vinext 1.0.1 → 1.1.0

package/dist/server/middleware-matcher-pattern.js

@@ -1,4 +1,4 @@
-import { analyzeRegexSafety, regexAtomsMayOverlap } from "../utils/regex-safety.js";
+import { analyzeRegexSafety, mayHaveNamedGroups, regexAtomsMayOverlap } from "../utils/regex-safety.js";
 import { middlewarePathTokensToRegExp, normalizeMiddlewarePathTokens, parseMiddlewarePath } from "./middleware-path-to-regexp.js";
 //#region src/server/middleware-matcher-pattern.ts
 const MATCHER_OBJECT_KEYS = /* @__PURE__ */ new Set([
@@ -138,8 +138,11 @@ function hasOverlappingSequentialRepetition(pattern) {
 	}
 	return false;
 }
-function unsafeTokenReason(token) {
-	const regexSafetyIssue = analyzeRegexSafety(token.pattern, { ignoreCase: true });
+function unsafeTokenReason(token, namedGroups) {
+	const regexSafetyIssue = analyzeRegexSafety(token.pattern, {
+		ignoreCase: true,
+		namedGroups
+	});
 	if (regexSafetyIssue) {
 		if (regexSafetyIssue === "analysis budget exceeded") return `parameter "${token.name}" exceeds the regex analysis budget`;
 		return `parameter "${token.name}" contains ${regexSafetyIssue}`;
@@ -150,9 +153,10 @@ function unsafeTokenReason(token) {
 	return null;
 }
 function validateTokens(tokens) {
+	const namedGroups = tokens.some((token) => typeof token !== "string" && mayHaveNamedGroups(token.pattern));
 	for (const token of tokens) {
 		if (typeof token === "string") continue;
-		const reason = unsafeTokenReason(token);
+		const reason = unsafeTokenReason(token, namedGroups);
 		if (reason) return reason;
 	}
 	return null;

package/dist/server/middleware-response-headers.js

@@ -1,3 +1,4 @@
+import "./headers.js";
 //#region src/server/middleware-response-headers.ts
 const ADDITIVE_RESPONSE_HEADER_NAMES = /* @__PURE__ */ new Set(["set-cookie", "vary"]);
 function mergeVaryHeader(target, value) {
@@ -28,6 +29,7 @@ function mergeMiddlewareResponseHeaders(target, middlewareHeaders) {
 	if (!middlewareHeaders) return;
 	for (const [key, value] of middlewareHeaders) {
 		const lowerName = key.toLowerCase();
+		if (lowerName === "x-vinext-special-error-status") continue;
 		if (lowerName === "link" && !value) continue;
 		if (lowerName === "vary") {
 			mergeVaryHeader(target, value);

package/dist/server/multi-stage.d.ts

@@ -21,6 +21,14 @@ export type VinextResponseStageDispatchOptions = {
    * opt into completed-response admission and honor core's `no-store` policy.
    */
   cache: "shared" | "bypass";
+  /**
+   * Render an App page document whole before its first byte, as Next.js
+   * renders a static page, so its streamed metadata is in `<head>`. An adapter
+   * sets this for a render no client is waiting on, such as a regeneration or
+   * a deployment warm-up. It is not a cache selector: a transport must not
+   * partition its lookup or stored entry by it.
+   */
+  renderWholeDocument?: boolean;
   /**
    * Query-free identity of a shared App page GET/HEAD dispatch, supplied only
    * to adapters that declare `responseStageCacheIdentity: "query-free"` and

package/dist/server/navigation-planner.js

@@ -1,8 +1,8 @@
 import { splitPathnameForRouteMatch } from "../routing/utils.js";
 import { stripBasePath } from "../utils/base-path.js";
+import { matchRoutePattern, matchRoutePatternPrefix, matchRoutePatternWithOptionalDynamicSegments } from "../routing/route-pattern.js";
 import { AppElementsWire, compareAppElementsSlotIds } from "./app-elements-wire.js";
 import "./app-elements.js";
-import { matchRoutePattern, matchRoutePatternPrefix, matchRoutePatternWithOptionalDynamicSegments } from "../routing/route-pattern.js";
 import { resolveHardNavigationTargetFromRscResponse, resolveRscCompatibilityNavigationDecision } from "./app-rsc-cache-busting.js";
 import { resolveRscRedirectLifecycleHop, resolveStreamedRscRedirectLifecycleHop } from "./app-browser-rsc-redirect.js";
 import { NavigationTraceReasonCodes, createNavigationLifecycleTraceFields, createNavigationTrace } from "./navigation-trace.js";

