vinext 1.2.0 → 1.3.0

package/dist/server/pages-request-stage-entry.js

@@ -1,13 +1,13 @@
 import { VINEXT_PRERENDER_SECRET_HEADER, VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
 import { requestContextFromRequest } from "../config/request-context.js";
-import { assetPrefixPathname, isNextStaticPath } from "../utils/asset-prefix.js";
-import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
-import { runWithExecutionContext } from "../shims/request-context.js";
 import { VINEXT_CACHEABILITY_PROBE_QUERY_PARAM, VINEXT_EXPECTED_WORKER_VERSION_HEADER } from "./headers.js";
 import { notFoundStaticAssetResponse } from "./http-error-responses.js";
 import { attachRequestCfMetadata, cloneRequestWithHeaders, cloneRequestWithUrl, filterInternalHeaders, guardProtocolRelativeUrl } from "./request-pipeline.js";
-import { normalizeDefaultLocalePathname } from "./pages-i18n.js";
+import { assetPrefixPathname, isNextStaticPath } from "../utils/asset-prefix.js";
+import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
+import { runWithExecutionContext } from "../shims/request-context.js";
+import { normalizeDefaultLocalePathname, shouldRestoreLocaleRootTrailingSlash } from "./pages-i18n.js";
 import { isNextDataPathname } from "./pages-data-route.js";
 import { getExplicitCdnCacheAdapter } from "../shims/cdn-cache-state.js";
 import { CACHEABILITY_REQUEST_STATE } from "../shims/cacheability-classification.js";
@@ -48,6 +48,10 @@ const pagesRequestStagePrerenderSecret = pagesEntry.prerenderSecret ?? null;
 const basePath = vinextConfig?.basePath ?? "";
 const assetPathPrefix = assetPrefixPathname(vinextConfig?.assetPrefix ?? "");
 const trailingSlash = vinextConfig?.trailingSlash ?? false;
+const localeRootTrailingSlashConfig = {
+	trailingSlash,
+	skipProxyUrlNormalize: vinextConfig?.skipProxyUrlNormalize
+};
 const skipTrailingSlashRedirect = vinextConfig?.skipTrailingSlashRedirect ?? false;
 const i18nConfig = vinextConfig?.i18n ?? null;
 const configRedirects = vinextConfig?.redirects ?? [];
@@ -88,7 +92,7 @@ function handleRequestStageLocally(request, env, ctx, dispatchResponseStage) {
 function handleRequest(request, env, platformCtx, dispatchResponseStage, forceCacheBypass, defaultHostRuntime, assets) {
 	const url = new URL(request.url);
 	const trace = async () => {
-		await pagesEntry.__ensureInstrumentation?.();
+		await pagesEntry.__ensureInstrumentation?.(platformCtx);
 		return traceFrameworkRequest({
 			callback: () => handleRequestImpl(request, env, platformCtx, dispatchResponseStage, forceCacheBypass, defaultHostRuntime, assets),
 			getStatus: (response) => response?.status,
@@ -128,7 +132,7 @@ async function handleRequestImpl(request, env, platformCtx, dispatchResponseStag
 				probeRoute = readWorkerCacheabilityProbeRoute(request);
 				const probeUrl = new URL(request.url);
 				probeUrl.searchParams.delete(VINEXT_CACHEABILITY_PROBE_QUERY_PARAM);
-				request = new Request(probeUrl, request);
+				request = cloneRequestWithUrl(request, probeUrl.href);
 			}
 		}
 		let responseStageDispatched = false;
@@ -175,6 +179,7 @@ async function handleRequestImpl(request, env, platformCtx, dispatchResponseStag
 		}
 		const missingBuildAsset = isNextStaticPath(pathname, basePath, assetPathPrefix);
 		const hadBasePath = !basePath || hasBasePath(pathname, basePath);
+		const restoreLocaleRootTrailingSlash = shouldRestoreLocaleRootTrailingSlash(pathname, localeRootTrailingSlashConfig);
 		{
 			const stripped = stripBasePath(pathname, basePath);
 			if (stripped !== pathname) {
@@ -193,7 +198,10 @@ async function handleRequestImpl(request, env, platformCtx, dispatchResponseStag
 			request = dataNorm.request;
 			pathname = dataNorm.normalizedPathname;
 		}
-		const responseStagePolicyPathname = i18nConfig ? normalizeDefaultLocalePathname(pathname, i18nConfig, { hostname: url.hostname }) : pathname;
+		const responseStagePolicyPathname = i18nConfig ? normalizeDefaultLocalePathname(pathname, i18nConfig, {
+			hostname: url.hostname,
+			restoreRootTrailingSlash: restoreLocaleRootTrailingSlash
+		}) : pathname;
 		const responseStagePolicyHeaders = resolveResponseStageCachePolicy({
 			basePathState: {
 				basePath,
@@ -219,6 +227,7 @@ async function handleRequestImpl(request, env, platformCtx, dispatchResponseStag
 			hasMiddleware,
 			ctx,
 			recordCacheability: forceCacheBypass,
+			restoreLocaleRootTrailingSlash,
 			middlewareRequest: isDataReq && vinextConfig?.skipProxyUrlNormalize ? middlewareRequest : void 0,
 			dataNotFoundResponse: vinextConfig?.skipProxyUrlNormalize ? dataNorm.notFoundResponse : null,
 			authorizeOnDemandRevalidate: typeof authorizeOnDemandRevalidate === "function" ? authorizeOnDemandRevalidate : void 0,
@@ -320,7 +329,7 @@ async function handleRequestImpl(request, env, platformCtx, dispatchResponseStag
 						fetchPublicFile: (sourceRequest) => resolvePublicImageSource(sourceRequest, assets)
 					}), allowedWidths, imageConfig);
 				}
-				return fetchWorkerFilesystemRoute(filesystemRequest, requestPathname, phase, (assetRequest) => Promise.resolve(assets.fetch(assetRequest)), publicFiles, basePath, assetPathPrefix, hadBasePath);
+				return fetchWorkerFilesystemRoute(filesystemRequest, requestPathname, phase, (assetRequest) => Promise.resolve(assets.fetch(assetRequest)), publicFiles, basePath, assetPathPrefix, resolvedPathnameHasBasePath);
 			}
 		};
 		const resolvePublicImageSource = async (sourceRequest, sourceAssets) => {
@@ -333,6 +342,7 @@ async function handleRequestImpl(request, env, platformCtx, dispatchResponseStag
 			const sourceResult = await runPagesRequest(attachRequestCfMetadata(new Request(new URL(sourcePathname + sourceUrl.search, sourceUrl), { signal: sourceRequest.signal }), sourceRequest), {
 				...deps,
 				hadBasePath: sourceHadBasePath,
+				restoreLocaleRootTrailingSlash: shouldRestoreLocaleRootTrailingSlash(sourceUrl.pathname, localeRootTrailingSlashConfig),
 				isDataReq: false,
 				isDataRequest: false,
 				middlewareRequest: void 0,
@@ -341,9 +351,9 @@ async function handleRequestImpl(request, env, platformCtx, dispatchResponseStag
 				runMiddleware: typeof runMiddleware === "function" ? wrapMiddlewareWithBasePath(runMiddleware, basePath, sourceHadBasePath) : null,
 				renderPage: null,
 				handleApi: null,
-				serveFilesystemRoute: async (candidate, _stagedHeaders, phase, _resolvedUrl, filesystemRequest) => {
+				serveFilesystemRoute: async (candidate, _stagedHeaders, phase, _resolvedUrl, filesystemRequest, candidateHasBasePath) => {
 					if (isImageOptimizationPath(candidate)) return false;
-					const asset = await fetchWorkerFilesystemRoute(filesystemRequest, candidate, phase, (assetRequest) => Promise.resolve(sourceAssets.fetch(assetRequest)), publicFiles, basePath, assetPathPrefix, sourceHadBasePath);
+					const asset = await fetchWorkerFilesystemRoute(filesystemRequest, candidate, phase, (assetRequest) => Promise.resolve(sourceAssets.fetch(assetRequest)), publicFiles, basePath, assetPathPrefix, candidateHasBasePath);
 					if (asset === false) return false;
 					sourceAsset = asset;
 					return new Response(null);

