vinext 1.2.0 → 1.3.0

package/dist/config/config-source.js

@@ -0,0 +1,141 @@
+import { normalizePathTokens, parsePathPattern, pathTokensToRegExpSource } from "../utils/path-to-regexp.js";
+//#region src/config/config-source.ts
+/**
+* Compiles and matches next.config.js redirect, rewrite and header sources.
+*
+* Kept apart from config-matchers so the Pages router can match sources
+* synchronously with the same code as the server, without bundling the rest
+* of config-matchers.
+*/
+/**
+* Cache for compiled redirect/rewrite/header sources.
+*
+* Sources come from next.config.js and never change at runtime. Without
+* caching, every request re-parses and recompiles every rule. On apps with
+* many locale-prefixed rules this dominated profiling at ~2.4 seconds of CPU
+* self-time.
+*
+* Value is `null` when the source is invalid, so we skip it on subsequent
+* requests too without re-parsing it.
+*/
+const _compiledSourceCache = /* @__PURE__ */ new Map();
+/**
+* Compile a redirect/rewrite/header source the way Next.js does at runtime:
+* path-to-regexp 6 with `strict: true`, `delimiter: "/"` and case-insensitive
+* matching, then `modifyRouteRegex` appends an optional trailing slash.
+*
+* Returns an error for sources path-to-regexp rejects. Like Next.js, custom
+* param patterns are not checked for catastrophic backtracking.
+*
+* https://github.com/vercel/next.js/blob/v16.2.7/packages/next/src/server/lib/router-utils/filesystem.ts
+* https://github.com/vercel/next.js/blob/v16.2.7/packages/next/src/shared/lib/router/utils/path-match.ts
+*/
+function compileConfigSourceUncached(source) {
+	const parsed = parseConfigSource(source);
+	if ("kind" in parsed) return parsed;
+	const { tokens, re } = parsed;
+	return {
+		re,
+		keys: tokens.filter((token) => typeof token !== "string" && !!token.pattern)
+	};
+}
+function parseConfigSource(source) {
+	try {
+		const tokens = parsePathPattern(source, { delimiter: "/" });
+		return {
+			tokens,
+			re: new RegExp(`${pathTokensToRegExpSource(tokens)}(?:\\/)?$`, "i")
+		};
+	} catch (error) {
+		return {
+			kind: "invalid",
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+/**
+* Length of the RegExp Next.js builds when validating a source
+* (tryToParsePath: path-to-regexp defaults, retried with normalized repeat
+* tokens), or null when it cannot be built.
+*/
+function validationRegExpLength(source) {
+	try {
+		const tokens = parsePathPattern(source);
+		const build = (value) => new RegExp(`${pathTokensToRegExpSource(value)}[\\/#\\?]?$`).source.length;
+		try {
+			return build(tokens);
+		} catch {
+			return build(normalizePathTokens(tokens));
+		}
+	} catch {
+		return null;
+	}
+}
+/**
+* Why `source` is not a valid redirects/rewrites/headers source, or null.
+* Mirrors the source checks in Next.js's checkCustomRoutes, which fail the
+* build; config loading calls this to do the same.
+*
+* https://github.com/vercel/next.js/blob/v16.2.7/packages/next/src/lib/load-custom-routes.ts
+*/
+function configSourceError(source) {
+	if (!source) return "`source` is missing";
+	if (typeof source !== "string") return "`source` is not a string";
+	if (!source.startsWith("/")) return "`source` does not start with /";
+	const parsed = parseConfigSource(source);
+	if ("kind" in parsed) return parsed.error;
+	const length = validationRegExpLength(source);
+	if (length !== null && length > 4096) return "`source` exceeds max built length of 4096";
+	return null;
+}
+function compileConfigSource(source) {
+	let compiled = _compiledSourceCache.get(source);
+	if (compiled !== void 0) return compiled;
+	const result = compileConfigSourceUncached(source);
+	if ("kind" in result) {
+		console.warn(`[vinext] Ignoring invalid next.config.js source "${source}": ${result.error}`);
+		compiled = null;
+	} else compiled = result;
+	_compiledSourceCache.set(source, compiled);
+	return compiled;
+}
+/**
+* Match a Next.js config source (from redirects/rewrites/headers) against a
+* pathname. Returns the named params or null.
+*
+* Unnamed groups are dropped, as Next.js does with `removeUnnamedParams`.
+* Repeated params (`:path*`, `:path+`) keep the captured string (`a/b`), and
+* an optional param that did not match is `""`.
+*/
+function matchConfigPattern(pathname, pattern) {
+	return execConfigSource(pathname, pattern)?.params ?? null;
+}
+/**
+* matchConfigPattern, also reporting the optional params that did not match.
+* Next.js leaves those out of its params entirely.
+*/
+function execConfigSource(pathname, source) {
+	const compiled = compileConfigSource(source);
+	if (!compiled) return null;
+	const match = compiled.re.exec(pathname);
+	if (!match) return null;
+	const params = Object.create(null);
+	const matched = /* @__PURE__ */ new Set();
+	for (let i = 0; i < compiled.keys.length; i++) {
+		const key = compiled.keys[i].name;
+		if (typeof key !== "string") continue;
+		const value = match[i + 1];
+		if (value === void 0) {
+			if (!matched.has(key)) params[key] = "";
+			continue;
+		}
+		matched.add(key);
+		params[key] = value;
+	}
+	return {
+		params,
+		unmatched: Object.keys(params).filter((key) => !matched.has(key))
+	};
+}
+//#endregion
+export { compileConfigSource, configSourceError, execConfigSource, matchConfigPattern };

