vinext 1.4.0 → 1.4.2

package/dist/server/nitro-public-files-plugin.js

@@ -53,17 +53,26 @@ function toH3Pathname(pathname) {
 	}
 }
 /**
+* The key Nitro's static handler looks a pathname up under, following
+* `runtime/internal/static.mjs`: without one trailing slash and decoded
+* except for `%2F`.
+*/
+function toAssetId(pathname) {
+	const id = pathname.length > 1 && pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
+	try {
+		return decodeURIComponent(id.replace(/%2f/gi, "%252F"));
+	} catch {
+		return id;
+	}
+}
+/**
 * Whether Nitro's static handler would answer a request for a pathname with
-* a public file, following its lookup in `runtime/internal/static.mjs`. It
-* looks h3's pathname up without one trailing slash and decoded except for
-* `%2F`, and then as a directory with an `index.html`, each first with the
-* extension of a compressed copy for every encoding the request accepts.
+* a public file. It looks h3's pathname up under its key, and then as a
+* directory with an `index.html`, each first with the extension of a
+* compressed copy for every encoding the request accepts.
 */
 function isPublicFilePathname(pathname, extensions, publicAssets) {
-	let id = pathname.length > 1 && pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
-	try {
-		id = decodeURIComponent(id.replace(/%2f/gi, "%252F"));
-	} catch {}
+	const id = toAssetId(pathname);
 	const index = id.endsWith("/") ? `${id}index.html` : `${id}/index.html`;
 	return extensions.some((extension) => publicAssets.has(id + extension) || publicAssets.has(index + extension));
 }
@@ -86,6 +95,9 @@ function createNitroPublicFilesPlugin(options) {
 		const token = crypto.randomUUID();
 		Reflect.set(globalThis, Symbol.for(NITRO_ASSETS_KEY), {
 			async fetch(request) {
+				const { pathname } = new URL(request.url);
+				const h3Pathname = toH3Pathname(pathname);
+				if (h3Pathname === void 0 || toAssetId(h3Pathname) !== toAssetId(pathname)) return new Response(null, { status: 404 });
 				const headers = new Headers(request.headers);
 				headers.set(ASSET_REQUEST_HEADER, token);
 				return appFetch(new Request(request, { headers }));

package/dist/server/pages-data-route.d.ts

@@ -59,8 +59,12 @@ export declare function encodeUrlParserIgnoredCharacters(pathname: string): stri
  * `/_next/data/<buildId>/en.json`            → `/en`
  * `/_next/data/<wrong-id>/about.json`        → null
  * `/_next/data/<buildId>/about`              → null  (missing .json suffix)
+ * `/_next/data/<buildId>/blog/...json`       → null  (strips to a dot segment)
+ *
+ * `decoded` marks a percent-decoded copy of a pathname whose raw form already
+ * parsed: a `%2e` left in it was `%252e` on the wire, an ordinary character.
  */
-export declare function parseNextDataPathname(pathname: string, buildId: string): NextDataMatch | null;
+export declare function parseNextDataPathname(pathname: string, buildId: string, decoded?: boolean): NextDataMatch | null;
 /**
  * The page pathname a `_next/data` URL addresses, whatever its buildId. Next.js
  * compiles every middleware matcher with an optional `/_next/data/<buildId>`

