vinext 1.2.1 → 1.3.0

package/dist/config/config-matchers.js

@@ -1,60 +1,32 @@
 import { PRERENDER_REVALIDATE_HEADER, PRERENDER_REVALIDATE_ONLY_GENERATED_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
 import { buildRequestHeadersFromMiddlewareResponse, getUnconsumedMiddlewareRequestHeaders } from "../utils/middleware-request-headers.js";
-import { analyzeRegexSafety } from "../utils/regex-safety.js";
+import { compileConfigSource, configSourceError, execConfigSource, matchConfigPattern } from "./config-source.js";
 import { normalizeHost, parseCookies, requestContextFromRequest } from "./request-context.js";
 import { isExternalUrl } from "../utils/external-url.js";
 import { attachRequestCfMetadata } from "../server/request-pipeline.js";
 import { substituteDestinationParams, substituteRedirectDestinationQuery } from "./destination-params.js";
+import { compileHeaderParamTemplate, isValidHeaderPair } from "./header-params.js";
 //#region src/config/config-matchers.ts
 /**
-* Cache for compiled regex patterns in matchConfigPattern.
-*
-* Redirect/rewrite patterns are static — they come from next.config.js and
-* never change at runtime. Without caching, every request that hits the regex
-* branch re-runs the full tokeniser walk + isSafeRegex + new RegExp() for
-* every rule in the array. On apps with many locale-prefixed rules (which all
-* contain `(` and therefore enter the regex branch) this dominated profiling
-* at ~2.4 seconds of CPU self-time.
-*
-* Value is `null` when safeRegExp rejected the pattern (ReDoS risk), so we
-* skip it on subsequent requests too without re-running the scanner.
-*/
-const _compiledPatternCache = /* @__PURE__ */ new Map();
-/**
-* Cache for compiled header source regexes in matchHeaders.
-*
-* Each NextHeader rule has a `source` that is run through escapeHeaderSource()
-* then safeRegExp() to produce a RegExp. Both are pure functions of the source
-* string and the result never changes. Without caching, every request
-* re-runs the full escapeHeaderSource tokeniser + isSafeRegex scan + new RegExp()
-* for every header rule.
-*
-* Value is `null` when safeRegExp rejected the pattern (ReDoS risk).
-*/
-const _compiledHeaderSourceCache = /* @__PURE__ */ new Map();
-/**
 * Cache for compiled has/missing condition value regexes in checkSingleCondition.
 *
-* Each has/missing condition may carry a `value` string that is passed directly
-* to safeRegExp() for matching against header/cookie/query/host values. The
-* condition objects are static (from next.config.js) so the compiled RegExp
-* never changes. Without caching, safeRegExp() is called on every request for
-* every condition on every rule.
+* Each has/missing condition may carry a `value` string that is compiled as a
+* regex for matching against header/cookie/query/host values. The condition
+* objects are static (from next.config.js) so the compiled RegExp never
+* changes. Without caching, the value is recompiled on every request for every
+* condition on every rule.
 *
-* Value is `null` when safeRegExp rejected the pattern, or `false` when the
-* value string was undefined (no regex needed — use exact string comparison).
+* Value is `null` when the value is not a valid regex (use exact string
+* comparison instead).
 */
 const _compiledConditionCache = /* @__PURE__ */ new Map();
 /**
-* Generic helper for the regex compilation caches above.
+* Generic helper for the regex compilation cache above.
 *
-* Each cache stores the compiled artifact (or `null` when safeRegExp rejected
-* the pattern) the first time a key is seen, and reuses it forever. The
+* The cache stores the compiled artifact (or `null` when the pattern could
+* not be compiled) the first time a key is seen, and reuses it forever. The
 * `undefined` sentinel distinguishes "not yet seen" from "seen and rejected"
-* so we never re-run isSafeRegex on the same input.
-*
-* Keep the security path intact: `compile()` is responsible for calling
-* safeRegExp(); this helper only handles caching.
+* so we never recompile the same input.