package/dist/server/pages-response-stage-entry.js

@@ -36,7 +36,7 @@ async function renderPagesResponse(request, env, platformCtx, props, stagedHeade
 	if (!isPagesResponseStageProps(props)) return new Response("Invalid vinext Pages response stage", { status: 400 });
 	if (props.buildId !== pagesEntry.buildId) return new Response("Vinext Pages response stage deployment mismatch", { status: 409 });
 	if (props.requestHost !== new URL(request.url).host) return new Response("Invalid vinext Pages response stage", { status: 400 });
-	await pagesEntry.__ensureInstrumentation?.();
+	await pagesEntry.__ensureInstrumentation?.(platformCtx);
 	registerConfiguredImageOptimizer(env);
 	const renderHeaders = new Headers(stagedHeaders ?? props.stagedHeaders ?? []);
 	renderHeaders.delete("Content-Length");

package/dist/server/pages-revalidate.js

@@ -1,17 +1,18 @@
 import { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
-import { getRequestExecutionContext } from "../shims/request-context.js";
 import { VINEXT_REVALIDATED_CACHE_TAG_HEADER } from "./headers.js";
+import { getRequestExecutionContext } from "../shims/request-context.js";
+import { resolveRequestHost, resolveRequestProtocol } from "./proxy-trust.js";
 import { normalizeDomainHostname } from "../utils/domain-locale.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { getRevalidateSecret, isOnDemandRevalidateRequest } from "./revalidation-request.js";
 import "./isr-cache.js";
-import { resolveRequestHost, resolveRequestProtocol } from "./proxy-trust.js";
 //#region src/server/pages-revalidate.ts
 async function performOnDemandRevalidate(source, urlPath, opts = {}, trustedOrigin, allowedRevalidateHeaderKeys = [], dev = false) {
 	if (typeof urlPath !== "string" || !urlPath.startsWith("/")) throw new Error(`Invalid urlPath provided to revalidate(), must be a path e.g. /blog/post-1, received ${urlPath}`);
 	if (isSourceRevalidationRequest(source)) throw new Error(`Cannot revalidate ${urlPath} from an internal revalidation request`);
 	const executionContext = getRequestExecutionContext();
 	const dispatchRevalidate = executionContext?.dispatchPagesRevalidate;
+	if (!dispatchRevalidate && !trustedOrigin) throw new Error(`Cannot revalidate ${urlPath}: no in-process dispatcher or server-owned origin is available`);
 	const target = createRevalidateTarget(source, urlPath, trustedOrigin);
 	const headers = { [PRERENDER_REVALIDATE_HEADER]: getRevalidateSecret() };
 	if (trustedOrigin && !dispatchRevalidate) {

