vinext 1.2.0 → 1.3.0

package/dist/shims/server.js

@@ -3,10 +3,11 @@ import { MIDDLEWARE_SET_COOKIE_HEADER } from "../utils/protocol-headers.js";
 import { encodeMiddlewareRequestHeaders } from "../utils/middleware-request-headers.js";
 import { parseEdgeRequestCookieHeader } from "../utils/parse-cookie.js";
 import { hasBasePath, removeTrailingSlash, stripBasePath } from "../utils/base-path.js";
-import { getRequestExecutionContext } from "./request-context.js";
 import { MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER } from "../server/headers.js";
+import { getRequestExecutionContext } from "./request-context.js";
 import { validateCookieAttributeValue, validateCookieName } from "./internal/cookie-serialize.js";
 import { assertSafeNavigationUrl } from "./url-safety.js";
+import { trustProxy } from "../server/proxy-trust.js";
 import { userAgent, userAgentFromString } from "./user-agent.js";
 //#region src/shims/server.ts
 /**
@@ -97,13 +98,26 @@ function initWithoutInputBody(input, init) {
 		body: null
 	};
 }
+/**
+* workerd's `request.cf` metadata. Only the Workers runtime sets it, so its
+* presence means the request came through Cloudflare's edge rather than
+* straight from a client.
+*/
+function readCloudflareMetadata(request) {
+	const cf = Reflect.get(request, "cf");
+	return cf !== null && typeof cf === "object" ? cf : void 0;
+}
+function readStringField(source, key) {
+	const value = Reflect.get(source, key);
+	return typeof value === "string" && value !== "" ? value : void 0;
+}
 var NextRequest = class extends Request {
 	_nextUrl;
 	_url;
 	_cookies;
 	constructor(input, init) {
 		validateURL(typeof input !== "string" && "url" in input ? input.url : String(input));
-		const { nextConfig: _nextConfig, ...plainInit } = init ?? {};
+		const { nextConfig: _nextConfig, requestHost, ...plainInit } = init ?? {};
 		const requestInit = init instanceof Request ? requestInitFromRequest(init) : plainInit;
 		if (input instanceof Request) {
 			super(input, initWithoutInputBody(input, requestInit));
@@ -129,6 +143,7 @@ var NextRequest = class extends Request {
 		} : void 0;
 		const urlConfig = _nextConfig ? {
 			basePath: _nextConfig.basePath,
+			headers: requestHost === void 0 ? void 0 : { host: requestHost },
 			nextConfig: {
 				i18n,
 				trailingSlash: _nextConfig.trailingSlash,
@@ -155,17 +170,39 @@ var NextRequest = class extends Request {
 		throw new Error("NextRequest.ua has been removed; use userAgent() instead");
 	}
 	/**
-	* Client IP address. Prefers Cloudflare's trusted CF-Connecting-IP header
-	* over the spoofable X-Forwarded-For. Returns undefined if unavailable.
+	* Client IP address. Next.js removed `ip` in v15; vinext keeps it as an
+	* extension. Returns undefined unless the value comes from a trusted source.
+	*
+	* On Cloudflare Workers (the request carries `cf` metadata), Cloudflare's
+	* edge sets `CF-Connecting-IP`. Elsewhere these headers are client-supplied
+	* and are only honored behind a trusted proxy (`VINEXT_TRUST_PROXY` /
+	* `VINEXT_TRUSTED_HOSTS`), matching the `X-Forwarded-*` policy.
 	*/
 	get ip() {
+		if (readCloudflareMetadata(this)) return this.headers.get("cf-connecting-ip") ?? void 0;
+		if (!trustProxy) return void 0;
 		return this.headers.get("cf-connecting-ip") ?? this.headers.get("x-real-ip") ?? this.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? void 0;
 	}
 	/**
-	* Geolocation data. Platform-dependent (e.g., Cloudflare, Vercel).
-	* Returns undefined if not available.
+	* Geolocation data. Next.js removed `geo` in v15; vinext keeps it as an
+	* extension. Read from Cloudflare's `request.cf` metadata on Workers, or
+	* from platform geo headers behind a trusted proxy. Returns undefined
+	* otherwise, because any client can send these headers.
 	*/
 	get geo() {
+		const cf = readCloudflareMetadata(this);
+		if (cf) {
+			const country = readStringField(cf, "country");
+			if (!country) return void 0;
+			return {
+				country,
+				city: readStringField(cf, "city"),
+				region: readStringField(cf, "region"),
+				latitude: readStringField(cf, "latitude"),
+				longitude: readStringField(cf, "longitude")
+			};
+		}
+		if (!trustProxy) return void 0;
 		const country = this.headers.get("cf-ipcountry") ?? this.headers.get("x-vercel-ip-country") ?? void 0;
 		if (!country) return void 0;
 		return {
@@ -257,6 +294,9 @@ var NextResponse = class NextResponse extends Response {
 		});
 	}
 };
+function isRawDataPathname(pathname) {
+	return pathname.startsWith("/_next/data/") && pathname.endsWith(".json");
+}
 var NextURL = class NextURL {
 	/** Internal URL stores the pathname WITHOUT basePath or locale prefix. */
 	_url;
@@ -276,8 +316,15 @@ var NextURL = class NextURL {
 	_locales;
 	_domains;
 	_domainLocale;
+	_headers;
+	_buildId;
+	/** First page segment of a raw data pathname, where its locale sits. */
+	_dataPathSegment;
+	/** The locale parsed from that segment, if it is one. */
+	_dataPathLocale;
 	constructor(input, base, config) {
 		this._url = new URL(input.toString(), base);
+		this._headers = config?.headers;
 		this._configBasePath = config?.basePath ?? "";
