vinext 1.2.0 → 1.3.0

package/dist/server/open-redirect.d.ts

@@ -11,7 +11,7 @@ export declare function isOpenRedirectShaped(rawPathname: string): boolean;
 /**
  * What a request entry answers for a raw path containing a backslash or a
  * repeated slash: Next.js's 308, or a 404 when the collapsed path would still
- * be open-redirect shaped.
+ * be open-redirect shaped or the raw target is not origin-form.
  */
 export type RepeatedSlashRedirect = {
   status: 308;
@@ -33,17 +33,24 @@ export type RepeatedSlashRedirect = {
  * `//evil.com` → `/evil.com`. Percent-encoded `%2F`/`%5C` are not touched and
  * keep falling through to `isOpenRedirectShaped` (404), as in Next.js.
  *
- * The Location is always same-origin. Absolute-form request targets
- * (`GET http://host//x`) are left alone. A collapsed path that still starts
+ * The Location is always same-origin. A collapsed path that still starts
  * with an encoded slash or backslash (`//%2Fevil.com`, `/.//%2Fevil.com`) is
  * never echoed into a Location or routed: it gets a 404 instead.
  *
+ * A raw Node request target that is not origin-form (`GET http://evil.example/x`,
+ * which Node's parser accepts, or `OPTIONS *`) also gets a 404. Next.js never
+ * routes these either: it 308s absolute-form targets to their own URL (the
+ * `//` after the scheme trips the same check) and 500s `OPTIONS *`. Routing
+ * them would let the request line choose the origin of `request.url` that
+ * middleware and handlers see, bypassing the Host trust policy. Request-based
+ * entries always pass a pathname.
+ *
  * @param rawUrl - The raw request target: pathname plus optional `?query`
  */
 export declare function getRepeatedSlashRedirect(rawUrl: string): RepeatedSlashRedirect | null;
 /**
  * Build the Response for a raw request path containing a backslash or a
- * repeated slash. See `getRepeatedSlashRedirect`.
+ * repeated slash, or a non-origin-form target. See `getRepeatedSlashRedirect`.
  */
 export declare function repeatedSlashRedirectResponse(rawUrl: string): Response | null;
 /**

package/dist/server/open-redirect.js

@@ -34,15 +34,22 @@ const REDIRECT_LOCATION_BASE = "http://vinext.invalid";
 * `//evil.com` → `/evil.com`. Percent-encoded `%2F`/`%5C` are not touched and
 * keep falling through to `isOpenRedirectShaped` (404), as in Next.js.
 *
-* The Location is always same-origin. Absolute-form request targets
-* (`GET http://host//x`) are left alone. A collapsed path that still starts
+* The Location is always same-origin. A collapsed path that still starts
 * with an encoded slash or backslash (`//%2Fevil.com`, `/.//%2Fevil.com`) is
 * never echoed into a Location or routed: it gets a 404 instead.
 *
+* A raw Node request target that is not origin-form (`GET http://evil.example/x`,
+* which Node's parser accepts, or `OPTIONS *`) also gets a 404. Next.js never
+* routes these either: it 308s absolute-form targets to their own URL (the
+* `//` after the scheme trips the same check) and 500s `OPTIONS *`. Routing
+* them would let the request line choose the origin of `request.url` that
+* middleware and handlers see, bypassing the Host trust policy. Request-based
+* entries always pass a pathname.
+*
 * @param rawUrl - The raw request target: pathname plus optional `?query`
 */
 function getRepeatedSlashRedirect(rawUrl) {
-	if (!rawUrl.startsWith("/")) return null;
+	if (!rawUrl.startsWith("/")) return { status: 404 };
 	const urlParts = rawUrl.split("?");
 	const pathname = urlParts[0];
 	if (!REPEATED_SLASH_OR_BACKSLASH_RE.test(pathname)) return null;
@@ -62,7 +69,7 @@ function repeatedSlashRedirectHeaders(location) {
 }
 /**
 * Build the Response for a raw request path containing a backslash or a
-* repeated slash. See `getRepeatedSlashRedirect`.
+* repeated slash, or a non-origin-form target. See `getRepeatedSlashRedirect`.
 */
 function repeatedSlashRedirectResponse(rawUrl) {
 	const redirect = getRepeatedSlashRedirect(rawUrl);

package/dist/server/pages-api-route.js

@@ -1,8 +1,8 @@
+import { internalServerErrorResponse } from "./http-error-responses.js";
+import { cloneRequestWithUrl } from "./request-pipeline.js";
 import { getRequestExecutionContext, runWithExecutionContext } from "../shims/request-context.js";
 import "./server-globals.js";
 import { NextRequest } from "../shims/server.js";
-import { internalServerErrorResponse } from "./http-error-responses.js";
-import { cloneRequestWithUrl } from "./request-pipeline.js";
 import { markRouteCacheabilityExplicitResponsePolicy } from "../shims/cacheability-classification.js";
 import { hasCdnResponsePolicy } from "./cache-control.js";
 import { mergeRouteParamsIntoQuery, parseQueryString, urlQueryToSearchParams } from "../utils/query.js";

