vinext 1.1.0 → 1.2.1

package/dist/shims/internal/work-store-scope.js

@@ -0,0 +1,24 @@
+import { getOrCreateAls } from "./als-registry.js";
+//#region src/shims/internal/work-store-scope.ts
+/**
+* Marks the work that Next.js runs with a work store (`workAsyncStorage`):
+* App Router renders, Server Actions, route handlers and metadata routes,
+* `generateStaticParams`, and middleware. Pages Router renders, API routes
+* and `getStaticPaths` run without one.
+*
+* Next.js only applies some rules inside a work store, such as skipping the
+* read for an `unstable_cache` nested in another's callback.
+* Source: https://github.com/vercel/next.js/blob/canary/packages/next/src/server/web/spec-extension/unstable-cache.ts
+*/
+const _workStoreScopeAls = getOrCreateAls("vinext.workStoreScope.als");
+function runInWorkStoreScope(fn) {
+	return _workStoreScopeAls.run(true, fn);
+}
+function runOutsideWorkStoreScope(fn) {
+	return _workStoreScopeAls.run(false, fn);
+}
+function isInsideWorkStoreScope() {
+	return _workStoreScopeAls.getStore() === true;
+}
+//#endregion
+export { isInsideWorkStoreScope, runInWorkStoreScope, runOutsideWorkStoreScope };

package/dist/shims/link-prefetch.js

@@ -1,5 +1,5 @@
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
-import { isAbsoluteOrProtocolRelativeUrl } from "./url-utils.js";
+import { collapseLeadingSlashes, isAbsoluteOrProtocolRelativeUrl } from "./url-utils.js";
 //#region src/shims/link-prefetch.ts
 function canLinkPrefetch(input) {
 	return input.nodeEnv === "production" && input.prefetch !== false && !input.isDangerous;
@@ -32,9 +32,10 @@ function getLinkPrefetchHref(input) {
 		const current = new URL(currentOrigin);
 		const parsed = href.startsWith("//") ? new URL(href, current.origin) : new URL(href);
 		if (parsed.origin !== current.origin) return null;
-		if (!basePath) return parsed.pathname + parsed.search + parsed.hash;
-		if (!hasBasePath(parsed.pathname, basePath)) return null;
-		return stripBasePath(parsed.pathname, basePath) + parsed.search + parsed.hash;
+		const pathname = collapseLeadingSlashes(parsed.pathname);
+		if (!basePath) return pathname + parsed.search + parsed.hash;
+		if (!hasBasePath(pathname, basePath)) return null;
+		return collapseLeadingSlashes(stripBasePath(pathname, basePath)) + parsed.search + parsed.hash;
 	} catch {
 		return null;
 	}

package/dist/shims/link.js

@@ -317,7 +317,7 @@ function prefetchUrl(href, mode, priority = "low", pagesRouteHref, locale) {
 async function promotePrefetchEntriesForNavigation(href) {
 	if (typeof window === "undefined") return;
 	if (!hasAppNavigationRuntime()) return;
-	const [{ getPrefetchCache }, { stripRscCacheBustingSearchParam, stripRscSuffix }] = await Promise.all([loadNavigationModule(), import("../server/app-rsc-cache-busting.js")]);
+	const [{ getPrefetchCache }, { parseRscRequestPath, stripRscCacheBustingSearchParam, stripRscSuffix }] = await Promise.all([loadNavigationModule(), import("../server/app-rsc-cache-busting.js")]);
 	let target;
 	try {
 		target = new URL(toCanonicalBrowserNavigationHref(href, window.location.href, __basePath, __trailingSlash), window.location.href);
@@ -330,7 +330,7 @@ async function promotePrefetchEntriesForNavigation(href) {
 		const [rscUrl] = cacheKey.split("\0", 1);
 		let cached;
 		try {
-			cached = new URL(rscUrl, window.location.href);
+			cached = parseRscRequestPath(rscUrl);
 		} catch {
 			continue;
 		}