 		this._basePath = this._configBasePath;
 		this._configTrailingSlash = config?.nextConfig?.trailingSlash ?? false;
@@ -285,6 +332,7 @@ var NextURL = class NextURL {
 		this._trailingSlash = this._configTrailingSlash;
 		this._analyzeTrailingSlash();
 		this._stripBasePath();
+		this._parseBuildId();
 		const i18n = config?.nextConfig?.i18n;
 		if (i18n) {
 			this._locales = [...i18n.locales];
@@ -325,6 +373,22 @@ var NextURL = class NextURL {
 		this._basePath = this._configBasePath;
 		this._url.pathname = stripBasePath(this._url.pathname, this._configBasePath);
 	}
+	/**
+	* Take the build ID from a raw `/_next/data/<buildId>/….json` pathname, as
+	* getNextPathnameInfo does. Middleware only sees one when proxy URL
+	* normalization is skipped; the pathname is left as is.
+	*/
+	_parseBuildId() {
+		const { pathname } = this._url;
+		if (!isRawDataPathname(pathname)) {
+			this._buildId = void 0;
+			this._dataPathSegment = void 0;
+			return;
+		}
+		const [buildId, pageSegment] = pathname.slice(12, -5).split("/");
+		this._buildId = buildId;
+		this._dataPathSegment = pageSegment === "index" ? void 0 : pageSegment;
+	}
 	/** Extract locale from pathname, stripping it from the internal URL. */
 	_detectPathnameLocale(locales) {
 		const segments = this._url.pathname.split("/");
@@ -336,11 +400,29 @@ var NextURL = class NextURL {
 	_analyzeI18n() {
 		if (!this._locales || !this._configDefaultLocale) return;
 		const detectedLocale = this._detectPathnameLocale(this._locales);
+		this._dataPathLocale = void 0;
+		if (!detectedLocale && this._buildId && this._dataPathSegment) {
+			const candidate = this._dataPathSegment.toLowerCase();
+			this._dataPathLocale = this._locales.find((l) => l.toLowerCase() === candidate);
+		}
 		const detectedLocaleLower = detectedLocale?.toLowerCase();
-		const hostname = this._url.hostname.toLowerCase();
+		const hostHeader = this._headers?.host;
+		const hostname = (typeof hostHeader === "string" && hostHeader ? hostHeader.split(":", 1)[0] : this._url.hostname).toLowerCase();
 		this._domainLocale = this._domains?.find((domain) => domain.domain.split(":", 1)[0].toLowerCase() === hostname || detectedLocaleLower === domain.defaultLocale.toLowerCase() || domain.locales?.some((locale) => locale.toLowerCase() === detectedLocaleLower));
 		this._defaultLocale = this._domainLocale?.defaultLocale ?? this._configDefaultLocale;
-		this._locale = detectedLocale ?? this._defaultLocale;
+		this._locale = detectedLocale ?? this._dataPathLocale ?? this._defaultLocale;
+	}
+	/**
+	* A raw data pathname keeps its locale segment, replaced by the current
+	* locale once it has been changed.
+	*/
+	_formatDataPathLocale(pathname) {
+		if (!this._dataPathLocale || this._locale === this._dataPathLocale) return pathname;
+		if (!this._locale || !isRawDataPathname(pathname)) return pathname;
+		const segments = pathname.slice(12, -5).split("/");
+		if (segments[1]?.toLowerCase() !== this._dataPathLocale.toLowerCase()) return pathname;
+		segments[1] = this._locale;
+		return "/_next/data/" + segments.join("/") + ".json";
 	}
 	/**
 	* Reconstruct the full pathname with basePath + locale prefix and apply
@@ -349,9 +431,9 @@ var NextURL = class NextURL {
 	*/
 	_formatPathname() {
 		let prefix = this._basePath;
-		const inner = this._url.pathname;
+		const inner = this._formatDataPathLocale(this._url.pathname);
 		const innerLower = inner.toLowerCase();
-		if (!(innerLower === "/api" || innerLower.startsWith("/api/")) && this._locale && this._locale !== this._defaultLocale) prefix += "/" + this._locale;
+		if (!(innerLower === "/api" || innerLower.startsWith("/api/")) && !isRawDataPathname(inner) && this._locale && this._locale !== this._defaultLocale) prefix += "/" + this._locale;
 		const composed = !prefix ? inner : inner === "/" ? prefix : prefix + inner;
 		return this._applyTrailingSlash(composed);
 	}
@@ -379,6 +461,7 @@ var NextURL = class NextURL {
 		this._url.href = value;
 		this._analyzeTrailingSlash();
 		this._stripBasePath();
+		this._parseBuildId();
 		this._analyzeI18n();
 	}
 	get origin() {
@@ -490,6 +573,7 @@ var NextURL = class NextURL {
 		} else if (this._trailingSlash) nextConfig.trailingSlash = true;
 		const config = {
 			basePath: this._configBasePath,
+			headers: this._headers,
 			nextConfig: Object.keys(nextConfig).length > 0 ? nextConfig : void 0
 		};
 		return new NextURL(this.href, void 0, config);
@@ -501,13 +585,13 @@ var NextURL = class NextURL {
 		return this.href;
 	}
 	/**
-	* The build ID of the Next.js application.
-	* Set from `generateBuildId` in next.config.js, or a random UUID if not configured.
-	* Can be used in middleware to detect deployment skew between client and server.
-	* Matches the Next.js API: `request.nextUrl.buildId`.
+	* Matches the Next.js API: `request.nextUrl.buildId`. Next.js derives it
+	* from the URL (only `/_next/data/<buildId>/…` paths carry one) and never
+	* from the deployment, so a Client Component reads the same value on the
+	* server and in the browser.
 	*/
 	get buildId() {
-		return process.env.__VINEXT_BUILD_ID ?? void 0;
+		return this._buildId;
 	}
 };
 var RequestCookies = class {

