vinext 1.4.0 → 1.4.2

package/dist/server/app-worker-stages.js

@@ -1,4 +1,5 @@
 import { VINEXT_RSC_VARY_HEADER } from "./app-rsc-vary.js";
+import { APP_RSC_RENDER_MODE_NAVIGATION } from "./app-rsc-render-mode.js";
 import { cacheabilityManifestPageState, cacheabilityRequestIdentity, cacheabilityRoutePathname } from "./cacheability-manifest.js";
 import { keepOnlyValidatedRscCacheBustingSearchParam } from "./app-rsc-cache-busting.js";
 import { isTrustedPrerenderState } from "./prerender-route-params.js";
@@ -32,9 +33,8 @@ function createSharedAppCacheIdentity(request, props) {
 }
 /**
 * Build the query-free cache identity of a shared App page dispatch. The user
-* query leaves both the URL and `resolvedUrl`; the `.rsc` suffix, an RSC
-* request's validated `_rsc`, and the render mode stay because they select the
-* representation. HTML identities also drop the RSC selector headers.
+* query leaves both the URL and `resolvedUrl`; an RSC request's validated
+* `_rsc` and the render mode stay because they select the representation. HTML identities also drop the RSC selector headers.
 */
 function createSharedAppPageCacheIdentity(request, props) {
 	const queryFree = withoutAppPageDispatchQuery(request.url, props);
@@ -49,6 +49,39 @@ function createSharedAppPageCacheIdentity(request, props) {
 	};
 }
 /**
+* Build the query-free cache identity of a shared Route Handler or metadata
+* route dispatch. Next.js keys a route handler by its pathname: the query and
+* the RSC selectors pick no representation of a handler's response, and a
+* handler that reads the request's URL or headers is dynamic, so admission
+* refuses its response. Keeping them in the identity would only let a client
+* store one entry per query or selector value. The method, path and route
+* props stay; the selector headers and the props derived from them leave.
+*/
+function createSharedAppRouteCacheIdentity(request, props) {
+	const url = new URL(request.url);
+	url.search = "";
+	const headers = new Headers(request.headers);
+	for (const name of VINEXT_RSC_VARY_HEADER.split(",")) headers.delete(name.trim());
+	const searchIndex = props.resolvedUrl.indexOf("?");
+	return {
+		...sharedAppCacheIdentity(url.toString(), {
+			headers,
+			method: request.method
+		}, {
+			...props,
+			...props.kind === "app-metadata" ? {} : {
+				interceptionContext: null,
+				interceptionId: null
+			},
+			isRscRequest: false,
+			mountedSlotsHeader: null,
+			renderMode: APP_RSC_RENDER_MODE_NAVIGATION,
+			resolvedUrl: searchIndex === -1 ? props.resolvedUrl : props.resolvedUrl.slice(0, searchIndex)
+		}),
+		queryFree: true
+	};
+}
+/**
 * Build the cache identity of a shared hybrid Pages page dispatch: the
 * dispatched request and props under `origin`, so every host that names it
 * shares one entry.
@@ -141,4 +174,4 @@ function isResponseStageCacheability(value) {
 	return (cacheability.probeMode === null || cacheability.probeMode === "probe" || cacheability.probeMode === "identity") && (cacheability.policyHeaders === null || Array.isArray(cacheability.policyHeaders) && cacheability.policyHeaders.every((entry) => Array.isArray(entry) && entry.length === 2 && typeof entry[0] === "string" && typeof entry[1] === "string")) && (cacheability.representation === void 0 || cacheability.representation === "app-route" || cacheability.representation === "html" || cacheability.representation === "pages-data" || cacheability.representation === "rsc-full" || cacheability.representation === "rsc-loading-shell") && typeof cacheability.resolvedRoutePathname === "string" && cacheability.resolvedRoutePathname.startsWith("/");
 }
 //#endregion
-export { APP_METADATA_RESPONSE_STAGE_NO_MATCH_HEADER, APP_WORKER_RESPONSE_STAGE_PROTOCOL_VERSION, createSharedAppCacheIdentity, createSharedAppPageCacheIdentity, createSharedHybridPagesCacheIdentity, isAppWorkerResponseStageProps, isStaticCandidateAppPageDispatch, prepareSharedAppPageDispatch, withoutAppPageDispatchQuery };
+export { APP_METADATA_RESPONSE_STAGE_NO_MATCH_HEADER, APP_WORKER_RESPONSE_STAGE_PROTOCOL_VERSION, createSharedAppCacheIdentity, createSharedAppPageCacheIdentity, createSharedAppRouteCacheIdentity, createSharedHybridPagesCacheIdentity, isAppWorkerResponseStageProps, isStaticCandidateAppPageDispatch, prepareSharedAppPageDispatch, withoutAppPageDispatchQuery };

