vinext 1.0.0-beta.3 → 1.0.0-beta.5

package/dist/config/config-matchers.js

@@ -1,7 +1,7 @@
+import { normalizeHost, parseCookies, requestContextFromRequest } from "./request-context.js";
 import { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
-import { buildRequestHeadersFromMiddlewareResponse } from "../utils/middleware-request-headers.js";
+import { buildRequestHeadersFromMiddlewareResponse, getUnconsumedMiddlewareRequestHeaders } from "../utils/middleware-request-headers.js";
 import { analyzeRegexSafety } from "../utils/regex-safety.js";
-import { normalizeHost, parseCookies, requestContextFromRequest } from "./request-context.js";
 import { isExternalUrl } from "../utils/external-url.js";
 //#region src/config/config-matchers.ts
 /**
@@ -301,9 +301,10 @@ function shouldEvaluateRule(ruleBasePath, state) {
 * individual header values), so the wider `string | string[]` type of
 * `middlewareHeaders` is safe to cast here.
 */
-function applyMiddlewareRequestHeaders(middlewareHeaders, request, options = {}) {
-	const nextHeaders = buildRequestHeadersFromMiddlewareResponse(request.headers, middlewareHeaders, options);
-	for (const key of Object.keys(middlewareHeaders)) if (key.startsWith("x-middleware-") && key !== "x-middleware-cache") delete middlewareHeaders[key];
+function applyMiddlewareRequestHeaders(middlewareHeaders, request) {
+	const nextHeaders = buildRequestHeadersFromMiddlewareResponse(request.headers, middlewareHeaders);
+	const unconsumedRequestHeaders = getUnconsumedMiddlewareRequestHeaders(middlewareHeaders);
+	for (const key of Object.keys(middlewareHeaders)) if (key.startsWith("x-middleware-") && key !== "x-middleware-cache" && !unconsumedRequestHeaders.has(key)) delete middlewareHeaders[key];
 	if (nextHeaders) request = new Request(request.url, {
 		method: request.method,
 		headers: nextHeaders,
@@ -831,7 +832,7 @@ async function proxyExternalRequest(request, externalUrl) {
 	headers.set("host", targetUrl.host);
 	stripHopByHopRequestHeaders(headers);
 	const keysToDelete = [];
-	for (const key of headers.keys()) if (key.startsWith("x-middleware-")) keysToDelete.push(key);
+	for (const key of headers.keys()) if (key.startsWith("x-middleware-") && !key.startsWith("x-middleware-request-")) keysToDelete.push(key);
 	for (const key of keysToDelete) headers.delete(key);
 	headers.delete(VINEXT_PRERENDER_SECRET_HEADER);
 	headers.delete(VINEXT_PRERENDER_ROUTE_PARAMS_HEADER);

package/dist/config/dotenv.d.ts

@@ -1,5 +1,4 @@
 //#region src/config/dotenv.d.ts
-type VinextEnvMode = "development" | "production" | "test";
 /**
  * Environment-variable bag accepted by {@link loadDotenv}.
  *
@@ -12,18 +11,18 @@ type VinextEnvMode = "development" | "production" | "test";
 type EnvBag = Record<string, string | undefined>;
 type LoadDotenvOptions = {
   root: string;
-  mode: VinextEnvMode;
+  mode: string;
   processEnv?: EnvBag;
 };
 type LoadDotenvResult = {
-  mode: VinextEnvMode;
+  mode: string;
   loadedFiles: string[];
   loadedEnv: Record<string, string>;
 };
 /**
  * Next.js-compatible dotenv lookup order (highest priority first).
  */
-declare function getDotenvFiles(mode: VinextEnvMode): string[];
+declare function getDotenvFiles(mode: string): string[];
 /**
  * Load .env files into processEnv with Next.js-like precedence:
  * process.env > .env.<mode>.local > .env.local > .env.<mode> > .env.
@@ -47,10 +46,6 @@ declare function getDotenvFiles(mode: VinextEnvMode): string[];
  * pass is effectively a no-op for overlapping keys. For `start` and `deploy`
  * commands (which don't go through Vite at all), this is the only loading.
  */
-declare function loadDotenv({
-  root,
-  mode,
-  processEnv
-}: LoadDotenvOptions): LoadDotenvResult;
+declare function loadDotenv({ root, mode, processEnv }: LoadDotenvOptions): LoadDotenvResult;
 //#endregion
 export { getDotenvFiles, loadDotenv };

