vinext 1.0.1 → 1.2.0

package/dist/build/ssr-manifest.d.ts

@@ -14,6 +14,8 @@ export type BundleBackfillChunk = {
  * `toSlash` where the result becomes a module id / manifest key.
  */
 export declare function tryRealpathSync(candidate: string): string | null;
+/** Forward-slash `path.relative(root, moduleId)`, which may escape with `../`. */
+export declare function relativeToRoot(root: string, moduleId: string): string;
 export declare function relativeWithinRoot(root: string, moduleId: string): string | null;
 export declare function augmentSsrManifestFromBundle(ssrManifest: Record<string, string[]>, bundle: Record<string, BundleBackfillChunk | {
   type: string;

package/dist/build/ssr-manifest.js

@@ -16,8 +16,12 @@ function tryRealpathSync(candidate) {
 function isWindowsAbsolutePath(candidate) {
 	return /^[a-zA-Z]:[\\/]/.test(candidate) || candidate.startsWith("\\\\");
 }
+/** Forward-slash `path.relative(root, moduleId)`, which may escape with `../`. */
+function relativeToRoot(root, moduleId) {
+	return isWindowsAbsolutePath(root) || isWindowsAbsolutePath(moduleId) ? path.win32.relative(root, moduleId) : path.relative(root, moduleId);
+}
 function relativeWithinRoot(root, moduleId) {
-	const relativeId = isWindowsAbsolutePath(root) || isWindowsAbsolutePath(moduleId) ? path.win32.relative(root, moduleId) : path.relative(root, moduleId);
+	const relativeId = relativeToRoot(root, moduleId);
 	if (!relativeId || relativeId === ".." || relativeId.startsWith("../")) return null;
 	return relativeId;
 }
@@ -70,4 +74,4 @@ function augmentSsrManifestFromBundle(ssrManifest, bundle, root, base = "/") {
 	return Object.fromEntries(Object.entries(nextManifest).map(([key, files]) => [key, [...files]]));
 }
 //#endregion
-export { augmentSsrManifestFromBundle, relativeWithinRoot, tryRealpathSync };
+export { augmentSsrManifestFromBundle, relativeToRoot, relativeWithinRoot, tryRealpathSync };

package/dist/cache/cache-adapters-virtual.d.ts

@@ -74,7 +74,13 @@ export type CacheAdapterBuildOutput = {
 export type CacheAdapterDescriptor<O extends Record<string, unknown> = Record<string, unknown>> = {
   /**
    * Module specifier (or absolute path, e.g. from `require.resolve(...)`) whose
-   * default export is a cache adapter factory.
+   * default export creates the adapter from one `{ env, options }` argument:
+   * either a factory `({ env, options }) => adapter` or a class
+   * `new Adapter({ env, options })`. Class syntax is invoked with `new`; any
+   * other function is called. For a constructor that is not class syntax (an
+   * ES5-compiled, bound or Proxy-wrapped class), export
+   * `(args) => new Adapter(args)`. The result must be the adapter object
+   * itself, not a Promise.
    */
   adapter: string;
   /** JSON-serializable options forwarded to the factory at runtime. */

