vinext 1.4.0 → 1.4.2

package/dist/server/prod-server.js

@@ -8,7 +8,7 @@ import { getRepeatedSlashRedirect, isOpenRedirectShaped, sendRepeatedSlashRedire
 import { readStaticFileSignal } from "./static-file-signal.js";
 import { canonicalizeRequestPathname, filterInternalHeaders } from "./request-pipeline.js";
 import { ASSET_PREFIX_URL_DIR, assetPrefixPathname, isAbsoluteAssetPrefix, isAssetPrefixBuildAsset } from "../utils/asset-prefix.js";
-import { StaticFileCache, contentTypeForPath, etagFromFilenameHash } from "./static-file-cache.js";
+import { StaticFileCache, contentTypeForPath, etagFromFilenameHash, staticFileCacheControl } from "./static-file-cache.js";
 import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { resolveRequestHost, resolveRequestProtocol, resolveTrustedForwardedHost, trustProxy, trustedHosts } from "./proxy-trust.js";
 import { normalizePath } from "./normalize-path.js";
@@ -19,7 +19,7 @@ import { parseHttpDate } from "./http-date.js";
 import { evaluateStaticPreconditions } from "./http-conditional.js";
 import { setPagesClientAssets } from "./pages-client-assets.js";
 import { signalFromNodeResponse } from "./node-response-signal.js";
-import { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, IMAGE_RESPONSE_CACHE_STATE, INVALID_IMAGE_SOURCE_MESSAGE, isImageOptimizationPath, isImageSourceBodyStatus, isSafeImageContentType, parseImageParams, readImageOptimizationSignal } from "./image-optimization.js";
+import { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, IMAGE_RESPONSE_CACHE_STATE, INVALID_IMAGE_SOURCE_MESSAGE, MUTABLE_IMAGE_SOURCE_CACHE_CONTROL, isImageOptimizationPath, isImageSourceBodyStatus, isSafeImageContentType, parseImageParams, readImageOptimizationSignal } from "./image-optimization.js";
 import { installSocketErrorBackstop } from "./socket-error-backstop.js";
 import { collectInlineCssManifest } from "../build/inline-css.js";
 import { readTrustedRevalidationHostname } from "./revalidation-host.js";
@@ -270,6 +270,7 @@ const OMIT_STATIC_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
 	"content-type",
 	VINEXT_PRERENDER_SPECIAL_ERROR_HEADER
 ]);
+const IMAGE_ERROR_SIGNAL_HEADERS = ["content-type", "content-encoding"];
 function omitHeadersCaseInsensitive(headersRecord, targets) {
 	const filtered = {};
 	for (const [key, value] of Object.entries(headersRecord)) {
@@ -284,6 +285,16 @@ function readHeaderCaseInsensitive(headersRecord, name) {
 	const value = headersRecord[key];
 	return Array.isArray(value) ? value.join(", ") : value;
 }
+/** Spell a header's name as `name`, so spreading the record replaces that key. */
+function withHeaderName(headersRecord, name) {
+	const lowerName = name.toLowerCase();
+	const key = Object.keys(headersRecord).find((entry) => entry !== name && entry.toLowerCase() === lowerName);
+	if (key === void 0) return headersRecord;
+	const { [key]: value, ...rest } = headersRecord;
+	const existing = rest[name];
+	rest[name] = existing === void 0 ? value : [existing, value].flat();
+	return rest;
+}
 /** Remove one field name from a Vary header, dropping the header if it empties. */
 function omitVaryToken(headers, token) {
 	const varyKey = Object.keys(headers).find((key) => key.toLowerCase() === "vary");
@@ -464,6 +475,18 @@ function staticCacheLookupPath(pathname) {
 	if (lookupPath.startsWith("/.vite/") || lookupPath === "/.vite") return null;
 	return lookupPath;
 }
+/**
+* Give a Node image passthrough Next.js's image Cache-Control instead of the
+* public-file default: a hashed build asset keeps its immutable default, and
+* any other source is revalidated after the default `images.minimumCacheTTL`.
+*/
+function withImageSourceCacheControl(headers, sourcePath) {
+	if (sourcePath.includes(`/_next/static/`)) return headers;
+	return {
+		...headers,
+		"Cache-Control": MUTABLE_IMAGE_SOURCE_CACHE_CONTROL
+	};
+}
 /** Pathnames the Pages Router serves from routes rather than the client directory. */
 function isPagesFilesystemExcludedPath(pathname, phase) {
