vinext 1.2.0 → 1.3.0

package/dist/server/middleware-matcher-pattern.js

@@ -1,5 +1,4 @@
-import { analyzeRegexSafety, mayHaveNamedGroups, regexAtomsMayOverlap } from "../utils/regex-safety.js";
-import { middlewarePathTokensToRegExp, normalizeMiddlewarePathTokens, parseMiddlewarePath } from "./middleware-path-to-regexp.js";
+import { normalizePathTokens, parsePathPattern, pathTokensToRegExpSource } from "../utils/path-to-regexp.js";
 //#region src/server/middleware-matcher-pattern.ts
 const MATCHER_OBJECT_KEYS = /* @__PURE__ */ new Set([
 	"source",
@@ -52,154 +51,26 @@ function matcherObjectSource(value) {
 function isValidMiddlewareMatcherObjectConfig(value) {
 	return matcherObjectSource(value).error === void 0;
 }
-function patternMatches(pattern, value) {
-	try {
-		return new RegExp(`^(?:${pattern})$`).test(value);
-	} catch {
-		return false;
-	}
-}
-function atomsOverlap(left, right) {
-	return regexAtomsMayOverlap(left, right, true);
-}
-function groupCanMatchEmpty(group) {
-	if (/^\?(?:[=!]|<[=!])/.test(group)) return true;
-	return patternMatches(group.startsWith("?:") ? group.slice(2) : group, "");
-}
-function hasOverlappingSequentialRepetition(pattern) {
-	const repeatedAtDepth = [[]];
-	const groupStarts = [];
-	let depth = 0;
-	for (let index = 0; index < pattern.length; index++) {
-		const character = pattern[index];
-		if (character === "(") {
-			groupStarts.push(index);
-			depth++;
-			repeatedAtDepth[depth] = [];
-			if (pattern[index + 1] === "?") {
-				index++;
-				if (pattern[index + 1] === "<" && /[=!]/.test(pattern[index + 2] ?? "")) index += 2;
-				else if (/[=:!]/.test(pattern[index + 1] ?? "")) index++;
-			}
-			continue;
-		}
-		if (character === ")") {
-			const groupStart = groupStarts.pop();
-			repeatedAtDepth[depth] = [];
-			depth = Math.max(0, depth - 1);
-			if (groupStart !== void 0) {
-				const modifier = pattern[index + 1];
-				if (!(modifier === "*" || modifier === "?" || modifier === "{" && /^\{0(?:,\d*)?\}/.test(pattern.slice(index + 1))) && !groupCanMatchEmpty(pattern.slice(groupStart + 1, index))) repeatedAtDepth[depth] = [];
-			}
-			continue;
-		}
-		if (character === "|") {
-			repeatedAtDepth[depth] = [];
-			continue;
-		}
-		if (character === "^" || character === "$") continue;
-		if (character === "*" || character === "+" || character === "?" || character === "{") continue;
-		let atom = character;
-		if (character === "\\") {
-			if (index + 1 >= pattern.length) return true;
-			atom += pattern[++index];
-		} else if (character === "[") {
-			let classEnd = index + 1;
-			if (pattern[classEnd] === "^") classEnd++;
-			while (classEnd < pattern.length && pattern[classEnd] !== "]") {
-				if (pattern[classEnd] === "\\") classEnd++;
-				classEnd++;
-			}
-			if (classEnd >= pattern.length) return true;
-			atom = pattern.slice(index, classEnd + 1);
-			index = classEnd;
-		} else if (character === ".") atom = ".";
-		const quantifierStart = index + 1;
-		const quantifier = pattern[quantifierStart];
-		let unbounded = quantifier === "*" || quantifier === "+";
-		let canBeEmpty = quantifier === "*";
-		let quantifierEnd = quantifierStart;
-		if (quantifier === "{") {
-			const match = /^\{(\d+),\}/.exec(pattern.slice(quantifierStart));
-			if (match) {
-				unbounded = true;
-				canBeEmpty = Number(match[1]) === 0;
-				quantifierEnd += match[0].length - 1;
-			}
-		}
-		if (!unbounded) {
-			if (quantifier !== "?") repeatedAtDepth[depth] = [];
-			if (quantifier === "?") index = quantifierStart;
-			continue;
-		}
-		if (repeatedAtDepth[depth].some((previous) => atomsOverlap(previous, atom))) return true;
-		repeatedAtDepth[depth] = canBeEmpty ? [...repeatedAtDepth[depth], atom] : [atom];
-		index = quantifierEnd;
-	}
-	return false;
-}
-function unsafeTokenReason(token, namedGroups) {
-	const regexSafetyIssue = analyzeRegexSafety(token.pattern, {
-		ignoreCase: true,
-		namedGroups
-	});
-	if (regexSafetyIssue) {
-		if (regexSafetyIssue === "analysis budget exceeded") return `parameter "${token.name}" exceeds the regex analysis budget`;
-		return `parameter "${token.name}" contains ${regexSafetyIssue}`;
-	}
-	if (hasOverlappingSequentialRepetition(token.pattern)) return `parameter "${token.name}" contains overlapping sequential repetition`;
-	if (token.modifier !== "*" && token.modifier !== "+") return null;
-	if (patternMatches(token.pattern, "") || patternMatches(token.pattern, "/")) return `repeated parameter "${token.name}" may match an empty value or path delimiter`;
-	return null;
-}
-function validateTokens(tokens) {
-	const namedGroups = tokens.some((token) => typeof token !== "string" && mayHaveNamedGroups(token.pattern));
-	for (const token of tokens) {
-		if (typeof token === "string") continue;
-		const reason = unsafeTokenReason(token, namedGroups);
-		if (reason) return reason;
-	}
-	return null;
+function middlewareRegExp(tokens) {
+	return new RegExp(`${pathTokensToRegExpSource(tokens)}[\\/#\\?]?$`);
 }
 function compileMiddlewareMatcherPattern(source) {
-	if (!source.startsWith("/")) return {
-		kind: "invalid",
-		error: "source must start with /"
-	};
-	if (source.length > 4096) return {
-		kind: "invalid",
-		error: "source exceeds max built length of 4096"
-	};
+	if (!source.startsWith("/")) return { error: "source must start with /" };
+	if (source.length > 4096) return { error: "source exceeds max built length of 4096" };
 	let tokens;
 	try {
-		tokens = parseMiddlewarePath(source);
+		tokens = parsePathPattern(source);
 	} catch (error) {
-		return {
-			kind: "invalid",
-			error: error instanceof Error ? error.message : "matcher could not be parsed"
-		};
+		return { error: error instanceof Error ? error.message : "matcher could not be parsed" };
 	}
-	const unsafeReason = validateTokens(tokens);
-	if (unsafeReason) return {
-		kind: "unsafe",
-		error: unsafeReason
-	};
 	try {
-		return { regexp: middlewarePathTokensToRegExp(tokens) };
+		return { regexp: middlewareRegExp(tokens) };
 	} catch {
-		const normalizedTokens = normalizeMiddlewarePathTokens(tokens);
-		const normalizedUnsafeReason = validateTokens(normalizedTokens);
-		if (normalizedUnsafeReason) return {
-			kind: "unsafe",
-			error: normalizedUnsafeReason
-		};
+		const normalizedTokens = normalizePathTokens(tokens);
 		try {
-			return { regexp: middlewarePathTokensToRegExp(normalizedTokens) };
+			return { regexp: middlewareRegExp(normalizedTokens) };
 		} catch (error) {
-			return {
-				kind: "invalid",
-				error: error instanceof Error ? error.message : "matcher could not be compiled"
-			};
+			return { error: error instanceof Error ? error.message : "matcher could not be compiled" };
 		}
 	}
 }

