vinext 1.1.0 → 1.2.1

package/dist/server/middleware.js

@@ -77,7 +77,7 @@ function isMiddlewareModule(value) {
 * @param request - The incoming Request object
 * @returns Middleware result describing what action to take
 */
-async function runMiddleware(runner, middlewarePath, request, i18nConfig, basePath, trailingSlash, isDataRequest, normalizedPathname) {
+async function runMiddleware(runner, middlewarePath, request, i18nConfig, basePath, trailingSlash, isDataRequest, normalizedPathname, isStaleDataRequest, skipTrailingSlashRedirect) {
 	const mod = await runner.import(middlewarePath);
 	if (!isMiddlewareModule(mod)) throw new Error(`Middleware module "${middlewarePath}" did not evaluate to an object.`);
 	return runGeneratedMiddleware({
@@ -87,10 +87,12 @@ async function runMiddleware(runner, middlewarePath, request, i18nConfig, basePa
 		i18nConfig,
 		includeErrorDetails: process.env.NODE_ENV !== "production",
 		isDataRequest,
+		isStaleDataRequest,
 		isProxy: isProxyFile(middlewarePath),
 		module: mod,
 		normalizedPathname,
 		request,
+		skipTrailingSlashRedirect,
 		trailingSlash
 	});
 }

package/dist/server/multi-stage.d.ts

@@ -29,6 +29,17 @@ export type VinextResponseStageDispatchOptions = {
    * partition its lookup or stored entry by it.
    */
   renderWholeDocument?: boolean;
+  /**
+   * Regenerate an entry the adapter already stores for this build. Set only
+   * from a platform-invoked regeneration callback or a platform cache's
+   * conditional revalidation of a stored entry, never from anything a client
+   * can send: core then treats the path as admitted and skips
+   * request-time admission work such as a Pages `getStaticPaths()` call, as
+   * Next.js regenerates a generated path without consulting it. It is not a
+   * cache selector: a transport must not partition its lookup or stored entry
+   * by it.
+   */
+  regeneratesStoredEntry?: boolean;
   /**
    * Query-free identity of a shared App page GET/HEAD dispatch, supplied only
    * to adapters that declare `responseStageCacheIdentity: "query-free"` and

package/dist/server/navigation-planner.js

@@ -1,5 +1,5 @@
-import { splitPathnameForRouteMatch } from "../routing/utils.js";
 import { stripBasePath } from "../utils/base-path.js";
+import { splitPathnameForRouteMatch } from "../routing/utils.js";
 import { matchRoutePattern, matchRoutePatternPrefix, matchRoutePatternWithOptionalDynamicSegments } from "../routing/route-pattern.js";
 import { AppElementsWire, compareAppElementsSlotIds } from "./app-elements-wire.js";
 import "./app-elements.js";

package/dist/server/normalize-path.d.ts

@@ -1,17 +1,4 @@
 //#region src/server/normalize-path.d.ts
-export declare function escapePathDelimiters(segment: string, escapeEncoded?: boolean): string;
-/**
- * Decode a URL pathname segment-by-segment, preserving encoded path delimiters.
- * Non-ASCII characters (e.g. %C3%A9 -> e) are decoded, but structural characters
- * like %2F (/) %23 (#) %3F (?) %5C (\) are re-encoded after decoding.
- *
- * This prevents encoded slashes from changing the path structure (e.g.
- * /admin%2Fpanel stays as a single segment, not /admin/panel).
- *
- * Ported from Next.js: packages/next/src/server/lib/router-utils/decode-path-params.ts
- * https://github.com/vercel/next.js/blob/canary/packages/next/src/server/lib/router-utils/decode-path-params.ts
- */
-export declare function decodePathParams(pathname: string): string;
 export declare function isInterceptionMatchedUrlPath(value: string): boolean;
 /**
  * Path normalization utility for request handling.