package/dist/config/header-params.d.ts

@@ -0,0 +1,29 @@
+//#region src/config/header-params.d.ts
+/**
+ * Param substitution for next.config.js `headers()` keys and values.
+ *
+ * Next.js compiles each header key and value with `compileNonPath`: only
+ * `:name` markers for captured params are substituted, every other
+ * path-to-regexp metacharacter stays literal, repeated params are joined with
+ * their template prefix and suffix, and params are inserted verbatim (no
+ * encoding or validation).
+ *
+ * https://github.com/vercel/next.js/blob/v16.2.7/packages/next/src/shared/lib/router/utils/prepare-destination.ts
+ * https://github.com/vercel/next.js/blob/v16.2.7/packages/next/src/shared/lib/router/utils/route-match-utils.ts
+ */
+/**
+ * Params captured by a header rule: path-to-regexp source params (`*`/`+`
+ * params are arrays) merged with Next.js `matchHas` captures. A has capture
+ * can be `undefined` when its named group did not participate in the match.
+ */
+export type HeaderParams = Record<string, string | string[] | undefined>;
+/**
+ * Substitute `params` into a header key or value like Next.js's
+ * `compileNonPath`. Throws where Next.js throws: a repeated param referenced
+ * without `*`/`+`, an `undefined` has capture, or a template path-to-regexp
+ * cannot parse.
+ */
+export declare function compileHeaderParamTemplate(value: string, params: HeaderParams): string;
+/** Whether a substituted header pair can be sent as a response header. */
+export declare function isValidHeaderPair(key: string, value: string): boolean;
+//#endregion