package/dist/server/middleware-matcher.js

@@ -8,7 +8,7 @@ const EMPTY_MIDDLEWARE_REQUEST_CONTEXT = {
 	query: new URLSearchParams(),
 	host: ""
 };
-const UNSAFE_MATCHER_PATTERN = Symbol("unsafe matcher pattern");
+const INVALID_MATCHER_PATTERN = Symbol("invalid matcher pattern");
 const _mwPatternCache = /* @__PURE__ */ new Map();
 function matchesMiddleware(pathname, matcher, request, i18nConfig, localeContext) {
 	if (!matcher) return true;
@@ -63,7 +63,7 @@ function matchObjectMatcher(pathname, matcher, i18nConfig, localeContext) {
 	return matchPattern(localeContext?.kind === "defaulted" ? `/${localeContext.defaultLocale}${pathname === "/" ? "" : pathname}` : pathname, matcher.source);
 }
 function matchNextDataPattern(pathname, source, i18nConfig, localized) {
-	if (compiledPattern(source) === UNSAFE_MATCHER_PATTERN) return true;
+	if (compiledPattern(source) === INVALID_MATCHER_PATTERN) return true;
 	return matchPattern(pathname, nextDataMatcherSource(source, i18nConfig, localized));
 }
 /**
@@ -89,7 +89,7 @@ function stripFirstPathSegment(pathname) {
 function matchPattern(pathname, pattern) {
 	if (pattern === "/" && (pathname === "//" || pathname === "/?" || pathname === "/#")) return false;
 	const compiled = compiledPattern(pattern);
-	if (compiled === UNSAFE_MATCHER_PATTERN) return true;
+	if (compiled === INVALID_MATCHER_PATTERN) return true;
 	return compiled.test(pathname);
 }
 function compiledPattern(pattern) {
@@ -103,9 +103,8 @@ function compiledPattern(pattern) {
 function compileMatcherPattern(pattern) {
 	const result = compileMiddlewareMatcherPattern(pattern);
 	if (result.regexp) return result.regexp;
-	const problem = result.kind === "unsafe" ? "potentially unsafe" : "invalid";
-	console.warn(`[vinext] Rejecting ${problem} middleware matcher: ${pattern}\n  ${result.error}.\n  Middleware will run for all paths to avoid bypassing request guards.`);
-	return UNSAFE_MATCHER_PATTERN;
+	console.warn(`[vinext] Rejecting invalid middleware matcher: ${pattern}\n  ${result.error}.\n  Middleware will run for all paths to avoid bypassing request guards.`);
+	return INVALID_MATCHER_PATTERN;
 }
 //#endregion
 export { matchPattern, matchesMiddleware, matchesMiddlewarePathname };

package/dist/server/middleware-response-headers.d.ts

@@ -8,4 +8,35 @@ export declare function mergeVaryHeader(target: Headers, value: string): void;
  * response headers like Cache-Control.
  */
 export declare function mergeMiddlewareResponseHeaders(target: Headers, middlewareHeaders: Headers | null): void;
+export type MiddlewareResponseMergeOptions = {
+  /**
+   * Keep the response's WWW-Authenticate and Proxy-Authenticate after
+   * middleware's, as Next.js does for App route handlers. Pages API handlers
+   * write to the Node response that already holds middleware's headers, so
+   * their callers opt out.
+   */
+  appendResponseChallenges?: boolean;
+};
+/**
+ * Merge middleware response headers onto an already-built response's headers.
+ *
+ * Next.js writes middleware response headers before the handler runs and then
+ * appends the handler response's Set-Cookie, WWW-Authenticate and
+ * Proxy-Authenticate values, so middleware values come first and the
+ * response's own are kept. A handler's cookie for the same name (a logout
+ * deletion or session rotation) is then the one the browser applies last.
+ */
+export declare function mergeMiddlewareResponseHeadersOntoResponse(target: Headers, middlewareHeaders: Headers | null, options?: MiddlewareResponseMergeOptions): void;
+/**
+ * Build the response for an external rewrite from the headers routing staged
+ * before proxying.
+ *
+ * Next.js writes the staged config and middleware headers to its outgoing
+ * response and then proxies, and the proxy sets each upstream header over
+ * them. Its Set-Cookie patch keeps middleware's cookies ahead of the
+ * upstream's, so an upstream cookie replaces a staged config cookie while
+ * middleware's are kept. Without an upstream Set-Cookie the staged cookies
+ * stay as they are.
+ */
+export declare function withExternalRewriteResponseHeaders(upstream: Response, staged: Headers, middlewareCookies: readonly string[]): Response;
 //#endregion