package/dist/shims/navigation.js

@@ -9,14 +9,15 @@ import { getPprFallbackShellState, markPprFallbackShellDynamicBoundary } from ".
 import { AppRouterContext } from "./internal/app-router-context.js";
 import { resolveDirectHybridClientRouteOwner } from "./internal/hybrid-client-route-owner-direct.js";
 import { isHashOnlyBrowserUrlChange, toCanonicalBrowserNavigationHref, toSameOriginAppPath, withBasePath } from "./url-utils.js";
-import { retryScrollTo, scrollToHashTarget, scrollToHashTargetOnNextFrame } from "./hash-scroll.js";
+import { disableSmoothScrollDuringRouteTransition } from "./disable-smooth-scroll.js";
+import { retryScrollTo, scrollToHashTarget } from "./hash-scroll.js";
 import { AppElementsWire } from "../server/app-elements-wire.js";
 import "../server/app-elements.js";
 import { GLOBAL_ACCESSORS_KEY, ServerInsertedHTMLContext, _registerStateAccessors, clearClientHydrationContext, clearServerInsertedHTML, flushServerInsertedHTML, getBfcacheIdMapContext, getBfcacheSegmentIdContext, getLayoutSegmentContext, getNavigationContext, registerServerInsertedHTMLCallback, renderServerInsertedHTML, setNavigationContext } from "./navigation-context-state.js";
 import { BailoutToCSRError, DynamicServerError, HTTP_ERROR_FALLBACK_ERROR_CODE, RedirectType, decodeRedirectError, forbidden, getAccessFallbackHTTPStatus, isBailoutToCSRError, isDynamicServerError, isHTTPAccessFallbackError, isNextRouterError, isRedirectError, notFound, permanentRedirect, redirect, unauthorized, unstable_rethrow } from "./navigation-errors.js";
 import { clearAppNavigationFailureTarget, stageAppNavigationFailureTarget } from "../client/app-nav-failure-handler.js";
 import { beginAppRouterScrollIntent, clearAppRouterScrollIntent, consumeAppRouterScrollIntent, getPendingAppRouterScrollIntent, isLatestAppRouterScrollIntent } from "./app-router-scroll-state.js";
-import { VINEXT_RSC_COMPATIBILITY_ID_HEADER, createRscRequestHeaders, createRscRequestUrl, stripRscCacheBustingSearchParam, stripRscSuffix } from "../server/app-rsc-cache-busting.js";
+import { VINEXT_RSC_COMPATIBILITY_ID_HEADER, VINEXT_RSC_CONTENT_TYPE, createRscRequestHeaders, createRscRequestUrl, formatRscRequestPath, parseRscRequestPath, stripRscCacheBustingSearchParam, stripRscSuffix } from "../server/app-rsc-cache-busting.js";
 import { notifyAppRouterTransitionStart } from "../client/instrumentation-client-state.js";
 import { getNavigationRuntime, hasAppNavigationRuntime } from "../client/navigation-runtime.js";
 import { UnrecognizedActionError, unstable_isUnrecognizedActionError } from "./unrecognized-action-error.js";
@@ -235,7 +236,7 @@ function resolvePrefetchCacheEntryMountedSlotsHeader(entry) {
 }
 function normalizeRscCacheLookupUrl(rscUrl) {
 	try {
-		const url = new URL(rscUrl, "http://vinext.local");
+		const url = parseRscRequestPath(rscUrl);
 		stripRscCacheBustingSearchParam(url);
 		return `${url.pathname}${url.search}`;
 	} catch {
@@ -244,7 +245,7 @@ function normalizeRscCacheLookupUrl(rscUrl) {
 }
 function normalizeRscCacheLookupPathname(rscUrl) {
 	try {
-		const url = new URL(rscUrl, "http://vinext.local");
+		const url = parseRscRequestPath(rscUrl);
 		return stripRscSuffix(url.pathname);
 	} catch {
 		return null;
@@ -434,8 +435,7 @@ function toAppPrefetchDestination(href) {
 	}
 	const browserHref = toCanonicalBrowserNavigationHref(localHref, window.location.href, __basePath, __trailingSlash);
 	try {
-		const url = new URL(browserHref, window.location.href);
-		return `${url.pathname}${url.search}`;
+		return formatRscRequestPath(new URL(browserHref, window.location.href));
 	} catch {
 		return browserHref.split("#", 1)[0];
 	}
@@ -797,6 +797,22 @@ async function fetchRouteTreeGatedPrefetch(options) {
 	return fetchFullRscPayload();
 }
 /**
+* Whether a prefetch response may be decoded as Flight. A successful response
+* that is not Flight (e.g. a Route Handler's text download) is a miss: decoding
+* its bytes would let text shaped like Flight resource hints insert scripts.
+* Navigation then fetches it and falls back to a document navigation.
+*
+* Ported from Next.js: fetchPrefetchResponse in
+* packages/next/src/client/components/segment-cache/cache.ts, which skips the
+* check in `output: "export"` because a static host, not Next.js, chooses the
+* MIME type of the exported `.txt` payloads.
+*/
+function isFlightPrefetchResponse(response) {
+	if (!response.ok) return false;
+	if (process.env.NODE_ENV === "production" && process.env.__NEXT_CONFIG_OUTPUT === "export") return true;
+	return response.headers.get("content-type")?.toLowerCase().startsWith(VINEXT_RSC_CONTENT_TYPE) === true;
+}
+/**
 * Prefetch an RSC response and snapshot it for later consumption.
 * Stores the in-flight promise so immediate clicks can await it instead
 * of firing a duplicate fetch.
@@ -824,7 +840,7 @@ function prefetchRscResponse(rscUrl, fetchPromise, interceptionContext = null, m
 	addPrefetchInvalidationCallback(entry, options?.onInvalidate);
 	entry.fetchPromise = fetchPromise;
 	entry.pending = fetchPromise.then(async (response) => {
-		if (response.ok) {
+		if (isFlightPrefetchResponse(response)) {
 			const snapshot = await snapshotRscResponse(response);
 			if (cache.get(cacheKey) !== entry) return;
 			const previousSize = getPrefetchCacheEntrySize(entry);
@@ -841,6 +857,7 @@ function prefetchRscResponse(rscUrl, fetchPromise, interceptionContext = null, m
 			evictPrefetchCacheIfNeeded();
 		} else {
 			releaseAppPrefetchFetchSlot(response);
+			response.body?.cancel().catch(() => {});
 			deletePrefetchCacheEntry(cache, prefetched, cacheKey, entry, false);
 		}
 	}).catch(() => {
@@ -1333,11 +1350,19 @@ function commitHashOnlyHistoryState(href, mode, scroll) {
 function applyAppRouterScrollFallback(intent) {
 	if (typeof document === "undefined" || typeof window === "undefined") return;
 	if (intent.hash !== null) {
-		scrollToHashTargetOnNextFrame(intent.hash, () => isLatestAppRouterScrollIntent(intent));
+		const hash = intent.hash;
+		requestAnimationFrame(() => {
+			if (!isLatestAppRouterScrollIntent(intent)) return;
+			disableSmoothScrollDuringRouteTransition(() => {
+				scrollToHashTarget(hash);
+			});
+		});
 		return;
 	}
 	if (intent.targetHoistedInHead) return;
-	document.documentElement.scrollTop = 0;
+	disableSmoothScrollDuringRouteTransition(() => {
+		document.documentElement.scrollTop = 0;
+	});
 }
 function scheduleAppRouterScrollFallback(intent) {
 	queueMicrotask(() => {