package/dist/server/pages-data-route.js

@@ -1,7 +1,7 @@
 import { MIDDLEWARE_SKIP_HEADER } from "../utils/protocol-headers.js";
-import { addBasePathToPathname, hasBasePath, stripBasePath } from "../utils/base-path.js";
+import { hasBasePath, restoreBasePath, stripBasePath } from "../utils/base-path.js";
 import { NEXTJS_DEPLOYMENT_ID_HEADER } from "./headers.js";
-import { cloneRequestWithUrl } from "./request-pipeline.js";
+import { cloneRequestWithUrl, hasUrlParserDotSegment } from "./request-pipeline.js";
 //#region src/server/pages-data-route.ts
 /**
 * Helpers for the Pages Router `/_next/data/{buildId}/{...page}.json` endpoint.
@@ -62,13 +62,19 @@ function encodeUrlParserIgnoredCharacters(pathname) {
 * `/_next/data/<buildId>/en.json`            → `/en`
 * `/_next/data/<wrong-id>/about.json`        → null
 * `/_next/data/<buildId>/about`              → null  (missing .json suffix)
+* `/_next/data/<buildId>/blog/...json`       → null  (strips to a dot segment)
+*
+* `decoded` marks a percent-decoded copy of a pathname whose raw form already
+* parsed: a `%2e` left in it was `%252e` on the wire, an ordinary character.
 */
-function parseNextDataPathname(pathname, buildId) {
+function parseNextDataPathname(pathname, buildId, decoded = false) {
 	if (!buildId) return null;
 	if (!isNextDataPathname(pathname)) return null;
 	const expectedPrefix = `${NEXT_DATA_PREFIX}${buildId}/`;
 	if (!pathname.startsWith(expectedPrefix)) return null;
-	return pageFromNextDataRest(pathname.slice(expectedPrefix.length, -5));
+	const rest = pathname.slice(expectedPrefix.length, -5);
+	if (!decoded && hasUrlParserDotSegment(rest)) return null;
+	return pageFromNextDataRest(rest);
 }
 /**
 * The page pathname a `_next/data` URL addresses, whatever its buildId. Next.js
@@ -83,7 +89,9 @@ function nextDataMiddlewareMatchPathname(pathname) {
 	if (!isNextDataPathname(pathname)) return null;
 	const buildIdEnd = pathname.indexOf("/", 12);
 	if (buildIdEnd <= 12) return null;
-	return pageFromNextDataRest(pathname.slice(buildIdEnd + 1, -5))?.pagePathname ?? null;
+	const rest = pathname.slice(buildIdEnd + 1, -5);
+	if (hasUrlParserDotSegment(rest)) return null;
+	return pageFromNextDataRest(rest)?.pagePathname ?? null;
 }
 function pageFromNextDataRest(rest) {
 	if (rest.length === 0) return null;
@@ -189,7 +197,7 @@ function normalizePagesDataRequest(request, buildId, basePath = "", trailingSlas
 	};
 	const pagePathname = normalizeNextDataPagePathname(dataMatch.pagePathname, trailingSlash);
 	const normalizedUrl = new URL(reqUrl);
-	normalizedUrl.pathname = hadBasePath ? addBasePathToPathname(pagePathname, basePath) : pagePathname;
+	normalizedUrl.pathname = hadBasePath ? restoreBasePath(pagePathname, basePath) : pagePathname;
 	return {
 		isDataReq: true,
 		request: cloneRequestWithUrl(request, normalizedUrl.href),

package/dist/server/pages-node-compat.d.ts

@@ -7,7 +7,7 @@ export type PagesRequestQuery = Record<string, string | string[]>;
 export type PagesReqResRequest = Readable & {
   method: string;
   url: string;
-  headers: Record<string, string>;
+  headers: Record<string, string | string[] | undefined>;
   query: PagesRequestQuery;
   body: unknown;
   cookies: Record<string, string>;

package/dist/server/pages-node-compat.js

@@ -367,6 +367,8 @@ function isVinextStreamedApiResponse(response) {
 function createPagesReqRes(options) {
 	const headersObj = {};
 	for (const [key, value] of options.request.headers) headersObj[key.toLowerCase()] = value;
+	const setCookies = options.request.headers.getSetCookie();
+	if (setCookies.length > 1) headersObj["set-cookie"] = setCookies;
 	const req = Object.assign(createRequestReadable(options.request), {
 		method: options.request.method,
 		url: options.url,

package/dist/server/pages-page-data.js

@@ -13,7 +13,7 @@ import { normalizeStaticPathname } from "../routing/route-pattern.js";
 import { buildCacheStateHeaders } from "./cache-headers.js";
 import { pagesPathCacheTag } from "./pages-cache-tag.js";
 import { isPageNotModified } from "./http-conditional.js";
-import { generatePagesETag, isPagesStreamingBot, rendersPagesNotModified } from "./pages-page-response.js";
+import { applyPagesPrerenderRevalidateHeader, generatePagesETag, isPagesStreamingBot, rendersPagesNotModified } from "./pages-page-response.js";
 import { createPagesGetInitialPropsRouter, hasPagesGetInitialProps, isResponseSent, loadPagesGetInitialProps } from "./pages-get-initial-props.js";
 import { isSerializableProps } from "./pages-serializable-props.js";
 import { tracePagesData, tracePagesDocument } from "./pages-execution-tracing.js";
@@ -130,6 +130,7 @@ function applyPagesTerminalMissHeaders(response, revalidateSeconds, isrCachePath
 		tags: [pagesPathCacheTag(isrCachePathname)]
 	});
 	for (const [name, value] of Object.entries(buildCacheStateHeaders("MISS"))) response.headers.set(name, value);
+	applyPagesPrerenderRevalidateHeader(response.headers, revalidateSeconds);
 	return response;
 }
 function applyCachedPagesRepresentationHeaders(response, cacheState, entry, options) {

