vinext 1.1.0 → 1.2.1

package/dist/server/http-conditional.js

@@ -31,6 +31,15 @@ function matchesIfNoneMatch(ifNoneMatch, etag) {
 	}
 	return sawTag && matched;
 }
+/**
+* Whether a page answers its request with a 304, as Next.js's
+* `sendEtagResponse` does with `fresh(req.headers, { etag })`. Next.js gives a
+* page no Last-Modified, so a request with If-Modified-Since gets the page, and
+* a request `Cache-Control: no-cache` always does.
+*/
+function isPageNotModified(request, etag) {
+	return !request.ifModifiedSince && !/(?:^|,)\s*no-cache\s*(?:,|$)/.test(request.cacheControl ?? "") && matchesIfNoneMatch(request.ifNoneMatch, etag);
+}
 /** Test an If-Match field using Next.js's weak/strong-equivalent comparison. */
 function matchesIfMatch(ifMatch, etag) {
 	if (!ifMatch) return false;
@@ -114,4 +123,4 @@ function joinHeader(value) {
 	return Array.isArray(value) ? value.join(", ") : value;
 }
 //#endregion
-export { evaluateStaticPreconditions, matchesIfMatch, matchesIfNoneMatch };
+export { evaluateStaticPreconditions, isPageNotModified, matchesIfMatch, matchesIfNoneMatch };

package/dist/server/http-error-responses.d.ts

@@ -9,7 +9,7 @@
  * `new Response(...)` boilerplate.
  *
  * Sites with route-specific bodies (e.g. `"404 - API route not found"`,
- * `"Image not found"`, generated worker templates) intentionally remain inline
+ * generated worker templates) intentionally remain inline
  * because their bodies are either tested-against fixtures or run inside template
  * strings that have no access to runtime imports.
  *

package/dist/server/image-optimization.d.ts

@@ -82,6 +82,44 @@ export type ParseImageParamsOptions = {
   isDev?: boolean;
 };
 export declare function resolveDevImageRedirect(requestUrl: URL, allowedWidths?: number[], allowedQualities?: number[], options?: ParseImageParamsOptions): string | null;
+export type ImageOptimizationSignal = {
+  /** Middleware response headers to send with the image. */
+  middlewareHeaders: Headers;
+  /** The request headers after middleware's overrides, when it set any. */
+  requestHeaders: Headers | null;
+  /** The image query after middleware and rewrites. */
+  search: string;
+};
+/**
+ * Mark the App Router's image endpoint response once the request has passed
+ * middleware and rewrites. A host that serves images itself (the Node
+ * production server) replaces the response with the image; other hosts send
+ * the response unchanged. The symbol carries the signal across the built RSC
+ * module boundary, so response headers cannot forge it.
+ */
+export declare function markImageOptimizationSignal(response: Response, signal: ImageOptimizationSignal): Response;
+/** Return the signal of a framework-created image endpoint response. */
+export declare function readImageOptimizationSignal(response: Response): ImageOptimizationSignal | null;
+/**
+ * Carry a signal through the response-stage transport, which drops the
+ * symbol. The signal rides in the body of the bodiless carrier, with the
+ * carrier's status in the token-authenticated marker.
+ */
+export declare function serializeImageOptimizationSignalForTransport(response: Response, token: string): Response;
+/** Restore and consume a signal returned by the trusted response-stage wrapper. */
+export declare function restoreImageOptimizationSignalFromTransport(response: Response, token: string): Promise<Response>;
+/**
+ * Whether a local source's pipeline status carries the file's bytes. A no-body
+ * success such as 204 serves no file, which Next.js rejects as an invalid
+ * image.
+ */
+export declare function isImageSourceBodyStatus(status: number): boolean;
+/**
+ * Body Next.js answers, with a 400, for a local source that yields no image:
+ * a missing file, or anything middleware or routing answers in its place.
+ */
+export declare const INVALID_IMAGE_SOURCE_MESSAGE = "The requested resource isn't a valid image.";
+export declare function invalidImageSourceResponse(): Response;
 /**
  * Parse and validate image optimization query parameters.
  * Returns null if the request is malformed.

