vinext 1.1.0 → 1.2.1

package/dist/config/config-matchers.d.ts

@@ -1,5 +1,6 @@
 import { HasCondition, NextHeader, NextI18nConfig, NextRedirect, NextRewrite } from "./next-config.js";
 import { RequestContext, normalizeHost, parseCookies, requestContextFromRequest } from "./request-context.js";
+import { RedirectDestinationQueryPart } from "./destination-params.js";
 import { isExternalUrl } from "../utils/external-url.js";
 //#region src/config/config-matchers.d.ts
 /**
@@ -75,6 +76,15 @@ export declare function applyMiddlewareRequestHeaders(middlewareHeaders: Record<
 };
 export declare function checkHasConditions(has: HasCondition[] | undefined, missing: HasCondition[] | undefined, ctx: RequestContext): boolean;
 export declare function matchConfigPattern(pathname: string, pattern: string): Record<string, string> | null;
+/**
+ * A matched config redirect. `destinationQuery` holds the destination query's
+ * parts, split before params were substituted, for merging the request query.
+ */
+export type RedirectMatch = {
+  destination: string;
+  permanent: boolean;
+  destinationQuery: RedirectDestinationQueryPart[];
+};
 /**
  * Apply redirect rules from next.config.js.
  * Returns the redirect info if a redirect was matched, or null.
@@ -110,10 +120,7 @@ export declare function matchConfigPattern(pathname: string, pattern: string): R
  * an original index < N are checked via matchConfigPattern first — they are
  * few in practice (typically zero) so this is not a hot-path concern.
  */
-export declare function matchRedirect(pathname: string, redirects: NextRedirect[], ctx: RequestContext, basePathState?: BasePathMatchState, onRuleSourceMatch?: (rule: NextRedirect) => void): {
-  destination: string;
-  permanent: boolean;
-} | null;
+export declare function matchRedirect(pathname: string, redirects: NextRedirect[], ctx: RequestContext, basePathState?: BasePathMatchState, onRuleSourceMatch?: (rule: NextRedirect) => void): RedirectMatch | null;
 /**
  * Apply rewrite rules from next.config.js.
  * Returns the rewritten URL or null if no rewrite matched.
@@ -142,7 +149,8 @@ export declare function matchesRewriteSource(pathname: string, rewrite: NextRewr
  * users off-site.
  *
  * This function collapses any leading double (or more) slashes to a single
- * slash for non-external (relative) destinations.
+ * slash for non-external (relative) destinations, including tab/newline and
+ * leading C0 control characters that browsers ignore while parsing.
  */
 export declare function sanitizeDestination(dest: string): string;
 /**
@@ -162,13 +170,20 @@ export declare function sanitizeDestination(dest: string): string;
  * still treated as an RSC fetch. Dropping it breaks RSC fetch semantics
  * (issue #1529).
  *
- * Destination query params win — a request param is only carried over when
- * the destination does not already specify that key. Mirrors the merge
- * semantics in `proxyExternalRequest`. External destinations are returned
- * untouched (a config redirect to another origin should not leak the
- * original request's query).
+ * Ported from Next.js's `{ ...requestQuery, ...destinationQuery }` merge and
+ * `stringifyQuery`: request keys keep their order (integer-like keys first, as
+ * in a JS object), a destination key overrides the request value in place,
+ * and destination-only keys follow. Request keys and values are re-encoded;
+ * destination query text is emitted verbatim, except that, like Next.js,
+ * destination strings equal to a request key or value are re-encoded too.
+ * Pass the match's
+ * `destinationQuery` so substituted params keep their value boundaries;
+ * without it the destination's own query is split. External destinations are returned untouched (a config redirect to another
+ * origin should not leak the original request's query).
+ *
+ * https://github.com/vercel/next.js/blob/canary/packages/next/src/server/server-route-utils.ts
  */
-export declare function preserveRedirectDestinationQuery(destination: string, requestSearch: string): string;
+export declare function preserveRedirectDestinationQuery(destination: string, requestSearch: string, destinationQuery?: RedirectDestinationQueryPart[]): string;
 /**
  * Proxy an incoming request to an external URL and return the upstream response.
