vinext 1.0.0 → 1.1.0

package/dist/server/metadata-route-response.js

@@ -4,23 +4,28 @@ import { decodeMatchedParams } from "../routing/utils.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
 import { VINEXT_METADATA_ROUTE_CACHE_HEADER } from "./headers.js";
 import { notFoundResponse } from "./http-error-responses.js";
-import { beginRouteCacheability, markRouteCacheabilityExplicitResponsePolicy } from "../shims/cacheability-classification.js";
-import { hasCdnResponsePolicy, hasExplicitNonCacheableResponsePolicy } from "./cache-control.js";
+import { beginRouteCacheability, markRouteCacheabilityExplicitResponsePolicy, markRouteCacheabilityResponseBodyComplete, recordRouteCacheability } from "../shims/cacheability-classification.js";
+import { NEVER_CACHE_CONTROL, applyCdnResponseHeaders, hasCdnResponsePolicy } from "./cache-control.js";
+import { buildAppRouteMissIsrCacheControl } from "./isr-decision.js";
 import { isrCacheControl } from "./isr-cache.js";
 import { resolveClientStaleTimeSeconds } from "../utils/cache-control-metadata.js";
-import { _consumeRequestScopedCacheLife, cacheLifeProfiles } from "../shims/cache-request-state.js";
+import { isRenderDynamicLatched } from "../shims/internal/headers-state.js";
+import { getActiveDraftModeState, getHeadersContext, hasDraftModeCookieHeader, replaceHeadersContext } from "../shims/headers.js";
+import { _consumeRequestScopedCacheLife } from "../shims/cache-request-state.js";
 import { ensureFetchPatch, getCollectedFetchTags, setCurrentFetchSoftTags } from "../shims/fetch-cache.js";
 import { isValidMetadataImageId, manifestToJson, matchMetadataRoutePattern, robotsToText, sitemapToXml } from "./metadata-routes.js";
 import { applyPrerenderCacheLifeHeader, applyPrerenderCacheTagsHeader } from "./prerender-cache-life-header.js";
 import { canonicalizeAppPageParams } from "./app-page-segment-state.js";
 import { buildPageCacheTags } from "./implicit-tags.js";
 import { buildAppRouteCacheValue, buildRouteHandlerCachedResponse } from "./app-route-handler-response.js";
-import { isMetadataResponseCacheable } from "./metadata-route-cache-policy.js";
+import { createStaticGenerationHeadersContext } from "./app-static-generation.js";
+import { completeAppRouteHandlerResponse } from "./app-route-handler-execution.js";
 //#region src/server/metadata-route-response.ts
 function isOuterMetadataCacheEnabled() {
 	return process.env.NODE_ENV !== "development";
 }
 const routeFunctionCache = /* @__PURE__ */ new WeakMap();
+const userMetadataResponses = /* @__PURE__ */ new WeakSet();
 const USE_CACHE_FUNCTION_SYMBOL = Symbol.for("vinext.useCacheFunction");
 const CACHE_HEADERS = {
 	noCache: "no-cache, no-store",
@@ -53,17 +58,19 @@ function metadataRouteCacheHeader(route) {
 	if (route.isDynamic && isImageMetadataRoute(route) && process.env.NODE_ENV === "development") return CACHE_HEADERS.noCache;
 	return CACHE_HEADERS.revalidate;
 }
-function withMetadataRouteCacheHeader(response, route) {
-	if (hasCdnResponsePolicy(response.headers) && !hasExplicitNonCacheableResponsePolicy(response.headers)) markRouteCacheabilityExplicitResponsePolicy();
-	const headers = new Headers(response.headers);
-	if (!headers.has("Cache-Control")) headers.set("Cache-Control", metadataRouteCacheHeader(route));
-	return new Response(response.body, {
-		headers,
-		status: response.status,
-		statusText: response.statusText
-	});
-}
 function beginMetadataRouteCacheability(route) {
+	const dynamic = route.module?.dynamic;
+	if (dynamic === "force-static" || dynamic === "error") {
+		const current = getHeadersContext();