package/dist/server/bfcache-identity.d.ts

@@ -3,6 +3,13 @@ type ParallelSlotBindingState = "active" | "default" | "unmatched";
 export declare function createNestedBfcacheSlotSegmentId(parentSlotId: string, level: number): string;
 export declare function isNestedBfcacheSlotSegmentId(id: string): boolean;
 export declare function isNestedBfcacheSlotSegmentIdFor(id: string, parentSlotId: string): boolean;
+/**
+ * Activity key for a route segment whose directory has no layout of its own.
+ * Next.js keeps a layout-router Activity list at every segment level, implicit
+ * layouts included, keyed by the child segment. The tag keeps these keys apart
+ * from identity strings, whose kinds never use it, and from BFCache ids.
+ */
+export declare function createBfcacheChildSegmentStateKey(segmentPathKey: string): string;
 export type BfcacheSegmentIdentity = string;
 export type BfcacheSegmentDescriptor = {
   kind: "page";

package/dist/server/bfcache-identity.js

@@ -13,6 +13,15 @@ function isNestedBfcacheSlotSegmentId(id) {
 function isNestedBfcacheSlotSegmentIdFor(id, parentSlotId) {
 	return isNestedBfcacheSlotSegmentId(id) && id.startsWith(createNestedBfcacheSlotParentPrefix(parentSlotId));
 }
+/**
+* Activity key for a route segment whose directory has no layout of its own.
+* Next.js keeps a layout-router Activity list at every segment level, implicit
+* layouts included, keyed by the child segment. The tag keeps these keys apart
+* from identity strings, whose kinds never use it, and from BFCache ids.
+*/
+function createBfcacheChildSegmentStateKey(segmentPathKey) {
+	return JSON.stringify(["segment", segmentPathKey]);
+}
 function deriveBfcacheSegmentIdentity(descriptor) {
 	switch (descriptor.kind) {
 		case "page":
@@ -49,4 +58,4 @@ function deriveBfcacheSegmentIdentity(descriptor) {
 	}
 }
 //#endregion
-export { createNestedBfcacheSlotSegmentId, deriveBfcacheSegmentIdentity, isNestedBfcacheSlotSegmentId, isNestedBfcacheSlotSegmentIdFor };
+export { createBfcacheChildSegmentStateKey, createNestedBfcacheSlotSegmentId, deriveBfcacheSegmentIdentity, isNestedBfcacheSlotSegmentId, isNestedBfcacheSlotSegmentIdFor };

package/dist/server/cache-control.d.ts

@@ -1,6 +1,8 @@
 import { CdnCacheableHeaderInput, isNonCacheableCacheControl } from "../shims/cdn-cache.js";
 //#region src/server/cache-control.d.ts
 export declare const NEVER_CACHE_CONTROL = "private, no-cache, no-store, max-age=0, must-revalidate";
+/** The policy Next.js sends on every Server Action response. */
+export declare const SERVER_ACTION_CACHE_CONTROL = "no-cache, no-store, max-age=0, must-revalidate";
 export declare const BROWSER_REVALIDATE_CACHE_CONTROL = "public, max-age=0, must-revalidate";
 export declare const STATIC_CACHE_CONTROL = "s-maxage=31536000, stale-while-revalidate";
 export declare const NO_STORE_CACHE_CONTROL = "no-store, must-revalidate";

package/dist/server/cache-control.js

@@ -2,6 +2,8 @@ import { getCdnCacheAdapter, isNonCacheableCacheControl } from "../shims/cdn-cac
 import { recordRouteCacheabilityCdnTags } from "../shims/cacheability-classification.js";
 //#region src/server/cache-control.ts
 const NEVER_CACHE_CONTROL = "private, no-cache, no-store, max-age=0, must-revalidate";
+/** The policy Next.js sends on every Server Action response. */
+const SERVER_ACTION_CACHE_CONTROL = "no-cache, no-store, max-age=0, must-revalidate";
 const BROWSER_REVALIDATE_CACHE_CONTROL = "public, max-age=0, must-revalidate";
 const STATIC_CACHE_CONTROL = "s-maxage=31536000, stale-while-revalidate";
 const STALE_REVALIDATE_CACHE_CONTROL = "s-maxage=0, stale-while-revalidate";
@@ -167,4 +169,4 @@ function buildCachedRevalidateCacheControl(cacheState, revalidateSeconds, expire
 	return buildRevalidateCacheControl(revalidateSeconds, expireSeconds);
 }
 //#endregion
-export { BROWSER_REVALIDATE_CACHE_CONTROL, NEVER_CACHE_CONTROL, NO_STORE_CACHE_CONTROL, STATIC_CACHE_CONTROL, applyCdnResponseBuildIdentityHeaders, applyCdnResponseHeaders, applyCdnResponseIdentityHeaders, buildCachedRevalidateCacheControl, buildRevalidateCacheControl, captureCdnResponsePolicyHeaders, captureCdnResponsePolicyOverrides, hasCdnResponsePolicy, hasExplicitNonCacheableResponsePolicy, isCdnResponsePolicyHeader, isNonCacheableCacheControl, isNonCacheableCdnResponsePolicy, readCdnResponseCacheControl, readCdnResponsePolicyHeaderName, reconcileCdnResponseHeadersAfterOuterPolicy, shouldUseNextDeployCacheControl, validateCdnRequest };
+export { BROWSER_REVALIDATE_CACHE_CONTROL, NEVER_CACHE_CONTROL, NO_STORE_CACHE_CONTROL, SERVER_ACTION_CACHE_CONTROL, STATIC_CACHE_CONTROL, applyCdnResponseBuildIdentityHeaders, applyCdnResponseHeaders, applyCdnResponseIdentityHeaders, buildCachedRevalidateCacheControl, buildRevalidateCacheControl, captureCdnResponsePolicyHeaders, captureCdnResponsePolicyOverrides, hasCdnResponsePolicy, hasExplicitNonCacheableResponsePolicy, isCdnResponsePolicyHeader, isNonCacheableCacheControl, isNonCacheableCdnResponsePolicy, readCdnResponseCacheControl, readCdnResponsePolicyHeaderName, reconcileCdnResponseHeadersAfterOuterPolicy, shouldUseNextDeployCacheControl, validateCdnRequest };

