vinext 1.4.1 → 1.4.2

package/dist/server/pages-data-route.js

@@ -1,7 +1,7 @@
 import { MIDDLEWARE_SKIP_HEADER } from "../utils/protocol-headers.js";
-import { addBasePathToPathname, hasBasePath, stripBasePath } from "../utils/base-path.js";
+import { hasBasePath, restoreBasePath, stripBasePath } from "../utils/base-path.js";
 import { NEXTJS_DEPLOYMENT_ID_HEADER } from "./headers.js";
-import { cloneRequestWithUrl } from "./request-pipeline.js";
+import { cloneRequestWithUrl, hasUrlParserDotSegment } from "./request-pipeline.js";
 //#region src/server/pages-data-route.ts
 /**
 * Helpers for the Pages Router `/_next/data/{buildId}/{...page}.json` endpoint.
@@ -62,13 +62,19 @@ function encodeUrlParserIgnoredCharacters(pathname) {
 * `/_next/data/<buildId>/en.json`            → `/en`
 * `/_next/data/<wrong-id>/about.json`        → null
 * `/_next/data/<buildId>/about`              → null  (missing .json suffix)
+* `/_next/data/<buildId>/blog/...json`       → null  (strips to a dot segment)
+*
+* `decoded` marks a percent-decoded copy of a pathname whose raw form already
+* parsed: a `%2e` left in it was `%252e` on the wire, an ordinary character.
 */
-function parseNextDataPathname(pathname, buildId) {
+function parseNextDataPathname(pathname, buildId, decoded = false) {
 	if (!buildId) return null;
 	if (!isNextDataPathname(pathname)) return null;
 	const expectedPrefix = `${NEXT_DATA_PREFIX}${buildId}/`;
 	if (!pathname.startsWith(expectedPrefix)) return null;
-	return pageFromNextDataRest(pathname.slice(expectedPrefix.length, -5));
+	const rest = pathname.slice(expectedPrefix.length, -5);
+	if (!decoded && hasUrlParserDotSegment(rest)) return null;
+	return pageFromNextDataRest(rest);
 }
 /**
 * The page pathname a `_next/data` URL addresses, whatever its buildId. Next.js
@@ -83,7 +89,9 @@ function nextDataMiddlewareMatchPathname(pathname) {
 	if (!isNextDataPathname(pathname)) return null;
 	const buildIdEnd = pathname.indexOf("/", 12);
 	if (buildIdEnd <= 12) return null;
-	return pageFromNextDataRest(pathname.slice(buildIdEnd + 1, -5))?.pagePathname ?? null;
+	const rest = pathname.slice(buildIdEnd + 1, -5);
+	if (hasUrlParserDotSegment(rest)) return null;
+	return pageFromNextDataRest(rest)?.pagePathname ?? null;
 }
 function pageFromNextDataRest(rest) {
 	if (rest.length === 0) return null;
@@ -189,7 +197,7 @@ function normalizePagesDataRequest(request, buildId, basePath = "", trailingSlas
 	};
 	const pagePathname = normalizeNextDataPagePathname(dataMatch.pagePathname, trailingSlash);
 	const normalizedUrl = new URL(reqUrl);
-	normalizedUrl.pathname = hadBasePath ? addBasePathToPathname(pagePathname, basePath) : pagePathname;
+	normalizedUrl.pathname = hadBasePath ? restoreBasePath(pagePathname, basePath) : pagePathname;
 	return {
 		isDataReq: true,
 		request: cloneRequestWithUrl(request, normalizedUrl.href),