package/dist/server/middleware-response-headers.js

@@ -42,5 +42,61 @@ function mergeMiddlewareResponseHeaders(target, middlewareHeaders) {
 		target.set(key, value);
 	}
 }
+const RESPONSE_APPENDED_HEADER_NAMES = [
+	"set-cookie",
+	"www-authenticate",
+	"proxy-authenticate"
+];
+const RESPONSE_APPENDED_COOKIE_HEADER_NAMES = ["set-cookie"];
+/**
+* Merge middleware response headers onto an already-built response's headers.
+*
+* Next.js writes middleware response headers before the handler runs and then
+* appends the handler response's Set-Cookie, WWW-Authenticate and
+* Proxy-Authenticate values, so middleware values come first and the
+* response's own are kept. A handler's cookie for the same name (a logout
+* deletion or session rotation) is then the one the browser applies last.
+*/
+function mergeMiddlewareResponseHeadersOntoResponse(target, middlewareHeaders, options = {}) {
+	if (!middlewareHeaders) return;
+	const responseValues = [];
+	const appendedNames = options.appendResponseChallenges === false ? RESPONSE_APPENDED_COOKIE_HEADER_NAMES : RESPONSE_APPENDED_HEADER_NAMES;
+	for (const name of appendedNames) {
+		if (!middlewareHeaders.has(name)) continue;
+		const value = target.get(name);
+		responseValues.push([name, name === "set-cookie" ? target.getSetCookie() : value === null ? [] : [value]]);
+		target.delete(name);
+	}
+	mergeMiddlewareResponseHeaders(target, middlewareHeaders);
+	for (const [name, values] of responseValues) {
+		if (!middlewareHeaders.get(name)) target.delete(name);
+		for (const value of values) target.append(name, value);
+	}
+}
+/**
+* Build the response for an external rewrite from the headers routing staged
+* before proxying.
+*
+* Next.js writes the staged config and middleware headers to its outgoing
+* response and then proxies, and the proxy sets each upstream header over
+* them. Its Set-Cookie patch keeps middleware's cookies ahead of the
+* upstream's, so an upstream cookie replaces a staged config cookie while
+* middleware's are kept. Without an upstream Set-Cookie the staged cookies
+* stay as they are.
+*/
+function withExternalRewriteResponseHeaders(upstream, staged, middlewareCookies) {
+	staged.delete("content-length");
+	for (const name of new Set(upstream.headers.keys())) if (name !== "set-cookie") staged.set(name, upstream.headers.get(name) ?? "");
+	const upstreamCookies = upstream.headers.getSetCookie();
+	if (upstreamCookies.length > 0) {
+		staged.delete("set-cookie");
+		for (const cookie of /* @__PURE__ */ new Set([...middlewareCookies, ...upstreamCookies])) staged.append("set-cookie", cookie);
+	}
+	return new Response(upstream.body, {
+		status: upstream.status,
+		statusText: upstream.statusText,
+		headers: staged
+	});
+}
 //#endregion
-export { mergeMiddlewareResponseHeaders, mergeVaryHeader };
+export { mergeMiddlewareResponseHeaders, mergeMiddlewareResponseHeadersOntoResponse, mergeVaryHeader, withExternalRewriteResponseHeaders };