package/dist/shims/request-context.d.ts

@@ -44,6 +44,8 @@ export type ExecutionContextLike = {
   isInternalPagesRevalidation?: boolean;
   /** Marks a build-secret-authorized Worker request that may run prerender discovery hooks. */
   isPrerenderPathDiscovery?: boolean;
+  /** Marks an adapter-invoked regeneration of an entry stored for this build. */
+  isStoredEntryRegeneration?: boolean;
   /**
    * Installed only by the prerender server: records the page's special error
    * that escaped the shell, with the headers to store, for the build.

package/dist/shims/request-state-types.d.ts

@@ -3,7 +3,8 @@ import { NavigationContext } from "./navigation-context-state.js";
 import "./navigation.js";
 import { CacheLifeConfig, CacheState } from "./cache-request-state.js";
 import { RootParamsState } from "./root-params.js";
-import { FetchCacheState } from "./fetch-cache.js";
+import { FetchCacheState } from "./fetch-cache-state.js";
+import "./fetch-cache.js";
 import { HeadersAccessPhase, VinextHeadersShimState } from "./internal/headers-state.js";
 import { HeadersContext } from "./headers.js";
 import { RouterState, SSRContext } from "./router-state.js";

package/dist/shims/router.js

@@ -1,8 +1,9 @@
 import { isUnknownRecord } from "../utils/record.js";
 import { parseCookieHeader } from "../utils/parse-cookie.js";
 import { isExternalUrl } from "../utils/external-url.js";
-import { sortRoutes, splitPathSegments } from "../routing/utils.js";
 import { hasBasePath, removeTrailingSlash, stripBasePath } from "../utils/base-path.js";
+import { substituteDestinationParams } from "../config/destination-params.js";
+import { sortRoutes, splitPathSegments } from "../routing/utils.js";
 import { assertSafeNavigationUrl } from "./url-safety.js";
 import { addLocalePrefix, getDomainLocaleUrl, getLocalePathPrefix } from "../utils/domain-locale.js";
 import { AppRouterContext } from "./internal/app-router-context.js";
@@ -19,6 +20,7 @@ import { resolveDirectHybridClientRouteOwner } from "./internal/hybrid-client-ro
 import { installWindowNext } from "../client/window-next.js";
 import { getWindowOrigin, isAbsoluteOrProtocolRelativeUrl, isAbsoluteUrl, isHashOnlyBrowserUrlChange, normalizePathTrailingSlash, toBrowserNavigationHref, toSameOriginAppPath, toSameOriginPath, withBasePath } from "./url-utils.js";
 import { addQueryParam, mergeRewriteQuery, mergeRouteParamsIntoQuery, parseQueryString } from "../utils/query.js";
+import { disableSmoothScrollDuringRouteTransition } from "./disable-smooth-scroll.js";
 import { scrollToHashTarget } from "./hash-scroll.js";
 import { installPagesRouterRuntime, setPagesRouterPopStateHandler, setStampInitialHistoryState } from "./pages-router-runtime.js";
 import { interpolateDynamicRouteHref, resolveDynamicRouteHref } from "./internal/interpolate-as.js";
@@ -129,16 +131,9 @@ function scrollToPagesRouterPosition({ x, y }) {
 		window.scrollTo(x, y);
 		return;
 	}
-	const htmlElement = document.documentElement;
-	if (!(htmlElement.dataset.scrollBehavior === "smooth")) {
+	disableSmoothScrollDuringRouteTransition(() => {
 		window.scrollTo(x, y);
-		return;
-	}
-	const previousScrollBehavior = htmlElement.style.scrollBehavior;
-	htmlElement.style.scrollBehavior = "auto";
-	htmlElement.getClientRects();
-	window.scrollTo(x, y);
-	htmlElement.style.scrollBehavior = previousScrollBehavior;
+	});
 }
 function isAtScrollPosition({ x, y }) {
 	return Math.abs(window.scrollX - x) <= SCROLL_RESTORE_TOLERANCE_PX && Math.abs(window.scrollY - y) <= SCROLL_RESTORE_TOLERANCE_PX;
@@ -940,7 +935,6 @@ function isAppComponent(value) {
 function resolveSameOriginRedirectedUrl(responseUrl) {
 	const appPath = toSameOriginAppPath(responseUrl, __basePath);
 	if (appPath === null) return null;
-	if (appPath.startsWith("//")) return normalizePathTrailingSlash(responseUrl, __trailingSlash);
 	return normalizePathTrailingSlash(appPath, __trailingSlash);
 }
 function stripLocalePrefixForApiRedirect(appPath) {
@@ -962,19 +956,13 @@ function resolveLocalRedirectUrl(location) {
 	let appPath;
 	if (location.startsWith("/") && !location.startsWith("//")) try {
 		const parsed = new URL(location, "http://vinext.local");
-		appPath = stripBasePath(parsed.pathname, __basePath) + parsed.search + parsed.hash;
+		const pathname = stripBasePath(parsed.pathname, __basePath);
+		appPath = pathname.startsWith("//") ? toSameOriginAppPath(new URL(location, window.location.href).href, __basePath) : pathname + parsed.search + parsed.hash;
 	} catch {
 		appPath = location;
 	}
 	else appPath = toSameOriginAppPath(location, __basePath);
 	if (appPath === null) return null;
-	if (appPath.startsWith("//")) try {
-		const browserUrl = new URL(location, window.location.href);
-		if (browserUrl.origin !== getWindowOrigin()) return null;
-		return normalizePathTrailingSlash(browserUrl.href, __trailingSlash);
-	} catch {
-		return null;
-	}
 	return normalizePathTrailingSlash(stripLocalePrefixForApiRedirect(appPath), __trailingSlash);
 }
 function hasClientRewriteRules() {
@@ -1020,10 +1008,10 @@ async function resolveClientConfigRedirect(href) {
 	if (!redirects || redirects.length === 0) return null;
 	const routeContext = getClientConfigRouteContext(href);
 	if (!routeContext) return null;
