vinext 1.0.0-beta.3 → 1.0.0-beta.4

package/dist/server/app-visited-response-cache.js

@@ -1,3 +1,6 @@
+import { AppElementsWire } from "./app-elements-wire.js";
+import "./app-elements.js";
+import { stripRscCacheBustingSearchParam } from "./app-rsc-cache-busting.js";
 import { resolveCachedRscResponseExpiresAt } from "../shims/navigation.js";
 //#region src/server/app-visited-response-cache.ts
 const VISITED_RESPONSE_CACHE_TTL = 5 * 6e4;
@@ -17,5 +20,50 @@ function isVisitedResponseCacheEntryFresh(entry, options) {
 	if (options.navigationKind === "traverse") return options.now - entry.createdAt < MAX_TRAVERSAL_CACHE_TTL;
 	return entry.expiresAt > options.now;
 }
+function normalizeVisitedResponseCacheLookupUrl(rscUrl) {
+	try {
+		const url = new URL(rscUrl, "http://vinext.local");
+		stripRscCacheBustingSearchParam(url);
+		return `${url.pathname}${url.search}`;
+	} catch {
+		return null;
+	}
+}
+function parseVisitedResponseCacheKey(cacheKey) {
+	const separatorIndex = cacheKey.indexOf("\0");
+	if (separatorIndex === -1) return {
+		interceptionContext: null,
+		rscUrl: cacheKey
+	};
+	return {
+		interceptionContext: cacheKey.slice(separatorIndex + 1),
+		rscUrl: cacheKey.slice(0, separatorIndex)
+	};
+}
+function findVisitedResponseCacheEntry(cache, rscUrl, interceptionContext) {
+	const exactCacheKey = AppElementsWire.encodeCacheKey(rscUrl, interceptionContext);
+	const exactEntry = cache.get(exactCacheKey);
+	if (exactEntry) return {
+		cacheKey: exactCacheKey,
+		entry: exactEntry
+	};
+	const normalizedTarget = normalizeVisitedResponseCacheLookupUrl(rscUrl);
+	if (normalizedTarget === null) return null;
+	for (const [cacheKey, entry] of cache) {
+		const source = parseVisitedResponseCacheKey(cacheKey);
+		if (source.interceptionContext !== interceptionContext) continue;
+		if (normalizeVisitedResponseCacheLookupUrl(source.rscUrl) !== normalizedTarget) continue;
+		return {
+			cacheKey,
+			entry
+		};
+	}
+	return null;
+}
+function deleteVisitedResponseCacheEntry(cache, rscUrl, interceptionContext) {
+	const match = findVisitedResponseCacheEntry(cache, rscUrl, interceptionContext);
+	if (!match) return false;
+	return cache.delete(match.cacheKey);
+}
 //#endregion
-export { MAX_TRAVERSAL_CACHE_TTL, VISITED_RESPONSE_CACHE_TTL, createVisitedResponseCacheEntry, isVisitedResponseCacheEntryFresh };
+export { MAX_TRAVERSAL_CACHE_TTL, VISITED_RESPONSE_CACHE_TTL, createVisitedResponseCacheEntry, deleteVisitedResponseCacheEntry, findVisitedResponseCacheEntry, isVisitedResponseCacheEntryFresh };

package/dist/server/dev-server.d.ts

@@ -55,7 +55,7 @@ clientTraceMetadata?: readonly string[], htmlLimitedBots?: string,
 
 reactStrictMode?: boolean, /** Next.js `expireTime`, used when formatting terminal GSP responses. */
 
-expireTime?: number): (req: IncomingMessage, res: ServerResponse, url: string, /** Status code override — propagated from middleware rewrite status. */
+expireTime?: number, crossOrigin?: string): (req: IncomingMessage, res: ServerResponse, url: string, /** Status code override — propagated from middleware rewrite status. */
 
