vinext 1.0.1 → 1.1.0

package/dist/server/prod-server.js

@@ -5,18 +5,20 @@ import { ASSET_PREFIX_URL_DIR, assetPrefixPathname, isAbsoluteAssetPrefix } from
 import { StaticFileCache, contentTypeForPath, etagFromFilenameHash } from "./static-file-cache.js";
 import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
-import { VINEXT_PRERENDER_RENDER_ERROR_HEADER } from "./headers.js";
+import { VINEXT_PRERENDER_RENDER_ERROR_HEADER, VINEXT_PRERENDER_SPECIAL_ERROR_HEADER } from "./headers.js";
 import { normalizePath } from "./normalize-path.js";
 import { notFoundResponse } from "./http-error-responses.js";
-import { isOpenRedirectShaped } from "./open-redirect.js";
+import { isOpenRedirectShaped, sendRepeatedSlashRedirect } from "./open-redirect.js";
 import { readStaticFileSignal } from "./static-file-signal.js";
 import { canonicalizeRequestPathname, filterInternalHeaders } from "./request-pipeline.js";
+import { buildCacheStateHeaders } from "./cache-headers.js";
 import { parseHttpDate } from "./http-date.js";
 import { evaluateStaticPreconditions } from "./http-conditional.js";
 import { buildNextDataNotFoundResponse, encodeUrlParserIgnoredCharacters, isNextDataPathname, normalizeNextDataPagePathname, parseNextDataPathname, shouldAddTrailingSlashToPagesDataPath, urlParserCreatesPagesDataPath } from "./pages-data-route.js";
 import { setPagesClientAssets } from "./pages-client-assets.js";
 import { resolveRequestHost, resolveRequestProtocol, trustProxy, trustedHosts } from "./proxy-trust.js";
-import { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, isImageOptimizationPath, isSafeImageContentType, parseImageParams } from "./image-optimization.js";
+import { signalFromNodeResponse } from "./node-response-signal.js";
+import { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, IMAGE_RESPONSE_CACHE_STATE, isImageOptimizationPath, isSafeImageContentType, parseImageParams } from "./image-optimization.js";
 import { installSocketErrorBackstop } from "./socket-error-backstop.js";
 import { collectInlineCssManifest } from "../build/inline-css.js";
 import { readTrustedRevalidationHostname } from "./revalidation-host.js";
@@ -24,11 +26,12 @@ import { traceFrameworkRequest } from "./request-tracing.js";
 import { mergeHeaders } from "./worker-utils.js";
 import { runPagesRequest, wrapMiddlewareWithBasePath } from "./pages-request-pipeline.js";
 import { computeClientRuntimeMetadata } from "../utils/client-runtime-metadata.js";
-import { readPrerenderSecret } from "../build/server-manifest.js";
+import { readPrerenderSecret, readServerCompress } from "../build/server-manifest.js";
 import { readTrustedPrerenderRouteParamsFromHeaders, serializePrerenderRouteParamsHeader } from "./prerender-route-params.js";
 import { registerPrerenderCloudflareLoader } from "../build/prerender-cloudflare-loader.js";
 import { seedMemoryCacheFromPrerender } from "./seed-cache.js";
 import { negotiateEncoding, parseAcceptedEncodings, selectContentEncoding } from "./accept-encoding.js";
+import { COMPRESS_THRESHOLD, hasNoTransform, isCompressibleContentType, parseContentLengthHeader, resolveResponseCompression } from "./response-compression.js";
 import { ifRangeAllowsRange, parseByteRange } from "./http-range.js";
 import { createRequire } from "node:module";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -192,25 +195,6 @@ function readNodeStream(req) {
 		}
 	});
 }
-/** Content types that benefit from compression. */
-const COMPRESSIBLE_TYPES = /* @__PURE__ */ new Set([
-	"text/html",
-	"text/css",
-	"text/plain",
-	"text/xml",
-	"text/javascript",
-	"application/javascript",
-	"application/json",
-	"application/xml",
-	"application/xhtml+xml",
-	"application/rss+xml",
-	"application/atom+xml",
-	"image/svg+xml",
-	"application/manifest+json",
-	"application/wasm"
-]);
-/** Minimum size threshold for compression (in bytes). Below this, compression overhead isn't worth it. */
-const COMPRESS_THRESHOLD = 1024;
 /**
 * Create a compression stream for the given encoding.
