vinext 1.2.0 → 1.2.1

package/dist/server/config-headers.js

@@ -1,5 +1,5 @@
-import { matchHeaders } from "../config/config-matchers.js";
 import "./headers.js";
+import { matchHeaders } from "../config/config-matchers.js";
 import { markRouteCacheabilityConfigCdnCachePolicy, markRouteCacheabilityDynamic, markRouteCacheabilityFinalResponseUncacheable } from "../shims/cacheability-classification.js";
 import { isCdnResponsePolicyHeader, isNonCacheableCdnResponsePolicy } from "./cache-control.js";
 import { mergeVaryHeader } from "./middleware-response-headers.js";

package/dist/server/defer-until-stream-consumed.d.ts

@@ -1,6 +1,7 @@
 //#region src/server/defer-until-stream-consumed.d.ts
 /**
  * Defers cleanup until the downstream consumer drains or cancels the stream.
+ * `onCancel` runs before the cancellation reaches the source stream.
  */
-export declare function deferUntilStreamConsumed(stream: ReadableStream<Uint8Array>, onFlush: () => void, onError?: (error: unknown) => void): ReadableStream<Uint8Array>;
+export declare function deferUntilStreamConsumed(stream: ReadableStream<Uint8Array>, onFlush: () => void, onError?: (error: unknown) => void, onCancel?: (reason: unknown) => void): ReadableStream<Uint8Array>;
 //#endregion

package/dist/server/defer-until-stream-consumed.js

@@ -1,8 +1,9 @@
 //#region src/server/defer-until-stream-consumed.ts
 /**
 * Defers cleanup until the downstream consumer drains or cancels the stream.
+* `onCancel` runs before the cancellation reaches the source stream.
 */
-function deferUntilStreamConsumed(stream, onFlush, onError) {
+function deferUntilStreamConsumed(stream, onFlush, onError, onCancel) {
 	let called = false;
 	const once = () => {
 		if (!called) {
@@ -26,6 +27,7 @@ function deferUntilStreamConsumed(stream, onFlush, onError) {
 			});
 		},
 		cancel(reason) {
+			onCancel?.(reason);
 			once();
 			return reader.cancel(reason);
 		}

package/dist/server/dev-server.js

@@ -2,10 +2,10 @@ import { closeAfterResponse, createRequestContext, runWithRequestContext } from
 import { createValidFileMatcher, findFileWithExts } from "../routing/file-matcher.js";
 import { isBotUserAgent } from "../utils/html-limited-bots.js";
 import { PRERENDER_REVALIDATE_HEADER } from "../utils/protocol-headers.js";
+import { NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER } from "./headers.js";
 import { sanitizeDestination } from "../config/config-matchers.js";
 import { patternToNextFormat } from "../routing/route-validation.js";
 import { matchRoute } from "../routing/pages-router.js";
-import { NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER } from "./headers.js";
 import { isDangerousScheme } from "../shims/url-safety.js";
 import { extractLocaleFromUrl as extractLocaleFromUrl$1, resolvePagesI18nRequest } from "./pages-i18n.js";
 import { importModule, reportRequestError } from "./instrumentation.js";

package/dist/server/image-optimization.js

@@ -202,6 +202,7 @@ function parseImageParams(url, allowedWidths = [...DEFAULT_DEVICE_SIZES, ...DEFA
 		const base = "https://localhost";
 		const resolved = new URL(normalizedUrl, base);
 		if (resolved.origin !== base) return null;
+		if (resolved.pathname.startsWith("//")) return null;
 		if (RECURSIVE_IMAGE_URL_RE.test(decodeURIComponent(resolved.pathname))) return null;
 	} catch {
 		return null;

package/dist/server/metadata-route-response.js

@@ -1,10 +1,10 @@
 import { markFullyBufferedBody } from "./fully-buffered-response.js";
 import { closeAfterResponse, createRequestContext, runWithRequestContext } from "../shims/unified-request-context.js";
+import { VINEXT_METADATA_ROUTE_CACHE_HEADER } from "./headers.js";
+import { notFoundResponse } from "./http-error-responses.js";
 import { decodeMatchedParams } from "../routing/utils.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
-import { VINEXT_METADATA_ROUTE_CACHE_HEADER } from "./headers.js";
 import { runInWorkStoreScope } from "../shims/internal/work-store-scope.js";
-import { notFoundResponse } from "./http-error-responses.js";
 import { beginRouteCacheability, markRouteCacheabilityExplicitResponsePolicy, markRouteCacheabilityResponseBodyComplete, recordRouteCacheability } from "../shims/cacheability-classification.js";
 import { NEVER_CACHE_CONTROL, applyCdnResponseHeaders, hasCdnResponsePolicy } from "./cache-control.js";
 import { buildAppRouteMissIsrCacheControl } from "./isr-decision.js";