 */
 function getCachedRegex(cache, key, compile) {
 	let value = cache.get(key);
@@ -106,8 +78,36 @@ function getCachedRegex(cache, key, compile) {
 *      by `applyLocaleToRoutes` for the locale-capture variant)
 * Both forms benefit from O(1) suffix lookup; the optionality is recorded
 * on the entry so we know whether to try the no-locale-prefix bucket.
+*
+* The index must match exactly what the compiled source would. So the param
+* name follows path-to-regexp's `\w` name lexer, the alternatives are plain
+* words, possibly empty (a `.*` alternative could span several segments), and
+* the suffix class only admits characters path-to-regexp treats as literals:
+* `:` (param), `*` and `+` (modifiers), `(`, `{`, `?` and `\` are excluded.
 */
-const _LOCALE_STATIC_RE = /^\/:[\w-]+\(([^)]+)\)(\??)\/([a-zA-Z0-9_~.%@!$&'*+,;=:/-]+)$/;
+const _LOCALE_STATIC_RE = /^\/:\w+\(([\w-]*(?:\|[\w-]*)*)\)(\??)\/([a-zA-Z0-9_~.%@!$&',;=/-]+)$/;
+/**
+* ECMAScript's non-Unicode Canonicalize operation, which a RegExp with `i` and
+* without `u` compares characters by: it keeps the original UTF-16 code unit
+* when uppercasing expands it or maps a non-ASCII character to ASCII.
+*/
+function canonicalizeIgnoreCase(character) {
+	const upper = character.toUpperCase();
+	if (upper.length !== 1) return character;
+	if (character.charCodeAt(0) >= 128 && upper.charCodeAt(0) < 128) return character;
+	return upper;
+}
+/**
+* Folds case as a RegExp with `i` and without `u` compares characters, as
+* the compiled source does: `toLowerCase()` would also read the Kelvin sign
+* as `k`.
+*/
+function foldCase(value) {
+	if (!/[^ -~]/.test(value)) return value.toUpperCase();
+	let folded = "";
+	for (let i = 0; i < value.length; i++) folded += canonicalizeIgnoreCase(value[i]);
+	return folded;
+}
 const _redirectIndexCache = /* @__PURE__ */ new WeakMap();
 /**
 * Build (or retrieve from cache) the redirect index for a given redirects array.
@@ -124,12 +124,12 @@ function _getRedirectIndex(redirects) {
 	for (let i = 0; i < redirects.length; i++) {
 		const redirect = redirects[i];
 		const m = _LOCALE_STATIC_RE.exec(redirect.source);
-		if (m) {
+		if (m && m[1] !== "" && !m[3].endsWith("/")) {
 			const paramName = redirect.source.slice(2, redirect.source.indexOf("("));
 			const alternation = m[1];
 			const optional = m[2] === "?";
 			const suffix = "/" + m[3];
-			const altRe = safeRegExp("^(?:" + alternation + ")$", "i");
+			const altRe = compileRegExp("^(?:" + alternation + ")$", "i");
 			if (!altRe) {
 				linear.push([i, redirect]);
 				continue;
@@ -141,7 +141,7 @@ function _getRedirectIndex(redirects) {
 				redirect,
 				originalIndex: i
 			};
-			const bucketKey = suffix.toLowerCase();
+			const bucketKey = foldCase(suffix);
 			const bucket = localeStatic.get(bucketKey);
 			if (bucket) bucket.push(entry);
 			else localeStatic.set(bucketKey, [entry]);
@@ -185,77 +185,18 @@ function stripHopByHopRequestHeaders(headers) {
 	for (const token of connectionTokens) headers.delete(token);
 }
 /**
-* Detect regex patterns vulnerable to catastrophic backtracking (ReDoS).
-*
-* Uses the same deterministic structural analysis as middleware matcher
-* validation. Nested bounded repetition is accepted only when its repeated
-* language has fixed width and unambiguous branches; a fixed outer count can
-* otherwise still cause polynomially catastrophic backtracking on long near
-* misses.
+* Compile a regex from next.config, or return null when it is invalid.
 *
-* Returns true if the pattern appears safe, false if it's potentially dangerous.
+* Like Next.js, patterns are not checked for catastrophic backtracking: they
+* run as written.
