vinext 1.0.1 → 1.2.0

package/dist/server/headers.js

@@ -48,7 +48,10 @@ const VINEXT_PRERENDER_READINESS_PATH = "/__vinext/prerender/readiness";
 const VINEXT_PRERENDER_READINESS_HEADER = "X-Vinext-Prerender-Readiness";
 /** TPR (Tailored Per-Request) revalidation interval in seconds. */
 const VINEXT_REVALIDATE_HEADER = "x-vinext-revalidate";
-/** Actual Pages cache tag regenerated by an authenticated on-demand request. */
+/**
+* Actual Pages cache tag regenerated by an authenticated on-demand request.
+* URI-encoded, because a decoded path can end in whitespace that Headers trims.
+*/
 const VINEXT_REVALIDATED_CACHE_TAG_HEADER = "x-vinext-revalidated-cache-tag";
 /** Marker on cached ISR entries indicating RSC payload (value "1"). */
 const VINEXT_RSC_MARKER_HEADER = "x-vinext-rsc";
@@ -58,6 +61,12 @@ const VINEXT_PARAMS_HEADER = "X-Vinext-Params";
 const VINEXT_DYNAMIC_STALE_TIME_HEADER = "X-Vinext-Dynamic-Stale-Time";
 /** Marks an RSC body carrying completion metadata after the Flight payload. */
 const VINEXT_RSC_COMPLETION_METADATA_HEADER = "X-Vinext-Rsc-Completion-Metadata";
+/**
+* Carries the stored status of an App page RSC response whose 401, 403 or 404
+* is its page's notFound(), forbidden() or unauthorized(). Middleware and
+* config headers can't set it, and the request stage strips it.
+*/
+const VINEXT_SPECIAL_ERROR_STATUS_HEADER = "x-vinext-special-error-status";
 /** URL-encoded rendered path and search after middleware/config rewrites. */
 const VINEXT_RENDERED_PATH_AND_SEARCH_HEADER = "X-Vinext-Rendered-Path-And-Search";
 /** Prerender-only JSON side channel carrying request cacheLife metadata. */
@@ -66,6 +75,14 @@ const VINEXT_PRERENDER_CACHE_LIFE_HEADER = "x-vinext-prerender-cache-life";
 const VINEXT_PRERENDER_REWRITTEN_HEADER = "x-vinext-prerender-rewritten";
 /** Marks a local prerender-server 500 that originated from a thrown render error. */
 const VINEXT_PRERENDER_RENDER_ERROR_HEADER = "x-vinext-prerender-render-error";
+/**
+* Prerender-only marker: the response's 401, 403, 404 or redirect is its page's
+* notFound(), forbidden(), unauthorized() or redirect(), which escaped the shell.
+* Its value is the JSON of the headers to store: a redirect's own location, or
+* `{}`. Only the prerender server sets it, from the special error the page
+* recorded on its ctx, and it drops one that the response carries.
+*/
+const VINEXT_PRERENDER_SPECIAL_ERROR_HEADER = "x-vinext-prerender-special-error";
 /** Internal marker persisted only inside metadata-route APP_ROUTE cache values. */
 const VINEXT_METADATA_ROUTE_CACHE_HEADER = "x-vinext-metadata-route-cache";
 /** Disabled-by-default client hint describing already-held App Router payload entries. */
@@ -175,4 +192,4 @@ const VINEXT_INTERNAL_HEADERS = [
 	VINEXT_TRACE_ROUTE_HEADER.toLowerCase()
 ];
 //#endregion
-export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_CACHE_TAGS_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STALE_TIME_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHEABILITY_PROBE_HEADER, VINEXT_CACHEABILITY_PROBE_QUERY_PARAM, VINEXT_CACHEABILITY_PROBE_ROUTE_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_EXPECTED_WORKER_VERSION_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERCEPTION_ID_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_METADATA_ROUTE_CACHE_HEADER, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_METADATA_ROUTES_PATH, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_READINESS_HEADER, VINEXT_PRERENDER_READINESS_PATH, VINEXT_PRERENDER_RENDER_ERROR_HEADER, VINEXT_PRERENDER_REWRITTEN_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATED_CACHE_TAG_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_REVALIDATE_HOST_HEADER, VINEXT_RSC_COMPLETION_METADATA_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_RSC_STATE_FINGERPRINT_HEADER, VINEXT_RSC_VARY_HEADER, VINEXT_STALE_TIME_PENDING_HEADER, VINEXT_TIMING_HEADER, VINEXT_TRACE_BUFFERED_BODY_HEADER, VINEXT_TRACE_ERROR_HEADER, VINEXT_TRACE_ROUTE_HEADER, isVinextRscVaryField };
+export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_CACHE_TAGS_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STALE_TIME_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHEABILITY_PROBE_HEADER, VINEXT_CACHEABILITY_PROBE_QUERY_PARAM, VINEXT_CACHEABILITY_PROBE_ROUTE_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_EXPECTED_WORKER_VERSION_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERCEPTION_ID_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_METADATA_ROUTE_CACHE_HEADER, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_METADATA_ROUTES_PATH, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_READINESS_HEADER, VINEXT_PRERENDER_READINESS_PATH, VINEXT_PRERENDER_RENDER_ERROR_HEADER, VINEXT_PRERENDER_REWRITTEN_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECIAL_ERROR_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATED_CACHE_TAG_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_REVALIDATE_HOST_HEADER, VINEXT_RSC_COMPLETION_METADATA_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_RSC_STATE_FINGERPRINT_HEADER, VINEXT_RSC_VARY_HEADER, VINEXT_SPECIAL_ERROR_STATUS_HEADER, VINEXT_STALE_TIME_PENDING_HEADER, VINEXT_TIMING_HEADER, VINEXT_TRACE_BUFFERED_BODY_HEADER, VINEXT_TRACE_ERROR_HEADER, VINEXT_TRACE_ROUTE_HEADER, isVinextRscVaryField };