package/dist/server/pages-asset-tags.d.ts

@@ -9,6 +9,11 @@
  * unit-testable and lives in a normal typed module rather than a codegen
  * template string.
  */
+/**
+ * Fallback for when no build-time `sharedChunks` list is registered. Prefers
+ * the chunk-name based list the build writes into the SSR manifest; the file
+ * name scan only matches `[name]-[hash]` names, not hash-only ones.
+ */
 export declare function getSharedChunkFiles(manifest: Record<string, string[]>): string[];
 /**
  * Resolve the effective SSR manifest: prefer the caller-supplied object and

package/dist/server/pages-asset-tags.js

@@ -1,6 +1,6 @@
 import { appendDeploymentIdQuery } from "../utils/deployment-id.js";
 import { createNonceAttribute } from "./html.js";
-import { assetServingUrlFromBaseAnchored } from "../utils/manifest-paths.js";
+import { SSR_MANIFEST_SHARED_CHUNKS_KEY, assetServingUrlFromBaseAnchored } from "../utils/manifest-paths.js";
 import { getPagesClientAssets } from "./pages-client-assets.js";
 //#region src/server/pages-asset-tags.ts
 /**
@@ -55,7 +55,14 @@ function findModuleKey(manifest, moduleId) {
 	}
 	return matchedKey;
 }
+/**
+* Fallback for when no build-time `sharedChunks` list is registered. Prefers
+* the chunk-name based list the build writes into the SSR manifest; the file
+* name scan only matches `[name]-[hash]` names, not hash-only ones.
+*/
 function getSharedChunkFiles(manifest) {
+	const recorded = manifest[SSR_MANIFEST_SHARED_CHUNKS_KEY];
+	if (recorded) return recorded;
 	const cached = sharedChunkFiles.get(manifest);
 	if (cached) return cached;
 	const files = /* @__PURE__ */ new Set();
@@ -186,7 +193,7 @@ function collectAssetTags(options) {
 				const files = getManifestFilesForModule(m, id);
 				if (files) for (let fi = 0; fi < files.length; fi++) allFiles.push(files[fi]);
 			}
-			const sharedFiles = m === runtimeAssets.ssrManifest && runtimeAssets.sharedChunks ? runtimeAssets.sharedChunks : getSharedChunkFiles(m);
+			const sharedFiles = runtimeAssets.sharedChunks ?? getSharedChunkFiles(m);
 			for (const file of sharedFiles) allFiles.push(file);
 		} else for (const akey in m) {
 			const avals = m[akey];

package/dist/server/pages-client-assets.d.ts

@@ -4,7 +4,10 @@ export type PagesClientAssets = {
   clientEntry?: string;
   appBootstrapPreinitModules?: string[];
   ssrManifest?: Record<string, string[]>;
-  /** Build-time shared file list, valid only for this ssrManifest object. */
+  /**
+   * Shared Pages chunk files (framework, vinext runtime, client entry) keyed on
+   * chunk names from this client build, in the SSR-manifest key-space.
+   */
   sharedChunks?: string[];
   cssGraph?: Record<string, {
     imports?: string[];

package/dist/server/pages-data-route.js

@@ -1,6 +1,7 @@
 import { MIDDLEWARE_SKIP_HEADER } from "../utils/protocol-headers.js";
 import { addBasePathToPathname, hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { NEXTJS_DEPLOYMENT_ID_HEADER } from "./headers.js";
+import { cloneRequestWithUrl } from "./request-pipeline.js";
 //#region src/server/pages-data-route.ts
 /**
 * Helpers for the Pages Router `/_next/data/{buildId}/{...page}.json` endpoint.
@@ -191,7 +192,7 @@ function normalizePagesDataRequest(request, buildId, basePath = "", trailingSlas
 	normalizedUrl.pathname = hadBasePath ? addBasePathToPathname(pagePathname, basePath) : pagePathname;
 	return {
 		isDataReq: true,
-		request: new Request(normalizedUrl, request),
+		request: cloneRequestWithUrl(request, normalizedUrl.href),
 		normalizedPathname: pagePathname,
 		search: reqUrl.search,
 		notFoundResponse: null