package/dist/server/cacheability-manifest.js

@@ -118,7 +118,7 @@ function cacheabilityRequestIdentity(request, trustedRepresentation) {
 		representation: "pages-data",
 		requestKey
 	};
-	if (!(request.headers.get("RSC") === "1" || url.pathname.endsWith(".rsc"))) return (request.headers.get("Accept")?.toLowerCase() ?? "").includes("text/html") ? {
+	if (!(request.headers.get("RSC") === "1")) return (request.headers.get("Accept")?.toLowerCase() ?? "").includes("text/html") ? {
 		representation: "html",
 		requestKey
 	} : {
@@ -146,7 +146,6 @@ function normalizeCacheabilityRoutePathname(pathname) {
 }
 function cacheabilityRoutePathname(pathname, representation) {
 	const normalized = new URL(pathname, "http://vinext.local").pathname;
-	if (representation === "rsc-full" || representation === "rsc-loading-shell") return normalizeCacheabilityRoutePathname(normalized.endsWith(".rsc") ? normalized.slice(0, -4) : normalized);
 	if (representation !== "pages-data") return normalizeCacheabilityRoutePathname(normalized);
 	const marker = normalized.indexOf("/_next/data/");
 	const restWithBuildId = marker === -1 ? "" : normalized.slice(marker + 12);

package/dist/server/dev-origin-check.d.ts

@@ -41,7 +41,8 @@ export declare function isCrossSiteNoCorsRequest(secFetchSite: string | null | u
  * Validate a dev server request from a Node.js IncomingMessage.
  *
  * Returns null if the request is allowed, or a reason string if it should be blocked.
- * This is used by the Pages Router connect middleware.
+ * This is used by the vinext:dev-origin-check connect middleware and the Pages
+ * Router handler.
  */
 export declare function validateDevRequest(headers: {
   origin?: string;

package/dist/server/dev-origin-check.js

@@ -74,7 +74,8 @@ function isCrossSiteNoCorsRequest(secFetchSite, secFetchMode) {
 * Validate a dev server request from a Node.js IncomingMessage.
 *
 * Returns null if the request is allowed, or a reason string if it should be blocked.
-* This is used by the Pages Router connect middleware.
+* This is used by the vinext:dev-origin-check connect middleware and the Pages
+* Router handler.
 */
 function validateDevRequest(headers, allowedDevOrigins) {
 	if (isCrossSiteNoCorsRequest(headers["sec-fetch-site"], headers["sec-fetch-mode"])) return `cross-site no-cors request blocked`;

package/dist/server/dev-server.js

@@ -9,6 +9,7 @@ import { matchRoute } from "../routing/pages-router.js";
 import { isDangerousScheme } from "../shims/url-safety.js";
 import { extractLocaleFromUrl as extractLocaleFromUrl$1, resolvePagesI18nRequest } from "./pages-i18n.js";
 import { importModule, reportRequestError } from "./instrumentation.js";
+import { logRequestError } from "./request-error-log.js";
 import { NEVER_CACHE_CONTROL } from "./cache-control.js";
 import { buildMissIsrCacheControl } from "./isr-decision.js";
 import { isOnDemandRevalidateRequest } from "./revalidation-request.js";
@@ -918,7 +919,7 @@ function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatc
 				_renderEnd = now();
 				if (typeof routerShim.setSSRContext === "function") routerShim.setSSRContext(null);
 			} catch (e) {
-				console.error(e);
+				logRequestError(e);
 				await reportRequestError(e, {
 					path: url,
 					method: req.method ?? "GET",

package/dist/server/image-local-patterns.d.ts

@@ -0,0 +1,21 @@
+//#region src/server/image-local-patterns.d.ts
+/**
+ * `images.localPatterns` matching for the image optimization endpoint, kept
+ * apart from the remote-pattern shim so the request path doesn't load its IP
+ * parsing.
+ */
+export type LocalPattern = {
+  pathname?: string;
+  search?: string;
+};
+/**
+ * Check whether a local URL matches a single local pattern.
+ * Follows the same semantics as Next.js's matchLocalPattern().
+ */
+export declare function matchLocalPattern(pattern: LocalPattern, url: URL): boolean;
+/**
+ * Check whether a local URL matches any configured local pattern. Like
+ * Next.js's hasLocalMatch(), an unset list allows every local URL.
+ */
+export declare function hasLocalMatch(localPatterns: LocalPattern[] | undefined, url: URL): boolean;
+//#endregion