package/dist/server/http-conditional.d.ts

@@ -6,6 +6,17 @@
  * validator with the same opaque tag compare equal.
  */
 export declare function matchesIfNoneMatch(ifNoneMatch: string | undefined, etag: string): boolean;
+/**
+ * Whether a page answers its request with a 304, as Next.js's
+ * `sendEtagResponse` does with `fresh(req.headers, { etag })`. Next.js gives a
+ * page no Last-Modified, so a request with If-Modified-Since gets the page, and
+ * a request `Cache-Control: no-cache` always does.
+ */
+export declare function isPageNotModified(request: {
+  cacheControl?: string;
+  ifModifiedSince?: string;
+  ifNoneMatch?: string;
+}, etag: string): boolean;
 /** Test an If-Match field using Next.js's weak/strong-equivalent comparison. */
 export declare function matchesIfMatch(ifMatch: string | undefined, etag: string | undefined): boolean;
 type StaticConditionalHeaders = {

package/dist/server/http-conditional.js

@@ -31,6 +31,15 @@ function matchesIfNoneMatch(ifNoneMatch, etag) {
 	}
 	return sawTag && matched;
 }
+/**
+* Whether a page answers its request with a 304, as Next.js's
+* `sendEtagResponse` does with `fresh(req.headers, { etag })`. Next.js gives a
+* page no Last-Modified, so a request with If-Modified-Since gets the page, and
+* a request `Cache-Control: no-cache` always does.
+*/
+function isPageNotModified(request, etag) {
+	return !request.ifModifiedSince && !/(?:^|,)\s*no-cache\s*(?:,|$)/.test(request.cacheControl ?? "") && matchesIfNoneMatch(request.ifNoneMatch, etag);
+}
 /** Test an If-Match field using Next.js's weak/strong-equivalent comparison. */
 function matchesIfMatch(ifMatch, etag) {
 	if (!ifMatch) return false;
@@ -114,4 +123,4 @@ function joinHeader(value) {
 	return Array.isArray(value) ? value.join(", ") : value;
 }
 //#endregion
-export { evaluateStaticPreconditions, matchesIfMatch, matchesIfNoneMatch };
+export { evaluateStaticPreconditions, isPageNotModified, matchesIfMatch, matchesIfNoneMatch };

package/dist/server/http-error-responses.d.ts

@@ -9,7 +9,7 @@
  * `new Response(...)` boilerplate.
  *
  * Sites with route-specific bodies (e.g. `"404 - API route not found"`,
- * `"Image not found"`, generated worker templates) intentionally remain inline
+ * generated worker templates) intentionally remain inline
  * because their bodies are either tested-against fixtures or run inside template
  * strings that have no access to runtime imports.
  *

