* `PRERENDER_REVALIDATE_HEADER` (`x-prerender-revalidate`) — see
-* `.nextjs-ref/packages/next/src/lib/constants.ts`.
-*
-* SECURITY: in Next.js this header is NOT a presence flag — it carries the
-* secret `previewModeId`, and `checkIsOnDemandRevalidate`
-* (`.nextjs-ref/packages/next/src/server/api-utils/index.ts`) only treats a
-* request as on-demand revalidation when the value *equals* that secret. If we
-* gated on presence alone, any external client could send
-* `x-prerender-revalidate: <anything>` to force synchronous regeneration of any
-* ISR page, bypassing the fresh/stale cache short-circuits — a
-* cache-stampede/DoS vector. We therefore validate the value against
-* {@link getRevalidateSecret} (a build-time secret shared across all Workers
-* isolates) with a constant-time comparison, and only the matching value (sent
-* by our own `res.revalidate()`) is honored.
-*/
-const PRERENDER_REVALIDATE_HEADER = "x-prerender-revalidate";
-/**
-* Companion header to {@link PRERENDER_REVALIDATE_HEADER}. When set,
-* `res.revalidate(path, { unstable_onlyGenerated: true })` only revalidates the
-* path if it was already generated, and a 404 response counts as a successful
-* no-op. Mirrors Next.js's `PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER`
-* (`x-prerender-revalidate-if-generated`) — see
-* `.nextjs-ref/packages/next/src/lib/constants.ts`.
-*/
-const PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER = "x-prerender-revalidate-if-generated";
-/**
 * Build-time secret that authenticates on-demand revalidation requests, the
 * vinext analog of Next.js's prerender-manifest `previewModeId`.
 *
@@ -54,19 +27,22 @@ const PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER = "x-prerender-revalidate-if-ge
 *
 * When the build-time define is absent — dev mode, and any path that doesn't
 * run through `vinext build` — we fall back to a lazily-generated random secret.
-* Those paths are single-process, so a module-scoped value is shared by sender
-* and receiver there — no regression.
+* Those paths are single-process, but Vite can evaluate this module separately
+* in its RSC and SSR module graphs. Store the fallback on `globalThis` under a
+* registry symbol so every module copy in the process reads the same value.
 */
-let devRevalidateSecret;
+const _DEV_REVALIDATE_SECRET_KEY = Symbol.for("vinext.isrCache.devRevalidateSecret");
 function getRevalidateSecret() {
 	const baked = process.env.__VINEXT_REVALIDATE_SECRET;
 	if (baked) return baked;
-	if (devRevalidateSecret === void 0) {
-		const bytes = /* @__PURE__ */ new Uint8Array(32);
-		crypto.getRandomValues(bytes);
-		devRevalidateSecret = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
-	}
-	return devRevalidateSecret;
+	const globals = globalThis;
+	const existing = globals[_DEV_REVALIDATE_SECRET_KEY];
+	if (typeof existing === "string") return existing;
+	const bytes = /* @__PURE__ */ new Uint8Array(32);
+	crypto.getRandomValues(bytes);
+	const secret = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+	globals[_DEV_REVALIDATE_SECRET_KEY] = secret;
+	return secret;
 }
 /**
 * Constant-time string equality. Avoids leaking secret length / prefix via
@@ -98,16 +74,18 @@ function isOnDemandRevalidateRequest(headerValue) {
 * Get a cache entry with staleness information.
 *
 * Returns { value, isStale: false } for fresh entries,
-* { value, isStale: true } for expired-but-usable entries,
-* or null for cache misses.
+* { value, isStale: true } for stale-but-usable entries,
+* { value, isStale: true, isExpired: true } for entries that must be retained
+* as regeneration input but not served, or null for cache misses.
 */
 async function isrGet(key) {
 	const result = await getCdnCacheAdapter().get(key);
-	if (!result || !result.value) return null;
-	if (result.cacheState === "expired") return null;
+	if (!result) return null;
+	const isExpired = result.cacheState === "expired";
 	return {
 		value: result,
-		isStale: result.cacheState === "stale"
+		isStale: isExpired || result.cacheState === "stale",
+		...isExpired ? { isExpired: true } : {}
 	};
 }
 /**
@@ -142,6 +120,18 @@ async function isrSetPrerenderedAppPage(key, data, metadata) {
 const _PENDING_REGEN_KEY = Symbol.for("vinext.isrCache.pendingRegenerations");
 const _g = globalThis;
 const pendingRegenerations = _g[_PENDING_REGEN_KEY] ??= /* @__PURE__ */ new Map();
+const _PENDING_ON_DEMAND_REGEN_KEY = Symbol.for("vinext.isrCache.pendingOnDemandRegenerations");
+const pendingOnDemandRegenerations = _g[_PENDING_ON_DEMAND_REGEN_KEY] ??= /* @__PURE__ */ new Map();
+/** Coalesce same-key synchronous on-demand revalidations. */
+function coalesceOnDemandRevalidation(key, renderFn) {
+	const pending = pendingOnDemandRegenerations.get(key);
+	if (pending) return pending;
+	const promise = Promise.resolve().then(renderFn).finally(() => {
+		if (pendingOnDemandRegenerations.get(key) === promise) pendingOnDemandRegenerations.delete(key);
+	});
+	pendingOnDemandRegenerations.set(key, promise);
+	return promise;
+}
 /**
 * Trigger a background regeneration for a cache key.
 *
@@ -283,4 +273,4 @@ function getRevalidateDuration(key) {
 	return revalidateDurations.get(key);
 }
 //#endregion
-export { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrCacheKey, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, getRevalidateDuration, getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, setRevalidateDuration, triggerBackgroundRegeneration };
+export { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrCacheKey, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, coalesceOnDemandRevalidation, getRevalidateDuration, getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, setRevalidateDuration, triggerBackgroundRegeneration };