 */
@@ -276,12 +260,14 @@ const NO_BODY_RESPONSE_STATUSES = /* @__PURE__ */ new Set([
 	205,
 	304
 ]);
+const IMAGE_REPRESENTATION_HEADERS = buildCacheStateHeaders(IMAGE_RESPONSE_CACHE_STATE);
 const OMIT_BODY_HEADERS = /* @__PURE__ */ new Set(["content-length", "content-type"]);
 const OMIT_STATIC_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
 	"content-encoding",
 	"content-length",
 	"content-range",
-	"content-type"
+	"content-type",
+	VINEXT_PRERENDER_SPECIAL_ERROR_HEADER
 ]);
 function omitHeadersCaseInsensitive(headersRecord, targets) {
 	const filtered = {};
@@ -291,6 +277,23 @@ function omitHeadersCaseInsensitive(headersRecord, targets) {
 	}
 	return filtered;
 }
+function readHeaderCaseInsensitive(headersRecord, name) {
+	const key = Object.keys(headersRecord).find((entry) => entry.toLowerCase() === name);
+	if (key === void 0) return void 0;
+	const value = headersRecord[key];
+	return Array.isArray(value) ? value.join(", ") : value;
+}
+/** Remove one field name from a Vary header, dropping the header if it empties. */
+function omitVaryToken(headers, token) {
+	const varyKey = Object.keys(headers).find((key) => key.toLowerCase() === "vary");
+	if (varyKey === void 0) return headers;
+	const rawVary = headers[varyKey];
+	const remaining = (Array.isArray(rawVary) ? rawVary.join(",") : rawVary).split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0 && entry.toLowerCase() !== token.toLowerCase());
+	const result = { ...headers };
+	delete result[varyKey];
+	if (remaining.length > 0) result[varyKey] = remaining.join(", ");
+	return result;
+}
 function mergeVaryHeader(headers, value) {
 	const merged = { ...headers };
 	const existingKey = Object.keys(merged).find((key) => key.toLowerCase() === "vary");
@@ -337,6 +340,32 @@ function cancelResponseBody(response) {
 	if (!body || body.locked) return;
 	body.cancel().catch(() => {});
 }
+/**
+* Buffer a response body, cancelling it if the client disconnects first so a
+* stalled stream does not outlive the connection. Resolves null when aborted.
+*/
+async function bufferResponseBodyUntilAborted(response, signal) {
+	const body = response.body;
+	if (!body) return Buffer.alloc(0);
+	const reader = body.getReader();
+	const cancel = () => {
+		reader.cancel(signal.reason).catch(() => {});
+	};
+	if (signal.aborted) cancel();
+	else signal.addEventListener("abort", cancel, { once: true });
+	const chunks = [];
+	try {
+		while (true) {
+			const result = await reader.read();
+			if (result.done) break;
+			chunks.push(result.value);
+		}
+	} finally {
+		signal.removeEventListener("abort", cancel);
+		reader.releaseLock();
+	}
+	return signal.aborted ? null : Buffer.concat(chunks);
+}
 function isVinextStreamedHtmlResponse(response) {
 	return response.__vinextStreamedHtmlResponse === true;
 }
@@ -370,24 +399,23 @@ function mergeWebResponse(middlewareHeaders, response, statusOverride) {
 */
 function sendCompressed(req, res, body, contentType, statusCode, extraHeaders = {}, compress = true, statusText) {
 	const buf = typeof body === "string" ? Buffer.from(body) : body;
-	const baseType = contentType.split(";")[0].trim();
-	const varyByEncoding = compress && COMPRESSIBLE_TYPES.has(baseType);
-	const encoding = compress ? negotiateEncoding(req) : "identity";
 	const headersWithoutBodyHeaders = omitHeadersCaseInsensitive(extraHeaders, OMIT_BODY_HEADERS);
+	const { varyAcceptEncoding: varyByEncoding, encoding } = resolveResponseCompression(req, compress, {
+		contentType,
+		cacheControl: readHeaderCaseInsensitive(extraHeaders, "cache-control"),
+		contentEncoding: readHeaderCaseInsensitive(extraHeaders, "content-encoding"),
+		contentLength: buf.length
+	});
 	const writeHead = (headers, responseStatus = statusCode, responseStatusText = statusText) => {
 		if (responseStatusText) res.writeHead(responseStatus, responseStatusText, headers);
 		else res.writeHead(responseStatus, headers);
 	};
-	if (encoding !== "identity" && varyByEncoding && buf.length >= 1024) {
+	if (encoding !== "identity") {
 		writeHead(mergeVaryHeader({
 			...headersWithoutBodyHeaders,
 			"Content-Type": contentType,
 			"Content-Encoding": encoding
 		}, "Accept-Encoding"));
-		if (req.method === "HEAD") {
-			res.end();
-			return;
-		}
 		const compressor = createCompressor(encoding);
 		compressor.end(buf);
 		pipeline(compressor, res, () => {});
@@ -415,8 +443,12 @@ function sendCompressed(req, res, body, contentType, statusCode, extraHeaders =
 *
 * Without a cache, falls back to async filesystem probing (still non-blocking,
 * unlike the old sync existsSync/statSync approach).
+*
+* `extraHeaders` go on every response for the file. `representationHeaders` go
+* only on responses that carry the file's bytes (200 and 206), never on a 304,
+* 412, 416 or 405.