package/dist/server/pages-page-handler.js

@@ -8,6 +8,7 @@ import { getRequestExecutionContext } from "../shims/request-context.js";
 import { extractLocaleFromUrl, resolvePagesI18nRequest } from "./pages-i18n.js";
 import { buildNextDataNotFoundResponse, buildNextDataPropsJsonResponse, normalizePagesDataRequest, parseNextDataPathname } from "./pages-data-route.js";
 import { reportRequestError } from "./instrumentation.js";
+import { logRequestError } from "./request-error-log.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { beginRouteCacheability, isRouteCacheabilityIdentityProbe, isRouteCacheabilityProbe, markRouteCacheabilityExplicitResponsePolicy, markRouteCacheabilityFinalResponseUncacheable, recordRouteCacheability } from "../shims/cacheability-classification.js";
 import { BROWSER_REVALIDATE_CACHE_CONTROL, NEVER_CACHE_CONTROL, STATIC_CACHE_CONTROL, applyCdnResponseHeaders, hasCdnResponsePolicy, hasExplicitNonCacheableResponsePolicy, isCdnResponsePolicyHeader, shouldUseNextDeployCacheControl } from "./cache-control.js";
@@ -22,7 +23,7 @@ import { buildPagesReadinessNextData } from "./pages-readiness.js";
 import { resolvePagesPageMethodResponse } from "./pages-page-method.js";
 import { setCacheStateHeaders } from "./cache-headers.js";
 import { pagesPathCacheTag } from "./pages-cache-tag.js";
-import { renderPagesPageResponse } from "./pages-page-response.js";
+import { applyPagesPrerenderRevalidateHeader, renderPagesPageResponse } from "./pages-page-response.js";
 import { hasPagesGetInitialProps } from "./pages-get-initial-props.js";
 import { traceFindPageComponents, tracePagesDocumentStream } from "./pages-execution-tracing.js";
 import { mergePagesNotFoundSourceHeaders, resolvePagesPageData, resolvePagesStatusPageRenderPath, setPagesResponseHeader } from "./pages-page-data.js";
@@ -244,10 +245,12 @@ function createPagesPageHandler(opts) {
 			hasRewrites
 		});
 		const isCacheabilityProbe = isRouteCacheabilityProbe();
-		if (!isRouteMissErrorRender && options?.__forcedRoute === void 0) {
+		const isTopLevelPageRoute = !isRouteMissErrorRender && options?.__forcedRoute === void 0;
+		const isInitialPropsRender = isTopLevelPageRoute && !isStaticPropsRoute && pagesReadiness.gssp !== true && (pagesReadiness.gip === true || pagesReadiness.appGip === true);
+		if (isTopLevelPageRoute) {
 			beginRouteCacheability("pages-page", route.pattern);
 			if (isRouteCacheabilityIdentityProbe()) return new Response(null, { status: 204 });
-			if (pagesReadiness.gssp !== true && pagesReadiness.gip !== true && !(pagesReadiness.appGip === true && !isStaticPropsRoute) && !isStaticPropsRoute) recordRouteCacheability({
+			if (pagesReadiness.gssp !== true && !isInitialPropsRender && !isStaticPropsRoute) recordRouteCacheability({
 				cacheable: true,
 				cacheControl: STATIC_CACHE_CONTROL
 			});
@@ -282,7 +285,7 @@ function createPagesPageHandler(opts) {
 			resolveSentResponse = resolve;
 		});
 		const reportSsrError = async (e) => {
-			console.error("[vinext] SSR error:", e);
+			logRequestError("[vinext] SSR error:", e);
 			await reportRequestError(e, {
 				path: url,
 				method: request.method,
@@ -435,6 +438,7 @@ function createPagesPageHandler(opts) {
 						clientTraceMetadata: shouldEmitPagesClientTraceMetadata(pageModule, AppComponent) ? vinextConfig.clientTraceMetadata : void 0,
 						documentReqRes: render.documentReqRes,
 						gsspRes: render.gsspRes,
+						isInitialPropsRender,
 						isrCacheKey: pageIsrCacheKey,
 						isrCachePathname,
 						expireSeconds: render.expireSeconds,
@@ -585,6 +589,7 @@ function createPagesPageHandler(opts) {
 					notFoundResponse = stripPagesNotFoundFramingHeaders(notFoundResponse);
 					if (isOnDemandRevalidate) notFoundResponse = withPagesCacheState(notFoundResponse, "REVALIDATED", isrCachePathname);
 					else if (pageDataResult.cacheState) notFoundResponse = withPagesCacheState(notFoundResponse, pageDataResult.cacheState);
+					if (pageDataResult.revalidateSeconds !== void 0) applyPagesPrerenderRevalidateHeader(notFoundResponse.headers, pageDataResult.revalidateSeconds);
 					return finalizePagesPreviewResponse(withBrowserPolicy(notFoundResponse), preview);
 				}
 				if (pageDataResult.kind === "response") {
@@ -614,6 +619,7 @@ function createPagesPageHandler(opts) {
 				});
 				if (isDataReq) {
 					const headers = new Headers();
+					let resHasCacheControl = false;
 					if (gsspRes && typeof gsspRes.getHeaders === "function") {
 						const gsspHeaders = gsspRes.getHeaders();
 						for (const k of Object.keys(gsspHeaders)) {
@@ -622,10 +628,15 @@ function createPagesPageHandler(opts) {
 							if (k.toLowerCase() === "set-cookie" && Array.isArray(v)) for (const cookie of v) headers.append(k, String(cookie));
 							else headers.set(k, Array.isArray(v) ? v.join(", ") : String(v));
 						}
+						resHasCacheControl = headers.has("Cache-Control");
+					} else if (isInitialPropsRender && documentReqRes) {
+						const resHeaders = documentReqRes.res.getHeaders();
+						for (const [name, value] of Object.entries(resHeaders)) if (isCdnResponsePolicyHeader(name)) setPagesResponseHeader(headers, name, value);
+						resHasCacheControl = Boolean(resHeaders["cache-control"]);
 					}
 					if (hasCdnResponsePolicy(headers)) markRouteCacheabilityExplicitResponsePolicy();
-					if (gsspRes) {
-						if (!headers.has("Cache-Control")) headers.set("Cache-Control", NEVER_CACHE_CONTROL);
+					if (gsspRes || isInitialPropsRender) {
+						if (!resHasCacheControl) headers.set("Cache-Control", NEVER_CACHE_CONTROL);
 					} else if (isStaticPropsRoute) {
 						if (isrRevalidateSeconds !== null) applyCdnResponseHeaders(headers, {
 							cacheControl: buildMissIsrCacheControl(isrRevalidateSeconds, vinextConfig.expireTime),