package/dist/server/middleware-runtime.js

@@ -2,18 +2,18 @@ import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import "../utils/protocol-headers.js";
 import { shouldKeepMiddlewareHeader } from "../utils/middleware-request-headers.js";
 import { normalizeHost } from "../config/request-context.js";
-import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { addBasePathToPathname, hasBasePath, removeTrailingSlash, stripBasePath } from "../utils/base-path.js";
+import { MIDDLEWARE_REWRITE_HEADER } from "./headers.js";
+import { badRequestResponse, internalServerErrorResponse } from "./http-error-responses.js";
+import { isOpenRedirectShaped } from "./open-redirect.js";
+import { dropEmptyMiddlewareSetCookie, processMiddlewareHeaders } from "./request-pipeline.js";
+import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { getRequestExecutionContext, runWithExecutionContext } from "../shims/request-context.js";
 import "./server-globals.js";
-import { MIDDLEWARE_REWRITE_HEADER } from "./headers.js";
 import { NextFetchEvent, NextRequest } from "../shims/server.js";
 import { runInWorkStoreScope } from "../shims/internal/work-store-scope.js";
 import { normalizePath } from "./normalize-path.js";
 import { matchesMiddleware, matchesMiddlewarePathname } from "./middleware-matcher.js";
-import { badRequestResponse, internalServerErrorResponse } from "./http-error-responses.js";
-import { isOpenRedirectShaped } from "./open-redirect.js";
-import { processMiddlewareHeaders } from "./request-pipeline.js";
 import { normalizeDefaultLocalePathname } from "./pages-i18n.js";
 import { nextDataMiddlewareMatchPathname } from "./pages-data-route.js";
 import { reportRequestError } from "./instrumentation.js";
@@ -118,6 +118,7 @@ function dataRedirectResponse(target, originalResponse) {
 function collectMiddlewareHeaders(response) {
 	const responseHeaders = new Headers();
 	for (const [key, value] of response.headers) if (!key.startsWith("x-middleware-") || shouldKeepMiddlewareHeader(key)) responseHeaders.append(key, value);
+	dropEmptyMiddlewareSetCookie(responseHeaders);
 	return responseHeaders;
 }
 function drainFetchEvent(fetchEvent) {
@@ -135,12 +136,19 @@ function resolveMiddlewarePathname(request) {
 		return badRequestResponse();
 	}
 }
-function createNextRequest(request, i18nConfig, basePath, trailingSlash, hadBasePath, requestBodyAlreadyIsolated = false, skipTrailingSlashRedirect = false) {
-	const url = new URL(request.url);
+/** The same path and query on another origin. */
+function withOrigin(url, origin) {
+	const result = new URL(origin);
+	if (result.origin === url.origin) return url;
+	result.pathname = url.pathname;
+	result.search = url.search;
+	return result;
+}
+function createNextRequest(request, url, i18nConfig, basePath, trailingSlash, hadBasePath, requestBodyAlreadyIsolated = false, skipTrailingSlashRedirect = false) {
 	let mwRequest = !requestBodyAlreadyIsolated && request.body && !request.bodyUsed ? request.clone() : request;
 	const requestPathname = url.pathname;
 	const mwPathname = basePath && hadBasePath && !hasBasePath(requestPathname, basePath) ? addBasePathToPathname(requestPathname, basePath) : requestPathname;
-	if (mwPathname !== url.pathname) {
+	if (mwPathname !== url.pathname || url.href !== request.url) {
 		const mwUrl = new URL(url);
 		mwUrl.pathname = mwPathname;
 		mwRequest = new Request(mwUrl, mwRequest);
@@ -151,7 +159,12 @@ function createNextRequest(request, i18nConfig, basePath, trailingSlash, hadBase
 		trailingSlash: trailingSlash ?? void 0,
 		skipTrailingSlashRedirect
 	} : void 0;