 */
-async function tryServeStatic(req, res, clientDir, pathname, compress, cache, extraHeaders, statusCode) {
+async function tryServeStatic(req, res, clientDir, pathname, compress, cache, extraHeaders, statusCode, representationHeaders) {
 	if (pathname === "/") return false;
 	const responseStatus = statusCode ?? 200;
 	const omitBody = isNoBodyResponseStatus(responseStatus);
@@ -442,23 +474,27 @@ async function tryServeStatic(req, res, clientDir, pathname, compress, cache, ex
 			sendStaticMethodNotAllowed(res, extraHeaders);
 			return true;
 		}
-		const rawAe = compress ? req.headers["accept-encoding"] : void 0;
+		const encodingAllowed = compress && !hasNoTransform((extraHeaders && readHeaderCaseInsensitive(extraHeaders, "cache-control")) ?? entry.original.headers["Cache-Control"]);
+		const rawAe = encodingAllowed ? req.headers["accept-encoding"] : void 0;
 		const parsed = typeof rawAe === "string" ? parseAcceptedEncodings(rawAe) : void 0;
 		const availableVariants = [
 			...entry.zst ? ["zstd"] : [],
 			...entry.br ? ["br"] : [],
 			...entry.gz ? ["gzip"] : []
 		];
-		const variesByEncoding = compress && availableVariants.length > 0;
+		const variesByEncoding = encodingAllowed && availableVariants.length > 0;
 		const selected = parsed ? selectContentEncoding(parsed, availableVariants) : "identity";
 		const variant = selected === "zstd" ? entry.zst : selected === "br" ? entry.br : selected === "gzip" ? entry.gz : entry.original;
+		const notModifiedBaseHeaders = encodingAllowed ? entry.notModifiedHeaders : omitVaryToken(entry.notModifiedHeaders, "Accept-Encoding");
+		const originalHeaders = encodingAllowed ? entry.original.headers : omitVaryToken(entry.original.headers, "Accept-Encoding");
+		const variantHeaders = variant === entry.original ? originalHeaders : variant.headers;
 		const validators = extraHeaders ? resolveStaticValidators(entry.etag, entry.mtimeMs, extraHeaders) : void 0;
 		const effectiveEtag = validators ? validators.etag : entry.etag;
 		const effectiveMtimeMs = validators ? validators.mtimeMs : entry.mtimeMs;
 		const preconditionResult = responseStatus === 200 ? evaluateRequestPreconditions(req, effectiveEtag, effectiveMtimeMs) : "proceed";
 		if (preconditionResult === "precondition-failed") {
 			res.writeHead(412, {
-				...entry.notModifiedHeaders,
+				...notModifiedBaseHeaders,
 				...extraHeaders,
 				"Content-Type": entry.original.headers["Content-Type"],
 				"Accept-Ranges": "bytes"
@@ -468,10 +504,10 @@ async function tryServeStatic(req, res, clientDir, pathname, compress, cache, ex
 		}
 		if (preconditionResult === "not-modified") {
 			const notModifiedHeaders = variesByEncoding ? mergeVaryHeader({
-				...entry.notModifiedHeaders,
+				...notModifiedBaseHeaders,
 				...extraHeaders
 			}, "Accept-Encoding") : {
-				...entry.notModifiedHeaders,
+				...notModifiedBaseHeaders,
 				...extraHeaders
 			};
 			if (selected !== "identity") notModifiedHeaders["Content-Encoding"] = selected;
@@ -482,7 +518,7 @@ async function tryServeStatic(req, res, clientDir, pathname, compress, cache, ex
 		const range = resolveRequestedRange(requestRange, ifRange, entry.original.size, effectiveEtag ?? "", effectiveMtimeMs, responseStatus);
 		if (range.kind === "unsatisfiable") {
 			res.writeHead(416, {
-				...entry.notModifiedHeaders,
+				...notModifiedBaseHeaders,
 				...extraHeaders,
 				"Content-Type": entry.original.headers["Content-Type"],
 				"Accept-Ranges": "bytes",
@@ -494,8 +530,9 @@ async function tryServeStatic(req, res, clientDir, pathname, compress, cache, ex
 		if (range.kind === "range") {
 			const length = range.end - range.start + 1;
 			const rangeHeaders = {
-				...entry.original.headers,
+				...originalHeaders,
 				...extraHeaders,
+				...representationHeaders,
 				"Accept-Ranges": "bytes",
 				"Content-Length": String(length),
 				"Content-Range": `bytes ${range.start}-${range.end}/${entry.original.size}`
@@ -510,8 +547,9 @@ async function tryServeStatic(req, res, clientDir, pathname, compress, cache, ex
 			return true;
 		}
 		const responseHeaders = {
-			...variant.headers,
+			...variantHeaders,
 			...extraHeaders,
+			...representationHeaders,
 			"Accept-Ranges": "bytes"
 		};
 		res.writeHead(responseStatus, variesByEncoding ? mergeVaryHeader(responseHeaders, "Accept-Encoding") : responseHeaders);
@@ -549,8 +587,6 @@ async function tryServeStatic(req, res, clientDir, pathname, compress, cache, ex
 	const isHashed = pathname.includes(`/${ASSET_PREFIX_URL_DIR}/`);
 	const cacheControl = isHashed ? "public, max-age=31536000, immutable" : "public, max-age=3600";
 	const etag = isHashed && etagFromFilenameHash(resolved.path, ext) || `W/"${resolved.size}-${Math.floor(resolved.mtimeMs / 1e3)}"`;
-	const baseType = ct.split(";")[0].trim();
-	const isCompressible = compress && COMPRESSIBLE_TYPES.has(baseType);
 	const baseHeaders = {
 		"Content-Type": ct,
 		"Cache-Control": cacheControl,