package/dist/server/image-optimization.d.ts

@@ -82,6 +82,44 @@ export type ParseImageParamsOptions = {
   isDev?: boolean;
 };
 export declare function resolveDevImageRedirect(requestUrl: URL, allowedWidths?: number[], allowedQualities?: number[], options?: ParseImageParamsOptions): string | null;
+export type ImageOptimizationSignal = {
+  /** Middleware response headers to send with the image. */
+  middlewareHeaders: Headers;
+  /** The request headers after middleware's overrides, when it set any. */
+  requestHeaders: Headers | null;
+  /** The image query after middleware and rewrites. */
+  search: string;
+};
+/**
+ * Mark the App Router's image endpoint response once the request has passed
+ * middleware and rewrites. A host that serves images itself (the Node
+ * production server) replaces the response with the image; other hosts send
+ * the response unchanged. The symbol carries the signal across the built RSC
+ * module boundary, so response headers cannot forge it.
+ */
+export declare function markImageOptimizationSignal(response: Response, signal: ImageOptimizationSignal): Response;
+/** Return the signal of a framework-created image endpoint response. */
+export declare function readImageOptimizationSignal(response: Response): ImageOptimizationSignal | null;
+/**
+ * Carry a signal through the response-stage transport, which drops the
+ * symbol. The signal rides in the body of the bodiless carrier, with the
+ * carrier's status in the token-authenticated marker.
+ */
+export declare function serializeImageOptimizationSignalForTransport(response: Response, token: string): Response;
+/** Restore and consume a signal returned by the trusted response-stage wrapper. */
+export declare function restoreImageOptimizationSignalFromTransport(response: Response, token: string): Promise<Response>;
+/**
+ * Whether a local source's pipeline status carries the file's bytes. A no-body
+ * success such as 204 serves no file, which Next.js rejects as an invalid
+ * image.
+ */
+export declare function isImageSourceBodyStatus(status: number): boolean;
+/**
+ * Body Next.js answers, with a 400, for a local source that yields no image:
+ * a missing file, or anything middleware or routing answers in its place.
+ */
+export declare const INVALID_IMAGE_SOURCE_MESSAGE = "The requested resource isn't a valid image.";
+export declare function invalidImageSourceResponse(): Response;
 /**
  * Parse and validate image optimization query parameters.
  * Returns null if the request is malformed.
@@ -117,6 +155,22 @@ export declare const IMAGE_CONTENT_SECURITY_POLICY = "script-src 'none'; frame-s
  * Returns false for SVG (unless dangerouslyAllowSVG is true), HTML, or any non-image type.
  */
 export declare function isSafeImageContentType(contentType: string | null, dangerouslyAllowSVG?: boolean): boolean;
+/**
+ * Cache state for a successful image response, sent as both `X-Nextjs-Cache`
+ * and `X-Vinext-Cache`.
+ *
+ * Next.js keeps optimized images in an image cache and labels each 200 with
+ * where the bytes came from: `MISS` when the optimizer ran for this request,
+ * `HIT` or `STALE` when the cache served them. vinext has no image cache on any
+ * runtime, so every successful response is transformed (or passed through) from
+ * the source for the request that receives it. Next.js behaves the same way
+ * when its image cache is disabled (`images.maximumDiskCacheSize: 0`): every
+ * 200 is a `MISS`. `HIT` and `STALE` need a cache of optimized images.
+ *
+ * Next.js sets the header after its ETag check, so a 304 and error responses
+ * go out without it. Only full image responses carry either header here too.
+ */
+export declare const IMAGE_RESPONSE_CACHE_STATE = "MISS";
 /**
  * Handlers for image optimization I/O operations.
  * Workers provide these callbacks to adapt their specific bindings.