package/dist/server/image-optimization.js

@@ -78,6 +78,93 @@ function resolveDevImageRedirect(requestUrl, allowedWidths = [...DEFAULT_DEVICE_
 	if (resolved.origin !== requestUrl.origin) return null;
 	return resolved.pathname + resolved.search;
 }
+const IMAGE_OPTIMIZATION_SIGNAL = Symbol.for("vinext.image-optimization-signal");
+/**
+* Mark the App Router's image endpoint response once the request has passed
+* middleware and rewrites. A host that serves images itself (the Node
+* production server) replaces the response with the image; other hosts send
+* the response unchanged. The symbol carries the signal across the built RSC
+* module boundary, so response headers cannot forge it.
+*/
+function markImageOptimizationSignal(response, signal) {
+	Object.defineProperty(response, IMAGE_OPTIMIZATION_SIGNAL, { value: signal });
+	return response;
+}
+/** Return the signal of a framework-created image endpoint response. */
+function readImageOptimizationSignal(response) {
+	const signal = Reflect.get(response, IMAGE_OPTIMIZATION_SIGNAL);
+	if (typeof signal !== "object" || signal === null) return null;
+	const { middlewareHeaders, requestHeaders, search } = signal;
+	return middlewareHeaders instanceof Headers && (requestHeaders === null || requestHeaders instanceof Headers) && typeof search === "string" ? {
+		middlewareHeaders,
+		requestHeaders,
+		search
+	} : null;
+}
+const IMAGE_OPTIMIZATION_SIGNAL_TRANSPORT_HEADER = "x-vinext-stage-image-optimization";
+function isHeaderEntries(value) {
+	return Array.isArray(value) && value.every((entry) => Array.isArray(entry) && entry.length === 2 && typeof entry[0] === "string" && typeof entry[1] === "string");
+}
+/**
+* Carry a signal through the response-stage transport, which drops the
+* symbol. The signal rides in the body of the bodiless carrier, with the
+* carrier's status in the token-authenticated marker.
+*/
+function serializeImageOptimizationSignalForTransport(response, token) {
+	const signal = readImageOptimizationSignal(response);
+	if (signal === null) return response;
+	const headers = new Headers(response.headers);
+	headers.set(IMAGE_OPTIMIZATION_SIGNAL_TRANSPORT_HEADER, `${token}:${response.status}`);
+	return new Response(JSON.stringify({
+		middlewareHeaders: [...signal.middlewareHeaders],
+		requestHeaders: signal.requestHeaders ? [...signal.requestHeaders] : null,
+		search: signal.search
+	}), { headers });
+}
+/** Restore and consume a signal returned by the trusted response-stage wrapper. */
+async function restoreImageOptimizationSignalFromTransport(response, token) {
+	const marker = response.headers.get(IMAGE_OPTIMIZATION_SIGNAL_TRANSPORT_HEADER);
+	if (marker === null || response.status < 200 || response.status > 599) return response;
+	const headers = new Headers(response.headers);
+	headers.delete(IMAGE_OPTIMIZATION_SIGNAL_TRANSPORT_HEADER);
+	const prefix = `${token}:`;
+	const status = marker.startsWith(prefix) ? Number(marker.slice(prefix.length)) : NaN;
+	if (!Number.isInteger(status) || status < 200 || status > 599) {
+		const body = response.status === 204 || response.status === 205 || response.status === 304 ? null : response.body;
+		return new Response(body, {
+			headers,
+			status: response.status,
+			statusText: response.statusText
+		});
+	}
+	const { middlewareHeaders, requestHeaders, search } = JSON.parse(await response.text()) ?? {};
+	if (!isHeaderEntries(middlewareHeaders) || requestHeaders !== null && !isHeaderEntries(requestHeaders) || typeof search !== "string") throw new Error("Invalid image optimization signal from the response stage");
+	return markImageOptimizationSignal(new Response(null, {
+		headers,
+		status
+	}), {
+		middlewareHeaders: new Headers(middlewareHeaders),
+		requestHeaders: requestHeaders ? new Headers(requestHeaders) : null,
+		search
+	});
+}
+/**
+* Whether a local source's pipeline status carries the file's bytes. A no-body
+* success such as 204 serves no file, which Next.js rejects as an invalid