package/dist/server/normalize-path.js

@@ -1,37 +1,4 @@
 //#region src/server/normalize-path.ts
-/**
-* Re-encode path delimiter characters that were decoded by decodeURIComponent.
-* After decoding a URL segment, characters like / # ? \ need to be re-encoded
-* so they don't change the path structure.
-*
-* Ported from Next.js: packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts
-* https://github.com/vercel/next.js/blob/canary/packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts
-*/
-const PATH_DELIMITERS_RE = /([/#?])/gi;
-const PATH_DELIMITERS_ENCODED_RE = /([/#?]|%(2f|23|3f|5c))/gi;
-function escapePathDelimiters(segment, escapeEncoded) {
-	return segment.replace(escapeEncoded ? PATH_DELIMITERS_ENCODED_RE : PATH_DELIMITERS_RE, (char) => encodeURIComponent(char));
-}
-/**
-* Decode a URL pathname segment-by-segment, preserving encoded path delimiters.
-* Non-ASCII characters (e.g. %C3%A9 -> e) are decoded, but structural characters
-* like %2F (/) %23 (#) %3F (?) %5C (\) are re-encoded after decoding.
-*
-* This prevents encoded slashes from changing the path structure (e.g.
-* /admin%2Fpanel stays as a single segment, not /admin/panel).
-*
-* Ported from Next.js: packages/next/src/server/lib/router-utils/decode-path-params.ts
-* https://github.com/vercel/next.js/blob/canary/packages/next/src/server/lib/router-utils/decode-path-params.ts
-*/
-function decodePathParams(pathname) {
-	return pathname.split("/").map((seg) => {
-		try {
-			return escapePathDelimiters(decodeURIComponent(seg), true);
-		} catch {
-			return seg;
-		}
-	}).join("/");
-}
 function isInterceptionMatchedUrlPath(value) {
 	return value.startsWith("/") && !value.startsWith("//") && !value.includes("?") && !value.includes("#") && !value.includes("\\") && !value.includes("\0");
 }
@@ -67,4 +34,4 @@ function normalizePath(pathname) {
 	return "/" + resolved.join("/");
 }
 //#endregion
-export { decodePathParams, escapePathDelimiters, isInterceptionMatchedUrlPath, normalizePath };
+export { isInterceptionMatchedUrlPath, normalizePath };

package/dist/server/open-redirect.d.ts

@@ -11,7 +11,7 @@ export declare function isOpenRedirectShaped(rawPathname: string): boolean;
 /**
  * What a request entry answers for a raw path containing a backslash or a
  * repeated slash: Next.js's 308, or a 404 when the collapsed path would still
- * be open-redirect shaped.
+ * be open-redirect shaped or the raw target is not origin-form.
  */
 export type RepeatedSlashRedirect = {
   status: 308;
@@ -33,17 +33,24 @@ export type RepeatedSlashRedirect = {
  * `//evil.com` → `/evil.com`. Percent-encoded `%2F`/`%5C` are not touched and
  * keep falling through to `isOpenRedirectShaped` (404), as in Next.js.
  *
- * The Location is always same-origin. Absolute-form request targets
- * (`GET http://host//x`) are left alone. A collapsed path that still starts
+ * The Location is always same-origin. A collapsed path that still starts
  * with an encoded slash or backslash (`//%2Fevil.com`, `/.//%2Fevil.com`) is
  * never echoed into a Location or routed: it gets a 404 instead.
  *
+ * A raw Node request target that is not origin-form (`GET http://evil.example/x`,
+ * which Node's parser accepts, or `OPTIONS *`) also gets a 404. Next.js never
+ * routes these either: it 308s absolute-form targets to their own URL (the
+ * `//` after the scheme trips the same check) and 500s `OPTIONS *`. Routing
+ * them would let the request line choose the origin of `request.url` that
+ * middleware and handlers see, bypassing the Host trust policy. Request-based
+ * entries always pass a pathname.
+ *
  * @param rawUrl - The raw request target: pathname plus optional `?query`
  */
 export declare function getRepeatedSlashRedirect(rawUrl: string): RepeatedSlashRedirect | null;
 /**
  * Build the Response for a raw request path containing a backslash or a
- * repeated slash. See `getRepeatedSlashRedirect`.
+ * repeated slash, or a non-origin-form target. See `getRepeatedSlashRedirect`.
  */
 export declare function repeatedSlashRedirectResponse(rawUrl: string): Response | null;
 /**

package/dist/server/open-redirect.js

@@ -34,15 +34,22 @@ const REDIRECT_LOCATION_BASE = "http://vinext.invalid";
 * `//evil.com` → `/evil.com`. Percent-encoded `%2F`/`%5C` are not touched and
 * keep falling through to `isOpenRedirectShaped` (404), as in Next.js.
 *
-* The Location is always same-origin. Absolute-form request targets
-* (`GET http://host//x`) are left alone. A collapsed path that still starts
+* The Location is always same-origin. A collapsed path that still starts
 * with an encoded slash or backslash (`//%2Fevil.com`, `/.//%2Fevil.com`) is
 * never echoed into a Location or routed: it gets a 404 instead.
 *
+* A raw Node request target that is not origin-form (`GET http://evil.example/x`,
+* which Node's parser accepts, or `OPTIONS *`) also gets a 404. Next.js never
+* routes these either: it 308s absolute-form targets to their own URL (the
+* `//` after the scheme trips the same check) and 500s `OPTIONS *`. Routing
+* them would let the request line choose the origin of `request.url` that
+* middleware and handlers see, bypassing the Host trust policy. Request-based
+* entries always pass a pathname.
+*
 * @param rawUrl - The raw request target: pathname plus optional `?query`
 */
 function getRepeatedSlashRedirect(rawUrl) {
-	if (!rawUrl.startsWith("/")) return null;
+	if (!rawUrl.startsWith("/")) return { status: 404 };
 	const urlParts = rawUrl.split("?");
 	const pathname = urlParts[0];
 	if (!REPEATED_SLASH_OR_BACKSLASH_RE.test(pathname)) return null;
@@ -62,7 +69,7 @@ function repeatedSlashRedirectHeaders(location) {
 }
 /**
 * Build the Response for a raw request path containing a backslash or a
-* repeated slash. See `getRepeatedSlashRedirect`.
+* repeated slash, or a non-origin-form target. See `getRepeatedSlashRedirect`.
 */
 function repeatedSlashRedirectResponse(rawUrl) {
 	const redirect = getRepeatedSlashRedirect(rawUrl);

