vinext 1.0.0-beta.2 → 1.0.0-beta.4

package/dist/server/pages-router-entry.js

@@ -1,5 +1,6 @@
 import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
+import { VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
 import { notFoundStaticAssetResponse } from "./http-error-responses.js";
 import { isOpenRedirectShaped } from "./open-redirect.js";
 import { cloneRequestWithHeaders, cloneRequestWithUrl, filterInternalHeaders } from "./request-pipeline.js";
@@ -7,6 +8,7 @@ import { assetPrefixPathname, isNextStaticPath } from "../utils/asset-prefix.js"
 import { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, handleConfiguredImageOptimization, isImageOptimizationPath } from "./image-optimization.js";
 import { finalizeMissingStaticAssetResponse } from "./worker-utils.js";
 import { fetchWorkerFilesystemRoute, runPagesRequest, wrapMiddlewareWithBasePath } from "./pages-request-pipeline.js";
+import { createWorkerRevalidationContext } from "./worker-revalidation-context.js";
 import { registerConfiguredCacheAdapters } from "virtual:vinext-cache-adapters";
 import { registerConfiguredImageOptimizer } from "virtual:vinext-image-adapters";
 import * as pagesEntry from "virtual:vinext-server-entry";
@@ -25,7 +27,7 @@ import * as pagesEntry from "virtual:vinext-server-entry";
 *   import handler from "vinext/server/pages-router-entry";
 *   return handler.fetch(request, env, ctx);
 */
-const { handleApiRoute, hasMiddleware, matchPageRoute, normalizeDataRequest, renderPage, runMiddleware, vinextConfig } = pagesEntry;
+const { authorizeOnDemandRevalidate, handleApiRoute, hasMiddleware, matchPageRoute, normalizeDataRequest, renderPage, runMiddleware, vinextConfig } = pagesEntry;
 const basePath = vinextConfig?.basePath ?? "";
 const assetPathPrefix = assetPrefixPathname(vinextConfig?.assetPrefix ?? "");
 const trailingSlash = vinextConfig?.trailingSlash ?? false;
@@ -47,7 +49,8 @@ const imageConfig = vinextConfig?.images ? {
 var pages_router_entry_default = { async fetch(request, env, ctx) {
 	return handleRequest(request, env, ctx);
 } };
-async function handleRequest(request, env, ctx) {
+async function handleRequest(request, env, platformCtx) {
+	const ctx = createWorkerRevalidationContext(platformCtx, (internalRequest, internalCtx) => handleRequest(internalRequest, env, internalCtx));
 	registerConfiguredCacheAdapters(env);
 	registerConfiguredImageOptimizer(env);
 	try {
@@ -59,7 +62,9 @@ async function handleRequest(request, env, ctx) {
 			return new Response("Bad Request", { status: 400 });
 		}
 		const missingBuildAsset = isNextStaticPath(pathname, basePath, assetPathPrefix);
-		request = cloneRequestWithHeaders(request, filterInternalHeaders(request.headers));
+		const filteredHeaders = ctx.isInternalPagesRevalidation ? new Headers(request.headers) : filterInternalHeaders(request.headers);
+		filteredHeaders.delete(VINEXT_REVALIDATE_HOST_HEADER);
+		request = cloneRequestWithHeaders(request, filteredHeaders);
 		const hadBasePath = !basePath || hasBasePath(pathname, basePath);
 		{
 			const stripped = stripBasePath(pathname, basePath);
@@ -93,10 +98,11 @@ async function handleRequest(request, env, ctx) {
 			isDataRequest: isDataReq,
 			hasMiddleware,
 			ctx,
+			authorizeOnDemandRevalidate: typeof authorizeOnDemandRevalidate === "function" ? authorizeOnDemandRevalidate : void 0,
 			matchPageRoute: typeof matchPageRoute === "function" ? matchPageRoute : null,
 			runMiddleware: typeof runMiddleware === "function" ? wrapMiddlewareWithBasePath(runMiddleware, basePath, hadBasePath) : null,
 			renderPage: typeof renderPage === "function" ? (req, resolvedUrl, options, stagedHeaders) => renderPage(req, resolvedUrl, null, ctx, stagedHeaders, options) : null,
-			handleApi: typeof handleApiRoute === "function" ? (req, apiUrl) => handleApiRoute(req, apiUrl, ctx) : null,
+			handleApi: typeof handleApiRoute === "function" ? (req, apiUrl) => handleApiRoute(req, apiUrl, ctx, new URL(req.url).origin, "worker") : null,
 			serveFilesystemRoute: async (requestPathname, _stagedHeaders, phase) => {
 				if (!env?.ASSETS) return false;
 				return fetchWorkerFilesystemRoute(request, requestPathname, phase, (assetRequest) => Promise.resolve(env.ASSETS.fetch(assetRequest)));

package/dist/server/prerender-manifest.d.ts

@@ -8,6 +8,7 @@ type PrerenderManifestRoute = {
   router?: string;
   fallback?: boolean;
   headers?: Record<string, string>;
+  tags?: string[];
 };
 type PrerenderManifest = {
   buildId?: string;