+* image.
+*/
+function isImageSourceBodyStatus(status) {
+	return status >= 200 && status < 300 && status !== 204 && status !== 205;
+}
+/**
+* Body Next.js answers, with a 400, for a local source that yields no image:
+* a missing file, or anything middleware or routing answers in its place.
+*/
+const INVALID_IMAGE_SOURCE_MESSAGE = "The requested resource isn't a valid image.";
+function invalidImageSourceResponse() {
+	return new Response(INVALID_IMAGE_SOURCE_MESSAGE, { status: 400 });
+}
+const RECURSIVE_IMAGE_URL_RE = /\/_(?:next|vinext)\/image(?:$|\/)/;
 /**
 * Parse and validate image optimization query parameters.
 * Returns null if the request is malformed.
@@ -113,7 +200,10 @@ function parseImageParams(url, allowedWidths = [...DEFAULT_DEVICE_SIZES, ...DEFA
 	if (!normalizedUrl.startsWith("/") || normalizedUrl.startsWith("//")) return null;
 	try {
 		const base = "https://localhost";
-		if (new URL(normalizedUrl, base).origin !== base) return null;
+		const resolved = new URL(normalizedUrl, base);
+		if (resolved.origin !== base) return null;
+		if (resolved.pathname.startsWith("//")) return null;
+		if (RECURSIVE_IMAGE_URL_RE.test(decodeURIComponent(resolved.pathname))) return null;
 	} catch {
 		return null;
 	}
@@ -226,7 +316,7 @@ async function handleImageOptimization(request, handlers, allowedWidths, imageCo
 	if (!params) return badRequestResponse();
 	const { imageUrl, width, quality } = params;
 	const source = await handlers.fetchAsset(imageUrl, request);
-	if (!source.ok || !source.body) return new Response("Image not found", { status: 404 });
+	if (!source.ok || !source.body) return invalidImageSourceResponse();
 	const format = negotiateImageFormat(request.headers.get("Accept"));
 	const sourceContentType = source.headers.get("Content-Type");
 	if (!isSafeImageContentType(sourceContentType, imageConfig?.dangerouslyAllowSVG)) return new Response("The requested resource is not an allowed image type", { status: 400 });
@@ -252,7 +342,7 @@ async function handleImageOptimization(request, handlers, allowedWidths, imageCo
 	} catch (e) {
 		console.error("[vinext] Image fallback error, refetching source image:", e);
 		const refetchedSource = await handlers.fetchAsset(imageUrl, request);
-		if (!refetchedSource.ok || !refetchedSource.body) return new Response("Image not found", { status: 404 });
+		if (!refetchedSource.ok || !refetchedSource.body) return invalidImageSourceResponse();
 		if (!isSafeImageContentType(refetchedSource.headers.get("Content-Type"), imageConfig?.dangerouslyAllowSVG)) return new Response("The requested resource is not an allowed image type", { status: 400 });
 		return createPassthroughImageResponse(refetchedSource, imageConfig);
 	}
@@ -307,4 +397,4 @@ function handleConfiguredImageOptimization(request, fetchAsset, allowedWidths, i
 	}, allowedWidths, imageConfig);
 }
 //#endregion
-export { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, IMAGE_CACHE_CONTROL, IMAGE_CONTENT_SECURITY_POLICY, IMAGE_OPTIMIZATION_PATH, IMAGE_RESPONSE_CACHE_STATE, VINEXT_IMAGE_OPTIMIZATION_PATH, getImageOptimizer, handleConfiguredImageOptimization, handleImageOptimization, isImageOptimizationPath, isSafeImageContentType, negotiateImageFormat, parseImageParams, resolveDevImageRedirect, setImageOptimizer };
+export { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, IMAGE_CACHE_CONTROL, IMAGE_CONTENT_SECURITY_POLICY, IMAGE_OPTIMIZATION_PATH, IMAGE_RESPONSE_CACHE_STATE, INVALID_IMAGE_SOURCE_MESSAGE, VINEXT_IMAGE_OPTIMIZATION_PATH, getImageOptimizer, handleConfiguredImageOptimization, handleImageOptimization, invalidImageSourceResponse, isImageOptimizationPath, isImageSourceBodyStatus, isSafeImageContentType, markImageOptimizationSignal, negotiateImageFormat, parseImageParams, readImageOptimizationSignal, resolveDevImageRedirect, restoreImageOptimizationSignalFromTransport, serializeImageOptimizationSignalForTransport, setImageOptimizer };