package/dist/server/pages-i18n.d.ts

@@ -63,12 +63,30 @@ export declare function detectPathnameLocale(pathname: string, locales: readonly
  * `:locale`. After normalisation the request looks like `/en/to-sv` and
  * the rule matches with `:locale=en`.
  *
+ * `restoreRootTrailingSlash` makes the root `/en/` rather than `/en`; header
+ * callers compute it with `shouldRestoreLocaleRootTrailingSlash`. Redirect
+ * and rewrite callers do not pass it yet.
+ *
  * Ported from Next.js: packages/next/src/server/lib/router-utils/resolve-routes.ts
  * https://github.com/vercel/next.js/blob/canary/packages/next/src/server/lib/router-utils/resolve-routes.ts
  */
 export declare function normalizeDefaultLocalePathname(pathname: string, i18n: NextI18nConfig | null | undefined, options?: {
   hostname?: string | null;
+  restoreRootTrailingSlash?: boolean;
 }): string;
+/**
+ * Whether Next.js re-adds the root's trailing slash after splicing in the
+ * default locale: the raw request pathname (basePath included, so `/docs`
+ * stays `/docs/en` while `/docs/` becomes `/docs/en/`) ends with `/`, and
+ * `trailingSlash` is on without `skipProxyUrlNormalize`.
+ *
+ * Ported from Next.js: packages/next/src/server/lib/router-utils/resolve-routes.ts
+ * (`hadTrailingSlash` + `maybeAddTrailingSlash`).
+ */
+export declare function shouldRestoreLocaleRootTrailingSlash(rawPathname: string, config: {
+  trailingSlash?: boolean;
+  skipProxyUrlNormalize?: boolean;
+}): boolean;
 /**
  * Extract locale prefix from a URL path.
  * e.g. /fr/about -> { locale: "fr", url: "/about", hadPrefix: true }

package/dist/server/pages-i18n.js

@@ -51,6 +51,10 @@ function detectPathnameLocale(pathname, locales) {
 * `:locale`. After normalisation the request looks like `/en/to-sv` and
 * the rule matches with `:locale=en`.
 *
+* `restoreRootTrailingSlash` makes the root `/en/` rather than `/en`; header
+* callers compute it with `shouldRestoreLocaleRootTrailingSlash`. Redirect
+* and rewrite callers do not pass it yet.
+*
 * Ported from Next.js: packages/next/src/server/lib/router-utils/resolve-routes.ts
 * https://github.com/vercel/next.js/blob/canary/packages/next/src/server/lib/router-utils/resolve-routes.ts
 */
@@ -59,10 +63,22 @@ function normalizeDefaultLocalePathname(pathname, i18n, options = {}) {
 	if (pathname.startsWith("/_next/") || pathname.startsWith("/__vinext/")) return pathname;
 	if (detectPathnameLocale(pathname, i18n.locales)) return pathname;
 	const defaultLocale = detectDomainLocale(i18n.domains, options.hostname ?? void 0)?.defaultLocale ?? i18n.defaultLocale;
-	if (pathname === "/") return `/${defaultLocale}`;
+	if (pathname === "/") return options.restoreRootTrailingSlash ? `/${defaultLocale}/` : `/${defaultLocale}`;
 	return `/${defaultLocale}${pathname}`;
 }
 /**
+* Whether Next.js re-adds the root's trailing slash after splicing in the
+* default locale: the raw request pathname (basePath included, so `/docs`
+* stays `/docs/en` while `/docs/` becomes `/docs/en/`) ends with `/`, and
+* `trailingSlash` is on without `skipProxyUrlNormalize`.
+*
+* Ported from Next.js: packages/next/src/server/lib/router-utils/resolve-routes.ts
+* (`hadTrailingSlash` + `maybeAddTrailingSlash`).
+*/
+function shouldRestoreLocaleRootTrailingSlash(rawPathname, config) {
+	return Boolean(config.trailingSlash && !config.skipProxyUrlNormalize && rawPathname.endsWith("/"));
+}
+/**
 * Extract locale prefix from a URL path.
 * e.g. /fr/about -> { locale: "fr", url: "/about", hadPrefix: true }
 *      /about    -> { locale: defaultLocale, url: "/about", hadPrefix: false }
@@ -243,4 +259,4 @@ function resolvePagesI18nRequest(url, i18nConfig, headers, hostname, basePath =
 	};
 }
 //#endregion
-export { detectDomainLocale, detectLocaleFromAcceptLanguage, detectPathnameLocale, extractLocaleFromUrl, getLocaleRedirect, normalizeDefaultLocalePathname, parseCookieLocaleFromHeader, resolvePagesI18nRequest, stripI18nLocaleForApiRoute };
+export { detectDomainLocale, detectLocaleFromAcceptLanguage, detectPathnameLocale, extractLocaleFromUrl, getLocaleRedirect, normalizeDefaultLocalePathname, parseCookieLocaleFromHeader, resolvePagesI18nRequest, shouldRestoreLocaleRootTrailingSlash, stripI18nLocaleForApiRoute };

