vinext 1.0.1 → 1.2.0

package/dist/server/middleware-runtime.d.ts

@@ -10,6 +10,8 @@ export type MiddlewareResult = {
   redirectUrl?: string;
   redirectStatus?: number;
   rewriteUrl?: string;
+  /** False when a same-origin rewrite target was outside the basePath. */
+  rewriteHadBasePath?: boolean;
   rewriteStatus?: number;
   status?: number;
   responseHeaders?: Headers;
@@ -41,6 +43,11 @@ type ExecuteMiddlewareOptions = {
    * must derive and forward this from trusted URL normalization.
    */
   isDataRequest?: boolean;
+  /**
+   * The data request names a buildId other than the current build. Adapters
+   * pass it raw to middleware only under `skipProxyUrlNormalize`.
+   */
+  isStaleDataRequest?: boolean;
   isProxy: boolean;
   module: MiddlewareModule;
   normalizedPathname?: string;
@@ -63,6 +70,12 @@ type ExecuteMiddlewareOptions = {
    * `new URL('/x', req.url)`.
    */
   trailingSlash?: boolean;
+  /**
+   * next.config `skipTrailingSlashRedirect`. Middleware then sees requests in
+   * either slash form, so NextURL keeps each request's own trailing slash and
+   * redirect Locations keep theirs, as Next.js's `getNextPathnameInfo` does.
+   */
+  skipTrailingSlashRedirect?: boolean;
 };
 type RunGeneratedMiddlewareOptions = ExecuteMiddlewareOptions & {
   ctx?: ExecutionContextLike;