package/dist/server/node-response-signal.d.ts

@@ -0,0 +1,16 @@
+import { Writable } from "node:stream";
+//#region src/server/node-response-signal.d.ts
+export declare class ResponseAborted extends Error {
+  readonly name = "ResponseAborted";
+}
+/**
+ * Creates an AbortSignal tied to the closing of a ServerResponse.
+ *
+ * The incoming request cannot be used: once its body has been fully read the
+ * readable side is done, so a later client disconnect fires nothing on it
+ * (and its `close` event also fires on normal requests). If `finish` fires
+ * first, `res.end()` completed and the following `close` is our own teardown;
+ * if `close` fires first, the client disconnected before we finished.
+ */
+export declare function signalFromNodeResponse(response: Writable): AbortSignal;
+//#endregion

package/dist/server/node-response-signal.js

@@ -0,0 +1,26 @@
+//#region src/server/node-response-signal.ts
+const ResponseAbortedName = "ResponseAborted";
+var ResponseAborted = class extends Error {
+	name = ResponseAbortedName;
+};
+/**
+* Creates an AbortSignal tied to the closing of a ServerResponse.
+*
+* The incoming request cannot be used: once its body has been fully read the
+* readable side is done, so a later client disconnect fires nothing on it
+* (and its `close` event also fires on normal requests). If `finish` fires
+* first, `res.end()` completed and the following `close` is our own teardown;
+* if `close` fires first, the client disconnected before we finished.
+*/
+function signalFromNodeResponse(response) {
+	const { errored, destroyed } = response;
+	if (errored || destroyed) return AbortSignal.abort(errored ?? new ResponseAborted());
+	const controller = new AbortController();
+	response.once("close", () => {
+		if (response.writableFinished) return;
+		controller.abort(new ResponseAborted());
+	});
+	return controller.signal;
+}
+//#endregion
+export { ResponseAborted, signalFromNodeResponse };

package/dist/server/open-redirect.d.ts

@@ -8,4 +8,51 @@
  * to resolve a `Location` containing the pathname as protocol-relative.
  */
 export declare function isOpenRedirectShaped(rawPathname: string): boolean;
+/**
+ * What a request entry answers for a raw path containing a backslash or a
+ * repeated slash: Next.js's 308, or a 404 when the collapsed path would still
+ * be open-redirect shaped.
+ */
+export type RepeatedSlashRedirect = {
+  status: 308;
+  location: string;
+} | {
+  status: 404;
+};
+/**
+ * Returns Next.js's redirect for a raw request path containing a backslash or
+ * a repeated slash, or `null` when the path needs no change.
+ *
+ * Ported from Next.js's request entry (`base-server.ts` / `resolve-routes.ts`,
+ * via `normalizeRepeatedSlashes` in `shared/lib/utils.ts`): backslashes in the
+ * path become `/`, runs of slashes collapse to one and the query is kept.
+ * `next start` then builds the Location with `url.format(parseUrl(...))` in
+ * `router-server.ts`, so the result is serialized through a WHATWG URL here
+ * too (`/a/%2e%2e//b` → `/b`, `?q="x"` → `?q=%22x%22`, as observed). It runs
+ * before basePath handling, so `//` → `/`, `/docs//` → `/docs/` and
+ * `//evil.com` → `/evil.com`. Percent-encoded `%2F`/`%5C` are not touched and
+ * keep falling through to `isOpenRedirectShaped` (404), as in Next.js.
+ *
+ * The Location is always same-origin. Absolute-form request targets
+ * (`GET http://host//x`) are left alone. A collapsed path that still starts
+ * with an encoded slash or backslash (`//%2Fevil.com`, `/.//%2Fevil.com`) is
+ * never echoed into a Location or routed: it gets a 404 instead.
+ *
+ * @param rawUrl - The raw request target: pathname plus optional `?query`
+ */
+export declare function getRepeatedSlashRedirect(rawUrl: string): RepeatedSlashRedirect | null;
+/**
+ * Build the Response for a raw request path containing a backslash or a
+ * repeated slash. See `getRepeatedSlashRedirect`.
+ */
+export declare function repeatedSlashRedirectResponse(rawUrl: string): Response | null;
+/**
+ * Node `ServerResponse` counterpart of `repeatedSlashRedirectResponse`, for
+ * entries that see the raw request target (dev and `vinext start`). Returns
+ * true when a response was sent.
+ */
+export declare function sendRepeatedSlashRedirect(rawUrl: string, res: {
+  writeHead(status: number, headers?: Record<string, string>): unknown;
+  end(body: string): unknown;
+}): boolean;
 //#endregion