package/dist/config/header-params.js

@@ -0,0 +1,106 @@
+import { parsePathPattern } from "../utils/path-to-regexp.js";
+//#region src/config/header-params.ts
+/**
+* Param substitution for next.config.js `headers()` keys and values.
+*
+* Next.js compiles each header key and value with `compileNonPath`: only
+* `:name` markers for captured params are substituted, every other
+* path-to-regexp metacharacter stays literal, repeated params are joined with
+* their template prefix and suffix, and params are inserted verbatim (no
+* encoding or validation).
+*
+* https://github.com/vercel/next.js/blob/v16.2.7/packages/next/src/shared/lib/router/utils/prepare-destination.ts
+* https://github.com/vercel/next.js/blob/v16.2.7/packages/next/src/shared/lib/router/utils/route-match-utils.ts
+*/
+/**
+* Substitute `params` into a header key or value like Next.js's
+* `compileNonPath`. Throws where Next.js throws: a repeated param referenced
+* without `*`/`+`, an `undefined` has capture, or a template path-to-regexp
+* cannot parse.
+*/
+function compileHeaderParamTemplate(value, params) {
+	if (!value.includes(":")) return value;
+	const keys = Object.keys(params);
+	const cacheKey = JSON.stringify([value, keys]);
+	let compiled = _compiledTemplateCache.get(cacheKey);
+	if (!compiled) {
+		try {
+			compiled = { compile: compileTemplate(value, keys) };
+		} catch (error) {
+			compiled = { error };
+		}
+		_compiledTemplateCache.set(cacheKey, compiled);
+	}
+	if ("error" in compiled) throw compiled.error;
+	return compiled.compile(params);
+}
+const _compiledTemplateCache = /* @__PURE__ */ new Map();
+function compileTemplate(value, keys) {
+	for (const key of keys) if (value.includes(`:${key}`)) value = value.replace(new RegExp(`:${key}\\*`, "g"), `:${key}--ESCAPED_PARAM_ASTERISKS`).replace(new RegExp(`:${key}\\?`, "g"), `:${key}--ESCAPED_PARAM_QUESTION`).replace(new RegExp(`:${key}\\+`, "g"), `:${key}--ESCAPED_PARAM_PLUS`).replace(new RegExp(`:${key}(?!\\w)`, "g"), `--ESCAPED_PARAM_COLON${key}`);
+	value = value.replace(/(:|\*|\?|\+|\(|\)|\{|\})/g, "\\$1").replace(/--ESCAPED_PARAM_PLUS/g, "+").replace(/--ESCAPED_PARAM_COLON/g, ":").replace(/--ESCAPED_PARAM_QUESTION/g, "?").replace(/--ESCAPED_PARAM_ASTERISKS/g, "*");
+	const compiler = safeCompile(`/${value}`);
+	return (params) => compiler(params).slice(1);
+}
+const PARAM_SEPARATOR = "_NEXTSEP_";
+function safeCompile(route) {
+	const needsNormalization = /\/\(\.{1,3}\):[^/\s]+/.test(route) || ADJACENT_PARAMS_RE.test(route);
+	const routeToUse = needsNormalization ? normalizeAdjacentParameters(route) : route;
+	try {
+		const compiler = compile(routeToUse);
+		return needsNormalization ? (params) => stripNormalizedSeparators(compiler(params)) : compiler;
+	} catch (error) {
+		if (needsNormalization) throw error;
+		try {
+			const compiler = compile(normalizeAdjacentParameters(route));
+			return (params) => stripNormalizedSeparators(compiler(params));
+		} catch {
+			throw error;
+		}
+	}
+}
+const ADJACENT_PARAMS_RE = /:[a-zA-Z_][a-zA-Z0-9_]*:[a-zA-Z_][a-zA-Z0-9_]*/;
+function normalizeAdjacentParameters(route) {
+	return route.replace(/(\([^)]*\)):([^/\s]+)/g, `$1${PARAM_SEPARATOR}:$2`).replace(/:([^:/\s)]+)(?=:)/g, `:$1${PARAM_SEPARATOR}`);
+}
+function stripNormalizedSeparators(pathname) {
+	return pathname.replace(new RegExp(`\\)${PARAM_SEPARATOR}`, "g"), ")");
+}
+function compile(route) {
+	const tokens = parsePathPattern(route);
+	return (params) => {
+		let path = "";
+		for (const token of tokens) {
+			if (typeof token === "string") {
+				path += token;
+				continue;
+			}
+			const value = params[token.name];
+			const optional = token.modifier === "?" || token.modifier === "*";
+			const repeat = token.modifier === "*" || token.modifier === "+";
+			if (Array.isArray(value)) {
+				if (!repeat) throw new TypeError(`Expected "${token.name}" to not repeat, but got an array`);
+				if (value.length === 0) {
+					if (optional) continue;
+					throw new TypeError(`Expected "${token.name}" to not be empty`);
+				}
+				for (const segment of value) path += token.prefix + segment + token.suffix;
+				continue;
+			}
+			if (typeof value === "string") {
+				path += token.prefix + value + token.suffix;
+				continue;
+			}
+			if (optional) continue;
+			throw new TypeError(`Expected "${token.name}" to be ${repeat ? "an array" : "a string"}`);
+		}
+		return path;
+	};
+}
+const HTTP_TOKEN_RE = /^[\^_`a-zA-Z\-0-9!#$%&'*+.|~]+$/;
+const INVALID_HEADER_VALUE_CHAR_RE = /[^\t\x20-\x7e\x80-\xff]/;
+/** Whether a substituted header pair can be sent as a response header. */
+function isValidHeaderPair(key, value) {
+	return HTTP_TOKEN_RE.test(key) && !INVALID_HEADER_VALUE_CHAR_RE.test(value);
+}
+//#endregion
+export { compileHeaderParamTemplate, isValidHeaderPair };