package/dist/server/pages-api-route.d.ts

@@ -2,7 +2,7 @@ import { NextI18nConfig } from "../config/next-config.js";
 import { Route } from "../routing/pages-router.js";
 import { ExecutionContextLike } from "../shims/request-context.js";
 import { EdgeApiExecutionRuntime } from "./edge-api-runtime.js";
-import { PagesReqResRequest, PagesReqResResponse, PagesRequestQuery } from "./pages-node-compat.js";
+import { PagesApiReqResResponse, PagesReqResRequest, PagesRequestQuery } from "./pages-node-compat.js";
 //#region src/server/pages-api-route.d.ts
 type PagesApiRouteConfig = {
   runtime?: string;
@@ -36,7 +36,7 @@ type PagesApiRouteConfig = {
     externalResolver?: boolean;
   };
 };
-type PagesNodeApiRouteHandler = (req: PagesReqResRequest, res: PagesReqResResponse) => unknown;
+type PagesNodeApiRouteHandler = (req: PagesReqResRequest, res: PagesApiReqResResponse) => unknown;
 type PagesEdgeApiRouteHandler = (request: Request) => Response | Promise<Response>;
 type PagesApiRouteModule = {
   /**
@@ -80,6 +80,7 @@ type HandlePagesApiRouteOptions = {
     allowedRevalidateHeaderKeys?: readonly string[];
     i18n?: NextI18nConfig | null;
     trailingSlash?: boolean;
+    skipTrailingSlashRedirect?: boolean;
   };
   trustedRevalidateOrigin?: string;
 };

package/dist/server/pages-api-route.js

@@ -1,15 +1,15 @@
+import { internalServerErrorResponse } from "./http-error-responses.js";
+import { cloneRequestWithUrl } from "./request-pipeline.js";
 import { getRequestExecutionContext, runWithExecutionContext } from "../shims/request-context.js";
 import "./server-globals.js";
 import { NextRequest } from "../shims/server.js";
-import { internalServerErrorResponse } from "./http-error-responses.js";
-import { cloneRequestWithUrl } from "./request-pipeline.js";
 import { markRouteCacheabilityExplicitResponsePolicy } from "../shims/cacheability-classification.js";
 import { hasCdnResponsePolicy } from "./cache-control.js";
 import { mergeRouteParamsIntoQuery, parseQueryString, urlQueryToSearchParams } from "../utils/query.js";
 import { tracePagesApiHandler } from "./pages-execution-tracing.js";
 import { resolveBodyParserConfig } from "./pages-body-parser-config.js";
 import { PagesBodyParseError } from "./pages-media-type.js";
-import { createPagesReqRes, markVinextStreamedApiResponse, parsePagesApiBody } from "./pages-node-compat.js";
+import { createPagesApiReqRes, markVinextStreamedApiResponse, parsePagesApiBody } from "./pages-node-compat.js";
 import { finalizeEdgeApiResponse, isEdgeApiRuntime } from "./edge-api-runtime.js";
 //#region src/server/pages-api-route.ts
 function resolveModuleRuntime(module) {
@@ -47,7 +47,8 @@ async function _handlePagesApiRoute(options) {
 			const nextRequest = new NextRequest(createEdgeApiRequest(options.request, options.url, params), options.nextConfig ? { nextConfig: {
 				basePath: options.nextConfig.basePath,
 				i18n: options.nextConfig.i18n ?? void 0,
-				trailingSlash: options.nextConfig.trailingSlash
+				trailingSlash: options.nextConfig.trailingSlash,
+				skipTrailingSlashRedirect: options.nextConfig.skipTrailingSlashRedirect
 			} } : void 0);
 			const response = await tracePagesApiHandler(route.pattern, () => handler(nextRequest));
 			if (response instanceof Response) {
@@ -70,7 +71,7 @@ async function _handlePagesApiRoute(options) {
 		const query = buildPagesApiQuery(options.url, params);
 		const bodyParserConfig = resolveBodyParserConfig(route.module.config);
 		const body = bodyParserConfig.enabled ? await parsePagesApiBody(options.request, bodyParserConfig.sizeLimit) : void 0;
-		const { req, res, responsePromise } = createPagesReqRes({
+		const { req, res, responsePromise } = createPagesApiReqRes({
 			allowedRevalidateHeaderKeys: options.nextConfig?.allowedRevalidateHeaderKeys,
 			body,
 			initialResponseHeaders: options.initialResponseHeaders,