package/dist/server/isr-cache.d.ts

@@ -112,7 +112,17 @@ export declare function pagesIsrCacheKey(pathname: string, buildId?: string, i18
  * Cloudflare KV key under its 512-byte limit for long pathnames.
  */
 export declare function appIsrCacheKey(pathname: string, suffix: string, buildId?: string | undefined): string;
+/**
+ * Compute the ISR key for a PPR fallback shell artifact, such as the HTML for
+ * `/en/[slug]`. Shells get their own namespace: a request for the literal path
+ * `/en/%5Bslug%5D` decodes to the same pathname, and its render must not be
+ * stored where every unknown `[slug]` reads its shell. The namespace is a
+ * prefix of its own rather than a part after the build ID, which can contain
+ * `:` and so could spell it.
+ */
+export declare function appIsrFallbackShellKey(pathname: string, suffix: "html" | "rsc", buildId?: string | undefined): string;
 export declare function appIsrHtmlKey(pathname: string): string;
+export declare function appIsrFallbackShellHtmlKey(pathname: string): string;
 /**
  * Build the ISR cache key for an RSC payload.
  *

package/dist/server/isr-cache.js

@@ -4,12 +4,26 @@ import { getRequestExecutionContext } from "../shims/request-context.js";
 import { isInterceptionMatchedUrlPath } from "./normalize-path.js";
 import { reportRequestError } from "./instrumentation.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
-import { fnv1a64 } from "../utils/hash.js";
 import { normalizeMountedSlotsHeader } from "./app-mounted-slots-header.js";
 import { APP_RSC_RENDER_MODE_NAVIGATION, getRscRenderModeCacheVariant } from "./app-rsc-render-mode.js";
 import { getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret } from "./revalidation-request.js";
+import { createHash } from "node:crypto";
 //#region src/server/isr-cache.ts
 /**
+* ISR (Incremental Static Regeneration) cache layer.
+*
+* Wraps the pluggable CacheHandler with stale-while-revalidate semantics:
+* - Fresh hit: serve immediately
+* - Stale hit: serve immediately + trigger background regeneration
+* - Miss: render synchronously, cache, serve
+*
+* Background regeneration is deduped — only one regeneration per cache key
+* runs at a time, preventing thundering herd on popular pages.
+*
+* This layer works with any CacheHandler backend (memory, Redis, KV, etc.)
+* because it only uses the standard get/set interface.
+*/
+/**
 * Get a cache entry with staleness information.
 *
 * Returns { value, isStale: false } for fresh entries,
@@ -151,12 +165,19 @@ function buildAppPageCacheValue(html, rscData, status, renderObservation, header
 function normalizeCachePathname(pathname) {
 	return pathname === "/" ? "/" : pathname.replace(/\/$/, "");
 }
+/**
+* Digest a request-controlled key part. It must be collision resistant: a
+* crafted value that shared a weaker hash with another would share its entry.
+*/
+function digestKeyPart(value) {
+	return createHash("sha256").update(value).digest("hex");
+}
 function buildCacheKey(prefix, pathname, suffix) {
 	const normalized = normalizeCachePathname(pathname);
 	const suffixPart = suffix ? `:${suffix}` : "";
 	const key = `${prefix}:${normalized}${suffixPart}`;
 	if (key.length <= 200) return key;
-	return `${prefix}:__hash:${fnv1a64(normalized)}${suffixPart}`;
+	return `${prefix}:__hash:${digestKeyPart(normalized)}${suffixPart}`;
 }
 /**
 * Compute an ISR cache key for a given router type and pathname.
@@ -179,9 +200,23 @@ function pagesIsrCacheKey(pathname, buildId, i18nCacheVariant) {
 function appIsrCacheKey(pathname, suffix, buildId = process.env.__VINEXT_BUILD_ID) {
 	return buildCacheKey(buildId ? `app:v2:${buildId}` : "app:v2", pathname, suffix);
 }
+/**
+* Compute the ISR key for a PPR fallback shell artifact, such as the HTML for
+* `/en/[slug]`. Shells get their own namespace: a request for the literal path
+* `/en/%5Bslug%5D` decodes to the same pathname, and its render must not be
+* stored where every unknown `[slug]` reads its shell. The namespace is a
+* prefix of its own rather than a part after the build ID, which can contain
+* `:` and so could spell it.
+*/
+function appIsrFallbackShellKey(pathname, suffix, buildId = process.env.__VINEXT_BUILD_ID) {
+	return buildCacheKey(buildId ? `app-fallback-shell:v1:${buildId}` : "app-fallback-shell:v1", pathname, suffix);
+}
 function appIsrHtmlKey(pathname) {
 	return appIsrCacheKey(pathname, "html");
 }
+function appIsrFallbackShellHtmlKey(pathname) {
+	return appIsrFallbackShellKey(pathname, "html");
+}
 function normalizeInterceptionContextForCacheKey(interceptionContext) {
 	return isInterceptionMatchedUrlPath(interceptionContext) ? interceptionContext : null;
 }
@@ -200,9 +235,9 @@ function appIsrRscKey(pathname, mountedSlotsHeader, renderMode = APP_RSC_RENDER_
 	const normalizedMountedSlotsHeader = normalizeMountedSlotsHeader(mountedSlotsHeader);
 	const sourceVariant = interceptionContext === void 0 || interceptionContext === null ? null : normalizeInterceptionContextForCacheKey(interceptionContext);
 	const variant = [
-		sourceVariant ? `source:${fnv1a64(sourceVariant)}` : null,
-		interceptionId ? `selector:${fnv1a64(interceptionId)}` : null,
-		normalizedMountedSlotsHeader ? `slots:${fnv1a64(normalizedMountedSlotsHeader)}` : null,
+		sourceVariant ? `source:${digestKeyPart(sourceVariant)}` : null,
+		interceptionId ? `selector:${digestKeyPart(interceptionId)}` : null,
+		normalizedMountedSlotsHeader ? `slots:${digestKeyPart(normalizedMountedSlotsHeader)}` : null,
 		getRscRenderModeCacheVariant(renderMode)
 	].filter((part) => part !== null).join(":");
 	return appIsrCacheKey(pathname, variant ? `rsc:${variant}` : "rsc");
@@ -211,4 +246,4 @@ function appIsrRouteKey(pathname) {
 	return appIsrCacheKey(pathname, pathname !== "/" && pathname.endsWith("/") ? "route:trailing-slash" : "route");
 }
 //#endregion
-export { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrCacheKey, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, coalesceOnDemandRevalidation, getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret, isrCacheControl, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, pagesIsrCacheKey, resolveRouteExpireSeconds, triggerBackgroundRegeneration };
+export { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, appIsrCacheKey, appIsrFallbackShellHtmlKey, appIsrFallbackShellKey, appIsrHtmlKey, appIsrRouteKey, appIsrRscKey, buildAppPageCacheValue, buildPagesCacheValue, coalesceOnDemandRevalidation, getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret, isrCacheControl, isrCacheKey, isrGet, isrSet, isrSetPrerenderedAppPage, normalizeMountedSlotsHeader, pagesIsrCacheKey, resolveRouteExpireSeconds, triggerBackgroundRegeneration };