package/dist/server/image-optimization.js

@@ -1,4 +1,5 @@
 import { badRequestResponse } from "./http-error-responses.js";
+import { setCacheStateHeaders } from "./cache-headers.js";
 //#region src/server/image-optimization.ts
 /**
 * Image optimization request handler.
@@ -77,6 +78,93 @@ function resolveDevImageRedirect(requestUrl, allowedWidths = [...DEFAULT_DEVICE_
 	if (resolved.origin !== requestUrl.origin) return null;
 	return resolved.pathname + resolved.search;
 }
+const IMAGE_OPTIMIZATION_SIGNAL = Symbol.for("vinext.image-optimization-signal");
+/**
+* Mark the App Router's image endpoint response once the request has passed
+* middleware and rewrites. A host that serves images itself (the Node
+* production server) replaces the response with the image; other hosts send
+* the response unchanged. The symbol carries the signal across the built RSC
+* module boundary, so response headers cannot forge it.
+*/
+function markImageOptimizationSignal(response, signal) {
+	Object.defineProperty(response, IMAGE_OPTIMIZATION_SIGNAL, { value: signal });
+	return response;
+}
+/** Return the signal of a framework-created image endpoint response. */
+function readImageOptimizationSignal(response) {
+	const signal = Reflect.get(response, IMAGE_OPTIMIZATION_SIGNAL);
+	if (typeof signal !== "object" || signal === null) return null;
+	const { middlewareHeaders, requestHeaders, search } = signal;
+	return middlewareHeaders instanceof Headers && (requestHeaders === null || requestHeaders instanceof Headers) && typeof search === "string" ? {
+		middlewareHeaders,
+		requestHeaders,
+		search
+	} : null;
+}
+const IMAGE_OPTIMIZATION_SIGNAL_TRANSPORT_HEADER = "x-vinext-stage-image-optimization";
+function isHeaderEntries(value) {
+	return Array.isArray(value) && value.every((entry) => Array.isArray(entry) && entry.length === 2 && typeof entry[0] === "string" && typeof entry[1] === "string");
+}
+/**
+* Carry a signal through the response-stage transport, which drops the
+* symbol. The signal rides in the body of the bodiless carrier, with the
+* carrier's status in the token-authenticated marker.
+*/
+function serializeImageOptimizationSignalForTransport(response, token) {
+	const signal = readImageOptimizationSignal(response);
+	if (signal === null) return response;
+	const headers = new Headers(response.headers);
+	headers.set(IMAGE_OPTIMIZATION_SIGNAL_TRANSPORT_HEADER, `${token}:${response.status}`);
+	return new Response(JSON.stringify({
+		middlewareHeaders: [...signal.middlewareHeaders],
+		requestHeaders: signal.requestHeaders ? [...signal.requestHeaders] : null,
+		search: signal.search
+	}), { headers });
+}
+/** Restore and consume a signal returned by the trusted response-stage wrapper. */
+async function restoreImageOptimizationSignalFromTransport(response, token) {
+	const marker = response.headers.get(IMAGE_OPTIMIZATION_SIGNAL_TRANSPORT_HEADER);
+	if (marker === null || response.status < 200 || response.status > 599) return response;
+	const headers = new Headers(response.headers);
+	headers.delete(IMAGE_OPTIMIZATION_SIGNAL_TRANSPORT_HEADER);
+	const prefix = `${token}:`;
+	const status = marker.startsWith(prefix) ? Number(marker.slice(prefix.length)) : NaN;
+	if (!Number.isInteger(status) || status < 200 || status > 599) {
+		const body = response.status === 204 || response.status === 205 || response.status === 304 ? null : response.body;
+		return new Response(body, {
+			headers,
+			status: response.status,
+			statusText: response.statusText
+		});
+	}
+	const { middlewareHeaders, requestHeaders, search } = JSON.parse(await response.text()) ?? {};
+	if (!isHeaderEntries(middlewareHeaders) || requestHeaders !== null && !isHeaderEntries(requestHeaders) || typeof search !== "string") throw new Error("Invalid image optimization signal from the response stage");
+	return markImageOptimizationSignal(new Response(null, {
+		headers,
+		status
+	}), {
+		middlewareHeaders: new Headers(middlewareHeaders),
+		requestHeaders: requestHeaders ? new Headers(requestHeaders) : null,
+		search
+	});
+}
+/**
+* Whether a local source's pipeline status carries the file's bytes. A no-body
+* success such as 204 serves no file, which Next.js rejects as an invalid
+* image.
+*/
+function isImageSourceBodyStatus(status) {
+	return status >= 200 && status < 300 && status !== 204 && status !== 205;
+}
+/**
+* Body Next.js answers, with a 400, for a local source that yields no image:
+* a missing file, or anything middleware or routing answers in its place.
+*/
+const INVALID_IMAGE_SOURCE_MESSAGE = "The requested resource isn't a valid image.";
+function invalidImageSourceResponse() {
+	return new Response(INVALID_IMAGE_SOURCE_MESSAGE, { status: 400 });
+}
+const RECURSIVE_IMAGE_URL_RE = /\/_(?:next|vinext)\/image(?:$|\/)/;
 /**
 * Parse and validate image optimization query parameters.
 * Returns null if the request is malformed.
@@ -112,7 +200,9 @@ function parseImageParams(url, allowedWidths = [...DEFAULT_DEVICE_SIZES, ...DEFA
 	if (!normalizedUrl.startsWith("/") || normalizedUrl.startsWith("//")) return null;
 	try {
 		const base = "https://localhost";
-		if (new URL(normalizedUrl, base).origin !== base) return null;