+		const staticContext = createStaticGenerationHeadersContext({
+			dynamicConfig: dynamic,
+			routeKind: "route",
+			routePattern: route.servedUrl,
+			draftModeEnabled: getActiveDraftModeState() ?? void 0,
+			draftModeSecret: current?.draftModeSecret
+		});
+		replaceHeadersContext(staticContext);
+	}
 	beginRouteCacheability("app-route", route.patternParts ? `/${route.patternParts.join("/")}` : route.servedUrl);
 }
 function getMetadataRouteFunctions(route) {
@@ -137,29 +144,68 @@ function markMetadataRouteCacheValue(value) {
 function buildMetadataRouteTags(route, cleanPathname, collectedTags) {
 	return buildPageCacheTags(cleanPathname, collectedTags, route.routeSegments ?? [], "route");
 }
-function captureRenderedMetadataRoute(response) {
-	const cacheLife = _consumeRequestScopedCacheLife();
+async function captureRenderedMetadataRoute(response, route, cleanPathname) {
+	const isUserResponse = userMetadataResponses.has(response);
+	let completed = false;
+	if (isOuterMetadataCacheEnabled()) {
+		const result = await completeAppRouteHandlerResponse(response);
+		response = result.response;
+		completed = result.completed;
+		if (completed) markRouteCacheabilityResponseBodyComplete();
+	}
+	const browserCacheControl = response.headers.get("Cache-Control") ?? void 0;
+	const hasUserPolicy = isUserResponse && hasCdnResponsePolicy(response.headers);
+	if (hasUserPolicy) markRouteCacheabilityExplicitResponsePolicy();
+	const observedCacheLife = _consumeRequestScopedCacheLife();
 	const collectedTags = getCollectedFetchTags();
+	const revalidate = typeof route.module?.revalidate === "number" ? route.module.revalidate : Infinity;
+	const frameworkRevalidate = Math.min(observedCacheLife?.revalidate ?? Infinity, revalidate);
+	const cacheLife = {
+		...observedCacheLife,
+		revalidate: frameworkRevalidate
+	};
+	const cacheable = (response.status < 400 || response.status === 404) && completed && !isRenderDynamicLatched() && !getActiveDraftModeState() && !hasDraftModeCookieHeader() && route.module?.dynamic !== "force-dynamic" && frameworkRevalidate > 0 && !response.headers.has("set-cookie");
+	const cacheControl = cacheable ? buildAppRouteMissIsrCacheControl(frameworkRevalidate, cacheLife?.expire) : NEVER_CACHE_CONTROL;
+	if (isUserResponse && !hasUserPolicy) {
+		response = new Response(response.body, {
+			headers: new Headers(response.headers),
+			status: response.status,
+			statusText: response.statusText
+		});
+		applyCdnResponseHeaders(response.headers, { cacheControl: isOuterMetadataCacheEnabled() ? cacheControl : metadataRouteCacheHeader(route) });
+	}
+	recordRouteCacheability(cacheable ? {
+		cacheable: true,
+		cacheControl,
+		tags: buildMetadataRouteTags(route, cleanPathname, collectedTags)
+	} : {
+		cacheable: false,
+		dynamicUsage: true
+	});
 	if (process.env.VINEXT_PRERENDER === "1") {
-		applyPrerenderCacheLifeHeader(response.headers, cacheLife);
+		applyPrerenderCacheLifeHeader(response.headers, {
+			...cacheLife,
+			revalidate: cacheable ? frameworkRevalidate : 0
+		});
 		applyPrerenderCacheTagsHeader(response.headers, collectedTags);
 	}
 	return {
+		browserCacheControl,
 		cacheLife,
+		cacheable,
 		collectedTags,
 		response
 	};
 }
 async function writeRenderedMetadataRoute(options, route, routeKey, rendered, previousEntry) {
-	if (!options.isrSet || !rendered.response.ok || !isMetadataResponseCacheable(rendered.response)) return;
+	if (!options.isrSet || !rendered.cacheable) return;
 	const previousCacheControl = previousEntry?.value.cacheControl;
-	const defaultCacheLife = cacheLifeProfiles.default;