package/dist/server/metadata-route-response.js

@@ -1,9 +1,10 @@
 import { markFullyBufferedBody } from "./fully-buffered-response.js";
 import { closeAfterResponse, createRequestContext, runWithRequestContext } from "../shims/unified-request-context.js";
-import { decodeMatchedParams } from "../routing/utils.js";
-import { getRequestExecutionContext } from "../shims/request-context.js";
 import { VINEXT_METADATA_ROUTE_CACHE_HEADER } from "./headers.js";
 import { notFoundResponse } from "./http-error-responses.js";
+import { decodeMatchedParams } from "../routing/utils.js";
+import { getRequestExecutionContext } from "../shims/request-context.js";
+import { runInWorkStoreScope } from "../shims/internal/work-store-scope.js";
 import { beginRouteCacheability, markRouteCacheabilityExplicitResponsePolicy, markRouteCacheabilityResponseBodyComplete, recordRouteCacheability } from "../shims/cacheability-classification.js";
 import { NEVER_CACHE_CONTROL, applyCdnResponseHeaders, hasCdnResponsePolicy } from "./cache-control.js";
 import { buildAppRouteMissIsrCacheControl } from "./isr-decision.js";
@@ -215,7 +216,7 @@ async function writeRenderedMetadataRoute(options, route, routeKey, rendered, pr
 async function runMetadataRouteRegeneration(options, route, render, routeKey, previousEntry, executionContext) {
 	const requestContext = createRequestContext({ executionContext });
 	try {
-		await runWithRequestContext(requestContext, async () => {
+		await runWithRequestContext(requestContext, () => runInWorkStoreScope(async () => {
 			ensureFetchPatch();
 			beginMetadataRouteCacheability(route);
 			setCurrentFetchSoftTags(buildMetadataRouteTags(route, options.cleanPathname, []));
@@ -225,7 +226,7 @@ async function runMetadataRouteRegeneration(options, route, render, routeKey, pr
 			} finally {
 				rendered.response.body?.cancel().catch(() => {});
 			}
-		});
+		}));
 	} finally {
 		await closeAfterResponse(requestContext);
 	}
@@ -512,6 +513,12 @@ async function handleMetadataRouteRequest(options) {
 			decodeMatchedParams(runtimeParams);
 			match.params = runtimeParams;
 		}
+		const render = async () => {
+			setCurrentFetchSoftTags(buildMetadataRouteTags(route, options.cleanPathname, []));
+			return captureRenderedMetadataRoute(route.isDynamic ? await callDynamicMetadataRoute(route, match, options.makeThenableParams, functions) : serveStaticMetadataRoute(route), route, options.cleanPathname);
+		};
+		const cached = await readMatchedPrerenderedMetadataRouteResponse(options, route, render);
+		if (cached.response) return cached.response;
 		if (route.isDynamic && isImageMetadataRoute(route) && functions.dynamicParams === false) {
 			const validationParams = { ...rawParams };
 			canonicalizeAppPageParams(validationParams);
@@ -526,12 +533,6 @@ async function handleMetadataRouteRequest(options) {
 			});
 			if (dynamicParamsResponse) return dynamicParamsResponse;
 		}
-		const render = async () => {
-			setCurrentFetchSoftTags(buildMetadataRouteTags(route, options.cleanPathname, []));
-			return captureRenderedMetadataRoute(route.isDynamic ? await callDynamicMetadataRoute(route, match, options.makeThenableParams, functions) : serveStaticMetadataRoute(route), route, options.cleanPathname);
-		};
-		const cached = await readMatchedPrerenderedMetadataRouteResponse(options, route, render);
-		if (cached.response) return cached.response;
 		const rendered = await render();
 		await writeMetadataRouteMiss(options, route, rendered, cached.cachedEntry);
 		return rendered.response;

package/dist/server/middleware-matcher.d.ts

@@ -7,6 +7,8 @@ export type MiddlewareLocaleMatchContext = {
   defaultLocale: string;
 } | {
   kind: "internal" | "literal";
+} | {
+  kind: "next-data";
 };
 export declare function matchesMiddleware(pathname: string, matcher: MatcherConfig | undefined, request?: Request, i18nConfig?: NextI18nConfig | null, localeContext?: MiddlewareLocaleMatchContext): boolean;
 /**