package/dist/server/middleware-runtime.js

@@ -8,12 +8,14 @@ import { getRequestExecutionContext, runWithExecutionContext } from "../shims/re
 import "./server-globals.js";
 import { MIDDLEWARE_REWRITE_HEADER } from "./headers.js";
 import { NextFetchEvent, NextRequest } from "../shims/server.js";
+import { runInWorkStoreScope } from "../shims/internal/work-store-scope.js";
 import { normalizePath } from "./normalize-path.js";
 import { matchesMiddleware, matchesMiddlewarePathname } from "./middleware-matcher.js";
 import { badRequestResponse, internalServerErrorResponse } from "./http-error-responses.js";
 import { isOpenRedirectShaped } from "./open-redirect.js";
 import { processMiddlewareHeaders } from "./request-pipeline.js";
 import { normalizeDefaultLocalePathname } from "./pages-i18n.js";
+import { nextDataMiddlewareMatchPathname } from "./pages-data-route.js";
 import { reportRequestError } from "./instrumentation.js";
 import { isValidNavigationSignalError } from "../utils/navigation-signal.js";
 import { frameworkTracer } from "./tracer.js";
@@ -133,7 +135,7 @@ function resolveMiddlewarePathname(request) {
 		return badRequestResponse();
 	}
 }
-function createNextRequest(request, i18nConfig, basePath, trailingSlash, hadBasePath, requestBodyAlreadyIsolated = false) {
+function createNextRequest(request, i18nConfig, basePath, trailingSlash, hadBasePath, requestBodyAlreadyIsolated = false, skipTrailingSlashRedirect = false) {
 	const url = new URL(request.url);
 	let mwRequest = !requestBodyAlreadyIsolated && request.body && !request.bodyUsed ? request.clone() : request;
 	const requestPathname = url.pathname;
@@ -143,10 +145,11 @@ function createNextRequest(request, i18nConfig, basePath, trailingSlash, hadBase
 		mwUrl.pathname = mwPathname;
 		mwRequest = new Request(mwUrl, mwRequest);
 	}
-	const nextConfig = basePath || i18nConfig || trailingSlash ? {
+	const nextConfig = basePath || i18nConfig || trailingSlash || skipTrailingSlashRedirect ? {
 		basePath: basePath ?? "",
 		i18n: i18nConfig ?? void 0,
-		trailingSlash: trailingSlash ?? void 0
+		trailingSlash: trailingSlash ?? void 0,
+		skipTrailingSlashRedirect
 	} : void 0;
 	const nextRequest = mwRequest instanceof NextRequest && (!mwRequest.body || mwRequest.bodyUsed) ? mwRequest : new NextRequest(mwRequest, nextConfig ? { nextConfig } : void 0);
 	if (mwRequest !== request && mwRequest.body && !mwRequest.bodyUsed && !mwRequest.body.locked) mwRequest.body.cancel().catch(() => {});
@@ -164,7 +167,10 @@ function releaseMiddlewareRequestBody(request, waitUntilPromises, retainedByResp
 	}
 	Promise.allSettled(waitUntilPromises).then(cancel);
 }
-async function executeMiddleware(options) {
+function executeMiddleware(options) {
+	return runInWorkStoreScope(() => executeMiddlewareModule(options));
+}
+async function executeMiddlewareModule(options) {
 	const middlewareFn = resolveMiddlewareModuleHandler(options.module, {
 		filePath: options.filePath,
 		isProxy: options.isProxy
@@ -187,14 +193,17 @@ async function executeMiddleware(options) {
 		if (options.hadBasePath === true) return candidate;
 		return matcher === void 0 ? candidate : null;
 	};
-	const encodedMatchPathname = prepareMatcherPathname(encodedRequestPathname);
+	const isStaleDataRequest = options.isDataRequest === true && options.isStaleDataRequest === true;
+	const toPageMatcherPathname = (candidate) => candidate !== null && options.isDataRequest && !isStaleDataRequest ? nextDataMiddlewareMatchPathname(candidate) ?? candidate : candidate;
+	const encodedMatchPathname = toPageMatcherPathname(prepareMatcherPathname(encodedRequestPathname));
 	let decodedMatchPathname = encodedMatchPathname;
 	try {
 		if (encodedMatchPathname !== null) decodedMatchPathname = decodeURIComponent(encodedMatchPathname);
-		else if (!options.i18nConfig) decodedMatchPathname = prepareMatcherPathname(decodeURIComponent(encodedRequestPathname));
+		else if (!options.i18nConfig) decodedMatchPathname = toPageMatcherPathname(prepareMatcherPathname(decodeURIComponent(encodedRequestPathname)));
 	} catch {}
 	let localeContext;
-	if (options.i18nConfig && encodedMatchPathname !== null) {
+	if (isStaleDataRequest) localeContext = { kind: "next-data" };
+	else if (options.i18nConfig && encodedMatchPathname !== null) {
 		const hostname = normalizeHost(options.request.headers.get("host"), requestUrl.hostname);
 		const firstSegment = encodedMatchPathname.split("/", 3)[1];
 		if (firstSegment !== void 0 && options.i18nConfig.locales.some((locale) => locale.toLowerCase() === firstSegment.toLowerCase())) localeContext = { kind: "literal" };
@@ -210,7 +219,7 @@ async function executeMiddleware(options) {
 	const decodedMatches = !encodedMatches && decodedMatchPathname !== null && decodedMatchPathname !== encodedMatchPathname && matchesMiddleware(decodedMatchPathname, matcher, options.request, options.i18nConfig, localeContext);
 	if (!encodedMatches && !decodedMatches) return { continue: true };
 	options.onMatch?.();
-	const nextRequest = createNextRequest(options.request, options.i18nConfig, options.basePath, options.trailingSlash, hadBasePath, options.requestBodyAlreadyIsolated);
+	const nextRequest = createNextRequest(options.request, options.i18nConfig, options.basePath, options.trailingSlash, hadBasePath, options.requestBodyAlreadyIsolated, options.skipTrailingSlashRedirect);
 	if (options.isDataRequest) Object.defineProperty(nextRequest, "__isData", {
 		enumerable: false,
 		value: true
@@ -248,21 +257,12 @@ async function executeMiddleware(options) {
 			waitUntilPromises
 		};
 	}
-	if (response.headers.get("x-middleware-next") === "1") {
-		releaseMiddlewareRequestBody(nextRequest, waitUntilPromises);
-		return {
-			continue: true,
-			responseHeaders: collectMiddlewareHeaders(response),
-			status: response.status !== 200 ? response.status : void 0,
-			waitUntilPromises
-		};
-	}
 	if (response.status >= 300 && response.status < 400) {
 		const location = response.headers.get("Location") ?? response.headers.get("location");
 		if (location) {
 			const relativeLocation = relativizeLocation(location, options.request.url);
 			let normalizedLocation = relativeLocation;
-			if (options.trailingSlash !== void 0) try {
+			if (options.trailingSlash !== void 0 && !options.skipTrailingSlashRedirect) try {
 				const loc = new URL(relativeLocation, options.request.url);
 				if (loc.origin === new URL(options.request.url).origin) {
 					const p = loc.pathname;
@@ -309,11 +309,14 @@ async function executeMiddleware(options) {
 	const rewriteUrl = response.headers.get(MIDDLEWARE_REWRITE_HEADER);
 	if (rewriteUrl) {
 		let rewritePath;
+		let rewriteHadBasePath;
 		try {
 			const rewriteParsed = new URL(rewriteUrl, options.request.url);
 			const requestOrigin = new URL(options.request.url).origin;
-			if (rewriteParsed.origin === requestOrigin) rewritePath = (options.basePath ? stripBasePath(rewriteParsed.pathname, options.basePath) : rewriteParsed.pathname) + rewriteParsed.search;
-			else rewritePath = rewriteParsed.href;
+			if (rewriteParsed.origin === requestOrigin) {
+				rewriteHadBasePath = !options.basePath || hasBasePath(rewriteParsed.pathname, options.basePath);
+				rewritePath = (options.basePath ? stripBasePath(rewriteParsed.pathname, options.basePath) : rewriteParsed.pathname) + rewriteParsed.search;
+			} else rewritePath = rewriteParsed.href;
 		} catch {
 			rewritePath = rewriteUrl;
 		}
@@ -321,12 +324,22 @@ async function executeMiddleware(options) {
 		return {
 			continue: true,
 			rewriteUrl: rewritePath,
+			rewriteHadBasePath,
 			rewriteStatus: response.status !== 200 ? response.status : void 0,
 			responseHeaders: collectMiddlewareHeaders(response),
 			status: response.status !== 200 ? response.status : void 0,
 			waitUntilPromises
 		};
 	}
+	if (response.headers.get("x-middleware-next") === "1") {
+		releaseMiddlewareRequestBody(nextRequest, waitUntilPromises);
+		return {
+			continue: true,
+			responseHeaders: collectMiddlewareHeaders(response),
+			status: response.status !== 200 ? response.status : void 0,
+			waitUntilPromises
+		};
+	}
 	releaseMiddlewareRequestBody(nextRequest, waitUntilPromises, response.body === nextRequest.body);
 	return {
 		continue: false,