package/dist/server/isr-decision.d.ts

@@ -33,7 +33,7 @@ type DecideIsrOptions = {
    * For `"dev"` call sites this is the only source of the revalidate value —
    * dev never has metadata attached to a cache entry.
    */
-  revalidateSeconds: number;
+  revalidateSeconds: number | false;
   /**
    * The expire ceiling (seconds from epoch) read from the route config.
    * Absent when the route pre-dates expire metadata support.
@@ -63,7 +63,7 @@ declare function decideIsr(options: DecideIsrOptions): IsrDecision;
  * therefore never has `cacheControlMeta`. `expireSeconds` here is the route
  * config ceiling passed directly from the caller (not a per-entry fallback).
  */
-declare function buildMissIsrCacheControl(revalidateSeconds: number, expireSeconds?: number): string;
+declare function buildMissIsrCacheControl(revalidateSeconds: number | false, expireSeconds?: number): string;
 /**
  * Build the `Cache-Control` string for a fresh (MISS) app-route response.
  *

package/dist/server/pages-api-route.d.ts

@@ -1,6 +1,7 @@
 import { NextI18nConfig } from "../config/next-config.js";
 import { Route } from "../routing/pages-router.js";
 import { ExecutionContextLike } from "../shims/request-context.js";
+import { EdgeApiExecutionRuntime } from "./edge-api-runtime.js";
 import { PagesReqResRequest, PagesReqResResponse, PagesRequestQuery } from "./pages-node-compat.js";
 
 //#region src/server/pages-api-route.d.ts
@@ -68,15 +69,18 @@ type HandlePagesApiRouteOptions = {
    * response. Omit on Node.js dev where no Workers lifecycle exists.
    */
   ctx?: ExecutionContextLike;
+  edgeRuntime?: EdgeApiExecutionRuntime;
   match: PagesApiRouteMatch | null;
   reportRequestError?: (error: Error, routePattern: string) => void | Promise<void>;
   request: Request;
   url: string;
   nextConfig?: {
     basePath?: string;
+    allowedRevalidateHeaderKeys?: readonly string[];
     i18n?: NextI18nConfig | null;
     trailingSlash?: boolean;
   };
+  trustedRevalidateOrigin?: string;
 };
 declare function handlePagesApiRoute(options: HandlePagesApiRouteOptions): Promise<Response>;
 //#endregion