 statusCode?: number,
 /**

package/dist/server/dev-server.js

@@ -1,6 +1,5 @@
 import { closeAfterResponse, createRequestContext, runWithRequestContext } from "../shims/unified-request-context.js";
-import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
-import { createValidFileMatcher, findFileWithExtensions, findFileWithExts } from "../routing/file-matcher.js";
+import { createValidFileMatcher, findFileWithExts } from "../routing/file-matcher.js";
 import { patternToNextFormat } from "../routing/route-validation.js";
 import { matchRoute } from "../routing/pages-router.js";
 import { PRERENDER_REVALIDATE_HEADER } from "../utils/protocol-headers.js";
@@ -16,6 +15,7 @@ import { mergeRouteParamsIntoQuery, parseQueryString } from "../utils/query.js";
 import "../shims/router-state.js";
 import { withScriptNonce } from "../shims/script-nonce-context.js";
 import { createInlineScriptTag, createNonceAttribute, escapeHtmlAttr, safeJsonStringify } from "./html.js";
+import { applyDocumentAssetProps, extractDocumentAssetProps, markDocumentAssetPropsProtectedTags, stripDocumentAssetPropsProtectionMarkers } from "./pages-document-asset-props.js";
 import { getClientTraceMetadataHTML } from "./client-trace-metadata.js";
 import { getScriptNonceFromNodeHeaderSources } from "./csp.js";
 import { logRequest, now } from "./request-log.js";
@@ -34,6 +34,7 @@ import { createPagesDevHydrationScript } from "./pages-dev-hydration.js";
 import { getManifestFilesForModule } from "./pages-asset-tags.js";
 import { PAGES_PREVIEW_CACHE_CONTROL, appendPagesPreviewClearCookies, getPagesPreviewState } from "./pages-preview.js";
 import { attachPagesRequestCookies } from "./pages-node-compat.js";
+import { randomUUID } from "node:crypto";
 import React from "react";
 import { renderToReadableStream } from "react-dom/server.edge";
 //#region src/server/dev-server.ts
@@ -227,7 +228,7 @@ const STREAM_BODY_MARKER = "<!--VINEXT_STREAM_BODY-->";
 * shell sooner).
 */
 async function streamPageToResponse(res, element, options) {
-	const { url, server, fontHeadHTML, assetHeadHTML = "", scripts, DocumentComponent, statusCode, extraHeaders, getHeadHTML, enhancePageElement, scriptNonce, documentContext, setDocumentInitialHead, bufferBodyBeforeHeaders = false } = options;
+	const { url, server, fontHeadHTML, assetHeadHTML = "", scripts, DocumentComponent, statusCode, extraHeaders, getHeadHTML, enhancePageElement, scriptNonce, documentContext, setDocumentInitialHead, crossOrigin, bufferBodyBeforeHeaders = false } = options;
 	const documentRenderPage = await runDocumentRenderPage({
 		DocumentComponent,
 		enhancePageElement,
@@ -250,26 +251,46 @@ async function streamPageToResponse(res, element, options) {
 	let headHTML = getHeadHTML();
 	if (documentRenderPage.status === "rendered" && documentRenderPage.stylesHTML) headHTML += `\n  ${documentRenderPage.stylesHTML}`;
 	let shellTemplate;
+	let documentAssetProps = {};
+	const protectedAssetMarker = `data-vinext-document-asset-props-protected-${randomUUID()}`;
+	const protectAssetTags = (html) => markDocumentAssetPropsProtectedTags(html, protectedAssetMarker);
+	const applyGeneratedAssetProps = (html, props, scriptOwner) => protectAssetTags(applyDocumentAssetProps(html, props, {
+		configuredCrossOrigin: crossOrigin,
+		scriptOwner
+	}));
 	if (DocumentComponent) {
 		const docProps = documentRenderPage.status === "skipped" ? await loadUserDocumentInitialProps(DocumentComponent) : documentRenderPage.docProps;
-		let docHtml = await renderToStringAsync(docProps ? React.createElement(DocumentComponent, docProps) : React.createElement(DocumentComponent));
+		const renderedDocument = extractDocumentAssetProps(await renderToStringAsync(docProps ? React.createElement(DocumentComponent, docProps) : React.createElement(DocumentComponent)));
+		documentAssetProps = renderedDocument.props;
+		let docHtml = protectAssetTags(renderedDocument.html);
+		const generatedScripts = applyGeneratedAssetProps(scripts, renderedDocument.props, "next-script");
+		const generatedAssetHeadHTML = applyGeneratedAssetProps(assetHeadHTML, renderedDocument.props, "next-script");
 		docHtml = docHtml.replace("__NEXT_MAIN__", STREAM_BODY_MARKER);
-		if (headHTML || fontHeadHTML || assetHeadHTML) docHtml = docHtml.replace("</head>", `  ${fontHeadHTML}${headHTML}\n  ${assetHeadHTML}\n</head>`);
-		docHtml = docHtml.replace("<!-- __NEXT_SCRIPTS__ -->", scripts);
-		if (!docHtml.includes("__NEXT_DATA__")) docHtml = docHtml.replace("</body>", `  ${scripts}\n</body>`);
+		if (headHTML || fontHeadHTML || generatedAssetHeadHTML) docHtml = docHtml.replace("</head>", `  ${protectAssetTags(fontHeadHTML)}${protectAssetTags(headHTML)}\n  ${generatedAssetHeadHTML}\n</head>`);
+		docHtml = docHtml.replace("<!-- __NEXT_SCRIPTS__ -->", generatedScripts);
+		if (!docHtml.includes("__NEXT_DATA__")) docHtml = docHtml.replace("</body>", `  ${generatedScripts}\n</body>`);