package/dist/cache/cache-adapters-virtual.js

@@ -103,7 +103,7 @@ function generateCacheAdaptersModule(cache) {
 		"export function registerConfiguredCacheAdapters() {}",
 		""
 	].join("\n");
-	const lines = ["// vinext: generated from the `cache` option in your vinext() plugin config."];
+	const lines = ["// vinext: generated from the `cache` option in your vinext() plugin config.", `import { instantiateCacheAdapter } from "vinext/shims/cache-adapter-instantiate";`];
 	if (data?.adapter) {
 		lines.push(`import __vinextDataAdapterFactory from ${JSON.stringify(data.adapter)};`);
 		lines.push(`import { registerDataCacheHandler } from "vinext/shims/cache-handler";`);
@@ -114,11 +114,11 @@ function generateCacheAdaptersModule(cache) {
 	} else if (dataProvidesBuildIdentity) lines.push(`import { DefaultCdnCacheAdapter } from "vinext/shims/cdn-cache";`, `import { registerCdnCacheAdapter } from "vinext/shims/cdn-cache-state";`);
 	lines.push("", "// A factory that throws (e.g. a missing binding on an incompatible runtime)", "// is logged and skipped so the default handler stays in place.", "function __vinextFormatAdapterError(error) {", "  if (error instanceof Error && error.message) return error.message;", "  try {", "    return String(error);", "  } catch {", "    return '<unknown error>';", "  }", "}", "", "let __vinextCacheAdaptersRegistered = false;", "", "export function registerConfiguredCacheAdapters(env) {", "  if (typeof process !== 'undefined' && process.env?.__VINEXT_PRERENDER_PATH_DISCOVERY === '1') return;", "  if (__vinextCacheAdaptersRegistered) return;", "  __vinextCacheAdaptersRegistered = true;");
 	if (data?.adapter) {
-		lines.push("  try {", `    registerDataCacheHandler(() => __vinextDataAdapterFactory({ env, options: ${inlineOptions(data.adapter, data.options)} }));`);
+		lines.push("  try {", `    registerDataCacheHandler(() => instantiateCacheAdapter(__vinextDataAdapterFactory, { env, options: ${inlineOptions(data.adapter, data.options)} }, "data"));`);
 		if (dataProvidesBuildIdentity) lines.push("    registerCdnCacheAdapter(() => new DefaultCdnCacheAdapter(", "      process.env.__VINEXT_RSC_BUILD_IDENTITY || process.env.__VINEXT_BUILD_ID,", "    ));");
 		lines.push("  } catch (error) {", "    console.warn(\"[vinext] failed to initialize the configured data cache adapter; using the default handler.\\n\" + __vinextFormatAdapterError(error));", "  }");
 	}
-	if (cdn?.adapter) lines.push("  try {", `    registerCdnCacheAdapter(() => __vinextCdnAdapterFactory({ env, options: ${inlineOptions(cdn.adapter, cdn.options)} }));`, "  } catch (error) {", "    console.warn(\"[vinext] failed to initialize the configured CDN cache adapter; using the default adapter.\\n\" + __vinextFormatAdapterError(error));", "  }");
+	if (cdn?.adapter) lines.push("  try {", `    registerCdnCacheAdapter(() => instantiateCacheAdapter(__vinextCdnAdapterFactory, { env, options: ${inlineOptions(cdn.adapter, cdn.options)} }, "cdn"));`, "  } catch (error) {", "    console.warn(\"[vinext] failed to initialize the configured CDN cache adapter; using the default adapter.\\n\" + __vinextFormatAdapterError(error));", "  }");
 	lines.push("}", "");
 	return lines.join("\n");
 }

package/dist/check.js

@@ -210,7 +210,7 @@ const CONFIG_SUPPORT = {
 	},
 	transpilePackages: {
 		status: "supported",
-		detail: "listed packages are bundled instead of externalized on the server"
+		detail: "listed packages are bundled instead of externalized on the server, and their next/dynamic() calls get SSR preload links"
 	},
 	serverExternalPackages: {
 		status: "supported",
@@ -252,9 +252,10 @@ const CONFIG_SUPPORT = {
 		status: "unsupported",
 		detail: "custom cacheLife profiles are ignored; only the built-in profiles are available"
 	},
-	skipTrailingSlashRedirect: {
-		status: "unsupported",
-		detail: "ignored; trailing-slash redirects are always applied"
+	skipTrailingSlashRedirect: { status: "supported" },
+	"experimental.skipTrailingSlashRedirect": {
+		status: "supported",
+		detail: "legacy alias of skipTrailingSlashRedirect"
 	},
 	reactCompiler: {
 		status: "partial",
@@ -433,8 +434,8 @@ const LIBRARY_SUPPORT = {
 		detail: "renders client-side; by default events are only collected when deployed on Vercel"
 	},
 	"next-intl": {
-		status: "partial",
-		detail: "auto-detected from (src/)i18n/request.{ts,tsx,js,jsx}, so createNextIntlPlugin isn't needed; client components can fail with \"No intl context found\" (cloudflare/vinext#177)"
+		status: "supported",
+		detail: "createNextIntlPlugin is only optional with the request config at (src/)i18n/request.*; its experimental messages, precompile and extract options don't work (they need webpack/Turbopack loaders)"
 	},
 	"@clerk/nextjs": {
 		status: "supported",

package/dist/cli.js

@@ -4,8 +4,8 @@ import { detectPackageManager, ensureViteConfigCompatibility, findViteConfigPath
 import { formatReport, runCheck } from "./check.js";
 import { parseArgs } from "./cli-args.js";
 import { findViteRoot, getViteCliInvocation, valueOptionName } from "./utils/vite-cli-invocation.js";
-import { init } from "./init.js";
 import { resolveInitOptions } from "./init-platform.js";
+import { init } from "./init.js";
 import { loadDotenv } from "./config/dotenv.js";
 import { PHASE_PRODUCTION_BUILD } from "./shims/constants.js";
 import { loadNextConfig, resolveNextConfig } from "./config/next-config.js";
@@ -275,6 +275,7 @@ function printHelp(cmd) {
     --no-install         Update dependency entries without installing them
     --force              Overwrite existing vite.config.ts
     --platform <target>  Deployment target: cloudflare or node
+    --name <name>        Cloudflare Worker name (default: derived from package.json)
     --prerender          Configure Vite builds to pre-render static routes
                          (Cloudflare deploy won't serve them unless using Static Assets)
     --warm-cache         Add cache warming to the Cloudflare deploy script

