vinext 1.4.1 → 1.4.2

package/dist/server/app-rsc-route-matching.d.ts

@@ -101,6 +101,7 @@ type AppRscRouteForMatching = {
   pattern: string;
   patternParts: string[];
   routeHandler?: unknown;
+  routeSegments?: readonly string[] | null;
   slots?: Record<string, AppRscSlotForMatching>;
   siblingIntercepts?: AppRscSiblingInterceptForMatching[];
 };
@@ -108,6 +109,14 @@ type AppRscInterceptMatch = AppRscInterceptLookupEntry & {
   matchedParams: AppRscRouteParams;
   sourceRouteIsConcrete: boolean;
   sourceMatchedParams: AppRscRouteParams;
+  /**
+   * The source route and params the request's interception context names,
+   * which the request handler authorizes. They differ from the rendered
+   * `sourceRouteIndex` only for a sibling intercept opened from a deeper
+   * source, which renders the intercepting route itself.
+   */
+  authorizationSourceRouteIndex: number;
+  authorizationSourceParams: AppRscRouteParams;
 };
 type AppRscInterceptLoadState = {
   page: unknown;
@@ -120,6 +129,11 @@ type AppRscInterceptLookupEntry = {
   interceptionId: string | null;
   interceptionGraphId: string | null;
   sourceRouteIndex: number;
+  /**
+   * A sibling intercept whose owner route's page sits in the directory of the
+   * interception marker, so the owner is the intercepting route itself.
+   */
+  ownerIsInterceptingRoute: boolean;
   slotKey: string;
   targetPattern: string;
   targetPatternParts: string[];