package/dist/server/prod-server.d.ts

@@ -1,3 +1,4 @@
+import { NextI18nConfig } from "../config/next-config.js";
 import { negotiateEncoding } from "./accept-encoding.js";
 import { StaticFileCache } from "./static-file-cache.js";
 import { resolveRequestHost, trustProxy, trustedHosts } from "./proxy-trust.js";
@@ -103,7 +104,7 @@ declare function tryServeStatic(req: IncomingMessage, res: ServerResponse, clien
  * When `urlOverride` is provided, it is used as the path + query string
  * instead of `req.url`.
  */
-declare function nodeToWebRequest(req: IncomingMessage, urlOverride?: string, prerenderSecret?: string): Request;
+declare function nodeToWebRequest(req: IncomingMessage, urlOverride?: string, prerenderSecret?: string, i18nConfig?: NextI18nConfig | null, authorizeOnDemandRevalidate?: (headerValue: string | null) => boolean): Request;
 /**
  * Stream a Web Response back to a Node.js ServerResponse.
  * Supports streaming compression for SSR responses.

package/dist/server/prod-server.js

@@ -16,6 +16,7 @@ import { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, isImageOptimizationPath, isS
 import { installSocketErrorBackstop } from "./socket-error-backstop.js";
 import { CONTENT_TYPES, StaticFileCache, etagFromFilenameHash } from "./static-file-cache.js";
 import { collectInlineCssManifest } from "../build/inline-css.js";
+import { readTrustedRevalidationHostname } from "./revalidation-host.js";
 import { mergeHeaders } from "./worker-utils.js";
 import { runPagesRequest, wrapMiddlewareWithBasePath } from "./pages-request-pipeline.js";
 import { computeClientRuntimeMetadata } from "../utils/client-runtime-metadata.js";
@@ -557,13 +558,16 @@ async function statIfFile(filePath) {
 * When `urlOverride` is provided, it is used as the path + query string
 * instead of `req.url`.
 */
-function nodeToWebRequest(req, urlOverride, prerenderSecret) {
-	const origin = `${resolveRequestProtocol(req)}://${resolveRequestHost(req, "localhost")}`;
-	const url = new URL(urlOverride ?? req.url ?? "/", origin);
+function nodeToWebRequest(req, urlOverride, prerenderSecret, i18nConfig, authorizeOnDemandRevalidate) {
+	const proto = resolveRequestProtocol(req);
 	const rawHeaders = nodeHeadersToWebHeaders(req.headers);
+	const revalidationHostname = readTrustedRevalidationHostname(rawHeaders, i18nConfig, authorizeOnDemandRevalidate);
+	const origin = `${proto}://${revalidationHostname ?? resolveRequestHost(req, "localhost")}`;
+	const url = new URL(urlOverride ?? req.url ?? "/", origin);
 	const prerenderRouteParamsPayload = readTrustedPrerenderRouteParamsFromHeaders(rawHeaders, prerenderSecret);
 	const isTrustedSpeculativePrerender = process.env.VINEXT_PRERENDER === "1" && prerenderSecret !== void 0 && rawHeaders.get("x-vinext-prerender-secret") === prerenderSecret && rawHeaders.get("x-vinext-prerender-speculative") === "1";
 	const headers = filterInternalHeaders(rawHeaders);
+	if (revalidationHostname) headers.set("host", revalidationHostname);
 	const prerenderRouteParamsHeader = serializePrerenderRouteParamsHeader(prerenderRouteParamsPayload);
 	if (prerenderRouteParamsHeader !== null) headers.set(VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, prerenderRouteParamsHeader);
 	if (isTrustedSpeculativePrerender) headers.set(VINEXT_PRERENDER_SPECULATIVE_HEADER, "1");
@@ -660,19 +664,33 @@ async function startProdServer(options = {}) {
 		silent
 	});
 }
-function createNodeExecutionContext() {
+function createNodeExecutionContext(trustedRevalidateOrigin) {
 	return {
+		hostRuntime: "node",
 		waitUntil(promise) {
 			Promise.resolve(promise).catch(() => {});
 		},
-		passThroughOnException() {}
+		passThroughOnException() {},
+		trustedRevalidateOrigin
 	};
 }
+function resolveTrustedNodeRevalidateOrigin(req, configuredHost, configuredPort) {
+	const port = req.socket.localPort ?? configuredPort;
+	return `http://${normalizeInternalFetchHost(configuredHost)}:${port}`;
+}
+function normalizeInternalFetchHost(host) {
+	if (!host || host === "0.0.0.0" || host === "::") return "localhost";
+	if (host.includes(":") && !host.startsWith("[")) return `[${host}]`;
+	return host;
+}
 function resolveAppRouterHandler(entry) {
-	if (typeof entry === "function") return (request) => Promise.resolve(entry(request));
+	if (typeof entry === "function") {
+		const handler = entry;
+		return (request, ctx) => Promise.resolve(handler(request, ctx));
+	}
 	if (entry && typeof entry === "object" && "fetch" in entry) {
 		const workerEntry = entry;
-		if (typeof workerEntry.fetch === "function") return (request) => Promise.resolve(workerEntry.fetch(request, void 0, createNodeExecutionContext()));
+		if (typeof workerEntry.fetch === "function") return (request, ctx) => Promise.resolve(workerEntry.fetch(request, void 0, ctx));
 	}
 	console.error("[vinext] App Router entry must export either a default handler function or a Worker-style default export with fetch()");
 	process.exit(1);
@@ -793,6 +811,8 @@ async function startAppRouterServer(options) {
 	const appRouterBasePath = typeof rscModule.__basePath === "string" ? rscModule.__basePath : "";