@@ -559,7 +595,12 @@ async function tryServeStatic(req, res, clientDir, pathname, compress, cache, ex
 		"Accept-Ranges": "bytes",
 		...extraHeaders
 	};
-	const encoding = isCompressible ? negotiateEncoding(req) : "identity";
+	const { varyAcceptEncoding: isCompressible, encoding } = resolveResponseCompression(req, compress, {
+		contentType: ct,
+		cacheControl: (extraHeaders && readHeaderCaseInsensitive(extraHeaders, "cache-control")) ?? cacheControl,
+		contentEncoding: extraHeaders && readHeaderCaseInsensitive(extraHeaders, "content-encoding"),
+		contentLength: resolved.size
+	});
 	const validators = extraHeaders ? resolveStaticValidators(etag, resolved.mtimeMs, extraHeaders) : void 0;
 	const effectiveEtag = validators ? validators.etag : etag;
 	const effectiveMtimeMs = validators ? validators.mtimeMs : resolved.mtimeMs;
@@ -595,6 +636,7 @@ async function tryServeStatic(req, res, clientDir, pathname, compress, cache, ex
 		const length = range.end - range.start + 1;
 		const rangeHeaders = {
 			...baseHeaders,
+			...representationHeaders,
 			"Content-Length": String(length),
 			"Content-Range": `bytes ${range.start}-${range.end}/${resolved.size}`
 		};
@@ -609,6 +651,7 @@ async function tryServeStatic(req, res, clientDir, pathname, compress, cache, ex
 	if (isCompressible && encoding !== "identity") {
 		res.writeHead(responseStatus, mergeVaryHeader({
 			...baseHeaders,
+			...representationHeaders,
 			"Content-Encoding": encoding
 		}, "Accept-Encoding"));
 		if (omitBody || req.method === "HEAD") {
@@ -626,6 +669,7 @@ async function tryServeStatic(req, res, clientDir, pathname, compress, cache, ex
 	}
 	const identityHeaders = {
 		...baseHeaders,
+		...representationHeaders,
 		"Content-Length": String(resolved.size)
 	};
 	res.writeHead(responseStatus, isCompressible ? mergeVaryHeader(identityHeaders, "Accept-Encoding") : identityHeaders);
@@ -734,7 +778,7 @@ async function statIfFile(filePath) {
 * When `urlOverride` is provided, it is used as the path + query string
 * instead of `req.url`.
 */
-function nodeToWebRequest(req, urlOverride, prerenderSecret, i18nConfig, authorizeOnDemandRevalidate) {
+function nodeToWebRequest(req, urlOverride, prerenderSecret, i18nConfig, authorizeOnDemandRevalidate, signal) {
 	const proto = resolveRequestProtocol(req);
 	const rawHeaders = nodeHeadersToWebHeaders(req.headers);
 	const revalidationHostname = readTrustedRevalidationHostname(rawHeaders, i18nConfig, authorizeOnDemandRevalidate);
@@ -751,9 +795,10 @@ function nodeToWebRequest(req, urlOverride, prerenderSecret, i18nConfig, authori
 	const hasBody = method !== "GET" && method !== "HEAD";
 	const init = {
 		method,
-		headers
+		headers,
+		signal
 	};
-	if (hasBody) {
+	if (hasBody && !signal?.aborted) {
 		init.body = readNodeStream(req);
 		init.duplex = "half";
 	}
@@ -776,22 +821,23 @@ async function sendWebResponse(webResponse, req, res, compress) {
 		if (existing !== void 0) nodeHeaders[key] = Array.isArray(existing) ? [...existing, value] : [existing, value];
 		else nodeHeaders[key] = value;
 	});
-	const alreadyEncoded = webResponse.headers.get("content-encoding") !== null;
-	if (!webResponse.body) {
-		writeHead(nodeHeaders);
-		res.end();
-		return;
-	}
-	const baseType = (webResponse.headers.get("content-type") ?? "").split(";")[0].trim();
-	const varyByEncoding = compress && !alreadyEncoded && COMPRESSIBLE_TYPES.has(baseType);
-	const encoding = compress && !alreadyEncoded ? negotiateEncoding(req) : "identity";
-	const shouldCompress = encoding !== "identity" && COMPRESSIBLE_TYPES.has(baseType);
+	const { varyAcceptEncoding: varyByEncoding, encoding } = resolveResponseCompression(req, compress, {
+		contentType: webResponse.headers.get("content-type"),
+		cacheControl: webResponse.headers.get("cache-control"),
+		contentEncoding: webResponse.headers.get("content-encoding"),
+		contentLength: webResponse.body ? parseContentLengthHeader(webResponse.headers.get("content-length")) : 0
+	});
+	const shouldCompress = encoding !== "identity";
 	if (shouldCompress) {
 		delete nodeHeaders["content-length"];
-		delete nodeHeaders["Content-Length"];
+		delete nodeHeaders["content-encoding"];
 		nodeHeaders["Content-Encoding"] = encoding;
 	}
 	writeHead(varyByEncoding ? mergeVaryHeader(nodeHeaders, "Accept-Encoding") : nodeHeaders);
+	if (!webResponse.body) {
+		res.end();
+		return;
+	}
 	if (req.method === "HEAD") {
 		cancelResponseBody(webResponse);
 		res.end();
@@ -861,6 +907,7 @@ async function startProdServer(options = {}) {
 		port,
 		host,
 		clientDir,
+		serverDir,
 		serverEntryPath,
 		compress,
 		purpose,
@@ -877,6 +924,23 @@ function createNodeExecutionContext(trustedRevalidateOrigin) {
 		trustedRevalidateOrigin
 	};
 }
+/**
+* Sets the prerender special-error marker only from the page's recorded
+* special error, which middleware, route handlers and external rewrites can't
+* reach, and drops one they set.