package/dist/server/middleware-path-to-regexp.js

@@ -224,7 +224,7 @@ function middlewarePathTokensToRegExp(tokens) {
 		} else route += `(?:${prefix}${suffix})${token.modifier}`;
 	}
 	route += `${delimiterRegex}?$`;
-	return new RegExp(route, "i");
+	return new RegExp(route);
 }
 //#endregion
 export { middlewarePathTokensToRegExp, normalizeMiddlewarePathTokens, parseMiddlewarePath };

package/dist/server/middleware-runtime.js

@@ -2,18 +2,18 @@ import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import "../utils/protocol-headers.js";
 import { shouldKeepMiddlewareHeader } from "../utils/middleware-request-headers.js";
 import { normalizeHost } from "../config/request-context.js";
-import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { addBasePathToPathname, hasBasePath, removeTrailingSlash, stripBasePath } from "../utils/base-path.js";
+import { MIDDLEWARE_REWRITE_HEADER } from "./headers.js";
+import { badRequestResponse, internalServerErrorResponse } from "./http-error-responses.js";
+import { isOpenRedirectShaped } from "./open-redirect.js";
+import { processMiddlewareHeaders } from "./request-pipeline.js";
+import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { getRequestExecutionContext, runWithExecutionContext } from "../shims/request-context.js";
 import "./server-globals.js";
-import { MIDDLEWARE_REWRITE_HEADER } from "./headers.js";
 import { NextFetchEvent, NextRequest } from "../shims/server.js";
 import { runInWorkStoreScope } from "../shims/internal/work-store-scope.js";
 import { normalizePath } from "./normalize-path.js";
 import { matchesMiddleware, matchesMiddlewarePathname } from "./middleware-matcher.js";
-import { badRequestResponse, internalServerErrorResponse } from "./http-error-responses.js";
-import { isOpenRedirectShaped } from "./open-redirect.js";
-import { processMiddlewareHeaders } from "./request-pipeline.js";
 import { normalizeDefaultLocalePathname } from "./pages-i18n.js";
 import { nextDataMiddlewareMatchPathname } from "./pages-data-route.js";
 import { reportRequestError } from "./instrumentation.js";

package/dist/server/navigation-planner.js

@@ -1,5 +1,5 @@
-import { splitPathnameForRouteMatch } from "../routing/utils.js";
 import { stripBasePath } from "../utils/base-path.js";
+import { splitPathnameForRouteMatch } from "../routing/utils.js";
 import { matchRoutePattern, matchRoutePatternPrefix, matchRoutePatternWithOptionalDynamicSegments } from "../routing/route-pattern.js";
 import { AppElementsWire, compareAppElementsSlotIds } from "./app-elements-wire.js";
 import "./app-elements.js";

package/dist/server/open-redirect.d.ts

@@ -11,7 +11,7 @@ export declare function isOpenRedirectShaped(rawPathname: string): boolean;
 /**
  * What a request entry answers for a raw path containing a backslash or a
  * repeated slash: Next.js's 308, or a 404 when the collapsed path would still
- * be open-redirect shaped.
+ * be open-redirect shaped or the raw target is not origin-form.
  */
 export type RepeatedSlashRedirect = {
   status: 308;
@@ -33,17 +33,24 @@ export type RepeatedSlashRedirect = {
  * `//evil.com` → `/evil.com`. Percent-encoded `%2F`/`%5C` are not touched and
  * keep falling through to `isOpenRedirectShaped` (404), as in Next.js.
  *
- * The Location is always same-origin. Absolute-form request targets
- * (`GET http://host//x`) are left alone. A collapsed path that still starts
+ * The Location is always same-origin. A collapsed path that still starts
  * with an encoded slash or backslash (`//%2Fevil.com`, `/.//%2Fevil.com`) is
  * never echoed into a Location or routed: it gets a 404 instead.
  *
+ * A raw Node request target that is not origin-form (`GET http://evil.example/x`,
+ * which Node's parser accepts, or `OPTIONS *`) also gets a 404. Next.js never
+ * routes these either: it 308s absolute-form targets to their own URL (the
+ * `//` after the scheme trips the same check) and 500s `OPTIONS *`. Routing
+ * them would let the request line choose the origin of `request.url` that
+ * middleware and handlers see, bypassing the Host trust policy. Request-based
+ * entries always pass a pathname.
+ *
  * @param rawUrl - The raw request target: pathname plus optional `?query`
  */
 export declare function getRepeatedSlashRedirect(rawUrl: string): RepeatedSlashRedirect | null;
 /**
  * Build the Response for a raw request path containing a backslash or a
- * repeated slash. See `getRepeatedSlashRedirect`.
+ * repeated slash, or a non-origin-form target. See `getRepeatedSlashRedirect`.
  */
 export declare function repeatedSlashRedirectResponse(rawUrl: string): Response | null;
 /**