 */
-function isSafeRegex(pattern, flags) {
-	return analyzeRegexSafety(pattern, { ignoreCase: flags?.includes("i") }) === null;
-}
-/**
-* Compile a regex pattern safely. Returns the compiled RegExp or null if the
-* pattern is invalid or vulnerable to ReDoS.
-*
-* Logs a warning when a pattern is rejected so developers can fix their config.
-*/
-function safeRegExp(pattern, flags) {
-	if (!isSafeRegex(pattern, flags)) {
-		console.warn(`[vinext] Rejecting potentially unsafe regex pattern (ReDoS risk): ${pattern}\n  Nested or ambiguous repetition can cause catastrophic backtracking.\n  Simplify the pattern to make repeated matches fixed and unambiguous.`);
-		return null;
-	}
+function compileRegExp(pattern, flags) {
 	try {
 		return new RegExp(pattern, flags);
 	} catch {
 		return null;
 	}
 }
-/**
-* Convert a Next.js header/rewrite/redirect source pattern into a regex string.
-*
-* Regex groups in the source (e.g. `(\d+)`) are extracted first, the remaining
-* text is escaped/converted in a **single pass** (avoiding chained `.replace()`
-* which CodeQL flags as incomplete sanitization), then groups are restored.
-*/
-function escapeHeaderSource(source) {
-	const S = "";
-	const groups = [];
-	const withPlaceholders = source.replace(/\(([^)]+)\)/g, (_m, inner) => {
-		groups.push(inner);
-		return `${S}G${groups.length - 1}${S}`;
-	});
-	let result = "";
-	const re = new RegExp(`${S}G(\\d+)${S}|:[\\w-]+|[.+?*]|[^.+?*:\\uE000]+`, "g");
-	let m;
-	while ((m = re.exec(withPlaceholders)) !== null) if (m[1] !== void 0) result += `(${groups[Number(m[1])]})`;
-	else if (m[0].startsWith(":")) {
-		const constraintMatch = withPlaceholders.slice(re.lastIndex).match(new RegExp(`^${S}G(\\d+)${S}`));
-		if (constraintMatch) {
-			re.lastIndex += constraintMatch[0].length;
-			result += `(${groups[Number(constraintMatch[1])]})`;
-		} else result += "[^/]+";
-	} else switch (m[0]) {
-		case ".":
-			result += "\\.";
-			break;
-		case "+":
-			result += "\\+";
-			break;
-		case "?":
-			result += "\\?";
-			break;
-		case "*":
-			result += ".*";
-			break;
-		default: result += m[0];
-	}
-	return result;
-}
 const _BASEPATH_DEFAULT = {
 	basePath: "",
 	hadBasePath: true
@@ -360,11 +301,11 @@ function matchSingleCondition(condition, ctx) {
 }
 /**
 * Return a cached RegExp for a has/missing condition value string, compiling
-* on first use. Returns null if safeRegExp rejected the pattern or if the
-* value is not a valid regex (fall back to exact string comparison).
+* on first use. Returns null if the value is not a valid regex (fall back to
+* exact string comparison).
 */
 function _cachedConditionRegex(value) {
-	return getCachedRegex(_compiledConditionCache, value, () => safeRegExp(`^${value}$`));
+	return getCachedRegex(_compiledConditionCache, value, () => compileRegExp(`^${value}$`));
 }
 /**
 * Check all has/missing conditions for a config rule.
@@ -389,125 +330,13 @@ function checkHasConditions(has, missing, ctx) {
 	return collectConditionParams(has, missing, ctx) !== null;
 }
 /**
-* If the current position in `str` starts with a parenthesized group, consume
-* it and advance `re.lastIndex` past the closing `)`. Returns the group
-* contents or null if no group is present.
-*/
-function extractConstraint(str, re) {
-	if (str[re.lastIndex] !== "(") return null;
-	const start = re.lastIndex + 1;
-	let depth = 1;
-	let i = start;
-	while (i < str.length && depth > 0) {
-		if (str[i] === "(") depth++;
-		else if (str[i] === ")") depth--;
-		i++;
-	}
-	if (depth !== 0) return null;
-	re.lastIndex = i;
-	return str.slice(start, i - 1);
-}
-/**
-* Match a Next.js config pattern (from redirects/rewrites sources) against a pathname.