package/dist/server/pages-node-compat.d.ts

@@ -15,15 +15,17 @@ export type PagesReqResRequest = Readable & {
   draftMode?: true;
   previewData: PagesPreviewData | false;
 };
+type PagesReqResHeaderValue = string | number | boolean | string[];
 type PagesReqResHeaders = {
-  [key: string]: string | number | boolean | string[];
+  [key: string]: PagesReqResHeaderValue;
 };
 export type PagesReqResResponse = Writable & {
   statusCode: number;
   readonly headersSent: boolean;
   writeHead: (code: number, headers?: PagesReqResHeaders) => PagesReqResResponse;
-  setHeader: (name: string, value: string | number | boolean | string[]) => PagesReqResResponse;
-  getHeader: (name: string) => string | number | boolean | string[] | undefined;
+  setHeader: (name: string, value: PagesReqResHeaderValue) => PagesReqResResponse;
+  appendHeader: (name: string, value: string | readonly string[]) => PagesReqResResponse;
+  getHeader: (name: string) => PagesReqResHeaderValue | undefined;
   status: (code: number) => PagesReqResResponse;
   json: (data: unknown) => void;
   send: (data: unknown) => void;

package/dist/server/pages-node-compat.js

@@ -1,4 +1,5 @@
 import { parseCookieHeader } from "../utils/parse-cookie.js";
+import { getRequestExecutionContext } from "../shims/request-context.js";
 import { readStreamAsTextWithLimit } from "../utils/text-stream.js";
 import { DEFAULT_PAGES_API_BODY_SIZE_LIMIT } from "./pages-body-parser-config.js";
 import { PagesBodyParseError, getMediaType, isJsonMediaType } from "./pages-media-type.js";
@@ -13,6 +14,18 @@ const NO_BODY_RESPONSE_STATUSES = /* @__PURE__ */ new Set([
 	205,
 	304
 ]);
+const HTTP_TOKEN_PATTERN = /^[\^_`a-zA-Z\-0-9!#$%&'*+.|~]+$/;
+const INVALID_HEADER_VALUE_CHAR_PATTERN = /[^\t\x20-\x7e\x80-\xff]/;
+function createNodeTypeError(code, message) {
+	return Object.assign(new TypeError(message), { code });
+}
+function validateAppendedHeader(name, value) {
+	if (typeof name !== "string" || !name || !HTTP_TOKEN_PATTERN.test(name)) throw createNodeTypeError("ERR_INVALID_HTTP_TOKEN", `Header name must be a valid HTTP token ["${String(name)}"]`);
+	for (const item of Array.isArray(value) ? value : [value]) {
+		if (item === void 0) throw createNodeTypeError("ERR_HTTP_INVALID_HEADER_VALUE", `Invalid value "undefined" for header "${name}"`);
+		if (INVALID_HEADER_VALUE_CHAR_PATTERN.test(String(item))) throw createNodeTypeError("ERR_INVALID_CHAR", `Invalid character in header content ["${name}"]`);
+	}
+}
 async function readPagesRequestBodyWithLimit(request, maxBytes) {
 	if (!request.body) return "";
 	return readStreamAsTextWithLimit(request.body, maxBytes, () => {
@@ -120,9 +133,9 @@ var PagesResponseStream = class extends Writable {
 	resolveResponse;
 	rejectResponse;
 	resStatusCode = 200;
-	resHeaders = {};
-	setCookieHeaders = [];
+	resHeaders = Object.create(null);
 	resolved = false;
+	headWritten = false;
 	controller = null;
 	bufferedChunks = [];
 	streamEnded = false;
@@ -150,15 +163,21 @@ var PagesResponseStream = class extends Writable {
 	}
 	writeHead(code, headers) {
 		this.resStatusCode = code;
-		if (headers) for (const [key, value] of Object.entries(headers)) this.setHeaderValue(key, value, { replaceSetCookie: true });
+		if (headers) for (const [key, value] of Object.entries(headers)) this.setHeaderValue(key, value, { append: false });
+		this.headWritten = true;
 		return this;
 	}
 	setHeader(name, value) {
-		this.setHeaderValue(name, value, { replaceSetCookie: true });
+		this.setHeaderValue(name, value, { append: false });
+		return this;
+	}
+	appendHeader(name, value) {
+		if (this.headWritten || this.headersSent) throw Object.assign(/* @__PURE__ */ new Error("Cannot append headers after they are sent to the client"), { code: "ERR_HTTP_HEADERS_SENT" });
+		validateAppendedHeader(name, value);
+		this.setHeaderValue(name, value, { append: true });
 		return this;
 	}
 	getHeader(name) {
-		if (name.toLowerCase() === "set-cookie") return this.setCookieHeaders.length > 0 ? this.setCookieHeaders : void 0;
 		return this.resHeaders[name.toLowerCase()];
 	}
 	status(code) {
@@ -196,9 +215,7 @@ var PagesResponseStream = class extends Writable {
 		return this;
 	}
 	getHeaders() {
-		const headers = { ...this.resHeaders };
-		if (this.setCookieHeaders.length > 0) headers["set-cookie"] = this.setCookieHeaders;
-		return headers;
+		return { ...this.resHeaders };
 	}
 	setPreviewData(data, options = {}) {
 		setPagesPreviewData(this, data, options);
@@ -250,13 +267,15 @@ var PagesResponseStream = class extends Writable {
 		callback(error);
 	}
 	setHeaderValue(name, value, options) {
-		if (name.toLowerCase() === "set-cookie") {
-			const values = Array.isArray(value) ? value.map(String) : [String(value)];
-			if (options.replaceSetCookie) this.setCookieHeaders.length = 0;
-			this.setCookieHeaders.push(...values);
+		const key = name.toLowerCase();
+		const existing = this.resHeaders[key];
+		if (!options.append || existing === void 0) {
+			this.resHeaders[key] = value;
 			return;
 		}
-		this.resHeaders[name.toLowerCase()] = Array.isArray(value) ? value.join(", ") : value;
+		const values = Array.isArray(existing) ? existing : [existing];
+		values.push(...Array.isArray(value) ? value : [value]);
+		this.resHeaders[key] = values;
 	}
 	releasePendingWrite(error) {
 		const callback = this.pendingWrite;
@@ -267,8 +286,8 @@ var PagesResponseStream = class extends Writable {
 		if (this.resolved) return;
 		this.resolved = true;
 		const headers = new Headers();
-		for (const [key, value] of Object.entries(this.resHeaders)) headers.set(key, String(value));
-		for (const cookie of this.setCookieHeaders) headers.append("set-cookie", cookie);
+		for (const [key, value] of Object.entries(this.resHeaders)) if (Array.isArray(value)) for (const item of value) headers.append(key, String(item));
+		else headers.set(key, String(value));
 		if (NO_BODY_RESPONSE_STATUSES.has(this.resStatusCode)) {
 			this.discardBody = true;
 			this.bufferedChunks.length = 0;
@@ -359,10 +378,10 @@ function createPagesReqRes(options) {
 */
 function createPagesApiReqRes(options) {
 	const { req, res, responsePromise } = createPagesReqRes(options);
-	const trustedRevalidateOrigin = options.trustedRevalidateOrigin ?? new URL(options.request.url).origin;
 	return {
 		req,
 		res: Object.assign(res, { async revalidate(urlPath, opts) {
+			const trustedRevalidateOrigin = options.trustedRevalidateOrigin ?? (getRequestExecutionContext()?.dispatchPagesRevalidate ? new URL(options.request.url).origin : void 0);
 			await performOnDemandRevalidate(options.request.headers, urlPath, opts, trustedRevalidateOrigin, options.allowedRevalidateHeaderKeys);
 		} }),
 		responsePromise