package/dist/server/pages-router-entry.js

@@ -1,6 +1,6 @@
-import { runWithExecutionContext } from "../shims/request-context.js";
 import { VINEXT_CACHEABILITY_PROBE_HEADER, VINEXT_CACHEABILITY_PROBE_QUERY_PARAM } from "./headers.js";
 import { cloneRequestWithHeaders, cloneRequestWithUrl } from "./request-pipeline.js";
+import { runWithExecutionContext } from "../shims/request-context.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { validateCdnRequest } from "./cache-control.js";
 import { createWorkerRevalidationContext } from "./worker-revalidation-context.js";
@@ -20,7 +20,7 @@ async function handleSingleStageRequest(request, env, platformCtx) {
 	let ctx = createWorkerPrerenderDiscoveryContext(ctxWithRevalidation, request, pagesRequestStagePrerenderSecret);
 	const readinessResponse = createWorkerPrerenderReadinessResponse(ctx, request);
 	if (readinessResponse) {
-		if (readinessResponse.status === 204) await Promise.all([__ensureInstrumentation(), __ensureInstrumentation$1()]);
+		if (readinessResponse.status === 204) await Promise.all([__ensureInstrumentation(ctx), __ensureInstrumentation$1(ctx)]);
 		return await validateCdnRequest(request) ?? readinessResponse;
 	}
 	const isClientBuildFile = isPagesClientBuildFileRequest(request, env, ctx);

package/dist/server/prod-server.d.ts

@@ -3,7 +3,7 @@ import { negotiateEncoding } from "./accept-encoding.js";
 import { StaticFileCache } from "./static-file-cache.js";
 import { resolveRequestHost, trustProxy, trustedHosts } from "./proxy-trust.js";
 import { COMPRESS_THRESHOLD, isCompressibleContentType } from "./response-compression.js";
-import { IncomingMessage, ServerResponse } from "node:http";
+import { IncomingMessage, Server, ServerResponse } from "node:http";
 //#region src/server/prod-server.d.ts
 /**
  * Import a built server entry module (App Router RSC entry or Pages Router
@@ -127,7 +127,7 @@ declare function waitForNodeResponseCompletion(res: ServerResponse): Promise<voi
  * Pages Router (dist/server/entry.js) and configures the appropriate handler.
  */
 export declare function startProdServer(options?: ProdServerOptions): Promise<{
-  server: import("node:http").Server<typeof IncomingMessage, typeof ServerResponse>;
+  server: Server<typeof IncomingMessage, typeof ServerResponse>;
   port: number;
 }>;
 type AppRouterPrerenderSeeder = (serverDir: string) => Promise<number>;