 	const appRouterInlineCss = rscModule.__inlineCss === true;
 	const appRouterHasPagesDir = rscModule.__hasPagesDir === true;
+	const appRouterI18nConfig = rscModule.__i18nConfig ?? null;
+	const appRouterAuthorizeOnDemandRevalidate = typeof rscModule.authorizeOnDemandRevalidate === "function" ? rscModule.authorizeOnDemandRevalidate : void 0;
 	const appImageAllowedWidths = Array.isArray(rscModule.__imageAllowedWidths) ? rscModule.__imageAllowedWidths : [...DEFAULT_DEVICE_SIZES, ...DEFAULT_IMAGE_SIZES];
 	let imageConfig = typeof rscModule.__imageConfig === "object" && rscModule.__imageConfig !== null ? rscModule.__imageConfig : void 0;
 	if (imageConfig === void 0) {
@@ -870,8 +890,8 @@ async function startAppRouterServer(options) {
 			return;
 		}
 		try {
-			const request = nodeToWebRequest(req, rawUrl, prerenderSecret);
-			const response = await rscHandler(request);
+			const request = nodeToWebRequest(req, rawUrl, prerenderSecret, appRouterI18nConfig, appRouterAuthorizeOnDemandRevalidate);
+			const response = await rscHandler(request, createNodeExecutionContext(resolveTrustedNodeRevalidateOrigin(req, host, port)));
 			if (missingBuildAsset && response.status === 404) {
 				cancelResponseBody(response);
 				res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
@@ -935,14 +955,16 @@ function readPagesServerEntryPageRoutes(value) {
 *
 * Uses the server entry (dist/server/entry.js) which exports:
 * - renderPage(request, url, manifest, ctx?, middlewareHeaders?) — SSR rendering (Web Request → Response)
-* - handleApiRoute(request, url, ctx?) — API route handling (ctx optional; pass for ctx.waitUntil() on Workers)
+* - handleApiRoute(request, url, ctx?, trustedRevalidateOrigin?) — API route handling
+*   (ctx optional; pass for ctx.waitUntil() on Workers)
+* - authorizeOnDemandRevalidate(header) — validates against the bundled build secret
 * - runMiddleware(request, ctx?) — middleware execution (ctx optional; pass for ctx.waitUntil() on Workers)
 * - vinextConfig — embedded next.config.js settings
 */
 async function startPagesRouterServer(options) {
 	const { port, host, clientDir, serverEntryPath, compress, purpose, silent } = options;
 	const serverEntry = await importServerEntryModule(serverEntryPath);
-	const { renderPage, handleApiRoute: handleApi, runMiddleware, vinextConfig, buildId: pagesBuildId } = serverEntry;
+	const { renderPage, handleApiRoute: handleApi, authorizeOnDemandRevalidate, runMiddleware, vinextConfig, buildId: pagesBuildId } = serverEntry;
 	const matchPageRoute = typeof serverEntry.matchPageRoute === "function" ? serverEntry.matchPageRoute : void 0;
 	const hasMiddleware = serverEntry.hasMiddleware === true;
 	const pageRoutes = readPagesServerEntryPageRoutes(serverEntry.pageRoutes);
@@ -1095,11 +1117,13 @@ async function startPagesRouterServer(options) {
 			const protocol = resolveRequestProtocol(req);
 			const hostHeader = resolveRequestHost(req, `${host}:${port}`);
 			const rawReqHeaders = nodeHeadersToWebHeaders(req.headers);
+			const revalidationHostname = readTrustedRevalidationHostname(rawReqHeaders, i18nConfig, typeof authorizeOnDemandRevalidate === "function" ? authorizeOnDemandRevalidate : void 0);
 			const isDataRequest = isDataReq;
 			const reqHeaders = filterInternalHeaders(rawReqHeaders);
+			if (revalidationHostname) reqHeaders.set("host", revalidationHostname);
 			const method = req.method ?? "GET";
 			const hasBody = method !== "GET" && method !== "HEAD";
-			const result = await runPagesRequest(new Request(`${protocol}://${hostHeader}${url}`, {
+			const result = await runPagesRequest(new Request(`${protocol}://${revalidationHostname ?? hostHeader}${url}`, {
 				method,
 				headers: reqHeaders,
 				body: hasBody ? readNodeStream(req) : void 0,
@@ -1117,6 +1141,7 @@ async function startPagesRouterServer(options) {
 				hasMiddleware,
 				ctx: void 0,
 				rawSearch: rawQs,
+				authorizeOnDemandRevalidate: typeof authorizeOnDemandRevalidate === "function" ? authorizeOnDemandRevalidate : void 0,
 				configMatchPathname,
 				matchPageRoute: matchPageRoute ?? null,
 				runMiddleware: typeof runMiddleware === "function" ? wrapMiddlewareWithBasePath(runMiddleware, basePath, hadBasePath) : null,
@@ -1124,7 +1149,7 @@ async function startPagesRouterServer(options) {
 					...options,
 					originalUrl: originalRenderUrl
 				}) : null,
-				handleApi: typeof handleApi === "function" ? (request, apiUrl) => handleApi(request, apiUrl, createNodeExecutionContext()) : null,
+				handleApi: typeof handleApi === "function" ? (request, apiUrl) => handleApi(request, apiUrl, createNodeExecutionContext(), resolveTrustedNodeRevalidateOrigin(req, host, port), "node") : null,
 				serveFilesystemRoute: async (requestPathname, stagedHeaders, phase) => {
 					if (req.method !== "GET" && req.method !== "HEAD" || requestPathname === "/" || requestPathname === "/api" || requestPathname.startsWith("/api/") || phase === "direct" && requestPathname.startsWith(`/_next/static/`)) return false;
 					return tryServeStatic(req, res, clientDir, requestPathname, compress, staticCache, stagedHeaders);