package/dist/shims/thenable-params.d.ts

@@ -3,7 +3,12 @@ import { WellKnownProperty } from "./internal/thenable-well-known-properties.js"
 export type ThenableParams<T extends Record<string, unknown>> = Promise<T> & Omit<T, WellKnownProperty>;
 export type ThenableParamsObserver = Readonly<{
   observeParamAccess: (keys: readonly string[]) => void;
-  observeReactPromiseStatus?: boolean;
+  /**
+   * Runs when `then` is read, and when `catch` or `finally` is called (they
+   * read `then` on a native promise). Throwing here fails the read itself
+   * before React counts any pending work, as Next.js does.
+   */
+  observeThenRead?: () => void;
 }>;
 /** Serialize backing values without reading a framework fallback-key proxy. */
 export declare function getFallbackParamsSnapshot(value: unknown): Promise<Record<string, unknown>> | undefined;

package/dist/shims/thenable-params.js

@@ -117,14 +117,20 @@ function createThenableParams(obj, observer, fallbackShellState) {
 	const params = createThenableParamsProxy(promise, {
 		get(target, prop, receiver) {
 			if (isPromiseContinuation(prop)) {
+				if (prop === "then") observer?.observeThenRead?.();
 				const value = Reflect.get(target, prop, receiver);
 				if (typeof value !== "function") return value;
 				return (...args) => {
-					if (!fallbackParamNames) observeAllParamKeys(observer, plain);
+					if (prop !== "then") observer?.observeThenRead?.();
+					if (!fallbackParamNames) try {
+						observeAllParamKeys(observer, plain);
+					} catch (error) {
+						return Reflect.apply(value, Promise.reject(error), args);
+					}
 					return Reflect.apply(value, target, args);
 				};
 			}
-			if (prop === "status" && observer?.observeReactPromiseStatus === true) observeAllParamKeys(observer, plain);
+			if (prop === "reason" && Object.hasOwn(target, prop)) return Reflect.get(target, prop);
 			if (typeof prop === "string" && !isWellKnownProperty(prop)) observeParamKeys(observer, [prop]);
 			if (!isWellKnownProperty(prop) && hasParamProperty(plain, prop)) {
 				if (isFallbackParam(prop)) {
@@ -164,6 +170,9 @@ function createThenableParams(obj, observer, fallbackShellState) {
 		ownKeys() {
 			observeReadableParamKeys(observer, plain);
 			return Reflect.ownKeys(plain).filter((prop) => !isWellKnownProperty(prop));
+		},
+		set(target, prop, value) {
+			return Reflect.set(target, prop, value);
 		}
 	});
 	paramsState.set(params, {