package/dist/server/prod-server.js

@@ -1,22 +1,23 @@
 import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { isUnknownRecord } from "../utils/record.js";
 import { VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER } from "../utils/protocol-headers.js";
-import { ASSET_PREFIX_URL_DIR, assetPrefixPathname, isAbsoluteAssetPrefix } from "../utils/asset-prefix.js";
-import { StaticFileCache, contentTypeForPath, etagFromFilenameHash } from "./static-file-cache.js";
-import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { VINEXT_PRERENDER_RENDER_ERROR_HEADER, VINEXT_PRERENDER_SPECIAL_ERROR_HEADER } from "./headers.js";
-import { normalizePath } from "./normalize-path.js";
 import { notFoundResponse } from "./http-error-responses.js";
 import { getRepeatedSlashRedirect, isOpenRedirectShaped, sendRepeatedSlashRedirect } from "./open-redirect.js";
 import { readStaticFileSignal } from "./static-file-signal.js";
 import { canonicalizeRequestPathname, filterInternalHeaders } from "./request-pipeline.js";
+import { ASSET_PREFIX_URL_DIR, assetPrefixPathname, isAbsoluteAssetPrefix, isAssetPrefixBuildAsset } from "../utils/asset-prefix.js";
+import { StaticFileCache, contentTypeForPath, etagFromFilenameHash } from "./static-file-cache.js";
+import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
+import { resolveRequestHost, resolveRequestProtocol, resolveTrustedForwardedHost, trustProxy, trustedHosts } from "./proxy-trust.js";
+import { normalizePath } from "./normalize-path.js";
+import { shouldRestoreLocaleRootTrailingSlash } from "./pages-i18n.js";
 import { buildNextDataNotFoundResponse, encodeUrlParserIgnoredCharacters, isNextDataPathname, normalizeNextDataPagePathname, parseNextDataPathname, shouldAddTrailingSlashToPagesDataPath, urlParserCreatesPagesDataPath } from "./pages-data-route.js";
 import { buildCacheStateHeaders } from "./cache-headers.js";
 import { parseHttpDate } from "./http-date.js";
 import { evaluateStaticPreconditions } from "./http-conditional.js";
 import { setPagesClientAssets } from "./pages-client-assets.js";
-import { resolveRequestHost, resolveRequestProtocol, trustProxy, trustedHosts } from "./proxy-trust.js";
 import { signalFromNodeResponse } from "./node-response-signal.js";
 import { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, IMAGE_RESPONSE_CACHE_STATE, INVALID_IMAGE_SOURCE_MESSAGE, isImageOptimizationPath, isImageSourceBodyStatus, isSafeImageContentType, parseImageParams, readImageOptimizationSignal } from "./image-optimization.js";
 import { installSocketErrorBackstop } from "./socket-error-backstop.js";
@@ -378,6 +379,19 @@ function isVinextStreamedHtmlResponse(response) {
 function isVinextStreamedApiResponse(response) {
 	return response.__vinextStreamedApiResponse === true;
 }
+function disablePrerenderKeepAliveTimeout(server, purpose) {
+	if (purpose === "prerender") server.keepAliveTimeout = 0;
+}
+function listen(server, port, host) {
+	return new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(port, host, () => {
+			server.off("error", reject);
+			const addr = server.address();
+			resolve(typeof addr === "object" && addr ? addr.port : port);
+		});
+	});
+}
 function logProdServerStarted(host, port, purpose) {
 	const url = `http://${host}:${port}`;
 	if (purpose === "prerender") {
@@ -925,14 +939,16 @@ async function startProdServer(options = {}) {
 		silent
 	});
 }
-function createNodeExecutionContext(trustedRevalidateOrigin) {
+function createNodeExecutionContext(trustedRevalidateOrigin, { middlewareOrigin, requestSignal } = {}) {
 	return {
 		hostRuntime: "node",
+		requestSignal,
 		waitUntil(promise) {
 			Promise.resolve(promise).catch(() => {});
 		},
 		passThroughOnException() {},
-		trustedRevalidateOrigin
+		trustedRevalidateOrigin,
+		middlewareOrigin
 	};
 }
 /**
@@ -953,8 +969,26 @@ function markPrerenderSpecialError(response, marker) {
 	});
 }
 function resolveTrustedNodeRevalidateOrigin(req, configuredHost, configuredPort) {
+	return `http://${resolveNodeServerHost(req, configuredHost, configuredPort)}`;
+}
+/**
+* The origin middleware runs against. The Host header is client-controlled,
+* so, like Next.js, which builds the middleware URL from its own hostname and
+* port, it never counts as the server's origin. Otherwise a client could send
+* the host of an external middleware rewrite target and turn that rewrite into
+* an internal one, skipping middleware's checks for the target path. A trusted
+* `X-Forwarded-Host` is operator-approved, so it keeps the request origin, and
+* rewrites to that host stay internal.
+*/
+function resolveNodeMiddlewareOrigin(req, requestUrl, configuredHost, configuredPort) {
+	const url = new URL(requestUrl);
+	if (resolveTrustedForwardedHost(req) !== void 0) return url.origin;
+	return `${url.protocol}//${resolveNodeServerHost(req, configuredHost, configuredPort)}`;
+}
+/** The `host:port` this server is reachable at locally. */
+function resolveNodeServerHost(req, configuredHost, configuredPort) {
 	const port = req.socket.localPort ?? configuredPort;
-	return `http://${normalizeInternalFetchHost(configuredHost)}:${port}`;
+	return `${normalizeInternalFetchHost(configuredHost)}:${port}`;
 }
 function normalizeInternalFetchHost(host) {
 	if (!host || host === "0.0.0.0" || host === "::") return "localhost";
@@ -1058,6 +1092,7 @@ function installPagesClientAssets(options) {
 		clientEntry: metadata.clientEntryFile,
 		appBootstrapPreinitModules: metadata.appBootstrapPreinitModules,
 		ssrManifest: Object.keys(ssrManifest).length > 0 ? ssrManifest : void 0,
+		sharedChunks: metadata.sharedChunks,
 		cssGraph: metadata.cssGraph,
 		lazyChunks: metadata.lazyChunks,
 		dynamicPreloads: metadata.dynamicPreloads,
@@ -1154,7 +1189,7 @@ async function startAppRouterServer(options) {
 		const assetLookupPath = sourcePathname !== null ? resolveAppRouterAssetPath(sourcePathname, appAssetPathPrefix, appRouterAssetPrefix) : null;
 		if (assetLookupPath && await serveSource(assetLookupPath)) return;
 		if (sourcePathname !== null) {
-			const sourceResponse = await rscHandler(new Request(sourceUrl, { signal: request.signal }), createNodeExecutionContext(resolveTrustedNodeRevalidateOrigin(req, host, port)));
+			const sourceResponse = await rscHandler(new Request(sourceUrl, { signal: request.signal }), createNodeExecutionContext(resolveTrustedNodeRevalidateOrigin(req, host, port), { middlewareOrigin: resolveNodeMiddlewareOrigin(req, request.url, host, port) }));
 			const sourceSignal = isImageSourceBodyStatus(sourceResponse.status) ? readStaticFileSignal(sourceResponse) : null;
 			cancelResponseBody(sourceResponse, request.signal.reason);