-	const revalidate = rendered.cacheLife?.revalidate ?? previousCacheControl?.revalidate ?? defaultCacheLife.revalidate ?? 900;
-	const expire = rendered.cacheLife?.expire ?? previousCacheControl?.expire ?? defaultCacheLife.expire;
+	const revalidate = rendered.cacheLife?.revalidate ?? previousCacheControl?.revalidate ?? (typeof route.module?.revalidate === "number" ? route.module.revalidate : false);
+	const expire = rendered.cacheLife?.expire ?? previousCacheControl?.expire;
 	const stale = resolveClientStaleTimeSeconds(rendered.cacheLife) ?? previousCacheControl?.stale;
-	const value = markMetadataRouteCacheValue(await buildAppRouteCacheValue(rendered.response));
+	const value = markMetadataRouteCacheValue(await buildAppRouteCacheValue(rendered.response, rendered.browserCacheControl));
 	await options.isrSet(routeKey, value, {
-		cacheControl: isrCacheControl(revalidate, {
+		cacheControl: isrCacheControl(revalidate === Infinity ? false : revalidate, {
 			...typeof expire === "number" ? { expireSeconds: expire } : {},
 			...typeof stale === "number" ? { staleSeconds: stale } : {}
 		}),
@@ -171,16 +217,21 @@ async function runMetadataRouteRegeneration(options, route, render, routeKey, pr
 	try {
 		await runWithRequestContext(requestContext, async () => {
 			ensureFetchPatch();
+			beginMetadataRouteCacheability(route);
 			setCurrentFetchSoftTags(buildMetadataRouteTags(route, options.cleanPathname, []));
 			const rendered = await render();
-			if (rendered) await writeRenderedMetadataRoute(options, route, routeKey, rendered, previousEntry);
+			if (rendered) try {
+				await writeRenderedMetadataRoute(options, route, routeKey, rendered, previousEntry);
+			} finally {
+				rendered.response.body?.cancel().catch(() => {});
+			}
 		});
 	} finally {
 		await closeAfterResponse(requestContext);
 	}
 }
-async function readMatchedPrerenderedMetadataRouteResponse(options, route, functions, render) {
-	if (!isOuterMetadataCacheEnabled() || !options.isrGet || !options.isrRouteKey) return {
+async function readMatchedPrerenderedMetadataRouteResponse(options, route, render) {
+	if (!isOuterMetadataCacheEnabled() || !options.isrGet || !options.isrRouteKey || getActiveDraftModeState() || hasDraftModeCookieHeader() || route.module?.dynamic === "force-dynamic" || route.module?.revalidate === 0) return {
 		cachedEntry: null,
 		response: null
 	};
@@ -214,7 +265,7 @@ async function readMatchedPrerenderedMetadataRouteResponse(options, route, funct
 			revalidateSeconds
 		})
 	};
-	if (isUseCacheFunction(functions.defaultExport) && options.isrSet && options.scheduleBackgroundRegeneration) {
+	if (options.isrSet && options.scheduleBackgroundRegeneration) {
 		const executionContext = getRequestExecutionContext();
 		options.scheduleBackgroundRegeneration(routeKey, () => runMetadataRouteRegeneration(options, route, render, routeKey, cached, executionContext), {
 			routerKind: "App Router",
@@ -330,7 +381,10 @@ async function handleGeneratedSitemap(route, cleanPathname, functions) {
 	const matchedId = findGeneratedSitemapId(await functions.generateSitemaps({}), rawId);
 	if (!matchedId) return notFoundResponse();
 	const result = await functions.defaultExport({ id: makeThenableMetadataRouteId(matchedId) });
-	if (result instanceof Response) return withMetadataRouteCacheHeader(result, route);
+	if (result instanceof Response) {
+		userMetadataResponses.add(result);
+		return result;
+	}
 	if (!isSitemapEntries(result)) throw new TypeError("Metadata sitemap routes must return an array.");