package/dist/server/revalidation-host.d.ts

@@ -0,0 +1,11 @@
+import { NextI18nConfig } from "../config/next-config.js";
+
+//#region src/server/revalidation-host.d.ts
+/**
+ * Read the logical request hostname carried by a server-pinned revalidation
+ * loopback. The side channel is accepted only as part of the authenticated
+ * revalidation protocol and only for an exact configured i18n domain.
+ */
+declare function readTrustedRevalidationHostname(headers: Headers, i18nConfig: NextI18nConfig | null | undefined, authorizeRevalidation?: (headerValue: string | null) => boolean): string | null;
+//#endregion
+export { readTrustedRevalidationHostname };

package/dist/server/revalidation-host.js

@@ -0,0 +1,19 @@
+import { VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
+import { isOnDemandRevalidateRequest } from "./isr-cache.js";
+import { normalizeDomainHostname } from "../utils/domain-locale.js";
+//#region src/server/revalidation-host.ts
+/**
+* Read the logical request hostname carried by a server-pinned revalidation
+* loopback. The side channel is accepted only as part of the authenticated
+* revalidation protocol and only for an exact configured i18n domain.
+*/
+function readTrustedRevalidationHostname(headers, i18nConfig, authorizeRevalidation = isOnDemandRevalidateRequest) {
+	if (!i18nConfig?.domains?.length || !authorizeRevalidation(headers.get("x-prerender-revalidate"))) return null;
+	const rawHostname = headers.get(VINEXT_REVALIDATE_HOST_HEADER);
+	if (!rawHostname) return null;
+	const hostname = rawHostname.trim().toLowerCase();
+	if (normalizeDomainHostname(hostname) !== hostname) return null;
+	return i18nConfig.domains.find((item) => normalizeDomainHostname(item.domain) === hostname)?.domain.toLowerCase() ?? null;
+}
+//#endregion
+export { readTrustedRevalidationHostname };

package/dist/server/seed-cache.js

@@ -66,7 +66,7 @@ async function seedMemoryCacheFromPrerender(serverDir, options) {
 		const rscKey = options?.buildAppPageRscKey?.(cachePathname) ?? baseKey + ":rsc";
 		const revalidateSeconds = typeof route.revalidate === "number" ? route.revalidate : void 0;
 		const expireSeconds = typeof route.expire === "number" ? route.expire : void 0;
-		const tags = buildAppPageCacheTags(cachePathname, []);
+		const tags = buildAppPageCacheTags(cachePathname, route.tags ?? []);
 		if (await seedHtml(writeAppPageEntry, prerenderDir, htmlKey, artifactPathname, trailingSlash, route.headers, revalidateSeconds, expireSeconds, tags)) {
 			await seedRsc(writeAppPageEntry, prerenderDir, rscKey, artifactPathname, revalidateSeconds, expireSeconds, tags);
 			seeded++;

package/dist/server/worker-revalidation-context.d.ts

@@ -0,0 +1,13 @@
+import { ExecutionContextLike } from "../shims/request-context.js";
+
+//#region src/server/worker-revalidation-context.d.ts
+type PlatformExecutionContext = Partial<ExecutionContextLike>;
+/**
+ * Add a request-local, in-process Pages revalidation dispatcher to a Worker
+ * execution context. Re-entering with the derived internal context preserves
+ * the authenticated protocol headers while keeping ordinary inbound requests
+ * on the normal header-scrubbing path.
+ */
+declare function createWorkerRevalidationContext(base: PlatformExecutionContext | undefined, handleInternalRequest: (request: Request, ctx: ExecutionContextLike) => Promise<Response>): ExecutionContextLike;
+//#endregion
+export { createWorkerRevalidationContext };