 			if (request.signal.aborted) return;
@@ -1211,8 +1246,12 @@ async function startAppRouterServer(options) {
 			if (clientBuildFile && await tryServeStatic(req, res, clientDir, clientBuildFile, compress, staticCache)) return;
 		}
 		try {
-			const request = nodeToWebRequest(req, rawUrl, prerenderSecret, appRouterI18nConfig, appRouterAuthorizeOnDemandRevalidate, signalFromNodeResponse(res));
-			const ctx = createNodeExecutionContext(resolveTrustedNodeRevalidateOrigin(req, host, port));
+			const signal = signalFromNodeResponse(res);
+			const request = nodeToWebRequest(req, rawUrl, prerenderSecret, appRouterI18nConfig, appRouterAuthorizeOnDemandRevalidate, signal);
+			const ctx = createNodeExecutionContext(resolveTrustedNodeRevalidateOrigin(req, host, port), {
+				middlewareOrigin: resolveNodeMiddlewareOrigin(req, request.url, host, port),
+				requestSignal: signal
+			});
 			const recorded = {};
 			if (purpose === "prerender") ctx.recordPrerenderSpecialError = (marker) => {
 				recorded.marker = marker;
@@ -1282,18 +1321,12 @@ async function startAppRouterServer(options) {
 	const server = createServer((req, res) => {
 		runWithServerEntryRequire(rscEntryRequire, () => handleRequest(req, res));
 	});
-	await new Promise((resolve) => {
-		server.listen(port, host, () => {
-			const addr = server.address();
-			const actualPort = typeof addr === "object" && addr ? addr.port : port;
-			if (!silent) logProdServerStarted(host, actualPort, purpose);
-			resolve();
-		});
-	});
-	const addr = server.address();
+	disablePrerenderKeepAliveTimeout(server, purpose);
+	const actualPort = await listen(server, port, host);
+	if (!silent) logProdServerStarted(host, actualPort, purpose);
 	return {
 		server,
-		port: typeof addr === "object" && addr ? addr.port : port
+		port: actualPort
 	};
 }
 function isPagesServerEntryPageRoute(value) {
@@ -1323,18 +1356,12 @@ async function startPagesRouterServer(options) {
 	const { port, host, purpose, silent } = options;
 	const handler = await createPagesRouterRequestHandler(options);
 	const server = createServer(handler);
-	await new Promise((resolve) => {
-		server.listen(port, host, () => {
-			const addr = server.address();
-			const actualPort = typeof addr === "object" && addr ? addr.port : port;
-			if (!silent) logProdServerStarted(host, actualPort, purpose);
-			resolve();
-		});
-	});
-	const addr = server.address();
+	disablePrerenderKeepAliveTimeout(server, purpose);
+	const actualPort = await listen(server, port, host);
+	if (!silent) logProdServerStarted(host, actualPort, purpose);
 	return {
 		server,
-		port: typeof addr === "object" && addr ? addr.port : port
+		port: actualPort
 	};
 }
 /**
@@ -1481,6 +1508,10 @@ async function createPagesRouterRequestHandler(options) {
 		}
 		try {
 			const hadBasePath = !basePath || hasBasePath(requestPathname, basePath);
+			const restoreLocaleRootTrailingSlash = shouldRestoreLocaleRootTrailingSlash(requestPathname, {
+				trailingSlash,
+				skipProxyUrlNormalize
+			});
 			let configMatchPathname = stripBasePath(requestPathname, basePath);
 			{
 				const strippedPathname = stripBasePath(pathname, basePath);
@@ -1543,6 +1574,8 @@ async function createPagesRouterRequestHandler(options) {
 				duplex: hasBody ? "half" : void 0
 			});
 			const middlewareRequest = isDataReq && skipProxyUrlNormalize ? new Request(new URL(originalRenderUrl, webRequest.url), webRequest) : void 0;
+			const middlewareCtx = createNodeExecutionContext(void 0, { middlewareOrigin: resolveNodeMiddlewareOrigin(req, webRequest.url, host, port) });
+			const runNodeMiddleware = typeof runMiddleware === "function" ? (request, _ctx, opts) => runMiddleware(request, middlewareCtx, opts) : null;
 			const resolvePublicImageSource = async (sourceUrl) => {
 				const rawSourcePathname = sourceUrl.pathname;
 				if (getRepeatedSlashRedirect(rawSourcePathname) || isOpenRedirectShaped(rawSourcePathname)) return null;
@@ -1561,11 +1594,15 @@ async function createPagesRouterRequestHandler(options) {
 					recordCacheability: false,
 					rawSearch: sourceUrl.search,
 					configMatchPathname: strippedSourcePathname,
-					runMiddleware: typeof runMiddleware === "function" ? wrapMiddlewareWithBasePath(runMiddleware, basePath, sourceHadBasePath) : null,
+					restoreLocaleRootTrailingSlash: shouldRestoreLocaleRootTrailingSlash(sourceRequestPathname, {
+						trailingSlash,
+						skipProxyUrlNormalize
+					}),
+					runMiddleware: runNodeMiddleware ? wrapMiddlewareWithBasePath(runNodeMiddleware, basePath, sourceHadBasePath) : null,
 					renderPage: null,
 					handleApi: null,
-					serveFilesystemRoute: async (candidate, _stagedHeaders, phase) => {
-						if (isImageOptimizationPath(candidate) || isPagesFilesystemExcludedPath(candidate, phase)) return false;
+					serveFilesystemRoute: async (candidate, _stagedHeaders, phase, _resolvedUrl, _request, candidateHasBasePath) => {
+						if (!candidateHasBasePath && !isAssetPrefixBuildAsset(candidate, pagesAssetPathPrefix) || isImageOptimizationPath(candidate) || isPagesFilesystemExcludedPath(candidate, phase)) return false;
 						const lookupPath = staticCacheLookupPath(candidate);
 						if (lookupPath === null || lookupPath === "/" || !staticCache.lookup(lookupPath)) return false;
 						sourcePath = candidate;
@@ -1595,9 +1632,10 @@ async function createPagesRouterRequestHandler(options) {
 				rawSearch: rawQs,
 				authorizeOnDemandRevalidate: typeof authorizeOnDemandRevalidate === "function" ? authorizeOnDemandRevalidate : void 0,
 				configMatchPathname,
+				restoreLocaleRootTrailingSlash,
 				matchPageRoute: matchPageRoute ?? null,
 				matchApiRoute: matchApiRoute ?? null,
-				runMiddleware: typeof runMiddleware === "function" ? wrapMiddlewareWithBasePath(runMiddleware, basePath, hadBasePath) : null,
+				runMiddleware: runNodeMiddleware ? wrapMiddlewareWithBasePath(runNodeMiddleware, basePath, hadBasePath) : null,
 				renderPage: typeof renderPage === "function" ? (request, resolvedUrl, options, stagedHeaders) => renderPage(request, resolvedUrl, ssrManifest, void 0, stagedHeaders, {
 					...options,
 					originalUrl: originalRenderUrl
@@ -1648,7 +1686,7 @@ async function createPagesRouterRequestHandler(options) {
 						res.end(INVALID_IMAGE_SOURCE_MESSAGE);
 						return true;
 					}
-					if (isPagesFilesystemExcludedPath(requestPathname, phase)) return false;
+					if (!resolvedPathnameHasBasePath && !isAssetPrefixBuildAsset(requestPathname, pagesAssetPathPrefix) || isPagesFilesystemExcludedPath(requestPathname, phase)) return false;
 					return tryServeStatic(req, res, clientDir, requestPathname, compress, staticCache, stagedHeaders);
 				}
 			};