package/dist/server/pages-request-pipeline.js

@@ -1,7 +1,7 @@
 import { PRERENDER_REVALIDATE_HEADER } from "../utils/protocol-headers.js";
 import { requestContextFromRequest } from "../config/request-context.js";
 import { isExternalUrl } from "../utils/external-url.js";
-import { addBasePathToPathname } from "../utils/base-path.js";
+import { restoreBasePath } from "../utils/base-path.js";
 import { VINEXT_PRERENDER_REWRITTEN_HEADER } from "./headers.js";
 import { methodNotAllowedResponse, notFoundStaticAssetResponse, sanitizeMethodNotAllowedHeaders } from "./http-error-responses.js";
 import { cloneRequestWithUrl, normalizeTrailingSlash } from "./request-pipeline.js";
@@ -14,10 +14,11 @@ import { buildMiddlewarePrefetchSkipResponse } from "./pages-data-route.js";
 import { markRouteCacheabilityDynamic } from "../shims/cacheability-classification.js";
 import { isOnDemandRevalidateRequest } from "./revalidation-request.js";
 import { mergeRewriteQuery } from "../utils/query.js";
+import { isImageOptimizationPath } from "./image-optimization.js";
 import { setFrameworkRequestRoute } from "./request-tracing.js";
 import { withExternalRewriteResponseHeaders } from "./middleware-response-headers.js";
 import { applyConfigHeadersToHeaderRecord } from "./config-headers.js";
-import { finalizeMissingStaticAssetResponse, mergeHeaders } from "./worker-utils.js";
+import { finalizeMissingStaticAssetResponse, mergeHeaders, mergeStaticFileHeaders } from "./worker-utils.js";
 //#region src/server/pages-request-pipeline.ts
 function ruleUsesUnkeyedRequestCondition(rule) {
 	return [...rule.has ?? [], ...rule.missing ?? []].some((condition) => condition.type === "header" || condition.type === "cookie" || condition.type === "host");
@@ -80,7 +81,7 @@ function wrapMiddlewareWithBasePath(runMiddleware, basePath, hadBasePath) {
 	if (!hadBasePath || !basePath) return runMiddleware;
 	return (request, ctx, opts) => {
 		const mwUrl = new URL(request.url);
-		mwUrl.pathname = addBasePathToPathname(mwUrl.pathname, basePath);
+		mwUrl.pathname = restoreBasePath(mwUrl.pathname, basePath);
 		return runMiddleware(cloneRequestWithUrl(request, mwUrl.toString()), ctx, opts);
 	};
 }
@@ -166,7 +167,7 @@ async function runPagesRequest(request, deps) {
 		const served = await deps.serveFilesystemRoute(requestPathname, middlewareHeaders, phase, resolvedUrl, request, resolvedPathnameHasBasePath);
 		if (served instanceof Response) {
 			const isStaticMethodNotAllowed = served.status === 405 && served.headers.get("allow") === "GET, HEAD";
-			const response = mergeHeaders(served, middlewareHeaders, isStaticMethodNotAllowed || !served.ok || served.status === 206 ? void 0 : middlewareStatus);
+			const response = (resolvedPathnameHasBasePath && isImageOptimizationPath(requestPathname) ? mergeHeaders : mergeStaticFileHeaders)(served, middlewareHeaders, isStaticMethodNotAllowed || !served.ok || served.status === 206 ? void 0 : middlewareStatus);
 			if (isStaticMethodNotAllowed) sanitizeMethodNotAllowedHeaders(response.headers, "GET, HEAD");
 			return {
 				type: "response",
@@ -306,7 +307,7 @@ async function runPagesRequest(request, deps) {
 			let apiRequest = request;
 			if (basePath && hadBasePath) {
 				const apiRequestUrl = new URL(request.url);
-				apiRequestUrl.pathname = addBasePathToPathname(apiRequestUrl.pathname, basePath);
+				apiRequestUrl.pathname = restoreBasePath(apiRequestUrl.pathname, basePath);
 				apiRequest = cloneRequestWithUrl(request, apiRequestUrl.toString());
 			}
 			const response = await deps.handleApi(apiRequest, apiLookupUrl, deps.ctx ?? null, headersFromRecord(middlewareHeaders));

package/dist/server/pages-request-stage-entry.js

@@ -69,6 +69,7 @@ const configRewrites = vinextConfig?.rewrites ?? {
 const configHeaders = vinextConfig?.headers ?? [];
 const imageConfig = vinextConfig?.images ? {
 	qualities: vinextConfig.images.qualities,
+	localPatterns: vinextConfig.images.localPatterns,
 	dangerouslyAllowSVG: vinextConfig.images.dangerouslyAllowSVG,
 	dangerouslyAllowLocalIP: vinextConfig.images.dangerouslyAllowLocalIP,
 	contentDispositionType: vinextConfig.images.contentDispositionType,