package/dist/server/worker-revalidation-context.js

@@ -0,0 +1,30 @@
+//#region src/server/worker-revalidation-context.ts
+function deriveExecutionContext(base, dispatchPagesRevalidate, isInternalPagesRevalidation) {
+	return {
+		waitUntil(promise) {
+			if (typeof base?.waitUntil === "function") base.waitUntil(promise);
+			else Promise.resolve(promise).catch(() => {});
+		},
+		...typeof base?.passThroughOnException === "function" ? { passThroughOnException() {
+			base.passThroughOnException?.();
+		} } : {},
+		hostRuntime: "worker",
+		...base?.cache === void 0 ? {} : { cache: base.cache },
+		...base?.trustedRevalidateOrigin === void 0 ? {} : { trustedRevalidateOrigin: base.trustedRevalidateOrigin },
+		dispatchPagesRevalidate,
+		isInternalPagesRevalidation
+	};
+}
+/**
+* Add a request-local, in-process Pages revalidation dispatcher to a Worker
+* execution context. Re-entering with the derived internal context preserves
+* the authenticated protocol headers while keeping ordinary inbound requests
+* on the normal header-scrubbing path.
+*/
+function createWorkerRevalidationContext(base, handleInternalRequest) {
+	if (typeof base?.dispatchPagesRevalidate === "function") return base;
+	const dispatchPagesRevalidate = (request) => handleInternalRequest(request, deriveExecutionContext(base, dispatchPagesRevalidate, true));
+	return deriveExecutionContext(base, dispatchPagesRevalidate, false);
+}
+//#endregion
+export { createWorkerRevalidationContext };

package/dist/shims/app-router-scroll-state.d.ts

@@ -9,8 +9,9 @@ type AppRouterScrollIntent = Readonly<{
 declare function beginAppRouterScrollIntent(hash: string | null): AppRouterScrollIntent;
 declare function clearAppRouterScrollIntent(): void;
 declare function getPendingAppRouterScrollIntent(): AppRouterScrollIntent | null;
+declare function isLatestAppRouterScrollIntent(expected: AppRouterScrollIntent | null | undefined): boolean;
 declare function claimAppRouterScrollIntentForCommit(expected: AppRouterScrollIntent | null | undefined, commitId: number): void;
 declare function markAppRouterScrollIntentHeadHoisted(expected: AppRouterScrollIntent | null | undefined, commitId: number): void;
 declare function consumeAppRouterScrollIntent(expected: AppRouterScrollIntent | null | undefined, commitId?: number): AppRouterScrollIntent | null;
 //#endregion
-export { AppRouterScrollIntent, beginAppRouterScrollIntent, claimAppRouterScrollIntentForCommit, clearAppRouterScrollIntent, consumeAppRouterScrollIntent, getPendingAppRouterScrollIntent, markAppRouterScrollIntentHeadHoisted };
+export { AppRouterScrollIntent, beginAppRouterScrollIntent, claimAppRouterScrollIntentForCommit, clearAppRouterScrollIntent, consumeAppRouterScrollIntent, getPendingAppRouterScrollIntent, isLatestAppRouterScrollIntent, markAppRouterScrollIntentHeadHoisted };

package/dist/shims/app-router-scroll-state.js

@@ -22,11 +22,16 @@ function beginAppRouterScrollIntent(hash) {
 	return intent;
 }
 function clearAppRouterScrollIntent() {
-	getScrollIntentStore().pending = null;
+	const store = getScrollIntentStore();
+	store.nextId += 1;
+	store.pending = null;
 }
 function getPendingAppRouterScrollIntent() {
 	return getScrollIntentStore().pending;
 }
+function isLatestAppRouterScrollIntent(expected) {
+	return expected !== null && expected !== void 0 && getScrollIntentStore().nextId === expected.id;
+}
 function claimAppRouterScrollIntentForCommit(expected, commitId) {
 	const store = getScrollIntentStore();
 	const intent = store.pending;
@@ -59,4 +64,4 @@ function consumeAppRouterScrollIntent(expected, commitId) {
 	return intent;
 }
 //#endregion
-export { beginAppRouterScrollIntent, claimAppRouterScrollIntentForCommit, clearAppRouterScrollIntent, consumeAppRouterScrollIntent, getPendingAppRouterScrollIntent, markAppRouterScrollIntentHeadHoisted };
+export { beginAppRouterScrollIntent, claimAppRouterScrollIntentForCommit, clearAppRouterScrollIntent, consumeAppRouterScrollIntent, getPendingAppRouterScrollIntent, isLatestAppRouterScrollIntent, markAppRouterScrollIntentHeadHoisted };

package/dist/shims/cache-handler.d.ts

@@ -9,7 +9,7 @@ type CacheHandlerValue = {
   value: IncrementalCacheValue | null;
 };
 type CacheControlMetadata = {
-  revalidate: number;
+  revalidate: number | false;
   expire?: number;
 };
 type IncrementalCacheValue = CachedFetchValue | CachedAppPageValue | CachedPagesValue | CachedRouteValue | CachedRedirectValue | CachedImageValue;