package/dist/server/open-redirect.js

@@ -1,3 +1,4 @@
+import { notFoundResponse } from "./http-error-responses.js";
 //#region src/server/open-redirect.ts
 /**
 * Returns true if a request pathname looks like a protocol-relative open
@@ -17,5 +18,77 @@ function isOpenRedirectShaped(rawPathname) {
 	}
 	return false;
 }
+const REPEATED_SLASH_OR_BACKSLASH_RE = /\\|\/\//;
+const REDIRECT_LOCATION_BASE = "http://vinext.invalid";
+/**
+* Returns Next.js's redirect for a raw request path containing a backslash or
+* a repeated slash, or `null` when the path needs no change.
+*
+* Ported from Next.js's request entry (`base-server.ts` / `resolve-routes.ts`,
+* via `normalizeRepeatedSlashes` in `shared/lib/utils.ts`): backslashes in the
+* path become `/`, runs of slashes collapse to one and the query is kept.
+* `next start` then builds the Location with `url.format(parseUrl(...))` in
+* `router-server.ts`, so the result is serialized through a WHATWG URL here
+* too (`/a/%2e%2e//b` → `/b`, `?q="x"` → `?q=%22x%22`, as observed). It runs
+* before basePath handling, so `//` → `/`, `/docs//` → `/docs/` and
+* `//evil.com` → `/evil.com`. Percent-encoded `%2F`/`%5C` are not touched and
+* keep falling through to `isOpenRedirectShaped` (404), as in Next.js.
+*
+* The Location is always same-origin. Absolute-form request targets
+* (`GET http://host//x`) are left alone. A collapsed path that still starts
+* with an encoded slash or backslash (`//%2Fevil.com`, `/.//%2Fevil.com`) is
+* never echoed into a Location or routed: it gets a 404 instead.
+*
+* @param rawUrl - The raw request target: pathname plus optional `?query`
+*/
+function getRepeatedSlashRedirect(rawUrl) {
+	if (!rawUrl.startsWith("/")) return null;
+	const urlParts = rawUrl.split("?");
+	const pathname = urlParts[0];
+	if (!REPEATED_SLASH_OR_BACKSLASH_RE.test(pathname)) return null;
+	const cleanUrl = pathname.replaceAll("\\", "/").replace(/\/\/+/g, "/") + (urlParts[1] ? `?${urlParts.slice(1).join("?")}` : "");
+	const parsed = new URL(REDIRECT_LOCATION_BASE + cleanUrl);
+	const location = parsed.pathname + parsed.search + parsed.hash;
+	return isOpenRedirectShaped(location) ? { status: 404 } : {
+		status: 308,
+		location
+	};
+}
+function repeatedSlashRedirectHeaders(location) {
+	return {
+		Location: location,
+		Refresh: `0;url=${location}`
+	};
+}
+/**
+* Build the Response for a raw request path containing a backslash or a
+* repeated slash. See `getRepeatedSlashRedirect`.
+*/
+function repeatedSlashRedirectResponse(rawUrl) {
+	const redirect = getRepeatedSlashRedirect(rawUrl);
+	if (!redirect) return null;
+	if (redirect.status === 404) return notFoundResponse();
+	return new Response(redirect.location, {
+		status: 308,
+		headers: repeatedSlashRedirectHeaders(redirect.location)
+	});
+}
+/**
+* Node `ServerResponse` counterpart of `repeatedSlashRedirectResponse`, for
+* entries that see the raw request target (dev and `vinext start`). Returns
+* true when a response was sent.
+*/
+function sendRepeatedSlashRedirect(rawUrl, res) {
+	const redirect = getRepeatedSlashRedirect(rawUrl);
+	if (!redirect) return false;
+	if (redirect.status === 404) {
+		res.writeHead(404);
+		res.end("This page could not be found");
+		return true;
+	}
+	res.writeHead(308, repeatedSlashRedirectHeaders(redirect.location));
+	res.end(redirect.location);
+	return true;
+}
 //#endregion
-export { isOpenRedirectShaped };
+export { getRepeatedSlashRedirect, isOpenRedirectShaped, repeatedSlashRedirectResponse, sendRepeatedSlashRedirect };