+*/
+function markPrerenderSpecialError(response, marker) {
+	const trusted = marker !== void 0 && marker.status === response.status;
+	if (!trusted && !response.headers.has("x-vinext-prerender-special-error")) return response;
+	const headers = new Headers(response.headers);
+	headers.delete(VINEXT_PRERENDER_SPECIAL_ERROR_HEADER);
+	if (trusted) headers.set(VINEXT_PRERENDER_SPECIAL_ERROR_HEADER, JSON.stringify(marker.headers));
+	return new Response(response.body, {
+		headers,
+		status: response.status,
+		statusText: response.statusText
+	});
+}
 function resolveTrustedNodeRevalidateOrigin(req, configuredHost, configuredPort) {
 	const port = req.socket.localPort ?? configuredPort;
 	return `http://${normalizeInternalFetchHost(configuredHost)}:${port}`;
@@ -1008,8 +1072,9 @@ function installPagesClientAssets(options) {
 * 4. Stream the Web Response back (with optional compression)
 */
 async function startAppRouterServer(options) {
-	const { port, host, clientDir, serverDir, rscEntryPath, compress, purpose, silent } = options;
+	const { port, host, clientDir, serverDir, rscEntryPath, compress: compressOption, purpose, silent } = options;
 	const prerenderSecret = readPrerenderSecret(serverDir);
+	const compress = compressOption && readServerCompress(serverDir);
 	const rscModule = await importServerEntryModule(rscEntryPath);
 	const rscEntryRequire = createServerEntryRequire(rscEntryPath);
 	const rscHandler = resolveAppRouterHandler(rscModule.default);
@@ -1048,6 +1113,7 @@ async function startAppRouterServer(options) {
 	const handleRequestImpl = async (req, res) => {
 		const rawUrl = req.url ?? "/";
 		const rawPathname = rawUrl.split("?")[0];
+		if (sendRepeatedSlashRedirect(rawUrl, res)) return;
 		if (isOpenRedirectShaped(rawPathname)) {
 			res.writeHead(404);
 			res.end("This page could not be found");
@@ -1095,14 +1161,23 @@ async function startAppRouterServer(options) {
 				"X-Content-Type-Options": "nosniff",
 				"Content-Disposition": imageConfig?.contentDispositionType === "attachment" ? "attachment" : "inline"
 			};
-			if (await tryServeStatic(req, res, clientDir, params.imageUrl, false, staticCache, imageSecurityHeaders)) return;
+			if (await tryServeStatic(req, res, clientDir, params.imageUrl, false, staticCache, imageSecurityHeaders, void 0, IMAGE_REPRESENTATION_HEADERS)) return;
 			res.writeHead(404);
 			res.end("Image not found");
 			return;
 		}
 		try {
-			const request = nodeToWebRequest(req, rawUrl, prerenderSecret, appRouterI18nConfig, appRouterAuthorizeOnDemandRevalidate);
-			const response = await rscHandler(request, createNodeExecutionContext(resolveTrustedNodeRevalidateOrigin(req, host, port)));
+			const request = nodeToWebRequest(req, rawUrl, prerenderSecret, appRouterI18nConfig, appRouterAuthorizeOnDemandRevalidate, signalFromNodeResponse(res));
+			const ctx = createNodeExecutionContext(resolveTrustedNodeRevalidateOrigin(req, host, port));
+			const recorded = {};
+			if (purpose === "prerender") ctx.recordPrerenderSpecialError = (marker) => {
+				recorded.marker = marker;
+			};
+			const response = await rscHandler(request, ctx);
+			if (request.signal.aborted) {
+				cancelResponseBody(response);
+				return;
+			}
 			const staticFileSignal = readStaticFileSignal(response);
 			if (staticFileSignal) {
 				let staticFilePath = "/";
@@ -1118,7 +1193,7 @@ async function startAppRouterServer(options) {
 				await sendWebResponse(notFoundResponse({ headers: toWebHeaders(staticResponseHeaders) }), req, res, compress);
 				return;
 			}
-			await sendWebResponse(response, req, res, compress);
+			await sendWebResponse(purpose === "prerender" ? markPrerenderSpecialError(response, recorded.marker) : response, req, res, compress);
 		} catch (e) {
 			console.error("[vinext] Server error:", e);
 			if (!res.headersSent) {