-	const { matchRedirect, preserveRedirectDestinationQuery } = await import("../config/config-matchers.js");
-	const redirect = matchRedirect(routeContext.pathname, redirects, routeContext.context, routeContext.basePathState);
+	const [{ matchClientRedirect }, { preserveRedirectDestinationQuery }] = await Promise.all([import("../client/client-redirect-matcher.js"), import("../config/config-matchers.js")]);
+	const redirect = matchClientRedirect(routeContext.pathname, redirects, routeContext.context, routeContext.basePathState);
 	if (!redirect) return null;
-	return preserveRedirectDestinationQuery(__basePath && routeContext.basePathState.hadBasePath && !isExternalUrl(redirect.destination) && !hasBasePath(redirect.destination, __basePath) ? __basePath + redirect.destination : redirect.destination, routeContext.search);
+	return preserveRedirectDestinationQuery(__basePath && routeContext.basePathState.hadBasePath && !isExternalUrl(redirect.destination) && !hasBasePath(redirect.destination, __basePath) ? __basePath + redirect.destination : redirect.destination, routeContext.search, redirect.destinationQuery);
 }
 async function applyClientConfigRewrite(href, rewrite) {
 	const routeContext = getClientConfigRouteContext(href);
@@ -1076,12 +1064,6 @@ function simpleClientConfigSourceCouldMatch(pathname, source) {
 	const normalizedPathname = removeTrailingSlash(pathname);
 	return normalizedPathname === normalizedPrefix || normalizedPathname.startsWith(`${normalizedPrefix}/`);
 }
-function substituteSimpleClientConfigDestination(destination, params) {
-	const keys = Object.keys(params);
-	if (keys.length === 0) return destination;
-	const alternation = keys.sort((a, b) => b.length - a.length).map((key) => key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
-	return destination.replace(new RegExp(`:(${alternation})([+*])?(?![A-Za-z0-9_])`, "g"), (_token, key) => params[key] ?? _token);
-}
 function isExternalClientConfigUrl(url) {
 	return /^[a-z][a-z0-9+.-]*:/i.test(url) || url.startsWith("//");
 }
@@ -1111,7 +1093,7 @@ function resolveClientConfigRewriteSync(href) {
 		const params = matchSimpleClientConfigPattern(routeContext.pathname, rewrite.source);
 		if (params === void 0) return void 0;
 		if (params === null) continue;
-		const rewritten = substituteSimpleClientConfigDestination(rewrite.destination, params);
+		const rewritten = substituteDestinationParams(rewrite.destination, params, "rewrite");
 		if (isExternalClientConfigUrl(rewritten)) return { kind: "document" };
 		currentHref = mergeRewriteQuery(currentHref, rewritten);
 		matched = true;
@@ -1827,6 +1809,10 @@ async function performNavigation(url, as, options, mode, onStateUpdate, redirect
 	const absoluteHistoryUrl = sameOriginPath === null ? void 0 : origin && inputHref.startsWith(origin) ? inputHref.slice(origin.length) : sameOriginPath;
 	const currentRoute = window.__NEXT_DATA__?.page ?? stripBasePath(window.location.pathname, __basePath);
 	const currentAs = stripBasePath(window.location.pathname, __basePath) + window.location.search;
+	const resolveRelativeRoutePath = (href) => href === "" || /^[/?#]/.test(href) || isAbsoluteUrl(href) ? href : resolvePagesRouterHref(href, {
+		pathname: currentRoute,
+		asPath: currentAs
+	}, __basePath);
 	const preparedHistoryHref = (isAbsoluteUrl(inputHref) ? toSameOriginAppPath(inputHref, __basePath) : null) ?? absoluteHistoryUrl ?? resolvePagesRouterHref(inputHref, {
 		pathname: currentRoute,
 		asPath: currentAs
@@ -1836,12 +1822,12 @@ async function performNavigation(url, as, options, mode, onStateUpdate, redirect
 	const replaceInheritedLocale = options?.locale !== void 0 && (!as ? urlInheritsCurrentPath || typeof url !== "string" && inheritsVisiblePath(url) : typeof as !== "string" && inheritsVisiblePath(as));
 	const credentialedHistoryHref = credentialedSameOriginHref(url);
 	const credentialedDisplayHref = credentialedSameOriginHref(as) ?? (!as ? credentialedHistoryHref : void 0);
-	as = as ? resolveUrl(as, true) : void 0;
+	as = as ? resolveRelativeRoutePath(resolveUrl(as, true)) : void 0;
 	assertSafeNavigationUrl(resolveUrl(url));
 	if (as !== void 0) assertSafeNavigationUrl(as);
 	const isHydrationQueryUpdate = options?._h === 1;
 	const navigationLocale = resolveTransitionLocale(options?.locale);
-	const unlocalizedRouteHref = resolveUrl(isQueryOnlyString ? `${stripBasePath(window.location.pathname, __basePath)}${url}` : url);
+	const unlocalizedRouteHref = resolveRelativeRoutePath(resolveUrl(isQueryOnlyString ? `${stripBasePath(window.location.pathname, __basePath)}${url}` : url));
 	const localRouteHref = isExternalUrl(unlocalizedRouteHref) ? toSameOriginAppPath(unlocalizedRouteHref, __basePath) : unlocalizedRouteHref;
 	const implicitDynamicRoute = !isHydrationQueryUpdate && as === void 0 && localRouteHref !== null ? resolveDynamicRouteHref(localRouteHref) : null;
 	const routeForNavigation = implicitDynamicRoute?.as ?? unlocalizedRouteHref;
@@ -2018,7 +2004,10 @@ See more info: https://nextjs.org/docs/messages/invalid-relative-url-external-as
 		emitBeforeHistoryChange();
 		if (doScroll) {
 			if (hash) scrollToHashTarget(hash);
-			else window.scrollTo(0, 0);
+			else scrollToPagesRouterPosition({
+				x: 0,
+				y: 0
+			});
 		}
 	}
 	onStateUpdate?.();