package/dist/shims/unified-request-context.d.ts

@@ -21,6 +21,11 @@ import "./request-state-types.js";
 export type UnifiedRequestContext = {
   /** Cloudflare Workers ExecutionContext, or null on Node.js dev. */
   executionContext: ExecutionContextLike | null;
+  /**
+   * The host's client-connection signal for the incoming request, before any
+   * clone follows it. Null for requests vinext creates itself (regeneration).
+   */
+  requestSignal: AbortSignal | null;
   /** Per-request cache for cacheForRequest(). Keyed by factory function reference. */
   requestCache: WeakMap<(...args: any[]) => any, unknown>;
   /** Shared lifecycle state for work deferred until the response closes. */

package/dist/shims/unified-request-context.js

@@ -18,6 +18,7 @@ function createRequestContext(opts) {
 		headersContext: null,
 		actionRevalidationKind: 0,
 		cacheLifeSink: null,
+		pendingCdnTagInvalidations: [],
 		pendingRevalidatedTags: /* @__PURE__ */ new Set(),
 		pendingRevalidations: /* @__PURE__ */ new Set(),
 		dynamicUsageDetected: false,
@@ -50,6 +51,7 @@ function createRequestContext(opts) {
 		currentFetchDedupeEntries: /* @__PURE__ */ new Map(),
 		nextFetchId: 1,
 		executionContext: _getInheritedExecutionContext(),
+		requestSignal: null,
 		requestCache: /* @__PURE__ */ new WeakMap(),
 		afterContext: {
 			callbacks: [],

package/dist/shims/url-utils.d.ts

@@ -2,6 +2,13 @@
 export declare function isAbsoluteUrl(url: string): boolean;
 export declare function isAbsoluteOrProtocolRelativeUrl(url: string): boolean;
 export declare function getWindowOrigin(): string | null;
+/**
+ * A same-origin pathname can start with "//" (e.g. `https://app.com//evil.com`),
+ * and as a local path that is a protocol-relative reference to another host.
+ * Collapse the leading slashes: Next.js does the same for these URLs, on the
+ * client (`resolveHref`) or with its server's repeated-slash 308.
+ */
+export declare function collapseLeadingSlashes(pathname: string): string;
 /**
  * If `url` is an absolute same-origin URL, return the local path
  * (pathname + search + hash). Returns null for truly external URLs

package/dist/shims/url-utils.js

@@ -25,6 +25,15 @@ function getWindowOrigin() {
 	}
 }
 /**
+* A same-origin pathname can start with "//" (e.g. `https://app.com//evil.com`),
+* and as a local path that is a protocol-relative reference to another host.
+* Collapse the leading slashes: Next.js does the same for these URLs, on the
+* client (`resolveHref`) or with its server's repeated-slash 308.
+*/
+function collapseLeadingSlashes(pathname) {
+	return pathname.replace(/^\/{2,}/, "/");
+}
+/**
 * If `url` is an absolute same-origin URL, return the local path
 * (pathname + search + hash). Returns null for truly external URLs
 * or on the server (where origin is unknown).
@@ -34,7 +43,7 @@ function toSameOriginPath(url) {
 	if (!origin) return null;
 	try {
 		const parsed = url.startsWith("//") ? new URL(url, origin) : new URL(url);
-		if (parsed.origin === origin) return parsed.pathname + parsed.search + parsed.hash;
+		if (parsed.origin === origin) return collapseLeadingSlashes(parsed.pathname) + parsed.search + parsed.hash;
 	} catch {}
 	return null;
 }
@@ -49,7 +58,7 @@ function toSameOriginAppPath(url, basePath) {
 	try {
 		const parsed = new URL(localPath, "http://vinext.local");
 		if (!hasBasePath(parsed.pathname, basePath)) return null;
-		return stripBasePath(parsed.pathname, basePath) + parsed.search + parsed.hash;
+		return collapseLeadingSlashes(stripBasePath(parsed.pathname, basePath)) + parsed.search + parsed.hash;
 	} catch {
 		return localPath;
 	}
@@ -164,4 +173,4 @@ function isHashOnlyBrowserUrlChange(href, currentHref, basePath = "") {
 	}
 }
 //#endregion
-export { getWindowOrigin, isAbsoluteOrProtocolRelativeUrl, isAbsoluteUrl, isHashOnlyBrowserUrlChange, normalizePathTrailingSlash, resolveRelativeHref, toBrowserNavigationHref, toCanonicalBrowserNavigationHref, toSameOriginAppPath, toSameOriginPath, withBasePath };
+export { collapseLeadingSlashes, getWindowOrigin, isAbsoluteOrProtocolRelativeUrl, isAbsoluteUrl, isHashOnlyBrowserUrlChange, normalizePathTrailingSlash, resolveRelativeHref, toBrowserNavigationHref, toCanonicalBrowserNavigationHref, toSameOriginAppPath, toSameOriginPath, withBasePath };