package/dist/server/proxy-trust.d.ts

@@ -35,4 +35,10 @@ export declare function resolveRequestProtocol(source: IncomingMessage | Headers
  * against `request.url`.
  */
 export declare function resolveRequestHost(source: IncomingMessage | Headers, fallback: string): string;
+/**
+ * The `X-Forwarded-Host` value when it matches the `trustedHosts` allow-list,
+ * otherwise undefined. Unlike the raw `Host` header, this host is
+ * operator-approved.
+ */
+export declare function resolveTrustedForwardedHost(source: IncomingMessage | Headers): string | undefined;
 //#endregion

package/dist/server/proxy-trust.js

@@ -42,12 +42,18 @@ function resolveRequestProtocol(source) {
 * against `request.url`.
 */
 function resolveRequestHost(source, fallback) {
+	return resolveTrustedForwardedHost(source) ?? (readHost(source) || fallback);
+}
+/**
+* The `X-Forwarded-Host` value when it matches the `trustedHosts` allow-list,
+* otherwise undefined. Unlike the raw `Host` header, this host is
+* operator-approved.
+*/
+function resolveTrustedForwardedHost(source) {
 	const rawForwarded = readForwardedHost(source);
-	if (rawForwarded && trustedHosts.size > 0) {
-		const forwardedHost = rawForwarded.split(",")[0]?.trim().toLowerCase();
-		if (forwardedHost && trustedHosts.has(forwardedHost)) return forwardedHost;
-	}
-	return readHost(source) || fallback;
+	if (!rawForwarded || trustedHosts.size === 0) return void 0;
+	const forwardedHost = rawForwarded.split(",")[0]?.trim().toLowerCase();
+	return forwardedHost && trustedHosts.has(forwardedHost) ? forwardedHost : void 0;
 }
 function readForwardedProto(source) {
 	if (isWebHeaders(source)) return source.get("x-forwarded-proto") ?? void 0;
@@ -65,4 +71,4 @@ function isWebHeaders(source) {
 	return typeof source.get === "function";
 }
 //#endregion
-export { resolveRequestHost, resolveRequestProtocol, trustProxy, trustedHosts };
+export { resolveRequestHost, resolveRequestProtocol, resolveTrustedForwardedHost, trustProxy, trustedHosts };