 	return pathname === "/" || pathname === "/api" || pathname.startsWith("/api/") || phase === "direct" && pathname.startsWith(`/_next/static/`);
@@ -479,12 +502,13 @@ function isPagesFilesystemExcludedPath(pathname, phase) {
 * Without a cache, falls back to async filesystem probing (still non-blocking,
 * unlike the old sync existsSync/statSync approach).
 *
-* `extraHeaders` go on every response for the file. `representationHeaders` go
+* `stagedHeaders` go on every response for the file. `representationHeaders` go
 * only on responses that carry the file's bytes (200 and 206), never on a 304,
 * 412, 416 or 405.
 */
-async function tryServeStatic(req, res, clientDir, pathname, compress, cache, extraHeaders, statusCode, representationHeaders) {
+async function tryServeStatic(req, res, clientDir, pathname, compress, cache, stagedHeaders, statusCode, representationHeaders) {
 	if (pathname === "/") return false;
+	const extraHeaders = stagedHeaders && withHeaderName(stagedHeaders, "Cache-Control");
 	const responseStatus = statusCode ?? 200;
 	const omitBody = isNoBodyResponseStatus(responseStatus);
 	const requestRange = req.method === "GET" || req.method === "HEAD" ? req.headers.range : void 0;
@@ -610,7 +634,7 @@ async function tryServeStatic(req, res, clientDir, pathname, compress, cache, ex
 	const ext = path.extname(resolved.path);
 	const ct = contentTypeForPath(resolved.path);
 	const isHashed = pathname.includes(`/${ASSET_PREFIX_URL_DIR}/`);
-	const cacheControl = isHashed ? "public, max-age=31536000, immutable" : "public, max-age=3600";
+	const cacheControl = staticFileCacheControl(isHashed);
 	const etag = isHashed && etagFromFilenameHash(resolved.path, ext) || `W/"${resolved.size}-${Math.floor(resolved.mtimeMs / 1e3)}"`;
 	const baseHeaders = {
 		"Content-Type": ct,
@@ -798,6 +822,15 @@ async function statIfFile(filePath) {
 	}
 }
 /**
+* Node's parser keeps a `#fragment` sent on the request line in `req.url`.
+* Next.js rebuilds request URLs from pathname + search, so neither routing,
+* middleware nor handlers observe one; drop it before anything reads the URL.
+*/
+function stripNodeRequestUrlFragment(req) {
+	const hashIndex = req.url?.indexOf("#") ?? -1;
+	if (hashIndex !== -1) req.url = req.url?.slice(0, hashIndex);
+}
+/**
 * Convert a Node.js IncomingMessage to a Web Request object.
 *
 * When `urlOverride` is provided, it is used as the path + query string
@@ -1163,18 +1196,25 @@ async function startAppRouterServer(options) {
 	if (seededRoutes > 0) console.log(`[vinext] Seeded ${seededRoutes} pre-rendered route${seededRoutes !== 1 ? "s" : ""} into memory cache`);
 	const staticCache = await StaticFileCache.create(clientDir);
 	const serveImageOptimization = async (req, res, request, signal) => {
-		const stagedHeaders = omitHeadersCaseInsensitive(mergeResponseHeaders({}, new Response(null, { headers: signal.middlewareHeaders })), OMIT_STATIC_RESPONSE_HEADERS);
+		const signalHeaders = mergeResponseHeaders({}, new Response(null, { headers: signal.middlewareHeaders }));
+		const stagedHeaders = omitHeadersCaseInsensitive(signalHeaders, OMIT_STATIC_RESPONSE_HEADERS);
 		for (const [name, value] of Object.entries(stagedHeaders)) res.setHeader(name, value);
+		const sendBadRequest = (body) => {
+			for (const name of IMAGE_ERROR_SIGNAL_HEADERS) {
+				const value = signalHeaders[name];
+				if (value !== void 0) res.setHeader(name, value);
+			}
+			res.writeHead(400);
+			res.end(body);
+		};
 		const parsedUrl = new URL(`/${signal.search}`, "http://localhost");
-		const params = parseImageParams(parsedUrl, appImageAllowedWidths, imageConfig?.qualities);
+		const params = parseImageParams(parsedUrl, appImageAllowedWidths, imageConfig?.qualities, { localPatterns: imageConfig?.localPatterns });
 		if (!params) {
-			res.writeHead(400);
-			res.end("Bad Request");
+			sendBadRequest("Bad Request");
 			return;
 		}
 		const sendUnsafeContentType = () => {
-			res.writeHead(400);
-			res.end("The requested resource is not an allowed image type");