package/dist/server/middleware.d.ts

@@ -44,6 +44,6 @@ export declare function findMiddlewareFile(root: string, fileMatcher: ValidFileM
  * @param request - The incoming Request object
  * @returns Middleware result describing what action to take
  */
-export declare function runMiddleware(runner: ModuleRunner, middlewarePath: string, request: Request, i18nConfig?: NextI18nConfig | null, basePath?: string, trailingSlash?: boolean, isDataRequest?: boolean, normalizedPathname?: string): Promise<MiddlewareResult>;
+export declare function runMiddleware(runner: ModuleRunner, middlewarePath: string, request: Request, i18nConfig?: NextI18nConfig | null, basePath?: string, trailingSlash?: boolean, isDataRequest?: boolean, normalizedPathname?: string, isStaleDataRequest?: boolean, skipTrailingSlashRedirect?: boolean): Promise<MiddlewareResult>;
 //#endregion
 export { matchPattern, matchesMiddleware };

package/dist/server/middleware.js

@@ -77,7 +77,7 @@ function isMiddlewareModule(value) {
 * @param request - The incoming Request object
 * @returns Middleware result describing what action to take
 */
-async function runMiddleware(runner, middlewarePath, request, i18nConfig, basePath, trailingSlash, isDataRequest, normalizedPathname) {
+async function runMiddleware(runner, middlewarePath, request, i18nConfig, basePath, trailingSlash, isDataRequest, normalizedPathname, isStaleDataRequest, skipTrailingSlashRedirect) {
 	const mod = await runner.import(middlewarePath);
 	if (!isMiddlewareModule(mod)) throw new Error(`Middleware module "${middlewarePath}" did not evaluate to an object.`);
 	return runGeneratedMiddleware({
@@ -87,10 +87,12 @@ async function runMiddleware(runner, middlewarePath, request, i18nConfig, basePa
 		i18nConfig,
 		includeErrorDetails: process.env.NODE_ENV !== "production",
 		isDataRequest,
+		isStaleDataRequest,
 		isProxy: isProxyFile(middlewarePath),
 		module: mod,
 		normalizedPathname,
 		request,
+		skipTrailingSlashRedirect,
 		trailingSlash
 	});
 }

package/dist/server/multi-stage.d.ts

@@ -21,6 +21,25 @@ export type VinextResponseStageDispatchOptions = {
    * opt into completed-response admission and honor core's `no-store` policy.
    */
   cache: "shared" | "bypass";
+  /**
+   * Render an App page document whole before its first byte, as Next.js
+   * renders a static page, so its streamed metadata is in `<head>`. An adapter
+   * sets this for a render no client is waiting on, such as a regeneration or
+   * a deployment warm-up. It is not a cache selector: a transport must not
+   * partition its lookup or stored entry by it.
+   */
+  renderWholeDocument?: boolean;
+  /**
+   * Regenerate an entry the adapter already stores for this build. Set only
+   * from a platform-invoked regeneration callback or a platform cache's
+   * conditional revalidation of a stored entry, never from anything a client
+   * can send: core then treats the path as admitted and skips
+   * request-time admission work such as a Pages `getStaticPaths()` call, as
+   * Next.js regenerates a generated path without consulting it. It is not a
+   * cache selector: a transport must not partition its lookup or stored entry
+   * by it.
+   */
+  regeneratesStoredEntry?: boolean;
   /**
    * Query-free identity of a shared App page GET/HEAD dispatch, supplied only
    * to adapters that declare `responseStageCacheIdentity: "query-free"` and