package/dist/server/pages-api-route.js

@@ -7,7 +7,7 @@ import { mergeRouteParamsIntoQuery, parseQueryString, urlQueryToSearchParams } f
 import { resolveBodyParserConfig } from "./pages-body-parser-config.js";
 import { PagesBodyParseError } from "./pages-media-type.js";
 import { createPagesReqRes, parsePagesApiBody } from "./pages-node-compat.js";
-import { isEdgeApiRuntime } from "./edge-api-runtime.js";
+import { finalizeEdgeApiResponse, isEdgeApiRuntime } from "./edge-api-runtime.js";
 //#region src/server/pages-api-route.ts
 function resolveModuleRuntime(module) {
 	return module.runtime ?? module.config?.runtime;
@@ -42,16 +42,19 @@ async function _handlePagesApiRoute(options) {
 				trailingSlash: options.nextConfig.trailingSlash
 			} } : void 0);
 			const response = await route.module.default(nextRequest);
-			if (response instanceof Response) return response;
+			if (response instanceof Response) return finalizeEdgeApiResponse(response, options.edgeRuntime ?? "worker");
 			throw new Error("Edge API route did not return a Response");
 		}
 		if (!isNodeApiRouteModule(route.module)) return new Response("API route does not export a default function", { status: 500 });
 		const query = buildPagesApiQuery(options.url, params);
 		const bodyParserConfig = resolveBodyParserConfig(route.module.config);
+		const body = bodyParserConfig.enabled ? await parsePagesApiBody(options.request, bodyParserConfig.sizeLimit) : void 0;
 		const { req, res, responsePromise } = createPagesReqRes({
-			body: bodyParserConfig.enabled ? await parsePagesApiBody(options.request, bodyParserConfig.sizeLimit) : void 0,
+			allowedRevalidateHeaderKeys: options.nextConfig?.allowedRevalidateHeaderKeys,
+			body,
 			query,
 			request: options.request,
+			trustedRevalidateOrigin: options.trustedRevalidateOrigin,
 			url: options.url
 		});
 		let resWasPiped = false;

package/dist/server/pages-asset-tags.d.ts

@@ -57,6 +57,7 @@ type CollectAssetTagsOptions = {
   basePath?: string;
   assetPrefix?: string;
   deploymentId?: string;
+  crossOrigin?: string;
 };
 /**
  * Build the HTML `<link>` and `<script>` tag string for the SSR response.

package/dist/server/pages-asset-tags.js

@@ -70,6 +70,8 @@ function collectAssetTags(options) {
 	const seen = /* @__PURE__ */ new Set();
 	const nonceAttr = createNonceAttribute(options.scriptNonce);
 	const deferAttr = options.disableOptimizedLoading ? "" : " defer";
+	const scriptCrossOriginAttr = options.crossOrigin ? ` crossorigin="${options.crossOrigin}"` : " crossorigin";
+	const preloadCrossOriginAttr = options.crossOrigin ? ` crossorigin="${options.crossOrigin}"` : "";
 	const basePath = options.basePath ?? "";
 	const assetPrefix = options.assetPrefix ?? "";
 	const href = (value) => {
@@ -82,8 +84,8 @@ function collectAssetTags(options) {
 	const clientEntry = runtimeAssets.clientEntry;
 	if (clientEntry) {
 		seen.add(clientEntry);
-		tags.push("<link rel=\"modulepreload\"" + nonceAttr + " href=\"" + href(clientEntry) + "\" />");
-		tags.push("<script type=\"module\"" + deferAttr + nonceAttr + " src=\"" + href(clientEntry) + "\" crossorigin><\/script>");
+		tags.push("<link rel=\"modulepreload\"" + nonceAttr + " href=\"" + href(clientEntry) + "\"" + preloadCrossOriginAttr + " />");
+		tags.push("<script type=\"module\"" + deferAttr + nonceAttr + " src=\"" + href(clientEntry) + "\"" + scriptCrossOriginAttr + "><\/script>");
 	}
 	if (m) {
 		const allFiles = [];
@@ -115,8 +117,8 @@ function collectAssetTags(options) {
 			if (tf.endsWith(".css")) tags.push("<link rel=\"stylesheet\"" + nonceAttr + " href=\"" + href(tf) + "\" />");
 			else if (tf.endsWith(".js")) {
 				if (lazySet && lazySet.has(tf)) continue;
-				tags.push("<link rel=\"modulepreload\"" + nonceAttr + " href=\"" + href(tf) + "\" />");
-				tags.push("<script type=\"module\"" + deferAttr + nonceAttr + " src=\"" + href(tf) + "\" crossorigin><\/script>");
+				tags.push("<link rel=\"modulepreload\"" + nonceAttr + " href=\"" + href(tf) + "\"" + preloadCrossOriginAttr + " />");
+				tags.push("<script type=\"module\"" + deferAttr + nonceAttr + " src=\"" + href(tf) + "\"" + scriptCrossOriginAttr + "><\/script>");
 			}
 		}
 	}