 		shellTemplate = docHtml;
-	} else shellTemplate = `<!DOCTYPE html>
+	} else {
+		const generatedScripts = applyGeneratedAssetProps(scripts, {}, "next-script");
+		const generatedAssetHeadHTML = applyGeneratedAssetProps(assetHeadHTML, {}, "next-script");
+		shellTemplate = `<!DOCTYPE html>
 <html>
 <head>
-  ${fontHeadHTML}${headHTML}
-  ${assetHeadHTML}
+  ${protectAssetTags(fontHeadHTML)}${protectAssetTags(headHTML)}
+  ${generatedAssetHeadHTML}
 </head>
 <body>
   <div id="__next">${STREAM_BODY_MARKER}</div>
-  ${scripts}
+  ${generatedScripts}
 </body>
 </html>`;
-	const transformedShell = await server.transformIndexHtml(url, shellTemplate);
+	}
+	let transformedShell = await server.transformIndexHtml(url, shellTemplate);
+	transformedShell = stripDocumentAssetPropsProtectionMarkers(applyDocumentAssetProps(transformedShell, documentAssetProps, {
+		configuredCrossOrigin: crossOrigin,
+		protectedAssetMarker,
+		scriptOwner: "next-script"
+	}), protectedAssetMarker);
 	const markerIdx = transformedShell.indexOf(STREAM_BODY_MARKER);
 	const prefix = transformedShell.slice(0, markerIdx);
 	const suffix = transformedShell.slice(markerIdx + 25);
@@ -330,7 +351,7 @@ function parseCookieLocale(req, i18nConfig) {
 * 4. Render the component to HTML
 * 5. Wrap in _document shell and send response
 */
-function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatcher, basePath = "", trailingSlash = false, hasMiddleware = false, hasRewrites = false, clientTraceMetadata, htmlLimitedBots, reactStrictMode = false, expireTime = PAGES_CACHE_ONE_YEAR_SECONDS) {
+function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatcher, basePath = "", trailingSlash = false, hasMiddleware = false, hasRewrites = false, clientTraceMetadata, htmlLimitedBots, reactStrictMode = false, expireTime = PAGES_CACHE_ONE_YEAR_SECONDS, crossOrigin) {
 	const matcher = fileMatcher ?? createValidFileMatcher();
 	const pagePatterns = routes.map((r) => patternToNextFormat(r.pattern));
 	const _alsRegistration = Promise.all([runner.import("vinext/head-state"), runner.import("vinext/router-state")]);
@@ -372,7 +393,8 @@ function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatc
 			basePath,
 			locale: locale ?? currentDefaultLocale,
 			locales: i18nConfig?.locales,
-			defaultLocale: currentDefaultLocale
+			defaultLocale: currentDefaultLocale,
+			crossOrigin
 		};
 		const match = matchRoute(localeStrippedUrl, routes);
 		if (!match) {
@@ -435,10 +457,8 @@ function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatc
 				};
 				const requestPreviewData = requestPreview.data;
 				let AppComponent = null;
-				const appPath = path.join(pagesDir, "_app");
-				if (findFileWithExtensions(appPath, matcher)) try {
-					AppComponent = (await importModule(runner, appPath)).default ?? null;
-				} catch {}
+				const appFilePath = findFileWithExts(pagesDir, "_app", matcher);
+				if (appFilePath) AppComponent = (await importModule(runner, appFilePath)).default ?? null;
 				const pagesNextData = {
 					...buildPagesReadinessNextData({
 						pageModule,
@@ -754,7 +774,8 @@ function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatc
 				if (typeof dynamicShim.flushPreloads === "function") await dynamicShim.flushPreloads();
 				const nonceAttr = createNonceAttribute(scriptNonce);
 				let fontHeadHTML = "";
-				const assetHeadHTML = await collectDevInitialStylesheetHeadHTML(server, runner, [AppComponent ? findFileWithExts(pagesDir, "_app", matcher) : null, route.filePath], nonceAttr);
+				const appAssetPath = AppComponent ? appFilePath : null;
+				const assetHeadHTML = await collectDevInitialStylesheetHeadHTML(server, runner, [appAssetPath, route.filePath], nonceAttr);
 				const allFontStyles = [];
 				const allFontPreloads = [];
 				try {
@@ -777,15 +798,15 @@ function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatc
 				for (const { href, type } of allFontPreloads) {
 					const safeHref = href.replace(/&/g, "&amp;").replace(/"/g, "&quot;");
 					const safeType = type.replace(/&/g, "&amp;").replace(/"/g, "&quot;");
-					fontHeadHTML += `<link rel="preload"${nonceAttr} href="${safeHref}" as="font" type="${safeType}" crossorigin />\n  `;
+					fontHeadHTML += `<link rel="preload"${nonceAttr} href="${safeHref}" as="font" type="${safeType}" crossorigin="anonymous" />\n  `;
 				}
 				if (allFontStyles.length > 0) fontHeadHTML += `<style data-vinext-fonts${nonceAttr}>${allFontStyles.join("\n")}</style>\n  `;
 				const viteRoot = server.config.root;
 				const viteBase = server.config.base;
 				const pageModuleUrl = createPagesDevModuleUrl(viteRoot, route.filePath, viteBase);
 				const pageModuleSource = createPagesDevModuleUrl(viteRoot, route.filePath, "/");
-				const appModuleUrl = AppComponent ? createPagesDevModuleUrl(viteRoot, path.join(pagesDir, "_app"), viteBase) : null;
-				const appModuleSource = AppComponent ? createPagesDevModuleUrl(viteRoot, path.join(pagesDir, "_app"), "/") : null;