package/dist/server/app-rsc-route-matching.js

@@ -1,7 +1,8 @@
-import { decodeMatchedParams, decodeRouteSegment, splitPathSegments, splitPathnameForRouteMatch } from "../routing/utils.js";
+import { decodeMatchedParams, decodeRouteSegment, splitPathSegments } from "../routing/utils.js";
 import { createAppRouteGraphInterceptionId } from "../routing/app-route-ids.js";
 import { buildRouteTrie, trieMatchRaw } from "../routing/route-trie.js";
 import { extractRawRoutePatternParams, matchRoutePatternPrefix, matchRoutePatternRaw } from "../routing/route-pattern.js";
+import { getRenderedConcreteUrlPathsForRoute } from "./pregenerated-concrete-paths.js";
 import { canonicalizeAppPageParams } from "./app-page-segment-state.js";
 //#region src/server/app-rsc-route-matching.ts
 /**
@@ -13,10 +14,19 @@ const SIBLING_PAGE_INTERCEPT_SLOT_KEY = "__vinext_page_intercept";
 function createRouteParams() {
 	return Object.create(null);
 }
-function appRscPathnameParts(pathname, isNormalized = false) {
+/**
+* Whether each encoded raw segment is exactly the spelling the URL parser, as
+* a browser runs it, gives its decoded form: `caf%C3%A9` for `café`, but `q&a`
+* for `q&a`. `%61dmin`, `caf%c3%a9`, `%63af%C3%A9` and `q%26a` are other
+* spellings of a page, which middleware never compared as its pathname.
+*/
+function isCanonicalPathEncoding(rawParts, decodedParts) {
+	return rawParts.every((rawPart, index) => !rawPart.includes("%") || rawPart === new URL(`/${decodedParts[index]}`, "http://n").pathname.slice(1));
+}
+function appRscPathnameParts(pathname) {
 	const pathOnly = pathname.split("?")[0];
 	const normalizedPathname = pathOnly === "/" ? "/" : pathOnly.replace(/\/$/, "");
-	return isNormalized ? splitPathSegments(normalizedPathname) : splitPathnameForRouteMatch(normalizedPathname);
+	return splitPathSegments(normalizedPathname);
 }
 function isAppRouteHandlerRoute(route) {
 	return route.routeHandler != null || typeof route.__loadRouteHandler === "function";
@@ -49,8 +59,10 @@ function createAppRscRouteMatcher(routes, decodedPathnamePatterns = []) {
 		const result = matchRawRequestParts(rawParts);
 		if (!result) return null;
 		if (decodedPathnameRoutes.size > 0 && result.route.patternParts.some((part) => part.startsWith(":")) && !isAppRouteHandlerRoute(result.route) && rawParts.some((part) => part.includes("%"))) {
-			const route = decodedPathnameRoutes.get(rawParts.map(decodeRouteSegment).join("/"));
-			if (route && route !== result.route) return {
+			const decodedParts = rawParts.map(decodeRouteSegment);
+			const decodedPathname = decodedParts.join("/");
+			const route = decodedPathnameRoutes.get(decodedPathname);
+			if (route && route !== result.route && (isCanonicalPathEncoding(rawParts, decodedParts) || getRenderedConcreteUrlPathsForRoute(route.pattern)?.has(`/${decodedPathname}`) === true)) return {
 				route,
 				params: createRouteParams()
 			};
@@ -62,23 +74,18 @@ function createAppRscRouteMatcher(routes, decodedPathnamePatterns = []) {
 			return interceptionIds.has(interceptionId);
 		},
 		matchRoute(url) {
-			const rawParts = appRscPathnameParts(url, true);
-			const result = trieMatchRaw(routeTrie, appRscPathnameParts(url, false));
-			if (!result) return null;
-			result.params = extractRawRoutePatternParams(result.route.patternParts, rawParts);
-			normalizeMatchedParamsForRoute(result);
-			return result;
+			return matchRequestParts(appRscPathnameParts(url));
 		},
 		matchRequestRoute(url) {
-			return matchRequestParts(appRscPathnameParts(url, true));
+			return matchRequestParts(appRscPathnameParts(url));
 		},
 		matchRawRequestRoute(url) {
-			return matchRawRequestParts(appRscPathnameParts(url, true));
+			return matchRawRequestParts(appRscPathnameParts(url));
 		},
 		findIntercept(pathname, sourcePathname = null, interceptionId = null) {
 			if (sourcePathname === null) return null;
-			const urlParts = appRscPathnameParts(pathname, true);
-			const sourceParts = appRscPathnameParts(sourcePathname, true);
+			const urlParts = appRscPathnameParts(pathname);
+			const sourceParts = appRscPathnameParts(sourcePathname);
 			const matchedSourceRoute = matchRawRequestParts(sourceParts);