package/dist/server/pages-page-data.js

@@ -1,7 +1,7 @@
 import { isUnknownRecord } from "../utils/record.js";
 import { isBotUserAgent } from "../utils/html-limited-bots.js";
-import { normalizePathnameForRouteMatch } from "../routing/utils.js";
 import { NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER } from "./headers.js";
+import { normalizePathnameForRouteMatch } from "../routing/utils.js";
 import { isDangerousScheme } from "../shims/url-safety.js";
 import { extractLocaleFromUrl } from "./pages-i18n.js";
 import { buildNextDataPropsJsonResponse } from "./pages-data-route.js";

package/dist/server/pages-page-handler.js

@@ -1,10 +1,10 @@
 import { preserveFullyBufferedBodyMetadata } from "./fully-buffered-response.js";
 import { closeAfterResponse, closeAfterResponseWithBody, createRequestContext, runWithRequestContext } from "../shims/unified-request-context.js";
 import { PRERENDER_REVALIDATE_HEADER } from "../utils/protocol-headers.js";
+import { NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, VINEXT_CACHE_HEADER, VINEXT_REVALIDATED_CACHE_TAG_HEADER } from "./headers.js";
 import { normalizePathnameForRouteMatch } from "../routing/utils.js";
 import { patternToNextFormat } from "../routing/route-validation.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
-import { NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, VINEXT_CACHE_HEADER, VINEXT_REVALIDATED_CACHE_TAG_HEADER } from "./headers.js";
 import { extractLocaleFromUrl, resolvePagesI18nRequest } from "./pages-i18n.js";
 import { buildNextDataNotFoundResponse, buildNextDataPropsJsonResponse, normalizePagesDataRequest, parseNextDataPathname } from "./pages-data-route.js";
 import { reportRequestError } from "./instrumentation.js";

package/dist/server/pages-page-response.js

@@ -1,6 +1,6 @@
 import { isBotUserAgent } from "../utils/html-limited-bots.js";
-import { getRequestExecutionContext } from "../shims/request-context.js";
 import { NEXTJS_CACHE_HEADER, VINEXT_REVALIDATED_CACHE_TAG_HEADER } from "./headers.js";
+import { getRequestExecutionContext } from "../shims/request-context.js";
 import { reportRequestError } from "./instrumentation.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { markRouteCacheabilityExplicitResponsePolicy } from "../shims/cacheability-classification.js";