 	return markFullyBufferedBody(new Response(sitemapToXml(result), { headers: {
 		"Content-Type": route.contentType,
@@ -367,7 +421,10 @@ async function callDynamicMetadataRoute(route, match, makeThenableParams, functi
 			id: makeThenableMetadataRouteId(matchedImageId)
 		});
 	} else result = await functions.defaultExport({ params: paramsThenable });
-	if (result instanceof Response) return withMetadataRouteCacheHeader(result, route);
+	if (result instanceof Response) {
+		userMetadataResponses.add(result);
+		return result;
+	}
 	let body;
 	if (route.type === "sitemap") {
 		if (!isSitemapEntries(result)) throw new TypeError("Metadata sitemap routes must return an array.");
@@ -410,8 +467,8 @@ function isMetadataRouteRequestPath(metadataRoutes, cleanPathname) {
 	}
 	return false;
 }
-async function writeMetadataRouteMiss(options, route, functions, rendered, cachedEntry) {
-	if (process.env.VINEXT_PRERENDER === "1" || !isOuterMetadataCacheEnabled() || !rendered.response.ok || !isMetadataResponseCacheable(rendered.response) || !isUseCacheFunction(functions.defaultExport) || !options.isrRouteKey || !options.isrSet) return;
+async function writeMetadataRouteMiss(options, route, rendered, cachedEntry) {
+	if (process.env.VINEXT_PRERENDER === "1" || !isOuterMetadataCacheEnabled() || !rendered.cacheable || !options.isrRouteKey || !options.isrSet) return;
 	try {
 		await writeRenderedMetadataRoute(options, route, options.isrRouteKey(options.cleanPathname), {
 			...rendered,
@@ -433,13 +490,13 @@ async function handleMetadataRouteRequest(options) {
 					const render = async () => {
 						setCurrentFetchSoftTags(buildMetadataRouteTags(route, options.cleanPathname, []));
 						const response = await handleGeneratedSitemap(route, options.cleanPathname, functions);
-						return response ? captureRenderedMetadataRoute(response) : null;
+						return response ? captureRenderedMetadataRoute(response, route, options.cleanPathname) : null;
 					};
-					const cached = await readMatchedPrerenderedMetadataRouteResponse(options, route, functions, render);
+					const cached = await readMatchedPrerenderedMetadataRouteResponse(options, route, render);
 					if (cached.response) return cached.response;
 					const rendered = await render();
 					if (rendered) {
-						await writeMetadataRouteMiss(options, route, functions, rendered, cached.cachedEntry);
+						await writeMetadataRouteMiss(options, route, rendered, cached.cachedEntry);
 						return rendered.response;
 					}
 				}
@@ -471,12 +528,12 @@ async function handleMetadataRouteRequest(options) {
 		}
 		const render = async () => {
 			setCurrentFetchSoftTags(buildMetadataRouteTags(route, options.cleanPathname, []));
-			return captureRenderedMetadataRoute(route.isDynamic ? await callDynamicMetadataRoute(route, match, options.makeThenableParams, functions) : serveStaticMetadataRoute(route));
+			return captureRenderedMetadataRoute(route.isDynamic ? await callDynamicMetadataRoute(route, match, options.makeThenableParams, functions) : serveStaticMetadataRoute(route), route, options.cleanPathname);
 		};
-		const cached = await readMatchedPrerenderedMetadataRouteResponse(options, route, functions, render);
+		const cached = await readMatchedPrerenderedMetadataRouteResponse(options, route, render);
 		if (cached.response) return cached.response;
 		const rendered = await render();
-		await writeMetadataRouteMiss(options, route, functions, rendered, cached.cachedEntry);
+		await writeMetadataRouteMiss(options, route, rendered, cached.cachedEntry);
 		return rendered.response;
 	}
 	return null;