package/dist/server/pages-page-response.d.ts

@@ -17,6 +17,13 @@ export declare function generatePagesETag(payload: string): string;
  * A page whose status carries no body has nothing to store.
  */
 export declare function rendersPagesNotModified(status: number): boolean;
+/**
+ * Hand the revalidate getStaticProps returned to build/prerender.ts, which
+ * records it in vinext-prerender.json like Next.js's `initialRevalidateSeconds`.
+ * The CDN adapter may rewrite Cache-Control, so the build cannot read it there.
+ * Only build-time renders carry this header.
+ */
+export declare function applyPagesPrerenderRevalidateHeader(headers: Headers, revalidateSeconds: number | false): void;
 type PagesFontPreload = {
   href: string;
   type: string;
@@ -79,6 +86,8 @@ type RenderPagesPageResponseOptions = {
   setDocumentInitialHead?: ((head: ReactNode[]) => void) | undefined;
   documentReqRes?: PagesDocumentReqRes | null;
   gsspRes: PagesGsspResponse | null;
+  /** A page or custom `_app` getInitialProps render; rendered per request like gSSP. */
+  isInitialPropsRender?: boolean;
   isrCacheKey: (router: string, pathname: string) => string;
   /** Filesystem-route identity used for ISR persistence and cache tags. */
   isrCachePathname?: string;