package/dist/server/open-redirect.js

@@ -34,15 +34,22 @@ const REDIRECT_LOCATION_BASE = "http://vinext.invalid";
 * `//evil.com` → `/evil.com`. Percent-encoded `%2F`/`%5C` are not touched and
 * keep falling through to `isOpenRedirectShaped` (404), as in Next.js.
 *
-* The Location is always same-origin. Absolute-form request targets
-* (`GET http://host//x`) are left alone. A collapsed path that still starts
+* The Location is always same-origin. A collapsed path that still starts
 * with an encoded slash or backslash (`//%2Fevil.com`, `/.//%2Fevil.com`) is
 * never echoed into a Location or routed: it gets a 404 instead.
 *
+* A raw Node request target that is not origin-form (`GET http://evil.example/x`,
+* which Node's parser accepts, or `OPTIONS *`) also gets a 404. Next.js never
+* routes these either: it 308s absolute-form targets to their own URL (the
+* `//` after the scheme trips the same check) and 500s `OPTIONS *`. Routing
+* them would let the request line choose the origin of `request.url` that
+* middleware and handlers see, bypassing the Host trust policy. Request-based
+* entries always pass a pathname.
+*
 * @param rawUrl - The raw request target: pathname plus optional `?query`
 */
 function getRepeatedSlashRedirect(rawUrl) {
-	if (!rawUrl.startsWith("/")) return null;
+	if (!rawUrl.startsWith("/")) return { status: 404 };
 	const urlParts = rawUrl.split("?");
 	const pathname = urlParts[0];
 	if (!REPEATED_SLASH_OR_BACKSLASH_RE.test(pathname)) return null;
@@ -62,7 +69,7 @@ function repeatedSlashRedirectHeaders(location) {
 }
 /**
 * Build the Response for a raw request path containing a backslash or a
-* repeated slash. See `getRepeatedSlashRedirect`.
+* repeated slash, or a non-origin-form target. See `getRepeatedSlashRedirect`.
 */
 function repeatedSlashRedirectResponse(rawUrl) {
 	const redirect = getRepeatedSlashRedirect(rawUrl);

package/dist/server/pages-api-route.js

@@ -1,8 +1,8 @@
+import { internalServerErrorResponse } from "./http-error-responses.js";
+import { cloneRequestWithUrl } from "./request-pipeline.js";
 import { getRequestExecutionContext, runWithExecutionContext } from "../shims/request-context.js";
 import "./server-globals.js";
 import { NextRequest } from "../shims/server.js";
-import { internalServerErrorResponse } from "./http-error-responses.js";
-import { cloneRequestWithUrl } from "./request-pipeline.js";
 import { markRouteCacheabilityExplicitResponsePolicy } from "../shims/cacheability-classification.js";
 import { hasCdnResponsePolicy } from "./cache-control.js";
 import { mergeRouteParamsIntoQuery, parseQueryString, urlQueryToSearchParams } from "../utils/query.js";

package/dist/server/pages-data-route.js

@@ -1,6 +1,7 @@
 import { MIDDLEWARE_SKIP_HEADER } from "../utils/protocol-headers.js";
 import { addBasePathToPathname, hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { NEXTJS_DEPLOYMENT_ID_HEADER } from "./headers.js";
+import { cloneRequestWithUrl } from "./request-pipeline.js";
 //#region src/server/pages-data-route.ts
 /**
 * Helpers for the Pages Router `/_next/data/{buildId}/{...page}.json` endpoint.
@@ -191,7 +192,7 @@ function normalizePagesDataRequest(request, buildId, basePath = "", trailingSlas
 	normalizedUrl.pathname = hadBasePath ? addBasePathToPathname(pagePathname, basePath) : pagePathname;
 	return {
 		isDataReq: true,
-		request: new Request(normalizedUrl, request),
+		request: cloneRequestWithUrl(request, normalizedUrl.href),
 		normalizedPathname: pagePathname,
 		search: reqUrl.search,
 		notFoundResponse: null

package/dist/server/pages-page-data.js

@@ -1,7 +1,7 @@
 import { isUnknownRecord } from "../utils/record.js";
 import { isBotUserAgent } from "../utils/html-limited-bots.js";
-import { normalizePathnameForRouteMatch } from "../routing/utils.js";
 import { NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER } from "./headers.js";
+import { normalizePathnameForRouteMatch } from "../routing/utils.js";
 import { isDangerousScheme } from "../shims/url-safety.js";
 import { extractLocaleFromUrl } from "./pages-i18n.js";
 import { buildNextDataPropsJsonResponse } from "./pages-data-route.js";