@@ -1149,7 +1224,7 @@ async function startAppRouterServer(options) {
 			},
 			getStatus: () => res.statusCode,
 			headers,
-			isRsc: new URL(target, "http://localhost").pathname.endsWith(".rsc") || headers.get("RSC") === "1",
+			isRsc: target.split("?", 1)[0].endsWith(".rsc") || headers.get("RSC") === "1",
 			method: req.method ?? "GET",
 			target
 		});
@@ -1195,7 +1270,7 @@ function readPagesServerEntryPageRoutes(value) {
 * - vinextConfig — embedded next.config.js settings
 */
 async function startPagesRouterServer(options) {
-	const { port, host, clientDir, serverEntryPath, compress, purpose, silent } = options;
+	const { port, host, clientDir, serverDir, serverEntryPath, compress: compressOption, purpose, silent } = options;
 	const serverEntry = await importServerEntryModule(serverEntryPath);
 	const serverEntryRequire = createServerEntryRequire(serverEntryPath);
 	const { renderPage, handleApiRoute: handleApi, authorizeOnDemandRevalidate, runMiddleware, vinextConfig, buildId: pagesBuildId } = serverEntry;
@@ -1205,6 +1280,7 @@ async function startPagesRouterServer(options) {
 	const hasMiddleware = serverEntry.hasMiddleware === true;
 	const pageRoutes = readPagesServerEntryPageRoutes(serverEntry.pageRoutes);
 	const prerenderSecret = readPrerenderSecret(path.dirname(serverEntryPath));
+	const compress = compressOption && readServerCompress(serverDir);
 	const basePath = vinextConfig?.basePath ?? "";
 	const assetPrefix = vinextConfig?.assetPrefix ?? "";
 	const pagesAssetPathPrefix = assetPrefixPathname(assetPrefix);
@@ -1261,6 +1337,7 @@ async function startPagesRouterServer(options) {
 	const handleRequestImpl = async (req, res) => {
 		const rawUrl = req.url ?? "/";
 		const rawPagesPathnameBeforeNormalize = rawUrl.split("?")[0];
+		if (sendRepeatedSlashRedirect(rawUrl, res)) return;
 		if (isOpenRedirectShaped(rawPagesPathnameBeforeNormalize)) {
 			res.writeHead(404);
 			res.end("This page could not be found");
@@ -1366,10 +1443,12 @@ async function startPagesRouterServer(options) {
 			const reqHeaders = filterInternalHeaders(rawReqHeaders);
 			if (revalidationHostname) reqHeaders.set("host", revalidationHostname);
 			const method = req.method ?? "GET";
-			const hasBody = method !== "GET" && method !== "HEAD";
+			const signal = signalFromNodeResponse(res);
+			const hasBody = method !== "GET" && method !== "HEAD" && !signal.aborted;
 			const webRequest = new Request(`${protocol}://${revalidationHostname ?? hostHeader}${url}`, {
 				method,
 				headers: reqHeaders,
+				signal,
 				body: hasBody ? readNodeStream(req) : void 0,
 				duplex: hasBody ? "half" : void 0
 			});
@@ -1421,7 +1500,7 @@ async function startPagesRouterServer(options) {
 							"X-Content-Type-Options": "nosniff",
 							"Content-Disposition": pagesImageConfig?.contentDispositionType === "attachment" ? "attachment" : "inline"
 						};
-						if (await tryServeStatic(req, res, clientDir, params.imageUrl, false, staticCache, imageSecurityHeaders)) return true;
+						if (await tryServeStatic(req, res, clientDir, params.imageUrl, false, staticCache, imageSecurityHeaders, void 0, IMAGE_REPRESENTATION_HEADERS)) return true;
 						res.writeHead(404);
 						res.end("Image not found");
 						return true;
@@ -1434,13 +1513,18 @@ async function startPagesRouterServer(options) {
 			if (result.type === "handled") return;
 			if (result.type === "response") {
 				const { response } = result;
+				if (webRequest.signal.aborted) {
+					cancelResponseBody(response);
+					return;
+				}
 				const streamedApi = isVinextStreamedApiResponse(response);
 				if (isVinextStreamedHtmlResponse(response) || streamedApi || !response.body || result.defaultContentType === void 0) {
 					if (streamedApi && result.defaultContentType !== void 0 && !response.headers.has("content-type")) response.headers.set("content-type", result.defaultContentType);