package/dist/config/next-config.d.ts

@@ -609,11 +609,13 @@ export declare function normalizeAssetPrefix(value: unknown): string;
 /**
  * Resolve the App Router RSC compatibility identity for a build.
  *
- * This token is baked into the client bundle and echoed by the server in the
- * `X-Vinext-RSC-Compatibility-Id` response header; browser navigation rejects
- * RSC payloads whose token differs (deploy skew) without exposing the raw
- * build ID. When the user pins a `deploymentId` we reuse it (already stable
- * across plugin instances); otherwise we mint a random UUID.
+ * The server sends this token with each page (the navigation bootstrap) and in
+ * the `X-Vinext-RSC-Compatibility-Id` response header; browser navigation
+ * rejects RSC payloads whose token differs from its page's (deploy skew)
+ * without exposing the raw build ID. It is never inlined into the client
+ * bundle, where a per-build value would rename chunks on every build. When
+ * the user pins a `deploymentId` we reuse it (already stable across plugin
+ * instances); otherwise we mint a random UUID.
  *
  * NOTE: like `resolveBuildId`, this is non-deterministic in the no-deploymentId
  * case, so a single `vite build` that instantiates the plugin more than once

package/dist/config/next-config.js

@@ -5,6 +5,7 @@ import { isUnknownRecord } from "../utils/record.js";
 import { PHASE_DEVELOPMENT_SERVER, PHASE_PRODUCTION_BUILD } from "../shims/constants.js";
 import { getHtmlLimitedBotRegex } from "../utils/html-limited-bots.js";
 import { flattenPluginOptions } from "../utils/plugin-options.js";
+import { configSourceError } from "./config-source.js";
 import { isExternalUrl } from "../utils/external-url.js";
 import { applyLocaleToRoutes } from "./config-matchers.js";
 import { loadTsconfigResolutionForRoot } from "./tsconfig-paths.js";
@@ -534,11 +535,13 @@ function resolveDeploymentId(configDeploymentId) {
 /**
 * Resolve the App Router RSC compatibility identity for a build.
 *
-* This token is baked into the client bundle and echoed by the server in the
-* `X-Vinext-RSC-Compatibility-Id` response header; browser navigation rejects
-* RSC payloads whose token differs (deploy skew) without exposing the raw
-* build ID. When the user pins a `deploymentId` we reuse it (already stable
-* across plugin instances); otherwise we mint a random UUID.
+* The server sends this token with each page (the navigation bootstrap) and in
+* the `X-Vinext-RSC-Compatibility-Id` response header; browser navigation
+* rejects RSC payloads whose token differs from its page's (deploy skew)
+* without exposing the raw build ID. It is never inlined into the client
+* bundle, where a per-build value would rename chunks on every build. When
+* the user pins a `deploymentId` we reuse it (already stable across plugin
+* instances); otherwise we mint a random UUID.
 *
 * NOTE: like `resolveBuildId`, this is non-deterministic in the no-deploymentId
 * case, so a single `vite build` that instantiates the plugin more than once
@@ -750,6 +753,93 @@ function normalizeI18nConfig(value) {
 	};
 }
 /**
+* Fail config loading on an invalid source, as Next.js fails the build
+* (load-custom-routes.ts checkCustomRoutes), instead of silently skipping a
+* redirect or security header per request.
+*/
+function validateConfigSources(type, routes) {
+	const invalid = [];
+	for (const route of routes) {
+		const error = configSourceError(route?.source);
+		if (!error) continue;
+		invalid.push(`  ${describeSource(route?.source)}: ${error}`);
+	}
+	if (invalid.length > 0) throw new Error(`Invalid next.config.js ${type} source${invalid.length === 1 ? "" : "s"}:\n${invalid.join("\n")}`);
+}
+/**
+* A route source for an error message. Only a string is shown as is; any
+* other value, such as a BigInt, may not serialize.
+*/
+function describeSource(source) {
+	return typeof source === "string" ? JSON.stringify(source) : `(${source === null ? "null" : typeof source})`;
+}
+const CONDITION_TYPES = /* @__PURE__ */ new Set([
+	"header",
+	"cookie",
+	"query",
+	"host"
+]);
+/**
+* Fail config loading on a malformed has/missing list or item, with the rules
+* of Next.js's checkCustomRoutes (load-custom-routes.ts). The matchers rely on
+* these shapes.
+*/
+function validateConfigConditions(type, routes) {
+	const invalid = [];
+	for (const route of routes) {
+		const source = describeSource(route?.source);
+		for (const field of ["has", "missing"]) {
+			const items = route?.[field];
+			if (items === void 0) continue;
+			if (!Array.isArray(items)) {
+				invalid.push(`  ${source}: \`${field}\` must be undefined or an array`);
+				continue;
+			}
+			for (const item of items) {
+				const condition = item ?? {};
+				const parts = [];
+				if (!CONDITION_TYPES.has(condition.type)) parts.push("invalid type");