package/dist/config/dotenv.js

@@ -56,33 +56,41 @@ function loadDotenv({ root, mode, processEnv = process.env }) {
 		loadedEnv
 	};
 }
-const ENV_REF_RE = /(\\)?\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;
 function expandEnv(parsed, processEnv) {
-	const expanded = {};
-	const resolving = /* @__PURE__ */ new Set();
-	const context = {
+	const expanded = { ...parsed };
+	for (const key of Object.keys(expanded)) {
+		const processValue = processEnv[key];
+		expanded[key] = (processValue && processValue !== expanded[key] ? processValue : expandValue(expanded[key], processEnv, expanded)).replace(/\\\$/g, "$");
+	}
+	return expanded;
+}
+function expandValue(value, processEnv, parsed) {
+	const env = {
 		...parsed,
 		...processEnv
 	};
-	function resolveValue(key) {
-		const cached = expanded[key];
-		if (cached !== void 0) return cached;
-		if (resolving.has(key)) return context[key] ?? "";
-		const raw = context[key];
-		if (raw === void 0) return "";
-		resolving.add(key);
-		let value = raw.replace(ENV_REF_RE, (match, escaped, braced, bare) => {
-			if (escaped) return match.slice(1);
-			return resolveValue(braced || bare);
-		});
-		value = value.replace(/\\\$/g, "$");
-		resolving.delete(key);
-		expanded[key] = value;
-		context[key] = value;
-		return value;
+	const envRefRe = /(?<!\\)\${([^{}]+)}|(?<!\\)\$([A-Za-z_][A-Za-z0-9_]*)/g;
+	const seen = /* @__PURE__ */ new Set();
+	let result = value;
+	let match;
+	while ((match = envRefRe.exec(result)) !== null) {
+		seen.add(result);
+		const [template, braced, bare] = match;
+		const expression = braced || bare;
+		const operator = expression.match(/(:\+|\+|:-|-)/)?.[0];
+		const parts = operator ? expression.split(operator) : [expression];
+		const refKey = parts.shift();
+		const operand = parts.join(operator ?? "");
+		const refValue = env[refKey];
+		let replacement;
+		if (operator === ":+" || operator === "+") replacement = refValue ? operand : "";
+		else if (refValue) replacement = seen.has(refValue) ? operand : refValue;
+		else replacement = operand;
+		result = result.replace(template, replacement);
+		if (result === parsed[refKey]) break;
+		envRefRe.lastIndex = 0;
 	}
-	for (const key of Object.keys(parsed)) resolveValue(key);
-	return expanded;
+	return result;
 }
 //#endregion
 export { getDotenvFiles, loadDotenv };