package/dist/server/pages-page-handler.js

@@ -1,6 +1,7 @@
 import { preserveFullyBufferedBodyMetadata } from "./fully-buffered-response.js";
 import { closeAfterResponse, closeAfterResponseWithBody, createRequestContext, runWithRequestContext } from "../shims/unified-request-context.js";
 import { PRERENDER_REVALIDATE_HEADER } from "../utils/protocol-headers.js";
+import { normalizePathnameForRouteMatch } from "../routing/utils.js";
 import { patternToNextFormat } from "../routing/route-validation.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
 import { NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, VINEXT_CACHE_HEADER, VINEXT_REVALIDATED_CACHE_TAG_HEADER } from "./headers.js";
@@ -187,7 +188,7 @@ function createPagesPageHandler(opts) {
 			redirectUrl: void 0
 		};
 		const locale = localeInfo.locale;
-		const routeUrl = localeInfo.url;
+		let routeUrl = localeInfo.url;
 		const currentDefaultLocale = i18nConfig ? localeInfo.domainLocale ? localeInfo.domainLocale.defaultLocale : i18nConfig.defaultLocale : void 0;
 		const domainLocales = i18nConfig ? i18nConfig.domains : void 0;
 		const pageIsrCacheKey = isrCacheKeyForRequest(i18nConfig ? localeInfo.domainLocale ? JSON.stringify([String(localeInfo.domainLocale.domain).toLowerCase(), locale]) : "locale:" + String(locale) : null);
@@ -216,6 +217,22 @@ function createPagesPageHandler(opts) {
 				renderAsPath = routeUrl;
 			} else return buildDefaultPagesNotFoundResponse();
 		}
+		const routePathname = routeUrl.split("?")[0];
+		const cachePathname = normalizePathnameForRouteMatch(routePathname);
+		let cacheIdentityDiverges = false;
+		if (!isRouteMissErrorRender && options?.__forcedRoute === void 0 && cachePathname !== routePathname) {
+			const cachePathRoute = matchRoute(cachePathname, pageRoutes)?.route;
+			if (cachePathRoute !== match.route) {
+				const cachePathModule = cachePathRoute?.module;
+				if (match.route.isDynamic && typeof match.route.module.getStaticProps === "function" && cachePathRoute && !cachePathRoute.isDynamic && typeof cachePathModule?.getStaticProps === "function" && typeof cachePathModule.getServerSideProps !== "function" && getPagesPreviewState(request.headers.get("cookie"), { isOnDemandRevalidate: isOnDemandRevalidateRequest(request.headers.get("x-prerender-revalidate")) }).data === false) {
+					match = {
+						route: cachePathRoute,
+						params: {}
+					};
+					routeUrl = cachePathname + routeUrl.slice(routePathname.length);
+				} else cacheIdentityDiverges = true;
+			}
+		}
 		const { route, params } = match;
 		const pageModule = traceFindPageComponents(route.pattern, () => route.module);
 		const isStaticPropsRoute = typeof pageModule.getStaticProps === "function";
@@ -234,10 +251,10 @@ function createPagesPageHandler(opts) {
 			});
 			else recordRouteCacheability({ cacheable: false });
 		}
-		const routeIsrGet = isCacheabilityProbe ? async () => null : isrGet;
-		const routeIsrSet = isCacheabilityProbe ? async () => {} : isrSet;
+		const routeIsrGet = isCacheabilityProbe || cacheIdentityDiverges ? async () => null : isrGet;
+		const routeIsrSet = isCacheabilityProbe || cacheIdentityDiverges ? async () => {} : isrSet;
 		const isStaticPropsRender = isStaticPropsRoute && typeof pageModule.getServerSideProps !== "function";
-		if (!options?.__skipOnDemandCoalesce && !options?.__forcedRoute && isStaticPropsRoute && isOnDemandRevalidateRequest(request.headers.get("x-prerender-revalidate"))) {
+		if (!options?.__skipOnDemandCoalesce && !options?.__forcedRoute && !cacheIdentityDiverges && isStaticPropsRoute && isOnDemandRevalidateRequest(request.headers.get("x-prerender-revalidate"))) {
 			const cacheKey = pageIsrCacheKey("pages", routeUrl.split("?")[0]);
 			const snapshot = await coalesceOnDemandRevalidation(cacheKey, async () => {
 				const response = await renderPage(request, url, manifest, middlewareHeaders, {