-* Returns matched params or null.
-*
-* Supports:
-*   :param     - matches a single path segment
-*   :param*    - matches zero or more segments (catch-all)
-*   :param+    - matches one or more segments
-*   (regex)    - inline regex patterns in the source
-*   :param(constraint) - named param with inline regex constraint
-*/
-/**
-* Strip a single trailing slash from a pathname for config-source matching.
-*
-* Next.js conditionally appends `(/)?` to rewrite/redirect/header source
-* regexes when `trailingSlash: true` (see Next.js
-* `resolve-rewrites.ts` and `server-utils.ts:checkRewrite`). Rather than
-* threading the trailingSlash flag through every matcher, we unconditionally
-* strip a trailing slash from the incoming pathname. When `trailingSlash: false`
-* the request pipeline emits a normalizing redirect (step 3) before config
-* rewrites/redirects (step 6) ever run, so the pathname is already slash-free;
-* the unconditional strip is defense-in-depth for that ordering. When
-* `trailingSlash: true` it bridges the gap between the canonicalized request
-* path (`/rewrite-1/`) and source patterns written without a trailing slash
-* (`/rewrite-1`).
-*
-* The root path `"/"` is preserved as-is.
+* Strip one trailing slash, preserving the root path `"/"`. Compiled sources
+* accept an optional trailing slash, so the redirect index looks up the
+* slash-free form.
 */
 function stripTrailingSlashForConfigMatch(value) {
 	return value.length > 1 && value.endsWith("/") ? value.slice(0, -1) : value;
 }
-function configPathEquals(a, b) {
-	return a.toLowerCase() === b.toLowerCase();
-}
-function configPathStartsWith(pathname, prefix) {
-	return pathname.slice(0, prefix.length).toLowerCase() === prefix.toLowerCase();
-}
-function matchConfigPattern(pathname, pattern) {
-	const pathnameHadTrailingSlash = pathname.length > 1 && pathname.endsWith("/");
-	pathname = stripTrailingSlashForConfigMatch(pathname);
-	if (pathnameHadTrailingSlash) pattern = stripTrailingSlashForConfigMatch(pattern);
-	const catchAllAnchor = /:[\w-]+[*+]/.test(pattern);
-	const namedParamCount = (pattern.match(/:[\w-]+/g) || []).length;
-	if (pattern.includes("(") || pattern.includes("\\") || /:[\w-]+[*+][^/]/.test(pattern) || /:[\w-]+\./.test(pattern) || /[^/]:[\w-]+/.test(pattern) || catchAllAnchor && namedParamCount > 1) try {
-		const compiled = getCachedRegex(_compiledPatternCache, pattern, () => {
-			const paramNames = [];
-			let regexStr = "";
-			const tokenRe = /:([\w-]+)|[.]|[^:.]+/g;
-			let tok;
-			while ((tok = tokenRe.exec(pattern)) !== null) if (tok[1] !== void 0) {
-				const name = tok[1];
-				const rest = pattern.slice(tokenRe.lastIndex);
-				if (rest.startsWith("*") || rest.startsWith("+")) {
-					const quantifier = rest[0];
-					tokenRe.lastIndex += 1;
-					const constraint = extractConstraint(pattern, tokenRe);
-					paramNames.push(name);
-					if (constraint !== null) regexStr += `(${constraint})`;
-					else regexStr += quantifier === "*" ? "(.*)" : "(.+)";
-				} else {
-					const constraint = extractConstraint(pattern, tokenRe);
-					paramNames.push(name);
-					regexStr += constraint !== null ? `(${constraint})` : "([^/]+)";
-				}
-			} else if (tok[0] === ".") regexStr += "\\.";
-			else regexStr += tok[0];
-			const re = safeRegExp("^" + regexStr + "$", "i");
-			return re ? {
-				re,
-				paramNames
-			} : null;
-		});
-		if (!compiled) return null;
-		const match = compiled.re.exec(pathname);
-		if (!match) return null;
-		const params = Object.create(null);
-		for (let i = 0; i < compiled.paramNames.length; i++) params[compiled.paramNames[i]] = match[i + 1] ?? "";
-		return params;
-	} catch {}
-	const catchAllMatch = pattern.match(/:([\w-]+)(\*|\+)$/);
-	if (catchAllMatch) {