  *

package/dist/config/config-matchers.js

@@ -3,6 +3,8 @@ import { buildRequestHeadersFromMiddlewareResponse, getUnconsumedMiddlewareReque
 import { analyzeRegexSafety } from "../utils/regex-safety.js";
 import { normalizeHost, parseCookies, requestContextFromRequest } from "./request-context.js";
 import { isExternalUrl } from "../utils/external-url.js";
+import { attachRequestCfMetadata } from "../server/request-pipeline.js";
+import { substituteDestinationParams, substituteRedirectDestinationQuery } from "./destination-params.js";
 //#region src/config/config-matchers.ts
 /**
 * Cache for compiled regex patterns in matchConfigPattern.
@@ -44,14 +46,6 @@ const _compiledHeaderSourceCache = /* @__PURE__ */ new Map();
 */
 const _compiledConditionCache = /* @__PURE__ */ new Map();
 /**
-* Cache for destination substitution regexes in substituteDestinationParams.
-*
-* The regex depends only on the set of param keys captured from the matched
-* source pattern. Caching by sorted key list avoids recompiling a new RegExp
-* for repeated redirect/rewrite calls that use the same param shape.
-*/
-const _compiledDestinationParamCache = /* @__PURE__ */ new Map();
-/**
 * Generic helper for the regex compilation caches above.
 *
 * Each cache stores the compiled artifact (or `null` when safeRegExp rejected
@@ -303,13 +297,17 @@ function applyMiddlewareRequestHeaders(middlewareHeaders, request) {
 	const nextHeaders = buildRequestHeadersFromMiddlewareResponse(request.headers, middlewareHeaders);
 	const unconsumedRequestHeaders = getUnconsumedMiddlewareRequestHeaders(middlewareHeaders);
 	for (const key of Object.keys(middlewareHeaders)) if (key.startsWith("x-middleware-") && key !== "x-middleware-cache" && !unconsumedRequestHeaders.has(key)) delete middlewareHeaders[key];
-	if (nextHeaders) request = new Request(request.url, {
-		method: request.method,
-		headers: nextHeaders,
-		body: request.body,
-		signal: request.signal,
-		duplex: request.body ? "half" : void 0
-	});
+	if (nextHeaders) {
+		const source = request;
+		request = new Request(request.url, {
+			method: request.method,
+			headers: nextHeaders,
+			body: request.body,
+			signal: request.signal,
+			duplex: request.body ? "half" : void 0
+		});
+		attachRequestCfMetadata(request, source);
+	}
 	return {
 		request,
 		postMwReqCtx: requestContextFromRequest(request)
@@ -561,13 +559,10 @@ function matchRedirect(pathname, redirects, ctx, basePathState = _BASEPATH_DEFAU
 			onRuleSourceMatch?.(redirect);
 			const conditionParams = redirect.has || redirect.missing ? collectConditionParams(redirect.has, redirect.missing, ctx) : _emptyParams();
 			if (!conditionParams) continue;
-			localeMatch = {
-				destination: substituteAndSanitizeDestination(redirect.destination, {
-					[entry.paramName]: "",
-					...conditionParams
-				}),
-				permanent: redirect.permanent
-			};
+			localeMatch = resolveRedirectMatch(redirect, {
+				[entry.paramName]: "",
+				...conditionParams
+			});
 			localeMatchIndex = entry.originalIndex;
 			break;
 		}
@@ -584,13 +579,10 @@ function matchRedirect(pathname, redirects, ctx, basePathState = _BASEPATH_DEFAU
 				onRuleSourceMatch?.(redirect);
 				const conditionParams = redirect.has || redirect.missing ? collectConditionParams(redirect.has, redirect.missing, ctx) : _emptyParams();
 				if (!conditionParams) continue;
-				localeMatch = {
-					destination: substituteAndSanitizeDestination(redirect.destination, {
-						[entry.paramName]: localePart,
-						...conditionParams
-					}),
-					permanent: redirect.permanent
-				};
+				localeMatch = resolveRedirectMatch(redirect, {
+					[entry.paramName]: localePart,
+					...conditionParams
+				});
 				localeMatchIndex = entry.originalIndex;
 				break;
 			}
@@ -604,13 +596,10 @@ function matchRedirect(pathname, redirects, ctx, basePathState = _BASEPATH_DEFAU