package/dist/server/pages-page-handler.js

@@ -1,10 +1,10 @@
 import { preserveFullyBufferedBodyMetadata } from "./fully-buffered-response.js";
 import { closeAfterResponse, closeAfterResponseWithBody, createRequestContext, runWithRequestContext } from "../shims/unified-request-context.js";
 import { PRERENDER_REVALIDATE_HEADER } from "../utils/protocol-headers.js";
+import { NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, VINEXT_CACHE_HEADER, VINEXT_REVALIDATED_CACHE_TAG_HEADER } from "./headers.js";
 import { normalizePathnameForRouteMatch } from "../routing/utils.js";
 import { patternToNextFormat } from "../routing/route-validation.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
-import { NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, VINEXT_CACHE_HEADER, VINEXT_REVALIDATED_CACHE_TAG_HEADER } from "./headers.js";
 import { extractLocaleFromUrl, resolvePagesI18nRequest } from "./pages-i18n.js";
 import { buildNextDataNotFoundResponse, buildNextDataPropsJsonResponse, normalizePagesDataRequest, parseNextDataPathname } from "./pages-data-route.js";
 import { reportRequestError } from "./instrumentation.js";

package/dist/server/pages-page-response.js

@@ -1,6 +1,6 @@
 import { isBotUserAgent } from "../utils/html-limited-bots.js";
-import { getRequestExecutionContext } from "../shims/request-context.js";
 import { NEXTJS_CACHE_HEADER, VINEXT_REVALIDATED_CACHE_TAG_HEADER } from "./headers.js";
+import { getRequestExecutionContext } from "../shims/request-context.js";
 import { reportRequestError } from "./instrumentation.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { markRouteCacheabilityExplicitResponsePolicy } from "../shims/cacheability-classification.js";

package/dist/server/pages-request-pipeline.js

@@ -1,14 +1,14 @@
 import { PRERENDER_REVALIDATE_HEADER } from "../utils/protocol-headers.js";
 import { requestContextFromRequest } from "../config/request-context.js";
 import { isExternalUrl } from "../utils/external-url.js";
-import { applyMiddlewareRequestHeaders, matchRedirect, matchRewrite, preserveRedirectDestinationQuery, proxyExternalRequest, sanitizeDestination } from "../config/config-matchers.js";
-import { assetPrefixPathname, isNextStaticPath } from "../utils/asset-prefix.js";
-import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { addBasePathToPathname, hasBasePath } from "../utils/base-path.js";
-import { patternToNextFormat } from "../routing/route-validation.js";
 import { VINEXT_PRERENDER_REWRITTEN_HEADER } from "./headers.js";
 import { methodNotAllowedResponse, notFoundStaticAssetResponse, sanitizeMethodNotAllowedHeaders } from "./http-error-responses.js";
 import { cloneRequestWithUrl, normalizeTrailingSlash } from "./request-pipeline.js";
+import { applyMiddlewareRequestHeaders, matchRedirect, matchRewrite, preserveRedirectDestinationQuery, proxyExternalRequest, sanitizeDestination } from "../config/config-matchers.js";
+import { assetPrefixPathname, isNextStaticPath } from "../utils/asset-prefix.js";
+import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
+import { patternToNextFormat } from "../routing/route-validation.js";
 import { detectPathnameLocale, normalizeDefaultLocalePathname, stripI18nLocaleForApiRoute } from "./pages-i18n.js";
 import { buildMiddlewarePrefetchSkipResponse } from "./pages-data-route.js";
 import { markRouteCacheabilityDynamic } from "../shims/cacheability-classification.js";
@@ -79,7 +79,7 @@ function wrapMiddlewareWithBasePath(runMiddleware, basePath, hadBasePath) {
 	return (request, ctx, opts) => {
 		const mwUrl = new URL(request.url);
 		mwUrl.pathname = addBasePathToPathname(mwUrl.pathname, basePath);
-		return runMiddleware(new Request(mwUrl, request), ctx, opts);
+		return runMiddleware(cloneRequestWithUrl(request, mwUrl.toString()), ctx, opts);
 	};
 }
 /**

package/dist/server/pages-request-stage-entry.js

@@ -1,12 +1,12 @@
 import { VINEXT_PRERENDER_SECRET_HEADER, VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
 import { requestContextFromRequest } from "../config/request-context.js";
-import { assetPrefixPathname, isNextStaticPath } from "../utils/asset-prefix.js";
-import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
-import { runWithExecutionContext } from "../shims/request-context.js";
 import { VINEXT_CACHEABILITY_PROBE_QUERY_PARAM, VINEXT_EXPECTED_WORKER_VERSION_HEADER } from "./headers.js";
 import { notFoundStaticAssetResponse } from "./http-error-responses.js";
 import { attachRequestCfMetadata, cloneRequestWithHeaders, cloneRequestWithUrl, filterInternalHeaders, guardProtocolRelativeUrl } from "./request-pipeline.js";
+import { assetPrefixPathname, isNextStaticPath } from "../utils/asset-prefix.js";
+import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
+import { runWithExecutionContext } from "../shims/request-context.js";
 import { normalizeDefaultLocalePathname } from "./pages-i18n.js";
 import { isNextDataPathname } from "./pages-data-route.js";
 import { getExplicitCdnCacheAdapter } from "../shims/cdn-cache-state.js";
@@ -128,7 +128,7 @@ async function handleRequestImpl(request, env, platformCtx, dispatchResponseStag
 				probeRoute = readWorkerCacheabilityProbeRoute(request);
 				const probeUrl = new URL(request.url);
 				probeUrl.searchParams.delete(VINEXT_CACHEABILITY_PROBE_QUERY_PARAM);
-				request = new Request(probeUrl, request);
+				request = cloneRequestWithUrl(request, probeUrl.href);
 			}
 		}
 		let responseStageDispatched = false;