package/dist/client/client-redirect-matcher.d.ts

@@ -0,0 +1,14 @@
+import { RequestContext } from "../config/request-context.js";
+import { BasePathMatchState, RedirectMatch } from "../config/config-matchers.js";
+import { ClientRedirect } from "./client-redirects.js";
+//#region src/client/client-redirect-matcher.d.ts
+/**
+ * Resolve the first matching client-safe redirect. A matching server-owned
+ * rule stops client evaluation and returns null so a later client-safe rule
+ * cannot take its place. The navigation then continues as it does in Next.js,
+ * which never resolves config redirects in the browser: a document request (or
+ * a data request that falls back to one) reaches the server rule, while a page
+ * without data fetching renders without it.
+ */
+export declare function matchClientRedirect(pathname: string, redirects: ClientRedirect[], context: RequestContext, basePathState: BasePathMatchState): RedirectMatch | null;
+//#endregion

package/dist/client/client-redirect-matcher.js

@@ -0,0 +1,37 @@
+import { matchRedirect } from "../config/config-matchers.js";
+//#region src/client/client-redirect-matcher.ts
+const matcherRules = /* @__PURE__ */ new WeakMap();
+function getMatcherRule(redirect) {
+	let rule = matcherRules.get(redirect);
+	if (!rule) {
+		rule = [{
+			source: redirect.source,
+			destination: redirect.destination ?? "/",
+			permanent: redirect.permanent ?? false,
+			has: redirect.has,
+			missing: redirect.missing,
+			locale: redirect.locale,
+			basePath: redirect.basePath
+		}];
+		matcherRules.set(redirect, rule);
+	}
+	return rule;
+}
+/**
+* Resolve the first matching client-safe redirect. A matching server-owned
+* rule stops client evaluation and returns null so a later client-safe rule
+* cannot take its place. The navigation then continues as it does in Next.js,
+* which never resolves config redirects in the browser: a document request (or
+* a data request that falls back to one) reaches the server rule, while a page
+* without data fetching renders without it.
+*/
+function matchClientRedirect(pathname, redirects, context, basePathState) {
+	for (const redirect of redirects) {
+		const match = matchRedirect(pathname, getMatcherRule(redirect), context, basePathState);
+		if (match === null) continue;
+		return redirect.requiresServerEvaluation ? null : match;
+	}
+	return null;
+}
+//#endregion
+export { matchClientRedirect };

package/dist/client/client-redirects.d.ts

@@ -0,0 +1,27 @@
+import { NextRedirect, ResolvedNextConfig } from "../config/next-config.js";
+import { ClientHasCondition } from "./client-rewrites.js";
+//#region src/client/client-redirects.d.ts
+type ClientRedirectFields = Pick<NextRedirect, "basePath" | "locale" | "source"> & {
+  has?: ClientHasCondition[];
+  missing?: ClientHasCondition[];
+};
+/**
+ * Redirect data that is safe to publish in a browser bundle.
+ *
+ * Next.js keeps redirects in the server routes manifest only. Vinext resolves
+ * browser-authoritative redirects during Pages Router navigation, but rules
+ * with header or cookie conditions are server-owned: their condition values
+ * can be private, so the rule keeps only its source and client-safe
+ * conditions to preserve first-match ordering, and drops its destination.
+ */
+export type ClientRedirect = (ClientRedirectFields & {
+  destination: string;
+  permanent: boolean;
+  requiresServerEvaluation?: never;
+}) | (ClientRedirectFields & {
+  destination?: never;
+  permanent?: never;
+  requiresServerEvaluation: true;
+});
+export declare function toClientRedirects(redirects: ResolvedNextConfig["redirects"]): ClientRedirect[];
+//#endregion

package/dist/client/client-redirects.js

@@ -0,0 +1,28 @@
+import { isClientHasCondition } from "./client-rewrites.js";
+//#region src/client/client-redirects.ts
+function toClientRedirect(redirect) {
+	const hasServerOnlyCondition = (redirect.has?.some((condition) => !isClientHasCondition(condition)) ?? false) || (redirect.missing?.some((condition) => !isClientHasCondition(condition)) ?? false);
+	const clientHas = redirect.has?.filter(isClientHasCondition);
+	const clientMissing = redirect.missing?.filter(isClientHasCondition);
+	const common = {
+		source: redirect.source,
+		has: clientHas?.length ? clientHas : void 0,
+		missing: clientMissing?.length ? clientMissing : void 0,
+		locale: redirect.locale,
+		basePath: redirect.basePath
+	};
+	if (hasServerOnlyCondition) return {
+		...common,
+		requiresServerEvaluation: true
+	};
+	return {
+		...common,
+		destination: redirect.destination,
+		permanent: redirect.permanent
+	};
+}
+function toClientRedirects(redirects) {
+	return redirects.map(toClientRedirect);
+}
+//#endregion
+export { toClientRedirects };