package/dist/server/pages-page-response.js

@@ -1,7 +1,8 @@
 import { isBotUserAgent } from "../utils/html-limited-bots.js";
-import { NEXTJS_CACHE_HEADER, VINEXT_REVALIDATED_CACHE_TAG_HEADER } from "./headers.js";
+import { NEXTJS_CACHE_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_REVALIDATED_CACHE_TAG_HEADER } from "./headers.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
 import { reportRequestError } from "./instrumentation.js";
+import { logRequestError } from "./request-error-log.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { markRouteCacheabilityExplicitResponsePolicy } from "../shims/cacheability-classification.js";
 import { BROWSER_REVALIDATE_CACHE_CONTROL, NEVER_CACHE_CONTROL, NO_STORE_CACHE_CONTROL, applyCdnResponseHeaders, hasCdnResponsePolicy, shouldUseNextDeployCacheControl } from "./cache-control.js";
@@ -17,6 +18,7 @@ import { spliceDocumentHeadClose, spliceDocumentHeadOpen, spliceDocumentScripts,
 import { getClientTraceMetadataHTML } from "./client-trace-metadata.js";
 import { setCacheStateHeaders } from "./cache-headers.js";
 import { pagesPathCacheTag } from "./pages-cache-tag.js";
+import { applyPrerenderCacheLifeHeader } from "./prerender-cache-life-header.js";
 import { readStreamAsText } from "../utils/text-stream.js";
 import { loadUserDocumentInitialProps, runDocumentRenderPage } from "./pages-document-initial-props.js";
 import { callDocumentGetInitialProps } from "./document-initial-head.js";
@@ -42,6 +44,17 @@ function generatePagesETag(payload) {
 function rendersPagesNotModified(status) {
 	return status === 204 || status === 205 || status === 304 || getCdnCacheAdapter().deferNotModifiedResponse?.() !== true;
 }
+/**
+* Hand the revalidate getStaticProps returned to build/prerender.ts, which
+* records it in vinext-prerender.json like Next.js's `initialRevalidateSeconds`.
+* The CDN adapter may rewrite Cache-Control, so the build cannot read it there.
+* Only build-time renders carry this header.
+*/
+function applyPagesPrerenderRevalidateHeader(headers, revalidateSeconds) {
+	if (typeof process === "undefined" || process.env?.VINEXT_PRERENDER !== "1") return;
+	headers.delete(VINEXT_PRERENDER_CACHE_LIFE_HEADER);
+	if (typeof revalidateSeconds === "number") applyPrerenderCacheLifeHeader(headers, { revalidate: revalidateSeconds });
+}
 function buildPagesFontHeadHtml(fontLinks, fontPreloads, fontStyles, scriptNonce) {
 	let html = "";
 	const nonceAttr = createNonceAttribute(scriptNonce);
@@ -121,7 +134,7 @@ async function buildPagesCompositeStream(bodyStream, shellPrefix, shellSuffix) {
 	} });
 }
 async function reportPagesIsrCacheWriteError(error, cacheKey, routePattern) {
-	console.error(`[vinext] Pages ISR cache write failed for ${cacheKey}:`, error);
+	logRequestError(`[vinext] Pages ISR cache write failed for ${cacheKey}:`, error);
 	try {
 		await reportRequestError(error, {
 			path: cacheKey,
@@ -284,12 +297,13 @@ async function renderPagesPageResponse(options) {
 			cacheControl: buildMissIsrCacheControl(options.isrRevalidateSeconds, options.expireSeconds),
 			tags: [pathTag]
 		});
+		applyPagesPrerenderRevalidateHeader(responseHeaders, options.isrRevalidateSeconds);
 		if (options.isOnDemandRevalidate) {
 			responseHeaders.set(NEXTJS_CACHE_HEADER, "REVALIDATED");
 			responseHeaders.set(VINEXT_REVALIDATED_CACHE_TAG_HEADER, encodeURIComponent(pathTag));
 		} else setCacheStateHeaders(responseHeaders, "MISS");
 	} else if (options.isStaticPropsRoute && shouldUseNextDeployCacheControl()) responseHeaders.set("Cache-Control", BROWSER_REVALIDATE_CACHE_CONTROL);
-	else if (options.gsspRes && !userSetCacheControl) responseHeaders.set("Cache-Control", NEVER_CACHE_CONTROL);
+	else if ((options.gsspRes || options.isInitialPropsRender || options.isFallback) && !userSetCacheControl) responseHeaders.set("Cache-Control", NEVER_CACHE_CONTROL);
 	if (options.fontLinkHeader) responseHeaders.set("Link", options.fontLinkHeader);
 	if (options.userAgent && isPagesStreamingBot(options.userAgent)) {
 		const fullHtml = await readStreamAsText(compositeStream);
@@ -314,4 +328,4 @@ async function renderPagesPageResponse(options) {
 	}), { __vinextStreamedHtmlResponse: true });
 }
 //#endregion
-export { buildPagesNextDataScript, generatePagesETag, isPagesStreamingBot, renderPagesPageResponse, rendersPagesNotModified };
+export { applyPagesPrerenderRevalidateHeader, buildPagesNextDataScript, generatePagesETag, isPagesStreamingBot, renderPagesPageResponse, rendersPagesNotModified };