 			onRuleSourceMatch?.(redirect);
 			const conditionParams = redirect.has || redirect.missing ? collectConditionParams(redirect.has, redirect.missing, ctx) : _emptyParams();
 			if (!conditionParams) continue;
-			return {
-				destination: substituteAndSanitizeDestination(redirect.destination, {
-					...params,
-					...conditionParams
-				}),
-				permanent: redirect.permanent
-			};
+			return resolveRedirectMatch(redirect, {
+				...params,
+				...conditionParams
+			});
 		}
 	}
 	return localeMatch;
@@ -636,12 +625,24 @@ function matchRewrite(pathname, rewrites, ctx, basePathState = _BASEPATH_DEFAULT
 				...params,
 				...conditionParams
 			};
-			return substituteAndSanitizeRewriteDestination(rewrite.destination, rewriteParams);
+			return substituteAndSanitizeRewriteDestination(serializeRewriteDestinationTemplate(rewrite.destination), rewriteParams);
 		}
 	}
 	return null;
 }
 /**
+* Next.js prepareDestination URL-parses the destination template before it
+* substitutes params, so a literal `é` routes as `%C3%A9` while substituted
+* values stay verbatim: a captured `../admin` is never resolved to `/admin`.
+*
+* https://github.com/vercel/next.js/blob/canary/packages/next/src/shared/lib/router/utils/prepare-destination.ts
+*/
+function serializeRewriteDestinationTemplate(destination) {
+	if (!destination.startsWith("/") || destination.startsWith("//")) return destination;
+	const parsed = new URL(destination, "http://n");
+	return parsed.pathname + parsed.search + parsed.hash;
+}
+/**
 * Check whether a rewrite source can match a pathname without evaluating its
 * request-dependent `has` / `missing` conditions.
 *
@@ -654,47 +655,20 @@ function matchesRewriteSource(pathname, rewrite, basePathState = _BASEPATH_DEFAU
 	return shouldEvaluateRule(rewrite.basePath, basePathState) && matchConfigPattern(pathname, rewrite.source) !== null;
 }
 /**
-* Substitute all matched route params into a redirect/rewrite destination.
-*
-* Handles repeated params (e.g. `/api/:id/:id`) and catch-all suffix forms
-* (`:path*`, `:path+`) in a single pass. Unknown params are left intact.
-*/
-function substituteDestinationParams(destination, params) {
-	const keys = Object.keys(params);
-	if (keys.length === 0) return destination;
-	const sortedKeys = [...keys].sort((a, b) => b.length - a.length);
-	const cacheKey = sortedKeys.join("\0");
-	let paramRe = _compiledDestinationParamCache.get(cacheKey);
-	if (!paramRe) {
-		const paramAlternation = sortedKeys.map((key) => key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
-		paramRe = new RegExp(`:(${paramAlternation})([+*])?(?![A-Za-z0-9_])`, "g");
-		_compiledDestinationParamCache.set(cacheKey, paramRe);
-	}
-	const replaceParams = (value, encodeParam) => value.replace(paramRe, (_token, key) => encodeParam(params[key]));
-	const hashIndex = destination.indexOf("#");
-	const beforeHash = hashIndex === -1 ? destination : destination.slice(0, hashIndex);
-	const hash = hashIndex === -1 ? "" : destination.slice(hashIndex);
-	const queryIndex = beforeHash.indexOf("?");
-	if (queryIndex !== -1) {
-		const beforeQuery = beforeHash.slice(0, queryIndex);
-		const query = beforeHash.slice(queryIndex + 1);
-		return `${replaceParams(beforeQuery, (value) => value)}?${replaceParams(query, encodeDestinationQueryParamValue)}${replaceParams(hash, (value) => value)}`;
-	}
-	return replaceParams(destination, (value) => value);
-}
-function encodeDestinationQueryParamValue(value) {
-	const params = new URLSearchParams();
-	params.set("", value);
-	return params.toString().slice(1);
-}
-/**
 * Substitute params into a redirect/rewrite destination and sanitize the
 * result. Used by every redirect/rewrite branch — the substitution can
 * introduce protocol-relative URLs (e.g. `//evil.com` from a decoded `%2F`
 * in a catch-all param), which sanitizeDestination collapses.