package/dist/server/navigation-planner.js

@@ -1,8 +1,8 @@
 import { splitPathnameForRouteMatch } from "../routing/utils.js";
 import { stripBasePath } from "../utils/base-path.js";
+import { matchRoutePattern, matchRoutePatternPrefix, matchRoutePatternWithOptionalDynamicSegments } from "../routing/route-pattern.js";
 import { AppElementsWire, compareAppElementsSlotIds } from "./app-elements-wire.js";
 import "./app-elements.js";
-import { matchRoutePattern, matchRoutePatternPrefix, matchRoutePatternWithOptionalDynamicSegments } from "../routing/route-pattern.js";
 import { resolveHardNavigationTargetFromRscResponse, resolveRscCompatibilityNavigationDecision } from "./app-rsc-cache-busting.js";
 import { resolveRscRedirectLifecycleHop, resolveStreamedRscRedirectLifecycleHop } from "./app-browser-rsc-redirect.js";
 import { NavigationTraceReasonCodes, createNavigationLifecycleTraceFields, createNavigationTrace } from "./navigation-trace.js";

package/dist/server/node-response-signal.d.ts

@@ -0,0 +1,16 @@
+import { Writable } from "node:stream";
+//#region src/server/node-response-signal.d.ts
+export declare class ResponseAborted extends Error {
+  readonly name = "ResponseAborted";
+}
+/**
+ * Creates an AbortSignal tied to the closing of a ServerResponse.
+ *
+ * The incoming request cannot be used: once its body has been fully read the
+ * readable side is done, so a later client disconnect fires nothing on it
+ * (and its `close` event also fires on normal requests). If `finish` fires
+ * first, `res.end()` completed and the following `close` is our own teardown;
+ * if `close` fires first, the client disconnected before we finished.
+ */
+export declare function signalFromNodeResponse(response: Writable): AbortSignal;
+//#endregion

package/dist/server/node-response-signal.js

@@ -0,0 +1,26 @@
+//#region src/server/node-response-signal.ts
+const ResponseAbortedName = "ResponseAborted";
+var ResponseAborted = class extends Error {
+	name = ResponseAbortedName;
+};
+/**
+* Creates an AbortSignal tied to the closing of a ServerResponse.
+*
+* The incoming request cannot be used: once its body has been fully read the
+* readable side is done, so a later client disconnect fires nothing on it
+* (and its `close` event also fires on normal requests). If `finish` fires
+* first, `res.end()` completed and the following `close` is our own teardown;
+* if `close` fires first, the client disconnected before we finished.
+*/
+function signalFromNodeResponse(response) {
+	const { errored, destroyed } = response;
+	if (errored || destroyed) return AbortSignal.abort(errored ?? new ResponseAborted());
+	const controller = new AbortController();
+	response.once("close", () => {
+		if (response.writableFinished) return;
+		controller.abort(new ResponseAborted());
+	});
+	return controller.signal;
+}
+//#endregion
+export { ResponseAborted, signalFromNodeResponse };

package/dist/server/normalize-path.d.ts

@@ -1,17 +1,4 @@
 //#region src/server/normalize-path.d.ts
-export declare function escapePathDelimiters(segment: string, escapeEncoded?: boolean): string;
-/**
- * Decode a URL pathname segment-by-segment, preserving encoded path delimiters.
- * Non-ASCII characters (e.g. %C3%A9 -> e) are decoded, but structural characters
- * like %2F (/) %23 (#) %3F (?) %5C (\) are re-encoded after decoding.
- *
- * This prevents encoded slashes from changing the path structure (e.g.
- * /admin%2Fpanel stays as a single segment, not /admin/panel).
- *
- * Ported from Next.js: packages/next/src/server/lib/router-utils/decode-path-params.ts
- * https://github.com/vercel/next.js/blob/canary/packages/next/src/server/lib/router-utils/decode-path-params.ts
- */
-export declare function decodePathParams(pathname: string): string;
 export declare function isInterceptionMatchedUrlPath(value: string): boolean;
 /**
  * Path normalization utility for request handling.