 			for (const entry of interceptLookup) {
 				if (interceptionId !== null && entry.interceptionId !== interceptionId) continue;
@@ -92,15 +99,21 @@ function createAppRscRouteMatcher(routes, decodedPathnamePatterns = []) {
 				if (sourceRoute && isAppRouteHandlerRoute(sourceRoute)) continue;
 				const matchedSourceParams = concreteSourceRoute ? concreteSourceRoute.params : sourceRoute ? matchSlotOwnerSourceParams(sourceParts, sourceRoute.patternParts, entry.sourceMatchPatternParts !== null) : null;
 				if (!concreteSourceRoute && matchedSourceParams) canonicalizeAppPageParams(matchedSourceParams);
+				const ownerRoute = routes[entry.sourceRouteIndex];
+				const rendersOwnerRoute = entry.ownerIsInterceptingRoute && concreteSourceRouteIndex !== entry.sourceRouteIndex && ownerRoute !== void 0;
+				const renderedSourceParams = rendersOwnerRoute ? matchSlotOwnerSourceParams(sourceParts, ownerRoute.patternParts, true) : matchedSourceParams;
+				if (rendersOwnerRoute && renderedSourceParams) canonicalizeAppPageParams(renderedSourceParams);
 				if (matchedSourceParams === null && entry.sourceMatchPatternParts === null) continue;
-				const sourceParams = matchedSourceParams && entry.sourceMatchPatternParts !== null ? pickPatternParams(matchedSourceParams, entry.sourceMatchPatternParts) : matchedSourceParams ?? createRouteParams();
+				const sourceParams = renderedSourceParams && entry.sourceMatchPatternParts !== null ? pickPatternParams(renderedSourceParams, entry.sourceMatchPatternParts) : renderedSourceParams ?? createRouteParams();
 				return {
 					...entry,
 					page: entry.__loadState.page,
 					sourceRouteIsConcrete: concreteSourceRoute !== null,
-					sourceRouteIndex: concreteSourceRouteIndex,
+					sourceRouteIndex: rendersOwnerRoute ? entry.sourceRouteIndex : concreteSourceRouteIndex,
 					matchedParams: mergeMatchedParams(sourceParams, params),
-					sourceMatchedParams: matchedSourceParams ?? createRouteParams()
+					sourceMatchedParams: renderedSourceParams ?? createRouteParams(),
+					authorizationSourceRouteIndex: concreteSourceRouteIndex,
+					authorizationSourceParams: matchedSourceParams ?? createRouteParams()
 				};
 			}
 			return null;
@@ -108,6 +121,15 @@ function createAppRscRouteMatcher(routes, decodedPathnamePatterns = []) {
 	};
 }
 /**
+* Whether a sibling intercept's owner route is the intercepting route: its
+* page lives in the directory that holds the interception marker. An owner
+* found elsewhere stands in for a marker directory without a page.
+*/
+function isInterceptingRoute(routeSegments, sourcePageSegments) {
+	if (!routeSegments || !sourcePageSegments) return false;
+	return sourcePageSegments.findIndex((segment) => /^\(\.+\)/.test(segment)) === routeSegments.length && routeSegments.every((segment, index) => segment === sourcePageSegments[index]);
+}
+/**
 * Params for the slot owner when interception falls back to it instead of a
 * concrete descendant source route. The owner is what renders, and
 * `matchInterceptRoute` reads the promoted route's params solely from these,
@@ -195,6 +217,7 @@ function createInterceptLookup(routes) {
 					interceptionId: typeof slotModule.id === "string" && sourceMatchPattern !== null ? createAppRouteGraphInterceptionId(slotModule.id, sourceMatchPattern, intercept.targetPattern) : null,
 					interceptionGraphId: null,
 					sourceRouteIndex: ownerRouteIndex,
+					ownerIsInterceptingRoute: false,
 					slotKey,
 					slotId: typeof slotModule.id === "string" ? slotModule.id : null,
 					targetRouteGraphId: resolveTargetRouteGraphId(intercept.targetPattern),
@@ -246,6 +269,7 @@ function createInterceptLookup(routes) {
 				interceptionId: typeof intercept.id === "string" ? intercept.id : null,
 				interceptionGraphId: typeof intercept.id === "string" ? intercept.id : null,
 				sourceRouteIndex: routeIndex,
+				ownerIsInterceptingRoute: !isAppRouteHandlerRoute(route) && isInterceptingRoute(route.routeSegments, intercept.sourcePageSegments),
 				slotKey: SIBLING_PAGE_INTERCEPT_SLOT_KEY,
 				slotId: typeof intercept.slotId === "string" ? intercept.slotId : null,
 				targetRouteGraphId: resolveTargetRouteGraphId(intercept.targetPattern),