+			sendBadRequest("The requested resource is not an allowed image type");
 		};
 		const isSafeSourcePath = (sourcePath) => isSafeImageContentType(contentTypeForPath(sourcePath), imageConfig?.dangerouslyAllowSVG);
 		const imageSecurityHeaders = {
@@ -1182,7 +1222,7 @@ async function startAppRouterServer(options) {
 			"X-Content-Type-Options": "nosniff",
 			"Content-Disposition": imageConfig?.contentDispositionType === "attachment" ? "attachment" : "inline"
 		};
-		const serveSource = (sourcePath) => tryServeStatic(req, res, clientDir, sourcePath, false, staticCache, imageSecurityHeaders, void 0, IMAGE_REPRESENTATION_HEADERS);
+		const serveSource = (sourcePath) => tryServeStatic(req, res, clientDir, sourcePath, false, staticCache, withImageSourceCacheControl(imageSecurityHeaders, sourcePath), void 0, IMAGE_REPRESENTATION_HEADERS);
 		const sourceUrl = new URL(params.imageUrl, request.url);
 		let sourcePathname = null;
 		try {
@@ -1211,8 +1251,7 @@ async function startAppRouterServer(options) {
 				if (await serveSource(sourcePath)) return;
 			}
 		}
-		res.writeHead(400);
-		res.end(INVALID_IMAGE_SOURCE_MESSAGE);
+		sendBadRequest(INVALID_IMAGE_SOURCE_MESSAGE);
 	};
 	const clientBuildFiles = new Set(Array.isArray(rscModule.__clientBuildFiles) ? rscModule.__clientBuildFiles : []);
 	const handleRequestImpl = async (req, res) => {
@@ -1299,6 +1338,7 @@ async function startAppRouterServer(options) {
 		}
 	};
 	const handleRequest = async (req, res) => {
+		stripNodeRequestUrlFragment(req);
 		try {
 			await ensureInstrumentation();
 		} catch (error) {
@@ -1319,7 +1359,7 @@ async function startAppRouterServer(options) {
 			},
 			getStatus: () => res.statusCode,
 			headers,
-			isRsc: target.split("?", 1)[0].endsWith(".rsc") || headers.get("RSC") === "1",
+			isRsc: headers.get("RSC") === "1",
 			method: req.method ?? "GET",
 			target
 		});
@@ -1422,6 +1462,7 @@ async function createPagesRouterRequestHandler(options) {
 		dangerouslyAllowSVG: vinextConfig.images.dangerouslyAllowSVG,
 		dangerouslyAllowLocalIP: vinextConfig.images.dangerouslyAllowLocalIP,
 		qualities: vinextConfig.images.qualities,
+		localPatterns: vinextConfig.images.localPatterns,
 		contentDispositionType: vinextConfig.images.contentDispositionType,
 		contentSecurityPolicy: vinextConfig.images.contentSecurityPolicy
 	} : void 0;
@@ -1434,6 +1475,7 @@ async function createPagesRouterRequestHandler(options) {
 	});
 	const staticCache = await StaticFileCache.create(clientDir);
 	const handleRequest = async (req, res) => {
+		stripNodeRequestUrlFragment(req);
 		try {
 			await ensureInstrumentation();
 		} catch (error) {
@@ -1655,7 +1697,7 @@ async function createPagesRouterRequestHandler(options) {
 					if (resolvedPathnameHasBasePath && isImageOptimizationPath(requestPathname)) {
 						for (const [name, value] of Object.entries(stagedHeaders)) res.setHeader(name, value);
 						const parsedUrl = new URL(resolvedUrl, "http://localhost");
-						const params = parseImageParams(parsedUrl, allowedImageWidths, pagesImageConfig?.qualities);
+						const params = parseImageParams(parsedUrl, allowedImageWidths, pagesImageConfig?.qualities, { localPatterns: pagesImageConfig?.localPatterns });
 						if (!params) {
 							res.writeHead(400);
 							res.end("Bad Request");
@@ -1671,7 +1713,7 @@ async function createPagesRouterRequestHandler(options) {
 							"X-Content-Type-Options": "nosniff",
 							"Content-Disposition": pagesImageConfig?.contentDispositionType === "attachment" ? "attachment" : "inline"
 						};
-						const serveSource = (sourcePath) => tryServeStatic(req, res, clientDir, sourcePath, false, staticCache, imageSecurityHeaders, void 0, IMAGE_REPRESENTATION_HEADERS);
+						const serveSource = (sourcePath) => tryServeStatic(req, res, clientDir, sourcePath, false, staticCache, withImageSourceCacheControl(imageSecurityHeaders, sourcePath), void 0, IMAGE_REPRESENTATION_HEADERS);
 						const sourceUrl = new URL(params.imageUrl, webRequest.url);
 						let sourcePathname = null;
 						try {