package/dist/shims/server.d.ts

@@ -26,6 +26,7 @@ export type RequestInit = globalThis.RequestInit & {
       }>;
     } | null;
     trailingSlash?: boolean;
+    skipTrailingSlashRedirect?: boolean;
   };
   signal?: AbortSignal;
   duplex?: "half";
@@ -41,13 +42,20 @@ export declare class NextRequest extends Request {
   get page(): void;
   get ua(): void;
   /**
-   * Client IP address. Prefers Cloudflare's trusted CF-Connecting-IP header
-   * over the spoofable X-Forwarded-For. Returns undefined if unavailable.
+   * Client IP address. Next.js removed `ip` in v15; vinext keeps it as an
+   * extension. Returns undefined unless the value comes from a trusted source.
+   *
+   * On Cloudflare Workers (the request carries `cf` metadata), Cloudflare's
+   * edge sets `CF-Connecting-IP`. Elsewhere these headers are client-supplied
+   * and are only honored behind a trusted proxy (`VINEXT_TRUST_PROXY` /
+   * `VINEXT_TRUSTED_HOSTS`), matching the `X-Forwarded-*` policy.
    */
   get ip(): string | undefined;
   /**
-   * Geolocation data. Platform-dependent (e.g., Cloudflare, Vercel).
-   * Returns undefined if not available.
+   * Geolocation data. Next.js removed `geo` in v15; vinext keeps it as an
+   * extension. Read from Cloudflare's `request.cf` metadata on Workers, or
+   * from platform geo headers behind a trusted proxy. Returns undefined
+   * otherwise, because any client can send these headers.
    */
   get geo(): {
     city?: string;
@@ -109,6 +117,14 @@ export type NextURLConfig = {
      * honour the user's `trailingSlash` config.
      */
     trailingSlash?: boolean;
+    /**
+     * When true, the trailing slash follows the parsed URL instead, and
+     * `trailingSlash` only decides the root, like Next.js's
+     * getNextPathnameInfo. Without the trailing-slash redirect, requests
+     * arrive in either form, so the config can no longer be applied as a
+     * policy.
+     */
+    skipTrailingSlashRedirect?: boolean;
   };
 };
 export declare class NextURL {
@@ -121,6 +137,8 @@ export declare class NextURL {
    */
   private _configBasePath;
   private _basePath;
+  private _configTrailingSlash;
+  private _manualTrailingSlash;
   private _trailingSlash;
   private _locale;
   private _configDefaultLocale;
@@ -129,6 +147,11 @@ export declare class NextURL {
   private _domains;
   private _domainLocale;
   constructor(input: string | URL, base?: string | URL, config?: NextURLConfig);
+  /**
+   * With `skipTrailingSlashRedirect`, take the slash from the parsed pathname
+   * (before basePath and locale are stripped), as getNextPathnameInfo does.
+   */
+  private _analyzeTrailingSlash;
   /** Strip basePath prefix from the internal pathname.
    * Mirrors Next.js's getNextPathnameInfo (re-run by NextURL.analyze() on
    * every parse, including `href` reassignment): basePath is only considered