package/dist/server/image-local-patterns.js

@@ -0,0 +1,59 @@
+//#region src/server/image-local-patterns.ts
+const localPathnameRegexCache = /* @__PURE__ */ new Map();
+/**
+* Convert a local pathname glob to a RegExp, reading `*` and `**` like Next.js's
+* picomatch (`makeRe(pathname, { dot: true })`):
+*   - a `**` segment matches zero or more whole segments, but needs its own
+*     separator right after a leading `/`, and at the end after a segment
+*     that ends in `*`;
+*   - any other `*` run matches characters within one segment;
+*   - a last segment ending in `*` also matches one trailing slash, and a
+*     whole last `*` matches one character or more (that slash included).
+* Other picomatch syntax (braces, `?`, classes) is matched literally.
+*/
+function localPathnameGlobToRegex(pattern) {
+	const cached = localPathnameRegexCache.get(pattern);
+	if (cached !== void 0) return cached;
+	const segments = pattern.split("/").filter((segment, i, all) => !(segment === "**" && all[i - 1] === "**"));
+	let regexStr = "^";
+	for (let i = 0; i < segments.length; i++) {
+		const segment = segments[i];
+		const previous = segments[i - 1];
+		const isLast = i === segments.length - 1;
+		if (segment === "**") {
+			if (i === 0) regexStr += isLast ? ".*" : "(?:.*/)?";
+			else if (previous === "" || isLast && previous.endsWith("*")) regexStr += "/.*";
+			else regexStr += "(?:/.*)?";
+			continue;
+		}
+		if (i > 0 && !(i === 1 && previous === "**")) regexStr += "/";
+		if (segment === "*" && isLast) {
+			regexStr += "(?:[^/]+/?|/)";
+			continue;
+		}
+		regexStr += segment.split(/\*+/).map((literal) => literal.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join("[^/]*");
+		if (isLast && segment.endsWith("*")) regexStr += "/?";
+	}
+	regexStr += "$";
+	const re = new RegExp(regexStr);
+	localPathnameRegexCache.set(pattern, re);
+	return re;
+}
+/**
+* Check whether a local URL matches a single local pattern.
+* Follows the same semantics as Next.js's matchLocalPattern().
+*/
+function matchLocalPattern(pattern, url) {
+	if (pattern.search !== void 0 && pattern.search !== url.search) return false;
+	return localPathnameGlobToRegex(pattern.pathname ?? "**").test(url.pathname);
+}
+/**
+* Check whether a local URL matches any configured local pattern. Like
+* Next.js's hasLocalMatch(), an unset list allows every local URL.
+*/
+function hasLocalMatch(localPatterns, url) {
+	if (!localPatterns) return true;
+	return localPatterns.some((p) => matchLocalPattern(p, url));
+}
+//#endregion
+export { hasLocalMatch, matchLocalPattern };