package/dist/server/pages-revalidate.js

@@ -1,11 +1,11 @@
 import { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
-import { getRequestExecutionContext } from "../shims/request-context.js";
 import { VINEXT_REVALIDATED_CACHE_TAG_HEADER } from "./headers.js";
+import { getRequestExecutionContext } from "../shims/request-context.js";
+import { resolveRequestHost, resolveRequestProtocol } from "./proxy-trust.js";
 import { normalizeDomainHostname } from "../utils/domain-locale.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { getRevalidateSecret, isOnDemandRevalidateRequest } from "./revalidation-request.js";
 import "./isr-cache.js";
-import { resolveRequestHost, resolveRequestProtocol } from "./proxy-trust.js";
 //#region src/server/pages-revalidate.ts
 async function performOnDemandRevalidate(source, urlPath, opts = {}, trustedOrigin, allowedRevalidateHeaderKeys = [], dev = false) {
 	if (typeof urlPath !== "string" || !urlPath.startsWith("/")) throw new Error(`Invalid urlPath provided to revalidate(), must be a path e.g. /blog/post-1, received ${urlPath}`);

package/dist/server/pages-router-entry.js

@@ -1,6 +1,6 @@
-import { runWithExecutionContext } from "../shims/request-context.js";
 import { VINEXT_CACHEABILITY_PROBE_HEADER, VINEXT_CACHEABILITY_PROBE_QUERY_PARAM } from "./headers.js";
 import { cloneRequestWithHeaders, cloneRequestWithUrl } from "./request-pipeline.js";
+import { runWithExecutionContext } from "../shims/request-context.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { validateCdnRequest } from "./cache-control.js";
 import { createWorkerRevalidationContext } from "./worker-revalidation-context.js";

package/dist/server/prod-server.js

@@ -1,22 +1,22 @@
 import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { isUnknownRecord } from "../utils/record.js";
 import { VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER } from "../utils/protocol-headers.js";
-import { ASSET_PREFIX_URL_DIR, assetPrefixPathname, isAbsoluteAssetPrefix } from "../utils/asset-prefix.js";
-import { StaticFileCache, contentTypeForPath, etagFromFilenameHash } from "./static-file-cache.js";
-import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { VINEXT_PRERENDER_RENDER_ERROR_HEADER, VINEXT_PRERENDER_SPECIAL_ERROR_HEADER } from "./headers.js";
-import { normalizePath } from "./normalize-path.js";
 import { notFoundResponse } from "./http-error-responses.js";
 import { getRepeatedSlashRedirect, isOpenRedirectShaped, sendRepeatedSlashRedirect } from "./open-redirect.js";
 import { readStaticFileSignal } from "./static-file-signal.js";
 import { canonicalizeRequestPathname, filterInternalHeaders } from "./request-pipeline.js";
+import { ASSET_PREFIX_URL_DIR, assetPrefixPathname, isAbsoluteAssetPrefix } from "../utils/asset-prefix.js";
+import { StaticFileCache, contentTypeForPath, etagFromFilenameHash } from "./static-file-cache.js";
+import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
+import { resolveRequestHost, resolveRequestProtocol, trustProxy, trustedHosts } from "./proxy-trust.js";
+import { normalizePath } from "./normalize-path.js";
 import { buildNextDataNotFoundResponse, encodeUrlParserIgnoredCharacters, isNextDataPathname, normalizeNextDataPagePathname, parseNextDataPathname, shouldAddTrailingSlashToPagesDataPath, urlParserCreatesPagesDataPath } from "./pages-data-route.js";
 import { buildCacheStateHeaders } from "./cache-headers.js";
 import { parseHttpDate } from "./http-date.js";
 import { evaluateStaticPreconditions } from "./http-conditional.js";
 import { setPagesClientAssets } from "./pages-client-assets.js";
-import { resolveRequestHost, resolveRequestProtocol, trustProxy, trustedHosts } from "./proxy-trust.js";
 import { signalFromNodeResponse } from "./node-response-signal.js";
 import { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, IMAGE_RESPONSE_CACHE_STATE, INVALID_IMAGE_SOURCE_MESSAGE, isImageOptimizationPath, isImageSourceBodyStatus, isSafeImageContentType, parseImageParams, readImageOptimizationSignal } from "./image-optimization.js";
 import { installSocketErrorBackstop } from "./socket-error-backstop.js";