package/dist/shims/cache-handler.js

@@ -1,4 +1,4 @@
-import { readCacheControlNumberField } from "../utils/cache-control-metadata.js";
+import { readCacheControlNumberField, readCacheControlRevalidateField } from "../utils/cache-control-metadata.js";
 //#region src/shims/cache-handler.ts
 var NoOpCacheHandler = class {
 	async get(_key, _ctx) {
@@ -88,12 +88,14 @@ var MemoryCacheHandler = class {
 			const revalidatedAt = this.tagRevalidatedAt.get(tag);
 			if (revalidatedAt && revalidatedAt >= entry.lastModified) return null;
 		}
-		if (entry.expireAt !== null && Date.now() > entry.expireAt) {
-			this.deleteEntry(key);
-			return null;
-		}
 		this.touchEntry(key, entry);
 		const now = Date.now();
+		if (entry.expireAt !== null && now > entry.expireAt) return {
+			lastModified: entry.lastModified,
+			value: entry.value,
+			cacheState: "expired",
+			cacheControl: entry.cacheControl
+		};
 		const requestedRevalidate = readPositiveNumberField(ctx, "revalidate");
 		const requestedRevalidateAt = requestedRevalidate === void 0 ? null : entry.lastModified + requestedRevalidate * 1e3;
 		if (entry.revalidateAt !== null && now > entry.revalidateAt || requestedRevalidateAt !== null && now > requestedRevalidateAt) return {
@@ -113,14 +115,15 @@ var MemoryCacheHandler = class {
 		if (data && "tags" in data && Array.isArray(data.tags)) for (const tag of data.tags) tagSet.add(tag);
 		for (const tag of readStringArrayField(ctx, "tags")) tagSet.add(tag);
 		const tags = [...tagSet];
-		let effectiveRevalidate = readCacheControlNumberField(ctx, "revalidate");
+		let effectiveRevalidate = readCacheControlRevalidateField(ctx);
 		const effectiveExpire = readCacheControlNumberField(ctx, "expire");
 		if (data && "revalidate" in data && typeof data.revalidate === "number") effectiveRevalidate = data.revalidate;
+		else if (data && "revalidate" in data && data.revalidate === false) effectiveRevalidate ??= false;
 		if (effectiveRevalidate === 0) return;
 		const now = Date.now();
 		const revalidateAt = typeof effectiveRevalidate === "number" && effectiveRevalidate > 0 ? now + effectiveRevalidate * 1e3 : null;
 		const expireAt = typeof effectiveExpire === "number" && effectiveExpire > 0 ? now + effectiveExpire * 1e3 : null;
-		const cacheControl = typeof effectiveRevalidate === "number" ? effectiveExpire === void 0 ? { revalidate: effectiveRevalidate } : {
+		const cacheControl = typeof effectiveRevalidate === "number" || effectiveRevalidate === false ? effectiveExpire === void 0 ? { revalidate: effectiveRevalidate } : {
 			revalidate: effectiveRevalidate,
 			expire: effectiveExpire
 		} : void 0;

package/dist/shims/cache-runtime.d.ts

@@ -71,6 +71,12 @@ declare function runWithPrivateCache<T>(fn: () => T | Promise<T>): T | Promise<T
  */
 declare function clearPrivateCache(): void;
 type RegisterCachedFunctionOptions = {
+  /**
+   * Whether the original function declaration accepts a second argument.
+   * Function.length cannot represent default or rest parameters, so the
+   * transform records this separately for metadata parent resolution.
+   */
+  acceptsSecondArgument?: boolean;
   /**
    * Internal transform metadata for file-level `"use cache"` default exports
    * in App Router `page.*` files. Page components receive framework-owned

package/dist/shims/cache-runtime.js

@@ -334,10 +334,13 @@ function registerCachedFunction(fn, id, variant, options = {}) {
 		configurable: true
 	});
 	cachedFn[USE_CACHE_FUNCTION_SYMBOL] = true;
+	if (options.acceptsSecondArgument !== void 0) Reflect.set(cachedFn, USE_CACHE_ACCEPTS_SECOND_ARGUMENT_SYMBOL, options.acceptsSecondArgument);
 	return cachedFn;
 }
 /** @internal Symbol used to identify "use cache" wrapper functions. */
 const USE_CACHE_FUNCTION_SYMBOL = Symbol.for("vinext.useCacheFunction");
+/** @internal Symbol carrying transform-derived cached function argument metadata. */
+const USE_CACHE_ACCEPTS_SECOND_ARGUMENT_SYMBOL = Symbol.for("vinext.useCacheAcceptsSecondArgument");
 function throwPrivateUseCacheInsidePublicUseCacheError() {
 	const error = /* @__PURE__ */ new Error("\"use cache: private\" must not be used within \"use cache\". It can only be nested inside of another \"use cache: private\".");
 	const ctx = getRequestContext();
@@ -347,7 +350,7 @@ function throwPrivateUseCacheInsidePublicUseCacheError() {
 function recordRequestScopedCacheControl(cacheControl) {
 	if (cacheControl === void 0) return;
 	_setRequestScopedCacheLife({
-		revalidate: cacheControl.revalidate,
+		revalidate: cacheControl.revalidate === false ? void 0 : cacheControl.revalidate,
 		expire: cacheControl.expire
 	});
 }