package/dist/server/normalize-path.js

@@ -1,37 +1,4 @@
 //#region src/server/normalize-path.ts
-/**
-* Re-encode path delimiter characters that were decoded by decodeURIComponent.
-* After decoding a URL segment, characters like / # ? \ need to be re-encoded
-* so they don't change the path structure.
-*
-* Ported from Next.js: packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts
-* https://github.com/vercel/next.js/blob/canary/packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts
-*/
-const PATH_DELIMITERS_RE = /([/#?])/gi;
-const PATH_DELIMITERS_ENCODED_RE = /([/#?]|%(2f|23|3f|5c))/gi;
-function escapePathDelimiters(segment, escapeEncoded) {
-	return segment.replace(escapeEncoded ? PATH_DELIMITERS_ENCODED_RE : PATH_DELIMITERS_RE, (char) => encodeURIComponent(char));
-}
-/**
-* Decode a URL pathname segment-by-segment, preserving encoded path delimiters.
-* Non-ASCII characters (e.g. %C3%A9 -> e) are decoded, but structural characters
-* like %2F (/) %23 (#) %3F (?) %5C (\) are re-encoded after decoding.
-*
-* This prevents encoded slashes from changing the path structure (e.g.
-* /admin%2Fpanel stays as a single segment, not /admin/panel).
-*
-* Ported from Next.js: packages/next/src/server/lib/router-utils/decode-path-params.ts
-* https://github.com/vercel/next.js/blob/canary/packages/next/src/server/lib/router-utils/decode-path-params.ts
-*/
-function decodePathParams(pathname) {
-	return pathname.split("/").map((seg) => {
-		try {
-			return escapePathDelimiters(decodeURIComponent(seg), true);
-		} catch {
-			return seg;
-		}
-	}).join("/");
-}
 function isInterceptionMatchedUrlPath(value) {
 	return value.startsWith("/") && !value.startsWith("//") && !value.includes("?") && !value.includes("#") && !value.includes("\\") && !value.includes("\0");
 }
@@ -67,4 +34,4 @@ function normalizePath(pathname) {
 	return "/" + resolved.join("/");
 }
 //#endregion
-export { decodePathParams, escapePathDelimiters, isInterceptionMatchedUrlPath, normalizePath };
+export { isInterceptionMatchedUrlPath, normalizePath };

package/dist/server/open-redirect.d.ts

@@ -8,4 +8,51 @@
  * to resolve a `Location` containing the pathname as protocol-relative.
  */
 export declare function isOpenRedirectShaped(rawPathname: string): boolean;
+/**
+ * What a request entry answers for a raw path containing a backslash or a
+ * repeated slash: Next.js's 308, or a 404 when the collapsed path would still
+ * be open-redirect shaped.
+ */
+export type RepeatedSlashRedirect = {
+  status: 308;
+  location: string;
+} | {
+  status: 404;
+};
+/**
+ * Returns Next.js's redirect for a raw request path containing a backslash or
+ * a repeated slash, or `null` when the path needs no change.
+ *
+ * Ported from Next.js's request entry (`base-server.ts` / `resolve-routes.ts`,
+ * via `normalizeRepeatedSlashes` in `shared/lib/utils.ts`): backslashes in the
+ * path become `/`, runs of slashes collapse to one and the query is kept.
+ * `next start` then builds the Location with `url.format(parseUrl(...))` in
+ * `router-server.ts`, so the result is serialized through a WHATWG URL here
+ * too (`/a/%2e%2e//b` → `/b`, `?q="x"` → `?q=%22x%22`, as observed). It runs
+ * before basePath handling, so `//` → `/`, `/docs//` → `/docs/` and
+ * `//evil.com` → `/evil.com`. Percent-encoded `%2F`/`%5C` are not touched and
+ * keep falling through to `isOpenRedirectShaped` (404), as in Next.js.
+ *
+ * The Location is always same-origin. Absolute-form request targets
+ * (`GET http://host//x`) are left alone. A collapsed path that still starts
+ * with an encoded slash or backslash (`//%2Fevil.com`, `/.//%2Fevil.com`) is
+ * never echoed into a Location or routed: it gets a 404 instead.
+ *
+ * @param rawUrl - The raw request target: pathname plus optional `?query`
+ */
+export declare function getRepeatedSlashRedirect(rawUrl: string): RepeatedSlashRedirect | null;
+/**
+ * Build the Response for a raw request path containing a backslash or a
+ * repeated slash. See `getRepeatedSlashRedirect`.
+ */
+export declare function repeatedSlashRedirectResponse(rawUrl: string): Response | null;
+/**
+ * Node `ServerResponse` counterpart of `repeatedSlashRedirectResponse`, for
+ * entries that see the raw request target (dev and `vinext start`). Returns
+ * true when a response was sent.
+ */
+export declare function sendRepeatedSlashRedirect(rawUrl: string, res: {
+  writeHead(status: number, headers?: Record<string, string>): unknown;
+  end(body: string): unknown;
+}): boolean;
 //#endregion