+				if (typeof condition.key !== "string" && condition.type !== "host") parts.push("invalid key");
+				if (condition.value !== void 0 && typeof condition.value !== "string") parts.push("invalid value");
+				if (condition.value === void 0 && condition.type === "host") parts.push("value is required for \"host\" type");
+				if (parts.length > 0) invalid.push(`  ${source}: \`${field}\` item: ${parts.join(", ")} for ${describeConfigValue(item)}`);
+			}
+		}
+	}
+	if (invalid.length > 0) throw new Error(`Invalid next.config.js ${type} has/missing condition${invalid.length === 1 ? "" : "s"}:\n${invalid.join("\n")}\nEach item must be { type: header, cookie, query or host, key: string, value?: string }, with a value and no key required for host.`);
+}
+/** JSON for a config value, or its type when JSON cannot serialize it. */
+function describeConfigValue(value) {
+	try {
+		return JSON.stringify(value) ?? `(${typeof value})`;
+	} catch {
+		return `(${typeof value})`;
+	}
+}
+/**
+* The sources Next.js's processRoutes builds from `routes` by adding the
+* basePath and locale prefixes, which checkCustomRoutes then checks again
+* (load-custom-routes.ts). vinext adds basePath at match time instead, so
+* these exist only for that check.
+*/
+function processedRouteSources(routes, type, options) {
+	const { basePath, i18n, trailingSlash } = options;
+	const escape = (value) => value.replace(/[|\\{}()[\]^$+*?.-]/g, "\\$&");
+	const suffixFor = (source) => source === "/" && !trailingSlash ? "" : source;
+	const defaultLocales = i18n && type === "redirect" ? [...(i18n.domains ?? []).map((domain) => domain.defaultLocale), i18n.defaultLocale] : [];
+	const sources = [];
+	for (const route of routes) {
+		const sourceBasePath = basePath && route.basePath !== false ? basePath : "";
+		let source = route.source;
+		if (i18n && route.locale !== false) {
+			if ("destination" in route && route.destination?.startsWith("/")) for (const locale of defaultLocales) sources.push({ source: `${sourceBasePath}/${locale}${suffixFor(source)}` });
+			source = `/:nextInternalLocale(${i18n.locales.map(escape).join("|")})${suffixFor(source)}`;
+		}
+		sources.push({ source: `${sourceBasePath}${source === "/" && sourceBasePath ? "" : source}` });
+	}
+	return sources;
+}
+/**
 * Resolve a NextConfig into a fully-resolved ResolvedNextConfig.
 * Awaits async functions for redirects/rewrites/headers.
 */
@@ -852,11 +942,18 @@ async function resolveNextConfig(config, root = toSlash(process.cwd()), options
 		};
 	}
 	{
-		const externalRewrites = [
+		const allRewrites = [
 			...rewrites.beforeFiles,
 			...rewrites.afterFiles,
 			...rewrites.fallback
-		].filter((rewrite) => isExternalUrl(rewrite.destination));
+		];
+		validateConfigSources("redirect", redirects);
+		validateConfigSources("rewrite", allRewrites);
+		validateConfigConditions("redirect", redirects);
+		validateConfigConditions("rewrite", allRewrites);
+		const invalidBasePathRewrites = allRewrites.filter((rewrite) => rewrite.basePath === false && !(rewrite.destination.startsWith("http://") || rewrite.destination.startsWith("https://")));
+		if (invalidBasePathRewrites.length > 0) throw new Error(invalidBasePathRewrites.map((rewrite) => `The route ${rewrite.source} rewrites urls outside of the basePath. Please use a destination that starts with \`http://\` or \`https://\` https://nextjs.org/docs/messages/invalid-external-rewrite`).concat(`Invalid rewrite${invalidBasePathRewrites.length === 1 ? "" : "s"} found`).join("\n"));
+		const externalRewrites = allRewrites.filter((rewrite) => isExternalUrl(rewrite.destination));
 		if (externalRewrites.length > 0) {
 			const noun = externalRewrites.length === 1 ? "external rewrite" : "external rewrites";
 			const listing = externalRewrites.map((rewrite) => `  ${rewrite.source} → ${rewrite.destination}`).join("\n");
@@ -865,6 +962,22 @@ async function resolveNextConfig(config, root = toSlash(process.cwd()), options
 	}
 	let headers = [];
 	if (config.headers) headers = await config.headers();
+	validateConfigSources("header", headers);
+	validateConfigConditions("header", headers);
+	if (config.basePath || i18n) {
+		const processOptions = {
+			basePath: config.basePath ?? "",
+			i18n,
+			trailingSlash: config.trailingSlash ?? false
+		};
+		validateConfigSources("redirect", processedRouteSources(redirects, "redirect", processOptions));
+		validateConfigSources("rewrite", processedRouteSources([
+			...rewrites.beforeFiles,
+			...rewrites.afterFiles,
+			...rewrites.fallback
+		], "rewrite", processOptions));
+		validateConfigSources("header", processedRouteSources(headers, "header", processOptions));
+	}
 	const webpackProbe = await probeWebpackConfig(config, root, options.dev ?? false);
 	const mdx = webpackProbe.mdx;
 	const aliases = {