package/dist/server/middleware-matcher-pattern.js

@@ -1,4 +1,4 @@
-import { analyzeRegexSafety, regexAtomsMayOverlap } from "../utils/regex-safety.js";
+import { analyzeRegexSafety, mayHaveNamedGroups, regexAtomsMayOverlap } from "../utils/regex-safety.js";
 import { middlewarePathTokensToRegExp, normalizeMiddlewarePathTokens, parseMiddlewarePath } from "./middleware-path-to-regexp.js";
 //#region src/server/middleware-matcher-pattern.ts
 const MATCHER_OBJECT_KEYS = /* @__PURE__ */ new Set([
@@ -138,8 +138,11 @@ function hasOverlappingSequentialRepetition(pattern) {
 	}
 	return false;
 }
-function unsafeTokenReason(token) {
-	const regexSafetyIssue = analyzeRegexSafety(token.pattern, { ignoreCase: true });
+function unsafeTokenReason(token, namedGroups) {
+	const regexSafetyIssue = analyzeRegexSafety(token.pattern, {
+		ignoreCase: true,
+		namedGroups
+	});
 	if (regexSafetyIssue) {
 		if (regexSafetyIssue === "analysis budget exceeded") return `parameter "${token.name}" exceeds the regex analysis budget`;
 		return `parameter "${token.name}" contains ${regexSafetyIssue}`;
@@ -150,9 +153,10 @@ function unsafeTokenReason(token) {
 	return null;
 }
 function validateTokens(tokens) {
+	const namedGroups = tokens.some((token) => typeof token !== "string" && mayHaveNamedGroups(token.pattern));
 	for (const token of tokens) {
 		if (typeof token === "string") continue;
-		const reason = unsafeTokenReason(token);
+		const reason = unsafeTokenReason(token, namedGroups);
 		if (reason) return reason;
 	}
 	return null;

package/dist/server/middleware-response-headers.js

@@ -1,3 +1,4 @@
+import "./headers.js";
 //#region src/server/middleware-response-headers.ts
 const ADDITIVE_RESPONSE_HEADER_NAMES = /* @__PURE__ */ new Set(["set-cookie", "vary"]);
 function mergeVaryHeader(target, value) {
@@ -28,6 +29,7 @@ function mergeMiddlewareResponseHeaders(target, middlewareHeaders) {
 	if (!middlewareHeaders) return;
 	for (const [key, value] of middlewareHeaders) {
 		const lowerName = key.toLowerCase();
+		if (lowerName === "x-vinext-special-error-status") continue;
 		if (lowerName === "link" && !value) continue;
 		if (lowerName === "vary") {
 			mergeVaryHeader(target, value);

package/dist/server/multi-stage.d.ts

@@ -21,6 +21,14 @@ export type VinextResponseStageDispatchOptions = {
    * opt into completed-response admission and honor core's `no-store` policy.
    */
   cache: "shared" | "bypass";
+  /**
+   * Render an App page document whole before its first byte, as Next.js
+   * renders a static page, so its streamed metadata is in `<head>`. An adapter
+   * sets this for a render no client is waiting on, such as a regeneration or
+   * a deployment warm-up. It is not a cache selector: a transport must not
+   * partition its lookup or stored entry by it.
+   */
+  renderWholeDocument?: boolean;
   /**
    * Query-free identity of a shared App page GET/HEAD dispatch, supplied only
    * to adapters that declare `responseStageCacheIdentity: "query-free"` and