package/dist/server/open-redirect.js

@@ -1,3 +1,4 @@
+import { notFoundResponse } from "./http-error-responses.js";
 //#region src/server/open-redirect.ts
 /**
 * Returns true if a request pathname looks like a protocol-relative open
@@ -17,5 +18,77 @@ function isOpenRedirectShaped(rawPathname) {
 	}
 	return false;
 }
+const REPEATED_SLASH_OR_BACKSLASH_RE = /\\|\/\//;
+const REDIRECT_LOCATION_BASE = "http://vinext.invalid";
+/**
+* Returns Next.js's redirect for a raw request path containing a backslash or
+* a repeated slash, or `null` when the path needs no change.
+*
+* Ported from Next.js's request entry (`base-server.ts` / `resolve-routes.ts`,
+* via `normalizeRepeatedSlashes` in `shared/lib/utils.ts`): backslashes in the
+* path become `/`, runs of slashes collapse to one and the query is kept.
+* `next start` then builds the Location with `url.format(parseUrl(...))` in
+* `router-server.ts`, so the result is serialized through a WHATWG URL here
+* too (`/a/%2e%2e//b` → `/b`, `?q="x"` → `?q=%22x%22`, as observed). It runs
+* before basePath handling, so `//` → `/`, `/docs//` → `/docs/` and
+* `//evil.com` → `/evil.com`. Percent-encoded `%2F`/`%5C` are not touched and
+* keep falling through to `isOpenRedirectShaped` (404), as in Next.js.
+*
+* The Location is always same-origin. Absolute-form request targets
+* (`GET http://host//x`) are left alone. A collapsed path that still starts
+* with an encoded slash or backslash (`//%2Fevil.com`, `/.//%2Fevil.com`) is
+* never echoed into a Location or routed: it gets a 404 instead.
+*
+* @param rawUrl - The raw request target: pathname plus optional `?query`
+*/
+function getRepeatedSlashRedirect(rawUrl) {
+	if (!rawUrl.startsWith("/")) return null;
+	const urlParts = rawUrl.split("?");
+	const pathname = urlParts[0];
+	if (!REPEATED_SLASH_OR_BACKSLASH_RE.test(pathname)) return null;
+	const cleanUrl = pathname.replaceAll("\\", "/").replace(/\/\/+/g, "/") + (urlParts[1] ? `?${urlParts.slice(1).join("?")}` : "");
+	const parsed = new URL(REDIRECT_LOCATION_BASE + cleanUrl);
+	const location = parsed.pathname + parsed.search + parsed.hash;
+	return isOpenRedirectShaped(location) ? { status: 404 } : {
+		status: 308,
+		location
+	};
+}
+function repeatedSlashRedirectHeaders(location) {
+	return {
+		Location: location,
+		Refresh: `0;url=${location}`
+	};
+}
+/**
+* Build the Response for a raw request path containing a backslash or a
+* repeated slash. See `getRepeatedSlashRedirect`.
+*/
+function repeatedSlashRedirectResponse(rawUrl) {
+	const redirect = getRepeatedSlashRedirect(rawUrl);
+	if (!redirect) return null;
+	if (redirect.status === 404) return notFoundResponse();
+	return new Response(redirect.location, {
+		status: 308,
+		headers: repeatedSlashRedirectHeaders(redirect.location)
+	});
+}
+/**
+* Node `ServerResponse` counterpart of `repeatedSlashRedirectResponse`, for
+* entries that see the raw request target (dev and `vinext start`). Returns
+* true when a response was sent.
+*/
+function sendRepeatedSlashRedirect(rawUrl, res) {
+	const redirect = getRepeatedSlashRedirect(rawUrl);
+	if (!redirect) return false;
+	if (redirect.status === 404) {
+		res.writeHead(404);
+		res.end("This page could not be found");
+		return true;
+	}
+	res.writeHead(308, repeatedSlashRedirectHeaders(redirect.location));
+	res.end(redirect.location);
+	return true;
+}
 //#endregion
-export { isOpenRedirectShaped };
+export { getRepeatedSlashRedirect, isOpenRedirectShaped, repeatedSlashRedirectResponse, sendRepeatedSlashRedirect };