package/dist/server/request-error-log.d.ts

@@ -0,0 +1,9 @@
+//#region src/server/request-error-log.d.ts
+/**
+ * Logs an error vinext also passes to instrumentation's `onRequestError`, as
+ * `next start` logs it. `VINEXT_QUIET=1` turns these logs off, like Next.js'
+ * `quiet` server option, so an `onRequestError` that redacts errors before
+ * recording them is the only place they reach.
+ */
+export declare function logRequestError(...args: unknown[]): void;
+//#endregion

package/dist/server/request-error-log.js

@@ -0,0 +1,13 @@
+//#region src/server/request-error-log.ts
+/**
+* Logs an error vinext also passes to instrumentation's `onRequestError`, as
+* `next start` logs it. `VINEXT_QUIET=1` turns these logs off, like Next.js'
+* `quiet` server option, so an `onRequestError` that redacts errors before
+* recording them is the only place they reach.
+*/
+function logRequestError(...args) {
+	if (process.env.VINEXT_QUIET === "1") return;
+	console.error(...args);
+}
+//#endregion
+export { logRequestError };

package/dist/server/request-pipeline.d.ts

@@ -16,6 +16,11 @@ import { getRepeatedSlashRedirect, isOpenRedirectShaped, sendRepeatedSlashRedire
 export declare function canonicalizeRequestPathname(pathname: string): string;
 /** Canonicalize only the pathname portion while preserving the raw query. */
 export declare function canonicalizeRequestUrlPathname(url: string): string;
+/**
+ * Whether the pathname has a segment the URL parser resolves as `.` or `..`,
+ * literally or percent-encoded. Such a pathname changes when it becomes a URL.
+ */
+export declare function hasUrlParserDotSegment(pathname: string): boolean;
 /**
  * Shared request pipeline utilities.
  *
@@ -73,7 +78,6 @@ type ResolvePublicFileRouteOptions = {
   middlewareContext: StaticFileSignalContext & {
     requestHeaders?: Headers | null;
   };
-  pathname: string;
   publicFiles: ReadonlySet<string>;
   request: Request;
 };
@@ -82,7 +86,7 @@ type ResolvePublicFileRouteOptions = {
  *
  * Public files are checked after middleware and before afterFiles/fallback
  * rewrites. The generated App Router entry provides the public-file set; this
- * helper owns the RSC exclusion, existence-first method enforcement, and
+ * helper owns existence-first method enforcement and
  * static-file signaling. Missing mutation targets continue through routing.
  */
 export declare function resolvePublicFileRoute(options: ResolvePublicFileRouteOptions): Response | null;
@@ -91,8 +95,8 @@ export declare function normalizeTrailingSlashPathname(pathname: string, trailin
  * Check if the pathname needs a trailing slash redirect, and return the
  * redirect Response if so.
  *
- * Follows Next.js behavior:
- * - `/api` routes are never redirected
+ * Follows Next.js behavior, whose internal trailing-slash redirects cover
+ * every path, `/api` included:
  * - The root path `/` is never redirected
  * - If `trailingSlash` is true, redirect `/about` → `/about/`
  * - If `trailingSlash` is true, redirect file-looking `/file.ext/` → `/file.ext`
@@ -200,5 +204,11 @@ export declare function withRequestHeaders(request: Request, headers: Headers):
  * exists.
  */
 export declare function cloneRequestWithUrl(request: Request, url: string): Request;
+/**
+ * Drop a `#fragment` the host kept from the request line. Next.js rebuilds
+ * request URLs from pathname + search, so neither middleware nor handlers
+ * ever observe one, and pathname-keyed cache entries must not either.
+ */
+export declare function stripRequestUrlFragment(request: Request): Request;
 //#endregion
 export { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, createStaticFileSignal, getRepeatedSlashRedirect, hasBasePath, isOpenRedirectShaped, sendRepeatedSlashRedirect, stripBasePath };