package/dist/client/client-rewrites.d.ts

@@ -1,6 +1,6 @@
 import { HasCondition, NextRewrite, ResolvedNextConfig } from "../config/next-config.js";
 //#region src/client/client-rewrites.d.ts
-type ClientHasCondition = Omit<HasCondition, "type"> & {
+export type ClientHasCondition = Omit<HasCondition, "type"> & {
   type: "host" | "query";
 };
 type ClientRewriteFields = Pick<NextRewrite, "basePath" | "locale" | "source"> & {
@@ -26,5 +26,6 @@ export type ClientRewrites = {
   beforeFiles: ClientRewrite[];
   fallback: ClientRewrite[];
 };
+export declare function isClientHasCondition(condition: HasCondition): condition is ClientHasCondition;
 export declare function toClientRewrites(rewrites: ResolvedNextConfig["rewrites"]): ClientRewrites;
 //#endregion

package/dist/client/client-rewrites.js

@@ -38,4 +38,4 @@ function toClientRewrites(rewrites) {
 	};
 }
 //#endregion
-export { toClientRewrites };
+export { isClientHasCondition, toClientRewrites };

package/dist/client/navigation-runtime.d.ts

@@ -57,6 +57,17 @@ export type NavigationRuntimeFunctions = {
   preparePrefetchResponse?: (response: Response) => Promise<unknown>;
   claimCurrentHistoryTreeSnapshot?: (historyUpdateMode: NavigationRuntimeHistoryUpdateMode, previousHistoryState: unknown) => void;
   commitAppOwnedHistoryStateWrite?: (historyUpdateMode: NavigationRuntimeHistoryUpdateMode, previousHistoryState: unknown) => void;
+  /**
+   * Called after a raw (non-app-owned) history.pushState/replaceState with a
+   * URL so an App Router navigation that has not committed yet is discarded,
+   * matching Next.js' ACTION_RESTORE.
+   */
+  discardPendingNavigation?: () => void;
+  /**
+   * Called before any history.pushState/replaceState so a navigation React is
+   * committing writes its URL first, as Next.js does from an insertion effect.
+   */
+  flushCommittingNavigationUrl?: () => void;
 };
 export type NavigationRuntimeBootstrap = {
   routeManifest: RouteManifest | null;

package/dist/client/navigation-runtime.js

@@ -31,7 +31,7 @@ function readRuntimeWindow() {
 }
 function isNavigationRuntimeFunctions(value) {
 	if (!isUnknownRecord(value)) return false;
-	return isOptionalRuntimeFunction(Reflect.get(value, "clearNavigationCaches")) && isOptionalRuntimeFunction(Reflect.get(value, "commitHashNavigation")) && isOptionalRuntimeFunction(Reflect.get(value, "navigateExternal")) && isOptionalRuntimeFunction(Reflect.get(value, "navigate")) && isOptionalRuntimeFunction(Reflect.get(value, "getPrefetchRouterState")) && isOptionalRuntimeFunction(Reflect.get(value, "notifyLinkNavigationStart")) && isOptionalRuntimeFunction(Reflect.get(value, "pingVisibleLinks")) && isOptionalRuntimeFunction(Reflect.get(value, "preparePrefetchResponse")) && isOptionalRuntimeFunction(Reflect.get(value, "claimCurrentHistoryTreeSnapshot")) && isOptionalRuntimeFunction(Reflect.get(value, "commitAppOwnedHistoryStateWrite"));
+	return isOptionalRuntimeFunction(Reflect.get(value, "clearNavigationCaches")) && isOptionalRuntimeFunction(Reflect.get(value, "commitHashNavigation")) && isOptionalRuntimeFunction(Reflect.get(value, "navigateExternal")) && isOptionalRuntimeFunction(Reflect.get(value, "navigate")) && isOptionalRuntimeFunction(Reflect.get(value, "getPrefetchRouterState")) && isOptionalRuntimeFunction(Reflect.get(value, "notifyLinkNavigationStart")) && isOptionalRuntimeFunction(Reflect.get(value, "pingVisibleLinks")) && isOptionalRuntimeFunction(Reflect.get(value, "preparePrefetchResponse")) && isOptionalRuntimeFunction(Reflect.get(value, "claimCurrentHistoryTreeSnapshot")) && isOptionalRuntimeFunction(Reflect.get(value, "commitAppOwnedHistoryStateWrite")) && isOptionalRuntimeFunction(Reflect.get(value, "discardPendingNavigation")) && isOptionalRuntimeFunction(Reflect.get(value, "flushCommittingNavigationUrl"));
 }
 function isNavigationRuntimeRscChunk(value) {
 	if (typeof value === "string") return true;