 					await sendWebResponse(response, req, res, compress);
 					return;
 				}
-				const responseBody = Buffer.from(await response.arrayBuffer());
+				const responseBody = await bufferResponseBodyUntilAborted(response, webRequest.signal);
+				if (!responseBody) return;
 				const ct = response.headers.get("content-type") ?? result.defaultContentType;
 				const responseHeaders = {};
 				response.headers.forEach((v, k) => {
@@ -1482,4 +1566,4 @@ async function startPagesRouterServer(options) {
 	};
 }
 //#endregion
-export { COMPRESSIBLE_TYPES, COMPRESS_THRESHOLD, importServerEntryModule, mergeResponseHeaders, mergeWebResponse, negotiateEncoding, nodeToWebRequest, readNodeStream, rememberCurrentServerEntryImportMtime, resolveAppRouterAssetPath, resolveAppRouterPrerenderSeeder, resolveRequestHost as resolveHost, resolveServerEntryImportUrl, sendCompressed, sendWebResponse, startProdServer, trustProxy, trustedHosts, tryServeStatic, waitForNodeResponseCompletion };
+export { COMPRESS_THRESHOLD, importServerEntryModule, isCompressibleContentType, mergeResponseHeaders, mergeWebResponse, negotiateEncoding, nodeToWebRequest, readNodeStream, rememberCurrentServerEntryImportMtime, resolveAppRouterAssetPath, resolveAppRouterPrerenderSeeder, resolveRequestHost as resolveHost, resolveServerEntryImportUrl, sendCompressed, sendWebResponse, startProdServer, trustProxy, trustedHosts, tryServeStatic, waitForNodeResponseCompletion };

package/dist/server/request-pipeline.d.ts

@@ -1,7 +1,7 @@
 import { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS } from "./headers.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { StaticFileSignalContext, createStaticFileSignal } from "./static-file-signal.js";
-import { isOpenRedirectShaped } from "./open-redirect.js";
+import { getRepeatedSlashRedirect, isOpenRedirectShaped, sendRepeatedSlashRedirect } from "./open-redirect.js";
 //#region src/server/request-pipeline.d.ts
 /**
  * Apply the URL Standard's pathname canonicalization without decoding and
@@ -39,10 +39,21 @@ export declare function canonicalizeRequestUrlPathname(url: string): string;
  * Backslashes are equivalent to forward slashes in the URL spec
  * (e.g. `/\evil.com` is treated as `//evil.com` by browsers).
  *
- * Next.js returns 404 for these paths. We check the RAW pathname before
- * normalization so the guard fires before normalizePath collapses `//`.
- *
- * Percent-encoded variants are also blocked because:
+ * Like Next.js, any raw path containing a literal backslash or a repeated
+ * slash first gets a 308 to the collapsed path (`//evil.com` → `/evil.com`,
+ * `//` → `/`); see `getRepeatedSlashRedirect`. We check the RAW
+ * pathname before normalization so this fires before normalizePath collapses
+ * `//`.
+ *
+ * Request-based (Worker) entries only see `request.url` after WHATWG URL
+ * parsing, which has already turned `\` into `/`; the raw request target is
+ * not available there. `/\evil.com` still redirects (it arrives as
+ * `//evil.com`), but a lone backslash such as `/foo\bar` arrives as
+ * `/foo/bar` and is routed without the redirect. On Cloudflare, requests that
+ * match a static asset are also answered by the asset layer before the
+ * Worker runs. Node entries (dev and `vinext start`) check the raw target.
+ *
+ * Percent-encoded variants get a 404, as in Next.js, because:
  *   - `%5C` decodes to `\` (browsers treat `/\evil.com` as `//evil.com`).
  *   - `%2F` decodes to `/` (so `/%2F/evil.com` effectively becomes `//evil.com`).
  * These forms survive segment-wise decoding that re-encodes path delimiters
@@ -51,9 +62,10 @@ export declare function canonicalizeRequestUrlPathname(url: string): string;
  * `isOpenRedirectShaped` for the full list of rejected leading-segment forms.