package/dist/server/request-pipeline.js

@@ -30,6 +30,16 @@ function canonicalizeRequestUrlPathname(url) {
 	return canonicalizeRequestPathname(pathname) + search;
 }
 /**
+* Whether the pathname has a segment the URL parser resolves as `.` or `..`,
+* literally or percent-encoded. Such a pathname changes when it becomes a URL.
+*/
+function hasUrlParserDotSegment(pathname) {
+	return pathname.split("/").some((segment) => {
+		const decodedDots = segment.replaceAll(/%2e/gi, ".");
+		return decodedDots === "." || decodedDots === "..";
+	});
+}
+/**
 * Shared request pipeline utilities.
 *
 * Extracted from generated entries and server hot paths to keep codegen focused
@@ -84,7 +94,8 @@ function guardProtocolRelativeUrl(rawPathname, search = "") {
 	if (isOpenRedirectShaped(rawPathname)) return notFoundResponse();
 	return null;
 }
-const FILE_LIKE_PATHNAME_RE = /\.[^/]+\/?$/;
+const SLASHED_FILE_PATHNAME_RE = /^\/(?:[^/]+\/)*[^/]+\.\w+\/$/;
+const UNSLASHED_NON_FILE_PATHNAME_RE = /^\/(?:[^/]+\/)*[^/.]+$/;
 function isWellKnownPathname(pathname) {
 	return pathname === "/.well-known" || pathname.startsWith("/.well-known/");
 }
@@ -93,37 +104,32 @@ function isWellKnownPathname(pathname) {
 *
 * Public files are checked after middleware and before afterFiles/fallback
 * rewrites. The generated App Router entry provides the public-file set; this
-* helper owns the RSC exclusion, existence-first method enforcement, and
+* helper owns existence-first method enforcement and
 * static-file signaling. Missing mutation targets continue through routing.
 */
 function resolvePublicFileRoute(options) {
-	if (options.pathname.endsWith(".rsc")) return null;
 	if (!options.publicFiles.has(options.cleanPathname)) return null;
 	if (options.request.method !== "GET" && options.request.method !== "HEAD") return methodNotAllowedResponse("GET, HEAD", { headers: options.middlewareContext.headers ?? void 0 });
 	const { requestHeaders } = options.middlewareContext;
 	return createStaticFileSignal(options.cleanPathname, options.middlewareContext, requestHeaders ? buildRequestHeadersFromMiddlewareResponse(options.request.headers, requestHeaders) : null);
 }
 function normalizeTrailingSlashPathname(pathname, trailingSlash) {
-	if (pathname === "/" || pathname === "/api" || pathname.startsWith("/api/")) return null;
-	const hasTrailing = pathname.endsWith("/");
+	if (pathname === "/") return null;
 	if (trailingSlash) {
 		if (isWellKnownPathname(pathname)) return null;
-		if (FILE_LIKE_PATHNAME_RE.test(pathname)) {
-			const normalized = removeTrailingSlash(pathname);
-			return normalized === pathname ? null : normalized;
-		}
-		if (!hasTrailing && !pathname.endsWith(".rsc")) return `${pathname}/`;
+		if (SLASHED_FILE_PATHNAME_RE.test(pathname)) return pathname.slice(0, -1);
+		if (UNSLASHED_NON_FILE_PATHNAME_RE.test(pathname)) return `${pathname}/`;
 		return null;
 	}
-	if (hasTrailing) return removeTrailingSlash(pathname);
+	if (pathname.endsWith("/")) return removeTrailingSlash(pathname);
 	return null;
 }
 /**
 * Check if the pathname needs a trailing slash redirect, and return the
 * redirect Response if so.
 *
-* Follows Next.js behavior:
-* - `/api` routes are never redirected
+* Follows Next.js behavior, whose internal trailing-slash redirects cover
+* every path, `/api` included:
 * - The root path `/` is never redirected
 * - If `trailingSlash` is true, redirect `/about` → `/about/`
 * - If `trailingSlash` is true, redirect file-looking `/file.ext/` → `/file.ext`
@@ -137,7 +143,7 @@ function normalizeTrailingSlashPathname(pathname, trailingSlash) {
 * @returns A 308 redirect Response, or null if no redirect is needed
 */
 function normalizeTrailingSlash(pathname, basePath, trailingSlash, search) {
-	if (pathname === "/" || pathname === "/api" || pathname.startsWith("/api/")) return null;
+	if (pathname === "/") return null;
 	if (isOpenRedirectShaped(pathname)) return notFoundResponse();
 	const normalizedPathname = normalizeTrailingSlashPathname(pathname, trailingSlash);
 	if (normalizedPathname === null) return null;
@@ -463,5 +469,17 @@ function cloneRequestWithUrl(request, url) {
 	}
 	return attachRequestCfMetadata(cloned, request);
 }
+/**
+* Drop a `#fragment` the host kept from the request line. Next.js rebuilds
+* request URLs from pathname + search, so neither middleware nor handlers
+* ever observe one, and pathname-keyed cache entries must not either.
+*/
+function stripRequestUrlFragment(request) {
+	const hashIndex = request.url.indexOf("#");
+	if (hashIndex === -1) return request;
+	const signal = request.signal;
+	const stripped = cloneRequestWithUrl(request, request.url.slice(0, hashIndex));
+	return attachRequestCfMetadata(new Request(stripped, { signal }), request);
+}
 //#endregion
-export { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, attachRequestCfMetadata, canonicalizeRequestPathname, canonicalizeRequestUrlPathname, cloneRequestWithHeaders, cloneRequestWithUrl, createStaticFileSignal, dropEmptyMiddlewareSetCookie, filterInternalHeaders, getRepeatedSlashRedirect, guardProtocolRelativeUrl, hasBasePath, haveSameHeaders, isOpenRedirectShaped, isOriginAllowed, normalizeTrailingSlash, normalizeTrailingSlashPathname, processMiddlewareHeaders, resolvePublicFileRoute, sendRepeatedSlashRedirect, stripBasePath, validateCsrfOrigin, validateServerActionPayload, withRequestHeaders };
+export { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, attachRequestCfMetadata, canonicalizeRequestPathname, canonicalizeRequestUrlPathname, cloneRequestWithHeaders, cloneRequestWithUrl, createStaticFileSignal, dropEmptyMiddlewareSetCookie, filterInternalHeaders, getRepeatedSlashRedirect, guardProtocolRelativeUrl, hasBasePath, hasUrlParserDotSegment, haveSameHeaders, isOpenRedirectShaped, isOriginAllowed, normalizeTrailingSlash, normalizeTrailingSlashPathname, processMiddlewareHeaders, resolvePublicFileRoute, sendRepeatedSlashRedirect, stripBasePath, stripRequestUrlFragment, validateCsrfOrigin, validateServerActionPayload, withRequestHeaders };