package/dist/config/next-config.d.ts

@@ -1,6 +1,5 @@
 import { PHASE_PRODUCTION_BUILD } from "../shims/constants.js";
 import { PluginOption } from "vite";
-
 //#region src/config/next-config.d.ts
 declare const VINEXT_NEXT_CONFIG_PLUGIN_PROPERTY = "__vinextNextConfig";
 /**
@@ -42,8 +41,10 @@ type NextRewrite = {
   source: string;
   destination: string;
   has?: HasCondition[];
-  missing?: HasCondition[]; /** See {@link NextRedirect.locale}. */
-  locale?: false; /** See {@link NextRedirect.basePath}. */
+  missing?: HasCondition[];
+  /** See {@link NextRedirect.locale}. */
+  locale?: false;
+  /** See {@link NextRedirect.basePath}. */
   basePath?: false;
 };
 type NextHeader = {
@@ -53,12 +54,16 @@ type NextHeader = {
   headers: Array<{
     key: string;
     value: string;
-  }>; /** See {@link NextRedirect.basePath}. */
-  basePath?: false; /** See {@link NextRedirect.locale}. */
+  }>;
+  /** See {@link NextRedirect.basePath}. */
+  basePath?: false;
+  /** See {@link NextRedirect.locale}. */
   locale?: false;
 };
 type NextI18nConfig = {
-  /** List of supported locales */locales: string[]; /** The default locale (used when no locale prefix is in the URL) */
+  /** List of supported locales */
+  locales: string[];
+  /** The default locale (used when no locale prefix is in the URL) */
   defaultLocale: string;
   /**
    * Whether to auto-detect locale from Accept-Language header.
@@ -90,7 +95,9 @@ type PrefetchInliningConfig = false | {
   maxSize: number;
 };
 type NextConfig = {
-  /** Additional env variables */env?: Record<string, string>; /** Base URL path prefix */
+  /** Additional env variables */
+  env?: Record<string, string>;
+  /** Base URL path prefix */
   basePath?: string;
   /**
    * Prefix applied to every emitted JS/CSS/image/static asset URL.
@@ -99,14 +106,26 @@ type NextConfig = {
    * `basePath` affects route URLs; `assetPrefix` only affects asset URLs.
    * @see https://nextjs.org/docs/app/api-reference/config/next-config-js/assetPrefix
    */
-  assetPrefix?: string; /** Whether to add trailing slashes */
-  trailingSlash?: boolean; /** TypeScript build settings. */
+  assetPrefix?: string;
+  /** Cross-origin mode applied to framework scripts and preload links. */
+  crossOrigin?: "anonymous" | "use-credentials";
+  /** Whether to add trailing slashes */
+  trailingSlash?: boolean;
+  /** Keep the original request URL visible to middleware/proxy. */
+  skipProxyUrlNormalize?: boolean;
+  /** @deprecated Use `skipProxyUrlNormalize` instead. */
+  skipMiddlewareUrlNormalize?: boolean;
+  /** TypeScript build settings. */
   typescript?: {
-    /** Project-relative path to the TypeScript configuration file. */tsconfigPath?: string;
+    /** Project-relative path to the TypeScript configuration file. */
+    tsconfigPath?: string;
     [key: string]: unknown;
-  }; /** Internationalization routing config */
-  i18n?: NextI18nConfig; /** URL redirect rules */
-  redirects?: () => Promise<NextRedirect[]> | NextRedirect[]; /** URL rewrite rules */
+  };
+  /** Internationalization routing config */
+  i18n?: NextI18nConfig;
+  /** URL redirect rules */
+  redirects?: () => Promise<NextRedirect[]> | NextRedirect[];
+  /** URL rewrite rules */
   rewrites?: () => Promise<NextRewrite[] | {
     beforeFiles: NextRewrite[];
     afterFiles: NextRewrite[];
@@ -115,8 +134,10 @@ type NextConfig = {
     beforeFiles: NextRewrite[];
     afterFiles: NextRewrite[];
     fallback: NextRewrite[];
-  }; /** Custom response headers */
-  headers?: () => Promise<NextHeader[]> | NextHeader[]; /** Image optimization config */
+  };
+  /** Custom response headers */
+  headers?: () => Promise<NextHeader[]> | NextHeader[];
+  /** Image optimization config */
   images?: {
     remotePatterns?: Array<URL | {
       protocol?: string;
@@ -126,13 +147,20 @@ type NextConfig = {
       search?: string;
     }>;
     domains?: string[];
-    unoptimized?: boolean; /** Allowed device widths for image optimization. Defaults to Next.js defaults: [640, 750, 828, 1080, 1200, 1920, 2048, 3840] */
-    deviceSizes?: number[]; /** Allowed image sizes for fixed-width images. Defaults to Next.js defaults: [16, 32, 48, 64, 96, 128, 256, 384] */
-    imageSizes?: number[]; /** Allowed image qualities. When unset, any quality from 1-100 is permitted (matches Next.js). */
-    qualities?: number[]; /** Allow SVG images through the image optimization endpoint. SVG can contain scripts, so only enable if you trust all image sources. */
-    dangerouslyAllowSVG?: boolean; /** Allow image optimization for hostnames that resolve to private IP addresses. This is a security risk (SSRF) — only enable for private networks when you understand the risk. */
-    dangerouslyAllowLocalIP?: boolean; /** Content-Disposition header for image responses. Defaults to "inline". */
-    contentDispositionType?: "inline" | "attachment"; /** Content-Security-Policy header for image responses. Defaults to "script-src 'none'; frame-src 'none'; sandbox;" */
+    unoptimized?: boolean;
+    /** Allowed device widths for image optimization. Defaults to Next.js defaults: [640, 750, 828, 1080, 1200, 1920, 2048, 3840] */
+    deviceSizes?: number[];
+    /** Allowed image sizes for fixed-width images. Defaults to Next.js defaults: [32, 48, 64, 96, 128, 256, 384] */
+    imageSizes?: number[];
+    /** Allowed image qualities. When unset, any quality from 1-100 is permitted (matches Next.js). */
+    qualities?: number[];
+    /** Allow SVG images through the image optimization endpoint. SVG can contain scripts, so only enable if you trust all image sources. */
+    dangerouslyAllowSVG?: boolean;