+		const resolved = new URL(normalizedUrl, base);
+		if (resolved.origin !== base) return null;
+		if (RECURSIVE_IMAGE_URL_RE.test(decodeURIComponent(resolved.pathname))) return null;
 	} catch {
 		return null;
 	}
@@ -182,11 +272,32 @@ function setImageSecurityHeaders(headers, config) {
 	headers.set("X-Content-Type-Options", "nosniff");
 	headers.set("Content-Disposition", config?.contentDispositionType === "attachment" ? "attachment" : "inline");
 }
-function createPassthroughImageResponse(source, config) {
-	const headers = new Headers(source.headers);
+/**
+* Cache state for a successful image response, sent as both `X-Nextjs-Cache`
+* and `X-Vinext-Cache`.
+*
+* Next.js keeps optimized images in an image cache and labels each 200 with
+* where the bytes came from: `MISS` when the optimizer ran for this request,
+* `HIT` or `STALE` when the cache served them. vinext has no image cache on any
+* runtime, so every successful response is transformed (or passed through) from
+* the source for the request that receives it. Next.js behaves the same way
+* when its image cache is disabled (`images.maximumDiskCacheSize: 0`): every
+* 200 is a `MISS`. `HIT` and `STALE` need a cache of optimized images.
+*
+* Next.js sets the header after its ETag check, so a 304 and error responses
+* go out without it. Only full image responses carry either header here too.
+*/
+const IMAGE_RESPONSE_CACHE_STATE = "MISS";
+/** Headers shared by every successful image response, transformed or not. */
+function setImageResponseHeaders(headers, config) {
 	headers.set("Cache-Control", IMAGE_CACHE_CONTROL);
 	headers.set("Vary", "Accept");
 	setImageSecurityHeaders(headers, config);
+	setCacheStateHeaders(headers, IMAGE_RESPONSE_CACHE_STATE);
+}
+function createPassthroughImageResponse(source, config) {
+	const headers = new Headers(source.headers);
+	setImageResponseHeaders(headers, config);
 	return new Response(source.body, {
 		status: 200,
 		headers
@@ -204,7 +315,7 @@ async function handleImageOptimization(request, handlers, allowedWidths, imageCo
 	if (!params) return badRequestResponse();
 	const { imageUrl, width, quality } = params;
 	const source = await handlers.fetchAsset(imageUrl, request);
-	if (!source.ok || !source.body) return new Response("Image not found", { status: 404 });
+	if (!source.ok || !source.body) return invalidImageSourceResponse();
 	const format = negotiateImageFormat(request.headers.get("Accept"));
 	const sourceContentType = source.headers.get("Content-Type");
 	if (!isSafeImageContentType(sourceContentType, imageConfig?.dangerouslyAllowSVG)) return new Response("The requested resource is not an allowed image type", { status: 400 });
@@ -216,9 +327,7 @@ async function handleImageOptimization(request, handlers, allowedWidths, imageCo
 			quality
 		});
 		const headers = new Headers(transformed.headers);
-		headers.set("Cache-Control", IMAGE_CACHE_CONTROL);
-		headers.set("Vary", "Accept");
-		setImageSecurityHeaders(headers, imageConfig);
+		setImageResponseHeaders(headers, imageConfig);
 		if (!isSafeImageContentType(headers.get("Content-Type"), imageConfig?.dangerouslyAllowSVG)) headers.set("Content-Type", format);
 		return new Response(transformed.body, {
 			status: 200,
@@ -232,7 +341,7 @@ async function handleImageOptimization(request, handlers, allowedWidths, imageCo
 	} catch (e) {
 		console.error("[vinext] Image fallback error, refetching source image:", e);
 		const refetchedSource = await handlers.fetchAsset(imageUrl, request);
-		if (!refetchedSource.ok || !refetchedSource.body) return new Response("Image not found", { status: 404 });
+		if (!refetchedSource.ok || !refetchedSource.body) return invalidImageSourceResponse();
 		if (!isSafeImageContentType(refetchedSource.headers.get("Content-Type"), imageConfig?.dangerouslyAllowSVG)) return new Response("The requested resource is not an allowed image type", { status: 400 });
 		return createPassthroughImageResponse(refetchedSource, imageConfig);
 	}
@@ -287,4 +396,4 @@ function handleConfiguredImageOptimization(request, fetchAsset, allowedWidths, i
 	}, allowedWidths, imageConfig);
 }
 //#endregion
-export { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, IMAGE_CACHE_CONTROL, IMAGE_CONTENT_SECURITY_POLICY, IMAGE_OPTIMIZATION_PATH, VINEXT_IMAGE_OPTIMIZATION_PATH, getImageOptimizer, handleConfiguredImageOptimization, handleImageOptimization, isImageOptimizationPath, isSafeImageContentType, negotiateImageFormat, parseImageParams, resolveDevImageRedirect, setImageOptimizer };
+export { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, IMAGE_CACHE_CONTROL, IMAGE_CONTENT_SECURITY_POLICY, IMAGE_OPTIMIZATION_PATH, IMAGE_RESPONSE_CACHE_STATE, INVALID_IMAGE_SOURCE_MESSAGE, VINEXT_IMAGE_OPTIMIZATION_PATH, getImageOptimizer, handleConfiguredImageOptimization, handleImageOptimization, invalidImageSourceResponse, isImageOptimizationPath, isImageSourceBodyStatus, isSafeImageContentType, markImageOptimizationSignal, negotiateImageFormat, parseImageParams, readImageOptimizationSignal, resolveDevImageRedirect, restoreImageOptimizationSignalFromTransport, serializeImageOptimizationSignalForTransport, setImageOptimizer };