package/dist/server/pages-request-stage-entry.js

@@ -6,8 +6,7 @@ import { hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { runWithExecutionContext } from "../shims/request-context.js";
 import { VINEXT_CACHEABILITY_PROBE_QUERY_PARAM, VINEXT_EXPECTED_WORKER_VERSION_HEADER } from "./headers.js";
 import { notFoundStaticAssetResponse } from "./http-error-responses.js";
-import { isOpenRedirectShaped } from "./open-redirect.js";
-import { attachRequestCfMetadata, cloneRequestWithHeaders, cloneRequestWithUrl, filterInternalHeaders } from "./request-pipeline.js";
+import { attachRequestCfMetadata, cloneRequestWithHeaders, cloneRequestWithUrl, filterInternalHeaders, guardProtocolRelativeUrl } from "./request-pipeline.js";
 import { normalizeDefaultLocalePathname } from "./pages-i18n.js";
 import { getExplicitCdnCacheAdapter } from "../shims/cdn-cache-state.js";
 import { CACHEABILITY_REQUEST_STATE } from "../shims/cacheability-classification.js";
@@ -148,7 +147,8 @@ async function handleRequestImpl(request, env, platformCtx, dispatchResponseStag
 			requestHost: url.host,
 			stagedHeaders: null
 		}, { cache: "bypass" }, env, ctx);
-		if (isOpenRedirectShaped(pathname)) return new Response("This page could not be found", { status: 404 });
+		const protocolRelativeGuard = guardProtocolRelativeUrl(pathname, url.search);
+		if (protocolRelativeGuard) return protocolRelativeGuard;
 		try {
 			normalizePathnameForRouteMatchStrict(pathname);
 		} catch {
@@ -166,6 +166,7 @@ async function handleRequestImpl(request, env, platformCtx, dispatchResponseStag
 			}
 		}
 		const middlewareRequest = request;
+		const originalRenderUrl = pathname + new URL(request.url).search;
 		const dataNorm = normalizeDataRequest(request);
 		if (dataNorm.notFoundResponse && !vinextConfig?.skipProxyUrlNormalize) return dataNorm.notFoundResponse;
 		const isDataReq = dataNorm.isDataReq;
@@ -229,7 +230,10 @@ async function handleRequestImpl(request, env, platformCtx, dispatchResponseStag
 					kind: "pages-page",
 					protocolVersion: 4,
 					requestHost: new URL(req.url).host,
-					renderOptions: options ?? null,
+					renderOptions: isDataReq ? {
+						...options,
+						originalUrl: originalRenderUrl
+					} : options ?? null,
 					resolvedUrl,
 					stagedHeaders: isSharedStaticPage ? null : [...stagedHeaders ?? new Headers()]
 				});