-	const nextRequest = mwRequest instanceof NextRequest && (!mwRequest.body || mwRequest.bodyUsed) ? mwRequest : new NextRequest(mwRequest, nextConfig ? { nextConfig } : void 0);
+	const requestUrl = new URL(request.url);
+	const requestHost = requestUrl.origin === url.origin ? void 0 : requestUrl.host;
+	const nextRequest = mwRequest instanceof NextRequest && (!mwRequest.body || mwRequest.bodyUsed) ? mwRequest : new NextRequest(mwRequest, nextConfig ? {
+		nextConfig,
+		requestHost
+	} : void 0);
 	if (mwRequest !== request && mwRequest.body && !mwRequest.bodyUsed && !mwRequest.body.locked) mwRequest.body.cancel().catch(() => {});
 	return nextRequest;
 }
@@ -219,7 +232,8 @@ async function executeMiddlewareModule(options) {
 	const decodedMatches = !encodedMatches && decodedMatchPathname !== null && decodedMatchPathname !== encodedMatchPathname && matchesMiddleware(decodedMatchPathname, matcher, options.request, options.i18nConfig, localeContext);
 	if (!encodedMatches && !decodedMatches) return { continue: true };
 	options.onMatch?.();
-	const nextRequest = createNextRequest(options.request, options.i18nConfig, options.basePath, options.trailingSlash, hadBasePath, options.requestBodyAlreadyIsolated, options.skipTrailingSlashRedirect);
+	const middlewareUrl = withOrigin(requestUrl, getRequestExecutionContext()?.middlewareOrigin ?? requestUrl.origin);
+	const nextRequest = createNextRequest(options.request, middlewareUrl, options.i18nConfig, options.basePath, options.trailingSlash, hadBasePath, options.requestBodyAlreadyIsolated, options.skipTrailingSlashRedirect);
 	if (options.isDataRequest) Object.defineProperty(nextRequest, "__isData", {
 		enumerable: false,
 		value: true
@@ -260,11 +274,11 @@ async function executeMiddlewareModule(options) {
 	if (response.status >= 300 && response.status < 400) {
 		const location = response.headers.get("Location") ?? response.headers.get("location");
 		if (location) {
-			const relativeLocation = relativizeLocation(location, options.request.url);
+			const relativeLocation = relativizeLocation(location, middlewareUrl.href);
 			let normalizedLocation = relativeLocation;
 			if (options.trailingSlash !== void 0 && !options.skipTrailingSlashRedirect) try {
-				const loc = new URL(relativeLocation, options.request.url);
-				if (loc.origin === new URL(options.request.url).origin) {
+				const loc = new URL(relativeLocation, middlewareUrl);
+				if (loc.origin === middlewareUrl.origin) {
 					const p = loc.pathname;
 					let normalized = null;
 					if (p !== "" && p !== "/") {
@@ -273,7 +287,7 @@ async function executeMiddlewareModule(options) {
 					}
 					if (normalized !== null) {
 						loc.pathname = normalized;
-						normalizedLocation = relativizeLocation(loc.toString(), options.request.url);
+						normalizedLocation = relativizeLocation(loc.toString(), middlewareUrl.href);
 					}
 				}
 			} catch {}
@@ -311,9 +325,8 @@ async function executeMiddlewareModule(options) {
 		let rewritePath;
 		let rewriteHadBasePath;
 		try {
-			const rewriteParsed = new URL(rewriteUrl, options.request.url);
-			const requestOrigin = new URL(options.request.url).origin;
-			if (rewriteParsed.origin === requestOrigin) {
+			const rewriteParsed = new URL(rewriteUrl, middlewareUrl);
+			if (rewriteParsed.origin === middlewareUrl.origin) {
 				rewriteHadBasePath = !options.basePath || hasBasePath(rewriteParsed.pathname, options.basePath);
 				rewritePath = (options.basePath ? stripBasePath(rewriteParsed.pathname, options.basePath) : rewriteParsed.pathname) + rewriteParsed.search;
 			} else rewritePath = rewriteParsed.href;