package/dist/server/request-pipeline.d.ts

@@ -143,6 +143,11 @@ export declare function isOriginAllowed(origin: string, allowed: string[]): bool
  *
  * @param headers - The Headers object to modify in place
  */
+/**
+ * Next.js drops each empty middleware Set-Cookie value when it converts
+ * middleware's response headers, so blank values never reach the response.
+ */
+export declare function dropEmptyMiddlewareSetCookie(headers: Headers): void;
 export declare function processMiddlewareHeaders(headers: Headers): void;
 /**
  * Strip internal headers from an inbound request so they cannot be forged by

package/dist/server/request-pipeline.js

@@ -313,7 +313,18 @@ function isOriginAllowed(origin, allowed) {
 *
 * @param headers - The Headers object to modify in place
 */
+/**
+* Next.js drops each empty middleware Set-Cookie value when it converts
+* middleware's response headers, so blank values never reach the response.
+*/
+function dropEmptyMiddlewareSetCookie(headers) {
+	const cookies = headers.getSetCookie();
+	if (!cookies.includes("")) return;
+	headers.delete("set-cookie");
+	for (const cookie of cookies) if (cookie) headers.append("set-cookie", cookie);
+}
 function processMiddlewareHeaders(headers) {
+	dropEmptyMiddlewareSetCookie(headers);
 	const keysToDelete = [];
 	const unconsumedRequestHeaders = getUnconsumedMiddlewareRequestHeaders(headers);
 	for (const key of headers.keys()) if (key.startsWith("x-middleware-") && key !== "x-middleware-cache" && !unconsumedRequestHeaders.has(key)) keysToDelete.push(key);
@@ -433,4 +444,4 @@ function cloneRequestWithUrl(request, url) {
 	return attachRequestCfMetadata(cloned, request);
 }
 //#endregion
-export { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, attachRequestCfMetadata, canonicalizeRequestPathname, canonicalizeRequestUrlPathname, cloneRequestWithHeaders, cloneRequestWithUrl, createStaticFileSignal, filterInternalHeaders, getRepeatedSlashRedirect, guardProtocolRelativeUrl, hasBasePath, isOpenRedirectShaped, isOriginAllowed, normalizeTrailingSlash, normalizeTrailingSlashPathname, processMiddlewareHeaders, resolvePublicFileRoute, sendRepeatedSlashRedirect, stripBasePath, validateCsrfOrigin, validateServerActionPayload };
+export { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, attachRequestCfMetadata, canonicalizeRequestPathname, canonicalizeRequestUrlPathname, cloneRequestWithHeaders, cloneRequestWithUrl, createStaticFileSignal, dropEmptyMiddlewareSetCookie, filterInternalHeaders, getRepeatedSlashRedirect, guardProtocolRelativeUrl, hasBasePath, isOpenRedirectShaped, isOriginAllowed, normalizeTrailingSlash, normalizeTrailingSlashPathname, processMiddlewareHeaders, resolvePublicFileRoute, sendRepeatedSlashRedirect, stripBasePath, validateCsrfOrigin, validateServerActionPayload };

package/dist/server/rsc-stream-hints.d.ts

@@ -11,7 +11,7 @@
  * tag is `HL` are decoded and inspected. Length-prefixed bodies remain separate
  * so binary bytes do not force adjacent text through the embed's base64 path.
  */
-export declare function normalizeReactFlightPreloadHints(stream: ReadableStream<Uint8Array>): ReadableStream<Uint8Array>;
+export declare function normalizeReactFlightPreloadHints(stream: ReadableStream<Uint8Array>, onCancel?: (reason: unknown) => void): ReadableStream<Uint8Array>;
 export type RscRawRenderer = (model: unknown, options?: unknown) => ReadableStream<Uint8Array>;
 export type RscRawPrerenderer = (model: unknown, options?: unknown) => Promise<{
   prelude: ReadableStream<Uint8Array>;

package/dist/server/rsc-stream-hints.js

@@ -1,3 +1,4 @@
+import { createRenderStreamCancellation } from "./app-render-abort-error.js";
 //#region src/server/rsc-stream-hints.ts
 const REACT_FLIGHT_STYLESHEET_PRELOAD_HINT = /^([0-9a-f]*:HL\[.*?),"stylesheet"(\]|,)/;
 const STYLESHEET_TO_STYLE_JSON_PADDING = " ".repeat(5);
@@ -106,7 +107,7 @@ function isTagInTable(table, byte) {
 * tag is `HL` are decoded and inspected. Length-prefixed bodies remain separate
 * so binary bytes do not force adjacent text through the embed's base64 path.
 */
-function normalizeReactFlightPreloadHints(stream) {
+function normalizeReactFlightPreloadHints(stream, onCancel) {
 	let carry = null;
 	let rawBytesRemaining = 0;
 	let passThrough = false;
@@ -194,11 +195,28 @@ function normalizeReactFlightPreloadHints(stream) {
 		},
 		flush(controller) {
 			if (carry !== null && carry.byteLength > 0) controller.enqueue(rawBytesRemaining > 0 ? carry : normalizeReactFlightHintLine(carry));
-		}
+		},
+		cancel: onCancel
 	}));
 }
 function createRscRenderer(render) {
-	return (model, options) => normalizeReactFlightPreloadHints(render(model, options));
+	return (model, options) => {
+		const cancellation = createRenderStreamCancellation();
+		return normalizeReactFlightPreloadHints(render(model, ignoreCancellationErrors(options, cancellation)), cancellation.record);
+	};
+}
+/** A consumer cancelling the payload is not a render failure. */
+function ignoreCancellationErrors(options, cancellation) {
+	if (!options || typeof options !== "object") return options;
+	const onError = Reflect.get(options, "onError");
+	if (typeof onError !== "function") return options;
+	return {
+		...options,
+		onError(error, ...rest) {
+			if (cancellation.isReason(error)) return void 0;
+			return Reflect.apply(onError, options, [error, ...rest]);
+		}
+	};
 }
 function createRscPrerenderer(prerender) {
 	return async (model, options) => {