package/dist/shims/server.js

@@ -3,10 +3,11 @@ import { MIDDLEWARE_SET_COOKIE_HEADER } from "../utils/protocol-headers.js";
 import { encodeMiddlewareRequestHeaders } from "../utils/middleware-request-headers.js";
 import { parseEdgeRequestCookieHeader } from "../utils/parse-cookie.js";
 import { hasBasePath, removeTrailingSlash, stripBasePath } from "../utils/base-path.js";
-import { getRequestExecutionContext } from "./request-context.js";
 import { MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER } from "../server/headers.js";
+import { getRequestExecutionContext } from "./request-context.js";
 import { validateCookieAttributeValue, validateCookieName } from "./internal/cookie-serialize.js";
 import { assertSafeNavigationUrl } from "./url-safety.js";
+import { trustProxy } from "../server/proxy-trust.js";
 import { userAgent, userAgentFromString } from "./user-agent.js";
 //#region src/shims/server.ts
 /**
@@ -97,6 +98,19 @@ function initWithoutInputBody(input, init) {
 		body: null
 	};
 }
+/**
+* workerd's `request.cf` metadata. Only the Workers runtime sets it, so its
+* presence means the request came through Cloudflare's edge rather than
+* straight from a client.
+*/
+function readCloudflareMetadata(request) {
+	const cf = Reflect.get(request, "cf");
+	return cf !== null && typeof cf === "object" ? cf : void 0;
+}
+function readStringField(source, key) {
+	const value = Reflect.get(source, key);
+	return typeof value === "string" && value !== "" ? value : void 0;
+}
 var NextRequest = class extends Request {
 	_nextUrl;
 	_url;
@@ -131,7 +145,8 @@ var NextRequest = class extends Request {
 			basePath: _nextConfig.basePath,
 			nextConfig: {
 				i18n,
-				trailingSlash: _nextConfig.trailingSlash
+				trailingSlash: _nextConfig.trailingSlash,
+				skipTrailingSlashRedirect: _nextConfig.skipTrailingSlashRedirect
 			}
 		} : void 0;
 		this._nextUrl = new NextURL(url, void 0, urlConfig);
@@ -154,17 +169,39 @@ var NextRequest = class extends Request {
 		throw new Error("NextRequest.ua has been removed; use userAgent() instead");
 	}
 	/**
-	* Client IP address. Prefers Cloudflare's trusted CF-Connecting-IP header
-	* over the spoofable X-Forwarded-For. Returns undefined if unavailable.
+	* Client IP address. Next.js removed `ip` in v15; vinext keeps it as an
+	* extension. Returns undefined unless the value comes from a trusted source.
+	*
+	* On Cloudflare Workers (the request carries `cf` metadata), Cloudflare's
+	* edge sets `CF-Connecting-IP`. Elsewhere these headers are client-supplied
+	* and are only honored behind a trusted proxy (`VINEXT_TRUST_PROXY` /
+	* `VINEXT_TRUSTED_HOSTS`), matching the `X-Forwarded-*` policy.
 	*/
 	get ip() {
+		if (readCloudflareMetadata(this)) return this.headers.get("cf-connecting-ip") ?? void 0;
+		if (!trustProxy) return void 0;
 		return this.headers.get("cf-connecting-ip") ?? this.headers.get("x-real-ip") ?? this.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? void 0;
 	}
 	/**
-	* Geolocation data. Platform-dependent (e.g., Cloudflare, Vercel).
-	* Returns undefined if not available.
+	* Geolocation data. Next.js removed `geo` in v15; vinext keeps it as an
+	* extension. Read from Cloudflare's `request.cf` metadata on Workers, or
+	* from platform geo headers behind a trusted proxy. Returns undefined
+	* otherwise, because any client can send these headers.
 	*/
 	get geo() {
+		const cf = readCloudflareMetadata(this);
+		if (cf) {
+			const country = readStringField(cf, "country");
+			if (!country) return void 0;
+			return {
+				country,
+				city: readStringField(cf, "city"),
+				region: readStringField(cf, "region"),
+				latitude: readStringField(cf, "latitude"),
+				longitude: readStringField(cf, "longitude")
+			};
+		}
+		if (!trustProxy) return void 0;
 		const country = this.headers.get("cf-ipcountry") ?? this.headers.get("x-vercel-ip-country") ?? void 0;
 		if (!country) return void 0;
 		return {
@@ -266,6 +303,8 @@ var NextURL = class NextURL {
 	*/
 	_configBasePath;
 	_basePath;
+	_configTrailingSlash;
+	_manualTrailingSlash;
 	_trailingSlash;
 	_locale;
 	_configDefaultLocale;
@@ -277,7 +316,10 @@ var NextURL = class NextURL {
 		this._url = new URL(input.toString(), base);
 		this._configBasePath = config?.basePath ?? "";
 		this._basePath = this._configBasePath;
-		this._trailingSlash = config?.nextConfig?.trailingSlash ?? false;
+		this._configTrailingSlash = config?.nextConfig?.trailingSlash ?? false;
+		this._manualTrailingSlash = config?.nextConfig?.skipTrailingSlashRedirect === true;
+		this._trailingSlash = this._configTrailingSlash;
+		this._analyzeTrailingSlash();
 		this._stripBasePath();
 		const i18n = config?.nextConfig?.i18n;
 		if (i18n) {
@@ -290,6 +332,15 @@ var NextURL = class NextURL {
 			this._analyzeI18n();
 		}
 	}
+	/**
+	* With `skipTrailingSlashRedirect`, take the slash from the parsed pathname
+	* (before basePath and locale are stripped), as getNextPathnameInfo does.
+	*/
+	_analyzeTrailingSlash() {
+		if (!this._manualTrailingSlash) return;
+		const { pathname } = this._url;
+		this._trailingSlash = pathname !== "/" ? pathname.endsWith("/") : this._configTrailingSlash;
+	}
 	/** Strip basePath prefix from the internal pathname.
 	* Mirrors Next.js's getNextPathnameInfo (re-run by NextURL.analyze() on
 	* every parse, including `href` reassignment): basePath is only considered
@@ -348,7 +399,8 @@ var NextURL = class NextURL {
 	*/
 	_applyTrailingSlash(pathname) {
 		if (pathname === "" || pathname === "/") return pathname;
-		if ((this._basePath ? stripBasePath(pathname, this._basePath) : pathname).startsWith("/_next/")) return removeTrailingSlash(pathname);
+		const pathnameWithoutBasePath = this._basePath ? stripBasePath(pathname, this._basePath) : pathname;
+		if (!this._manualTrailingSlash && pathnameWithoutBasePath.startsWith("/_next/")) return removeTrailingSlash(pathname);
 		if (this._trailingSlash) return pathname.endsWith("/") ? pathname : pathname + "/";
 		return pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
 	}
@@ -361,6 +413,7 @@ var NextURL = class NextURL {
 	}
 	set href(value) {
 		this._url.href = value;
+		this._analyzeTrailingSlash();
 		this._stripBasePath();
 		this._analyzeI18n();
 	}
@@ -467,7 +520,10 @@ var NextURL = class NextURL {
 				locales: domain.locales ? [...domain.locales] : void 0
 			}))
 		};
-		if (this._trailingSlash) nextConfig.trailingSlash = true;
+		if (this._manualTrailingSlash) {
+			nextConfig.skipTrailingSlashRedirect = true;
+			if (this._configTrailingSlash) nextConfig.trailingSlash = true;
+		} else if (this._trailingSlash) nextConfig.trailingSlash = true;
 		const config = {
 			basePath: this._configBasePath,
 			nextConfig: Object.keys(nextConfig).length > 0 ? nextConfig : void 0