package/dist/server/app-server-action-execution.js

@@ -12,6 +12,7 @@ import { attachRequestCfMetadata, validateCsrfOrigin, validateServerActionPayloa
 import { splitPathSegments } from "../routing/utils.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
 import { logRequestError } from "./request-error-log.js";
+import { SERVER_ACTION_CACHE_CONTROL, applyCdnResponseHeaders } from "./cache-control.js";
 import { shareIsolatePromise } from "./isolate-shared-promise.js";
 import { APP_RSC_RENDER_MODE_NAVIGATION } from "./app-rsc-render-mode.js";
 import { isDraftModeRequest, setHeadersContext } from "../shims/headers.js";
@@ -21,17 +22,18 @@ import { readStreamAsTextWithLimit } from "../utils/text-stream.js";
 import { mergeMiddlewareResponseHeaders } from "./middleware-response-headers.js";
 import { VINEXT_RSC_CONTENT_TYPE, applyRscCompatibilityIdHeader, createRscRequestUrl, stripRscCacheBustingSearchParam } from "./app-rsc-cache-busting.js";
 import { getSetCookieName } from "./cookie-utils.js";
+import { markAppRscResponseConfigHeadersApplied, markStreamedActionRedirectResponse } from "./app-rsc-response-finalizer.js";
 import { createServerActionNotFoundResponse, getServerActionNotFoundMessage, isServerActionNotFoundError } from "./server-action-not-found.js";
 import { applyEdgeRuntimeHeader } from "./app-page-response.js";
 import { getNextErrorDigest, parseNextHttpErrorDigest, parseNextRedirectDigest } from "./next-error-digest.js";
-import { hasDigest } from "./app-rsc-errors.js";
-import { resolveAppPageNavigationParams } from "./app-page-element-builder.js";
+import { resolveAppPageNavigationParams } from "./app-page-navigation-params.js";
 import "./app-page-stream.js";
+import { hasDigest } from "./app-rsc-errors.js";
 import { buildAppPageTags } from "./implicit-tags.js";
+import { resolveAppPageInterceptSegmentConfig } from "./app-page-intercept-segment-config.js";
 import { resolveAppPageActionRerenderTarget } from "./app-page-request.js";
 import { createRootParamsUsageController, runWithRootParamsUsage } from "../shims/root-params.js";
 import { createStaticGenerationHeadersContext } from "./app-static-generation.js";
-import { markAppRscResponseConfigHeadersApplied } from "./app-rsc-response-finalizer.js";
 //#region src/server/app-server-action-execution.ts
 /**
 * Run a server-reference load or decode outside every request scope.
@@ -659,7 +661,7 @@ async function handleProgressiveServerActionRequest(options) {
 				options.clearRequestContext();
 				const headers = new Headers();
 				mergeMiddlewareResponseHeaders(headers, options.middlewareHeaders);
-				headers.set("Cache-Control", "no-cache, no-store, max-age=0, must-revalidate");
+				headers.set("Cache-Control", SERVER_ACTION_CACHE_CONTROL);
 				for (const cookie of actionPendingCookies) headers.append("Set-Cookie", cookie);
 				if (actionDraftCookie) headers.append("Set-Cookie", actionDraftCookie);
 				return internalServerErrorResponse(process.env.NODE_ENV === "production" ? void 0 : "Server action failed: " + getServerActionFailureMessage(actionError), { headers });
@@ -879,6 +881,7 @@ async function handleServerActionRscRequest(options) {
 			applyEdgeRuntimeHeader(redirectHeaders, options.isEdgeRuntime);
 			mergeActionRedirectSourceHeaders(redirectHeaders, options.sourceConfigHeaders ?? null);
 			mergeActionRedirectSourceHeaders(redirectHeaders, options.middlewareHeaders);
+			applyCdnResponseHeaders(redirectHeaders, { cacheControl: SERVER_ACTION_CACHE_CONTROL });
 			applyRscCompatibilityIdHeader(redirectHeaders);
 			const actionRedirectUrl = applyActionRedirectBasePath(actionRedirect.url, options.basePath ?? "");
 			redirectHeaders.set(ACTION_REDIRECT_HEADER, actionRedirectUrl);
@@ -938,10 +941,10 @@ async function handleServerActionRscRequest(options) {
 				targetPathname,
 				targetRoute: targetMatch?.route ?? null
 			}) ? 200 : 303;
-			return markAppRscResponseConfigHeadersApplied(createServerActionRscResponse(targetResponse.body, {
+			return markStreamedActionRedirectResponse(markAppRscResponseConfigHeadersApplied(createServerActionRscResponse(targetResponse.body, {
 				status: redirectResponseStatus,
 				headers: redirectHeaders
-			}, options.clearRequestContext));
+			}, options.clearRequestContext)));
 		}
 		const actionPendingCookies = dedupePendingCookies(options.getAndClearPendingCookies());
 		const actionDraftCookie = options.getDraftModeCookieHeader();
@@ -976,6 +979,7 @@ async function handleServerActionRscRequest(options) {
 		let element;
 		let errorPattern = match ? match.route.pattern : options.cleanPathname;
 		let renderedPathAndSearch = null;
+		let actionRerenderIsEdgeRuntime = options.isEdgeRuntime;
 		const actionRerenderIsRscRequest = true;
 		if (match) {
 			const { route: actionRoute, params: actionParams } = match;
@@ -991,7 +995,9 @@ async function handleServerActionRscRequest(options) {
 			});
 			const resolvedActionNavigationParams = resolveAppPageNavigationParams(actionRerenderTarget.route, actionRerenderTarget.navigationParams, options.cleanPathname, actionRerenderTarget.interceptOpts);
 			await options.ensureRouteLoaded?.(actionRerenderTarget.route);
-			const actionRerenderDynamicConfig = options.resolveRouteDynamicConfig?.(actionRerenderTarget.route);
+			const actionInterceptConfig = actionRerenderTarget.interceptOpts ? resolveAppPageInterceptSegmentConfig(actionRerenderTarget.route, actionRerenderTarget.interceptOpts) : null;
+			if (actionInterceptConfig) actionRerenderIsEdgeRuntime = actionInterceptConfig.isEdgeRuntime;
+			const actionRerenderDynamicConfig = actionInterceptConfig ? actionInterceptConfig.dynamicConfig : options.resolveRouteDynamicConfig?.(actionRerenderTarget.route);
 			const actionRerenderSearchParams = prepareActionPageRerenderContext({
 				draftModeCookie: actionDraftCookie,
 				draftModeSecret: options.draftModeSecret,
@@ -1007,8 +1013,8 @@ async function handleServerActionRscRequest(options) {
 			});
 			const renderedSearch = options.searchParams.toString();
 			renderedPathAndSearch = renderedSearch ? `${options.cleanPathname}?${renderedSearch}` : options.cleanPathname;
-			setCurrentFetchCacheMode(options.resolveRouteFetchCacheMode?.(actionRerenderTarget.route) ?? null);
-			setCurrentFetchRevalidate(options.resolveRouteRevalidateSeconds?.(actionRerenderTarget.route) ?? null);
+			setCurrentFetchCacheMode(actionInterceptConfig ? actionInterceptConfig.fetchCacheMode : options.resolveRouteFetchCacheMode?.(actionRerenderTarget.route) ?? null);
+			setCurrentFetchRevalidate(actionInterceptConfig ? actionInterceptConfig.revalidateSeconds : options.resolveRouteRevalidateSeconds?.(actionRerenderTarget.route) ?? null);
 			setCurrentForceDynamicFetchDefault(actionRerenderDynamicConfig === "force-dynamic");
 			setCurrentFetchSoftTags(buildServerActionPageTags(actionRerenderTarget.route, options.cleanPathname));
 			const buildActionRerenderElement = () => options.buildPageElement({
@@ -1047,7 +1053,7 @@ async function handleServerActionRscRequest(options) {
 			"Content-Type": VINEXT_RSC_CONTENT_TYPE,
 			Vary: VINEXT_RSC_VARY_HEADER
 		});
-		applyEdgeRuntimeHeader(actionHeaders, options.isEdgeRuntime);
+		applyEdgeRuntimeHeader(actionHeaders, actionRerenderIsEdgeRuntime);
 		mergeMiddlewareResponseHeaders(actionHeaders, options.middlewareHeaders);
 		applyRscCompatibilityIdHeader(actionHeaders);
 		setActionRevalidatedHeader(actionHeaders, actionRevalidationKind);