package/dist/server/response-stage-cacheability.d.ts

@@ -23,6 +23,13 @@ export type ResponseStageCacheabilityOptions = {
    * shared response drops them before admission and storage.
    */
   recomposesRequestScopedHeaders?: boolean;
+  /**
+   * Keeps `X-Vinext-Params` when the request scoped headers are dropped. An
+   * intercepted response's params include its target's, which the request
+   * stage doesn't match. Its identity holds the interception context, so the
+   * stored params are its own.
+   */
+  keepsParamsHeader?: boolean;
   /** Generated adapter registration, deferred until the response stage executes. */
   registerCacheAdapters(): void;
   request: Request;

package/dist/server/response-stage-cacheability.js

@@ -24,13 +24,13 @@ async function withResponseStageCacheability(options, render) {
 	const stripsRequestScopedHeaders = options.recomposesRequestScopedHeaders === true && options.cache === "shared" && !options.probeMode;
 	if (!cacheability) {
 		const rendered = await render(context);
-		return stripsRequestScopedHeaders ? withoutRequestScopedHeaders(rendered) : rendered;
+		return stripsRequestScopedHeaders ? withoutRequestScopedHeaders(rendered, options.keepsParamsHeader === true) : rendered;
 	}
 	if (options.policyHeadersAppliedBeforeRender) cacheability.recordResponseStageCachePolicy(context, options.policyHeaders);
 	const state = Reflect.get(context, CACHEABILITY_REQUEST_STATE);
 	if (options.probeMode && options.forceDynamic && !options.policyHeaders?.length && state) state.patternDynamicReason = "dynamic = \"force-dynamic\"";
 	const renderedResponse = await render(context);
-	const rendered = stripsRequestScopedHeaders ? withoutRequestScopedHeaders(renderedResponse) : renderedResponse;
+	const rendered = stripsRequestScopedHeaders ? withoutRequestScopedHeaders(renderedResponse, options.keepsParamsHeader === true) : renderedResponse;
 	const response = options.policyHeadersAppliedBeforeRender ? rendered : cacheability.applyResponseStageCachePolicy(rendered, context, options.policyHeaders);
 	const complete = (candidate) => cacheability.finalizeWorkerCacheabilityResponse(candidate, context);
 	const route = state?.route;
@@ -40,10 +40,11 @@ async function withResponseStageCacheability(options, render) {
 	}
 	return complete(response);
 }
-function withoutRequestScopedHeaders(response) {
-	if (!response.headers.has("X-Vinext-Params") && !response.headers.has("X-Vinext-Rendered-Path-And-Search")) return response;
+function withoutRequestScopedHeaders(response, keepsParams) {
+	const dropsParams = !keepsParams && response.headers.has("X-Vinext-Params");
+	if (!dropsParams && !response.headers.has("X-Vinext-Rendered-Path-And-Search")) return response;
 	const headers = new Headers(response.headers);
-	headers.delete(VINEXT_PARAMS_HEADER);
+	if (dropsParams) headers.delete(VINEXT_PARAMS_HEADER);
 	headers.delete(VINEXT_RENDERED_PATH_AND_SEARCH_HEADER);
 	return preserveFullyBufferedBodyMetadata(response, new Response(response.body, {
 		headers,

package/dist/server/rsc-completion-metadata.js

@@ -88,9 +88,11 @@ function extractRscCompletionMetadata(buffer) {
 }
 function appendRscCompletionMetadata(source, getMetadata) {
 	const reader = source.getReader();
+	let cancelled = false;
 	return new ReadableStream({
 		async pull(controller) {
 			const next = await reader.read();
+			if (cancelled) return;
 			if (!next.done) {
 				controller.enqueue(escapeFlightChunk(next.value));
 				return;
@@ -100,6 +102,7 @@ function appendRscCompletionMetadata(source, getMetadata) {
 			controller.close();
 		},
 		cancel(reason) {
+			cancelled = true;
 			return reader.cancel(reason);
 		}
 	});

package/dist/server/static-file-cache.d.ts

@@ -3,6 +3,15 @@
 export declare const CONTENT_TYPES: Record<string, string>;
 /** Resolve a path's MIME type with case-insensitive extension matching. */
 export declare function contentTypeForPath(filePath: string): string;
+/**
+ * Default `Cache-Control` for a file in the client build directory. Hashed
+ * build assets never change at their URL. Every other file (`public/`) must be
+ * revalidated on each reuse, as Next.js's `send` serves it with `max-age=0`:
+ * middleware may admit it per request, so a shared cache must not reuse it
+ * without asking the origin. A `Cache-Control` set by middleware or config
+ * headers replaces this default.
+ */
+export declare function staticFileCacheControl(isHashed: boolean): string;
 /** A servable file variant with pre-computed response headers. */
 type FileVariant = {
   /** Absolute file path (used for streaming large files). */