package/dist/server/pages-request-pipeline.js

@@ -1,7 +1,7 @@
 import { PRERENDER_REVALIDATE_HEADER } from "../utils/protocol-headers.js";
 import { requestContextFromRequest } from "../config/request-context.js";
 import { isExternalUrl } from "../utils/external-url.js";
-import { addBasePathToPathname } from "../utils/base-path.js";
+import { restoreBasePath } from "../utils/base-path.js";
 import { VINEXT_PRERENDER_REWRITTEN_HEADER } from "./headers.js";
 import { methodNotAllowedResponse, notFoundStaticAssetResponse, sanitizeMethodNotAllowedHeaders } from "./http-error-responses.js";
 import { cloneRequestWithUrl, normalizeTrailingSlash } from "./request-pipeline.js";
@@ -14,10 +14,11 @@ import { buildMiddlewarePrefetchSkipResponse } from "./pages-data-route.js";
 import { markRouteCacheabilityDynamic } from "../shims/cacheability-classification.js";
 import { isOnDemandRevalidateRequest } from "./revalidation-request.js";
 import { mergeRewriteQuery } from "../utils/query.js";
+import { isImageOptimizationPath } from "./image-optimization.js";
 import { setFrameworkRequestRoute } from "./request-tracing.js";
 import { withExternalRewriteResponseHeaders } from "./middleware-response-headers.js";
 import { applyConfigHeadersToHeaderRecord } from "./config-headers.js";
-import { finalizeMissingStaticAssetResponse, mergeHeaders } from "./worker-utils.js";
+import { finalizeMissingStaticAssetResponse, mergeHeaders, mergeStaticFileHeaders } from "./worker-utils.js";
 //#region src/server/pages-request-pipeline.ts
 function ruleUsesUnkeyedRequestCondition(rule) {
 	return [...rule.has ?? [], ...rule.missing ?? []].some((condition) => condition.type === "header" || condition.type === "cookie" || condition.type === "host");
@@ -80,7 +81,7 @@ function wrapMiddlewareWithBasePath(runMiddleware, basePath, hadBasePath) {
 	if (!hadBasePath || !basePath) return runMiddleware;
 	return (request, ctx, opts) => {
 		const mwUrl = new URL(request.url);
-		mwUrl.pathname = addBasePathToPathname(mwUrl.pathname, basePath);
+		mwUrl.pathname = restoreBasePath(mwUrl.pathname, basePath);
 		return runMiddleware(cloneRequestWithUrl(request, mwUrl.toString()), ctx, opts);
 	};
 }
@@ -166,7 +167,7 @@ async function runPagesRequest(request, deps) {
 		const served = await deps.serveFilesystemRoute(requestPathname, middlewareHeaders, phase, resolvedUrl, request, resolvedPathnameHasBasePath);
 		if (served instanceof Response) {
 			const isStaticMethodNotAllowed = served.status === 405 && served.headers.get("allow") === "GET, HEAD";
-			const response = mergeHeaders(served, middlewareHeaders, isStaticMethodNotAllowed || !served.ok || served.status === 206 ? void 0 : middlewareStatus);
+			const response = (resolvedPathnameHasBasePath && isImageOptimizationPath(requestPathname) ? mergeHeaders : mergeStaticFileHeaders)(served, middlewareHeaders, isStaticMethodNotAllowed || !served.ok || served.status === 206 ? void 0 : middlewareStatus);
 			if (isStaticMethodNotAllowed) sanitizeMethodNotAllowedHeaders(response.headers, "GET, HEAD");
 			return {
 				type: "response",
@@ -306,7 +307,7 @@ async function runPagesRequest(request, deps) {
 			let apiRequest = request;
 			if (basePath && hadBasePath) {
 				const apiRequestUrl = new URL(request.url);
-				apiRequestUrl.pathname = addBasePathToPathname(apiRequestUrl.pathname, basePath);
+				apiRequestUrl.pathname = restoreBasePath(apiRequestUrl.pathname, basePath);
 				apiRequest = cloneRequestWithUrl(request, apiRequestUrl.toString());
 			}
 			const response = await deps.handleApi(apiRequest, apiLookupUrl, deps.ctx ?? null, headersFromRecord(middlewareHeaders));