package/dist/utils/asset-prefix.d.ts

@@ -92,4 +92,11 @@ export declare function assetPrefixPathname(assetPrefix: string): string;
  * @see https://github.com/vercel/next.js/blob/canary/packages/next/src/server/lib/router-server.ts
  */
 export declare function isNextStaticPath(pathname: string, basePath: string, assetPathPrefix: string): boolean;
+/**
+ * Whether `pathname` is a build asset under a path `assetPrefix`. Next.js adds
+ * a built-in beforeFiles rewrite from `${assetPrefix}/_next/:path+` into the
+ * basePath (`loadRewrites` in `packages/next/src/lib/load-custom-routes.ts`),
+ * so such a path resolves even when it lies outside the basePath.
+ */
+export declare function isAssetPrefixBuildAsset(pathname: string, assetPathPrefix: string): boolean;
 //#endregion

package/dist/utils/asset-prefix.js

@@ -118,5 +118,14 @@ function isNextStaticPath(pathname, basePath, assetPathPrefix) {
 	if (assetPathPrefix && (p === assetPathPrefix || p.startsWith(assetPathPrefix + "/"))) p = p.slice(assetPathPrefix.length) || "/";
 	return p.startsWith(`/${ASSET_PREFIX_URL_DIR}/`);
 }
+/**
+* Whether `pathname` is a build asset under a path `assetPrefix`. Next.js adds
+* a built-in beforeFiles rewrite from `${assetPrefix}/_next/:path+` into the
+* basePath (`loadRewrites` in `packages/next/src/lib/load-custom-routes.ts`),
+* so such a path resolves even when it lies outside the basePath.
+*/
+function isAssetPrefixBuildAsset(pathname, assetPathPrefix) {
+	return !!assetPathPrefix && (pathname === assetPathPrefix || pathname.startsWith(assetPathPrefix + "/")) && isNextStaticPath(pathname, "", assetPathPrefix);
+}
 //#endregion
-export { ASSET_PREFIX_URL_DIR, assetPrefixPathname, isAbsoluteAssetPrefix, isNextStaticPath, resolveAssetUrlPrefix, resolveAssetsDir };
+export { ASSET_PREFIX_URL_DIR, assetPrefixPathname, isAbsoluteAssetPrefix, isAssetPrefixBuildAsset, isNextStaticPath, resolveAssetUrlPrefix, resolveAssetsDir };