package/dist/server/pages-request-pipeline.d.ts

@@ -15,7 +15,7 @@ type PageRouteMatch = {
     dataKind?: PagesRouteDataKind;
   };
 };
-export declare function fetchWorkerFilesystemRoute(request: Request, requestPathname: string, phase: FilesystemRoutePhase, fetchAsset: (request: Request) => Promise<Response>, publicFiles: ReadonlySet<string>, basePath?: string, assetPathPrefix?: string, hadBasePath?: boolean): Promise<Response | false>;
+export declare function fetchWorkerFilesystemRoute(request: Request, requestPathname: string, phase: FilesystemRoutePhase, fetchAsset: (request: Request) => Promise<Response>, publicFiles: ReadonlySet<string>, basePath?: string, assetPathPrefix?: string, pathnameHasBasePath?: boolean): Promise<Response | false>;
 export type MiddlewareResult = {
   continue: boolean;
   /** The pathname matches middleware, irrespective of request `has`/`missing` conditions. */
@@ -54,6 +54,11 @@ export type PagesPipelineDeps = {
   recordCacheability?: boolean;
   rawSearch?: string;
   configMatchPathname?: string;
+  /**
+   * `shouldRestoreLocaleRootTrailingSlash` for the raw request pathname
+   * (basePath included), which the basePath-stripped request no longer shows.
+   */
+  restoreLocaleRootTrailingSlash?: boolean;
   /**
    * Validate an on-demand revalidation credential using the runtime's
    * authoritative build secret. Production adapters must inject the verifier