 */
-function substituteAndSanitizeDestination(destination, params) {
-	return sanitizeDestination(substituteDestinationParams(destination, params));
+function substituteAndSanitizeDestination(destination, params, kind) {
+	return sanitizeDestination(substituteDestinationParams(destination, params, kind));
+}
+function resolveRedirectMatch(redirect, params) {
+	return {
+		destination: substituteAndSanitizeDestination(redirect.destination, params, "redirect"),
+		permanent: redirect.permanent,
+		destinationQuery: substituteRedirectDestinationQuery(redirect.destination, params)
+	};
 }
 /**
 * Match Next.js's rewrite-specific prepareDestination behavior: source params
@@ -704,7 +678,7 @@ function substituteAndSanitizeDestination(destination, params) {
 * https://github.com/vercel/next.js/blob/canary/packages/next/src/shared/lib/router/utils/prepare-destination.ts
 */
 function substituteAndSanitizeRewriteDestination(destination, params) {
-	const rewritten = substituteAndSanitizeDestination(destination, params);
+	const rewritten = substituteAndSanitizeDestination(destination, params, "rewrite");
 	if (!shouldAppendRewriteParamsToQuery(destination, params)) return rewritten;
 	const existingQueryKeys = getDestinationQueryKeys(destination);
 	const paramsToAppend = [];
@@ -771,11 +745,12 @@ function appendQueryParams(url, params) {
 * users off-site.
 *
 * This function collapses any leading double (or more) slashes to a single
-* slash for non-external (relative) destinations.
+* slash for non-external (relative) destinations, including tab/newline and
+* leading C0 control characters that browsers ignore while parsing.
 */
 function sanitizeDestination(dest) {
 	if (dest.startsWith("http://") || dest.startsWith("https://")) return dest;
-	dest = dest.replace(/^[\\/]+/, "/");
+	dest = dest.replace(/^[\u0000-\u0020]*(?:[\\/][\t\n\r]*)+/, "/");
 	return dest;
 }
 /**
@@ -795,13 +770,20 @@ function sanitizeDestination(dest) {
 * still treated as an RSC fetch. Dropping it breaks RSC fetch semantics
 * (issue #1529).
 *
-* Destination query params win — a request param is only carried over when
-* the destination does not already specify that key. Mirrors the merge
-* semantics in `proxyExternalRequest`. External destinations are returned
-* untouched (a config redirect to another origin should not leak the
-* original request's query).
+* Ported from Next.js's `{ ...requestQuery, ...destinationQuery }` merge and
+* `stringifyQuery`: request keys keep their order (integer-like keys first, as
+* in a JS object), a destination key overrides the request value in place,
+* and destination-only keys follow. Request keys and values are re-encoded;
+* destination query text is emitted verbatim, except that, like Next.js,
+* destination strings equal to a request key or value are re-encoded too.
+* Pass the match's
+* `destinationQuery` so substituted params keep their value boundaries;
+* without it the destination's own query is split. External destinations are returned untouched (a config redirect to another
+* origin should not leak the original request's query).