package/dist/utils/client-build-manifest.js

@@ -19,6 +19,8 @@ function readClientBuildManifest(manifestPath) {
 			const assets = readStringArray(entry.assets);
 			manifest[key] = {
 				file: entry.file,
+				...typeof entry.src === "string" ? { src: entry.src } : {},
+				...typeof entry.name === "string" ? { name: entry.name } : {},
 				...entry.isEntry === true ? { isEntry: true } : {},
 				...entry.isDynamicEntry === true ? { isDynamicEntry: true } : {},
 				...imports ? { imports } : {},
@@ -39,14 +41,19 @@ function findPagesClientEntryFileFromManifest(buildManifest, assetBase) {
 	return findEntryFileFromManifest(buildManifest, assetBase, PAGES_CLIENT_ENTRY_MARKERS, false);
 }
 function findEntryFileFromManifest(buildManifest, assetBase, markers, fallbackToFirstEntry) {
-	const entries = Object.values(buildManifest).filter((entry) => entry.isEntry && entry.file);
-	for (const marker of markers) {
-		const markedEntry = entries.find((entry) => entry.file.includes(marker));
-		if (markedEntry) return manifestFileWithBase(markedEntry.file, assetBase);
+	const entries = Object.entries(buildManifest).filter(([, entry]) => entry.isEntry && entry.file);
+	const matchers = [(marker, key, entry) => entry.name === marker || isVirtualEntryId(key, marker) || entry.src !== void 0 && isVirtualEntryId(entry.src, marker), (marker, _key, entry) => entry.file.includes(marker)];
+	for (const matches of matchers) for (const marker of markers) {
+		const markedEntry = entries.find(([key, entry]) => matches(marker, key, entry));
+		if (markedEntry) return manifestFileWithBase(markedEntry[1].file, assetBase);
 	}
-	const chosen = fallbackToFirstEntry ? entries[0] : void 0;
+	const chosen = fallbackToFirstEntry ? entries[0]?.[1] : void 0;
 	return chosen ? manifestFileWithBase(chosen.file, assetBase) : void 0;
 }
+function isVirtualEntryId(id, marker) {
+	const virtualId = `virtual:${marker}`;
+	return id === virtualId || id.endsWith(`/${virtualId}`);
+}
 function listFilesRecursive(dir) {
 	const out = [];
 	for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {

package/dist/utils/client-runtime-metadata.d.ts

@@ -8,6 +8,7 @@ type ClientRuntimeMetadata = {
   }>;
   lazyChunks?: string[];
   dynamicPreloads?: Record<string, string[]>;
+  sharedChunks?: string[];
 };
 /**
  * Read the client build manifest and compute runtime metadata used by

package/dist/utils/client-runtime-metadata.js

@@ -1,10 +1,20 @@
 import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { isAbsoluteAssetPrefix, resolveAssetsDir } from "./asset-prefix.js";
-import { manifestFileWithAssetPrefix, manifestFileWithBase } from "./manifest-paths.js";
+import { isSharedClientChunkName, manifestFileWithAssetPrefix, manifestFileWithBase } from "./manifest-paths.js";
 import { findClientEntryFileFromVinextManifest, findPagesClientEntryFileFromVinextManifest, readClientEntryManifest } from "./client-entry-manifest.js";
 import { findClientEntryFile, findPagesClientEntryFile, readClientBuildManifest } from "./client-build-manifest.js";
 import { computeDynamicImportPreloads, computeLazyChunks, dynamicImportPreloadsWithBase } from "./lazy-chunks.js";
 //#region src/utils/client-runtime-metadata.ts
+/**
+* Shared Pages Router chunk files, keyed on Rolldown chunk names rather than
+* emitted file names so user-configured `chunkFileNames` (e.g. hash-only
+* patterns) keep their modulepreload/script tags.
+*/
+function collectSharedChunkFiles(buildManifest, applyBase) {
+	const files = /* @__PURE__ */ new Set();
+	for (const chunk of Object.values(buildManifest)) if (chunk.file.endsWith(".js") && isSharedClientChunkName(chunk.name)) files.add(applyBase(chunk.file));
+	return files.size > 0 ? [...files] : void 0;
+}
 function collectCssGraph(buildManifest, applyBase) {
 	const cssGraph = {};
 	for (const [key, chunk] of Object.entries(buildManifest)) {
@@ -74,7 +84,10 @@ function computeClientRuntimeMetadata(opts) {
 		if (entry) metadata.clientEntryFile = entry;
 	}
 	if (!buildManifest) return metadata;
-	if (opts.includeClientEntry) metadata.cssGraph = collectCssGraph(buildManifest, (file) => manifestFileWithBase(file, opts.assetBase));
+	if (opts.includeClientEntry) {
+		metadata.cssGraph = collectCssGraph(buildManifest, (file) => manifestFileWithBase(file, opts.assetBase));
+		metadata.sharedChunks = collectSharedChunkFiles(buildManifest, (file) => manifestFileWithBase(file, opts.assetBase));
+	}
 	metadata.appBootstrapPreinitModules = collectAppBootstrapPreinitModules(buildManifest, clientEntryManifest?.appBrowserEntry, (file) => {
 		const url = manifestFileWithAssetPrefix(file, opts.assetBase, opts.assetPrefix);
 		return isAbsoluteAssetPrefix(opts.assetPrefix) ? url : "/" + url;