-		const prefix = pattern.slice(0, pattern.lastIndexOf(":"));
-		const paramName = catchAllMatch[1];
-		const isPlus = catchAllMatch[2] === "+";
-		const prefixNoSlash = prefix.replace(/\/$/, "");
-		if (!configPathStartsWith(pathname, prefixNoSlash)) return null;
-		const charAfter = pathname[prefixNoSlash.length];
-		if (charAfter !== void 0 && charAfter !== "/") return null;
-		const rest = pathname.slice(prefixNoSlash.length);
-		if (isPlus && (!rest || rest === "/")) return null;
-		let restValue = rest.startsWith("/") ? rest.slice(1) : rest;
-		return { [paramName]: restValue };
-	}
-	const parts = pattern.split("/");
-	const pathParts = pathname.split("/");
-	if (parts.length !== pathParts.length) return null;
-	const params = Object.create(null);
-	for (let i = 0; i < parts.length; i++) if (parts[i].startsWith(":")) params[parts[i].slice(1)] = pathParts[i];
-	else if (!configPathEquals(parts[i], pathParts[i])) return null;
-	return params;
-}
 /**
 * Apply redirect rules from next.config.js.
 * Returns the redirect info if a redirect was matched, or null.
@@ -550,7 +379,7 @@ function matchRedirect(pathname, redirects, ctx, basePathState = _BASEPATH_DEFAU
 	let localeMatch = null;
 	let localeMatchIndex = Infinity;
 	if (index.localeStatic.size > 0) {
-		const noLocaleBucket = index.localeStatic.get(normalizedPathname.toLowerCase());
+		const noLocaleBucket = index.localeStatic.get(foldCase(normalizedPathname));
 		if (noLocaleBucket) for (const entry of noLocaleBucket) {
 			if (!entry.optional) continue;
 			if (entry.originalIndex >= localeMatchIndex) continue;
@@ -570,7 +399,7 @@ function matchRedirect(pathname, redirects, ctx, basePathState = _BASEPATH_DEFAU
 		if (slashTwo !== -1) {
 			const suffix = normalizedPathname.slice(slashTwo);
 			const localePart = normalizedPathname.slice(1, slashTwo);
-			const localeBucket = index.localeStatic.get(suffix.toLowerCase());
+			const localeBucket = index.localeStatic.get(foldCase(suffix));
 			if (localeBucket) for (const entry of localeBucket) {
 				if (entry.originalIndex >= localeMatchIndex) continue;
 				if (!entry.altRe.test(localePart)) continue;
@@ -615,17 +444,17 @@ function matchRedirect(pathname, redirects, ctx, basePathState = _BASEPATH_DEFAU
 function matchRewrite(pathname, rewrites, ctx, basePathState = _BASEPATH_DEFAULT, paramsPathname = pathname, onRuleSourceMatch) {
 	for (const rewrite of rewrites) {
 		if (!shouldEvaluateRule(rewrite.basePath, basePathState)) continue;
-		const matchedParams = matchConfigPattern(pathname, rewrite.source);
-		if (matchedParams) {
+		const matched = execConfigSource(pathname, rewrite.source);
+		if (matched) {
 			onRuleSourceMatch?.(rewrite);
-			const params = paramsPathname === pathname ? matchedParams : matchConfigPattern(paramsPathname, rewrite.source) ?? matchedParams;
+			const { params, unmatched } = paramsPathname === pathname ? matched : execConfigSource(paramsPathname, rewrite.source) ?? matched;
 			const conditionParams = rewrite.has || rewrite.missing ? collectConditionParams(rewrite.has, rewrite.missing, ctx) : _emptyParams();
 			if (!conditionParams) continue;
 			const rewriteParams = {
 				...params,
 				...conditionParams
 			};
-			return substituteAndSanitizeRewriteDestination(serializeRewriteDestinationTemplate(rewrite.destination), rewriteParams);
+			return substituteAndSanitizeRewriteDestination(serializeRewriteDestinationTemplate(rewrite.destination), rewriteParams, unmatched.filter((key) => !(key in conditionParams)));
 		}
 	}
 	return null;
@@ -673,16 +502,18 @@ function resolveRedirectMatch(redirect, params) {
 /**
 * Match Next.js's rewrite-specific prepareDestination behavior: source params
 * that are not consumed by the destination path/host are exposed to the target
-* page through query.