package/dist/server/rsc-stream-hints.d.ts

@@ -11,7 +11,7 @@
  * tag is `HL` are decoded and inspected. Length-prefixed bodies remain separate
  * so binary bytes do not force adjacent text through the embed's base64 path.
  */
-export declare function normalizeReactFlightPreloadHints(stream: ReadableStream<Uint8Array>): ReadableStream<Uint8Array>;
+export declare function normalizeReactFlightPreloadHints(stream: ReadableStream<Uint8Array>, onCancel?: (reason: unknown) => void): ReadableStream<Uint8Array>;
 export type RscRawRenderer = (model: unknown, options?: unknown) => ReadableStream<Uint8Array>;
 export type RscRawPrerenderer = (model: unknown, options?: unknown) => Promise<{
   prelude: ReadableStream<Uint8Array>;

package/dist/server/rsc-stream-hints.js

@@ -1,3 +1,4 @@
+import { createRenderStreamCancellation } from "./app-render-abort-error.js";
 //#region src/server/rsc-stream-hints.ts
 const REACT_FLIGHT_STYLESHEET_PRELOAD_HINT = /^([0-9a-f]*:HL\[.*?),"stylesheet"(\]|,)/;
 const STYLESHEET_TO_STYLE_JSON_PADDING = " ".repeat(5);
@@ -106,7 +107,7 @@ function isTagInTable(table, byte) {
 * tag is `HL` are decoded and inspected. Length-prefixed bodies remain separate
 * so binary bytes do not force adjacent text through the embed's base64 path.
 */
-function normalizeReactFlightPreloadHints(stream) {
+function normalizeReactFlightPreloadHints(stream, onCancel) {
 	let carry = null;
 	let rawBytesRemaining = 0;
 	let passThrough = false;
@@ -194,11 +195,28 @@ function normalizeReactFlightPreloadHints(stream) {
 		},
 		flush(controller) {
 			if (carry !== null && carry.byteLength > 0) controller.enqueue(rawBytesRemaining > 0 ? carry : normalizeReactFlightHintLine(carry));
-		}
+		},
+		cancel: onCancel
 	}));
 }
 function createRscRenderer(render) {
-	return (model, options) => normalizeReactFlightPreloadHints(render(model, options));
+	return (model, options) => {
+		const cancellation = createRenderStreamCancellation();
+		return normalizeReactFlightPreloadHints(render(model, ignoreCancellationErrors(options, cancellation)), cancellation.record);
+	};
+}
+/** A consumer cancelling the payload is not a render failure. */
+function ignoreCancellationErrors(options, cancellation) {
+	if (!options || typeof options !== "object") return options;
+	const onError = Reflect.get(options, "onError");
+	if (typeof onError !== "function") return options;
+	return {
+		...options,
+		onError(error, ...rest) {
+			if (cancellation.isReason(error)) return void 0;
+			return Reflect.apply(onError, options, [error, ...rest]);
+		}
+	};
 }
 function createRscPrerenderer(prerender) {
 	return async (model, options) => {

package/dist/server/worker-image-optimization.js

@@ -1,9 +1,7 @@
-import { isNextStaticPath } from "../utils/asset-prefix.js";
-import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { VINEXT_PRERENDER_SPECIAL_ERROR_HEADER } from "./headers.js";
-import { normalizePath } from "./normalize-path.js";
 import { readStaticFileSignal, readStaticFileSignalRequestHeaders } from "./static-file-signal.js";
 import { attachRequestCfMetadata, cloneRequestWithUrl } from "./request-pipeline.js";
+import { isNextStaticPath } from "../utils/asset-prefix.js";
 import { handleConfiguredImageOptimization, invalidImageSourceResponse, isImageSourceBodyStatus } from "./image-optimization.js";
 import { createStaticAssetRequest, mergeHeaders } from "./worker-utils.js";
 import { resolveClientBuildFile } from "./client-build-files.js";
@@ -28,19 +26,34 @@ function cancelResponseBody(response) {
 	body.cancel().catch(() => {});
 }
 /**
+* Return the pathname of the `_next/static` file a source's decoded pathname
+* names, or null. Next.js matches the decoded pathname against its
+* `.next/static` files literally, so a `.`, `..` or empty segment names no
+* file. The asset binding decodes each segment once, so each segment is
+* encoded once from the name checked here. Parsing the decoded pathname as a
+* URL again would resolve a segment that decoded to `%2E%2E` as `..`, outside
+* `_next/static`.
+*/
+function resolveNextStaticFile(decodedPathname, options) {
+	if (!isNextStaticPath(decodedPathname, options.basePath, options.assetPathPrefix)) return null;
+	const segments = decodedPathname.split("/").slice(1);
+	if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) return null;
+	return "/" + segments.map(encodeURIComponent).join("/");
+}
+/**
 * Fetch a local image source. Build output is fetched from the asset binding,
 * which serves it before the Worker and its middleware. Any other source is
 * served only when the application pipeline selects a public file for it.
 */
 async function fetchWorkerImageSource(imageUrl, request, options) {
 	const sourceUrl = new URL(imageUrl, request.url);
-	let sourcePathname;
+	let decodedPathname;
 	try {
-		sourcePathname = normalizePath(normalizePathnameForRouteMatchStrict(sourceUrl.pathname));
+		decodedPathname = decodeURIComponent(sourceUrl.pathname);
 	} catch {
 		return invalidImageSourceResponse();
 	}
-	const buildAssetPath = isNextStaticPath(sourcePathname, options.basePath, options.assetPathPrefix) ? sourcePathname : resolveClientBuildFile(sourceUrl.pathname, options.basePath, options.clientBuildFiles);
+	const buildAssetPath = resolveNextStaticFile(decodedPathname, options) ?? resolveClientBuildFile(sourceUrl.pathname, options.basePath, options.clientBuildFiles);
 	if (buildAssetPath !== null) return options.assets.fetch(new Request(new URL(buildAssetPath, request.url)));
 	const sourceResponse = await options.fetchPublicFile(attachRequestCfMetadata(new Request(sourceUrl, { signal: request.signal }), request));
 	if (sourceResponse && isImageSourceBodyStatus(sourceResponse.status)) return sourceResponse;