+				const appModuleUrl = appAssetPath ? createPagesDevModuleUrl(viteRoot, appAssetPath, viteBase) : null;
+				const appModuleSource = appAssetPath ? createPagesDevModuleUrl(viteRoot, appAssetPath, "/") : null;
 				const serializedPagesNextData = {
 					...pagesNextData,
 					__vinext: {
@@ -815,11 +836,9 @@ function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatc
 					domainLocales,
 					...serializedPagesNextData
 				})}<\/script>`;
-				const docPath = path.join(pagesDir, "_document");
+				const docFilePath = findFileWithExts(pagesDir, "_document", matcher);
 				let DocumentComponent = null;
-				if (findFileWithExtensions(docPath, matcher)) try {
-					DocumentComponent = (await runner.import(docPath)).default ?? null;
-				} catch {}
+				if (docFilePath) DocumentComponent = (await runner.import(docFilePath)).default ?? null;
 				const allScripts = `${nextDataScript}\n  ${createInlineScriptTag(`window.__VINEXT_PAGE_PATTERNS__=${safeJsonStringify(pagePatterns)}`, scriptNonce)}\n  ${hydrationScript}`;
 				const extraHeaders = { ...gsspExtraHeaders };
 				if (typeof pageModule.getStaticProps === "function") {
@@ -868,6 +887,7 @@ function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatc
 						return traceHTML ? `${headHTML}\n  ${traceHTML}` : headHTML;
 					},
 					setDocumentInitialHead: typeof headShim.setDocumentInitialHead === "function" ? headShim.setDocumentInitialHead : void 0,
+					crossOrigin,
 					bufferBodyBeforeHeaders: true
 				});
 				_renderEnd = now();
@@ -917,11 +937,8 @@ async function renderErrorPage(server, runner, req, res, url, pagesDir, statusCo
 			const ErrorComponent = errorModule.default;
 			if (!ErrorComponent) continue;
 			let AppComponent = null;
-			const appPathErr = path.join(pagesDir, "_app");
 			const appAssetPath = findFileWithExts(pagesDir, "_app", matcher);
-			if (findFileWithExtensions(appPathErr, matcher)) try {
-				AppComponent = (await importModule(runner, appAssetPath ?? appPathErr)).default ?? null;
-			} catch {}
+			if (appAssetPath) AppComponent = (await importModule(runner, appAssetPath)).default ?? null;
 			const createElement = React.createElement;
 			res.statusCode = statusCode;
 			const errorPage = candidate === "_error" ? "/_error" : `/${candidate}`;
@@ -1008,10 +1025,8 @@ async function renderErrorPage(server, runner, req, res, url, pagesDir, statusCo
 				} : appRenderProps;
 			} else renderProps = { pageProps: errorProps };
 			let DocumentComponent = null;
-			const docPathErr = path.join(pagesDir, "_document");
-			if (findFileWithExtensions(docPathErr, matcher)) try {
-				DocumentComponent = (await importModule(runner, docPathErr)).default ?? null;
-			} catch {}
+			const docFilePathErr = findFileWithExts(pagesDir, "_document", matcher);
+			if (docFilePathErr) DocumentComponent = (await importModule(runner, docFilePathErr)).default ?? null;
 			const createErrorElement = (FinalApp, FinalComponent) => {
 				let errorElement = FinalApp ? createElement(FinalApp, {
 					...renderProps,
@@ -1069,9 +1084,14 @@ async function renderErrorPage(server, runner, req, res, url, pagesDir, statusCo
 					return createErrorElement(FinalApp, FinalComponent);
 				},
 				getHeadHTML: () => typeof headShim.getSSRHeadHTML === "function" ? headShim.getSSRHeadHTML() : "",
-				setDocumentInitialHead: typeof headShim.setDocumentInitialHead === "function" ? headShim.setDocumentInitialHead : void 0
+				setDocumentInitialHead: typeof headShim.setDocumentInitialHead === "function" ? headShim.setDocumentInitialHead : void 0,
+				crossOrigin: context.crossOrigin
 			});
 			else {
+				const bodyHtml = await renderToStringAsync(element);
+				const protectedAssetMarker = `data-vinext-document-asset-props-protected-${randomUUID()}`;
+				const protectAssetTags = (assetHtml) => markDocumentAssetPropsProtectedTags(assetHtml, protectedAssetMarker);
+				const protectedErrorScripts = protectAssetTags(applyDocumentAssetProps(errorScripts, {}, { configuredCrossOrigin: context.crossOrigin }));
 				const html = `<!DOCTYPE html>
 <html>
 <head>
@@ -1080,11 +1100,14 @@ async function renderErrorPage(server, runner, req, res, url, pagesDir, statusCo
   ${assetHeadHTML}
 </head>
 <body>
-  <div id="__next">${await renderToStringAsync(element)}</div>
-  ${errorScripts}
+  <div id="__next">${protectAssetTags(bodyHtml)}</div>
+  ${protectedErrorScripts}
 </body>
 </html>`;
-				const transformedHtml = await server.transformIndexHtml(url, html);
+				const transformedHtml = stripDocumentAssetPropsProtectionMarkers(applyDocumentAssetProps(await server.transformIndexHtml(url, html), {}, {
+					configuredCrossOrigin: context.crossOrigin,
+					protectedAssetMarker
+				}), protectedAssetMarker);
 				res.writeHead(statusCode, { "Content-Type": "text/html; charset=utf-8" });
 				res.end(transformedHtml);
 			}