package/dist/utils/domain-locale.js

@@ -42,7 +42,7 @@ function getDomainLocaleUrl(url, locale, { basePath, currentHostname, domainItem
 	const targetDomain = detectDomainLocale(domainItems, void 0, locale);
 	if (!targetDomain) return void 0;
 	const currentDomain = detectDomainLocale(domainItems, currentHostname ?? void 0);
-	const localizedPath = addLocalePrefix(url, locale, targetDomain.defaultLocale);
+	const localizedPath = addLocalePrefix(/^[/?#]/.test(url) ? url : `/${url}`, locale, targetDomain.defaultLocale);
 	if (currentDomain && normalizeDomainHostname(currentDomain.domain) === normalizeDomainHostname(targetDomain.domain)) return;
 	return `${`http${targetDomain.http ? "" : "s"}://`}${targetDomain.domain}${prefixBasePath(localizedPath, basePath)}`;
 }

package/dist/utils/lazy-chunks.d.ts

@@ -4,6 +4,10 @@
  */
 export type BuildManifestChunk = {
   file: string;
+  /** Source module id (or virtual id) of an entry chunk. */
+  src?: string;
+  /** Rolldown chunk name, independent of the configured output file name. */
+  name?: string;
   isEntry?: boolean;
   isDynamicEntry?: boolean;
   imports?: string[];

package/dist/utils/manifest-paths.d.ts

@@ -26,4 +26,18 @@ export declare function assetServingUrlFromBaseAnchored(value: string, basePath:
  * `<base>/<base>/` prefix is collapsed; a single prefix is left untouched.
  */
 export declare function collapseDuplicateBase(file: string, base: string): string;
+/**
+ * Whether a Rolldown chunk belongs to the shared Pages Router runtime, judged
+ * by its exact chunk name rather than its emitted file name so user-configured
+ * or hash-only `chunkFileNames` keep their modulepreload/script tags.
+ */
+export declare function isSharedClientChunkName(name: string | undefined): boolean;
+/**
+ * Reserved `ssr-manifest.json` key listing the shared runtime chunk files.
+ * Consumers that pass the on-disk manifest straight to `renderPage()` (the
+ * legacy two-call Pages build) have no registered build metadata, and file
+ * names alone can't identify these chunks. The `\0` prefix keeps it from
+ * matching any module id.
+ */
+export declare const SSR_MANIFEST_SHARED_CHUNKS_KEY = "\0vinext:shared-chunks";
 //#endregion

package/dist/utils/manifest-paths.js

@@ -62,5 +62,26 @@ function collapseDuplicateBase(file, base) {
 	const doubledPrefix = `${normalizedBase}/${normalizedBase}/`;
 	return normalizedFile.startsWith(doubledPrefix) ? normalizedFile.slice(normalizedBase.length + 1) : normalizedFile;
 }
+const SHARED_CHUNK_NAMES = /* @__PURE__ */ new Set([
+	"framework",
+	"vinext",
+	"vinext-client-entry"
+]);
+/**
+* Whether a Rolldown chunk belongs to the shared Pages Router runtime, judged
+* by its exact chunk name rather than its emitted file name so user-configured
+* or hash-only `chunkFileNames` keep their modulepreload/script tags.
+*/
+function isSharedClientChunkName(name) {
+	return name !== void 0 && SHARED_CHUNK_NAMES.has(name);
+}
+/**
+* Reserved `ssr-manifest.json` key listing the shared runtime chunk files.
+* Consumers that pass the on-disk manifest straight to `renderPage()` (the
+* legacy two-call Pages build) have no registered build metadata, and file
+* names alone can't identify these chunks. The `\0` prefix keeps it from
+* matching any module id.
+*/
+const SSR_MANIFEST_SHARED_CHUNKS_KEY = "\0vinext:shared-chunks";
 //#endregion
-export { assetServingUrlFromBaseAnchored, collapseDuplicateBase, manifestFileWithAssetPrefix, manifestFileWithBase };
+export { SSR_MANIFEST_SHARED_CHUNKS_KEY, assetServingUrlFromBaseAnchored, collapseDuplicateBase, isSharedClientChunkName, manifestFileWithAssetPrefix, manifestFileWithBase };