+* page through query. Optional params that did not match are not params at
+* all in Next.js, so they are neither appended nor count as consumed.
 *
 * https://github.com/vercel/next.js/blob/canary/packages/next/src/shared/lib/router/utils/prepare-destination.ts
 */
-function substituteAndSanitizeRewriteDestination(destination, params) {
+function substituteAndSanitizeRewriteDestination(destination, params, unmatchedParams) {
 	const rewritten = substituteAndSanitizeDestination(destination, params, "rewrite");
-	if (!shouldAppendRewriteParamsToQuery(destination, params)) return rewritten;
+	const matchedParams = unmatchedParams.length === 0 ? params : Object.fromEntries(Object.entries(params).filter(([key]) => !unmatchedParams.includes(key)));
+	if (!shouldAppendRewriteParamsToQuery(destination, matchedParams)) return rewritten;
 	const existingQueryKeys = getDestinationQueryKeys(destination);
 	const paramsToAppend = [];
-	for (const [key, value] of Object.entries(params)) {
+	for (const [key, value] of Object.entries(matchedParams)) {
 		if (key === "nextInternalLocale" || existingQueryKeys.has(key)) continue;
 		paramsToAppend.push([key, value]);
 	}
@@ -898,23 +729,118 @@ async function proxyExternalRequest(request, externalUrl) {
 * when evaluating headers, so this parameter is required.
 */
 function matchHeaders(pathname, headers, ctx, basePathState = _BASEPATH_DEFAULT, onRuleSourceMatch) {
-	const pathnameHadTrailingSlash = pathname.length > 1 && pathname.endsWith("/");
-	pathname = stripTrailingSlashForConfigMatch(pathname);
 	const result = [];
 	for (const rule of headers) {
 		if (!shouldEvaluateRule(rule.basePath, basePathState)) continue;
-		const source = pathnameHadTrailingSlash ? stripTrailingSlashForConfigMatch(rule.source) : rule.source;
-		const sourceRegex = getCachedRegex(_compiledHeaderSourceCache, source, () => safeRegExp("^" + escapeHeaderSource(source) + "$", "i"));
-		if (sourceRegex && sourceRegex.test(pathname)) {
+		const compiledSource = compileConfigSource(rule.source);
+		const sourceMatch = compiledSource?.re.exec(pathname);
+		if (compiledSource && sourceMatch) {
 			onRuleSourceMatch?.(rule);
 			if (rule.has || rule.missing) {
 				if (!checkHasConditions(rule.has, rule.missing, ctx)) continue;
 			}
-			result.push(...rule.headers);
+			if (!rule.headers.some((header) => header.key.includes(":") || header.value.includes(":"))) {
+				result.push(...rule.headers);
+				continue;
+			}
+			const params = collectHeaderSourceParams(sourceMatch, compiledSource.keys);
+			if (rule.has) collectHeaderHasParams(rule.has, ctx, params);
+			result.push(...substituteHeaderParams(rule.headers, params));
+		}
+	}
+	return result;
+}
+/**
+* Collect source params like Next.js's `getPathMatch` with
+* `removeUnnamedParams`: path-to-regexp's `regexpToFunction` keeps captures
+* raw, splits `*`/`+` captures on the key's prefix and suffix, and omits
+* groups that did not participate.