package/dist/server/middleware-matcher.js

@@ -49,6 +49,7 @@ function matchesMiddlewarePathname(pathname, matcher, i18nConfig, localeContext)
 	return false;
 }
 function matchMatcherPattern(pathname, pattern, i18nConfig, localeContext) {
+	if (localeContext?.kind === "next-data") return matchNextDataPattern(pathname, pattern, i18nConfig, true);
 	if (!i18nConfig) return matchPattern(pathname, pattern);
 	if (localeContext) {
 		if (localeContext.kind === "internal") return false;
@@ -57,9 +58,25 @@ function matchMatcherPattern(pathname, pattern, i18nConfig, localeContext) {
 	return matchPattern(stripLocalePrefix(pathname, i18nConfig) ?? pathname, pattern);
 }
 function matchObjectMatcher(pathname, matcher, i18nConfig, localeContext) {
+	if (localeContext?.kind === "next-data") return matchNextDataPattern(pathname, matcher.source, i18nConfig, matcher.locale !== false);
 	if (matcher.locale !== false) return matchMatcherPattern(pathname, matcher.source, i18nConfig, localeContext);
 	return matchPattern(localeContext?.kind === "defaulted" ? `/${localeContext.defaultLocale}${pathname === "/" ? "" : pathname}` : pathname, matcher.source);
 }
+function matchNextDataPattern(pathname, source, i18nConfig, localized) {
+	if (compiledPattern(source) === UNSAFE_MATCHER_PATTERN) return true;
+	return matchPattern(pathname, nextDataMatcherSource(source, i18nConfig, localized));
+}
+/**
+* The source Next.js compiles for a matcher: an optional `_next/data/<buildId>`
+* prefix, an internal locale segment under i18n, and an optional data suffix.
+* Next.js also accepts App Router transport suffixes, which end in `.rsc` and
+* so can never match a `.json` data URL.
+* https://github.com/vercel/next.js/blob/v16.2.7/packages/next/src/build/analysis/get-page-static-info.ts
+*/
+function nextDataMatcherSource(source, i18nConfig, localized) {
+	const isRoot = source === "/";
+	return `/:nextData(_next/data/[^/]{1,})?${i18nConfig && localized ? `/:nextInternalLocale((?!_next/)[^/.]{1,})${isRoot ? "" : source}` : source}${isRoot ? `(${i18nConfig ? "|\\.json|" : ""}/?index|/?index\\.json)?` : "{(\\.json)}?"}`;
+}
 function stripLocalePrefix(pathname, i18nConfig) {
 	if (pathname === "/") return null;
 	const lowerFirstSegment = pathname.split("/")[1]?.toLowerCase();
@@ -71,13 +88,17 @@ function stripFirstPathSegment(pathname) {
 }
 function matchPattern(pathname, pattern) {
 	if (pattern === "/" && (pathname === "//" || pathname === "/?" || pathname === "/#")) return false;
+	const compiled = compiledPattern(pattern);
+	if (compiled === UNSAFE_MATCHER_PATTERN) return true;
+	return compiled.test(pathname);
+}
+function compiledPattern(pattern) {
 	let cached = _mwPatternCache.get(pattern);
 	if (cached === void 0) {
 		cached = compileMatcherPattern(pattern);
 		_mwPatternCache.set(pattern, cached);
 	}
-	if (cached === UNSAFE_MATCHER_PATTERN) return true;
-	return cached.test(pathname);
+	return cached;
 }
 function compileMatcherPattern(pattern) {
 	const result = compileMiddlewareMatcherPattern(pattern);

package/dist/server/middleware-path-to-regexp.js

@@ -224,7 +224,7 @@ function middlewarePathTokensToRegExp(tokens) {
 		} else route += `(?:${prefix}${suffix})${token.modifier}`;
 	}
 	route += `${delimiterRegex}?$`;
-	return new RegExp(route, "i");
+	return new RegExp(route);
 }
 //#endregion
 export { middlewarePathTokensToRegExp, normalizeMiddlewarePathTokens, parseMiddlewarePath };

package/dist/server/middleware-runtime.d.ts

@@ -10,6 +10,8 @@ export type MiddlewareResult = {
   redirectUrl?: string;
   redirectStatus?: number;
   rewriteUrl?: string;
+  /** False when a same-origin rewrite target was outside the basePath. */
+  rewriteHadBasePath?: boolean;
   rewriteStatus?: number;
   status?: number;
   responseHeaders?: Headers;
@@ -41,6 +43,11 @@ type ExecuteMiddlewareOptions = {
    * must derive and forward this from trusted URL normalization.
    */
   isDataRequest?: boolean;
+  /**
+   * The data request names a buildId other than the current build. Adapters
+   * pass it raw to middleware only under `skipProxyUrlNormalize`.
+   */
+  isStaleDataRequest?: boolean;
   isProxy: boolean;
   module: MiddlewareModule;
   normalizedPathname?: string;
@@ -63,6 +70,12 @@ type ExecuteMiddlewareOptions = {
    * `new URL('/x', req.url)`.
    */
   trailingSlash?: boolean;
+  /**
+   * next.config `skipTrailingSlashRedirect`. Middleware then sees requests in
+   * either slash form, so NextURL keeps each request's own trailing slash and
+   * redirect Locations keep theirs, as Next.js's `getNextPathnameInfo` does.
+   */
+  skipTrailingSlashRedirect?: boolean;
 };
 type RunGeneratedMiddlewareOptions = ExecuteMiddlewareOptions & {
   ctx?: ExecutionContextLike;