+    /** Allow image optimization for hostnames that resolve to private IP addresses. This is a security risk (SSRF) — only enable for private networks when you understand the risk. */
+    dangerouslyAllowLocalIP?: boolean;
+    /** Content-Disposition header for image responses. Defaults to "inline". */
+    contentDispositionType?: "inline" | "attachment";
+    /** Content-Security-Policy header for image responses. Defaults to "script-src 'none'; frame-src 'none'; sandbox;" */
     contentSecurityPolicy?: string;
   };
   /**
@@ -142,9 +170,12 @@ type NextConfig = {
    * router: OFF for the Pages Router, ON for the App Router — matching Next.js.
    * @see https://nextjs.org/docs/app/api-reference/config/next-config-js/reactStrictMode
    */
-  reactStrictMode?: boolean | null; /** Build output mode: 'export' for full static export, 'standalone' for single server */
-  output?: "export" | "standalone"; /** File extensions treated as routable pages/routes (Next.js pageExtensions) */
-  pageExtensions?: string[]; /** Turbopack-compatible module resolution options. */
+  reactStrictMode?: boolean | null;
+  /** Build output mode: 'export' for full static export, 'standalone' for single server */
+  output?: "export" | "standalone";
+  /** File extensions treated as routable pages/routes (Next.js pageExtensions) */
+  pageExtensions?: string[];
+  /** Turbopack-compatible module resolution options. */
   turbopack?: {
     resolveAlias?: Record<string, unknown>;
     resolveExtensions?: string[];
@@ -155,8 +186,10 @@ type NextConfig = {
    * hydration, in array order, ahead of the user's `instrumentation-client.{ts,js}`.
    * Each entry may be a bare npm package name or a path relative to the project root.
    */
-  instrumentationClientInject?: string[]; /** Extra origins allowed to access the dev server. */
-  allowedDevOrigins?: string[]; /** Maximum age in seconds for stale ISR entries before blocking regeneration. */
+  instrumentationClientInject?: string[];
+  /** Extra origins allowed to access the dev server. */
+  allowedDevOrigins?: string[];
+  /** Maximum age in seconds for stale ISR entries before blocking regeneration. */
   expireTime?: number;
   /**
    * Maximum total length (in characters) of the preload `Link` header emitted
@@ -164,7 +197,8 @@ type NextConfig = {
    * exceeded; `0` disables emission entirely. Defaults to 6000.
    * @see https://nextjs.org/docs/app/api-reference/config/next-config-js/reactMaxHeadersLength
    */
-  reactMaxHeadersLength?: number; /** User agents that require blocking metadata in the initial head. */
+  reactMaxHeadersLength?: number;
+  /** User agents that require blocking metadata in the initial head. */
   htmlLimitedBots?: RegExp | string;
   /**
    * Enable Cache Components (Next.js 16).
@@ -177,21 +211,24 @@ type NextConfig = {
    * Helps with errors during the prerender phase in `vinext build`.
    * Defaults to `true`. Set to `false` to disable.
    */
-  enablePrerenderSourceMaps?: boolean; /** Transpile packages (Vite handles this natively) */
+  enablePrerenderSourceMaps?: boolean;
+  /** Transpile packages (Vite handles this natively) */
   transpilePackages?: string[];
   /**
    * Packages that should be treated as server-external (not bundled by Vite).
    * Corresponds to Next.js `serverExternalPackages` (or the legacy
    * `experimental.serverComponentsExternalPackages`).
    */
-  serverExternalPackages?: string[]; /** Webpack config (ignored — we use Vite) */
+  serverExternalPackages?: string[];
+  /** Webpack config (ignored — we use Vite) */
   webpack?: unknown;
   /**
    * Compiler options for build-time code transforms.
    * vinext supports the subset that maps to Vite-compatible transforms.
    */
   compiler?: {
-    /** Remove `console.*` calls from the client bundle. */removeConsole?: boolean | {
+    /** Remove `console.*` calls from the client bundle. */
+    removeConsole?: boolean | {
       exclude?: string[];
     };
     /**
@@ -207,7 +244,8 @@ type NextConfig = {
     defineServer?: Record<string, string | number | boolean>;
   };
   experimental?: {
-    /** Enables hard-navigation recovery when App Router navigation rendering fails. */appNavFailHandling?: boolean;
+    /** Enables hard-navigation recovery when App Router navigation rendering fails. */
+    appNavFailHandling?: boolean;
     /**
      * Enables the experimental App Router gesture transition API:
      * `useRouter().experimental_gesturePush()`.
@@ -221,7 +259,8 @@ type NextConfig = {
     prefetchInlining?: boolean | {
       maxBundleSize?: number;
       maxSize?: number;
-    }; /** Header names forwarded by Pages Router `res.revalidate()` internal requests. */
+    };
+    /** Header names forwarded by Pages Router `res.revalidate()` internal requests. */
     allowedRevalidateHeaderKeys?: string[];
     [key: string]: unknown;
   };
@@ -241,8 +280,10 @@ type NextConfig = {
    * Custom build ID generator. If provided, called once at build/dev start.
    * Must return a non-empty string, or null to use the default random ID.
    */
-  generateBuildId?: () => string | null | Promise<string | null>; /** Identifier for deployment-aware cache keys and version skew protection. */
-  deploymentId?: string; /** Any other options */
+  generateBuildId?: () => string | null | Promise<string | null>;
+  /** Identifier for deployment-aware cache keys and version skew protection. */
+  deploymentId?: string;
+  /** Any other options */
   [key: string]: unknown;
 };
 type NextConfigFactory = (phase: string, opts: {
@@ -271,6 +312,7 @@ type ResolvedNextConfig = {
    */
   assetPrefix: string;
   trailingSlash: boolean;