package/dist/server/pages-request-pipeline.js

@@ -1,19 +1,20 @@
 import { PRERENDER_REVALIDATE_HEADER } from "../utils/protocol-headers.js";
 import { requestContextFromRequest } from "../config/request-context.js";
 import { isExternalUrl } from "../utils/external-url.js";
-import { applyMiddlewareRequestHeaders, matchRedirect, matchRewrite, preserveRedirectDestinationQuery, proxyExternalRequest, sanitizeDestination } from "../config/config-matchers.js";
-import { assetPrefixPathname, isNextStaticPath } from "../utils/asset-prefix.js";
-import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { addBasePathToPathname, hasBasePath } from "../utils/base-path.js";
-import { patternToNextFormat } from "../routing/route-validation.js";
 import { VINEXT_PRERENDER_REWRITTEN_HEADER } from "./headers.js";
 import { methodNotAllowedResponse, notFoundStaticAssetResponse, sanitizeMethodNotAllowedHeaders } from "./http-error-responses.js";
 import { cloneRequestWithUrl, normalizeTrailingSlash } from "./request-pipeline.js";
+import { applyMiddlewareRequestHeaders, matchRedirect, matchRewrite, preserveRedirectDestinationQuery, proxyExternalRequest, sanitizeDestination } from "../config/config-matchers.js";
+import { assetPrefixPathname, isAssetPrefixBuildAsset, isNextStaticPath } from "../utils/asset-prefix.js";
+import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
+import { patternToNextFormat } from "../routing/route-validation.js";
 import { detectPathnameLocale, normalizeDefaultLocalePathname, stripI18nLocaleForApiRoute } from "./pages-i18n.js";
 import { buildMiddlewarePrefetchSkipResponse } from "./pages-data-route.js";
 import { markRouteCacheabilityDynamic } from "../shims/cacheability-classification.js";
 import { isOnDemandRevalidateRequest } from "./revalidation-request.js";
 import { mergeRewriteQuery } from "../utils/query.js";
+import { withExternalRewriteResponseHeaders } from "./middleware-response-headers.js";
 import { setFrameworkRequestRoute } from "./request-tracing.js";
 import { applyConfigHeadersToHeaderRecord } from "./config-headers.js";
 import { finalizeMissingStaticAssetResponse, mergeHeaders } from "./worker-utils.js";
@@ -33,7 +34,7 @@ function headersFromRecord(record) {
 	else headers.set(name, value);
 	return headers;
 }
-async function fetchWorkerFilesystemRoute(request, requestPathname, phase, fetchAsset, publicFiles, basePath = "", assetPathPrefix = "", hadBasePath = true) {
+async function fetchWorkerFilesystemRoute(request, requestPathname, phase, fetchAsset, publicFiles, basePath = "", assetPathPrefix = "", pathnameHasBasePath = true) {
 	const isRetrievalMethod = request.method === "GET" || request.method === "HEAD";
 	const assetUrl = new URL(request.url);
 	assetUrl.pathname = requestPathname;
@@ -46,7 +47,8 @@ async function fetchWorkerFilesystemRoute(request, requestPathname, phase, fetch
 	} catch {
 		return false;
 	}
-	const isPublicFile = (phase !== "direct" || hadBasePath) && publicFiles.has(publicFileKey);
+	if (!pathnameHasBasePath && !isAssetPrefixBuildAsset(decodedAssetUrl.pathname, assetPathPrefix)) return false;
+	const isPublicFile = pathnameHasBasePath && publicFiles.has(publicFileKey);
 	if (!isPublicFile && (requestPathname === "/api" || requestPathname.startsWith("/api/"))) return false;
 	if (phase === "direct" && isRetrievalMethod && !isPublicFile) return false;
 	if (!isPublicFile && !isNextStaticPath(decodedAssetUrl.pathname, basePath, assetPathPrefix)) return false;
@@ -79,7 +81,7 @@ function wrapMiddlewareWithBasePath(runMiddleware, basePath, hadBasePath) {
 	return (request, ctx, opts) => {
 		const mwUrl = new URL(request.url);
 		mwUrl.pathname = addBasePathToPathname(mwUrl.pathname, basePath);
-		return runMiddleware(new Request(mwUrl, request), ctx, opts);
+		return runMiddleware(cloneRequestWithUrl(request, mwUrl.toString()), ctx, opts);
 	};
 }
 /**
@@ -118,6 +120,10 @@ async function runPagesRequest(request, deps) {
 	const reqCtx = requestContextFromRequest(request);
 	const requestHostname = i18nConfig ? url.hostname : "";
 	const requestConfigMatchPathname = i18nConfig ? normalizeDefaultLocalePathname(requestConfigPathname, i18nConfig, { hostname: requestHostname }) : requestConfigPathname;
+	const requestHeaderMatchPathname = i18nConfig ? normalizeDefaultLocalePathname(requestConfigPathname, i18nConfig, {
+		hostname: requestHostname,
+		restoreRootTrailingSlash: deps.restoreLocaleRootTrailingSlash
+	}) : requestConfigPathname;
 	if (configRedirects.length) {
 		const redirect = matchRedirect(requestConfigMatchPathname, configRedirects, reqCtx, basePathState, conditionalRedirectCacheability);
 		if (redirect) {
@@ -141,14 +147,16 @@ async function runPagesRequest(request, deps) {
 		hadBasePath: resolvedPathnameHasBasePath
 	});
 	const middlewareHeaders = {};
+	let middlewareCookies = [];
 	const mergeConfigHeadersIntoEarlyResponse = (response) => {
 		if (configHeaders.length === 0) return response;
 		const matchedConfigHeaders = {};
 		applyConfigHeadersToHeaderRecord(matchedConfigHeaders, {
 			configHeaders,
-			pathname: requestConfigMatchPathname,
+			pathname: requestHeaderMatchPathname,
 			requestContext: reqCtx,
 			basePathState,
+			middlewareHeaders: response.headers,
 			recordCacheability: deps.recordCacheability
 		});
 		return mergeHeaders(response, matchedConfigHeaders);
@@ -210,6 +218,8 @@ async function runPagesRequest(request, deps) {
 			else if (existing) middlewareHeaders[key] = [existing, value];
 			else middlewareHeaders[key] = [value];
 		} else middlewareHeaders[key] = value;
+		const stagedCookies = middlewareHeaders["set-cookie"];
+		if (Array.isArray(stagedCookies)) middlewareCookies = [...stagedCookies];
 		if (result.rewriteUrl) {
 			resolvedUrl = result.rewriteUrl;
 			resolvedPathnameIsRequestPathname = false;
@@ -249,26 +259,24 @@ async function runPagesRequest(request, deps) {