+*
+* https://github.com/vercel/next.js/blob/canary/packages/next/src/server/server-route-utils.ts
 */
-function preserveRedirectDestinationQuery(destination, requestSearch) {
+function preserveRedirectDestinationQuery(destination, requestSearch, destinationQuery) {
 	if (requestSearch === "" || requestSearch === "?" || isExternalUrl(destination)) return destination;
 	const requestParams = new URLSearchParams(requestSearch);
 	if ([...requestParams.keys()].length === 0) return destination;
@@ -810,13 +792,29 @@ function preserveRedirectDestinationQuery(destination, requestSearch) {
 	const beforeHash = hashIndex === -1 ? destination : destination.slice(0, hashIndex);
 	const queryIndex = beforeHash.indexOf("?");
 	const pathPart = queryIndex === -1 ? beforeHash : beforeHash.slice(0, queryIndex);
-	const destQuery = queryIndex === -1 ? "" : beforeHash.slice(queryIndex + 1);
-	const merged = new URLSearchParams(destQuery);
-	const destKeys = new Set(merged.keys());
-	for (const [key, value] of requestParams) if (!destKeys.has(key)) merged.append(key, value);
-	const mergedQuery = merged.toString();
+	const requestStrings = /* @__PURE__ */ new Set();
+	const requestParts = Object.create(null);
+	for (const [key, value] of requestParams) {
+		requestStrings.add(key);
+		requestStrings.add(value);
+		(requestParts[key] ??= []).push(`${encodeURIComponent(key)}=${encodeURIComponent(value)}`);
+	}
+	const encode = (text) => requestStrings.has(text) ? encodeURIComponent(text) : text;
+	const destinationParts = Object.create(null);
+	for (const [key, keyText, valueText] of destinationQuery ?? substituteRedirectDestinationQuery(destination, {})) (destinationParts[key] ??= []).push(valueText === null ? encode(keyText) : `${encode(keyText)}=${encode(valueText)}`);
+	const mergedQuery = Object.values({
+		...requestParts,
+		...destinationParts
+	}).flat().join("&");
 	return mergedQuery === "" ? `${pathPart}${hash}` : `${pathPart}?${mergedQuery}${hash}`;
 }
+function parseExternalRewriteUrl(externalUrl) {
+	try {
+		return new URL(externalUrl);
+	} catch {
+		return null;
+	}
+}
 /**
 * Proxy an incoming request to an external URL and return the upstream response.
 *
@@ -828,7 +826,11 @@ function preserveRedirectDestinationQuery(destination, requestSearch) {
 */
 async function proxyExternalRequest(request, externalUrl) {
 	const originalUrl = new URL(request.url);
-	const targetUrl = new URL(externalUrl);
+	const targetUrl = parseExternalRewriteUrl(externalUrl);
+	if (!targetUrl) {
+		console.error("[vinext] Invalid external rewrite destination:", externalUrl);
+		return new Response("Internal Server Error", { status: 500 });
+	}
 	const destinationKeys = new Set(targetUrl.searchParams.keys());
 	for (const [key, value] of originalUrl.searchParams) if (!destinationKeys.has(key)) targetUrl.searchParams.append(key, value);
 	const headers = new Headers(request.headers);

package/dist/config/destination-params.d.ts

@@ -0,0 +1,47 @@
+//#region src/config/destination-params.d.ts
+/**
+ * Destination param substitution for next.config.js redirects and rewrites.
+ *
+ * Kept free of server-only imports so the Pages Router client can apply simple
+ * beforeFiles rewrites with exactly the same substitution as the server.
+ */
+/**
+ * Substitute all matched route params into a redirect/rewrite destination.
+ *
+ * Handles repeated params (e.g. `/api/:id/:id`) and catch-all suffix forms
+ * (`:path*`, `:path+`) in a single pass. Unknown params are left intact.
+ *
+ * Query substitution follows how Next.js consumes each destination kind:
+ *
+ * - A rewrite's query is parsed into an object before substitution, so the
+ *   target sees each param verbatim as one value. vinext encodes the whole
+ *   value so it round-trips back to that verbatim string.
+ * - A redirect's query is emitted as Location text with params inserted
+ *   verbatim, so an already percent-encoded capture is decoded once by the
+ *   client. vinext inserts redirect params verbatim too.