package/dist/server/cache-control.d.ts

@@ -1,6 +1,8 @@
 import { CdnCacheableHeaderInput, isNonCacheableCacheControl } from "../shims/cdn-cache.js";
 //#region src/server/cache-control.d.ts
 export declare const NEVER_CACHE_CONTROL = "private, no-cache, no-store, max-age=0, must-revalidate";
+/** The policy Next.js sends on every Server Action response. */
+export declare const SERVER_ACTION_CACHE_CONTROL = "no-cache, no-store, max-age=0, must-revalidate";
 export declare const BROWSER_REVALIDATE_CACHE_CONTROL = "public, max-age=0, must-revalidate";
 export declare const STATIC_CACHE_CONTROL = "s-maxage=31536000, stale-while-revalidate";
 export declare const NO_STORE_CACHE_CONTROL = "no-store, must-revalidate";

package/dist/server/cache-control.js

@@ -2,6 +2,8 @@ import { getCdnCacheAdapter, isNonCacheableCacheControl } from "../shims/cdn-cac
 import { recordRouteCacheabilityCdnTags } from "../shims/cacheability-classification.js";
 //#region src/server/cache-control.ts
 const NEVER_CACHE_CONTROL = "private, no-cache, no-store, max-age=0, must-revalidate";
+/** The policy Next.js sends on every Server Action response. */
+const SERVER_ACTION_CACHE_CONTROL = "no-cache, no-store, max-age=0, must-revalidate";
 const BROWSER_REVALIDATE_CACHE_CONTROL = "public, max-age=0, must-revalidate";
 const STATIC_CACHE_CONTROL = "s-maxage=31536000, stale-while-revalidate";
 const STALE_REVALIDATE_CACHE_CONTROL = "s-maxage=0, stale-while-revalidate";
@@ -167,4 +169,4 @@ function buildCachedRevalidateCacheControl(cacheState, revalidateSeconds, expire
 	return buildRevalidateCacheControl(revalidateSeconds, expireSeconds);
 }
 //#endregion
-export { BROWSER_REVALIDATE_CACHE_CONTROL, NEVER_CACHE_CONTROL, NO_STORE_CACHE_CONTROL, STATIC_CACHE_CONTROL, applyCdnResponseBuildIdentityHeaders, applyCdnResponseHeaders, applyCdnResponseIdentityHeaders, buildCachedRevalidateCacheControl, buildRevalidateCacheControl, captureCdnResponsePolicyHeaders, captureCdnResponsePolicyOverrides, hasCdnResponsePolicy, hasExplicitNonCacheableResponsePolicy, isCdnResponsePolicyHeader, isNonCacheableCacheControl, isNonCacheableCdnResponsePolicy, readCdnResponseCacheControl, readCdnResponsePolicyHeaderName, reconcileCdnResponseHeadersAfterOuterPolicy, shouldUseNextDeployCacheControl, validateCdnRequest };
+export { BROWSER_REVALIDATE_CACHE_CONTROL, NEVER_CACHE_CONTROL, NO_STORE_CACHE_CONTROL, SERVER_ACTION_CACHE_CONTROL, STATIC_CACHE_CONTROL, applyCdnResponseBuildIdentityHeaders, applyCdnResponseHeaders, applyCdnResponseIdentityHeaders, buildCachedRevalidateCacheControl, buildRevalidateCacheControl, captureCdnResponsePolicyHeaders, captureCdnResponsePolicyOverrides, hasCdnResponsePolicy, hasExplicitNonCacheableResponsePolicy, isCdnResponsePolicyHeader, isNonCacheableCacheControl, isNonCacheableCdnResponsePolicy, readCdnResponseCacheControl, readCdnResponsePolicyHeaderName, reconcileCdnResponseHeadersAfterOuterPolicy, shouldUseNextDeployCacheControl, validateCdnRequest };

package/dist/server/image-local-patterns.d.ts

@@ -0,0 +1,21 @@
+//#region src/server/image-local-patterns.d.ts
+/**
+ * `images.localPatterns` matching for the image optimization endpoint, kept
+ * apart from the remote-pattern shim so the request path doesn't load its IP
+ * parsing.
+ */
+export type LocalPattern = {
+  pathname?: string;
+  search?: string;
+};
+/**
+ * Check whether a local URL matches a single local pattern.
+ * Follows the same semantics as Next.js's matchLocalPattern().
+ */
+export declare function matchLocalPattern(pattern: LocalPattern, url: URL): boolean;
+/**
+ * Check whether a local URL matches any configured local pattern. Like
+ * Next.js's hasLocalMatch(), an unset list allows every local URL.
+ */
+export declare function hasLocalMatch(localPatterns: LocalPattern[] | undefined, url: URL): boolean;
+//#endregion

package/dist/server/image-local-patterns.js

@@ -0,0 +1,59 @@
+//#region src/server/image-local-patterns.ts
+const localPathnameRegexCache = /* @__PURE__ */ new Map();
+/**
+* Convert a local pathname glob to a RegExp, reading `*` and `**` like Next.js's
+* picomatch (`makeRe(pathname, { dot: true })`):
+*   - a `**` segment matches zero or more whole segments, but needs its own
+*     separator right after a leading `/`, and at the end after a segment
+*     that ends in `*`;
+*   - any other `*` run matches characters within one segment;
+*   - a last segment ending in `*` also matches one trailing slash, and a
+*     whole last `*` matches one character or more (that slash included).
+* Other picomatch syntax (braces, `?`, classes) is matched literally.
+*/
+function localPathnameGlobToRegex(pattern) {
+	const cached = localPathnameRegexCache.get(pattern);
+	if (cached !== void 0) return cached;
+	const segments = pattern.split("/").filter((segment, i, all) => !(segment === "**" && all[i - 1] === "**"));
+	let regexStr = "^";
+	for (let i = 0; i < segments.length; i++) {
+		const segment = segments[i];
+		const previous = segments[i - 1];
+		const isLast = i === segments.length - 1;
+		if (segment === "**") {
+			if (i === 0) regexStr += isLast ? ".*" : "(?:.*/)?";
+			else if (previous === "" || isLast && previous.endsWith("*")) regexStr += "/.*";
+			else regexStr += "(?:/.*)?";
+			continue;
+		}
+		if (i > 0 && !(i === 1 && previous === "**")) regexStr += "/";
+		if (segment === "*" && isLast) {
+			regexStr += "(?:[^/]+/?|/)";
+			continue;
+		}
+		regexStr += segment.split(/\*+/).map((literal) => literal.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join("[^/]*");
+		if (isLast && segment.endsWith("*")) regexStr += "/?";
+	}
+	regexStr += "$";
+	const re = new RegExp(regexStr);
+	localPathnameRegexCache.set(pattern, re);
+	return re;
+}
+/**
+* Check whether a local URL matches a single local pattern.
+* Follows the same semantics as Next.js's matchLocalPattern().
+*/
+function matchLocalPattern(pattern, url) {
+	if (pattern.search !== void 0 && pattern.search !== url.search) return false;
+	return localPathnameGlobToRegex(pattern.pathname ?? "**").test(url.pathname);
+}
+/**
+* Check whether a local URL matches any configured local pattern. Like
+* Next.js's hasLocalMatch(), an unset list allows every local URL.
+*/
+function hasLocalMatch(localPatterns, url) {
+	if (!localPatterns) return true;
+	return localPatterns.some((p) => matchLocalPattern(p, url));
+}
+//#endregion
+export { hasLocalMatch, matchLocalPattern };