package/dist/server/middleware-runtime.js

@@ -2,18 +2,20 @@ import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import "../utils/protocol-headers.js";
 import { shouldKeepMiddlewareHeader } from "../utils/middleware-request-headers.js";
 import { normalizeHost } from "../config/request-context.js";
-import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { addBasePathToPathname, hasBasePath, removeTrailingSlash, stripBasePath } from "../utils/base-path.js";
+import { MIDDLEWARE_REWRITE_HEADER } from "./headers.js";
+import { badRequestResponse, internalServerErrorResponse } from "./http-error-responses.js";
+import { isOpenRedirectShaped } from "./open-redirect.js";
+import { processMiddlewareHeaders } from "./request-pipeline.js";
+import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { getRequestExecutionContext, runWithExecutionContext } from "../shims/request-context.js";
 import "./server-globals.js";
-import { MIDDLEWARE_REWRITE_HEADER } from "./headers.js";
 import { NextFetchEvent, NextRequest } from "../shims/server.js";
+import { runInWorkStoreScope } from "../shims/internal/work-store-scope.js";
 import { normalizePath } from "./normalize-path.js";
 import { matchesMiddleware, matchesMiddlewarePathname } from "./middleware-matcher.js";
-import { badRequestResponse, internalServerErrorResponse } from "./http-error-responses.js";
-import { isOpenRedirectShaped } from "./open-redirect.js";
-import { processMiddlewareHeaders } from "./request-pipeline.js";
 import { normalizeDefaultLocalePathname } from "./pages-i18n.js";
+import { nextDataMiddlewareMatchPathname } from "./pages-data-route.js";
 import { reportRequestError } from "./instrumentation.js";
 import { isValidNavigationSignalError } from "../utils/navigation-signal.js";
 import { frameworkTracer } from "./tracer.js";
@@ -133,7 +135,7 @@ function resolveMiddlewarePathname(request) {
 		return badRequestResponse();
 	}
 }
-function createNextRequest(request, i18nConfig, basePath, trailingSlash, hadBasePath, requestBodyAlreadyIsolated = false) {
+function createNextRequest(request, i18nConfig, basePath, trailingSlash, hadBasePath, requestBodyAlreadyIsolated = false, skipTrailingSlashRedirect = false) {
 	const url = new URL(request.url);
 	let mwRequest = !requestBodyAlreadyIsolated && request.body && !request.bodyUsed ? request.clone() : request;
 	const requestPathname = url.pathname;
@@ -143,10 +145,11 @@ function createNextRequest(request, i18nConfig, basePath, trailingSlash, hadBase
 		mwUrl.pathname = mwPathname;
 		mwRequest = new Request(mwUrl, mwRequest);
 	}
-	const nextConfig = basePath || i18nConfig || trailingSlash ? {
+	const nextConfig = basePath || i18nConfig || trailingSlash || skipTrailingSlashRedirect ? {
 		basePath: basePath ?? "",
 		i18n: i18nConfig ?? void 0,
-		trailingSlash: trailingSlash ?? void 0
+		trailingSlash: trailingSlash ?? void 0,
+		skipTrailingSlashRedirect
 	} : void 0;
 	const nextRequest = mwRequest instanceof NextRequest && (!mwRequest.body || mwRequest.bodyUsed) ? mwRequest : new NextRequest(mwRequest, nextConfig ? { nextConfig } : void 0);
 	if (mwRequest !== request && mwRequest.body && !mwRequest.bodyUsed && !mwRequest.body.locked) mwRequest.body.cancel().catch(() => {});
@@ -164,7 +167,10 @@ function releaseMiddlewareRequestBody(request, waitUntilPromises, retainedByResp
 	}
 	Promise.allSettled(waitUntilPromises).then(cancel);
 }
-async function executeMiddleware(options) {
+function executeMiddleware(options) {
+	return runInWorkStoreScope(() => executeMiddlewareModule(options));
+}
+async function executeMiddlewareModule(options) {
 	const middlewareFn = resolveMiddlewareModuleHandler(options.module, {
 		filePath: options.filePath,
 		isProxy: options.isProxy
@@ -187,14 +193,17 @@ async function executeMiddleware(options) {
 		if (options.hadBasePath === true) return candidate;
 		return matcher === void 0 ? candidate : null;
 	};
-	const encodedMatchPathname = prepareMatcherPathname(encodedRequestPathname);
+	const isStaleDataRequest = options.isDataRequest === true && options.isStaleDataRequest === true;
+	const toPageMatcherPathname = (candidate) => candidate !== null && options.isDataRequest && !isStaleDataRequest ? nextDataMiddlewareMatchPathname(candidate) ?? candidate : candidate;
+	const encodedMatchPathname = toPageMatcherPathname(prepareMatcherPathname(encodedRequestPathname));
 	let decodedMatchPathname = encodedMatchPathname;
 	try {
 		if (encodedMatchPathname !== null) decodedMatchPathname = decodeURIComponent(encodedMatchPathname);
-		else if (!options.i18nConfig) decodedMatchPathname = prepareMatcherPathname(decodeURIComponent(encodedRequestPathname));
+		else if (!options.i18nConfig) decodedMatchPathname = toPageMatcherPathname(prepareMatcherPathname(decodeURIComponent(encodedRequestPathname)));
 	} catch {}
 	let localeContext;
-	if (options.i18nConfig && encodedMatchPathname !== null) {
+	if (isStaleDataRequest) localeContext = { kind: "next-data" };