 	};
 	if (configHeaders.length) applyConfigHeadersToHeaderRecord(middlewareHeaders, {
 		configHeaders,
-		pathname: requestConfigMatchPathname,
+		pathname: requestHeaderMatchPathname,
 		requestContext: reqCtx,
 		basePathState,
 		recordCacheability: deps.recordCacheability
 	});
-	if (isExternalUrl(resolvedUrl)) {
-		const proxyResponse = await proxyExternal(request, resolvedUrl);
-		return {
-			type: "response",
-			response: mergeHeaders(proxyResponse, middlewareHeaders, void 0)
-		};
-	}
+	const proxyConfigRewrite = async (destination) => ({
+		type: "response",
+		response: withExternalRewriteResponseHeaders(await proxyExternal(request, destination), new Headers(), middlewareCookies)
+	});
+	if (isExternalUrl(resolvedUrl)) return {
+		type: "response",
+		response: withExternalRewriteResponseHeaders(await proxyExternal(request, resolvedUrl), headersFromRecord(middlewareHeaders), middlewareCookies)
+	};
 	let configRewriteFired = false;
 	for (const rewrite of configRewrites.beforeFiles ?? []) {
 		const rewritten = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), currentBasePathState(), configSourcePathname(), conditionalRewriteCacheability);
 		if (rewritten) {
-			if (isExternalUrl(rewritten)) return {
-				type: "response",
-				response: await proxyExternal(request, rewritten)
-			};
+			if (isExternalUrl(rewritten)) return proxyConfigRewrite(rewritten);
 			resolvedUrl = mergeRewriteQuery(resolvedUrl, rewritten);
 			resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
 			resolvedPathnameIsRequestPathname = false;
@@ -279,13 +287,13 @@ async function runPagesRequest(request, deps) {
 	const initialFilesystemResult = await serveFilesystemRoute(resolvedPathname, resolvedPathnameIsRequestPathname ? "direct" : "beforeFiles");
 	if (initialFilesystemResult) return initialFilesystemResult;
 	const isMissingBuildAsset = () => isNextStaticPath(resolvedPathname, "", assetPrefixPathname(deps.assetPrefix ?? ""));
-	const isOutsideBasePathUnclaimed = () => basePath && !hadBasePath && !configRewriteFired;
+	const isOutsideBasePathUnclaimed = () => basePath && !resolvedPathnameHasBasePath;
 	const outOfBasePathNotFound = () => ({
 		type: "response",
-		response: isMissingBuildAsset() ? notFoundStaticAssetResponse(headersFromRecord(middlewareHeaders)) : new Response("This page could not be found", {
+		response: isMissingBuildAsset() ? notFoundStaticAssetResponse(headersFromRecord(middlewareHeaders)) : mergeHeaders(new Response("This page could not be found", {
 			status: 404,
 			headers: { "Content-Type": "text/html; charset=utf-8" }
-		})
+		}), middlewareHeaders)
 	});
 	const handleResolvedApiRoute = async () => {
 		if (isOutsideBasePathUnclaimed()) return null;
@@ -327,10 +335,7 @@ async function runPagesRequest(request, deps) {
 	if (!pageMatch || pageMatch.route.isDynamic) for (const rewrite of configRewrites.afterFiles ?? []) {
 		const rewritten = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), currentBasePathState(), configSourcePathname(), conditionalRewriteCacheability);
 		if (rewritten) {
-			if (isExternalUrl(rewritten)) return {
-				type: "response",
-				response: await proxyExternal(request, rewritten)
-			};
+			if (isExternalUrl(rewritten)) return proxyConfigRewrite(rewritten);
 			resolvedUrl = mergeRewriteQuery(resolvedUrl, rewritten);
 			resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
 			resolvedPathnameIsRequestPathname = false;
@@ -355,10 +360,7 @@ async function runPagesRequest(request, deps) {
 		if ((isOutsideBasePathUnclaimed() || isDataReq || isDataRequest) && !renderPageMatch && configRewrites.fallback?.length) for (const rewrite of configRewrites.fallback) {
 			const fallbackRewrite = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), currentBasePathState(), configSourcePathname(), conditionalRewriteCacheability);
 			if (!fallbackRewrite) continue;
-			if (isExternalUrl(fallbackRewrite)) return {
-				type: "response",
-				response: await proxyExternal(request, fallbackRewrite)
-			};
+			if (isExternalUrl(fallbackRewrite)) return proxyConfigRewrite(fallbackRewrite);
 			resolvedUrl = mergeRewriteQuery(resolvedUrl, fallbackRewrite);
 			resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
 			resolvedPathnameIsRequestPathname = false;
@@ -384,10 +386,7 @@ async function runPagesRequest(request, deps) {
 		if (response.status === 404 && shouldDeferErrorPageOnMiss && configRewrites.fallback?.length) for (const rewrite of configRewrites.fallback) {
 			const fallbackRewrite = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), currentBasePathState(), configSourcePathname(), conditionalRewriteCacheability);
 			if (!fallbackRewrite) continue;
-			if (isExternalUrl(fallbackRewrite)) return {
-				type: "response",
-				response: await proxyExternal(request, fallbackRewrite)
-			};
+			if (isExternalUrl(fallbackRewrite)) return proxyConfigRewrite(fallbackRewrite);
 			resolvedUrl = mergeRewriteQuery(resolvedUrl, fallbackRewrite);
 			resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
 			resolvedPathnameIsRequestPathname = false;
@@ -437,10 +436,7 @@ async function runPagesRequest(request, deps) {
 	if (!devPageMatch && configRewrites.fallback?.length) for (const rewrite of configRewrites.fallback) {
 		const fallbackRewrite = matchRewrite(configSourcePathname(), [rewrite], rewriteRequestContext(), currentBasePathState(), configSourcePathname(), conditionalRewriteCacheability);
 		if (!fallbackRewrite) continue;
-		if (isExternalUrl(fallbackRewrite)) return {
-			type: "response",
-			response: await proxyExternal(request, fallbackRewrite)
-		};
+		if (isExternalUrl(fallbackRewrite)) return proxyConfigRewrite(fallbackRewrite);
 		resolvedUrl = mergeRewriteQuery(resolvedUrl, fallbackRewrite);
 		resolvedPathname = pathnameForResolvedUrl(resolvedUrl);
 		resolvedPathnameIsRequestPathname = false;