package/dist/shims/head.js

@@ -183,7 +183,7 @@ function reduceHeadChildren(headChildren) {
 const SAFE_ATTR_NAME_RE = /^[a-zA-Z][a-zA-Z0-9\-:.]*$/;
 function isSafeAttrName(name) {
 	if (!SAFE_ATTR_NAME_RE.test(name)) return false;
-	if (name.length > 2 && name[0] === "o" && name[1] === "n" && name[2] >= "A" && name[2] <= "z") return false;
+	if (name.length > 2 && (name[0] === "o" || name[0] === "O") && (name[1] === "n" || name[1] === "N")) return false;
 	return true;
 }
 /**

package/dist/shims/headers.js

@@ -749,8 +749,8 @@ async function draftMode() {
 		}
 	};
 }
-const APPLY_RESPONSE_COOKIE = Symbol("vinext.apply-response-cookie");
-const SYNCHRONIZE_REQUEST_COOKIES = Symbol("vinext.synchronize-request-cookies");
+const APPLY_RESPONSE_COOKIE = Symbol.for("vinext.apply-response-cookie");
+const SYNCHRONIZE_REQUEST_COOKIES = Symbol.for("vinext.synchronize-request-cookies");
 var RequestCookies = class {
 	_cookies;
 	_responseCookies;

package/dist/shims/internal/hybrid-client-route-owner-direct.js

@@ -1,5 +1,5 @@
-import { compareHybridRoutePatterns } from "../../routing/utils.js";
 import { stripBasePath } from "../../utils/base-path.js";
+import { compareHybridRoutePatterns } from "../../routing/utils.js";
 import { createRouteTrieCache, matchRouteWithTrie } from "../../routing/route-matching.js";
 import { getLocalePathPrefix } from "../../utils/domain-locale.js";
 //#region src/shims/internal/hybrid-client-route-owner-direct.ts

package/dist/shims/internal/hybrid-client-route-owner.js

@@ -1,4 +1,5 @@
 import { parseCookies } from "../../config/request-context.js";
+import "../../config/config-matchers.js";
 import { matchDirectHybridClientRoutes, resolveMatchedHybridClientRouteOwner, resolveSameOriginAppPathname } from "./hybrid-client-route-owner-direct.js";
 import { mergeRewriteQuery } from "../../utils/query.js";
 import { matchClientRewrite } from "../../client/client-rewrite-matcher.js";

package/dist/shims/link-prefetch.js

@@ -1,5 +1,5 @@
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
-import { isAbsoluteOrProtocolRelativeUrl } from "./url-utils.js";
+import { collapseLeadingSlashes, isAbsoluteOrProtocolRelativeUrl } from "./url-utils.js";
 //#region src/shims/link-prefetch.ts
 function canLinkPrefetch(input) {
 	return input.nodeEnv === "production" && input.prefetch !== false && !input.isDangerous;
@@ -32,9 +32,10 @@ function getLinkPrefetchHref(input) {
 		const current = new URL(currentOrigin);
 		const parsed = href.startsWith("//") ? new URL(href, current.origin) : new URL(href);
 		if (parsed.origin !== current.origin) return null;
-		if (!basePath) return parsed.pathname + parsed.search + parsed.hash;
-		if (!hasBasePath(parsed.pathname, basePath)) return null;
-		return stripBasePath(parsed.pathname, basePath) + parsed.search + parsed.hash;
+		const pathname = collapseLeadingSlashes(parsed.pathname);
+		if (!basePath) return pathname + parsed.search + parsed.hash;
+		if (!hasBasePath(pathname, basePath)) return null;
+		return collapseLeadingSlashes(stripBasePath(pathname, basePath)) + parsed.search + parsed.hash;
 	} catch {
 		return null;
 	}