package/dist/server/pages-dev-hydration.js

@@ -17,7 +17,6 @@ function createPagesDevHydrationScript(options) {
   element = React.createElement(AppComponent, {
     ...props,
     Component: PageComponent,
-    pageProps: rawPageProps,
     router: appRouter,
   });
   ` : `

package/dist/server/pages-document-asset-props.d.ts

@@ -0,0 +1,26 @@
+//#region src/server/pages-document-asset-props.d.ts
+type DocumentAssetProps = {
+  headNonce?: string;
+  headCrossOrigin?: string;
+  scriptNonce?: string;
+  scriptCrossOrigin?: string;
+};
+type ApplyDocumentAssetPropsOptions = {
+  configuredCrossOrigin?: string;
+  protectedAssetMarker?: string;
+  scriptOwner?: "head" | "next-script";
+};
+declare function extractDocumentAssetProps(html: string): {
+  html: string;
+  props: DocumentAssetProps;
+};
+/**
+ * Protect asset tags whose attributes already have a more specific owner while
+ * Vite runs its HTML transforms. Tags injected by Vite after this marker pass
+ * remain unmarked, so Document/config props can still be applied to them.
+ */
+declare function markDocumentAssetPropsProtectedTags(html: string, markerAttribute: string): string;
+declare function stripDocumentAssetPropsProtectionMarkers(html: string, markerAttribute: string): string;
+declare function applyDocumentAssetProps(html: string, props: DocumentAssetProps, options?: ApplyDocumentAssetPropsOptions): string;
+//#endregion
+export { DocumentAssetProps, applyDocumentAssetProps, extractDocumentAssetProps, markDocumentAssetPropsProtectedTags, stripDocumentAssetPropsProtectionMarkers };