package/dist/server/image-optimization.d.ts

@@ -1,22 +1,5 @@
+import { LocalPattern } from "./image-local-patterns.js";
 //#region src/server/image-optimization.d.ts
-/**
- * Image optimization request handler.
- *
- * Handles `/_next/image?url=...&w=...&q=...` requests. In production
- * on Cloudflare Workers, uses the Images binding (`env.IMAGES`) to
- * resize and transcode on the fly. On other runtimes (Node.js dev/prod
- * server), serves the original file as a passthrough with appropriate
- * Cache-Control headers.
- *
- * Format negotiation: inspects the `Accept` header and serves AVIF, WebP,
- * or JPEG depending on client support.
- *
- * Security: All image responses include Content-Security-Policy and
- * X-Content-Type-Options headers to prevent XSS via SVG or Content-Type
- * spoofing. SVG content is blocked by default (following Next.js behavior).
- * When `dangerouslyAllowSVG` is enabled in next.config.js, SVGs are served
- * as-is (no transformation) with security headers applied.
- */
 /** The pathname that triggers image optimization (matches Next.js). */
 export declare const IMAGE_OPTIMIZATION_PATH = "/_next/image";
 /**
@@ -49,11 +32,22 @@ export type ImageConfig = {
   /** Allowed fixed-image widths. Defaults to Next.js image sizes. */
   imageSizes?: number[];
   /**
-   * Allowed output qualities. When unset, any quality from 1-100 is permitted
-   * (matches Next.js: an unset `images.qualities` is not restricted to a single
-   * value). When set, only the listed qualities are accepted.
+   * Allowed output qualities. When set, only the listed qualities are
+   * accepted, as in Next.js. When unset, any quality from 1-100 is accepted.
+   *
+   * Intentional divergence from Next.js 16, which defaults this to `[75]`:
+   * vinext keeps the Next.js 14/15 behaviour for an unset list so apps that
+   * adopt vinext from those versions and pass `quality={N}` keep working
+   * instead of getting 400s. Apps opt into Next.js 16's strict list by
+   * configuring `images.qualities`.
    */
   qualities?: number[];
+  /**
+   * Local sources the endpoint may serve, resolved like Next.js: an app list
+   * gains the static-import pattern, and an unset list becomes
+   * DEFAULT_LOCAL_PATTERNS when checked.
+   */
+  localPatterns?: LocalPattern[];
   /** Allow SVG through the image optimization endpoint. Default: false. */
   dangerouslyAllowSVG?: boolean;
   /**
@@ -80,10 +74,12 @@ export declare const DEFAULT_DEVICE_SIZES: number[];
 export declare const DEFAULT_IMAGE_SIZES: number[];
 export type ParseImageParamsOptions = {
   isDev?: boolean;
+  /** `images.localPatterns`; DEFAULT_LOCAL_PATTERNS when unset. */
+  localPatterns?: LocalPattern[];
 };
 export declare function resolveDevImageRedirect(requestUrl: URL, allowedWidths?: number[], allowedQualities?: number[], options?: ParseImageParamsOptions): string | null;
 export type ImageOptimizationSignal = {
-  /** Middleware response headers to send with the image. */
+  /** next.config and middleware response headers to send with the image. */
   middlewareHeaders: Headers;
   /** The request headers after middleware's overrides, when it set any. */
   requestHeaders: Headers | null;
@@ -120,6 +116,11 @@ export declare function isImageSourceBodyStatus(status: number): boolean;
  */
 export declare const INVALID_IMAGE_SOURCE_MESSAGE = "The requested resource isn't a valid image.";
 export declare function invalidImageSourceResponse(): Response;
+/**
+ * Next.js applies this when `images.localPatterns` is unset: every local path,
+ * but no query string.
+ */
+export declare const DEFAULT_LOCAL_PATTERNS: LocalPattern[];
 /**
  * Parse and validate image optimization query parameters.
  * Returns null if the request is malformed.