package/dist/server/prod-server.js

@@ -270,6 +270,7 @@ const OMIT_STATIC_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
 	"content-type",
 	VINEXT_PRERENDER_SPECIAL_ERROR_HEADER
 ]);
+const IMAGE_ERROR_SIGNAL_HEADERS = ["content-type", "content-encoding"];
 function omitHeadersCaseInsensitive(headersRecord, targets) {
 	const filtered = {};
 	for (const [key, value] of Object.entries(headersRecord)) {
@@ -1195,18 +1196,25 @@ async function startAppRouterServer(options) {
 	if (seededRoutes > 0) console.log(`[vinext] Seeded ${seededRoutes} pre-rendered route${seededRoutes !== 1 ? "s" : ""} into memory cache`);
 	const staticCache = await StaticFileCache.create(clientDir);
 	const serveImageOptimization = async (req, res, request, signal) => {
-		const stagedHeaders = omitHeadersCaseInsensitive(mergeResponseHeaders({}, new Response(null, { headers: signal.middlewareHeaders })), OMIT_STATIC_RESPONSE_HEADERS);
+		const signalHeaders = mergeResponseHeaders({}, new Response(null, { headers: signal.middlewareHeaders }));
+		const stagedHeaders = omitHeadersCaseInsensitive(signalHeaders, OMIT_STATIC_RESPONSE_HEADERS);
 		for (const [name, value] of Object.entries(stagedHeaders)) res.setHeader(name, value);
+		const sendBadRequest = (body) => {
+			for (const name of IMAGE_ERROR_SIGNAL_HEADERS) {
+				const value = signalHeaders[name];
+				if (value !== void 0) res.setHeader(name, value);
+			}
+			res.writeHead(400);
+			res.end(body);
+		};
 		const parsedUrl = new URL(`/${signal.search}`, "http://localhost");
-		const params = parseImageParams(parsedUrl, appImageAllowedWidths, imageConfig?.qualities);
+		const params = parseImageParams(parsedUrl, appImageAllowedWidths, imageConfig?.qualities, { localPatterns: imageConfig?.localPatterns });
 		if (!params) {
-			res.writeHead(400);
-			res.end("Bad Request");
+			sendBadRequest("Bad Request");
 			return;
 		}
 		const sendUnsafeContentType = () => {
-			res.writeHead(400);
-			res.end("The requested resource is not an allowed image type");
+			sendBadRequest("The requested resource is not an allowed image type");
 		};
 		const isSafeSourcePath = (sourcePath) => isSafeImageContentType(contentTypeForPath(sourcePath), imageConfig?.dangerouslyAllowSVG);
 		const imageSecurityHeaders = {
@@ -1243,8 +1251,7 @@ async function startAppRouterServer(options) {
 				if (await serveSource(sourcePath)) return;
 			}
 		}
-		res.writeHead(400);
-		res.end(INVALID_IMAGE_SOURCE_MESSAGE);
+		sendBadRequest(INVALID_IMAGE_SOURCE_MESSAGE);
 	};
 	const clientBuildFiles = new Set(Array.isArray(rscModule.__clientBuildFiles) ? rscModule.__clientBuildFiles : []);
 	const handleRequestImpl = async (req, res) => {
@@ -1455,6 +1462,7 @@ async function createPagesRouterRequestHandler(options) {
 		dangerouslyAllowSVG: vinextConfig.images.dangerouslyAllowSVG,
 		dangerouslyAllowLocalIP: vinextConfig.images.dangerouslyAllowLocalIP,
 		qualities: vinextConfig.images.qualities,
+		localPatterns: vinextConfig.images.localPatterns,
 		contentDispositionType: vinextConfig.images.contentDispositionType,
 		contentSecurityPolicy: vinextConfig.images.contentSecurityPolicy
 	} : void 0;
@@ -1689,7 +1697,7 @@ async function createPagesRouterRequestHandler(options) {
 					if (resolvedPathnameHasBasePath && isImageOptimizationPath(requestPathname)) {
 						for (const [name, value] of Object.entries(stagedHeaders)) res.setHeader(name, value);
 						const parsedUrl = new URL(resolvedUrl, "http://localhost");
-						const params = parseImageParams(parsedUrl, allowedImageWidths, pagesImageConfig?.qualities);
+						const params = parseImageParams(parsedUrl, allowedImageWidths, pagesImageConfig?.qualities, { localPatterns: pagesImageConfig?.localPatterns });
 						if (!params) {
 							res.writeHead(400);
 							res.end("Bad Request");

package/dist/server/request-pipeline.d.ts

@@ -16,6 +16,11 @@ import { getRepeatedSlashRedirect, isOpenRedirectShaped, sendRepeatedSlashRedire
 export declare function canonicalizeRequestPathname(pathname: string): string;
 /** Canonicalize only the pathname portion while preserving the raw query. */
 export declare function canonicalizeRequestUrlPathname(url: string): string;
+/**
+ * Whether the pathname has a segment the URL parser resolves as `.` or `..`,
+ * literally or percent-encoded. Such a pathname changes when it becomes a URL.
+ */
+export declare function hasUrlParserDotSegment(pathname: string): boolean;
 /**
  * Shared request pipeline utilities.
  *