package/dist/server/pages-document-asset-props.js

@@ -0,0 +1,69 @@
+import { escapeHtmlAttr } from "./html.js";
+//#region src/server/pages-document-asset-props.ts
+const HEAD_NONCE_ATTR = "data-vinext-head-nonce";
+const HEAD_CROSS_ORIGIN_ATTR = "data-vinext-head-cross-origin";
+const SCRIPT_NONCE_ATTR = "data-vinext-script-nonce";
+const SCRIPT_CROSS_ORIGIN_ATTR = "data-vinext-script-cross-origin";
+function readAttribute(tag, name) {
+	if (!tag) return void 0;
+	return tag.match(new RegExp(`\\s${name}="([^"]*)"`))?.[1];
+}
+function removeAttributes(tag, names) {
+	return tag.replace(new RegExp(`\\s(?:${names.join("|")})="[^"]*"`, "g"), "");
+}
+function extractDocumentAssetProps(html) {
+	const headTag = html.match(/<head\b[^>]*>/i)?.[0];
+	const nextScriptTag = html.match(/<span\b[^>]*>(?=<!-- __NEXT_SCRIPTS__ -->)/i)?.[0];
+	const props = {
+		headNonce: readAttribute(headTag, HEAD_NONCE_ATTR),
+		headCrossOrigin: readAttribute(headTag, HEAD_CROSS_ORIGIN_ATTR),
+		scriptNonce: readAttribute(nextScriptTag, SCRIPT_NONCE_ATTR),
+		scriptCrossOrigin: readAttribute(nextScriptTag, SCRIPT_CROSS_ORIGIN_ATTR)
+	};
+	return {
+		html: html.replace(/<head\b[^>]*>/i, (tag) => removeAttributes(tag, [HEAD_NONCE_ATTR, HEAD_CROSS_ORIGIN_ATTR])).replace(/<span\b[^>]*>(?=<!-- __NEXT_SCRIPTS__ -->)/i, (tag) => removeAttributes(tag, [SCRIPT_NONCE_ATTR, SCRIPT_CROSS_ORIGIN_ATTR])),
+		props
+	};
+}
+function addAttribute(tag, name, value, replaceExisting = false) {
+	if (value === void 0) return tag;
+	const attributePattern = new RegExp(`\\s${name}(?:="[^"]*")?`, "i");
+	if (attributePattern.test(tag)) return replaceExisting ? tag.replace(attributePattern, ` ${name}="${escapeHtmlAttr(value)}"`) : tag;
+	if (!tag.endsWith(">")) return tag;
+	const selfClosing = tag.endsWith("/>");
+	const closingStart = selfClosing ? tag.length - 2 : tag.length - 1;
+	const opening = tag.slice(0, closingStart).trimEnd();
+	const closing = selfClosing ? " />" : ">";
+	return `${opening} ${name}="${escapeHtmlAttr(value)}"${closing}`;
+}
+function hasAttribute(tag, name) {
+	return name !== void 0 && new RegExp(`\\s${name}(?:="[^"]*")?`, "i").test(tag);
+}
+/**
+* Protect asset tags whose attributes already have a more specific owner while
+* Vite runs its HTML transforms. Tags injected by Vite after this marker pass
+* remain unmarked, so Document/config props can still be applied to them.
+*/
+function markDocumentAssetPropsProtectedTags(html, markerAttribute) {
+	return html.replace(/<script\b[^>]*>/gi, (tag) => addAttribute(tag, markerAttribute, "")).replace(/<link\b[^>]*\brel="(?:preload|modulepreload)"[^>]*>/gi, (tag) => addAttribute(tag, markerAttribute, ""));
+}
+function stripDocumentAssetPropsProtectionMarkers(html, markerAttribute) {
+	const stripMarker = (tag) => removeAttributes(tag, [markerAttribute]);
+	return html.replace(/<script\b[^>]*>/gi, stripMarker).replace(/<link\b[^>]*\brel="(?:preload|modulepreload)"[^>]*>/gi, stripMarker);
+}
+function applyDocumentAssetProps(html, props, options = {}) {
+	const scriptOwner = options.scriptOwner ?? "next-script";
+	const scriptNonce = scriptOwner === "head" ? props.headNonce : props.scriptNonce;
+	const preloadNonce = props.headNonce;
+	const scriptCrossOrigin = (scriptOwner === "head" ? props.headCrossOrigin : props.scriptCrossOrigin) ?? options.configuredCrossOrigin;
+	const preloadCrossOrigin = props.headCrossOrigin ?? options.configuredCrossOrigin;
+	return html.replace(/<script\b[^>]*>/gi, (tag) => {
+		if (hasAttribute(tag, options.protectedAssetMarker)) return tag;
+		return addAttribute(addAttribute(tag, "nonce", scriptNonce, true), "crossorigin", scriptCrossOrigin, true);
+	}).replace(/<link\b[^>]*\brel="(?:preload|modulepreload)"[^>]*>/gi, (tag) => {
+		if (hasAttribute(tag, options.protectedAssetMarker)) return tag;
+		return addAttribute(addAttribute(tag, "nonce", preloadNonce, true), "crossorigin", preloadCrossOrigin, true);
+	});
+}
+//#endregion
+export { applyDocumentAssetProps, extractDocumentAssetProps, markDocumentAssetPropsProtectedTags, stripDocumentAssetPropsProtectionMarkers };

package/dist/server/pages-get-initial-props.d.ts

@@ -43,7 +43,7 @@ type DevAppInitialPropsResult = {
   kind: "render";
   pageProps: Record<string, unknown>;
   renderProps: Record<string, unknown> & {
-    pageProps: unknown;
+    pageProps?: unknown;
   };
 };
 type DevAppInitialPropsContext = {

package/dist/server/pages-get-initial-props.js

@@ -92,10 +92,7 @@ async function loadDevAppInitialProps(ctx) {
 	return {
 		kind: "render",
 		pageProps: isPropsObject(initialPageProps) ? initialPageProps : {},
-		renderProps: isPropsObject(initialProps) ? {
-			...initialProps,
-			pageProps: initialPageProps
-		} : { pageProps: initialPageProps }
+		renderProps: isPropsObject(initialProps) ? initialProps : {}
 	};
 }
 //#endregion