+ *
+ * A rewrite's absolute destination is proxied server-side, so params in its
+ * authority (`https://:tenant.example.com/`) are percent-encoded, keeping the
+ * `%XX` escapes a raw path capture already carries. A decoded `has` capture
+ * carrying `#`, `/`, `?`, `@` or `:` then makes the host invalid instead of
+ * moving the proxy to another host. Next.js substitutes the hostname verbatim
+ * and can be retargeted this way; vinext is stricter.
+ *
+ * https://github.com/vercel/next.js/blob/canary/packages/next/src/shared/lib/router/utils/prepare-destination.ts
+ * https://github.com/vercel/next.js/blob/canary/packages/next/src/server/server-route-utils.ts
+ */
+export declare function substituteDestinationParams(destination: string, params: Record<string, string>, kind: "redirect" | "rewrite"): string;
+/**
+ * Split a redirect destination's query into parts before substituting params,
+ * as Next.js's prepareDestination parses the template query first. Each part
+ * is `[key, keyText, valueText]`: the texts are the part's template text with
+ * params substituted verbatim (`valueText` is `null` without an `=`), and
+ * `key` is the decoded key, used only to match request params. Keeping these
+ * boundaries means a param containing `&` stays one value when the request
+ * query is merged in.
+ *
+ * https://github.com/vercel/next.js/blob/canary/packages/next/src/shared/lib/router/utils/prepare-destination.ts
+ */
+export declare function substituteRedirectDestinationQuery(destination: string, params: Record<string, string>): RedirectDestinationQueryPart[];
+export type RedirectDestinationQueryPart = [key: string, keyText: string, valueText: string | null];
+//#endregion

package/dist/config/destination-params.js

@@ -0,0 +1,116 @@
+//#region src/config/destination-params.ts
+/**
+* Destination param substitution for next.config.js redirects and rewrites.
+*
+* Kept free of server-only imports so the Pages Router client can apply simple
+* beforeFiles rewrites with exactly the same substitution as the server.
+*/
+/**
+* Cache for destination substitution regexes in substituteDestinationParams.
+*
+* The regex depends only on the set of param keys captured from the matched
+* source pattern. Caching by sorted key list avoids recompiling a new RegExp
+* for repeated redirect/rewrite calls that use the same param shape.
+*/
+const _compiledDestinationParamCache = /* @__PURE__ */ new Map();
+/**
+* Substitute all matched route params into a redirect/rewrite destination.
+*
+* Handles repeated params (e.g. `/api/:id/:id`) and catch-all suffix forms
+* (`:path*`, `:path+`) in a single pass. Unknown params are left intact.
+*
+* Query substitution follows how Next.js consumes each destination kind:
+*
+* - A rewrite's query is parsed into an object before substitution, so the
+*   target sees each param verbatim as one value. vinext encodes the whole
+*   value so it round-trips back to that verbatim string.
+* - A redirect's query is emitted as Location text with params inserted
+*   verbatim, so an already percent-encoded capture is decoded once by the
+*   client. vinext inserts redirect params verbatim too.
+*
+* A rewrite's absolute destination is proxied server-side, so params in its
+* authority (`https://:tenant.example.com/`) are percent-encoded, keeping the
+* `%XX` escapes a raw path capture already carries. A decoded `has` capture
+* carrying `#`, `/`, `?`, `@` or `:` then makes the host invalid instead of
+* moving the proxy to another host. Next.js substitutes the hostname verbatim
+* and can be retargeted this way; vinext is stricter.