package/dist/server/navigation-planner.js

@@ -1,8 +1,8 @@
 import { splitPathnameForRouteMatch } from "../routing/utils.js";
 import { stripBasePath } from "../utils/base-path.js";
+import { matchRoutePattern, matchRoutePatternPrefix, matchRoutePatternWithOptionalDynamicSegments } from "../routing/route-pattern.js";
 import { AppElementsWire, compareAppElementsSlotIds } from "./app-elements-wire.js";
 import "./app-elements.js";
-import { matchRoutePattern, matchRoutePatternPrefix, matchRoutePatternWithOptionalDynamicSegments } from "../routing/route-pattern.js";
 import { resolveHardNavigationTargetFromRscResponse, resolveRscCompatibilityNavigationDecision } from "./app-rsc-cache-busting.js";
 import { resolveRscRedirectLifecycleHop, resolveStreamedRscRedirectLifecycleHop } from "./app-browser-rsc-redirect.js";
 import { NavigationTraceReasonCodes, createNavigationLifecycleTraceFields, createNavigationTrace } from "./navigation-trace.js";

package/dist/server/node-response-signal.d.ts

@@ -0,0 +1,16 @@
+import { Writable } from "node:stream";
+//#region src/server/node-response-signal.d.ts
+export declare class ResponseAborted extends Error {
+  readonly name = "ResponseAborted";
+}
+/**
+ * Creates an AbortSignal tied to the closing of a ServerResponse.
+ *
+ * The incoming request cannot be used: once its body has been fully read the
+ * readable side is done, so a later client disconnect fires nothing on it
+ * (and its `close` event also fires on normal requests). If `finish` fires
+ * first, `res.end()` completed and the following `close` is our own teardown;
+ * if `close` fires first, the client disconnected before we finished.
+ */
+export declare function signalFromNodeResponse(response: Writable): AbortSignal;
+//#endregion

package/dist/server/node-response-signal.js

@@ -0,0 +1,26 @@
+//#region src/server/node-response-signal.ts
+const ResponseAbortedName = "ResponseAborted";
+var ResponseAborted = class extends Error {
+	name = ResponseAbortedName;
+};
+/**
+* Creates an AbortSignal tied to the closing of a ServerResponse.
+*
+* The incoming request cannot be used: once its body has been fully read the
+* readable side is done, so a later client disconnect fires nothing on it
+* (and its `close` event also fires on normal requests). If `finish` fires
+* first, `res.end()` completed and the following `close` is our own teardown;
+* if `close` fires first, the client disconnected before we finished.
+*/
+function signalFromNodeResponse(response) {
+	const { errored, destroyed } = response;
+	if (errored || destroyed) return AbortSignal.abort(errored ?? new ResponseAborted());
+	const controller = new AbortController();
+	response.once("close", () => {
+		if (response.writableFinished) return;
+		controller.abort(new ResponseAborted());
+	});
+	return controller.signal;
+}
+//#endregion
+export { ResponseAborted, signalFromNodeResponse };