package/dist/server/edge-api-runtime.d.ts

@@ -1,4 +1,13 @@
 //#region src/server/edge-api-runtime.d.ts
 declare function isEdgeApiRuntime(runtime: string | undefined): boolean;
+type EdgeApiExecutionRuntime = "node" | "worker";
+/**
+ * Remove wire-level body headers after Node's fetch implementation has decoded
+ * an Edge API response. Next.js applies the same boundary in its edge sandbox.
+ *
+ * Workers keep the original response untouched: workerd preserves the encoded
+ * body/header pair and can stream it directly to the client.
+ */
+declare function finalizeEdgeApiResponse(response: Response, runtime: EdgeApiExecutionRuntime): Response;
 //#endregion
-export { isEdgeApiRuntime };
+export { EdgeApiExecutionRuntime, finalizeEdgeApiResponse, isEdgeApiRuntime };

package/dist/server/edge-api-runtime.js

@@ -2,5 +2,33 @@
 function isEdgeApiRuntime(runtime) {
 	return runtime === "edge" || runtime === "experimental-edge";
 }
+const NODE_EDGE_RESPONSE_FORBIDDEN_HEADERS = [
+	"content-length",
+	"content-encoding",
+	"transfer-encoding"
+];
+/**
+* Remove wire-level body headers after Node's fetch implementation has decoded
+* an Edge API response. Next.js applies the same boundary in its edge sandbox.
+*
+* Workers keep the original response untouched: workerd preserves the encoded
+* body/header pair and can stream it directly to the client.
+*/
+function finalizeEdgeApiResponse(response, runtime) {
+	if (runtime === "worker") return response;
+	const headers = new Headers(response.headers);
+	let changed = false;
+	for (const name of NODE_EDGE_RESPONSE_FORBIDDEN_HEADERS) {
+		if (!headers.has(name)) continue;
+		headers.delete(name);
+		changed = true;
+	}
+	if (!changed) return response;
+	return new Response(response.body, {
+		headers,
+		status: response.status,
+		statusText: response.statusText
+	});
+}
 //#endregion
-export { isEdgeApiRuntime };
+export { finalizeEdgeApiResponse, isEdgeApiRuntime };

package/dist/server/headers.d.ts

@@ -15,6 +15,8 @@ import { MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP
 declare const VINEXT_CACHE_HEADER = "X-Vinext-Cache";
 /** Next.js public ISR / page cache state indicator. */
 declare const NEXTJS_CACHE_HEADER = "x-nextjs-cache";
+/** Next.js cache-tag metadata carried by prerendered App Router responses. */
+declare const NEXT_CACHE_TAGS_HEADER = "x-next-cache-tags";
 /** Static file signal — value is URL-encoded pathname. */
 declare const VINEXT_STATIC_FILE_HEADER = "x-vinext-static-file";
 /** Timing metrics: `handlerStart,compileMs,renderMs`. */
@@ -107,4 +109,4 @@ declare const INTERNAL_HEADERS: string[];
 /** Vinext-only internal headers stripped alongside Next.js protocol internals. */
 declare const VINEXT_INTERNAL_HEADERS: string[];
 //#endregion
-export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_REVALIDATE_HOST_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };
+export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_CACHE_TAGS_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_REVALIDATE_HOST_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };

package/dist/server/headers.js

@@ -14,6 +14,8 @@ import { MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_OVERRIDE_HEADERS, MIDDLEWARE_SET_C
 const VINEXT_CACHE_HEADER = "X-Vinext-Cache";
 /** Next.js public ISR / page cache state indicator. */
 const NEXTJS_CACHE_HEADER = "x-nextjs-cache";
+/** Next.js cache-tag metadata carried by prerendered App Router responses. */
+const NEXT_CACHE_TAGS_HEADER = "x-next-cache-tags";
 /** Static file signal — value is URL-encoded pathname. */
 const VINEXT_STATIC_FILE_HEADER = "x-vinext-static-file";
 /** Timing metrics: `handlerStart,compileMs,renderMs`. */
@@ -131,4 +133,4 @@ const VINEXT_INTERNAL_HEADERS = [
 	VINEXT_REVALIDATE_HOST_HEADER
 ];
 //#endregion
-export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_REVALIDATE_HOST_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };
+export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_CACHE_TAGS_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_REVALIDATE_HOST_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };

package/dist/server/pages-api-route.d.ts

@@ -1,6 +1,7 @@
 import { NextI18nConfig } from "../config/next-config.js";
 import { Route } from "../routing/pages-router.js";
 import { ExecutionContextLike } from "../shims/request-context.js";
+import { EdgeApiExecutionRuntime } from "./edge-api-runtime.js";
 import { PagesReqResRequest, PagesReqResResponse, PagesRequestQuery } from "./pages-node-compat.js";
 