package/dist/server/pages-api-route.d.ts

@@ -2,7 +2,7 @@ import { NextI18nConfig } from "../config/next-config.js";
 import { Route } from "../routing/pages-router.js";
 import { ExecutionContextLike } from "../shims/request-context.js";
 import { EdgeApiExecutionRuntime } from "./edge-api-runtime.js";
-import { PagesReqResRequest, PagesReqResResponse, PagesRequestQuery } from "./pages-node-compat.js";
+import { PagesApiReqResResponse, PagesReqResRequest, PagesRequestQuery } from "./pages-node-compat.js";
 //#region src/server/pages-api-route.d.ts
 type PagesApiRouteConfig = {
   runtime?: string;
@@ -36,7 +36,7 @@ type PagesApiRouteConfig = {
     externalResolver?: boolean;
   };
 };
-type PagesNodeApiRouteHandler = (req: PagesReqResRequest, res: PagesReqResResponse) => unknown;
+type PagesNodeApiRouteHandler = (req: PagesReqResRequest, res: PagesApiReqResResponse) => unknown;
 type PagesEdgeApiRouteHandler = (request: Request) => Response | Promise<Response>;
 type PagesApiRouteModule = {
   /**
@@ -80,6 +80,7 @@ type HandlePagesApiRouteOptions = {
     allowedRevalidateHeaderKeys?: readonly string[];
     i18n?: NextI18nConfig | null;
     trailingSlash?: boolean;
+    skipTrailingSlashRedirect?: boolean;
   };
   trustedRevalidateOrigin?: string;
 };

package/dist/server/pages-api-route.js

@@ -9,7 +9,7 @@ import { mergeRouteParamsIntoQuery, parseQueryString, urlQueryToSearchParams } f
 import { tracePagesApiHandler } from "./pages-execution-tracing.js";
 import { resolveBodyParserConfig } from "./pages-body-parser-config.js";
 import { PagesBodyParseError } from "./pages-media-type.js";
-import { createPagesReqRes, markVinextStreamedApiResponse, parsePagesApiBody } from "./pages-node-compat.js";
+import { createPagesApiReqRes, markVinextStreamedApiResponse, parsePagesApiBody } from "./pages-node-compat.js";
 import { finalizeEdgeApiResponse, isEdgeApiRuntime } from "./edge-api-runtime.js";
 //#region src/server/pages-api-route.ts
 function resolveModuleRuntime(module) {
@@ -47,7 +47,8 @@ async function _handlePagesApiRoute(options) {
 			const nextRequest = new NextRequest(createEdgeApiRequest(options.request, options.url, params), options.nextConfig ? { nextConfig: {
 				basePath: options.nextConfig.basePath,
 				i18n: options.nextConfig.i18n ?? void 0,
-				trailingSlash: options.nextConfig.trailingSlash
+				trailingSlash: options.nextConfig.trailingSlash,
+				skipTrailingSlashRedirect: options.nextConfig.skipTrailingSlashRedirect
 			} } : void 0);
 			const response = await tracePagesApiHandler(route.pattern, () => handler(nextRequest));
 			if (response instanceof Response) {
@@ -70,7 +71,7 @@ async function _handlePagesApiRoute(options) {
 		const query = buildPagesApiQuery(options.url, params);
 		const bodyParserConfig = resolveBodyParserConfig(route.module.config);
 		const body = bodyParserConfig.enabled ? await parsePagesApiBody(options.request, bodyParserConfig.sizeLimit) : void 0;
-		const { req, res, responsePromise } = createPagesReqRes({
+		const { req, res, responsePromise } = createPagesApiReqRes({
 			allowedRevalidateHeaderKeys: options.nextConfig?.allowedRevalidateHeaderKeys,
 			body,
 			initialResponseHeaders: options.initialResponseHeaders,

package/dist/server/pages-cache-tag.d.ts

@@ -0,0 +1,12 @@
+//#region src/server/pages-cache-tag.d.ts
+/**
+ * Build the edge path tag for a Pages ISR pathname.
+ *
+ * Every spelling of one pathname shares a single ISR entry, because
+ * `pagesIsrCacheKey()` decodes each segment first. The tag must use that same
+ * decoded identity. Otherwise `/users/%40alice` is stored at the edge under its
+ * own tag, and `res.revalidate("/users/@alice")` or
+ * `revalidatePath("/users/@alice")` never purges it.
+ */
+export declare function pagesPathCacheTag(isrPathname: string): string;
+//#endregion

package/dist/server/pages-cache-tag.js

@@ -0,0 +1,19 @@
+import { normalizePathnameForRouteMatch } from "../routing/utils.js";
+import { encodeCacheTag } from "../utils/encode-cache-tag.js";
+//#region src/server/pages-cache-tag.ts
+/**
+* Build the edge path tag for a Pages ISR pathname.
+*
+* Every spelling of one pathname shares a single ISR entry, because
+* `pagesIsrCacheKey()` decodes each segment first. The tag must use that same
+* decoded identity. Otherwise `/users/%40alice` is stored at the edge under its
+* own tag, and `res.revalidate("/users/@alice")` or
+* `revalidatePath("/users/@alice")` never purges it.
+*/
+function pagesPathCacheTag(isrPathname) {
+	const pathname = normalizePathnameForRouteMatch(isrPathname);
+	const stem = pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
+	return encodeCacheTag(`_N_T_${stem || "/"}`);
+}
+//#endregion
+export { pagesPathCacheTag };