package/dist/utils/path-to-regexp.d.ts

@@ -0,0 +1,21 @@
+//#region src/utils/path-to-regexp.d.ts
+export type PathToken = string | PathKey;
+export type PathKey = {
+  name: string | number;
+  prefix: string;
+  suffix: string;
+  pattern: string;
+  modifier: string;
+};
+export type ParsePathPatternOptions = {
+  /** Characters a default param cannot contain. path-to-regexp defaults to `/#?`. */
+  delimiter?: string;
+};
+export declare function parsePathPattern(value: string, options?: ParsePathPatternOptions): PathToken[];
+export declare function normalizePathTokens(tokens: PathToken[]): PathToken[];
+/**
+ * path-to-regexp's `tokensToRegexp` with `strict: true`, without the closing
+ * `$`. Callers append the ending their Next.js matcher uses.
+ */
+export declare function pathTokensToRegExpSource(tokens: PathToken[]): string;
+//#endregion

package/dist/{server/middleware-path-to-regexp.js → utils/path-to-regexp.js}

@@ -1,4 +1,4 @@
-//#region src/server/middleware-path-to-regexp.ts
+//#region src/utils/path-to-regexp.ts
 function lexer(value) {
 	const tokens = [];
 	let index = 0;
@@ -101,11 +101,12 @@ function lexer(value) {
 	});
 	return tokens;
 }
-function parseMiddlewarePath(value) {
+function parsePathPattern(value, options = {}) {
 	const tokens = lexer(value);
 	const result = [];
 	const prefixes = "./";
-	const delimiter = "/#?";
+	const delimiter = options.delimiter ?? "/#?";
+	const delimiterClass = `[^${escapeRegex(delimiter)}]`;
 	let key = 0;
 	let index = 0;
 	let path = "";
@@ -135,8 +136,8 @@ function parseMiddlewarePath(value) {
 			const name = typeof previous === "string" ? previous : previous.name;
 			throw new TypeError(`Must have text between two parameters, missing text after "${name}"`);
 		}
-		if (!previousText || containsDelimiter(previousText)) return "[^\\/#\\?]+?";
-		return `(?:(?!${escapeRegex(previousText)})[^\\/#\\?])+?`;
+		if (!previousText || containsDelimiter(previousText)) return `${delimiterClass}+?`;
+		return `(?:(?!${escapeRegex(previousText)})${delimiterClass})+?`;
 	};
 	while (index < tokens.length) {
 		const character = tryConsume("CHAR");
@@ -192,7 +193,7 @@ function parseMiddlewarePath(value) {
 function escapeRegex(value) {
 	return value.replace(/([.+*?=^!:${}()[\]|/\\])/g, "\\$1");
 }
-function normalizeMiddlewarePathTokens(tokens) {
+function normalizePathTokens(tokens) {
 	return tokens.map((token) => {
 		if (typeof token === "object" && (token.modifier === "*" || token.modifier === "+") && token.prefix === "" && token.suffix === "") return {
 			...token,
@@ -201,8 +202,11 @@ function normalizeMiddlewarePathTokens(tokens) {
 		return token;
 	});
 }
-function middlewarePathTokensToRegExp(tokens) {
-	const delimiterRegex = `[${escapeRegex("/#?")}]`;
+/**
+* path-to-regexp's `tokensToRegexp` with `strict: true`, without the closing
+* `$`. Callers append the ending their Next.js matcher uses.
+*/
+function pathTokensToRegExpSource(tokens) {
 	let route = "^";
 	for (const token of tokens) {
 		if (typeof token === "string") {
@@ -223,8 +227,7 @@ function middlewarePathTokensToRegExp(tokens) {
 			}
 		} else route += `(?:${prefix}${suffix})${token.modifier}`;
 	}
-	route += `${delimiterRegex}?$`;
-	return new RegExp(route, "i");
+	return route;
 }
 //#endregion
-export { middlewarePathTokensToRegExp, normalizeMiddlewarePathTokens, parseMiddlewarePath };
+export { normalizePathTokens, parsePathPattern, pathTokensToRegExpSource };

package/dist/utils/plugin-react-version.d.ts

@@ -0,0 +1,15 @@
+//#region src/utils/plugin-react-version.d.ts
+/**
+ * Resolve @vitejs/plugin-react from the project, falling back to vinext's own
+ * install when the project has none or reaches an unsupported version.
+ * Returns null when it is not installed, and throws when every copy found is
+ * unsupported.
+ */
+export declare function resolvePluginReactPath(projectRoot: string, fallbackFrom?: string): string | null;
+/**
+ * The @vitejs/plugin-react upgrade vinext init must install before vinext.
+ * A declared copy below the floor conflicts with vinext's peer range: npm stops
+ * with ERESOLVE, and pnpm installs but vinext refuses to start.
+ */
+export declare function getPluginReactUpgradeDeps(root: string): string[];
+//#endregion