package/dist/server/navigation-planner.d.ts

@@ -1,4 +1,4 @@
-import { RouteManifest } from "../routing/app-route-graph.js";
+import { BrowserRouteManifest } from "../routing/browser-route-manifest.js";
 import { CacheEntryReuseDecision, CacheEntryReuseProof } from "./cache-proof.js";
 import { AppElementsSlotBinding } from "./app-elements-wire.js";
 import "./app-elements.js";
@@ -230,7 +230,7 @@ type NavigationPrefetchProbeDecision = {
   reason: "cacheBypassed" | "refresh" | "visitedResponseAvailable";
 };
 export type NavigationPlannerInput = {
-  routeManifest: RouteManifest | null;
+  routeManifest: BrowserRouteManifest | null;
   state: NavigationPlannerState;
   event: NavigationEvent;
 };

package/dist/server/navigation-planner.js

@@ -1,5 +1,5 @@
-import { splitPathnameForRouteMatch } from "../routing/utils.js";
 import { stripBasePath } from "../utils/base-path.js";
+import { splitPathnameForRouteMatch } from "../routing/utils.js";
 import { matchRoutePattern, matchRoutePatternPrefix, matchRoutePatternWithOptionalDynamicSegments } from "../routing/route-pattern.js";
 import { AppElementsWire, compareAppElementsSlotIds } from "./app-elements-wire.js";
 import "./app-elements.js";

package/dist/server/nitro-public-files-plugin.d.ts

@@ -0,0 +1,38 @@
+//#region src/server/nitro-public-files-plugin.d.ts
+/**
+ * Nitro runtime plugin that lets vinext serve the files in `public/`.
+ *
+ * Nitro's static handler answers a request for a public file before any app
+ * handler runs, so middleware would never see it. The plugin sends those
+ * requests to vinext instead. vinext's router then decides which public file
+ * a request resolves to, for example the destination of a rewrite, but only
+ * the static handler can read the file from the server output. The plugin
+ * publishes an asset fetcher that sends a request back through the Nitro app,
+ * where the static handler answers it.
+ *
+ * This module runs in Nitro's server bundle, separate from vinext's request
+ * handlers, so it imports nothing and shares state through `globalThis`.
+ */
+export declare const NITRO_ASSETS_KEY = "vinext.nitro.assets";
+type NitroApp = {
+  fetch: (request: Request) => Response | Promise<Response>;
+  captureError?: (error: unknown, context: {
+    tags?: string[];
+  }) => void;
+};
+export type NitroAssets = {
+  fetch(request: Request): Promise<Response>;
+  /** Whether a request is an asset fetch that Nitro's static handler did not answer. */
+  isAssetRequest(request: Request): boolean;
+};
+type NitroPublicFilesPluginOptions = {
+  /**
+   * The static files Nitro serves for the files in `public/`, including
+   * their compressed copies, keyed as Nitro's static handler keys them.
+   */
+  publicAssets: string[];
+  /** Sends a request to vinext's request handler. */
+  fetchApp(request: Request): Promise<Response>;
+};
+export declare function createNitroPublicFilesPlugin(options: NitroPublicFilesPluginOptions): (nitroApp: NitroApp) => void;
+//#endregion