package/dist/server/image-optimization.d.ts

@@ -1,22 +1,5 @@
+import { LocalPattern } from "./image-local-patterns.js";
 //#region src/server/image-optimization.d.ts
-/**
- * Image optimization request handler.
- *
- * Handles `/_next/image?url=...&w=...&q=...` requests. In production
- * on Cloudflare Workers, uses the Images binding (`env.IMAGES`) to
- * resize and transcode on the fly. On other runtimes (Node.js dev/prod
- * server), serves the original file as a passthrough with appropriate
- * Cache-Control headers.
- *
- * Format negotiation: inspects the `Accept` header and serves AVIF, WebP,
- * or JPEG depending on client support.
- *
- * Security: All image responses include Content-Security-Policy and
- * X-Content-Type-Options headers to prevent XSS via SVG or Content-Type
- * spoofing. SVG content is blocked by default (following Next.js behavior).
- * When `dangerouslyAllowSVG` is enabled in next.config.js, SVGs are served
- * as-is (no transformation) with security headers applied.
- */
 /** The pathname that triggers image optimization (matches Next.js). */
 export declare const IMAGE_OPTIMIZATION_PATH = "/_next/image";
 /**
@@ -49,11 +32,22 @@ export type ImageConfig = {
   /** Allowed fixed-image widths. Defaults to Next.js image sizes. */
   imageSizes?: number[];
   /**
-   * Allowed output qualities. When unset, any quality from 1-100 is permitted
-   * (matches Next.js: an unset `images.qualities` is not restricted to a single
-   * value). When set, only the listed qualities are accepted.
+   * Allowed output qualities. When set, only the listed qualities are
+   * accepted, as in Next.js. When unset, any quality from 1-100 is accepted.
+   *
+   * Intentional divergence from Next.js 16, which defaults this to `[75]`:
+   * vinext keeps the Next.js 14/15 behaviour for an unset list so apps that
+   * adopt vinext from those versions and pass `quality={N}` keep working
+   * instead of getting 400s. Apps opt into Next.js 16's strict list by
+   * configuring `images.qualities`.
    */
   qualities?: number[];
+  /**
+   * Local sources the endpoint may serve, resolved like Next.js: an app list
+   * gains the static-import pattern, and an unset list becomes
+   * DEFAULT_LOCAL_PATTERNS when checked.
+   */
+  localPatterns?: LocalPattern[];
   /** Allow SVG through the image optimization endpoint. Default: false. */
   dangerouslyAllowSVG?: boolean;
   /**
@@ -80,10 +74,12 @@ export declare const DEFAULT_DEVICE_SIZES: number[];
 export declare const DEFAULT_IMAGE_SIZES: number[];
 export type ParseImageParamsOptions = {
   isDev?: boolean;
+  /** `images.localPatterns`; DEFAULT_LOCAL_PATTERNS when unset. */
+  localPatterns?: LocalPattern[];
 };
 export declare function resolveDevImageRedirect(requestUrl: URL, allowedWidths?: number[], allowedQualities?: number[], options?: ParseImageParamsOptions): string | null;
 export type ImageOptimizationSignal = {
-  /** Middleware response headers to send with the image. */
+  /** next.config and middleware response headers to send with the image. */
   middlewareHeaders: Headers;
   /** The request headers after middleware's overrides, when it set any. */
   requestHeaders: Headers | null;
@@ -120,6 +116,11 @@ export declare function isImageSourceBodyStatus(status: number): boolean;
  */
 export declare const INVALID_IMAGE_SOURCE_MESSAGE = "The requested resource isn't a valid image.";
 export declare function invalidImageSourceResponse(): Response;
+/**
+ * Next.js applies this when `images.localPatterns` is unset: every local path,
+ * but no query string.
+ */
+export declare const DEFAULT_LOCAL_PATTERNS: LocalPattern[];
 /**
  * Parse and validate image optimization query parameters.
  * Returns null if the request is malformed.
@@ -143,6 +144,11 @@ export declare function negotiateImageFormat(acceptHeader: string | null): strin
  * Optimized images are immutable because the URL encodes the transform params.
  */
 export declare const IMAGE_CACHE_CONTROL = "public, max-age=31536000, immutable";
+/**
+ * Next.js's Cache-Control for an image whose source can change at its URL
+ * (anything but a hashed build asset), at the default `images.minimumCacheTTL`.