package/dist/server/isr-cache.d.ts

@@ -112,7 +112,17 @@ export declare function pagesIsrCacheKey(pathname: string, buildId?: string, i18
  * Cloudflare KV key under its 512-byte limit for long pathnames.
  */
 export declare function appIsrCacheKey(pathname: string, suffix: string, buildId?: string | undefined): string;
+/**
+ * Compute the ISR key for a PPR fallback shell artifact, such as the HTML for
+ * `/en/[slug]`. Shells get their own namespace: a request for the literal path
+ * `/en/%5Bslug%5D` decodes to the same pathname, and its render must not be
+ * stored where every unknown `[slug]` reads its shell. The namespace is a
+ * prefix of its own rather than a part after the build ID, which can contain
+ * `:` and so could spell it.
+ */
+export declare function appIsrFallbackShellKey(pathname: string, suffix: "html" | "rsc", buildId?: string | undefined): string;
 export declare function appIsrHtmlKey(pathname: string): string;
+export declare function appIsrFallbackShellHtmlKey(pathname: string): string;
 /**
  * Build the ISR cache key for an RSC payload.
  *

package/dist/server/isr-cache.js

@@ -1,15 +1,29 @@
 import { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER } from "../utils/protocol-headers.js";
 import { normalizePathnameForRouteMatch } from "../routing/utils.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
+import { isInterceptionMatchedUrlPath } from "./normalize-path.js";
 import { reportRequestError } from "./instrumentation.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
-import { fnv1a64 } from "../utils/hash.js";
 import { normalizeMountedSlotsHeader } from "./app-mounted-slots-header.js";
 import { APP_RSC_RENDER_MODE_NAVIGATION, getRscRenderModeCacheVariant } from "./app-rsc-render-mode.js";
-import { normalizeAppPageInterceptionProofPathname } from "./app-page-render-identity.js";
 import { getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret } from "./revalidation-request.js";
+import { createHash } from "node:crypto";
 //#region src/server/isr-cache.ts
 /**
+* ISR (Incremental Static Regeneration) cache layer.
+*
+* Wraps the pluggable CacheHandler with stale-while-revalidate semantics:
+* - Fresh hit: serve immediately
+* - Stale hit: serve immediately + trigger background regeneration
+* - Miss: render synchronously, cache, serve
+*
+* Background regeneration is deduped — only one regeneration per cache key
+* runs at a time, preventing thundering herd on popular pages.
+*
+* This layer works with any CacheHandler backend (memory, Redis, KV, etc.)
+* because it only uses the standard get/set interface.
+*/
+/**
 * Get a cache entry with staleness information.
 *
 * Returns { value, isStale: false } for fresh entries,
@@ -151,12 +165,19 @@ function buildAppPageCacheValue(html, rscData, status, renderObservation, header
 function normalizeCachePathname(pathname) {
 	return pathname === "/" ? "/" : pathname.replace(/\/$/, "");
 }
+/**
+* Digest a request-controlled key part. It must be collision resistant: a
+* crafted value that shared a weaker hash with another would share its entry.
+*/
+function digestKeyPart(value) {
+	return createHash("sha256").update(value).digest("hex");
+}
 function buildCacheKey(prefix, pathname, suffix) {
 	const normalized = normalizeCachePathname(pathname);
 	const suffixPart = suffix ? `:${suffix}` : "";
 	const key = `${prefix}:${normalized}${suffixPart}`;
 	if (key.length <= 200) return key;
-	return `${prefix}:__hash:${fnv1a64(normalized)}${suffixPart}`;
+	return `${prefix}:__hash:${digestKeyPart(normalized)}${suffixPart}`;
 }
 /**
 * Compute an ISR cache key for a given router type and pathname.
@@ -179,11 +200,25 @@ function pagesIsrCacheKey(pathname, buildId, i18nCacheVariant) {
 function appIsrCacheKey(pathname, suffix, buildId = process.env.__VINEXT_BUILD_ID) {
 	return buildCacheKey(buildId ? `app:v2:${buildId}` : "app:v2", pathname, suffix);
 }
+/**
+* Compute the ISR key for a PPR fallback shell artifact, such as the HTML for
+* `/en/[slug]`. Shells get their own namespace: a request for the literal path
+* `/en/%5Bslug%5D` decodes to the same pathname, and its render must not be
+* stored where every unknown `[slug]` reads its shell. The namespace is a
+* prefix of its own rather than a part after the build ID, which can contain
+* `:` and so could spell it.
+*/
+function appIsrFallbackShellKey(pathname, suffix, buildId = process.env.__VINEXT_BUILD_ID) {
+	return buildCacheKey(buildId ? `app-fallback-shell:v1:${buildId}` : "app-fallback-shell:v1", pathname, suffix);
+}
 function appIsrHtmlKey(pathname) {
 	return appIsrCacheKey(pathname, "html");
 }
+function appIsrFallbackShellHtmlKey(pathname) {
+	return appIsrFallbackShellKey(pathname, "html");
+}
 function normalizeInterceptionContextForCacheKey(interceptionContext) {
-	return normalizeAppPageInterceptionProofPathname(interceptionContext);
+	return isInterceptionMatchedUrlPath(interceptionContext) ? interceptionContext : null;
 }
 /**
 * Build the ISR cache key for an RSC payload.
@@ -200,9 +235,9 @@ function appIsrRscKey(pathname, mountedSlotsHeader, renderMode = APP_RSC_RENDER_
 	const normalizedMountedSlotsHeader = normalizeMountedSlotsHeader(mountedSlotsHeader);
 	const sourceVariant = interceptionContext === void 0 || interceptionContext === null ? null : normalizeInterceptionContextForCacheKey(interceptionContext);
 	const variant = [
-		sourceVariant ? `source:${fnv1a64(sourceVariant)}` : null,
-		interceptionId ? `selector:${fnv1a64(interceptionId)}` : null,
-		normalizedMountedSlotsHeader ? `slots:${fnv1a64(normalizedMountedSlotsHeader)}` : null,
+		sourceVariant ? `source:${digestKeyPart(sourceVariant)}` : null,
+		interceptionId ? `selector:${digestKeyPart(interceptionId)}` : null,
+		normalizedMountedSlotsHeader ? `slots:${digestKeyPart(normalizedMountedSlotsHeader)}` : null,
 		getRscRenderModeCacheVariant(renderMode)
 	].filter((part) => part !== null).join(":");
 	return appIsrCacheKey(pathname, variant ? `rsc:${variant}` : "rsc");
@@ -211,4 +246,4 @@ function appIsrRouteKey(pathname) {
 	return appIsrCacheKey(pathname, pathname !== "/" && pathname.endsWith("/") ? "route:trailing-slash" : "route");
 }
 //#endregion
-export { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrCacheKey, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, coalesceOnDemandRevalidation, getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret, isrCacheControl, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, pagesIsrCacheKey, resolveRouteExpireSeconds, triggerBackgroundRegeneration };
+export { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrCacheKey, appIsrFallbackShellHtmlKey, appIsrFallbackShellKey, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, coalesceOnDemandRevalidation, getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret, isrCacheControl, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, pagesIsrCacheKey, resolveRouteExpireSeconds, triggerBackgroundRegeneration };