package/dist/config/config-matchers.d.ts

@@ -1,5 +1,6 @@
 import { HasCondition, NextHeader, NextI18nConfig, NextRedirect, NextRewrite } from "./next-config.js";
 import { RequestContext, normalizeHost, parseCookies, requestContextFromRequest } from "./request-context.js";
+import { RedirectDestinationQueryPart } from "./destination-params.js";
 import { isExternalUrl } from "../utils/external-url.js";
 //#region src/config/config-matchers.d.ts
 /**
@@ -75,6 +76,15 @@ export declare function applyMiddlewareRequestHeaders(middlewareHeaders: Record<
 };
 export declare function checkHasConditions(has: HasCondition[] | undefined, missing: HasCondition[] | undefined, ctx: RequestContext): boolean;
 export declare function matchConfigPattern(pathname: string, pattern: string): Record<string, string> | null;
+/**
+ * A matched config redirect. `destinationQuery` holds the destination query's
+ * parts, split before params were substituted, for merging the request query.
+ */
+export type RedirectMatch = {
+  destination: string;
+  permanent: boolean;
+  destinationQuery: RedirectDestinationQueryPart[];
+};
 /**
  * Apply redirect rules from next.config.js.
  * Returns the redirect info if a redirect was matched, or null.
@@ -110,10 +120,7 @@ export declare function matchConfigPattern(pathname: string, pattern: string): R
  * an original index < N are checked via matchConfigPattern first — they are
  * few in practice (typically zero) so this is not a hot-path concern.
  */
-export declare function matchRedirect(pathname: string, redirects: NextRedirect[], ctx: RequestContext, basePathState?: BasePathMatchState, onRuleSourceMatch?: (rule: NextRedirect) => void): {
-  destination: string;
-  permanent: boolean;
-} | null;
+export declare function matchRedirect(pathname: string, redirects: NextRedirect[], ctx: RequestContext, basePathState?: BasePathMatchState, onRuleSourceMatch?: (rule: NextRedirect) => void): RedirectMatch | null;
 /**
  * Apply rewrite rules from next.config.js.
  * Returns the rewritten URL or null if no rewrite matched.
@@ -142,7 +149,8 @@ export declare function matchesRewriteSource(pathname: string, rewrite: NextRewr
  * users off-site.
  *
  * This function collapses any leading double (or more) slashes to a single
- * slash for non-external (relative) destinations.
+ * slash for non-external (relative) destinations, including tab/newline and
+ * leading C0 control characters that browsers ignore while parsing.
  */
 export declare function sanitizeDestination(dest: string): string;
 /**
@@ -162,13 +170,20 @@ export declare function sanitizeDestination(dest: string): string;
  * still treated as an RSC fetch. Dropping it breaks RSC fetch semantics
  * (issue #1529).
  *
- * Destination query params win — a request param is only carried over when
- * the destination does not already specify that key. Mirrors the merge
- * semantics in `proxyExternalRequest`. External destinations are returned
- * untouched (a config redirect to another origin should not leak the
- * original request's query).
+ * Ported from Next.js's `{ ...requestQuery, ...destinationQuery }` merge and
+ * `stringifyQuery`: request keys keep their order (integer-like keys first, as
+ * in a JS object), a destination key overrides the request value in place,
+ * and destination-only keys follow. Request keys and values are re-encoded;
+ * destination query text is emitted verbatim, except that, like Next.js,
+ * destination strings equal to a request key or value are re-encoded too.
+ * Pass the match's
+ * `destinationQuery` so substituted params keep their value boundaries;
+ * without it the destination's own query is split. External destinations are returned untouched (a config redirect to another
+ * origin should not leak the original request's query).
+ *
+ * https://github.com/vercel/next.js/blob/canary/packages/next/src/server/server-route-utils.ts
  */
-export declare function preserveRedirectDestinationQuery(destination: string, requestSearch: string): string;
+export declare function preserveRedirectDestinationQuery(destination: string, requestSearch: string, destinationQuery?: RedirectDestinationQueryPart[]): string;
 /**
  * Proxy an incoming request to an external URL and return the upstream response.
  *