package/dist/server/pages-cache-tag.d.ts

@@ -0,0 +1,12 @@
+//#region src/server/pages-cache-tag.d.ts
+/**
+ * Build the edge path tag for a Pages ISR pathname.
+ *
+ * Every spelling of one pathname shares a single ISR entry, because
+ * `pagesIsrCacheKey()` decodes each segment first. The tag must use that same
+ * decoded identity. Otherwise `/users/%40alice` is stored at the edge under its
+ * own tag, and `res.revalidate("/users/@alice")` or
+ * `revalidatePath("/users/@alice")` never purges it.
+ */
+export declare function pagesPathCacheTag(isrPathname: string): string;
+//#endregion

package/dist/server/pages-cache-tag.js

@@ -0,0 +1,19 @@
+import { normalizePathnameForRouteMatch } from "../routing/utils.js";
+import { encodeCacheTag } from "../utils/encode-cache-tag.js";
+//#region src/server/pages-cache-tag.ts
+/**
+* Build the edge path tag for a Pages ISR pathname.
+*
+* Every spelling of one pathname shares a single ISR entry, because
+* `pagesIsrCacheKey()` decodes each segment first. The tag must use that same
+* decoded identity. Otherwise `/users/%40alice` is stored at the edge under its
+* own tag, and `res.revalidate("/users/@alice")` or
+* `revalidatePath("/users/@alice")` never purges it.
+*/
+function pagesPathCacheTag(isrPathname) {
+	const pathname = normalizePathnameForRouteMatch(isrPathname);
+	const stem = pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
+	return encodeCacheTag(`_N_T_${stem || "/"}`);
+}
+//#endregion
+export { pagesPathCacheTag };

package/dist/server/pages-client-assets.d.ts

@@ -14,6 +14,8 @@ export type PagesClientAssets = {
   dynamicPreloads?: Record<string, string[]>;
   /** next.config crossOrigin, defaulting to anonymous for Vite's CORS-fetched assets. */
   crossOrigin?: AssetCrossOrigin;
+  /** Client bundle files outside `_next/static`, as URL pathnames. */
+  clientBuildFiles?: string[];
 };
 export declare function setPagesClientAssets(assets: PagesClientAssets | undefined): void;
 export declare function getPagesClientAssets(): PagesClientAssets;

package/dist/server/pages-data-route.d.ts

@@ -61,6 +61,16 @@ export declare function encodeUrlParserIgnoredCharacters(pathname: string): stri
  * `/_next/data/<buildId>/about`              → null  (missing .json suffix)
  */
 export declare function parseNextDataPathname(pathname: string, buildId: string): NextDataMatch | null;
+/**
+ * The page pathname a `_next/data` URL addresses, whatever its buildId. Next.js
+ * compiles every middleware matcher with an optional `/_next/data/<buildId>`
+ * prefix and `.json` suffix, so a matcher written for `/admin` also guards that
+ * page's data URL, even one with a stale buildId. Middleware matching uses this
+ * when the request reaches middleware with its raw data URL
+ * (`skipProxyUrlNormalize`).
+ * https://github.com/vercel/next.js/blob/v16.2.7/packages/next/src/build/analysis/get-page-static-info.ts
+ */
+export declare function nextDataMiddlewareMatchPathname(pathname: string): string | null;
 export declare function normalizeNextDataPagePathname(pagePathname: string, trailingSlash?: boolean): string;
 /**
  * Next.js only applies `trailingSlash` while normalizing a data URL for