package/dist/server/pages-request-stage-entry.js

@@ -1,9 +1,10 @@
 import { VINEXT_PRERENDER_SECRET_HEADER, VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
+import { applyMiddlewareResponseHeadersToRequest } from "../utils/middleware-request-headers.js";
 import { requestContextFromRequest } from "../config/request-context.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { VINEXT_CACHEABILITY_PROBE_QUERY_PARAM, VINEXT_EXPECTED_WORKER_VERSION_HEADER } from "./headers.js";
 import { notFoundStaticAssetResponse } from "./http-error-responses.js";
-import { attachRequestCfMetadata, cloneRequestWithUrl, filterInternalHeaders, guardProtocolRelativeUrl, haveSameHeaders, withRequestHeaders } from "./request-pipeline.js";
+import { attachRequestCfMetadata, cloneRequestWithUrl, filterInternalHeaders, guardProtocolRelativeUrl, haveSameHeaders, stripRequestUrlFragment, withRequestHeaders } from "./request-pipeline.js";
 import { assetPrefixPathname, isNextStaticPath } from "../utils/asset-prefix.js";
 import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { runWithExecutionContext } from "../shims/request-context.js";
@@ -35,6 +36,15 @@ import * as pagesEntry from "virtual:vinext-pages-request-entry";
 * The public pages-router-entry delegates here. Multi-stage hosts import the
 * named request handler directly and provide their response-stage dispatcher.
 */
+/**
+* Whether middleware's request-header overrides changed the request. Next.js
+* also copies ordinary middleware response headers onto the request; like a
+* client's own headers, those do not opt the render out of the shared stage.
+*/
+function hasRequestHeaderOverrides(originalHeaders, requestHeaders, middlewareResponseHeaders) {
+	const expectedHeaders = middlewareResponseHeaders ? applyMiddlewareResponseHeadersToRequest(originalHeaders, middlewareResponseHeaders) : originalHeaders;
+	return !haveSameHeaders(expectedHeaders, requestHeaders);
+}
 function captureOuterResponsePolicyHeaders(stagedHeaders, transportedPolicyHeaders) {
 	return captureCdnResponsePolicyOverrides(stagedHeaders, new Headers(transportedPolicyHeaders ?? []));
 }
@@ -59,6 +69,7 @@ const configRewrites = vinextConfig?.rewrites ?? {
 const configHeaders = vinextConfig?.headers ?? [];
 const imageConfig = vinextConfig?.images ? {
 	qualities: vinextConfig.images.qualities,
+	localPatterns: vinextConfig.images.localPatterns,
 	dangerouslyAllowSVG: vinextConfig.images.dangerouslyAllowSVG,
 	dangerouslyAllowLocalIP: vinextConfig.images.dangerouslyAllowLocalIP,
 	contentDispositionType: vinextConfig.images.contentDispositionType,
@@ -86,6 +97,7 @@ function handleRequestStageLocally(request, env, ctx, dispatchResponseStage) {
 	return handleRequest(request, env, ctx, (stageRequest, props, _options, stageEnv, stageCtx) => dispatchResponseStage(stageRequest, stageEnv, stageCtx, props), true, "worker", ctx?.assets).then((response) => applyCdnResponseIdentityHeaders(response, originalRequest));
 }
 function handleRequest(request, env, platformCtx, dispatchResponseStage, forceCacheBypass, defaultHostRuntime, assets) {
+	request = stripRequestUrlFragment(request);
 	const url = new URL(request.url);
 	const trace = async () => {
 		await pagesEntry.__ensureInstrumentation?.(platformCtx);
@@ -208,6 +220,7 @@ async function handleRequestImpl(request, env, platformCtx, dispatchResponseStag
 			requestContext: requestContextFromRequest(request)
 		});
 		let speculativeRenderRequest = null;
+		let middlewareResponseHeaders;
 		const deps = {
 			assetPrefix: vinextConfig?.assetPrefix,
 			basePath,
@@ -229,7 +242,15 @@ async function handleRequestImpl(request, env, platformCtx, dispatchResponseStag
 			authorizeOnDemandRevalidate: typeof authorizeOnDemandRevalidate === "function" ? authorizeOnDemandRevalidate : void 0,
 			matchApiRoute: typeof matchApiRoute === "function" ? matchApiRoute : null,
 			matchPageRoute: typeof matchPageRoute === "function" ? matchPageRoute : null,
-			runMiddleware: typeof runMiddleware === "function" ? wrapMiddlewareWithBasePath(runMiddleware, basePath, hadBasePath) : null,
+			runMiddleware: typeof runMiddleware === "function" ? async (middlewareInput, middlewareCtx, middlewareOptions) => {
+				const result = await wrapMiddlewareWithBasePath(runMiddleware, basePath, hadBasePath)(middlewareInput, middlewareCtx, middlewareOptions);
+				middlewareResponseHeaders = void 0;
+				if (result.responseHeaders) {
+					middlewareResponseHeaders = new Headers();
+					for (const [key, value] of result.responseHeaders) middlewareResponseHeaders.append(key, value);
+				}
+				return result;
+			} : null,
 			renderPage: (req, resolvedUrl, options, stagedHeaders) => {
 				if (options?.renderErrorPageOnMiss === false && req.body !== null && !req.bodyUsed) speculativeRenderRequest = req;
 				const stageRequest = speculativeRenderRequest === req && req.body !== null && !req.bodyUsed ? attachRequestCfMetadata(req.clone(), req) : req;
@@ -238,7 +259,7 @@ async function handleRequestImpl(request, env, platformCtx, dispatchResponseStag
 					authorizeOnDemandRevalidate: typeof authorizeOnDemandRevalidate === "function" ? authorizeOnDemandRevalidate : void 0,
 					hasRequestAwareDocument: hasRequestAwareDocument === true,
 					request: req,
-					requestHeadersChanged: !haveSameHeaders(filteredHeaders, req.headers),
+					requestHeadersChanged: hasRequestHeaderOverrides(filteredHeaders, req.headers, middlewareResponseHeaders),
 					routeDataKind: matchedPage?.route.dataKind,
 					stagedHeaders
 				});
@@ -306,7 +327,7 @@ async function handleRequestImpl(request, env, platformCtx, dispatchResponseStag
 				const cache = forceCacheBypass || probeMode ? "bypass" : getPagesResponseStageCacheDisposition({
 					authorizeOnDemandRevalidate: typeof authorizeOnDemandRevalidate === "function" ? authorizeOnDemandRevalidate : void 0,
 					request: req,
-					requestHeadersChanged: !haveSameHeaders(filteredHeaders, req.headers),
+					requestHeadersChanged: hasRequestHeaderOverrides(filteredHeaders, req.headers, middlewareResponseHeaders),
 					stagedHeaders
 				});
 				const dispatched = trackedDispatchResponseStage(req, responseStageProps(), { cache }, env, ctx);