package/dist/server/metadata-route-response.js

@@ -3,6 +3,7 @@ import { closeAfterResponse, createRequestContext, runWithRequestContext } from
 import { decodeMatchedParams } from "../routing/utils.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
 import { VINEXT_METADATA_ROUTE_CACHE_HEADER } from "./headers.js";
+import { runInWorkStoreScope } from "../shims/internal/work-store-scope.js";
 import { notFoundResponse } from "./http-error-responses.js";
 import { beginRouteCacheability, markRouteCacheabilityExplicitResponsePolicy, markRouteCacheabilityResponseBodyComplete, recordRouteCacheability } from "../shims/cacheability-classification.js";
 import { NEVER_CACHE_CONTROL, applyCdnResponseHeaders, hasCdnResponsePolicy } from "./cache-control.js";
@@ -215,7 +216,7 @@ async function writeRenderedMetadataRoute(options, route, routeKey, rendered, pr
 async function runMetadataRouteRegeneration(options, route, render, routeKey, previousEntry, executionContext) {
 	const requestContext = createRequestContext({ executionContext });
 	try {
-		await runWithRequestContext(requestContext, async () => {
+		await runWithRequestContext(requestContext, () => runInWorkStoreScope(async () => {
 			ensureFetchPatch();
 			beginMetadataRouteCacheability(route);
 			setCurrentFetchSoftTags(buildMetadataRouteTags(route, options.cleanPathname, []));
@@ -225,7 +226,7 @@ async function runMetadataRouteRegeneration(options, route, render, routeKey, pr
 			} finally {
 				rendered.response.body?.cancel().catch(() => {});
 			}
-		});
+		}));
 	} finally {
 		await closeAfterResponse(requestContext);
 	}
@@ -512,6 +513,12 @@ async function handleMetadataRouteRequest(options) {
 			decodeMatchedParams(runtimeParams);
 			match.params = runtimeParams;
 		}
+		const render = async () => {
+			setCurrentFetchSoftTags(buildMetadataRouteTags(route, options.cleanPathname, []));
+			return captureRenderedMetadataRoute(route.isDynamic ? await callDynamicMetadataRoute(route, match, options.makeThenableParams, functions) : serveStaticMetadataRoute(route), route, options.cleanPathname);
+		};
+		const cached = await readMatchedPrerenderedMetadataRouteResponse(options, route, render);
+		if (cached.response) return cached.response;
 		if (route.isDynamic && isImageMetadataRoute(route) && functions.dynamicParams === false) {
 			const validationParams = { ...rawParams };
 			canonicalizeAppPageParams(validationParams);
@@ -526,12 +533,6 @@ async function handleMetadataRouteRequest(options) {
 			});
 			if (dynamicParamsResponse) return dynamicParamsResponse;
 		}
-		const render = async () => {
-			setCurrentFetchSoftTags(buildMetadataRouteTags(route, options.cleanPathname, []));
-			return captureRenderedMetadataRoute(route.isDynamic ? await callDynamicMetadataRoute(route, match, options.makeThenableParams, functions) : serveStaticMetadataRoute(route), route, options.cleanPathname);
-		};
-		const cached = await readMatchedPrerenderedMetadataRouteResponse(options, route, render);
-		if (cached.response) return cached.response;
 		const rendered = await render();
 		await writeMetadataRouteMiss(options, route, rendered, cached.cachedEntry);
 		return rendered.response;

package/dist/server/middleware-matcher-pattern.js

@@ -1,4 +1,4 @@
-import { analyzeRegexSafety, regexAtomsMayOverlap } from "../utils/regex-safety.js";
+import { analyzeRegexSafety, mayHaveNamedGroups, regexAtomsMayOverlap } from "../utils/regex-safety.js";
 import { middlewarePathTokensToRegExp, normalizeMiddlewarePathTokens, parseMiddlewarePath } from "./middleware-path-to-regexp.js";
 //#region src/server/middleware-matcher-pattern.ts
 const MATCHER_OBJECT_KEYS = /* @__PURE__ */ new Set([
@@ -138,8 +138,11 @@ function hasOverlappingSequentialRepetition(pattern) {
 	}
 	return false;
 }
-function unsafeTokenReason(token) {
-	const regexSafetyIssue = analyzeRegexSafety(token.pattern, { ignoreCase: true });
+function unsafeTokenReason(token, namedGroups) {
+	const regexSafetyIssue = analyzeRegexSafety(token.pattern, {
+		ignoreCase: true,
+		namedGroups
+	});
 	if (regexSafetyIssue) {
 		if (regexSafetyIssue === "analysis budget exceeded") return `parameter "${token.name}" exceeds the regex analysis budget`;
 		return `parameter "${token.name}" contains ${regexSafetyIssue}`;
@@ -150,9 +153,10 @@ function unsafeTokenReason(token) {
 	return null;
 }
 function validateTokens(tokens) {
+	const namedGroups = tokens.some((token) => typeof token !== "string" && mayHaveNamedGroups(token.pattern));
 	for (const token of tokens) {
 		if (typeof token === "string") continue;
-		const reason = unsafeTokenReason(token);
+		const reason = unsafeTokenReason(token, namedGroups);
 		if (reason) return reason;
 	}
 	return null;