+*/
+function collectHeaderSourceParams(match, keys) {
+	const params = _emptyParams();
+	for (let index = 1; index < match.length; index++) {
+		const capture = match[index];
+		const key = keys[index - 1];
+		if (capture === void 0 || !key || typeof key.name === "number") continue;
+		params[key.name] = key.modifier === "*" || key.modifier === "+" ? capture.split(key.prefix + key.suffix) : capture;
+	}
+	return params;
+}
+/**
+* Add `has` captures like Next.js's `matchHas`, after checkHasConditions has
+* accepted the rule: a condition without a value exposes the matched value
+* under its key (letters only), a value regex exposes its named groups, and a
+* host regex without named groups exposes the matched host as `host`.
+*
+* https://github.com/vercel/next.js/blob/v16.2.7/packages/next/src/shared/lib/router/utils/prepare-destination.ts
+*/
+function collectHeaderHasParams(has, ctx, params) {
+	for (const condition of has) {
+		let value;
+		switch (condition.type) {
+			case "header":
+				value = ctx.headers.get(condition.key) ?? void 0;
+				break;
+			case "cookie":
+				value = Object.hasOwn(ctx.cookies, condition.key) ? ctx.cookies[condition.key] : void 0;
+				break;
+			case "query": {
+				const values = ctx.query.getAll(condition.key);
+				value = values.length > 1 ? values : values[0];
+				break;
+			}
+			case "host": value = ctx.host;
 		}
+		if (!value) continue;
+		if (!condition.value) {
+			if (condition.type !== "host") params[condition.key.replace(/[^A-Za-z]/g, "")] = value;
+			continue;
+		}
+		const match = _cachedConditionRegex(condition.value)?.exec(Array.isArray(value) ? value[value.length - 1] : value);
+		if (!match) continue;
+		if (match.groups) Object.assign(params, match.groups);
+		else if (condition.type === "host" && match[0]) params.host = match[0];
+	}
+}
+const _warnedHeaderParamTemplates = /* @__PURE__ */ new WeakSet();
+/**
+* Substitute params into header keys and values like Next.js's
+* `compileNonPath`, with params inserted verbatim. Source captures are the raw
+* percent-encoded path text, as in Next.js, but `has` captures from decoded
+* cookies or query values can carry characters a header cannot.
+*
+* Next.js fails the whole request when compiling throws (a repeated param
+* used without `*`/`+`, or a has group that did not participate) or when the
+* result is not a valid header. Requests can trigger both, so vinext instead
+* omits only the affected header and logs once per header template.
+*/
+function substituteHeaderParams(headers, params) {
+	if (Object.keys(params).length === 0) return headers;
+	const result = [];
+	for (const header of headers) {
+		let key;
+		let value;
+		try {
+			key = compileHeaderParamTemplate(header.key, params);
+			value = compileHeaderParamTemplate(header.value, params);
+		} catch (error) {
+			warnHeaderParamTemplate(header, error instanceof Error ? error.message : String(error));
+			continue;
+		}
+		if (key === header.key && value === header.value) result.push(header);
+		else if (isValidHeaderPair(key, value)) result.push({
+			key,
+			value
+		});
+		else warnHeaderParamTemplate(header, "the substituted header is not a valid HTTP header");
 	}
 	return result;
 }
+function warnHeaderParamTemplate(header, reason) {
+	if (_warnedHeaderParamTemplates.has(header)) return;
+	_warnedHeaderParamTemplates.add(header);
+	console.warn(`[vinext] Omitting headers() header "${header.key}: ${header.value}" from a response: ${reason}.`);
+}
 /**
 * Escape a string for inclusion in a regex character class / alternation.
 * Mirrors `escape-string-regexp` semantics used by Next.js's processRoutes.
@@ -936,17 +862,19 @@ function _escapeRegexString(value) {
 *     starts with `/:nextInternalLocale(en|sv|nl)` so that locale-prefixed
 *     URLs match. For redirects only, a second variant prefixed with
 *     `/${defaultLocale}` is also emitted, matching Next.js exactly.
-*   - **Vinext divergence**: we ALSO retain the original (unprefixed) source
-*     so that requests for the default locale that arrive without a prefix
-*     still match. Next.js solves this upstream by path-normalising every
-*     incoming default-locale request to include the prefix
-*     (`resolve-routes.ts` lines ~251-263); vinext currently does that
-*     normalisation only inside the pages-server-entry route matcher, so
-*     the rewrite/redirect matcher would otherwise miss unprefixed paths.