package/dist/shims/cache.js

@@ -4,10 +4,10 @@ import { getRequestExecutionContext, runWithExecutionContext } from "./request-c
 import { MemoryCacheHandler, NoOpCacheHandler, configureMemoryCacheHandler, getCacheHandler, getDataCacheHandler, setCacheHandler, setDataCacheHandler } from "./cache-handler.js";
 import { getCdnCacheAdapter } from "./cdn-cache.js";
 import { fnv1a64 } from "../utils/hash.js";
+import { encodeCacheTag, encodeCacheTags } from "../utils/encode-cache-tag.js";
 import { makeHangingPromise } from "./internal/make-hanging-promise.js";
 import { getHeadersAccessPhase, isDraftModeEnabled, markDynamicUsage } from "./headers.js";
 import { ACTION_DID_REVALIDATE_DYNAMIC_ONLY, ACTION_DID_REVALIDATE_STATIC_AND_DYNAMIC, _consumeRequestScopedCacheLife, _drainPendingRevalidations, _hasPendingRevalidatedTag, _initRequestScopedCacheState, _markPendingRevalidatedTag, _peekRequestScopedCacheLife, _peekUnstableCacheObservations, _queuePendingRevalidation, _registerCacheContextAccessor, _runWithCacheState, _setRequestScopedCacheLife, cacheLifeProfiles, getAndClearActionRevalidationKind, getRegisteredCacheContext, markActionRevalidation, recordUnstableCacheObservation, shouldServeStaleUnstableCacheEntry } from "./cache-request-state.js";
-import { encodeCacheTag, encodeCacheTags } from "../utils/encode-cache-tag.js";
 import { addCollectedRequestTags, getCurrentFetchSoftTags } from "./fetch-cache.js";
 import { workUnitAsyncStorage } from "./internal/work-unit-async-storage.js";
 //#region src/shims/cache.ts

package/dist/shims/document.js

@@ -8,6 +8,12 @@ import { Fragment as Fragment$1, jsx, jsxs } from "react/jsx-runtime";
 * custom Pages Router documents. Vinext's renderer replaces the Main and
 * NextScript placeholders with the rendered page and hydration scripts.
 */
+const documentAssetMarkerAttributes = {
+	headNonce: "data-vinext-head-nonce",
+	headCrossOrigin: "data-vinext-head-cross-origin",
+	scriptNonce: "data-vinext-script-nonce",
+	scriptCrossOrigin: "data-vinext-script-cross-origin"
+};
 const HtmlContext = React.createContext(void 0);
 function Html(props) {
 	return /* @__PURE__ */ jsx("html", { ...props });
@@ -39,9 +45,11 @@ var Head = class extends React.Component {
 		return [];
 	}
 	render() {
-		const { children, ...props } = this.props;
+		const { children, nonce, crossOrigin, ...props } = this.props;
 		return /* @__PURE__ */ jsx("head", {
 			...props,
+			...nonce ? { [documentAssetMarkerAttributes.headNonce]: nonce } : {},
+			...crossOrigin ? { [documentAssetMarkerAttributes.headCrossOrigin]: crossOrigin } : {},
 			children
 		});
 	}
@@ -70,7 +78,12 @@ var NextScript = class extends React.Component {
 		return JSON.stringify(context.__NEXT_DATA__);
 	}
 	render() {
-		return /* @__PURE__ */ jsx("span", { dangerouslySetInnerHTML: { __html: "<!-- __NEXT_SCRIPTS__ -->" } });
+		const { nonce, crossOrigin } = this.props;
+		return /* @__PURE__ */ jsx("span", {
+			...nonce ? { [documentAssetMarkerAttributes.scriptNonce]: nonce } : {},
+			...crossOrigin ? { [documentAssetMarkerAttributes.scriptCrossOrigin]: crossOrigin } : {},
+			dangerouslySetInnerHTML: { __html: "<!-- __NEXT_SCRIPTS__ -->" }
+		});
 	}
 };
 var Document = class extends React.Component {

package/dist/shims/error.js

@@ -1,8 +1,8 @@
 import { AppRouterContext } from "./internal/app-router-context.js";
 import { RouterContext } from "./internal/router-context.js";
-import Head from "./head.js";
 import { isNextRouterError } from "./navigation-errors.js";
 import "./navigation.js";
+import Head from "./head.js";
 import { useUntrackedPathname } from "./internal/navigation-untracked.js";
 import React from "react";
 //#region src/shims/error.tsx

package/dist/shims/fetch-cache.js

@@ -2,9 +2,9 @@ import { getOrCreateAls } from "./internal/als-registry.js";
 import { getRequestContext, isInsideUnifiedScope, runWithUnifiedStateMutation } from "./unified-request-context.js";
 import { getRequestExecutionContext } from "./request-context.js";
 import { getDataCacheHandler } from "./cache-handler.js";
+import { encodeCacheTags } from "../utils/encode-cache-tag.js";
 import { markDynamicUsage } from "./headers.js";
 import { _hasPendingRevalidatedTag, _setRequestScopedCacheLife } from "./cache-request-state.js";
-import { encodeCacheTags } from "../utils/encode-cache-tag.js";
 //#region src/shims/fetch-cache.ts
 /**
 * Extended fetch() with Next.js caching semantics.