+*
+* https://github.com/vercel/next.js/blob/canary/packages/next/src/shared/lib/router/utils/prepare-destination.ts
+* https://github.com/vercel/next.js/blob/canary/packages/next/src/server/server-route-utils.ts
+*/
+function substituteDestinationParams(destination, params, kind) {
+	const paramRe = getDestinationParamRegex(params);
+	if (!paramRe) return destination;
+	const replaceParams = (value, encodeParam) => value.replace(paramRe, (_token, key) => encodeParam(params[key]));
+	if (kind === "redirect") return replaceParams(destination, (value) => value);
+	const hashIndex = destination.indexOf("#");
+	const beforeHash = hashIndex === -1 ? destination : destination.slice(0, hashIndex);
+	const hash = hashIndex === -1 ? "" : destination.slice(hashIndex);
+	const queryIndex = beforeHash.indexOf("?");
+	const beforeQuery = queryIndex === -1 ? beforeHash : beforeHash.slice(0, queryIndex);
+	const authorityEnd = getAbsoluteUrlAuthorityEnd(beforeQuery.replace(paramRe, (token) => "x".repeat(token.length)));
+	return `${`${replaceParams(beforeQuery.slice(0, authorityEnd), encodeAuthorityParam)}${replaceParams(beforeQuery.slice(authorityEnd), (value) => value)}`}${queryIndex === -1 ? "" : `?${replaceParams(beforeHash.slice(queryIndex + 1), encodeRewriteQueryParamValue)}`}${replaceParams(hash, (value) => value)}`;
+}
+function getAbsoluteUrlAuthorityEnd(value) {
+	const scheme = /^[a-z][a-z0-9+.-]*:[/\\\t\n\r]*/i.exec(value);
+	if (!scheme && /^[/\\]/.test(value)) return 0;
+	const start = scheme ? scheme[0].length : 0;
+	const pathStart = value.slice(start).search(/[/\\]/);
+	return pathStart === -1 ? value.length : start + pathStart;
+}
+/**
+* Split a redirect destination's query into parts before substituting params,
+* as Next.js's prepareDestination parses the template query first. Each part
+* is `[key, keyText, valueText]`: the texts are the part's template text with
+* params substituted verbatim (`valueText` is `null` without an `=`), and
+* `key` is the decoded key, used only to match request params. Keeping these
+* boundaries means a param containing `&` stays one value when the request
+* query is merged in.
+*
+* https://github.com/vercel/next.js/blob/canary/packages/next/src/shared/lib/router/utils/prepare-destination.ts
+*/
+function substituteRedirectDestinationQuery(destination, params) {
+	const hashIndex = destination.indexOf("#");
+	const beforeHash = hashIndex === -1 ? destination : destination.slice(0, hashIndex);
+	const queryIndex = beforeHash.indexOf("?");
+	if (queryIndex === -1) return [];
+	const paramRe = getDestinationParamRegex(params);
+	const substitute = (value) => paramRe ? value.replace(paramRe, (_token, key) => params[key]) : value;
+	return beforeHash.slice(queryIndex + 1).split("&").filter(Boolean).map((part) => {
+		const equalsIndex = part.indexOf("=");
+		const keyText = substitute(equalsIndex === -1 ? part : part.slice(0, equalsIndex));
+		const valueText = equalsIndex === -1 ? null : substitute(part.slice(equalsIndex + 1));
+		return [
+			decodeQueryKey(keyText),
+			keyText,
+			valueText
+		];
+	});
+}
+function decodeQueryKey(keyText) {
+	const [entry] = new URLSearchParams(keyText.replace(/[&=]/g, (char) => encodeURIComponent(char)));
+	return entry?.[0] ?? "";
+}
+function getDestinationParamRegex(params) {
+	const keys = Object.keys(params);
+	if (keys.length === 0) return null;
+	const sortedKeys = [...keys].sort((a, b) => b.length - a.length);
+	const cacheKey = sortedKeys.join("\0");
+	let paramRe = _compiledDestinationParamCache.get(cacheKey);
+	if (!paramRe) {
+		const paramAlternation = sortedKeys.map((key) => key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+		paramRe = new RegExp(`:(${paramAlternation})([+*])?(?![A-Za-z0-9_])`, "g");
+		_compiledDestinationParamCache.set(cacheKey, paramRe);
+	}
+	return paramRe;
+}
+function encodeAuthorityParam(value) {
+	return value.replace(/%(?![0-9a-f]{2})|[^A-Za-z0-9._~%-]/giu, encodeURIComponent);
+}
+function encodeRewriteQueryParamValue(value) {
+	const params = new URLSearchParams();
+	params.set("", value);
+	return params.toString().slice(1);
+}
+//#endregion
+export { substituteDestinationParams, substituteRedirectDestinationQuery };

package/dist/config/next-config.d.ts

@@ -111,6 +111,12 @@ export type NextConfig = {
   crossOrigin?: "anonymous" | "use-credentials";
   /** Whether to add trailing slashes */
   trailingSlash?: boolean;
+  /**
+   * Skip the automatic trailing-slash redirects and keep `<Link>`/router
+   * hrefs exactly as written.