package/dist/server/server-reference-loader.js

@@ -1,4 +1,6 @@
 import { runOutsideRequestScopes } from "../shims/internal/als-registry.js";
+import { getRequestExecutionContext } from "../shims/request-context.js";
+import { shareIsolatePromise } from "./isolate-shared-promise.js";
 //#region src/server/server-reference-loader.ts
 /**
 * Keep server-reference module evaluation out of the request that first
@@ -21,7 +23,14 @@ const ISOLATED = Symbol.for("vinext.serverReferenceRequire.isolated");
 function isolateServerReferenceLoads() {
 	const load = globalThis.__vite_rsc_server_require__;
 	if (typeof load !== "function" || ISOLATED in load) return;
-	const isolated = (id) => runOutsideRequestScopes(() => load(id));
+	const started = /* @__PURE__ */ new WeakSet();
+	const isolated = (id) => {
+		const ctx = getRequestExecutionContext();
+		const loaded = runOutsideRequestScopes(() => load(id));
+		if (!(loaded instanceof Promise) || started.has(loaded)) return loaded;
+		started.add(loaded);
+		return shareIsolatePromise(loaded, ctx);
+	};
 	Object.defineProperty(isolated, ISOLATED, { value: true });
 	globalThis.__vite_rsc_server_require__ = isolated;
 }

package/dist/server/static-file-cache.js

@@ -178,6 +178,15 @@ var StaticFileCache = class StaticFileCache {
 		return this.entries.get(pathname);
 	}
 };
+const MANAGED_CHUNKS_SEGMENT = `${ASSET_PREFIX_URL_DIR}/chunks/`;
+const MANAGED_CSS_SEGMENT = `${ASSET_PREFIX_URL_DIR}/css/`;
+const MANAGED_WORKERS_SEGMENT = `${ASSET_PREFIX_URL_DIR}/workers/`;
+const MANAGED_MEDIA_SEGMENT = `${ASSET_PREFIX_URL_DIR}/media/`;
+const HASH_ONLY_BASENAME_RE = /^[A-Za-z0-9_-]{8}$/;
+const WORKER_BASENAME_RE = /^[0-9a-f]{8}-[A-Za-z0-9_-]{8}$/;
+function isInManagedDir(normalizedPath, segment) {
+	return normalizedPath.startsWith(segment) || normalizedPath.includes(`/${segment}`);
+}
 /**
 * Extract a stable weak ETag from a Vite hashed filename (e.g. `app-DqZc3R4n.js`).
 * The hash is a content hash computed by the bundler — deterministic across
@@ -190,14 +199,17 @@ var StaticFileCache = class StaticFileCache {
 */
 function etagFromFilenameHash(relativePath, ext) {
 	const basename = path.basename(relativePath, ext);
+	if (basename.length === 8 && HASH_ONLY_BASENAME_RE.test(basename)) {
+		const normalizedPath = toSlash(relativePath);
+		if (isInManagedDir(normalizedPath, MANAGED_CHUNKS_SEGMENT) || isInManagedDir(normalizedPath, MANAGED_CSS_SEGMENT)) return `W/"${basename}"`;
+	}
+	if (basename.length === 17 && WORKER_BASENAME_RE.test(basename) && isInManagedDir(toSlash(relativePath), MANAGED_WORKERS_SEGMENT)) return `W/"${basename}"`;
 	const lastDash = basename.lastIndexOf("-");
 	if (lastDash !== -1 && lastDash !== basename.length - 1) {
 		const suffix = basename.slice(lastDash + 1);
 		if (suffix.length >= 6 && suffix.length <= 12 && /^[A-Za-z0-9_-]+$/.test(suffix)) return `W/"${suffix}"`;
 	}
-	const normalizedPath = toSlash(relativePath);
-	const managedMediaSegment = `${ASSET_PREFIX_URL_DIR}/media/`;
-	if (normalizedPath.startsWith(managedMediaSegment) || normalizedPath.includes(`/${managedMediaSegment}`)) {
+	if (isInManagedDir(toSlash(relativePath), MANAGED_MEDIA_SEGMENT)) {
 		const lastDot = basename.lastIndexOf(".");
 		if (lastDot !== -1) {
 			const suffix = basename.slice(lastDot + 1);