package/dist/config/config-matchers.js

@@ -3,6 +3,7 @@ import { buildRequestHeadersFromMiddlewareResponse, getUnconsumedMiddlewareReque
 import { analyzeRegexSafety } from "../utils/regex-safety.js";
 import { normalizeHost, parseCookies, requestContextFromRequest } from "./request-context.js";
 import { isExternalUrl } from "../utils/external-url.js";
+import { substituteDestinationParams, substituteRedirectDestinationQuery } from "./destination-params.js";
 //#region src/config/config-matchers.ts
 /**
 * Cache for compiled regex patterns in matchConfigPattern.
@@ -44,14 +45,6 @@ const _compiledHeaderSourceCache = /* @__PURE__ */ new Map();
 */
 const _compiledConditionCache = /* @__PURE__ */ new Map();
 /**
-* Cache for destination substitution regexes in substituteDestinationParams.
-*
-* The regex depends only on the set of param keys captured from the matched
-* source pattern. Caching by sorted key list avoids recompiling a new RegExp
-* for repeated redirect/rewrite calls that use the same param shape.
-*/
-const _compiledDestinationParamCache = /* @__PURE__ */ new Map();
-/**
 * Generic helper for the regex compilation caches above.
 *
 * Each cache stores the compiled artifact (or `null` when safeRegExp rejected
@@ -307,6 +300,7 @@ function applyMiddlewareRequestHeaders(middlewareHeaders, request) {
 		method: request.method,
 		headers: nextHeaders,
 		body: request.body,
+		signal: request.signal,
 		duplex: request.body ? "half" : void 0
 	});
 	return {
@@ -560,13 +554,10 @@ function matchRedirect(pathname, redirects, ctx, basePathState = _BASEPATH_DEFAU
 			onRuleSourceMatch?.(redirect);
 			const conditionParams = redirect.has || redirect.missing ? collectConditionParams(redirect.has, redirect.missing, ctx) : _emptyParams();
 			if (!conditionParams) continue;
-			localeMatch = {
-				destination: substituteAndSanitizeDestination(redirect.destination, {
-					[entry.paramName]: "",
-					...conditionParams
-				}),
-				permanent: redirect.permanent
-			};
+			localeMatch = resolveRedirectMatch(redirect, {
+				[entry.paramName]: "",
+				...conditionParams
+			});
 			localeMatchIndex = entry.originalIndex;
 			break;
 		}
@@ -583,13 +574,10 @@ function matchRedirect(pathname, redirects, ctx, basePathState = _BASEPATH_DEFAU
 				onRuleSourceMatch?.(redirect);
 				const conditionParams = redirect.has || redirect.missing ? collectConditionParams(redirect.has, redirect.missing, ctx) : _emptyParams();
 				if (!conditionParams) continue;
-				localeMatch = {
-					destination: substituteAndSanitizeDestination(redirect.destination, {
-						[entry.paramName]: localePart,
-						...conditionParams
-					}),
-					permanent: redirect.permanent
-				};
+				localeMatch = resolveRedirectMatch(redirect, {
+					[entry.paramName]: localePart,
+					...conditionParams
+				});
 				localeMatchIndex = entry.originalIndex;
 				break;
 			}
@@ -603,13 +591,10 @@ function matchRedirect(pathname, redirects, ctx, basePathState = _BASEPATH_DEFAU
 			onRuleSourceMatch?.(redirect);
 			const conditionParams = redirect.has || redirect.missing ? collectConditionParams(redirect.has, redirect.missing, ctx) : _emptyParams();
 			if (!conditionParams) continue;
-			return {
-				destination: substituteAndSanitizeDestination(redirect.destination, {
-					...params,
-					...conditionParams
-				}),
-				permanent: redirect.permanent
-			};
+			return resolveRedirectMatch(redirect, {
+				...params,
+				...conditionParams
+			});
 		}
 	}
 	return localeMatch;
@@ -635,12 +620,24 @@ function matchRewrite(pathname, rewrites, ctx, basePathState = _BASEPATH_DEFAULT
 				...params,
 				...conditionParams
 			};
-			return substituteAndSanitizeRewriteDestination(rewrite.destination, rewriteParams);
+			return substituteAndSanitizeRewriteDestination(serializeRewriteDestinationTemplate(rewrite.destination), rewriteParams);
 		}
 	}
 	return null;
 }
 /**
+* Next.js prepareDestination URL-parses the destination template before it
+* substitutes params, so a literal `é` routes as `%C3%A9` while substituted
+* values stay verbatim: a captured `../admin` is never resolved to `/admin`.
+*
+* https://github.com/vercel/next.js/blob/canary/packages/next/src/shared/lib/router/utils/prepare-destination.ts
+*/
+function serializeRewriteDestinationTemplate(destination) {
+	if (!destination.startsWith("/") || destination.startsWith("//")) return destination;
+	const parsed = new URL(destination, "http://n");