package/dist/server/middleware-matcher.d.ts

@@ -7,6 +7,8 @@ export type MiddlewareLocaleMatchContext = {
   defaultLocale: string;
 } | {
   kind: "internal" | "literal";
+} | {
+  kind: "next-data";
 };
 export declare function matchesMiddleware(pathname: string, matcher: MatcherConfig | undefined, request?: Request, i18nConfig?: NextI18nConfig | null, localeContext?: MiddlewareLocaleMatchContext): boolean;
 /**

package/dist/server/middleware-matcher.js

@@ -49,6 +49,7 @@ function matchesMiddlewarePathname(pathname, matcher, i18nConfig, localeContext)
 	return false;
 }
 function matchMatcherPattern(pathname, pattern, i18nConfig, localeContext) {
+	if (localeContext?.kind === "next-data") return matchNextDataPattern(pathname, pattern, i18nConfig, true);
 	if (!i18nConfig) return matchPattern(pathname, pattern);
 	if (localeContext) {
 		if (localeContext.kind === "internal") return false;
@@ -57,9 +58,25 @@ function matchMatcherPattern(pathname, pattern, i18nConfig, localeContext) {
 	return matchPattern(stripLocalePrefix(pathname, i18nConfig) ?? pathname, pattern);
 }
 function matchObjectMatcher(pathname, matcher, i18nConfig, localeContext) {
+	if (localeContext?.kind === "next-data") return matchNextDataPattern(pathname, matcher.source, i18nConfig, matcher.locale !== false);
 	if (matcher.locale !== false) return matchMatcherPattern(pathname, matcher.source, i18nConfig, localeContext);
 	return matchPattern(localeContext?.kind === "defaulted" ? `/${localeContext.defaultLocale}${pathname === "/" ? "" : pathname}` : pathname, matcher.source);
 }
+function matchNextDataPattern(pathname, source, i18nConfig, localized) {
+	if (compiledPattern(source) === UNSAFE_MATCHER_PATTERN) return true;
+	return matchPattern(pathname, nextDataMatcherSource(source, i18nConfig, localized));
+}
+/**
+* The source Next.js compiles for a matcher: an optional `_next/data/<buildId>`
+* prefix, an internal locale segment under i18n, and an optional data suffix.
+* Next.js also accepts App Router transport suffixes, which end in `.rsc` and
+* so can never match a `.json` data URL.
+* https://github.com/vercel/next.js/blob/v16.2.7/packages/next/src/build/analysis/get-page-static-info.ts
+*/
+function nextDataMatcherSource(source, i18nConfig, localized) {
+	const isRoot = source === "/";
+	return `/:nextData(_next/data/[^/]{1,})?${i18nConfig && localized ? `/:nextInternalLocale((?!_next/)[^/.]{1,})${isRoot ? "" : source}` : source}${isRoot ? `(${i18nConfig ? "|\\.json|" : ""}/?index|/?index\\.json)?` : "{(\\.json)}?"}`;
+}
 function stripLocalePrefix(pathname, i18nConfig) {
 	if (pathname === "/") return null;
 	const lowerFirstSegment = pathname.split("/")[1]?.toLowerCase();
@@ -71,13 +88,17 @@ function stripFirstPathSegment(pathname) {
 }
 function matchPattern(pathname, pattern) {
 	if (pattern === "/" && (pathname === "//" || pathname === "/?" || pathname === "/#")) return false;
+	const compiled = compiledPattern(pattern);
+	if (compiled === UNSAFE_MATCHER_PATTERN) return true;
+	return compiled.test(pathname);
+}
+function compiledPattern(pattern) {
 	let cached = _mwPatternCache.get(pattern);
 	if (cached === void 0) {
 		cached = compileMatcherPattern(pattern);
 		_mwPatternCache.set(pattern, cached);
 	}
-	if (cached === UNSAFE_MATCHER_PATTERN) return true;
-	return cached.test(pathname);
+	return cached;
 }
 function compileMatcherPattern(pattern) {
 	const result = compileMiddlewareMatcherPattern(pattern);

package/dist/server/middleware-response-headers.js

@@ -1,3 +1,4 @@
+import "./headers.js";
 //#region src/server/middleware-response-headers.ts
 const ADDITIVE_RESPONSE_HEADER_NAMES = /* @__PURE__ */ new Set(["set-cookie", "vary"]);
 function mergeVaryHeader(target, value) {
@@ -28,6 +29,7 @@ function mergeMiddlewareResponseHeaders(target, middlewareHeaders) {
 	if (!middlewareHeaders) return;
 	for (const [key, value] of middlewareHeaders) {
 		const lowerName = key.toLowerCase();
+		if (lowerName === "x-vinext-special-error-status") continue;
 		if (lowerName === "link" && !value) continue;
 		if (lowerName === "vary") {
 			mergeVaryHeader(target, value);