+	else if (options.i18nConfig && encodedMatchPathname !== null) {
 		const hostname = normalizeHost(options.request.headers.get("host"), requestUrl.hostname);
 		const firstSegment = encodedMatchPathname.split("/", 3)[1];
 		if (firstSegment !== void 0 && options.i18nConfig.locales.some((locale) => locale.toLowerCase() === firstSegment.toLowerCase())) localeContext = { kind: "literal" };
@@ -210,7 +219,7 @@ async function executeMiddleware(options) {
 	const decodedMatches = !encodedMatches && decodedMatchPathname !== null && decodedMatchPathname !== encodedMatchPathname && matchesMiddleware(decodedMatchPathname, matcher, options.request, options.i18nConfig, localeContext);
 	if (!encodedMatches && !decodedMatches) return { continue: true };
 	options.onMatch?.();
-	const nextRequest = createNextRequest(options.request, options.i18nConfig, options.basePath, options.trailingSlash, hadBasePath, options.requestBodyAlreadyIsolated);
+	const nextRequest = createNextRequest(options.request, options.i18nConfig, options.basePath, options.trailingSlash, hadBasePath, options.requestBodyAlreadyIsolated, options.skipTrailingSlashRedirect);
 	if (options.isDataRequest) Object.defineProperty(nextRequest, "__isData", {
 		enumerable: false,
 		value: true
@@ -248,21 +257,12 @@ async function executeMiddleware(options) {
 			waitUntilPromises
 		};
 	}
-	if (response.headers.get("x-middleware-next") === "1") {
-		releaseMiddlewareRequestBody(nextRequest, waitUntilPromises);
-		return {
-			continue: true,
-			responseHeaders: collectMiddlewareHeaders(response),
-			status: response.status !== 200 ? response.status : void 0,
-			waitUntilPromises
-		};
-	}
 	if (response.status >= 300 && response.status < 400) {
 		const location = response.headers.get("Location") ?? response.headers.get("location");
 		if (location) {
 			const relativeLocation = relativizeLocation(location, options.request.url);
 			let normalizedLocation = relativeLocation;
-			if (options.trailingSlash !== void 0) try {
+			if (options.trailingSlash !== void 0 && !options.skipTrailingSlashRedirect) try {
 				const loc = new URL(relativeLocation, options.request.url);
 				if (loc.origin === new URL(options.request.url).origin) {
 					const p = loc.pathname;
@@ -309,11 +309,14 @@ async function executeMiddleware(options) {
 	const rewriteUrl = response.headers.get(MIDDLEWARE_REWRITE_HEADER);
 	if (rewriteUrl) {
 		let rewritePath;
+		let rewriteHadBasePath;
 		try {
 			const rewriteParsed = new URL(rewriteUrl, options.request.url);
 			const requestOrigin = new URL(options.request.url).origin;
-			if (rewriteParsed.origin === requestOrigin) rewritePath = (options.basePath ? stripBasePath(rewriteParsed.pathname, options.basePath) : rewriteParsed.pathname) + rewriteParsed.search;
-			else rewritePath = rewriteParsed.href;
+			if (rewriteParsed.origin === requestOrigin) {
+				rewriteHadBasePath = !options.basePath || hasBasePath(rewriteParsed.pathname, options.basePath);
+				rewritePath = (options.basePath ? stripBasePath(rewriteParsed.pathname, options.basePath) : rewriteParsed.pathname) + rewriteParsed.search;
+			} else rewritePath = rewriteParsed.href;
 		} catch {
 			rewritePath = rewriteUrl;
 		}
@@ -321,12 +324,22 @@ async function executeMiddleware(options) {
 		return {
 			continue: true,
 			rewriteUrl: rewritePath,
+			rewriteHadBasePath,
 			rewriteStatus: response.status !== 200 ? response.status : void 0,
 			responseHeaders: collectMiddlewareHeaders(response),
 			status: response.status !== 200 ? response.status : void 0,
 			waitUntilPromises
 		};
 	}
+	if (response.headers.get("x-middleware-next") === "1") {
+		releaseMiddlewareRequestBody(nextRequest, waitUntilPromises);
+		return {
+			continue: true,
+			responseHeaders: collectMiddlewareHeaders(response),
+			status: response.status !== 200 ? response.status : void 0,
+			waitUntilPromises
+		};
+	}
 	releaseMiddlewareRequestBody(nextRequest, waitUntilPromises, response.body === nextRequest.body);
 	return {
 		continue: false,

package/dist/server/middleware.d.ts

@@ -44,6 +44,6 @@ export declare function findMiddlewareFile(root: string, fileMatcher: ValidFileM
  * @param request - The incoming Request object
  * @returns Middleware result describing what action to take
  */
-export declare function runMiddleware(runner: ModuleRunner, middlewarePath: string, request: Request, i18nConfig?: NextI18nConfig | null, basePath?: string, trailingSlash?: boolean, isDataRequest?: boolean, normalizedPathname?: string): Promise<MiddlewareResult>;
+export declare function runMiddleware(runner: ModuleRunner, middlewarePath: string, request: Request, i18nConfig?: NextI18nConfig | null, basePath?: string, trailingSlash?: boolean, isDataRequest?: boolean, normalizedPathname?: string, isStaleDataRequest?: boolean, skipTrailingSlashRedirect?: boolean): Promise<MiddlewareResult>;
 //#endregion
 export { matchPattern, matchesMiddleware };