package/dist/entries/app-browser-entry.d.ts

@@ -9,13 +9,26 @@ import { VinextLinkPrefetchRoute, VinextPagesLinkPrefetchRoute } from "../client
  * embedded RSC payload and handles client-side navigation by re-fetching
  * RSC streams.
  */
-export declare function generateBrowserEntry(routes?: readonly AppRoute[], routeManifest?: RouteManifest | null, pagesPrefetchRoutes?: readonly VinextPagesLinkPrefetchRoute[], rewrites?: {
+export declare function generateBrowserEntry(routes?: readonly AppRoute[], pagesPrefetchRoutes?: readonly VinextPagesLinkPrefetchRoute[], rewrites?: {
   afterFiles: NextRewrite[];
   beforeFiles: NextRewrite[];
   fallback: NextRewrite[];
 }, locales?: readonly string[]): string;
+/**
+ * App route handlers for hybrid App/Pages ownership, with their static
+ * segments hashed so the client never receives their paths in plain text.
+ */
+export declare function toHashedRouteHandlerRoutes(routes: readonly AppRoute[]): VinextLinkPrefetchRoute[];
 /** Project an `AppRoute` down to the public `VinextLinkPrefetchRoute` shape. */
 export declare function toLinkPrefetchRoute(route: AppRoute, hasSiblingInterceptLoading?: boolean): VinextLinkPrefetchRoute;
 /** Project App routes together so sibling-intercept loading is applied to its target route. */
 export declare function toLinkPrefetchRoutes(routes: readonly AppRoute[]): VinextLinkPrefetchRoute[];
+/**
+ * Generate the virtual module that holds the browser RouteManifest.
+ *
+ * The App browser runtime imports it dynamically when hydration starts, so the
+ * manifest, which grows with every route, stays out of the entry chunk. The
+ * JSON string keeps the parse on V8's fast JSON path.
+ */
+export declare function generateBrowserRouteManifestModule(routeManifest: RouteManifest | null): string;
 //#endregion