+	return parsed.pathname + parsed.search + parsed.hash;
+}
+/**
 * Check whether a rewrite source can match a pathname without evaluating its
 * request-dependent `has` / `missing` conditions.
 *
@@ -653,47 +650,20 @@ function matchesRewriteSource(pathname, rewrite, basePathState = _BASEPATH_DEFAU
 	return shouldEvaluateRule(rewrite.basePath, basePathState) && matchConfigPattern(pathname, rewrite.source) !== null;
 }
 /**
-* Substitute all matched route params into a redirect/rewrite destination.
-*
-* Handles repeated params (e.g. `/api/:id/:id`) and catch-all suffix forms
-* (`:path*`, `:path+`) in a single pass. Unknown params are left intact.
-*/
-function substituteDestinationParams(destination, params) {
-	const keys = Object.keys(params);
-	if (keys.length === 0) return destination;
-	const sortedKeys = [...keys].sort((a, b) => b.length - a.length);
-	const cacheKey = sortedKeys.join("\0");
-	let paramRe = _compiledDestinationParamCache.get(cacheKey);
-	if (!paramRe) {
-		const paramAlternation = sortedKeys.map((key) => key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
-		paramRe = new RegExp(`:(${paramAlternation})([+*])?(?![A-Za-z0-9_])`, "g");
-		_compiledDestinationParamCache.set(cacheKey, paramRe);
-	}
-	const replaceParams = (value, encodeParam) => value.replace(paramRe, (_token, key) => encodeParam(params[key]));
-	const hashIndex = destination.indexOf("#");
-	const beforeHash = hashIndex === -1 ? destination : destination.slice(0, hashIndex);
-	const hash = hashIndex === -1 ? "" : destination.slice(hashIndex);
-	const queryIndex = beforeHash.indexOf("?");
-	if (queryIndex !== -1) {
-		const beforeQuery = beforeHash.slice(0, queryIndex);
-		const query = beforeHash.slice(queryIndex + 1);
-		return `${replaceParams(beforeQuery, (value) => value)}?${replaceParams(query, encodeDestinationQueryParamValue)}${replaceParams(hash, (value) => value)}`;
-	}
-	return replaceParams(destination, (value) => value);
-}
-function encodeDestinationQueryParamValue(value) {
-	const params = new URLSearchParams();
-	params.set("", value);
-	return params.toString().slice(1);
-}
-/**
 * Substitute params into a redirect/rewrite destination and sanitize the
 * result. Used by every redirect/rewrite branch — the substitution can
 * introduce protocol-relative URLs (e.g. `//evil.com` from a decoded `%2F`
 * in a catch-all param), which sanitizeDestination collapses.
 */
-function substituteAndSanitizeDestination(destination, params) {
-	return sanitizeDestination(substituteDestinationParams(destination, params));
+function substituteAndSanitizeDestination(destination, params, kind) {
+	return sanitizeDestination(substituteDestinationParams(destination, params, kind));
+}
+function resolveRedirectMatch(redirect, params) {
+	return {
+		destination: substituteAndSanitizeDestination(redirect.destination, params, "redirect"),
+		permanent: redirect.permanent,
+		destinationQuery: substituteRedirectDestinationQuery(redirect.destination, params)
+	};
 }
 /**
 * Match Next.js's rewrite-specific prepareDestination behavior: source params
@@ -703,7 +673,7 @@ function substituteAndSanitizeDestination(destination, params) {
 * https://github.com/vercel/next.js/blob/canary/packages/next/src/shared/lib/router/utils/prepare-destination.ts
 */
 function substituteAndSanitizeRewriteDestination(destination, params) {
-	const rewritten = substituteAndSanitizeDestination(destination, params);
+	const rewritten = substituteAndSanitizeDestination(destination, params, "rewrite");
 	if (!shouldAppendRewriteParamsToQuery(destination, params)) return rewritten;
 	const existingQueryKeys = getDestinationQueryKeys(destination);
 	const paramsToAppend = [];
@@ -770,11 +740,12 @@ function appendQueryParams(url, params) {
 * users off-site.
 *
 * This function collapses any leading double (or more) slashes to a single
-* slash for non-external (relative) destinations.
+* slash for non-external (relative) destinations, including tab/newline and
+* leading C0 control characters that browsers ignore while parsing.
 */
 function sanitizeDestination(dest) {
 	if (dest.startsWith("http://") || dest.startsWith("https://")) return dest;
-	dest = dest.replace(/^[\\/]+/, "/");
+	dest = dest.replace(/^[\u0000-\u0020]*(?:[\\/][\t\n\r]*)+/, "/");
 	return dest;
 }
 /**
@@ -794,13 +765,20 @@ function sanitizeDestination(dest) {
 * still treated as an RSC fetch. Dropping it breaks RSC fetch semantics
 * (issue #1529).
 *
-* Destination query params win — a request param is only carried over when