package/dist/server/pages-data-route.js

@@ -1,6 +1,7 @@
 import { MIDDLEWARE_SKIP_HEADER } from "../utils/protocol-headers.js";
 import { addBasePathToPathname, hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { NEXTJS_DEPLOYMENT_ID_HEADER } from "./headers.js";
+import { cloneRequestWithUrl } from "./request-pipeline.js";
 //#region src/server/pages-data-route.ts
 /**
 * Helpers for the Pages Router `/_next/data/{buildId}/{...page}.json` endpoint.
@@ -67,7 +68,24 @@ function parseNextDataPathname(pathname, buildId) {
 	if (!isNextDataPathname(pathname)) return null;
 	const expectedPrefix = `${NEXT_DATA_PREFIX}${buildId}/`;
 	if (!pathname.startsWith(expectedPrefix)) return null;
-	const rest = pathname.slice(expectedPrefix.length, -5);
+	return pageFromNextDataRest(pathname.slice(expectedPrefix.length, -5));
+}
+/**
+* The page pathname a `_next/data` URL addresses, whatever its buildId. Next.js
+* compiles every middleware matcher with an optional `/_next/data/<buildId>`
+* prefix and `.json` suffix, so a matcher written for `/admin` also guards that
+* page's data URL, even one with a stale buildId. Middleware matching uses this
+* when the request reaches middleware with its raw data URL
+* (`skipProxyUrlNormalize`).
+* https://github.com/vercel/next.js/blob/v16.2.7/packages/next/src/build/analysis/get-page-static-info.ts
+*/
+function nextDataMiddlewareMatchPathname(pathname) {
+	if (!isNextDataPathname(pathname)) return null;
+	const buildIdEnd = pathname.indexOf("/", 12);
+	if (buildIdEnd <= 12) return null;
+	return pageFromNextDataRest(pathname.slice(buildIdEnd + 1, -5))?.pagePathname ?? null;
+}
+function pageFromNextDataRest(rest) {
 	if (rest.length === 0) return null;
 	if (rest === "index") return { pagePathname: "/" };
 	if (rest.endsWith("/index")) return { pagePathname: `/${rest.slice(0, -6)}` };
@@ -174,11 +192,11 @@ function normalizePagesDataRequest(request, buildId, basePath = "", trailingSlas
 	normalizedUrl.pathname = hadBasePath ? addBasePathToPathname(pagePathname, basePath) : pagePathname;
 	return {
 		isDataReq: true,
-		request: new Request(normalizedUrl, request),
+		request: cloneRequestWithUrl(request, normalizedUrl.href),
 		normalizedPathname: pagePathname,
 		search: reqUrl.search,
 		notFoundResponse: null
 	};
 }
 //#endregion
-export { buildMiddlewarePrefetchSkipResponse, buildNextDataNotFoundResponse, buildNextDataPropsJsonResponse, encodeUrlParserIgnoredCharacters, isNextDataPathname, normalizeNextDataPagePathname, normalizePagesDataRequest, parseNextDataPathname, shouldAddTrailingSlashToPagesDataPath, urlParserCreatesPagesDataPath };
+export { buildMiddlewarePrefetchSkipResponse, buildNextDataNotFoundResponse, buildNextDataPropsJsonResponse, encodeUrlParserIgnoredCharacters, isNextDataPathname, nextDataMiddlewareMatchPathname, normalizeNextDataPagePathname, normalizePagesDataRequest, parseNextDataPathname, shouldAddTrailingSlashToPagesDataPath, urlParserCreatesPagesDataPath };

package/dist/server/pages-document-asset-props.d.ts

@@ -10,7 +10,11 @@ type ApplyDocumentAssetPropsOptions = {
   protectedAssetMarker?: string;
   scriptOwner?: "head" | "next-script";
 };
-export declare function extractDocumentAssetProps(html: string): {
+/**
+ * Read and strip the nonce and crossOrigin props that `<Head>` and
+ * `<NextScript />` recorded on their tags, found by this render's token.
+ */
+export declare function extractDocumentAssetProps(html: string, token: string): {
   html: string;
   props: DocumentAssetProps;
 };