package/dist/entries/app-browser-entry.js

@@ -1,6 +1,8 @@
 import { patternsStructurallyEquivalent } from "../routing/app-route-graph.js";
 import { resolveClientRuntimeModule, resolveRuntimeEntryModule } from "./runtime-entry-module.js";
 import { toClientRewrites } from "../client/client-rewrites.js";
+import { hashRoutePatternParts } from "../routing/hashed-route-patterns.js";
+import { toBrowserRouteManifestWire } from "../routing/browser-route-manifest.js";
 //#region src/entries/app-browser-entry.ts
 /**
 * Generate the virtual browser entry module.
@@ -9,20 +11,20 @@ import { toClientRewrites } from "../client/client-rewrites.js";
 * embedded RSC payload and handles client-side navigation by re-fetching
 * RSC streams.
 */
-function generateBrowserEntry(routes = [], routeManifest = null, pagesPrefetchRoutes = [], rewrites = {
+function generateBrowserEntry(routes = [], pagesPrefetchRoutes = [], rewrites = {
 	afterFiles: [],
 	beforeFiles: [],
 	fallback: []
 }, locales = []) {
 	const entryPath = resolveRuntimeEntryModule("app-browser-entry");
 	const reactInstanceBootstrapPath = resolveClientRuntimeModule("react-instance-bootstrap");
-	const navigationRuntimePath = resolveClientRuntimeModule("navigation-runtime");
 	const prefetchRoutes = toLinkPrefetchRoutes(routes);
+	const routeHandlers = pagesPrefetchRoutes.length > 0 ? toHashedRouteHandlerRoutes(routes) : [];
 	const clientRewrites = toClientRewrites(rewrites);
 	return `import ${JSON.stringify(reactInstanceBootstrapPath)};
-import { registerNavigationRuntimeBootstrap } from ${JSON.stringify(navigationRuntimePath)};
 