package/dist/server/nitro-public-files-plugin.js

@@ -0,0 +1,106 @@
+//#region src/server/nitro-public-files-plugin.ts
+/**
+* Nitro runtime plugin that lets vinext serve the files in `public/`.
+*
+* Nitro's static handler answers a request for a public file before any app
+* handler runs, so middleware would never see it. The plugin sends those
+* requests to vinext instead. vinext's router then decides which public file
+* a request resolves to, for example the destination of a rewrite, but only
+* the static handler can read the file from the server output. The plugin
+* publishes an asset fetcher that sends a request back through the Nitro app,
+* where the static handler answers it.
+*
+* This module runs in Nitro's server bundle, separate from vinext's request
+* handlers, so it imports nothing and shares state through `globalThis`.
+*/
+const NITRO_ASSETS_KEY = "vinext.nitro.assets";
+const ASSET_REQUEST_HEADER = "x-vinext-nitro-asset";
+const STATIC_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+const ENCODING_EXTENSIONS = /* @__PURE__ */ new Map([
+	["br", ".br"],
+	["gzip", ".gz"],
+	["zstd", ".zst"]
+]);
+/**
+* The pathnames h3 can give Nitro's static handler for a request URL. srvx
+* usually hands h3 the URL's path up to the query as it is, so a literal `#`
+* stays in it, but parses the URL fully when the path needs normalizing.
+*/
+function getRequestPathnames(url) {
+	const parsed = new URL(url).pathname;
+	const start = url.indexOf("/", url.indexOf("://") + 3);
+	if (start === -1) return [parsed];
+	const query = url.indexOf("?", start);
+	const raw = url.slice(start, query === -1 ? void 0 : query);
+	return raw === parsed ? [parsed] : [parsed, raw];
+}
+/**
+* The pathname h3 2.0.1-rc.22, which the pinned Nitro uses, gives Nitro's
+* static handler. When it creates the request event, it decodes a pathname
+* that contains `%` except for `%25`, and the URL parser then resolves the
+* result again, for example `\` and `..` segments. Returns `undefined` when
+* h3 fails the request instead. Newer h3 releases leave decoding to Nitro, so
+* the plugin also looks up the pathname without this step.
+*/
+function toH3Pathname(pathname) {
+	if (!pathname.includes("%")) return pathname;
+	try {
+		const url = new URL("http://localhost");
+		url.pathname = decodeURI(pathname.replace(/%25/g, "%2525"));
+		return url.pathname;
+	} catch {
+		return;
+	}
+}
+/**
+* Whether Nitro's static handler would answer a request for a pathname with
+* a public file, following its lookup in `runtime/internal/static.mjs`. It
+* looks h3's pathname up without one trailing slash and decoded except for
+* `%2F`, and then as a directory with an `index.html`, each first with the
+* extension of a compressed copy for every encoding the request accepts.
+*/
+function isPublicFilePathname(pathname, extensions, publicAssets) {
+	let id = pathname.length > 1 && pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
+	try {
+		id = decodeURIComponent(id.replace(/%2f/gi, "%252F"));
+	} catch {}
+	const index = id.endsWith("/") ? `${id}index.html` : `${id}/index.html`;
+	return extensions.some((extension) => publicAssets.has(id + extension) || publicAssets.has(index + extension));
+}
+function isPublicFileRequest(request, publicAssets) {
+	if (!STATIC_METHODS.has(request.method)) return false;
+	const extensions = [""];
+	for (const encoding of request.headers.get("accept-encoding")?.split(",") ?? []) {
+		const [name, ...params] = encoding.split(";");
+		const quality = params.map((param) => param.trim().split("=")).find(([key]) => key.toLowerCase() === "q")?.[1];
+		if ((quality === void 0 ? 1 : Number.parseFloat(quality)) <= 0) continue;
+		const extension = ENCODING_EXTENSIONS.get(name.trim().toLowerCase());
+		if (extension) extensions.push(extension);
+	}
+	return getRequestPathnames(request.url).some((pathname) => [pathname, toH3Pathname(pathname)].some((candidate) => candidate !== void 0 && isPublicFilePathname(candidate, extensions, publicAssets)));
+}
+function createNitroPublicFilesPlugin(options) {
+	const publicAssets = new Set(options.publicAssets);
+	return (nitroApp) => {
+		const appFetch = nitroApp.fetch;
+		const token = crypto.randomUUID();
+		Reflect.set(globalThis, Symbol.for(NITRO_ASSETS_KEY), {
+			async fetch(request) {
+				const headers = new Headers(request.headers);
+				headers.set(ASSET_REQUEST_HEADER, token);
+				return appFetch(new Request(request, { headers }));
+			},
+			isAssetRequest: (request) => request.headers.get(ASSET_REQUEST_HEADER) === token
+		});
+		if (publicAssets.size > 0) nitroApp.fetch = (request) => {
+			if (!isPublicFileRequest(request, publicAssets)) return appFetch(request);
+			return Promise.resolve().then(() => options.fetchApp(request)).catch((error) => {
+				console.error("[vinext]", error);
+				nitroApp.captureError?.(error, { tags: ["vinext"] });
+				return new Response(null, { status: 500 });
+			});
+		};
+	};
+}
+//#endregion
+export { NITRO_ASSETS_KEY, createNitroPublicFilesPlugin };