package/dist/server/pages-router-entry.js

@@ -1,5 +1,5 @@
 import { VINEXT_CACHEABILITY_PROBE_HEADER, VINEXT_CACHEABILITY_PROBE_QUERY_PARAM } from "./headers.js";
-import { cloneRequestWithHeaders, cloneRequestWithUrl } from "./request-pipeline.js";
+import { cloneRequestWithHeaders, cloneRequestWithUrl, stripRequestUrlFragment } from "./request-pipeline.js";
 import { runWithExecutionContext } from "../shims/request-context.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { validateCdnRequest } from "./cache-control.js";
@@ -52,7 +52,8 @@ async function handleSingleStageRequest(request, env, platformCtx) {
 	return finalize ? finalize(response, ctx) : response;
 }
 var pages_router_entry_default = { fetch(request, env, ctx) {
-	const handle = () => handleSingleStageRequest(request, env, ctx);
+	const strippedRequest = stripRequestUrlFragment(request);
+	const handle = () => handleSingleStageRequest(strippedRequest, env, ctx);
 	return ctx && typeof ctx.waitUntil === "function" ? runWithExecutionContext(ctx, handle) : handle();
 } };
 //#endregion

package/dist/server/prod-server.d.ts

@@ -102,11 +102,11 @@ declare function sendCompressed(req: IncomingMessage, res: ServerResponse, body:
  * Without a cache, falls back to async filesystem probing (still non-blocking,
  * unlike the old sync existsSync/statSync approach).
  *
- * `extraHeaders` go on every response for the file. `representationHeaders` go
+ * `stagedHeaders` go on every response for the file. `representationHeaders` go
  * only on responses that carry the file's bytes (200 and 206), never on a 304,
  * 412, 416 or 405.
  */
-declare function tryServeStatic(req: IncomingMessage, res: ServerResponse, clientDir: string, pathname: string, compress: boolean, cache?: StaticFileCache, extraHeaders?: Record<string, string | string[]>, statusCode?: number, representationHeaders?: Record<string, string>): Promise<boolean>;
+declare function tryServeStatic(req: IncomingMessage, res: ServerResponse, clientDir: string, pathname: string, compress: boolean, cache?: StaticFileCache, stagedHeaders?: Record<string, string | string[]>, statusCode?: number, representationHeaders?: Record<string, string>): Promise<boolean>;
 /**
  * Convert a Node.js IncomingMessage to a Web Request object.
  *