+  skipProxyUrlNormalize: boolean;
   typescript: {
     tsconfigPath?: string;
   };
@@ -299,32 +341,47 @@ type ResolvedNextConfig = {
   };
   headers: NextHeader[];
   images: NextConfig["images"];
-  i18n: NextI18nConfig | null; /** MDX remark/rehype/recma plugins extracted from @next/mdx config */
-  mdx: MdxOptions | null; /** Explicit module aliases preserved from wrapped next.config plugins. */
-  aliases: Record<string, string>; /** Extra allowed origins for dev server access (from allowedDevOrigins). */
-  allowedDevOrigins: string[]; /** Extra allowed origins for server action CSRF validation (from experimental.serverActions.allowedOrigins). */
-  serverActionsAllowedOrigins: string[]; /** Header names forwarded by Pages Router `res.revalidate()` internal requests. */
-  allowedRevalidateHeaderKeys: string[]; /** Packages whose barrel imports should be optimized (from experimental.optimizePackageImports). */
-  optimizePackageImports: string[]; /** Packages explicitly requested for server/client transpilation. */
-  transpilePackages: string[]; /** Packages treated as application code by Turbopack's foreign-code condition. */
-  turbopackTranspilePackages: string[]; /** Inline app CSS into production HTML (from experimental.inlineCss). */
-  inlineCss: boolean; /** Enable standalone route-miss 404 handling (from experimental.globalNotFound). */
-  globalNotFound: boolean; /** Parsed body size limit for server actions in bytes (from experimental.serverActions.bodySizeLimit). Defaults to 1MB. */
-  serverActionsBodySizeLimit: number; /** Verbatim body size limit config value (e.g. "2mb") for the "Body exceeded {limit} limit" error. Defaults to "1 MB". */
-  serverActionsBodySizeLimitLabel: string; /** Route-level expire fallback in seconds for ISR entries with numeric revalidate. */
+  i18n: NextI18nConfig | null;
+  /** MDX remark/rehype/recma plugins extracted from @next/mdx config */
+  mdx: MdxOptions | null;
+  /** Explicit module aliases preserved from wrapped next.config plugins. */
+  aliases: Record<string, string>;
+  /** Extra allowed origins for dev server access (from allowedDevOrigins). */
+  allowedDevOrigins: string[];
+  /** Extra allowed origins for server action CSRF validation (from experimental.serverActions.allowedOrigins). */
+  serverActionsAllowedOrigins: string[];
+  /** Header names forwarded by Pages Router `res.revalidate()` internal requests. */
+  allowedRevalidateHeaderKeys: string[];
+  /** Packages whose barrel imports should be optimized (from experimental.optimizePackageImports). */
+  optimizePackageImports: string[];
+  /** Packages explicitly requested for server/client transpilation. */
+  transpilePackages: string[];
+  /** Packages treated as application code by Turbopack's foreign-code condition. */
+  turbopackTranspilePackages: string[];
+  /** Inline app CSS into production HTML (from experimental.inlineCss). */
+  inlineCss: boolean;
+  /** Enable standalone route-miss 404 handling (from experimental.globalNotFound). */
+  globalNotFound: boolean;
+  /** Parsed body size limit for server actions in bytes (from experimental.serverActions.bodySizeLimit). Defaults to 1MB. */
+  serverActionsBodySizeLimit: number;
+  /** Verbatim body size limit config value (e.g. "2mb") for the "Body exceeded {limit} limit" error. Defaults to "1 MB". */
+  serverActionsBodySizeLimitLabel: string;
+  /** Route-level expire fallback in seconds for ISR entries with numeric revalidate. */
   expireTime: number;
   /**
    * Maximum total length (in characters) of the preload `Link` header emitted
    * during App Router SSR. `0` disables emission. Defaults to 6000.
    */
-  reactMaxHeadersLength: number; /** Serialized htmlLimitedBots regexp source from next.config. */
+  reactMaxHeadersLength: number;
+  /** Serialized htmlLimitedBots regexp source from next.config. */
   htmlLimitedBots: string | undefined;
   /**
    * Packages that should be treated as server-external (not bundled by Vite).
    * Sourced from `serverExternalPackages` or the legacy
    * `experimental.serverComponentsExternalPackages` in next.config.
    */
-  serverExternalPackages: string[]; /** Enable sourcemaps for prerender error stack traces. Defaults to true. */
+  serverExternalPackages: string[];
+  /** Enable sourcemaps for prerender error stack traces. Defaults to true. */
   enablePrerenderSourceMaps: boolean;
   /**
    * Enable App Shell prefetching (from experimental.appShells).
@@ -332,8 +389,10 @@ type ResolvedNextConfig = {
    * bundle via `process.env.__NEXT_APP_SHELLS`, but actual App Shell behavior
    * requires the segment-cache architecture which is not yet implemented.
    */
-  appShells: boolean; /** Resolved build ID (from generateBuildId, or a random UUID if not provided). */
-  buildId: string; /** Resolved deployment ID from next.config.js or NEXT_DEPLOYMENT_ID. */
+  appShells: boolean;
+  /** Resolved build ID (from generateBuildId, or a random UUID if not provided). */
+  buildId: string;
+  /** Resolved deployment ID from next.config.js or NEXT_DEPLOYMENT_ID. */
   deploymentId: string | undefined;
   /**
    * Path to a custom cache handler module. file:// URLs are resolved to
@@ -383,6 +442,8 @@ type ResolvedNextConfig = {
    * `test/e2e/optimized-loading` test fixture.
    */
   disableOptimizedLoading: boolean;
+  /** Cross-origin mode applied to framework scripts and preload links. */
+  crossOrigin: "anonymous" | "use-credentials" | undefined;
   /**
    * Resolved `reactStrictMode` from next.config, preserved as `boolean | null`
    * so each router can apply its own default (Next.js resolves `null` to OFF