+ */
+export declare const MUTABLE_IMAGE_SOURCE_CACHE_CONTROL = "public, max-age=14400, must-revalidate";
 /**
  * Content-Security-Policy for image optimization responses.
  * Blocks script execution and framing to prevent XSS via SVG or other

package/dist/server/image-optimization.js

@@ -1,5 +1,6 @@
 import { badRequestResponse } from "./http-error-responses.js";
 import { setCacheStateHeaders } from "./cache-headers.js";
+import { hasLocalMatch } from "./image-local-patterns.js";
 //#region src/server/image-optimization.ts
 /**
 * Image optimization request handler.
@@ -166,6 +167,14 @@ function invalidImageSourceResponse() {
 }
 const RECURSIVE_IMAGE_URL_RE = /\/_(?:next|vinext)\/image(?:$|\/)/;
 /**
+* Next.js applies this when `images.localPatterns` is unset: every local path,
+* but no query string.
+*/
+const DEFAULT_LOCAL_PATTERNS = [{
+	pathname: "**",
+	search: ""
+}];
+/**
 * Parse and validate image optimization query parameters.
 * Returns null if the request is malformed.
 *
@@ -204,6 +213,7 @@ function parseImageParams(url, allowedWidths = [...DEFAULT_DEVICE_SIZES, ...DEFA
 		if (resolved.origin !== base) return null;
 		if (resolved.pathname.startsWith("//")) return null;
 		if (RECURSIVE_IMAGE_URL_RE.test(decodeURIComponent(resolved.pathname))) return null;
+		if (!options.isDev && !hasLocalMatch(options.localPatterns ?? DEFAULT_LOCAL_PATTERNS, resolved)) return null;
 	} catch {
 		return null;
 	}
@@ -229,6 +239,11 @@ function negotiateImageFormat(acceptHeader) {
 */
 const IMAGE_CACHE_CONTROL = "public, max-age=31536000, immutable";
 /**
+* Next.js's Cache-Control for an image whose source can change at its URL
+* (anything but a hashed build asset), at the default `images.minimumCacheTTL`.
+*/
+const MUTABLE_IMAGE_SOURCE_CACHE_CONTROL = "public, max-age=14400, must-revalidate";
+/**
 * Content-Security-Policy for image optimization responses.
 * Blocks script execution and framing to prevent XSS via SVG or other
 * active content that might be served through the image endpoint.
@@ -312,7 +327,7 @@ function createPassthroughImageResponse(source, config) {
 * cache headers.
 */
 async function handleImageOptimization(request, handlers, allowedWidths, imageConfig) {
-	const params = parseImageParams(new URL(request.url), allowedWidths, imageConfig?.qualities);
+	const params = parseImageParams(new URL(request.url), allowedWidths, imageConfig?.qualities, { localPatterns: imageConfig?.localPatterns });
 	if (!params) return badRequestResponse();
 	const { imageUrl, width, quality } = params;
 	const source = await handlers.fetchAsset(imageUrl, request);
@@ -397,4 +412,4 @@ function handleConfiguredImageOptimization(request, fetchAsset, allowedWidths, i
 	}, allowedWidths, imageConfig);
 }
 //#endregion
-export { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, IMAGE_CACHE_CONTROL, IMAGE_CONTENT_SECURITY_POLICY, IMAGE_OPTIMIZATION_PATH, IMAGE_RESPONSE_CACHE_STATE, INVALID_IMAGE_SOURCE_MESSAGE, VINEXT_IMAGE_OPTIMIZATION_PATH, getImageOptimizer, handleConfiguredImageOptimization, handleImageOptimization, invalidImageSourceResponse, isImageOptimizationPath, isImageSourceBodyStatus, isSafeImageContentType, markImageOptimizationSignal, negotiateImageFormat, parseImageParams, readImageOptimizationSignal, resolveDevImageRedirect, restoreImageOptimizationSignalFromTransport, serializeImageOptimizationSignalForTransport, setImageOptimizer };
+export { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, DEFAULT_LOCAL_PATTERNS, IMAGE_CACHE_CONTROL, IMAGE_CONTENT_SECURITY_POLICY, IMAGE_OPTIMIZATION_PATH, IMAGE_RESPONSE_CACHE_STATE, INVALID_IMAGE_SOURCE_MESSAGE, MUTABLE_IMAGE_SOURCE_CACHE_CONTROL, VINEXT_IMAGE_OPTIMIZATION_PATH, getImageOptimizer, handleConfiguredImageOptimization, handleImageOptimization, invalidImageSourceResponse, isImageOptimizationPath, isImageSourceBodyStatus, isSafeImageContentType, markImageOptimizationSignal, negotiateImageFormat, parseImageParams, readImageOptimizationSignal, resolveDevImageRedirect, restoreImageOptimizationSignalFromTransport, serializeImageOptimizationSignalForTransport, setImageOptimizer };