package/dist/server/pages-document-asset-props.js

@@ -1,4 +1,6 @@
+import { escapeRegExp } from "../utils/regex.js";
 import { escapeHtmlAttr } from "./html.js";
+import { getDocumentHeadOpenMarker, getDocumentScriptsPlaceholder } from "../shims/document-placeholders.js";
 //#region src/server/pages-document-asset-props.ts
 const HEAD_NONCE_ATTR = "data-vinext-head-nonce";
 const HEAD_CROSS_ORIGIN_ATTR = "data-vinext-head-cross-origin";
@@ -11,9 +13,15 @@ function readAttribute(tag, name) {
 function removeAttributes(tag, names) {
 	return tag.replace(new RegExp(`\\s(?:${names.join("|")})="[^"]*"`, "g"), "");
 }
-function extractDocumentAssetProps(html) {
-	const headTag = html.match(/<head\b[^>]*>/i)?.[0];
-	const nextScriptTag = html.match(/<span\b[^>]*>(?=<!-- __NEXT_SCRIPTS__ -->)/i)?.[0];
+/**
+* Read and strip the nonce and crossOrigin props that `<Head>` and
+* `<NextScript />` recorded on their tags, found by this render's token.
+*/
+function extractDocumentAssetProps(html, token) {
+	const headTagPattern = new RegExp(`<head\\b[^>]*${escapeRegExp(getDocumentHeadOpenMarker(token))}[^>]*>`, "i");
+	const nextScriptTagPattern = new RegExp(`<span\\b[^>]*>(?=${escapeRegExp(getDocumentScriptsPlaceholder(token))})`, "i");
+	const headTag = html.match(headTagPattern)?.[0];
+	const nextScriptTag = html.match(nextScriptTagPattern)?.[0];
 	const props = {
 		headNonce: readAttribute(headTag, HEAD_NONCE_ATTR),
 		headCrossOrigin: readAttribute(headTag, HEAD_CROSS_ORIGIN_ATTR),
@@ -21,14 +29,14 @@ function extractDocumentAssetProps(html) {
 		scriptCrossOrigin: readAttribute(nextScriptTag, SCRIPT_CROSS_ORIGIN_ATTR)
 	};
 	return {
-		html: html.replace(/<head\b[^>]*>/i, (tag) => removeAttributes(tag, [HEAD_NONCE_ATTR, HEAD_CROSS_ORIGIN_ATTR])).replace(/<span\b[^>]*>(?=<!-- __NEXT_SCRIPTS__ -->)/i, (tag) => removeAttributes(tag, [SCRIPT_NONCE_ATTR, SCRIPT_CROSS_ORIGIN_ATTR])),
+		html: html.replace(headTagPattern, (tag) => removeAttributes(tag, [HEAD_NONCE_ATTR, HEAD_CROSS_ORIGIN_ATTR])).replace(nextScriptTagPattern, (tag) => removeAttributes(tag, [SCRIPT_NONCE_ATTR, SCRIPT_CROSS_ORIGIN_ATTR])),
 		props
 	};
 }
 function addAttribute(tag, name, value, replaceExisting = false) {
 	if (value === void 0) return tag;
 	const attributePattern = new RegExp(`\\s${name}(?:="[^"]*")?`, "i");
-	if (attributePattern.test(tag)) return replaceExisting ? tag.replace(attributePattern, ` ${name}="${escapeHtmlAttr(value)}"`) : tag;
+	if (attributePattern.test(tag)) return replaceExisting ? tag.replace(attributePattern, () => ` ${name}="${escapeHtmlAttr(value)}"`) : tag;
 	if (!tag.endsWith(">")) return tag;
 	const selfClosing = tag.endsWith("/>");
 	const closingStart = selfClosing ? tag.length - 2 : tag.length - 1;

package/dist/server/pages-document-splice.d.ts

@@ -0,0 +1,19 @@
+//#region src/server/pages-document-splice.d.ts
+/**
+ * Drop `<Head>`'s marker attribute and insert `insertion` right after its
+ * opening tag. Dev HTML transforms may add attributes after the marker.
+ */
+export declare function spliceDocumentHeadOpen(html: string, token: string, insertion: string): string;
+/** Insert `insertion` right before `<Head>`'s closing tag. */
+export declare function spliceDocumentHeadClose(html: string, token: string, insertion: string): string;
+/** Put the generated hydration scripts where `<NextScript />` rendered. */
+export declare function spliceDocumentScripts(html: string, token: string, scripts: string): string;
+/**
+ * Split the Document where `<Main />` rendered. Like Next.js, a Document
+ * without `<Main />` gets the page body after its own markup.
+ */
+export declare function splitDocumentAtMain(html: string, token: string): {
+  prefix: string;
+  suffix: string;
+};
+//#endregion