package/dist/config/next-config.js

@@ -658,6 +658,7 @@ async function resolveNextConfig(config, root = toSlash(process.cwd()), options
 			basePath: "",
 			assetPrefix: "",
 			trailingSlash: false,
+			skipProxyUrlNormalize: false,
 			typescript: {},
 			output: "",
 			pageExtensions: normalizePageExtensions(),
@@ -702,6 +703,7 @@ async function resolveNextConfig(config, root = toSlash(process.cwd()), options
 			sassOptions: null,
 			removeConsole: false,
 			disableOptimizedLoading: false,
+			crossOrigin: void 0,
 			reactStrictMode: null,
 			scrollRestoration: false,
 			compilerDefine: {},
@@ -718,6 +720,8 @@ async function resolveNextConfig(config, root = toSlash(process.cwd()), options
 		detectNextIntlConfig(root, resolved);
 		return resolved;
 	}
+	if (config.crossOrigin !== void 0 && config.crossOrigin !== "anonymous" && config.crossOrigin !== "use-credentials") console.warn("Invalid next.config options detected:\n    Invalid option at \"crossOrigin\": expected \"anonymous\" or \"use-credentials\"\nSee more info here: https://nextjs.org/docs/messages/invalid-next-config");
+	if (config.skipProxyUrlNormalize !== void 0 && config.skipMiddlewareUrlNormalize !== void 0) throw new Error("Config options `skipProxyUrlNormalize` and `skipMiddlewareUrlNormalize` cannot be set at the same time. Please use `skipProxyUrlNormalize` instead.");
 	warnDeprecatedConfigOptions(config, root);
 	const i18n = normalizeI18nConfig(config.i18n);
 	let redirects = [];
@@ -835,6 +839,7 @@ async function resolveNextConfig(config, root = toSlash(process.cwd()), options
 		basePath: config.basePath ?? "",
 		assetPrefix: normalizeAssetPrefix(config.assetPrefix),
 		trailingSlash: config.trailingSlash ?? false,
+		skipProxyUrlNormalize: config.skipProxyUrlNormalize ?? config.skipMiddlewareUrlNormalize ?? false,
 		typescript: typeof config.typescript?.tsconfigPath === "string" ? { tsconfigPath: config.typescript.tsconfigPath } : {},
 		output: output === "export" || output === "standalone" ? output : "",
 		pageExtensions,
@@ -876,6 +881,7 @@ async function resolveNextConfig(config, root = toSlash(process.cwd()), options
 		sassOptions: readOptionalRecord(config.sassOptions) ?? null,
 		removeConsole: config.compiler?.removeConsole === true ? true : isUnknownRecord(config.compiler?.removeConsole) ? { exclude: readStringArray(config.compiler.removeConsole.exclude) } : false,
 		disableOptimizedLoading: experimental?.disableOptimizedLoading === true,
+		crossOrigin: config.crossOrigin === "anonymous" || config.crossOrigin === "use-credentials" ? config.crossOrigin : void 0,
 		reactStrictMode: typeof config.reactStrictMode === "boolean" ? config.reactStrictMode : null,
 		scrollRestoration: experimental?.scrollRestoration === true,
 		compilerDefine: serializeCompilerDefine(config.compiler?.define),

package/dist/config/prerender.d.ts

@@ -1,6 +1,5 @@
 import { VINEXT_CACHE_CONFIG_PLUGIN_PROPERTY, VinextCacheConfig, findVinextCacheConfigInPlugins, loadVinextCacheConfigFromViteConfig } from "../cache/cache-adapters-virtual.js";
 import { PluginOption } from "vite";
-
 //#region src/config/prerender.d.ts
 type VinextPrerenderConfig = true | {
   /**

package/dist/entries/app-browser-entry.d.ts

@@ -1,7 +1,6 @@
 import { NextRewrite } from "../config/next-config.js";
 import { AppRoute, RouteManifest } from "../routing/app-route-graph.js";
 import { VinextLinkPrefetchRoute, VinextPagesLinkPrefetchRoute } from "../client/vinext-next-data.js";
-
 //#region src/entries/app-browser-entry.d.ts
 /**
  * Generate the virtual browser entry module.