+   * @see https://nextjs.org/docs/app/api-reference/config/next-config-js/skipTrailingSlashRedirect
+   */
+  skipTrailingSlashRedirect?: boolean;
   /**
    * Compress responses from the Node production server. Defaults to true.
    * @see https://nextjs.org/docs/app/api-reference/config/next-config-js/compress
@@ -317,6 +323,7 @@ export type ResolvedNextConfig = {
    */
   assetPrefix: string;
   trailingSlash: boolean;
+  skipTrailingSlashRedirect: boolean;
   /** Whether the Node production server compresses responses (`compress`, default true). */
   compress: boolean;
   skipProxyUrlNormalize: boolean;

package/dist/config/next-config.js

@@ -373,6 +373,7 @@ function warnDeprecatedConfigOptions(config, root) {
 		["experimental.instrumentationHook", `\`experimental.instrumentationHook\` is no longer needed, because \`instrumentation.js\` is available by default. You can remove it from ${configFileName}.`]
 	];
 	for (const [propertyPath, warning] of warnings) if (hasConfigProperty(config, propertyPath)) warnConfigOnce(warning);
+	if (readOptionalRecord(config.experimental)?.skipTrailingSlashRedirect != null) warnConfigOnce(`\`experimental.skipTrailingSlashRedirect\` has been moved to \`skipTrailingSlashRedirect\`. Please update your ${configFileName} file accordingly.`);
 }
 async function resolveNextConfigInput(config, phase = PHASE_DEVELOPMENT_SERVER) {
 	return await resolveConfigValue(config, phase);
@@ -761,6 +762,7 @@ async function resolveNextConfig(config, root = toSlash(process.cwd()), options
 			basePath: "",
 			assetPrefix: "",
 			trailingSlash: false,
+			skipTrailingSlashRedirect: false,
 			compress: true,
 			skipProxyUrlNormalize: false,
 			typescript: {},
@@ -947,6 +949,7 @@ async function resolveNextConfig(config, root = toSlash(process.cwd()), options
 		basePath: config.basePath ?? "",
 		assetPrefix: normalizeAssetPrefix(config.assetPrefix),
 		trailingSlash: config.trailingSlash ?? false,
+		skipTrailingSlashRedirect: (experimental?.skipTrailingSlashRedirect ?? config.skipTrailingSlashRedirect) === true,
 		compress: config.compress !== false,
 		skipProxyUrlNormalize: config.skipProxyUrlNormalize ?? config.skipMiddlewareUrlNormalize ?? false,
 		typescript: typeof config.typescript?.tsconfigPath === "string" ? { tsconfigPath: config.typescript.tsconfigPath } : {},

package/dist/entries/app-rsc-entry.d.ts

@@ -93,6 +93,10 @@ type AppRouterConfig = {
   draftModeSecret?: string;
   /** Server-only token used to authorize build-time prerender endpoints. */
   prerenderSecret?: string;
+  /** next.config `skipTrailingSlashRedirect`. */
+  skipTrailingSlashRedirect?: boolean;
+  /** Dev-only key authenticating the hybrid Pages handler's forwarded middleware context. */
+  devForwardedMiddlewareContextKey?: string;
 };
 /** Generate the module-free App request stage used by multi-stage Worker outputs. */
 export declare function generateAppRequestRscEntry(appDir: string, routes: AppRoute[], middlewarePath?: string | null, metadataRoutes?: MetadataFileRoute[], _globalErrorPath?: string | null, basePath?: string, trailingSlash?: boolean, config?: AppRouterConfig, instrumentationPath?: string | null): string;