package/dist/server/isr-cache.js

@@ -3,6 +3,7 @@ import { normalizePathnameForRouteMatch } from "../routing/utils.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
 import { isInterceptionMatchedUrlPath } from "./normalize-path.js";
 import { reportRequestError } from "./instrumentation.js";
+import { logRequestError } from "./request-error-log.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { shareIsolatePromise } from "./isolate-shared-promise.js";
 import { normalizeMountedSlotsHeader } from "./app-mounted-slots-header.js";
@@ -144,7 +145,9 @@ function triggerBackgroundRegeneration(key, renderFn, errorContext) {
 	if (!getCdnCacheAdapter().ownsBackgroundRevalidation) return;
 	if (pendingRegenerations.has(key)) return;
 	const promise = renderFn().catch(async (err) => {
-		console.error(`[vinext] ISR background regeneration failed for ${key}:`, err);
+		const message = `[vinext] ISR background regeneration failed for ${key}:`;
+		if (errorContext) logRequestError(message, err);
+		else console.error(message, err);
 		if (errorContext && (errorContext.shouldReport?.(err) ?? true)) await reportRequestError(err, {
 			path: key,
 			method: "GET",

package/dist/server/metadata-route-response.js

@@ -14,10 +14,10 @@ import { isRenderDynamicLatched } from "../shims/internal/headers-state.js";
 import { getActiveDraftModeState, getHeadersContext, hasDraftModeCookieHeader, replaceHeadersContext } from "../shims/headers.js";
 import { _consumeRequestScopedCacheLife, _isOnDemandRevalidate } from "../shims/cache-request-state.js";
 import { ensureFetchPatch, getCollectedFetchTags, setCurrentFetchSoftTags } from "../shims/fetch-cache.js";
+import { applyPrerenderCacheLifeHeader, applyPrerenderCacheTagsHeader } from "./prerender-cache-life-header.js";
 import { isValidMetadataImageId, manifestToJson, matchMetadataRoutePattern, robotsToText, sitemapToXml } from "./metadata-routes.js";
 import { buildAppRouteCacheValue, buildRouteHandlerCachedResponse } from "./app-route-handler-response.js";
 import { canonicalizeAppPageParams } from "./app-page-segment-state.js";
-import { applyPrerenderCacheLifeHeader, applyPrerenderCacheTagsHeader } from "./prerender-cache-life-header.js";
 import { buildPageCacheTags } from "./implicit-tags.js";
 import { createStaticGenerationHeadersContext } from "./app-static-generation.js";
 import { completeAppRouteHandlerResponse } from "./app-route-handler-execution.js";
@@ -504,20 +504,34 @@ async function writeMetadataRouteMiss(options, route, rendered, cachedEntry) {
 async function handleMetadataRouteRequest(options) {
 	let urlParts;
 	const getUrlParts = () => urlParts ??= options.cleanPathname.split("/").filter(Boolean);
+	const routePathname = options.routePathname ?? options.cleanPathname;
+	let routeUrlParts;
+	const getRouteUrlParts = () => routeUrlParts ??= routePathname.split("/").filter(Boolean);
+	let cacheOptions = options;
+	const skipDecodedOwner = () => {
+		cacheOptions = {
+			...options,
+			isrGet: void 0,
+			isrRouteKey: void 0,
+			isrSet: void 0
+		};
+	};
 	for (const route of options.metadataRoutes) {
 		const functions = getMetadataRouteFunctions(route);
 		if (route.type === "sitemap" && route.isDynamic) {
 			if (functions.generateSitemaps) {
-				if (isGeneratedSitemapPath(route, options.cleanPathname)) {
+				if (!isGeneratedSitemapPath(route, options.cleanPathname)) continue;
+				if (!isGeneratedSitemapPath(route, routePathname)) skipDecodedOwner();
+				else {
 					beginMetadataRouteCacheability(route);
 					const render = async () => {
 						setCurrentFetchSoftTags(buildMetadataRouteTags(route, options.cleanPathname, []));
 						const response = await handleGeneratedSitemap(route, options.cleanPathname, functions);
 						return response ? captureRenderedMetadataRoute(response, route, options.cleanPathname) : null;
 					};
-					const cached = await readMatchedPrerenderedMetadataRouteResponse(options, route, render);
+					const cached = await readMatchedPrerenderedMetadataRouteResponse(cacheOptions, route, render);
 					if (cached.response) return cached.response;
-					const response = await renderMetadataRouteMiss(options, route, render, cached.cachedEntry);
+					const response = await renderMetadataRouteMiss(cacheOptions, route, render, cached.cachedEntry);
 					if (response) return response;
 				}
 				continue;
@@ -525,8 +539,12 @@ async function handleMetadataRouteRequest(options) {
 		}
 		const match = matchMetadataRoute(route, options.cleanPathname, functions, getUrlParts);
 		if (!match) continue;
+		if (!matchMetadataRoute(route, routePathname, functions, getRouteUrlParts)) {
+			skipDecodedOwner();
+			continue;
+		}
 		beginMetadataRouteCacheability(route);
-		const rawParams = route.patternParts ? metadataRouteRawParams(route, match, options.routePathname ?? options.cleanPathname) : Object.create(null);
+		const rawParams = route.patternParts ? metadataRouteRawParams(route, match, routePathname) : Object.create(null);
 		if (route.patternParts) {
 			const runtimeParams = { ...rawParams };
 			decodeMatchedParams(runtimeParams);
@@ -536,7 +554,7 @@ async function handleMetadataRouteRequest(options) {
 			setCurrentFetchSoftTags(buildMetadataRouteTags(route, options.cleanPathname, []));
 			return captureRenderedMetadataRoute(route.isDynamic ? await callDynamicMetadataRoute(route, match, options.makeThenableParams, functions) : serveStaticMetadataRoute(route), route, options.cleanPathname);
 		};
-		const cached = await readMatchedPrerenderedMetadataRouteResponse(options, route, render);
+		const cached = await readMatchedPrerenderedMetadataRouteResponse(cacheOptions, route, render);
 		if (cached.response) return cached.response;
 		if (route.isDynamic && isImageMetadataRoute(route) && functions.dynamicParams === false) {
 			const validationParams = { ...rawParams };
@@ -552,7 +570,7 @@ async function handleMetadataRouteRequest(options) {
 			});
 			if (dynamicParamsResponse) return dynamicParamsResponse;
 		}
-		return renderMetadataRouteMiss(options, route, render, cached.cachedEntry);
+		return renderMetadataRouteMiss(cacheOptions, route, render, cached.cachedEntry);
 	}
 	return null;
 }