package/dist/server/pages-document-splice.js

@@ -0,0 +1,55 @@
+import { getDocumentHeadCloseMarker, getDocumentHeadOpenMarker, getDocumentMainPlaceholder, getDocumentScriptsPlaceholder } from "../shims/document-placeholders.js";
+//#region src/server/pages-document-splice.ts
+/**
+* Splices framework output into a serialized custom Pages Router Document.
+*
+* `<Head>`, `<Main />` and `<NextScript />` mark their splice points with the
+* per-render token from `vinext/shims/document-placeholders`, so nothing the
+* Document renders can be taken for one. Each edit slices at a located index
+* instead of calling `String#replace`, so inserted HTML is never parsed for
+* `$&`-style replacement patterns. Like Next.js, a Document that leaves out
+* one of those components gets nothing inserted for it.
+*/
+function spliceMarker(html, marker, insertion) {
+	const index = html.indexOf(marker);
+	if (index === -1) return html;
+	return html.slice(0, index) + insertion + html.slice(index + marker.length);
+}
+/**
+* Drop `<Head>`'s marker attribute and insert `insertion` right after its
+* opening tag. Dev HTML transforms may add attributes after the marker.
+*/
+function spliceDocumentHeadOpen(html, token, insertion) {
+	const marker = getDocumentHeadOpenMarker(token);
+	const index = html.indexOf(marker);
+	if (index === -1) return html;
+	const tagEnd = html.indexOf(">", index + marker.length) + 1;
+	if (tagEnd === 0) return html;
+	return html.slice(0, index) + html.slice(index + marker.length, tagEnd) + insertion + html.slice(tagEnd);
+}
+/** Insert `insertion` right before `<Head>`'s closing tag. */
+function spliceDocumentHeadClose(html, token, insertion) {
+	return spliceMarker(html, getDocumentHeadCloseMarker(token), insertion);
+}
+/** Put the generated hydration scripts where `<NextScript />` rendered. */
+function spliceDocumentScripts(html, token, scripts) {
+	return spliceMarker(html, getDocumentScriptsPlaceholder(token), scripts);
+}
+/**
+* Split the Document where `<Main />` rendered. Like Next.js, a Document
+* without `<Main />` gets the page body after its own markup.
+*/
+function splitDocumentAtMain(html, token) {
+	const placeholder = getDocumentMainPlaceholder(token);
+	const index = html.indexOf(placeholder);
+	if (index === -1) return {
+		prefix: html,
+		suffix: ""
+	};
+	return {
+		prefix: html.slice(0, index),
+		suffix: html.slice(index + placeholder.length)
+	};
+}
+//#endregion
+export { spliceDocumentHeadClose, spliceDocumentHeadOpen, spliceDocumentScripts, splitDocumentAtMain };

package/dist/server/pages-i18n.d.ts

@@ -24,6 +24,15 @@ type PagesI18nRequestInfo = {
   domainLocale?: DomainLocale;
   redirectUrl?: string;
 };
+/**
+ * Return the configured locale that the first pathname segment names, compared
+ * case-insensitively (`/EN/about` -> `"en"`), or `undefined` when there is none.
+ * The configured casing is returned, not the request's.
+ *
+ * Ported from Next.js: packages/next/src/shared/lib/i18n/normalize-locale-path.ts
+ * https://github.com/vercel/next.js/blob/canary/packages/next/src/shared/lib/i18n/normalize-locale-path.ts
+ */
+export declare function detectPathnameLocale(pathname: string, locales: readonly string[]): string | undefined;
 /**
  * Prepend the default locale prefix to a pathname when i18n is configured and
  * the path does not already carry a locale prefix. Mirrors Next.js's
@@ -42,7 +51,9 @@ type PagesI18nRequestInfo = {
  *   - `/__vinext/*` (vinext-internal endpoints)
  *
  * Returns the input unchanged when i18n is not configured or when the path
- * already starts with one of the configured locales. The host-based default
+ * already starts with one of the configured locales (compared
+ * case-insensitively, like Next.js's `normalizeLocalePath`, so `/EN/about`
+ * is left alone rather than becoming `/en/EN/about`). The host-based default
  * locale (i18n.domains[].defaultLocale) is preferred over the global default
  * when supplied, matching Next.js's `domainLocale.defaultLocale` branch.
  *