package/dist/server/image-optimization.js

@@ -1,5 +1,6 @@
 import { badRequestResponse } from "./http-error-responses.js";
 import { setCacheStateHeaders } from "./cache-headers.js";
+import { hasLocalMatch } from "./image-local-patterns.js";
 //#region src/server/image-optimization.ts
 /**
 * Image optimization request handler.
@@ -166,6 +167,14 @@ function invalidImageSourceResponse() {
 }
 const RECURSIVE_IMAGE_URL_RE = /\/_(?:next|vinext)\/image(?:$|\/)/;
 /**
+* Next.js applies this when `images.localPatterns` is unset: every local path,
+* but no query string.
+*/
+const DEFAULT_LOCAL_PATTERNS = [{
+	pathname: "**",
+	search: ""
+}];
+/**
 * Parse and validate image optimization query parameters.
 * Returns null if the request is malformed.
 *
@@ -204,6 +213,7 @@ function parseImageParams(url, allowedWidths = [...DEFAULT_DEVICE_SIZES, ...DEFA
 		if (resolved.origin !== base) return null;
 		if (resolved.pathname.startsWith("//")) return null;
 		if (RECURSIVE_IMAGE_URL_RE.test(decodeURIComponent(resolved.pathname))) return null;
+		if (!options.isDev && !hasLocalMatch(options.localPatterns ?? DEFAULT_LOCAL_PATTERNS, resolved)) return null;
 	} catch {
 		return null;
 	}
@@ -317,7 +327,7 @@ function createPassthroughImageResponse(source, config) {
 * cache headers.
 */
 async function handleImageOptimization(request, handlers, allowedWidths, imageConfig) {
-	const params = parseImageParams(new URL(request.url), allowedWidths, imageConfig?.qualities);
+	const params = parseImageParams(new URL(request.url), allowedWidths, imageConfig?.qualities, { localPatterns: imageConfig?.localPatterns });
 	if (!params) return badRequestResponse();
 	const { imageUrl, width, quality } = params;
 	const source = await handlers.fetchAsset(imageUrl, request);
@@ -402,4 +412,4 @@ function handleConfiguredImageOptimization(request, fetchAsset, allowedWidths, i
 	}, allowedWidths, imageConfig);
 }
 //#endregion
-export { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, IMAGE_CACHE_CONTROL, IMAGE_CONTENT_SECURITY_POLICY, IMAGE_OPTIMIZATION_PATH, IMAGE_RESPONSE_CACHE_STATE, INVALID_IMAGE_SOURCE_MESSAGE, MUTABLE_IMAGE_SOURCE_CACHE_CONTROL, VINEXT_IMAGE_OPTIMIZATION_PATH, getImageOptimizer, handleConfiguredImageOptimization, handleImageOptimization, invalidImageSourceResponse, isImageOptimizationPath, isImageSourceBodyStatus, isSafeImageContentType, markImageOptimizationSignal, negotiateImageFormat, parseImageParams, readImageOptimizationSignal, resolveDevImageRedirect, restoreImageOptimizationSignalFromTransport, serializeImageOptimizationSignalForTransport, setImageOptimizer };
+export { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, DEFAULT_LOCAL_PATTERNS, IMAGE_CACHE_CONTROL, IMAGE_CONTENT_SECURITY_POLICY, IMAGE_OPTIMIZATION_PATH, IMAGE_RESPONSE_CACHE_STATE, INVALID_IMAGE_SOURCE_MESSAGE, MUTABLE_IMAGE_SOURCE_CACHE_CONTROL, VINEXT_IMAGE_OPTIMIZATION_PATH, getImageOptimizer, handleConfiguredImageOptimization, handleImageOptimization, invalidImageSourceResponse, isImageOptimizationPath, isImageSourceBodyStatus, isSafeImageContentType, markImageOptimizationSignal, negotiateImageFormat, parseImageParams, readImageOptimizationSignal, resolveDevImageRedirect, restoreImageOptimizationSignalFromTransport, serializeImageOptimizationSignalForTransport, setImageOptimizer };