 //#region src/server/pages-api-route.d.ts
@@ -68,6 +69,7 @@ type HandlePagesApiRouteOptions = {
    * response. Omit on Node.js dev where no Workers lifecycle exists.
    */
   ctx?: ExecutionContextLike;
+  edgeRuntime?: EdgeApiExecutionRuntime;
   match: PagesApiRouteMatch | null;
   reportRequestError?: (error: Error, routePattern: string) => void | Promise<void>;
   request: Request;

package/dist/server/pages-api-route.js

@@ -7,7 +7,7 @@ import { mergeRouteParamsIntoQuery, parseQueryString, urlQueryToSearchParams } f
 import { resolveBodyParserConfig } from "./pages-body-parser-config.js";
 import { PagesBodyParseError } from "./pages-media-type.js";
 import { createPagesReqRes, parsePagesApiBody } from "./pages-node-compat.js";
-import { isEdgeApiRuntime } from "./edge-api-runtime.js";
+import { finalizeEdgeApiResponse, isEdgeApiRuntime } from "./edge-api-runtime.js";
 //#region src/server/pages-api-route.ts
 function resolveModuleRuntime(module) {
 	return module.runtime ?? module.config?.runtime;
@@ -42,7 +42,7 @@ async function _handlePagesApiRoute(options) {
 				trailingSlash: options.nextConfig.trailingSlash
 			} } : void 0);
 			const response = await route.module.default(nextRequest);
-			if (response instanceof Response) return response;
+			if (response instanceof Response) return finalizeEdgeApiResponse(response, options.edgeRuntime ?? "worker");
 			throw new Error("Edge API route did not return a Response");
 		}
 		if (!isNodeApiRouteModule(route.module)) return new Response("API route does not export a default function", { status: 500 });

package/dist/server/pages-asset-tags.d.ts

@@ -57,6 +57,7 @@ type CollectAssetTagsOptions = {
   basePath?: string;
   assetPrefix?: string;
   deploymentId?: string;
+  crossOrigin?: string;
 };
 /**
  * Build the HTML `<link>` and `<script>` tag string for the SSR response.

package/dist/server/pages-asset-tags.js

@@ -70,6 +70,8 @@ function collectAssetTags(options) {
 	const seen = /* @__PURE__ */ new Set();
 	const nonceAttr = createNonceAttribute(options.scriptNonce);
 	const deferAttr = options.disableOptimizedLoading ? "" : " defer";
+	const scriptCrossOriginAttr = options.crossOrigin ? ` crossorigin="${options.crossOrigin}"` : " crossorigin";
+	const preloadCrossOriginAttr = options.crossOrigin ? ` crossorigin="${options.crossOrigin}"` : "";
 	const basePath = options.basePath ?? "";
 	const assetPrefix = options.assetPrefix ?? "";
 	const href = (value) => {
@@ -82,8 +84,8 @@ function collectAssetTags(options) {
 	const clientEntry = runtimeAssets.clientEntry;
 	if (clientEntry) {
 		seen.add(clientEntry);
-		tags.push("<link rel=\"modulepreload\"" + nonceAttr + " href=\"" + href(clientEntry) + "\" />");
-		tags.push("<script type=\"module\"" + deferAttr + nonceAttr + " src=\"" + href(clientEntry) + "\" crossorigin><\/script>");
+		tags.push("<link rel=\"modulepreload\"" + nonceAttr + " href=\"" + href(clientEntry) + "\"" + preloadCrossOriginAttr + " />");
+		tags.push("<script type=\"module\"" + deferAttr + nonceAttr + " src=\"" + href(clientEntry) + "\"" + scriptCrossOriginAttr + "><\/script>");
 	}
 	if (m) {
 		const allFiles = [];
@@ -115,8 +117,8 @@ function collectAssetTags(options) {
 			if (tf.endsWith(".css")) tags.push("<link rel=\"stylesheet\"" + nonceAttr + " href=\"" + href(tf) + "\" />");
 			else if (tf.endsWith(".js")) {
 				if (lazySet && lazySet.has(tf)) continue;
-				tags.push("<link rel=\"modulepreload\"" + nonceAttr + " href=\"" + href(tf) + "\" />");
-				tags.push("<script type=\"module\"" + deferAttr + nonceAttr + " src=\"" + href(tf) + "\" crossorigin><\/script>");
+				tags.push("<link rel=\"modulepreload\"" + nonceAttr + " href=\"" + href(tf) + "\"" + preloadCrossOriginAttr + " />");
+				tags.push("<script type=\"module\"" + deferAttr + nonceAttr + " src=\"" + href(tf) + "\"" + scriptCrossOriginAttr + "><\/script>");
 			}
 		}
 	}