package/dist/entries/app-browser-entry.js

@@ -1,4 +1,5 @@
 import { resolveClientRuntimeModule, resolveRuntimeEntryModule } from "./runtime-entry-module.js";
+import { toClientRewrites } from "../client/client-rewrites.js";
 import { patternsStructurallyEquivalent } from "../routing/app-route-graph.js";
 //#region src/entries/app-browser-entry.ts
 /**
@@ -14,9 +15,12 @@ function generateBrowserEntry(routes = [], routeManifest = null, pagesPrefetchRo
 	fallback: []
 }) {
 	const entryPath = resolveRuntimeEntryModule("app-browser-entry");
+	const reactInstanceBootstrapPath = resolveClientRuntimeModule("react-instance-bootstrap");
 	const navigationRuntimePath = resolveClientRuntimeModule("navigation-runtime");
 	const prefetchRoutes = toLinkPrefetchRoutes(routes);
-	return `import { registerNavigationRuntimeBootstrap } from ${JSON.stringify(navigationRuntimePath)};
+	const clientRewrites = toClientRewrites(rewrites);
+	return `import ${JSON.stringify(reactInstanceBootstrapPath)};
+import { registerNavigationRuntimeBootstrap } from ${JSON.stringify(navigationRuntimePath)};
 
 window.__VINEXT_LINK_PREFETCH_ROUTES__ = ${JSON.stringify(prefetchRoutes)};
 // Pages route manifest for hybrid ownership decisions. In a hybrid
@@ -24,7 +28,7 @@ window.__VINEXT_LINK_PREFETCH_ROUTES__ = ${JSON.stringify(prefetchRoutes)};
 // entry must also expose the Pages manifest (the Pages client entry does
 // the same — whichever entry runs first emits both globals).
 window.__VINEXT_PAGES_LINK_PREFETCH_ROUTES__ = ${JSON.stringify(pagesPrefetchRoutes)};
-window.__VINEXT_CLIENT_REWRITES__ = ${JSON.stringify(rewrites)};
+window.__VINEXT_CLIENT_REWRITES__ = ${JSON.stringify(clientRewrites)};
 registerNavigationRuntimeBootstrap({
     routeManifest: ${buildRouteManifestExpression(routeManifest)}
 });
@@ -58,7 +62,7 @@ function interceptTargetsRoute(interceptTargetPattern, route) {
 	return patternsStructurallyEquivalent(splitPatternParts(interceptTargetPattern), route.patternParts);
 }
 function hasLoadingBoundary(route, hasSiblingInterceptLoading) {
-	return route.loadingPath !== null || (route.loadingPaths?.length ?? 0) > 0 || route.parallelSlots.some((slot) => slot.loadingPath !== null || (slot.loadingPaths?.length ?? 0) > 0 || slot.interceptingRoutes.some((intercept) => interceptTargetsRoute(intercept.targetPattern, route) && (intercept.loadingPaths?.length ?? 0) > 0)) || hasSiblingInterceptLoading;
+	return route.loadingPath !== null || (route.loadingPaths?.some((_, index) => (route.loadingTreePositions?.[index] ?? 0) > 0) ?? false) || route.parallelSlots.some((slot) => slot.loadingPath !== null || (slot.loadingPaths?.length ?? 0) > 0 || slot.interceptingRoutes.some((intercept) => interceptTargetsRoute(intercept.targetPattern, route) && (intercept.loadingPaths?.length ?? 0) > 0)) || hasSiblingInterceptLoading;
 }
 /** Project an `AppRoute` down to the public `VinextLinkPrefetchRoute` shape. */
 function toLinkPrefetchRoute(route, hasSiblingInterceptLoading = route.siblingIntercepts.some((intercept) => interceptTargetsRoute(intercept.targetPattern, route) && (intercept.loadingPaths?.length ?? 0) > 0)) {