package/dist/shims/unified-request-context.d.ts

@@ -1,7 +1,7 @@
 import { ExecutionContextLike } from "./request-context.js";
 import { CacheState } from "./cache-request-state.js";
 import { RootParamsState } from "./root-params.js";
-import { FetchCacheState } from "./fetch-cache.js";
+import { FetchCacheState } from "./fetch-cache-state.js";
 import { VinextHeadersShimState } from "./internal/headers-state.js";
 import { RouterState } from "./router-state.js";
 import { markFullyBufferedBody, preserveFullyBufferedBodyMetadata } from "../server/fully-buffered-response.js";

package/dist/shims/url-utils.d.ts

@@ -2,6 +2,13 @@
 export declare function isAbsoluteUrl(url: string): boolean;
 export declare function isAbsoluteOrProtocolRelativeUrl(url: string): boolean;
 export declare function getWindowOrigin(): string | null;
+/**
+ * A same-origin pathname can start with "//" (e.g. `https://app.com//evil.com`),
+ * and as a local path that is a protocol-relative reference to another host.
+ * Collapse the leading slashes: Next.js does the same for these URLs, on the
+ * client (`resolveHref`) or with its server's repeated-slash 308.
+ */
+export declare function collapseLeadingSlashes(pathname: string): string;
 /**
  * If `url` is an absolute same-origin URL, return the local path
  * (pathname + search + hash). Returns null for truly external URLs
@@ -30,6 +37,8 @@ export declare function toSameOriginAppPath(url: string, basePath: string): stri
  *   `.well-known`-aware redirect rule shipped in `routes-manifest.json`.
  * - Query strings and hash fragments are preserved verbatim.
  * - Idempotent: already-canonical paths round-trip unchanged.
+ * - With `skipTrailingSlashRedirect`, every path is returned as written, like
+ *   Next.js's `__NEXT_MANUAL_TRAILING_SLASH` short-circuit.
  */
 export declare function normalizePathTrailingSlash(path: string, trailingSlash: boolean): string;
 /**