package/dist/server/open-redirect.d.ts

@@ -8,4 +8,51 @@
  * to resolve a `Location` containing the pathname as protocol-relative.
  */
 export declare function isOpenRedirectShaped(rawPathname: string): boolean;
+/**
+ * What a request entry answers for a raw path containing a backslash or a
+ * repeated slash: Next.js's 308, or a 404 when the collapsed path would still
+ * be open-redirect shaped.
+ */
+export type RepeatedSlashRedirect = {
+  status: 308;
+  location: string;
+} | {
+  status: 404;
+};
+/**
+ * Returns Next.js's redirect for a raw request path containing a backslash or
+ * a repeated slash, or `null` when the path needs no change.
+ *
+ * Ported from Next.js's request entry (`base-server.ts` / `resolve-routes.ts`,
+ * via `normalizeRepeatedSlashes` in `shared/lib/utils.ts`): backslashes in the
+ * path become `/`, runs of slashes collapse to one and the query is kept.
+ * `next start` then builds the Location with `url.format(parseUrl(...))` in
+ * `router-server.ts`, so the result is serialized through a WHATWG URL here
+ * too (`/a/%2e%2e//b` → `/b`, `?q="x"` → `?q=%22x%22`, as observed). It runs
+ * before basePath handling, so `//` → `/`, `/docs//` → `/docs/` and
+ * `//evil.com` → `/evil.com`. Percent-encoded `%2F`/`%5C` are not touched and
+ * keep falling through to `isOpenRedirectShaped` (404), as in Next.js.
+ *
+ * The Location is always same-origin. Absolute-form request targets
+ * (`GET http://host//x`) are left alone. A collapsed path that still starts
+ * with an encoded slash or backslash (`//%2Fevil.com`, `/.//%2Fevil.com`) is
+ * never echoed into a Location or routed: it gets a 404 instead.
+ *
+ * @param rawUrl - The raw request target: pathname plus optional `?query`
+ */
+export declare function getRepeatedSlashRedirect(rawUrl: string): RepeatedSlashRedirect | null;
+/**
+ * Build the Response for a raw request path containing a backslash or a
+ * repeated slash. See `getRepeatedSlashRedirect`.
+ */
+export declare function repeatedSlashRedirectResponse(rawUrl: string): Response | null;
+/**
+ * Node `ServerResponse` counterpart of `repeatedSlashRedirectResponse`, for
+ * entries that see the raw request target (dev and `vinext start`). Returns
+ * true when a response was sent.
+ */
+export declare function sendRepeatedSlashRedirect(rawUrl: string, res: {
+  writeHead(status: number, headers?: Record<string, string>): unknown;
+  end(body: string): unknown;
+}): boolean;
 //#endregion

package/dist/server/open-redirect.js

@@ -1,3 +1,4 @@
+import { notFoundResponse } from "./http-error-responses.js";
 //#region src/server/open-redirect.ts
 /**
 * Returns true if a request pathname looks like a protocol-relative open
@@ -17,5 +18,77 @@ function isOpenRedirectShaped(rawPathname) {
 	}
 	return false;
 }
+const REPEATED_SLASH_OR_BACKSLASH_RE = /\\|\/\//;
+const REDIRECT_LOCATION_BASE = "http://vinext.invalid";
+/**
+* Returns Next.js's redirect for a raw request path containing a backslash or
+* a repeated slash, or `null` when the path needs no change.
+*
+* Ported from Next.js's request entry (`base-server.ts` / `resolve-routes.ts`,
+* via `normalizeRepeatedSlashes` in `shared/lib/utils.ts`): backslashes in the
+* path become `/`, runs of slashes collapse to one and the query is kept.
+* `next start` then builds the Location with `url.format(parseUrl(...))` in
+* `router-server.ts`, so the result is serialized through a WHATWG URL here
+* too (`/a/%2e%2e//b` → `/b`, `?q="x"` → `?q=%22x%22`, as observed). It runs
+* before basePath handling, so `//` → `/`, `/docs//` → `/docs/` and
+* `//evil.com` → `/evil.com`. Percent-encoded `%2F`/`%5C` are not touched and
+* keep falling through to `isOpenRedirectShaped` (404), as in Next.js.
+*
+* The Location is always same-origin. Absolute-form request targets
+* (`GET http://host//x`) are left alone. A collapsed path that still starts
+* with an encoded slash or backslash (`//%2Fevil.com`, `/.//%2Fevil.com`) is
+* never echoed into a Location or routed: it gets a 404 instead.
+*
+* @param rawUrl - The raw request target: pathname plus optional `?query`
+*/
+function getRepeatedSlashRedirect(rawUrl) {
+	if (!rawUrl.startsWith("/")) return null;
+	const urlParts = rawUrl.split("?");
+	const pathname = urlParts[0];
+	if (!REPEATED_SLASH_OR_BACKSLASH_RE.test(pathname)) return null;
+	const cleanUrl = pathname.replaceAll("\\", "/").replace(/\/\/+/g, "/") + (urlParts[1] ? `?${urlParts.slice(1).join("?")}` : "");
+	const parsed = new URL(REDIRECT_LOCATION_BASE + cleanUrl);
+	const location = parsed.pathname + parsed.search + parsed.hash;
+	return isOpenRedirectShaped(location) ? { status: 404 } : {
+		status: 308,
+		location
+	};
+}
+function repeatedSlashRedirectHeaders(location) {
+	return {
+		Location: location,
+		Refresh: `0;url=${location}`
+	};
+}
+/**
+* Build the Response for a raw request path containing a backslash or a
+* repeated slash. See `getRepeatedSlashRedirect`.
+*/
+function repeatedSlashRedirectResponse(rawUrl) {
+	const redirect = getRepeatedSlashRedirect(rawUrl);
+	if (!redirect) return null;
+	if (redirect.status === 404) return notFoundResponse();
+	return new Response(redirect.location, {
+		status: 308,
+		headers: repeatedSlashRedirectHeaders(redirect.location)
+	});
+}
+/**
+* Node `ServerResponse` counterpart of `repeatedSlashRedirectResponse`, for
+* entries that see the raw request target (dev and `vinext start`). Returns
+* true when a response was sent.
+*/
+function sendRepeatedSlashRedirect(rawUrl, res) {
+	const redirect = getRepeatedSlashRedirect(rawUrl);
+	if (!redirect) return false;
+	if (redirect.status === 404) {
+		res.writeHead(404);
+		res.end("This page could not be found");
+		return true;
+	}
+	res.writeHead(308, repeatedSlashRedirectHeaders(redirect.location));
+	res.end(redirect.location);
+	return true;
+}
 //#endregion
-export { isOpenRedirectShaped };
+export { getRepeatedSlashRedirect, isOpenRedirectShaped, repeatedSlashRedirectResponse, sendRepeatedSlashRedirect };