-*     Keeping the unprefixed variant gives functionally identical behaviour
-*     without requiring a server-wide path normalisation pass. The original
-*     source is appended LAST so the locale-aware variants win when both
-*     forms could match.
+*   - Headers get only that variant, exactly like Next.js. Every header
+*     matcher caller splices the (domain-aware) default locale into
+*     unprefixed request paths first (`normalizeDefaultLocalePathname`,
+*     mirroring `resolve-routes.ts`), so `/about` is matched as `/en/about`.
+*     `/_next/*` paths are left unprefixed and therefore only match
+*     `locale: false` rules, as in Next.js.
+*   - **Vinext divergence (redirects/rewrites only)**: we ALSO retain the
+*     original (unprefixed) source, appended LAST so the locale-aware
+*     variants win when both forms could match. Their callers normalise
+*     default-locale paths too, so this is a legacy fallback. Headers never
+*     get it: it would apply rules Next.js skips (`/((?!api).*)` would match
+*     `/fr/api/x` as `fr/api/x`), and default-locale requests would match
+*     both variants, appending additive headers such as `Set-Cookie` twice.
 *
 * Destinations that are local (start with `/`) are similarly rewritten with
 * `/:nextInternalLocale` for the locale-capture variant so the locale
@@ -985,9 +913,9 @@ function applyLocaleToRoutes(routes, i18n, type, options = {}) {
 		};
 		if ("destination" in internalRoute && internalDestination !== void 0) internalRoute.destination = internalDestination;
 		out.push(internalRoute);
-		out.push(r);
+		if (type !== "header") out.push(r);
 	}
 	return out;
 }
 //#endregion
-export { applyLocaleToRoutes, applyMiddlewareRequestHeaders, checkHasConditions, escapeHeaderSource, isExternalUrl, isSafeRegex, matchConfigPattern, matchHeaders, matchRedirect, matchRewrite, matchesRewriteSource, normalizeHost, parseCookies, preserveRedirectDestinationQuery, proxyExternalRequest, requestContextFromRequest, safeRegExp, sanitizeDestination };
+export { applyLocaleToRoutes, applyMiddlewareRequestHeaders, checkHasConditions, configSourceError, isExternalUrl, matchConfigPattern, matchHeaders, matchRedirect, matchRewrite, matchesRewriteSource, normalizeHost, parseCookies, preserveRedirectDestinationQuery, proxyExternalRequest, requestContextFromRequest, sanitizeDestination };

package/dist/config/config-source.d.ts

@@ -0,0 +1,34 @@
+import { PathKey } from "../utils/path-to-regexp.js";
+//#region src/config/config-source.d.ts
+export type CompiledConfigSource = {
+  re: RegExp;
+  /** Keys in capture-group order; unnamed groups have numeric names. */
+  keys: PathKey[];
+};
+/**
+ * Why `source` is not a valid redirects/rewrites/headers source, or null.
+ * Mirrors the source checks in Next.js's checkCustomRoutes, which fail the
+ * build; config loading calls this to do the same.
+ *
+ * https://github.com/vercel/next.js/blob/v16.2.7/packages/next/src/lib/load-custom-routes.ts
+ */
+export declare function configSourceError(source: unknown): string | null;
+export declare function compileConfigSource(source: string): CompiledConfigSource | null;
+/**
+ * Match a Next.js config source (from redirects/rewrites/headers) against a
+ * pathname. Returns the named params or null.
+ *
+ * Unnamed groups are dropped, as Next.js does with `removeUnnamedParams`.
+ * Repeated params (`:path*`, `:path+`) keep the captured string (`a/b`), and
+ * an optional param that did not match is `""`.
+ */
+export declare function matchConfigPattern(pathname: string, pattern: string): Record<string, string> | null;
+/**
+ * matchConfigPattern, also reporting the optional params that did not match.
+ * Next.js leaves those out of its params entirely.
+ */
+export declare function execConfigSource(pathname: string, source: string): {
+  params: Record<string, string>;
+  unmatched: string[];
+} | null;
+//#endregion