package/dist/server/pages-document-asset-props.d.ts

@@ -0,0 +1,26 @@
+//#region src/server/pages-document-asset-props.d.ts
+type DocumentAssetProps = {
+  headNonce?: string;
+  headCrossOrigin?: string;
+  scriptNonce?: string;
+  scriptCrossOrigin?: string;
+};
+type ApplyDocumentAssetPropsOptions = {
+  configuredCrossOrigin?: string;
+  protectedAssetMarker?: string;
+  scriptOwner?: "head" | "next-script";
+};
+declare function extractDocumentAssetProps(html: string): {
+  html: string;
+  props: DocumentAssetProps;
+};
+/**
+ * Protect asset tags whose attributes already have a more specific owner while
+ * Vite runs its HTML transforms. Tags injected by Vite after this marker pass
+ * remain unmarked, so Document/config props can still be applied to them.
+ */
+declare function markDocumentAssetPropsProtectedTags(html: string, markerAttribute: string): string;
+declare function stripDocumentAssetPropsProtectionMarkers(html: string, markerAttribute: string): string;
+declare function applyDocumentAssetProps(html: string, props: DocumentAssetProps, options?: ApplyDocumentAssetPropsOptions): string;
+//#endregion
+export { DocumentAssetProps, applyDocumentAssetProps, extractDocumentAssetProps, markDocumentAssetPropsProtectedTags, stripDocumentAssetPropsProtectionMarkers };

package/dist/server/pages-document-asset-props.js

@@ -0,0 +1,69 @@
+import { escapeHtmlAttr } from "./html.js";
+//#region src/server/pages-document-asset-props.ts
+const HEAD_NONCE_ATTR = "data-vinext-head-nonce";
+const HEAD_CROSS_ORIGIN_ATTR = "data-vinext-head-cross-origin";
+const SCRIPT_NONCE_ATTR = "data-vinext-script-nonce";
+const SCRIPT_CROSS_ORIGIN_ATTR = "data-vinext-script-cross-origin";
+function readAttribute(tag, name) {
+	if (!tag) return void 0;
+	return tag.match(new RegExp(`\\s${name}="([^"]*)"`))?.[1];
+}
+function removeAttributes(tag, names) {
+	return tag.replace(new RegExp(`\\s(?:${names.join("|")})="[^"]*"`, "g"), "");
+}
+function extractDocumentAssetProps(html) {
+	const headTag = html.match(/<head\b[^>]*>/i)?.[0];
+	const nextScriptTag = html.match(/<span\b[^>]*>(?=<!-- __NEXT_SCRIPTS__ -->)/i)?.[0];
+	const props = {
+		headNonce: readAttribute(headTag, HEAD_NONCE_ATTR),
+		headCrossOrigin: readAttribute(headTag, HEAD_CROSS_ORIGIN_ATTR),
+		scriptNonce: readAttribute(nextScriptTag, SCRIPT_NONCE_ATTR),
+		scriptCrossOrigin: readAttribute(nextScriptTag, SCRIPT_CROSS_ORIGIN_ATTR)
+	};
+	return {
+		html: html.replace(/<head\b[^>]*>/i, (tag) => removeAttributes(tag, [HEAD_NONCE_ATTR, HEAD_CROSS_ORIGIN_ATTR])).replace(/<span\b[^>]*>(?=<!-- __NEXT_SCRIPTS__ -->)/i, (tag) => removeAttributes(tag, [SCRIPT_NONCE_ATTR, SCRIPT_CROSS_ORIGIN_ATTR])),
+		props
+	};
+}
+function addAttribute(tag, name, value, replaceExisting = false) {
+	if (value === void 0) return tag;
+	const attributePattern = new RegExp(`\\s${name}(?:="[^"]*")?`, "i");
+	if (attributePattern.test(tag)) return replaceExisting ? tag.replace(attributePattern, ` ${name}="${escapeHtmlAttr(value)}"`) : tag;
+	if (!tag.endsWith(">")) return tag;
+	const selfClosing = tag.endsWith("/>");
+	const closingStart = selfClosing ? tag.length - 2 : tag.length - 1;
+	const opening = tag.slice(0, closingStart).trimEnd();
+	const closing = selfClosing ? " />" : ">";
+	return `${opening} ${name}="${escapeHtmlAttr(value)}"${closing}`;
+}
+function hasAttribute(tag, name) {
+	return name !== void 0 && new RegExp(`\\s${name}(?:="[^"]*")?`, "i").test(tag);
+}
+/**
+* Protect asset tags whose attributes already have a more specific owner while
+* Vite runs its HTML transforms. Tags injected by Vite after this marker pass
+* remain unmarked, so Document/config props can still be applied to them.
+*/
+function markDocumentAssetPropsProtectedTags(html, markerAttribute) {
+	return html.replace(/<script\b[^>]*>/gi, (tag) => addAttribute(tag, markerAttribute, "")).replace(/<link\b[^>]*\brel="(?:preload|modulepreload)"[^>]*>/gi, (tag) => addAttribute(tag, markerAttribute, ""));
+}
+function stripDocumentAssetPropsProtectionMarkers(html, markerAttribute) {
+	const stripMarker = (tag) => removeAttributes(tag, [markerAttribute]);
+	return html.replace(/<script\b[^>]*>/gi, stripMarker).replace(/<link\b[^>]*\brel="(?:preload|modulepreload)"[^>]*>/gi, stripMarker);
+}
+function applyDocumentAssetProps(html, props, options = {}) {
+	const scriptOwner = options.scriptOwner ?? "next-script";
+	const scriptNonce = scriptOwner === "head" ? props.headNonce : props.scriptNonce;
+	const preloadNonce = props.headNonce;
+	const scriptCrossOrigin = (scriptOwner === "head" ? props.headCrossOrigin : props.scriptCrossOrigin) ?? options.configuredCrossOrigin;
+	const preloadCrossOrigin = props.headCrossOrigin ?? options.configuredCrossOrigin;
+	return html.replace(/<script\b[^>]*>/gi, (tag) => {
+		if (hasAttribute(tag, options.protectedAssetMarker)) return tag;
+		return addAttribute(addAttribute(tag, "nonce", scriptNonce, true), "crossorigin", scriptCrossOrigin, true);
+	}).replace(/<link\b[^>]*\brel="(?:preload|modulepreload)"[^>]*>/gi, (tag) => {
+		if (hasAttribute(tag, options.protectedAssetMarker)) return tag;
+		return addAttribute(addAttribute(tag, "nonce", preloadNonce, true), "crossorigin", preloadCrossOrigin, true);
+	});
+}
+//#endregion
+export { applyDocumentAssetProps, extractDocumentAssetProps, markDocumentAssetPropsProtectedTags, stripDocumentAssetPropsProtectionMarkers };