-* the destination does not already specify that key. Mirrors the merge
-* semantics in `proxyExternalRequest`. External destinations are returned
-* untouched (a config redirect to another origin should not leak the
-* original request's query).
+* Ported from Next.js's `{ ...requestQuery, ...destinationQuery }` merge and
+* `stringifyQuery`: request keys keep their order (integer-like keys first, as
+* in a JS object), a destination key overrides the request value in place,
+* and destination-only keys follow. Request keys and values are re-encoded;
+* destination query text is emitted verbatim, except that, like Next.js,
+* destination strings equal to a request key or value are re-encoded too.
+* Pass the match's
+* `destinationQuery` so substituted params keep their value boundaries;
+* without it the destination's own query is split. External destinations are returned untouched (a config redirect to another
+* origin should not leak the original request's query).
+*
+* https://github.com/vercel/next.js/blob/canary/packages/next/src/server/server-route-utils.ts
 */
-function preserveRedirectDestinationQuery(destination, requestSearch) {
+function preserveRedirectDestinationQuery(destination, requestSearch, destinationQuery) {
 	if (requestSearch === "" || requestSearch === "?" || isExternalUrl(destination)) return destination;
 	const requestParams = new URLSearchParams(requestSearch);
 	if ([...requestParams.keys()].length === 0) return destination;
@@ -809,13 +787,29 @@ function preserveRedirectDestinationQuery(destination, requestSearch) {
 	const beforeHash = hashIndex === -1 ? destination : destination.slice(0, hashIndex);
 	const queryIndex = beforeHash.indexOf("?");
 	const pathPart = queryIndex === -1 ? beforeHash : beforeHash.slice(0, queryIndex);
-	const destQuery = queryIndex === -1 ? "" : beforeHash.slice(queryIndex + 1);
-	const merged = new URLSearchParams(destQuery);
-	const destKeys = new Set(merged.keys());
-	for (const [key, value] of requestParams) if (!destKeys.has(key)) merged.append(key, value);
-	const mergedQuery = merged.toString();
+	const requestStrings = /* @__PURE__ */ new Set();
+	const requestParts = Object.create(null);
+	for (const [key, value] of requestParams) {
+		requestStrings.add(key);
+		requestStrings.add(value);
+		(requestParts[key] ??= []).push(`${encodeURIComponent(key)}=${encodeURIComponent(value)}`);
+	}
+	const encode = (text) => requestStrings.has(text) ? encodeURIComponent(text) : text;
+	const destinationParts = Object.create(null);
+	for (const [key, keyText, valueText] of destinationQuery ?? substituteRedirectDestinationQuery(destination, {})) (destinationParts[key] ??= []).push(valueText === null ? encode(keyText) : `${encode(keyText)}=${encode(valueText)}`);
+	const mergedQuery = Object.values({
+		...requestParts,
+		...destinationParts
+	}).flat().join("&");
 	return mergedQuery === "" ? `${pathPart}${hash}` : `${pathPart}?${mergedQuery}${hash}`;
 }
+function parseExternalRewriteUrl(externalUrl) {
+	try {
+		return new URL(externalUrl);
+	} catch {
+		return null;
+	}
+}
 /**
 * Proxy an incoming request to an external URL and return the upstream response.
 *
@@ -827,7 +821,11 @@ function preserveRedirectDestinationQuery(destination, requestSearch) {
 */
 async function proxyExternalRequest(request, externalUrl) {
 	const originalUrl = new URL(request.url);
-	const targetUrl = new URL(externalUrl);
+	const targetUrl = parseExternalRewriteUrl(externalUrl);
+	if (!targetUrl) {
+		console.error("[vinext] Invalid external rewrite destination:", externalUrl);
+		return new Response("Internal Server Error", { status: 500 });
+	}
 	const destinationKeys = new Set(targetUrl.searchParams.keys());
 	for (const [key, value] of originalUrl.searchParams) if (!destinationKeys.has(key)) targetUrl.searchParams.append(key, value);
 	const headers = new Headers(request.headers);
@@ -859,9 +857,10 @@ async function proxyExternalRequest(request, externalUrl) {
 	try {
 		upstreamResponse = await fetch(targetUrl.href, {
 			...init,
-			signal: controller.signal
+			signal: AbortSignal.any([request.signal, controller.signal])
 		});
 	} catch (e) {
+		if (request.signal.aborted && !controller.signal.aborted) return new Response(null, { status: 499 });
 		if (e instanceof Error && e.name === "AbortError") {
 			console.error("[vinext] External rewrite proxy timeout:", targetUrl.href);
 			return new Response("Gateway Timeout", { status: 504 });