package/dist/server/nitro-public-files.d.ts

@@ -0,0 +1,21 @@
+import { VinextAssetFetcher } from "./multi-stage.js";
+//#region src/server/nitro-public-files.d.ts
+type NitroFetchEntry = {
+  fetch(request: Request): Promise<Response>;
+};
+/**
+ * Wrap the App Router SSR service that Nitro dispatches requests to, so a
+ * public file the router resolves is served by Nitro's static handler.
+ */
+export declare function withNitroPublicFiles(entry: NitroFetchEntry): NitroFetchEntry;
+type PagesWorkerEntry<Env, Context extends object> = {
+  fetch(request: Request, env: Env, ctx: Context & {
+    assets?: VinextAssetFetcher;
+  }): unknown;
+};
+/**
+ * Give the Pages Router worker that Nitro dispatches requests to an asset
+ * fetcher that reads files through Nitro's static handler.
+ */
+export declare function withNitroPagesPublicFiles<Env, Context extends object>(worker: PagesWorkerEntry<Env, Context>): PagesWorkerEntry<Env, Context>;
+//#endregion

package/dist/server/nitro-public-files.js

@@ -0,0 +1,39 @@
+import { createStaticAssetRequest, resolveStaticAssetSignal } from "./worker-utils.js";
+import { NITRO_ASSETS_KEY } from "./nitro-public-files-plugin.js";
+//#region src/server/nitro-public-files.ts
+function getNitroAssets() {
+	const assets = Reflect.get(globalThis, Symbol.for(NITRO_ASSETS_KEY));
+	if (!assets) throw new Error("[vinext] The Nitro public files plugin did not run.");
+	return assets;
+}
+function notFound() {
+	return new Response(null, { status: 404 });
+}
+/**
+* Wrap the App Router SSR service that Nitro dispatches requests to, so a
+* public file the router resolves is served by Nitro's static handler.
+*/
+function withNitroPublicFiles(entry) {
+	return { async fetch(request) {
+		const assets = getNitroAssets();
+		if (assets.isAssetRequest(request)) return notFound();
+		const response = await entry.fetch(request);
+		return await resolveStaticAssetSignal(response, { fetchAsset: (path, requestHeaders) => assets.fetch(createStaticAssetRequest(path, request, requestHeaders)) }) ?? response;
+	} };
+}
+/**
+* Give the Pages Router worker that Nitro dispatches requests to an asset
+* fetcher that reads files through Nitro's static handler.
+*/
+function withNitroPagesPublicFiles(worker) {
+	return { fetch(request, env, ctx) {
+		const assets = getNitroAssets();
+		if (assets.isAssetRequest(request)) return notFound();
+		return worker.fetch(request, env, {
+			...ctx,
+			assets
+		});
+	} };
+}
+//#endregion
+export { withNitroPagesPublicFiles, withNitroPublicFiles };