package/dist/server/pages-node-compat.js

@@ -155,7 +155,7 @@ var PagesResponseStream = class extends Writable {
 	}
 	writeHead(code, headers) {
 		this.resStatusCode = code;
-		if (headers) for (const [key, value] of Object.entries(headers)) this.setHeaderValue(key, value, { replaceSetCookie: false });
+		if (headers) for (const [key, value] of Object.entries(headers)) this.setHeaderValue(key, value, { replaceSetCookie: true });
 		return this;
 	}
 	setHeader(name, value) {
@@ -251,9 +251,9 @@ var PagesResponseStream = class extends Writable {
 	}
 	setHeaderValue(name, value, options) {
 		if (name.toLowerCase() === "set-cookie") {
+			const values = Array.isArray(value) ? value.map(String) : [String(value)];
 			if (options.replaceSetCookie) this.setCookieHeaders.length = 0;
-			if (Array.isArray(value)) this.setCookieHeaders.push(...value.map(String));
-			else this.setCookieHeaders.push(String(value));
+			this.setCookieHeaders.push(...values);
 			return;
 		}
 		this.resHeaders[name.toLowerCase()] = Array.isArray(value) ? value.join(", ") : value;

package/dist/server/pages-page-handler.d.ts

@@ -35,6 +35,7 @@ type VinextConfigSubset = {
   htmlLimitedBots?: string;
   clientTraceMetadata?: readonly string[];
   disableOptimizedLoading: boolean;
+  crossOrigin?: string;
 };
 declare function shouldEmitPagesClientTraceMetadata(pageModule: PagesPageModule, appComponent: unknown): boolean;
 /**

package/dist/server/pages-page-handler.js

@@ -452,7 +452,8 @@ function createPagesPageHandler(opts) {
 						disableOptimizedLoading: vinextConfig.disableOptimizedLoading,
 						basePath: vinextConfig.basePath,
 						assetPrefix: vinextConfig.assetPrefix,
-						deploymentId: process.env.__VINEXT_DEPLOYMENT_ID || process.env.NEXT_DEPLOYMENT_ID
+						deploymentId: process.env.__VINEXT_DEPLOYMENT_ID || process.env.NEXT_DEPLOYMENT_ID,
+						crossOrigin: vinextConfig.crossOrigin
 					}),
 					buildId,
 					clearSsrContext() {
@@ -500,6 +501,8 @@ function createPagesPageHandler(opts) {
 					routeUrl: renderRouteUrl,
 					safeJsonStringify,
 					scriptNonce,
+					crossOrigin: vinextConfig.crossOrigin,
+					disableOptimizedLoading: vinextConfig.disableOptimizedLoading,
 					statusCode: renderStatusCode,
 					nextData: serializedPagesNextData,
 					userAgent: request.headers.get("user-agent") ?? void 0,

package/dist/server/pages-page-response.d.ts

@@ -114,6 +114,8 @@ type RenderPagesPageResponseOptions = {
   routeUrl: string;
   safeJsonStringify: (value: unknown) => string;
   scriptNonce?: string;
+  crossOrigin?: string;
+  disableOptimizedLoading: boolean;
   statusCode?: number;
   vinext?: VinextNextData["__vinext"];
   nextData?: PagesNextDataExtras;