package/dist/shims/url-utils.js

@@ -25,6 +25,15 @@ function getWindowOrigin() {
 	}
 }
 /**
+* A same-origin pathname can start with "//" (e.g. `https://app.com//evil.com`),
+* and as a local path that is a protocol-relative reference to another host.
+* Collapse the leading slashes: Next.js does the same for these URLs, on the
+* client (`resolveHref`) or with its server's repeated-slash 308.
+*/
+function collapseLeadingSlashes(pathname) {
+	return pathname.replace(/^\/{2,}/, "/");
+}
+/**
 * If `url` is an absolute same-origin URL, return the local path
 * (pathname + search + hash). Returns null for truly external URLs
 * or on the server (where origin is unknown).
@@ -34,7 +43,7 @@ function toSameOriginPath(url) {
 	if (!origin) return null;
 	try {
 		const parsed = url.startsWith("//") ? new URL(url, origin) : new URL(url);
-		if (parsed.origin === origin) return parsed.pathname + parsed.search + parsed.hash;
+		if (parsed.origin === origin) return collapseLeadingSlashes(parsed.pathname) + parsed.search + parsed.hash;
 	} catch {}
 	return null;
 }
@@ -49,7 +58,7 @@ function toSameOriginAppPath(url, basePath) {
 	try {
 		const parsed = new URL(localPath, "http://vinext.local");
 		if (!hasBasePath(parsed.pathname, basePath)) return null;
-		return stripBasePath(parsed.pathname, basePath) + parsed.search + parsed.hash;
+		return collapseLeadingSlashes(stripBasePath(parsed.pathname, basePath)) + parsed.search + parsed.hash;
 	} catch {
 		return localPath;
 	}
@@ -99,9 +108,11 @@ function removeRouteTrailingSlash(route) {
 *   `.well-known`-aware redirect rule shipped in `routes-manifest.json`.
 * - Query strings and hash fragments are preserved verbatim.
 * - Idempotent: already-canonical paths round-trip unchanged.
+* - With `skipTrailingSlashRedirect`, every path is returned as written, like
+*   Next.js's `__NEXT_MANUAL_TRAILING_SLASH` short-circuit.
 */
 function normalizePathTrailingSlash(path, trailingSlash) {
-	if (!path.startsWith("/") || path.startsWith("//")) return path;
+	if (!path.startsWith("/") || path.startsWith("//") || process.env.__VINEXT_MANUAL_TRAILING_SLASH === "true") return path;
 	const { pathname, query, hash } = parsePath(path);
 	if (trailingSlash) {
 		if (/\.[^/]+\/?$/.test(pathname)) return `${removeRouteTrailingSlash(pathname)}${query}${hash}`;
@@ -162,4 +173,4 @@ function isHashOnlyBrowserUrlChange(href, currentHref, basePath = "") {
 	}
 }
 //#endregion
-export { getWindowOrigin, isAbsoluteOrProtocolRelativeUrl, isAbsoluteUrl, isHashOnlyBrowserUrlChange, normalizePathTrailingSlash, resolveRelativeHref, toBrowserNavigationHref, toCanonicalBrowserNavigationHref, toSameOriginAppPath, toSameOriginPath, withBasePath };
+export { collapseLeadingSlashes, getWindowOrigin, isAbsoluteOrProtocolRelativeUrl, isAbsoluteUrl, isHashOnlyBrowserUrlChange, normalizePathTrailingSlash, resolveRelativeHref, toBrowserNavigationHref, toCanonicalBrowserNavigationHref, toSameOriginAppPath, toSameOriginPath, withBasePath };

package/dist/utils/client-runtime-metadata.js

@@ -1,8 +1,8 @@
 import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { isAbsoluteAssetPrefix, resolveAssetsDir } from "./asset-prefix.js";
 import { manifestFileWithAssetPrefix, manifestFileWithBase } from "./manifest-paths.js";
-import { findClientEntryFile, findPagesClientEntryFile, readClientBuildManifest } from "./client-build-manifest.js";
 import { findClientEntryFileFromVinextManifest, findPagesClientEntryFileFromVinextManifest, readClientEntryManifest } from "./client-entry-manifest.js";
+import { findClientEntryFile, findPagesClientEntryFile, readClientBuildManifest } from "./client-build-manifest.js";
 import { computeDynamicImportPreloads, computeLazyChunks, dynamicImportPreloadsWithBase } from "./lazy-chunks.js";
 //#region src/utils/client-runtime-metadata.ts
 function collectCssGraph(buildManifest, applyBase) {