package/dist/entries/app-rsc-entry.d.ts

@@ -2,7 +2,6 @@ import { NextHeader, NextI18nConfig, NextRedirect, NextRewrite, PrefetchInlining
 import { AppRoute } from "../routing/app-route-graph.js";
 import { MetadataFileRoute } from "../server/metadata-routes.js";
 import { ImageConfig } from "../server/image-optimization.js";
-
 //#region src/entries/app-rsc-entry.d.ts
 /**
  * Resolved config options relevant to App Router request handling.
@@ -15,11 +14,16 @@ type AppRouterConfig = {
     afterFiles: NextRewrite[];
     fallback: NextRewrite[];
   };
-  headers?: NextHeader[]; /** Extra origins allowed for server action CSRF checks (from experimental.serverActions.allowedOrigins). */
-  allowedOrigins?: string[]; /** Extra origins allowed for dev server access (from allowedDevOrigins). */
-  allowedDevOrigins?: string[]; /** Body size limit for server actions in bytes (from experimental.serverActions.bodySizeLimit). */
-  bodySizeLimit?: number; /** Verbatim body size limit config value (e.g. "2mb") for the "Body exceeded {limit} limit" error. */
-  bodySizeLimitLabel?: string; /** Serialized next.config htmlLimitedBots regexp source. */
+  headers?: NextHeader[];
+  /** Extra origins allowed for server action CSRF checks (from experimental.serverActions.allowedOrigins). */
+  allowedOrigins?: string[];
+  /** Extra origins allowed for dev server access (from allowedDevOrigins). */
+  allowedDevOrigins?: string[];
+  /** Body size limit for server actions in bytes (from experimental.serverActions.bodySizeLimit). */
+  bodySizeLimit?: number;
+  /** Verbatim body size limit config value (e.g. "2mb") for the "Body exceeded {limit} limit" error. */
+  bodySizeLimitLabel?: string;
+  /** Serialized next.config htmlLimitedBots regexp source. */
   htmlLimitedBots?: string;
   /**
    * Allow-list of keys (from `experimental.clientTraceMetadata`) to surface
@@ -35,19 +39,27 @@ type AppRouterConfig = {
    *
    * @see https://nextjs.org/docs/app/api-reference/config/next-config-js/assetPrefix
    */
-  assetPrefix?: string; /** Route-level expire fallback in seconds for ISR entries with numeric revalidate. */
+  assetPrefix?: string;
+  /** Route-level expire fallback in seconds for ISR entries with numeric revalidate. */
   expireTime?: number;
   /**
    * Maximum total length (in characters) of the preload `Link` header emitted
    * during App Router SSR. `0` disables emission. Defaults to 6000.
    */
-  reactMaxHeadersLength?: number; /** Maximum in-memory cache size in bytes. 0 disables the default memory cache. */
-  cacheMaxMemorySize?: number; /** Inline app CSS into production HTML (from experimental.inlineCss). */
-  inlineCss?: boolean; /** Enable standalone route-miss 404 handling (from experimental.globalNotFound). */
-  globalNotFound?: boolean; /** Enables Next.js Cache Components semantics for App Router document HTML. */
-  cacheComponents?: boolean; /** Resolved `experimental.prefetchInlining` thresholds. */
-  prefetchInlining?: PrefetchInliningConfig; /** Whether the RSC build discovered any server references. Defaults to true. */
-  hasServerActions?: boolean; /** Internationalization routing config for middleware matcher locale handling. */
+  reactMaxHeadersLength?: number;
+  /** Maximum in-memory cache size in bytes. 0 disables the default memory cache. */
+  cacheMaxMemorySize?: number;
+  /** Inline app CSS into production HTML (from experimental.inlineCss). */
+  inlineCss?: boolean;
+  /** Enable standalone route-miss 404 handling (from experimental.globalNotFound). */
+  globalNotFound?: boolean;
+  /** Enables Next.js Cache Components semantics for App Router document HTML. */
+  cacheComponents?: boolean;
+  /** Resolved `experimental.prefetchInlining` thresholds. */
+  prefetchInlining?: PrefetchInliningConfig;
+  /** Whether the RSC build discovered any server references. Defaults to true. */
+  hasServerActions?: boolean;
+  /** Internationalization routing config for middleware matcher locale handling. */
   i18n?: NextI18nConfig | null;
   imageConfig?: ImageConfig;
   /**
@@ -67,8 +79,10 @@ type AppRouterConfig = {
    * `import("./ssr/index.js")`, which re-exports it from
    * `virtual:vinext-server-entry` when this flag is set.
    */
-  hasPagesDir?: boolean; /** Exact public/ file routes, using normalized leading-slash pathnames. */
-  publicFiles?: string[]; /** Server-only token used to validate the draft-mode bypass cookie. */
+  hasPagesDir?: boolean;
+  /** Exact public/ file routes, using normalized leading-slash pathnames. */
+  publicFiles?: string[];
+  /** Server-only token used to validate the draft-mode bypass cookie. */
   draftModeSecret?: string;
 };
 /**