 window.__VINEXT_LINK_PREFETCH_ROUTES__ = ${JSON.stringify(prefetchRoutes)};
+window.__VINEXT_APP_ROUTE_HANDLERS__ = ${JSON.stringify(routeHandlers)};
 // Pages route manifest for hybrid ownership decisions. In a hybrid
 // app+pages build the user can land on an App page, so the App browser
 // entry must also expose the Pages manifest (the Pages client entry does
@@ -30,9 +32,6 @@ window.__VINEXT_LINK_PREFETCH_ROUTES__ = ${JSON.stringify(prefetchRoutes)};
 window.__VINEXT_PAGES_LINK_PREFETCH_ROUTES__ = ${JSON.stringify(pagesPrefetchRoutes)};
 window.__VINEXT_CLIENT_REWRITES__ = ${JSON.stringify(clientRewrites)};
 window.__VINEXT_LOCALES__ = ${JSON.stringify(locales)};
-registerNavigationRuntimeBootstrap({
-    routeManifest: ${buildRouteManifestExpression(routeManifest)}
-});
 import ${JSON.stringify(entryPath)};`;
 }
 /**
@@ -45,13 +44,17 @@ function isLinkPrefetchRoute(route) {
 	if (route.pagePath !== null) return true;
 	return route.routePath === null && route.layouts.length > 0;
 }
-function toDocumentOnlyAppRoute(route) {
-	return {
+/**
+* App route handlers for hybrid App/Pages ownership, with their static
+* segments hashed so the client never receives their paths in plain text.
+*/
+function toHashedRouteHandlerRoutes(routes) {
+	return routes.flatMap((route) => isLinkPrefetchRoute(route) ? [] : [{
 		canPrefetchLoadingShell: false,
 		documentOnly: true,
-		patternParts: [...route.patternParts],
-		isDynamic: route.isDynamic
-	};
+		isDynamic: route.isDynamic,
+		patternParts: hashRoutePatternParts(route.patternParts)
+	}]);
 }
 function requiresDynamicNavigationRequest(route) {
 	return route.isDynamic && route.parallelSlots.length > 0;
@@ -79,31 +82,18 @@ function toLinkPrefetchRoute(route, hasSiblingInterceptLoading = route.siblingIn
 function toLinkPrefetchRoutes(routes) {
 	const siblingInterceptLoadingTargets = [];
 	for (const route of routes) for (const intercept of route.siblingIntercepts) if ((intercept.loadingPaths?.length ?? 0) > 0) siblingInterceptLoadingTargets.push(splitPatternParts(intercept.targetPattern));
-	return routes.map((route) => isLinkPrefetchRoute(route) ? toLinkPrefetchRoute(route, siblingInterceptLoadingTargets.some((targetParts) => patternsStructurallyEquivalent(targetParts, route.patternParts))) : toDocumentOnlyAppRoute(route));
-}
-function buildRouteManifestExpression(routeManifest) {
-	if (routeManifest === null) return "null";
-	const graph = routeManifest.segmentGraph;
-	return `{
-  graphVersion: ${JSON.stringify(routeManifest.graphVersion)},
-  segmentGraph: {
-    routes: ${buildMapExpression(graph.routes)},
-    pages: ${buildMapExpression(graph.pages)},
-    routeHandlers: ${buildMapExpression(graph.routeHandlers)},
-    layouts: ${buildMapExpression(graph.layouts)},
-    templates: ${buildMapExpression(graph.templates)},
-    slots: ${buildMapExpression(graph.slots)},
-    defaults: ${buildMapExpression(graph.defaults)},
-    slotBindings: ${buildMapExpression(graph.slotBindings)},
-    interceptions: ${buildMapExpression(graph.interceptions)},
-    interceptionsBySlotId: ${buildMapExpression(graph.interceptionsBySlotId)},
-    boundaries: ${buildMapExpression(graph.boundaries)},
-    rootBoundaries: ${buildMapExpression(graph.rootBoundaries)}
-  }
-}`;
+	return routes.filter(isLinkPrefetchRoute).map((route) => toLinkPrefetchRoute(route, siblingInterceptLoadingTargets.some((targetParts) => patternsStructurallyEquivalent(targetParts, route.patternParts))));
 }
-function buildMapExpression(map) {
-	return `new Map(${JSON.stringify(Array.from(map.entries()))})`;
+/**
+* Generate the virtual module that holds the browser RouteManifest.
+*
+* The App browser runtime imports it dynamically when hydration starts, so the
+* manifest, which grows with every route, stays out of the entry chunk. The
+* JSON string keeps the parse on V8's fast JSON path.
+*/
+function generateBrowserRouteManifestModule(routeManifest) {
+	if (routeManifest === null) return "export default null;";
+	return `export default JSON.parse(${JSON.stringify(JSON.stringify(toBrowserRouteManifestWire(routeManifest)))});`;
 }
 //#endregion
-export { generateBrowserEntry, toLinkPrefetchRoute, toLinkPrefetchRoutes };
+export { generateBrowserEntry, generateBrowserRouteManifestModule, toHashedRouteHandlerRoutes, toLinkPrefetchRoute, toLinkPrefetchRoutes };

package/dist/entries/app-rsc-entry.d.ts

@@ -93,6 +93,8 @@ type AppRouterConfig = {
   draftModeSecret?: string;
   /** Server-only token used to authorize build-time prerender endpoints. */
   prerenderSecret?: string;
+  /** next.config `skipProxyUrlNormalize`. */
+  skipProxyUrlNormalize?: boolean;
   /** next.config `skipTrailingSlashRedirect`. */
   skipTrailingSlashRedirect?: boolean;
   /** Dev-only key authenticating the hybrid Pages handler's forwarded middleware context. */