package/dist/shims/link.js

@@ -317,7 +317,7 @@ function prefetchUrl(href, mode, priority = "low", pagesRouteHref, locale) {
 async function promotePrefetchEntriesForNavigation(href) {
 	if (typeof window === "undefined") return;
 	if (!hasAppNavigationRuntime()) return;
-	const [{ getPrefetchCache }, { stripRscCacheBustingSearchParam, stripRscSuffix }] = await Promise.all([loadNavigationModule(), import("../server/app-rsc-cache-busting.js")]);
+	const [{ getPrefetchCache }, { parseRscRequestPath, stripRscCacheBustingSearchParam, stripRscSuffix }] = await Promise.all([loadNavigationModule(), import("../server/app-rsc-cache-busting.js")]);
 	let target;
 	try {
 		target = new URL(toCanonicalBrowserNavigationHref(href, window.location.href, __basePath, __trailingSlash), window.location.href);
@@ -330,7 +330,7 @@ async function promotePrefetchEntriesForNavigation(href) {
 		const [rscUrl] = cacheKey.split("\0", 1);
 		let cached;
 		try {
-			cached = new URL(rscUrl, window.location.href);
+			cached = parseRscRequestPath(rscUrl);
 		} catch {
 			continue;
 		}

package/dist/shims/navigation.js

@@ -17,7 +17,7 @@ import { GLOBAL_ACCESSORS_KEY, ServerInsertedHTMLContext, _registerStateAccessor
 import { BailoutToCSRError, DynamicServerError, HTTP_ERROR_FALLBACK_ERROR_CODE, RedirectType, decodeRedirectError, forbidden, getAccessFallbackHTTPStatus, isBailoutToCSRError, isDynamicServerError, isHTTPAccessFallbackError, isNextRouterError, isRedirectError, notFound, permanentRedirect, redirect, unauthorized, unstable_rethrow } from "./navigation-errors.js";
 import { clearAppNavigationFailureTarget, stageAppNavigationFailureTarget } from "../client/app-nav-failure-handler.js";
 import { beginAppRouterScrollIntent, clearAppRouterScrollIntent, consumeAppRouterScrollIntent, getPendingAppRouterScrollIntent, isLatestAppRouterScrollIntent } from "./app-router-scroll-state.js";
-import { VINEXT_RSC_COMPATIBILITY_ID_HEADER, VINEXT_RSC_CONTENT_TYPE, createRscRequestHeaders, createRscRequestUrl, stripRscCacheBustingSearchParam, stripRscSuffix } from "../server/app-rsc-cache-busting.js";
+import { VINEXT_RSC_COMPATIBILITY_ID_HEADER, VINEXT_RSC_CONTENT_TYPE, createRscRequestHeaders, createRscRequestUrl, formatRscRequestPath, parseRscRequestPath, stripRscCacheBustingSearchParam, stripRscSuffix } from "../server/app-rsc-cache-busting.js";
 import { notifyAppRouterTransitionStart } from "../client/instrumentation-client-state.js";
 import { getNavigationRuntime, hasAppNavigationRuntime } from "../client/navigation-runtime.js";
 import { UnrecognizedActionError, unstable_isUnrecognizedActionError } from "./unrecognized-action-error.js";
@@ -236,7 +236,7 @@ function resolvePrefetchCacheEntryMountedSlotsHeader(entry) {
 }
 function normalizeRscCacheLookupUrl(rscUrl) {
 	try {
-		const url = new URL(rscUrl, "http://vinext.local");
+		const url = parseRscRequestPath(rscUrl);
 		stripRscCacheBustingSearchParam(url);
 		return `${url.pathname}${url.search}`;
 	} catch {
@@ -245,7 +245,7 @@ function normalizeRscCacheLookupUrl(rscUrl) {
 }
 function normalizeRscCacheLookupPathname(rscUrl) {
 	try {
-		const url = new URL(rscUrl, "http://vinext.local");
+		const url = parseRscRequestPath(rscUrl);
 		return stripRscSuffix(url.pathname);
 	} catch {
 		return null;
@@ -435,8 +435,7 @@ function toAppPrefetchDestination(href) {
 	}
 	const browserHref = toCanonicalBrowserNavigationHref(localHref, window.location.href, __basePath, __trailingSlash);
 	try {
-		const url = new URL(browserHref, window.location.href);
-		return `${url.pathname}${url.search}`;
+		return formatRscRequestPath(new URL(browserHref, window.location.href));
 	} catch {
 		return browserHref.split("#", 1)[0];
 	}