package/dist/server/metadata-route-response.js

@@ -504,20 +504,34 @@ async function writeMetadataRouteMiss(options, route, rendered, cachedEntry) {
 async function handleMetadataRouteRequest(options) {
 	let urlParts;
 	const getUrlParts = () => urlParts ??= options.cleanPathname.split("/").filter(Boolean);
+	const routePathname = options.routePathname ?? options.cleanPathname;
+	let routeUrlParts;
+	const getRouteUrlParts = () => routeUrlParts ??= routePathname.split("/").filter(Boolean);
+	let cacheOptions = options;
+	const skipDecodedOwner = () => {
+		cacheOptions = {
+			...options,
+			isrGet: void 0,
+			isrRouteKey: void 0,
+			isrSet: void 0
+		};
+	};
 	for (const route of options.metadataRoutes) {
 		const functions = getMetadataRouteFunctions(route);
 		if (route.type === "sitemap" && route.isDynamic) {
 			if (functions.generateSitemaps) {
-				if (isGeneratedSitemapPath(route, options.cleanPathname)) {
+				if (!isGeneratedSitemapPath(route, options.cleanPathname)) continue;
+				if (!isGeneratedSitemapPath(route, routePathname)) skipDecodedOwner();
+				else {
 					beginMetadataRouteCacheability(route);
 					const render = async () => {
 						setCurrentFetchSoftTags(buildMetadataRouteTags(route, options.cleanPathname, []));
 						const response = await handleGeneratedSitemap(route, options.cleanPathname, functions);
 						return response ? captureRenderedMetadataRoute(response, route, options.cleanPathname) : null;
 					};
-					const cached = await readMatchedPrerenderedMetadataRouteResponse(options, route, render);
+					const cached = await readMatchedPrerenderedMetadataRouteResponse(cacheOptions, route, render);
 					if (cached.response) return cached.response;
-					const response = await renderMetadataRouteMiss(options, route, render, cached.cachedEntry);
+					const response = await renderMetadataRouteMiss(cacheOptions, route, render, cached.cachedEntry);
 					if (response) return response;
 				}
 				continue;
@@ -525,8 +539,12 @@ async function handleMetadataRouteRequest(options) {
 		}
 		const match = matchMetadataRoute(route, options.cleanPathname, functions, getUrlParts);
 		if (!match) continue;
+		if (!matchMetadataRoute(route, routePathname, functions, getRouteUrlParts)) {
+			skipDecodedOwner();
+			continue;
+		}
 		beginMetadataRouteCacheability(route);
-		const rawParams = route.patternParts ? metadataRouteRawParams(route, match, options.routePathname ?? options.cleanPathname) : Object.create(null);
+		const rawParams = route.patternParts ? metadataRouteRawParams(route, match, routePathname) : Object.create(null);
 		if (route.patternParts) {
 			const runtimeParams = { ...rawParams };
 			decodeMatchedParams(runtimeParams);
@@ -536,7 +554,7 @@ async function handleMetadataRouteRequest(options) {
 			setCurrentFetchSoftTags(buildMetadataRouteTags(route, options.cleanPathname, []));
 			return captureRenderedMetadataRoute(route.isDynamic ? await callDynamicMetadataRoute(route, match, options.makeThenableParams, functions) : serveStaticMetadataRoute(route), route, options.cleanPathname);
 		};
-		const cached = await readMatchedPrerenderedMetadataRouteResponse(options, route, render);
+		const cached = await readMatchedPrerenderedMetadataRouteResponse(cacheOptions, route, render);
 		if (cached.response) return cached.response;
 		if (route.isDynamic && isImageMetadataRoute(route) && functions.dynamicParams === false) {
 			const validationParams = { ...rawParams };
@@ -552,7 +570,7 @@ async function handleMetadataRouteRequest(options) {
 			});
 			if (dynamicParamsResponse) return dynamicParamsResponse;
 		}
-		return renderMetadataRouteMiss(options, route, render, cached.cachedEntry);
+		return renderMetadataRouteMiss(cacheOptions, route, render, cached.cachedEntry);
 	}
 	return null;
 }

package/dist/server/nitro-public-files-plugin.js

@@ -53,17 +53,26 @@ function toH3Pathname(pathname) {
 	}
 }
 /**
+* The key Nitro's static handler looks a pathname up under, following
+* `runtime/internal/static.mjs`: without one trailing slash and decoded
+* except for `%2F`.
+*/
+function toAssetId(pathname) {
+	const id = pathname.length > 1 && pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
+	try {
+		return decodeURIComponent(id.replace(/%2f/gi, "%252F"));
+	} catch {
+		return id;
+	}
+}
+/**
 * Whether Nitro's static handler would answer a request for a pathname with
-* a public file, following its lookup in `runtime/internal/static.mjs`. It
-* looks h3's pathname up without one trailing slash and decoded except for
-* `%2F`, and then as a directory with an `index.html`, each first with the
-* extension of a compressed copy for every encoding the request accepts.
+* a public file. It looks h3's pathname up under its key, and then as a
+* directory with an `index.html`, each first with the extension of a
+* compressed copy for every encoding the request accepts.
 */
 function isPublicFilePathname(pathname, extensions, publicAssets) {
-	let id = pathname.length > 1 && pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
-	try {
-		id = decodeURIComponent(id.replace(/%2f/gi, "%252F"));
-	} catch {}
+	const id = toAssetId(pathname);
 	const index = id.endsWith("/") ? `${id}index.html` : `${id}/index.html`;
 	return extensions.some((extension) => publicAssets.has(id + extension) || publicAssets.has(index + extension));
 }
@@ -86,6 +95,9 @@ function createNitroPublicFilesPlugin(options) {
 		const token = crypto.randomUUID();
 		Reflect.set(globalThis, Symbol.for(NITRO_ASSETS_KEY), {
 			async fetch(request) {
+				const { pathname } = new URL(request.url);
+				const h3Pathname = toH3Pathname(pathname);
+				if (h3Pathname === void 0 || toAssetId(h3Pathname) !== toAssetId(pathname)) return new Response(null, { status: 404 });
 				const headers = new Headers(request.headers);
 				headers.set(ASSET_REQUEST_HEADER, token);
 				return appFetch(new Request(request, { headers }));

package/dist/server/pages-data-route.d.ts

@@ -59,8 +59,12 @@ export declare function encodeUrlParserIgnoredCharacters(pathname: string): stri
  * `/_next/data/<buildId>/en.json`            → `/en`
  * `/_next/data/<wrong-id>/about.json`        → null
  * `/_next/data/<buildId>/about`              → null  (missing .json suffix)
+ * `/_next/data/<buildId>/blog/...json`       → null  (strips to a dot segment)
+ *
+ * `decoded` marks a percent-decoded copy of a pathname whose raw form already
+ * parsed: a `%2e` left in it was `%252e` on the wire, an ordinary character.
  */
-export declare function parseNextDataPathname(pathname: string, buildId: string): NextDataMatch | null;
+export declare function parseNextDataPathname(pathname: string, buildId: string, decoded?: boolean): NextDataMatch | null;
 /**
  * The page pathname a `_next/data` URL addresses, whatever its buildId. Next.js
  * compiles every middleware matcher with an optional `/_next/data/<buildId>`