package/dist/server/pages-i18n.js

@@ -9,6 +9,19 @@ function readHeader(headers, name) {
 }
 const normalizeHostname = normalizeDomainHostname;
 /**
+* Return the configured locale that the first pathname segment names, compared
+* case-insensitively (`/EN/about` -> `"en"`), or `undefined` when there is none.
+* The configured casing is returned, not the request's.
+*
+* Ported from Next.js: packages/next/src/shared/lib/i18n/normalize-locale-path.ts
+* https://github.com/vercel/next.js/blob/canary/packages/next/src/shared/lib/i18n/normalize-locale-path.ts
+*/
+function detectPathnameLocale(pathname, locales) {
+	const segment = pathname.split("/", 2)[1]?.toLowerCase();
+	if (!segment) return void 0;
+	return locales.find((locale) => locale.toLowerCase() === segment);
+}
+/**
 * Prepend the default locale prefix to a pathname when i18n is configured and
 * the path does not already carry a locale prefix. Mirrors Next.js's
 * server-side path normalisation in `resolve-routes.ts` (lines ~250-263):
@@ -26,7 +39,9 @@ const normalizeHostname = normalizeDomainHostname;
 *   - `/__vinext/*` (vinext-internal endpoints)
 *
 * Returns the input unchanged when i18n is not configured or when the path
-* already starts with one of the configured locales. The host-based default
+* already starts with one of the configured locales (compared
+* case-insensitively, like Next.js's `normalizeLocalePath`, so `/EN/about`
+* is left alone rather than becoming `/en/EN/about`). The host-based default
 * locale (i18n.domains[].defaultLocale) is preferred over the global default
 * when supplied, matching Next.js's `domainLocale.defaultLocale` branch.
 *
@@ -42,8 +57,7 @@ const normalizeHostname = normalizeDomainHostname;
 function normalizeDefaultLocalePathname(pathname, i18n, options = {}) {
 	if (!i18n) return pathname;
 	if (pathname.startsWith("/_next/") || pathname.startsWith("/__vinext/")) return pathname;
-	const parts = pathname.split("/", 3);
-	if (parts[1] && i18n.locales.includes(parts[1])) return pathname;
+	if (detectPathnameLocale(pathname, i18n.locales)) return pathname;
 	const defaultLocale = detectDomainLocale(i18n.domains, options.hostname ?? void 0)?.defaultLocale ?? i18n.defaultLocale;
 	if (pathname === "/") return `/${defaultLocale}`;
 	return `/${defaultLocale}${pathname}`;
@@ -229,4 +243,4 @@ function resolvePagesI18nRequest(url, i18nConfig, headers, hostname, basePath =
 	};
 }
 //#endregion
-export { detectDomainLocale, detectLocaleFromAcceptLanguage, extractLocaleFromUrl, getLocaleRedirect, normalizeDefaultLocalePathname, parseCookieLocaleFromHeader, resolvePagesI18nRequest, stripI18nLocaleForApiRoute };
+export { detectDomainLocale, detectLocaleFromAcceptLanguage, detectPathnameLocale, extractLocaleFromUrl, getLocaleRedirect, normalizeDefaultLocalePathname, parseCookieLocaleFromHeader, resolvePagesI18nRequest, stripI18nLocaleForApiRoute };

package/dist/server/pages-node-compat.d.ts

@@ -29,7 +29,6 @@ export type PagesReqResResponse = Writable & {
   send: (data: unknown) => void;
   redirect: (statusOrUrl: number | string, url?: string) => PagesReqResResponse;
   getHeaders: () => PagesReqResHeaders;
-  revalidate: (urlPath: string, opts?: RevalidateOptions) => Promise<void>;
   setPreviewData: (data: object | string, options?: {
     maxAge?: number;
     path?: string;
@@ -41,6 +40,9 @@ export type PagesReqResResponse = Writable & {
     enable?: boolean;
   }) => PagesReqResResponse;
 };
+export type PagesApiReqResResponse = PagesReqResResponse & {
+  revalidate: (urlPath: string, opts?: RevalidateOptions) => Promise<void>;
+};
 type PagesRequestCookiesCarrier = {
   headers: {
     cookie?: string | string[] | null | undefined;
@@ -48,17 +50,19 @@ type PagesRequestCookiesCarrier = {
   cookies?: unknown;
 };
 type CreatePagesReqResOptions = {
-  allowedRevalidateHeaderKeys?: readonly string[];
   body: unknown;
   initialResponseHeaders?: Headers;
   query: PagesRequestQuery;
   request: Request;
-  trustedRevalidateOrigin?: string;
   url: string;
 };
-type CreatePagesReqResResult = {
+type CreatePagesApiReqResOptions = CreatePagesReqResOptions & {
+  allowedRevalidateHeaderKeys?: readonly string[];
+  trustedRevalidateOrigin?: string;
+};
+type CreatePagesReqResResult<Res extends PagesReqResResponse = PagesReqResResponse> = {
   req: PagesReqResRequest;
-  res: PagesReqResResponse;
+  res: Res;
   responsePromise: Promise<Response>;
 };
 /**
@@ -85,5 +89,12 @@ export declare function attachPagesPreviewApi(req: PagesReqResRequest, res: Page
 export declare function markVinextStreamedApiResponse(response: Response): void;
 export declare function isVinextStreamedApiResponse(response: Response): boolean;
 export declare function createPagesReqRes(options: CreatePagesReqResOptions): CreatePagesReqResResult;
+/**
+ * Create the req/res pair for a Pages API route. Only API responses get
+ * `res.revalidate()`: Next.js attaches it in apiResolver
+ * (`packages/next/src/server/api-utils/node/api-resolver.ts`), so a page's
+ * getServerSideProps `res` never carries the revalidation secret.
+ */
+export declare function createPagesApiReqRes(options: CreatePagesApiReqResOptions): CreatePagesReqResResult<PagesApiReqResResponse>;
 //#endregion
 export { PagesBodyParseError as PagesApiBodyParseError };