package/dist/server/pages-api-route.js

@@ -3,6 +3,8 @@ import "./server-globals.js";
 import { NextRequest } from "../shims/server.js";
 import { internalServerErrorResponse } from "./http-error-responses.js";
 import { cloneRequestWithUrl } from "./request-pipeline.js";
+import { markRouteCacheabilityExplicitResponsePolicy } from "../shims/cacheability-classification.js";
+import { hasCdnResponsePolicy } from "./cache-control.js";
 import { mergeRouteParamsIntoQuery, parseQueryString, urlQueryToSearchParams } from "../utils/query.js";
 import { tracePagesApiHandler } from "./pages-execution-tracing.js";
 import { resolveBodyParserConfig } from "./pages-body-parser-config.js";
@@ -29,8 +31,12 @@ function isNodeApiRouteModule(module) {
 	return typeof module.default === "function" && !isEdgeApiRuntime(resolveModuleRuntime(module));
 }
 async function handlePagesApiRoute(options) {
-	if (options.ctx) return runWithExecutionContext(options.ctx, () => _handlePagesApiRoute(options));
-	return _handlePagesApiRoute(options);
+	const run = async () => {
+		const response = await _handlePagesApiRoute(options);
+		if (hasCdnResponsePolicy(response.headers)) markRouteCacheabilityExplicitResponsePolicy();
+		return response;
+	};
+	return options.ctx ? runWithExecutionContext(options.ctx, run) : run();
 }
 async function _handlePagesApiRoute(options) {
 	if (!options.match) return new Response("404 - API route not found", { status: 404 });

package/dist/server/pages-asset-tags.d.ts

@@ -9,6 +9,7 @@
  * unit-testable and lives in a normal typed module rather than a codegen
  * template string.
  */
+export declare function getSharedChunkFiles(manifest: Record<string, string[]>): string[];
 /**
  * Resolve the effective SSR manifest: prefer the caller-supplied object and
  * fall back to the registered client build metadata.