package/dist/server/prod-server.d.ts

@@ -2,6 +2,7 @@ import { NextI18nConfig } from "../config/next-config.js";
 import { negotiateEncoding } from "./accept-encoding.js";
 import { StaticFileCache } from "./static-file-cache.js";
 import { resolveRequestHost, trustProxy, trustedHosts } from "./proxy-trust.js";
+import { COMPRESS_THRESHOLD, isCompressibleContentType } from "./response-compression.js";
 import { IncomingMessage, ServerResponse } from "node:http";
 //#region src/server/prod-server.d.ts
 /**
@@ -68,10 +69,6 @@ export type ProdServerOptions = {
   /** Suppress the startup log for internal child-process servers. */
   silent?: boolean;
 };
-/** Content types that benefit from compression. */
-declare const COMPRESSIBLE_TYPES: Set<string>;
-/** Minimum size threshold for compression (in bytes). Below this, compression overhead isn't worth it. */
-declare const COMPRESS_THRESHOLD = 1024;
 /**
  * Merge middleware headers and a Web Response's headers into a single
  * record suitable for Node.js `res.writeHead()`. Uses `getSetCookie()`
@@ -104,15 +101,19 @@ declare function sendCompressed(req: IncomingMessage, res: ServerResponse, body:
  *
  * Without a cache, falls back to async filesystem probing (still non-blocking,
  * unlike the old sync existsSync/statSync approach).
+ *
+ * `extraHeaders` go on every response for the file. `representationHeaders` go
+ * only on responses that carry the file's bytes (200 and 206), never on a 304,
+ * 412, 416 or 405.
  */
-declare function tryServeStatic(req: IncomingMessage, res: ServerResponse, clientDir: string, pathname: string, compress: boolean, cache?: StaticFileCache, extraHeaders?: Record<string, string | string[]>, statusCode?: number): Promise<boolean>;
+declare function tryServeStatic(req: IncomingMessage, res: ServerResponse, clientDir: string, pathname: string, compress: boolean, cache?: StaticFileCache, extraHeaders?: Record<string, string | string[]>, statusCode?: number, representationHeaders?: Record<string, string>): Promise<boolean>;
 /**
  * Convert a Node.js IncomingMessage to a Web Request object.
  *
  * When `urlOverride` is provided, it is used as the path + query string
  * instead of `req.url`.
  */
-declare function nodeToWebRequest(req: IncomingMessage, urlOverride?: string, prerenderSecret?: string, i18nConfig?: NextI18nConfig | null, authorizeOnDemandRevalidate?: (headerValue: string | null) => boolean): Request;
+declare function nodeToWebRequest(req: IncomingMessage, urlOverride?: string, prerenderSecret?: string, i18nConfig?: NextI18nConfig | null, authorizeOnDemandRevalidate?: (headerValue: string | null) => boolean, signal?: AbortSignal): Request;
 /**
  * Stream a Web Response back to a Node.js ServerResponse.
  * Supports streaming compression for SSR responses.
@@ -155,4 +156,4 @@ export declare function resolveAppRouterPrerenderSeeder(entryModule: unknown): A
  */
 export declare function resolveAppRouterAssetPath(pathname: string, assetPathPrefix: string, assetPrefix: string): string | null;
 //#endregion
-export { COMPRESSIBLE_TYPES, COMPRESS_THRESHOLD, mergeResponseHeaders, mergeWebResponse, negotiateEncoding, nodeToWebRequest, resolveRequestHost as resolveHost, sendCompressed, sendWebResponse, trustProxy, trustedHosts, tryServeStatic, waitForNodeResponseCompletion };
+export { COMPRESS_THRESHOLD, isCompressibleContentType, mergeResponseHeaders, mergeWebResponse, negotiateEncoding, nodeToWebRequest, resolveRequestHost as resolveHost, sendCompressed, sendWebResponse, trustProxy, trustedHosts, tryServeStatic, waitForNodeResponseCompletion };