  *
  * @param rawPathname - The raw pathname from the URL, before any normalization
- * @returns A 404 Response if the path is protocol-relative, or null to continue
+ * @param search - The raw query string (including `?`), kept in the 308 Location
+ * @returns A 308 or 404 Response, or null to continue
  */
-export declare function guardProtocolRelativeUrl(rawPathname: string): Response | null;
+export declare function guardProtocolRelativeUrl(rawPathname: string, search?: string): Response | null;
 export type HeaderRecord = Record<string, string | string[]>;
 type ResolvePublicFileRouteOptions = {
   cleanPathname: string;
@@ -175,4 +187,4 @@ export declare function cloneRequestWithHeaders(request: Request, headers: Heade
  */
 export declare function cloneRequestWithUrl(request: Request, url: string): Request;
 //#endregion
-export { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, createStaticFileSignal, hasBasePath, isOpenRedirectShaped, stripBasePath };
+export { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, createStaticFileSignal, getRepeatedSlashRedirect, hasBasePath, isOpenRedirectShaped, sendRepeatedSlashRedirect, stripBasePath };

package/dist/server/request-pipeline.js

@@ -3,7 +3,7 @@ import { getUnconsumedMiddlewareRequestHeaders } from "../utils/middleware-reque
 import { hasBasePath, removeTrailingSlash, stripBasePath } from "../utils/base-path.js";
 import { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS } from "./headers.js";
 import { forbiddenResponse, methodNotAllowedResponse, notFoundResponse } from "./http-error-responses.js";
-import { isOpenRedirectShaped } from "./open-redirect.js";
+import { getRepeatedSlashRedirect, isOpenRedirectShaped, repeatedSlashRedirectResponse, sendRepeatedSlashRedirect } from "./open-redirect.js";
 import { createStaticFileSignal } from "./static-file-signal.js";
 //#region src/server/request-pipeline.ts
 const PATHNAME_CANONICALIZATION_BASE = new URL("http://vinext.invalid/");
@@ -52,10 +52,21 @@ function canonicalizeRequestUrlPathname(url) {
 * Backslashes are equivalent to forward slashes in the URL spec
 * (e.g. `/\evil.com` is treated as `//evil.com` by browsers).
 *
-* Next.js returns 404 for these paths. We check the RAW pathname before
-* normalization so the guard fires before normalizePath collapses `//`.
+* Like Next.js, any raw path containing a literal backslash or a repeated
+* slash first gets a 308 to the collapsed path (`//evil.com` → `/evil.com`,
+* `//` → `/`); see `getRepeatedSlashRedirect`. We check the RAW
+* pathname before normalization so this fires before normalizePath collapses
+* `//`.
 *
-* Percent-encoded variants are also blocked because:
+* Request-based (Worker) entries only see `request.url` after WHATWG URL
+* parsing, which has already turned `\` into `/`; the raw request target is
+* not available there. `/\evil.com` still redirects (it arrives as
+* `//evil.com`), but a lone backslash such as `/foo\bar` arrives as
+* `/foo/bar` and is routed without the redirect. On Cloudflare, requests that
+* match a static asset are also answered by the asset layer before the
+* Worker runs. Node entries (dev and `vinext start`) check the raw target.
+*
+* Percent-encoded variants get a 404, as in Next.js, because:
 *   - `%5C` decodes to `\` (browsers treat `/\evil.com` as `//evil.com`).
 *   - `%2F` decodes to `/` (so `/%2F/evil.com` effectively becomes `//evil.com`).
 * These forms survive segment-wise decoding that re-encodes path delimiters
@@ -64,9 +75,12 @@ function canonicalizeRequestUrlPathname(url) {
 * `isOpenRedirectShaped` for the full list of rejected leading-segment forms.
 *
 * @param rawPathname - The raw pathname from the URL, before any normalization
-* @returns A 404 Response if the path is protocol-relative, or null to continue
+* @param search - The raw query string (including `?`), kept in the 308 Location
+* @returns A 308 or 404 Response, or null to continue
 */
-function guardProtocolRelativeUrl(rawPathname) {
+function guardProtocolRelativeUrl(rawPathname, search = "") {
+	const slashRedirect = repeatedSlashRedirectResponse(rawPathname + search);
+	if (slashRedirect) return slashRedirect;
 	if (isOpenRedirectShaped(rawPathname)) return notFoundResponse();
 	return null;
 }
@@ -418,4 +432,4 @@ function cloneRequestWithUrl(request, url) {
 	return attachRequestCfMetadata(cloned, request);
 }
 //#endregion
-export { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, attachRequestCfMetadata, canonicalizeRequestPathname, canonicalizeRequestUrlPathname, cloneRequestWithHeaders, cloneRequestWithUrl, createStaticFileSignal, filterInternalHeaders, guardProtocolRelativeUrl, hasBasePath, isOpenRedirectShaped, isOriginAllowed, normalizeTrailingSlash, normalizeTrailingSlashPathname, processMiddlewareHeaders, resolvePublicFileRoute, stripBasePath, validateCsrfOrigin, validateServerActionPayload };
+export { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, attachRequestCfMetadata, canonicalizeRequestPathname, canonicalizeRequestUrlPathname, cloneRequestWithHeaders, cloneRequestWithUrl, createStaticFileSignal, filterInternalHeaders, getRepeatedSlashRedirect, guardProtocolRelativeUrl, hasBasePath, isOpenRedirectShaped, isOriginAllowed, normalizeTrailingSlash, normalizeTrailingSlashPathname, processMiddlewareHeaders, resolvePublicFileRoute, sendRepeatedSlashRedirect, stripBasePath, validateCsrfOrigin, validateServerActionPayload };