package/dist/server/static-file-cache.js

@@ -57,6 +57,17 @@ function contentTypeForPath(filePath) {
 	return CONTENT_TYPES[path.extname(filePath).toLowerCase()] ?? "application/octet-stream";
 }
 /**
+* Default `Cache-Control` for a file in the client build directory. Hashed
+* build assets never change at their URL. Every other file (`public/`) must be
+* revalidated on each reuse, as Next.js's `send` serves it with `max-age=0`:
+* middleware may admit it per request, so a shared cache must not reuse it
+* without asking the origin. A `Cache-Control` set by middleware or config
+* headers replaces this default.
+*/
+function staticFileCacheControl(isHashed) {
+	return isHashed ? "public, max-age=31536000, immutable" : "public, max-age=0";
+}
+/**
 * Files below this size are buffered in memory at startup for zero-syscall
 * serving via res.end(buffer). Above this, files stream via createReadStream.
 * 64KB covers virtually all precompressed assets (a 200KB JS bundle compresses
@@ -98,7 +109,7 @@ var StaticFileCache = class StaticFileCache {
 			if (isHashed && PRECOMPRESSION_TEMP_FILE_RE.test(relativePath)) continue;
 			const ext = path.extname(relativePath);
 			const contentType = contentTypeForPath(relativePath);
-			const cacheControl = isHashed ? "public, max-age=31536000, immutable" : "public, max-age=3600";
+			const cacheControl = staticFileCacheControl(isHashed);
 			const etag = isHashed && etagFromFilenameHash(relativePath, ext) || `W/"${fileInfo.size}-${Math.floor(fileInfo.mtimeMs / 1e3)}"`;
 			const lastModified = new Date(fileInfo.mtimeMs).toUTCString();
 			const baseHeaders = {
@@ -266,4 +277,4 @@ async function* walkFilesWithStats(dir, base = dir) {
 	}
 }
 //#endregion
-export { CONTENT_TYPES, StaticFileCache, contentTypeForPath, etagFromFilenameHash };
+export { CONTENT_TYPES, StaticFileCache, contentTypeForPath, etagFromFilenameHash, staticFileCacheControl };

package/dist/server/worker-image-optimization.d.ts

@@ -27,8 +27,8 @@ export declare function fetchWorkerImageSource(imageUrl: string, request: Reques
 export declare function fetchSignalledPublicFile(response: Response, sourceRequest: Request, assets: VinextAssetFetcher): Promise<Response> | null;
 /**
  * Serve the App Router image endpoint once the request handler admitted it
- * through middleware and rewrites. Middleware's response headers are sent with
- * the image, as Next.js does.
+ * through middleware and rewrites. Config and middleware response headers are
+ * sent with the image, as Next.js does.
  */
 export declare function serveWorkerImageOptimization(request: Request, signal: ImageOptimizationSignal, allowedWidths: number[] | undefined, imageConfig: ImageConfig | undefined, options: WorkerImageSourceOptions): Promise<Response>;
 //#endregion

package/dist/server/worker-image-optimization.js

@@ -78,8 +78,8 @@ function fetchSignalledPublicFile(response, sourceRequest, assets) {
 }
 /**
 * Serve the App Router image endpoint once the request handler admitted it
-* through middleware and rewrites. Middleware's response headers are sent with
-* the image, as Next.js does.
+* through middleware and rewrites. Config and middleware response headers are
+* sent with the image, as Next.js does.
 */
 async function serveWorkerImageOptimization(request, signal, allowedWidths, imageConfig, options) {
 	const imageUrl = new URL(request.url);
@@ -93,7 +93,22 @@ async function serveWorkerImageOptimization(request, signal, allowedWidths, imag
 	});
 	const cookies = signal.middlewareHeaders.getSetCookie();
 	if (cookies.length > 0) middlewareHeaders["set-cookie"] = cookies;
-	return mergeHeaders(response, middlewareHeaders);
+	const merged = mergeHeaders(response, middlewareHeaders);
+	if (response.status < 400) return merged;
+	const errorHeaders = new Headers(merged.headers);
+	let replaced = false;
+	for (const name of ["content-type", "content-encoding"]) {
+		const value = signal.middlewareHeaders.get(name);
+		if (value === null) continue;
+		errorHeaders.set(name, value);
+		replaced = true;
+	}
+	if (!replaced) return merged;
+	return new Response(merged.body, {
+		headers: errorHeaders,
+		status: merged.status,
+		statusText: merged.statusText
+	});
 }
 //#endregion
 export { fetchSignalledPublicFile, fetchWorkerImageSource, serveWorkerImageOptimization };