package/dist/server/pages-client-assets.d.ts

@@ -14,6 +14,8 @@ export type PagesClientAssets = {
   dynamicPreloads?: Record<string, string[]>;
   /** next.config crossOrigin, defaulting to anonymous for Vite's CORS-fetched assets. */
   crossOrigin?: AssetCrossOrigin;
+  /** Client bundle files outside `_next/static`, as URL pathnames. */
+  clientBuildFiles?: string[];
 };
 export declare function setPagesClientAssets(assets: PagesClientAssets | undefined): void;
 export declare function getPagesClientAssets(): PagesClientAssets;

package/dist/server/pages-data-route.d.ts

@@ -61,6 +61,16 @@ export declare function encodeUrlParserIgnoredCharacters(pathname: string): stri
  * `/_next/data/<buildId>/about`              → null  (missing .json suffix)
  */
 export declare function parseNextDataPathname(pathname: string, buildId: string): NextDataMatch | null;
+/**
+ * The page pathname a `_next/data` URL addresses, whatever its buildId. Next.js
+ * compiles every middleware matcher with an optional `/_next/data/<buildId>`
+ * prefix and `.json` suffix, so a matcher written for `/admin` also guards that
+ * page's data URL, even one with a stale buildId. Middleware matching uses this
+ * when the request reaches middleware with its raw data URL
+ * (`skipProxyUrlNormalize`).
+ * https://github.com/vercel/next.js/blob/v16.2.7/packages/next/src/build/analysis/get-page-static-info.ts
+ */
+export declare function nextDataMiddlewareMatchPathname(pathname: string): string | null;
 export declare function normalizeNextDataPagePathname(pagePathname: string, trailingSlash?: boolean): string;
 /**
  * Next.js only applies `trailingSlash` while normalizing a data URL for

package/dist/server/pages-data-route.js

@@ -67,7 +67,24 @@ function parseNextDataPathname(pathname, buildId) {
 	if (!isNextDataPathname(pathname)) return null;
 	const expectedPrefix = `${NEXT_DATA_PREFIX}${buildId}/`;
 	if (!pathname.startsWith(expectedPrefix)) return null;
-	const rest = pathname.slice(expectedPrefix.length, -5);
+	return pageFromNextDataRest(pathname.slice(expectedPrefix.length, -5));
+}
+/**
+* The page pathname a `_next/data` URL addresses, whatever its buildId. Next.js
+* compiles every middleware matcher with an optional `/_next/data/<buildId>`
+* prefix and `.json` suffix, so a matcher written for `/admin` also guards that
+* page's data URL, even one with a stale buildId. Middleware matching uses this
+* when the request reaches middleware with its raw data URL
+* (`skipProxyUrlNormalize`).
+* https://github.com/vercel/next.js/blob/v16.2.7/packages/next/src/build/analysis/get-page-static-info.ts
+*/
+function nextDataMiddlewareMatchPathname(pathname) {
+	if (!isNextDataPathname(pathname)) return null;
+	const buildIdEnd = pathname.indexOf("/", 12);
+	if (buildIdEnd <= 12) return null;
+	return pageFromNextDataRest(pathname.slice(buildIdEnd + 1, -5))?.pagePathname ?? null;
+}
+function pageFromNextDataRest(rest) {
 	if (rest.length === 0) return null;
 	if (rest === "index") return { pagePathname: "/" };
 	if (rest.endsWith("/index")) return { pagePathname: `/${rest.slice(0, -6)}` };
@@ -181,4 +198,4 @@ function normalizePagesDataRequest(request, buildId, basePath = "", trailingSlas
 	};
 }
 //#endregion
-export { buildMiddlewarePrefetchSkipResponse, buildNextDataNotFoundResponse, buildNextDataPropsJsonResponse, encodeUrlParserIgnoredCharacters, isNextDataPathname, normalizeNextDataPagePathname, normalizePagesDataRequest, parseNextDataPathname, shouldAddTrailingSlashToPagesDataPath, urlParserCreatesPagesDataPath };
+export { buildMiddlewarePrefetchSkipResponse, buildNextDataNotFoundResponse, buildNextDataPropsJsonResponse, encodeUrlParserIgnoredCharacters, isNextDataPathname, nextDataMiddlewareMatchPathname, normalizeNextDataPagePathname, normalizePagesDataRequest, parseNextDataPathname, shouldAddTrailingSlashToPagesDataPath, urlParserCreatesPagesDataPath };