package/dist/server/middleware-matcher.js

@@ -50,17 +50,30 @@ function matchesMiddlewarePathname(pathname, matcher, i18nConfig, localeContext)
 }
 function matchMatcherPattern(pathname, pattern, i18nConfig, localeContext) {
 	if (localeContext?.kind === "next-data") return matchNextDataPattern(pathname, pattern, i18nConfig, true);
-	if (!i18nConfig) return matchPattern(pathname, pattern);
+	if (!i18nConfig) return matchRequestPattern(pathname, pattern);
 	if (localeContext) {
 		if (localeContext.kind === "internal") return false;
-		return matchPattern(localeContext.kind === "literal" ? stripFirstPathSegment(pathname) : pathname, pattern);
+		return matchRequestPattern(localeContext.kind === "literal" ? stripFirstPathSegment(pathname) : pathname, pattern);
 	}
-	return matchPattern(stripLocalePrefix(pathname, i18nConfig) ?? pathname, pattern);
+	return matchRequestPattern(stripLocalePrefix(pathname, i18nConfig) ?? pathname, pattern);
 }
 function matchObjectMatcher(pathname, matcher, i18nConfig, localeContext) {
 	if (localeContext?.kind === "next-data") return matchNextDataPattern(pathname, matcher.source, i18nConfig, matcher.locale !== false);
 	if (matcher.locale !== false) return matchMatcherPattern(pathname, matcher.source, i18nConfig, localeContext);
-	return matchPattern(localeContext?.kind === "defaulted" ? `/${localeContext.defaultLocale}${pathname === "/" ? "" : pathname}` : pathname, matcher.source);
+	return matchRequestPattern(localeContext?.kind === "defaulted" ? `/${localeContext.defaultLocale}${pathname === "/" ? "" : pathname}` : pathname, matcher.source);
+}
+const APP_ROUTE_TRANSPORT_SUFFIX = "\\.rsc|\\.segments/.+\\.segment\\.rsc";
+const APP_ROUTE_TRANSPORT_SUFFIX_RE = /(?:\.rsc|\.segments\/.+\.segment\.rsc)$/;
+/**
+* Next.js compiles every matcher with optional App Router transport suffixes,
+* so a matcher for `/about` runs middleware for `/about.rsc` too. Middleware
+* still sees the path as requested.
+* https://github.com/vercel/next.js/blob/v16.2.7/packages/next/src/build/analysis/get-page-static-info.ts
+*/
+function matchRequestPattern(pathname, source) {
+	if (matchPattern(pathname, source)) return true;
+	if (!APP_ROUTE_TRANSPORT_SUFFIX_RE.test(pathname)) return false;
+	return matchPattern(pathname, source === "/" ? `/(/?index(?:${APP_ROUTE_TRANSPORT_SUFFIX}))?` : `${source}{(${APP_ROUTE_TRANSPORT_SUFFIX})}?`);
 }
 function matchNextDataPattern(pathname, source, i18nConfig, localized) {
 	if (compiledPattern(source) === INVALID_MATCHER_PATTERN) return true;
@@ -69,8 +82,8 @@ function matchNextDataPattern(pathname, source, i18nConfig, localized) {
 /**
 * The source Next.js compiles for a matcher: an optional `_next/data/<buildId>`
 * prefix, an internal locale segment under i18n, and an optional data suffix.
-* Next.js also accepts App Router transport suffixes, which end in `.rsc` and
-* so can never match a `.json` data URL.
+* Its App Router transport suffixes end in `.rsc`, so they can never match a
+* `.json` data URL.
 * https://github.com/vercel/next.js/blob/v16.2.7/packages/next/src/build/analysis/get-page-static-info.ts
 */
 function nextDataMatcherSource(source, i18nConfig, localized) {

package/dist/server/middleware-runtime.js

@@ -19,6 +19,7 @@ import { nextDataMiddlewareMatchPathname } from "./pages-data-route.js";
 import { reportRequestError } from "./instrumentation.js";
 import { isValidNavigationSignalError } from "../utils/navigation-signal.js";
 import { frameworkTracer } from "./tracer.js";
+import { logRequestError } from "./request-error-log.js";
 //#region src/server/middleware-runtime.ts
 function reportProxyError(options, error) {
 	const url = new URL(options.request.url);
@@ -252,8 +253,11 @@ async function executeMiddlewareModule(options) {
 	} catch (e) {
 		const isDevelopmentNavigationSignal = process.env.NODE_ENV !== "production" && isValidNavigationSignalError(e);
 		if (isDevelopmentNavigationSignal && e instanceof Error) e.message = `Next.js navigation API is not allowed to be used in ${options.isProxy ? "Proxy" : "Middleware"}.`;
-		console.error("[vinext] Middleware error:", e);
-		if (!isDevelopmentNavigationSignal) await reportProxyError(options, e);
+		if (isDevelopmentNavigationSignal) console.error("[vinext] Middleware error:", e);
+		else {
+			logRequestError("[vinext] Middleware error:", e);
+			await reportProxyError(options, e);
+		}
 		const waitUntilPromises = drainFetchEvent(fetchEvent);
 		releaseMiddlewareRequestBody(nextRequest, waitUntilPromises);
 		const message = options.includeErrorDetails ? "Middleware Error: " + (e instanceof Error ? e.message : String(e)) : "Internal Server Error";

package/dist/server/multi-stage.d.ts

@@ -77,14 +77,18 @@ export type VinextResponseStageDispatchOptions = {
    *
    * Under `responseStageCacheIdentity: "query-free"`, an App page identity
    * also drops the user query from the URL and `resolvedUrl`, keeping
-   * framework representation selectors: the `.rsc` suffix, the render mode,
-   * and, for RSC requests only, the one validated `_rsc` value. That is safe
+   * framework representation selectors: the render mode and, for RSC
+   * requests only, the one validated `_rsc` value. That is safe
    * only because completed-response admission refuses a cacheable App page
    * response unless its render proved it never read `searchParams`. The
    * dispatched request still carries the real query for the render itself. A
    * page identity keeps the query when a `next.config` public cache policy
    * applies (cached per full URL, as Next.js CDN caching is), and for
-   * interception and mounted-slot dispatches.
+   * interception and mounted-slot dispatches. A Route Handler or metadata
+   * route identity keeps only the method, path (without `.rsc`) and route
+   * props, as Next.js keys a route handler by its pathname: the RSC selectors
+   * pick no representation of its response, and admission refuses a handler
+   * that read the request's URL or headers.
    */
   cacheIdentity?: {
     props: unknown;