package/dist/server/worker-utils.d.ts

@@ -1,6 +1,14 @@
 //#region src/server/worker-utils.d.ts
 export declare function finalizeMissingStaticAssetResponse(response: Response, missingBuildAsset: boolean): Response;
 export declare function mergeHeaders(response: Response, extraHeaders: Record<string, string | string[]>, statusOverride?: number): Response;
+/**
+ * Merge middleware/config headers into a file served from the asset layer.
+ * Its Cache-Control is only the layer's default (Workers Static Assets sends
+ * `public, max-age=0, must-revalidate` with every file), so one set by
+ * middleware or `headers()` wins, as Next.js's static file server sets its
+ * own only when the response has none.
+ */
+export declare function mergeStaticFileHeaders(response: Response, extraHeaders: Record<string, string | string[]>, statusOverride?: number): Response;
 export declare function resolveStaticAssetSignal(signalResponse: Response, options: {
   /** `requestHeaders` are the post-middleware request headers, when middleware set any. */
   fetchAsset(path: string, requestHeaders: Headers | null): Promise<Response>;

package/dist/server/worker-utils.js

@@ -82,6 +82,23 @@ function mergeHeaders(response, extraHeaders, statusOverride) {
 		headers: merged
 	});
 }
+/**
+* Merge middleware/config headers into a file served from the asset layer.
+* Its Cache-Control is only the layer's default (Workers Static Assets sends
+* `public, max-age=0, must-revalidate` with every file), so one set by
+* middleware or `headers()` wins, as Next.js's static file server sets its
+* own only when the response has none.
+*/
+function mergeStaticFileHeaders(response, extraHeaders, statusOverride) {
+	const merged = mergeHeaders(response, extraHeaders, statusOverride);
+	for (const [name, value] of Object.entries(extraHeaders)) {
+		if (name.toLowerCase() !== "cache-control") continue;
+		const cacheControl = (Array.isArray(value) ? value.join(", ") : value).trim();
+		if (!cacheControl) continue;
+		merged.headers.set(name, cacheControl);
+	}
+	return merged;
+}
 async function resolveStaticAssetSignal(signalResponse, options) {
 	const signal = readStaticFileSignal(signalResponse);
 	if (!signal) return null;
@@ -100,7 +117,7 @@ async function resolveStaticAssetSignal(signalResponse, options) {
 	const requestHeaders = readStaticFileSignalRequestHeaders(signalResponse);
 	cancelResponseBody(signalResponse);
 	const assetResponse = await options.fetchAsset(assetPath, requestHeaders);
-	return mergeHeaders(assetResponse, extraHeaders, assetResponse.ok && assetResponse.status !== 206 && signalResponse.status !== 200 ? signalResponse.status : void 0);
+	return mergeStaticFileHeaders(assetResponse, extraHeaders, assetResponse.ok && assetResponse.status !== 206 && signalResponse.status !== 200 ? signalResponse.status : void 0);
 }
 /**
 * Retarget a Worker asset request without dropping its conditional/range
@@ -116,4 +133,4 @@ function createStaticAssetRequest(assetPath, sourceRequest, headers = null) {
 	});
 }
 //#endregion
-export { createStaticAssetRequest, finalizeMissingStaticAssetResponse, mergeHeaders, resolveStaticAssetSignal };
+export { createStaticAssetRequest, finalizeMissingStaticAssetResponse, mergeHeaders, mergeStaticFileHeaders, resolveStaticAssetSignal };

package/dist/shims/cache-request-state.d.ts

@@ -1,10 +1,10 @@
+import { CacheLifeConfig } from "../utils/cache-life-profiles.js";
 import { _recordUseCacheRootParamRead, _registerCacheContextAccessor, getRegisteredCacheContext } from "./internal/cache-context-accessor.js";
 //#region src/shims/cache-request-state.d.ts
-export type CacheLifeConfig = {
-  stale?: number;
-  revalidate?: number;
-  expire?: number;
-};
+/**
+ * The built-in profiles merged with next.config `cacheLife`, baked in at
+ * build time like Next.js's `process.env.__NEXT_CACHE_LIFE` define.
+ */
 export declare const cacheLifeProfiles: Record<string, CacheLifeConfig>;
 export type UnstableCacheRevalidationMode = "foreground" | "background";
 export type ActionRevalidationKind = 0 | 1 | 2;
@@ -121,4 +121,4 @@ export declare function _captureRequestScopedCacheLifeAccessors(): {
 export declare function runWithDetachedCacheObservations<T>(fn: () => Promise<T>): Promise<T>;
 export declare function shouldServeStaleUnstableCacheEntry(): boolean;
 //#endregion
-export { _recordUseCacheRootParamRead, _registerCacheContextAccessor, getRegisteredCacheContext };
+export { type CacheLifeConfig, _recordUseCacheRootParamRead, _registerCacheContextAccessor, getRegisteredCacheContext };