package/dist/shims/font-google-base.js

@@ -19,7 +19,16 @@ import { buildGoogleFontsUrl as buildGoogleFontsUrl$1 } from "../build/google-fo
 *   // inter.style -> { fontFamily: "'Inter', 'Inter Fallback'", fontStyle: "normal" }
 *   // inter.variable -> CSS class that sets the font CSS variable when requested
 */
-const injectedFonts = /* @__PURE__ */ new Set();
+const _INJECTED_FONTS_KEY = Symbol.for("vinext.font.injectedFonts");
+const _INJECTED_CLASS_RULES_KEY = Symbol.for("vinext.font.injectedClassRules");
+const _INJECTED_VARIABLE_RULES_KEY = Symbol.for("vinext.font.injectedVariableRules");
+const _INJECTED_SELF_HOSTED_KEY = Symbol.for("vinext.font.injectedSelfHosted");
+const _SSR_FONT_STYLES_KEY = Symbol.for("vinext.font.ssrFontStyles");
+const _SSR_FONT_URLS_KEY = Symbol.for("vinext.font.ssrFontUrls");
+const _SSR_FONT_PRELOADS_KEY = Symbol.for("vinext.font.ssrFontPreloads");
+const _SSR_FONT_PRELOAD_HREFS_KEY = Symbol.for("vinext.font.ssrFontPreloadHrefs");
+const _g = globalThis;
+const injectedFonts = _g[_INJECTED_FONTS_KEY] ??= /* @__PURE__ */ new Set();
 /**
 * Convert a font family name to a CSS variable name.
 * e.g., "Inter" -> "--font-inter", "Roboto Mono" -> "--font-roboto-mono"
@@ -128,7 +137,7 @@ function injectFontStylesheet(url) {
 	}
 }
 /** Track which className CSS rules have been injected. */
-const injectedClassRules = /* @__PURE__ */ new Set();
+const injectedClassRules = _g[_INJECTED_CLASS_RULES_KEY] ??= /* @__PURE__ */ new Set();
 /**
 * Inject a CSS rule that maps a className to the exported font style.
 *
@@ -152,7 +161,7 @@ function injectClassNameRule(className, fontStyle) {
 	document.head.appendChild(styleElement);
 }
 /** Track which variable class CSS rules have been injected. */
-const injectedVariableRules = /* @__PURE__ */ new Set();
+const injectedVariableRules = _g[_INJECTED_VARIABLE_RULES_KEY] ??= /* @__PURE__ */ new Set();
 /**
 * Inject a CSS rule that sets a CSS variable on an element.
 * This is what makes `<html className={inter.variable}>` set the CSS variable
@@ -177,7 +186,7 @@ function injectVariableClassRule(variableClassName, cssVarName, fontFamily) {
 	style.setAttribute("data-vinext-font-variable", variableClassName);
 	document.head.appendChild(style);
 }
-const ssrFontStyles = [];
+const ssrFontStyles = _g[_SSR_FONT_STYLES_KEY] ??= [];
 /**
 * Get collected SSR font class styles (used by the renderer).
 * Note: We don't clear the arrays because fonts are loaded at module import
@@ -186,7 +195,7 @@ const ssrFontStyles = [];
 function getSSRFontStyles() {
 	return [...ssrFontStyles];
 }
-const ssrFontUrls = [];
+const ssrFontUrls = _g[_SSR_FONT_URLS_KEY] ??= [];
 /**
 * Get collected SSR font URLs (used by the renderer).
 * Note: We don't clear the arrays because fonts are loaded at module import
@@ -195,8 +204,8 @@ const ssrFontUrls = [];
 function getSSRFontLinks() {
 	return [...ssrFontUrls];
 }
-const ssrFontPreloads = [];
-const ssrFontPreloadHrefs = /* @__PURE__ */ new Set();
+const ssrFontPreloads = _g[_SSR_FONT_PRELOADS_KEY] ??= [];
+const ssrFontPreloadHrefs = _g[_SSR_FONT_PRELOAD_HREFS_KEY] ??= /* @__PURE__ */ new Set();
 /**
 * Get collected SSR font preload data (used by the renderer).
 * Returns an array of { href, type } objects for emitting
@@ -220,7 +229,7 @@ function collectFontPreloads(urls) {
 	}
 }
 /** Track injected self-hosted @font-face blocks (deduplicate) */
-const injectedSelfHosted = /* @__PURE__ */ new Set();
+const injectedSelfHosted = _g[_INJECTED_SELF_HOSTED_KEY] ??= /* @__PURE__ */ new Set();
 /**
 * Inject self-hosted @font-face CSS (from the build plugin).
 * This replaces the CDN <link> tag with inline CSS.