package/dist/server/request-pipeline.js

@@ -30,6 +30,16 @@ function canonicalizeRequestUrlPathname(url) {
 	return canonicalizeRequestPathname(pathname) + search;
 }
 /**
+* Whether the pathname has a segment the URL parser resolves as `.` or `..`,
+* literally or percent-encoded. Such a pathname changes when it becomes a URL.
+*/
+function hasUrlParserDotSegment(pathname) {
+	return pathname.split("/").some((segment) => {
+		const decodedDots = segment.replaceAll(/%2e/gi, ".");
+		return decodedDots === "." || decodedDots === "..";
+	});
+}
+/**
 * Shared request pipeline utilities.
 *
 * Extracted from generated entries and server hot paths to keep codegen focused
@@ -472,4 +482,4 @@ function stripRequestUrlFragment(request) {
 	return attachRequestCfMetadata(new Request(stripped, { signal }), request);
 }
 //#endregion
-export { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, attachRequestCfMetadata, canonicalizeRequestPathname, canonicalizeRequestUrlPathname, cloneRequestWithHeaders, cloneRequestWithUrl, createStaticFileSignal, dropEmptyMiddlewareSetCookie, filterInternalHeaders, getRepeatedSlashRedirect, guardProtocolRelativeUrl, hasBasePath, haveSameHeaders, isOpenRedirectShaped, isOriginAllowed, normalizeTrailingSlash, normalizeTrailingSlashPathname, processMiddlewareHeaders, resolvePublicFileRoute, sendRepeatedSlashRedirect, stripBasePath, stripRequestUrlFragment, validateCsrfOrigin, validateServerActionPayload, withRequestHeaders };
+export { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, attachRequestCfMetadata, canonicalizeRequestPathname, canonicalizeRequestUrlPathname, cloneRequestWithHeaders, cloneRequestWithUrl, createStaticFileSignal, dropEmptyMiddlewareSetCookie, filterInternalHeaders, getRepeatedSlashRedirect, guardProtocolRelativeUrl, hasBasePath, hasUrlParserDotSegment, haveSameHeaders, isOpenRedirectShaped, isOriginAllowed, normalizeTrailingSlash, normalizeTrailingSlashPathname, processMiddlewareHeaders, resolvePublicFileRoute, sendRepeatedSlashRedirect, stripBasePath, stripRequestUrlFragment, validateCsrfOrigin, validateServerActionPayload, withRequestHeaders };

package/dist/server/response-stage-cacheability.d.ts

@@ -23,6 +23,13 @@ export type ResponseStageCacheabilityOptions = {
    * shared response drops them before admission and storage.
    */
   recomposesRequestScopedHeaders?: boolean;
+  /**
+   * Keeps `X-Vinext-Params` when the request scoped headers are dropped. An
+   * intercepted response's params include its target's, which the request
+   * stage doesn't match. Its identity holds the interception context, so the
+   * stored params are its own.
+   */
+  keepsParamsHeader?: boolean;
   /** Generated adapter registration, deferred until the response stage executes. */
   registerCacheAdapters(): void;
   request: Request;

package/dist/server/response-stage-cacheability.js

@@ -24,13 +24,13 @@ async function withResponseStageCacheability(options, render) {
 	const stripsRequestScopedHeaders = options.recomposesRequestScopedHeaders === true && options.cache === "shared" && !options.probeMode;
 	if (!cacheability) {
 		const rendered = await render(context);
-		return stripsRequestScopedHeaders ? withoutRequestScopedHeaders(rendered) : rendered;
+		return stripsRequestScopedHeaders ? withoutRequestScopedHeaders(rendered, options.keepsParamsHeader === true) : rendered;
 	}
 	if (options.policyHeadersAppliedBeforeRender) cacheability.recordResponseStageCachePolicy(context, options.policyHeaders);
 	const state = Reflect.get(context, CACHEABILITY_REQUEST_STATE);
 	if (options.probeMode && options.forceDynamic && !options.policyHeaders?.length && state) state.patternDynamicReason = "dynamic = \"force-dynamic\"";
 	const renderedResponse = await render(context);
-	const rendered = stripsRequestScopedHeaders ? withoutRequestScopedHeaders(renderedResponse) : renderedResponse;
+	const rendered = stripsRequestScopedHeaders ? withoutRequestScopedHeaders(renderedResponse, options.keepsParamsHeader === true) : renderedResponse;
 	const response = options.policyHeadersAppliedBeforeRender ? rendered : cacheability.applyResponseStageCachePolicy(rendered, context, options.policyHeaders);
 	const complete = (candidate) => cacheability.finalizeWorkerCacheabilityResponse(candidate, context);
 	const route = state?.route;
@@ -40,10 +40,11 @@ async function withResponseStageCacheability(options, render) {
 	}
 	return complete(response);
 }
-function withoutRequestScopedHeaders(response) {
-	if (!response.headers.has("X-Vinext-Params") && !response.headers.has("X-Vinext-Rendered-Path-And-Search")) return response;
+function withoutRequestScopedHeaders(response, keepsParams) {
+	const dropsParams = !keepsParams && response.headers.has("X-Vinext-Params");
+	if (!dropsParams && !response.headers.has("X-Vinext-Rendered-Path-And-Search")) return response;
 	const headers = new Headers(response.headers);
-	headers.delete(VINEXT_PARAMS_HEADER);
+	if (dropsParams) headers.delete(VINEXT_PARAMS_HEADER);
 	headers.delete(VINEXT_RENDERED_PATH_AND_SEARCH_HEADER);
 	return preserveFullyBufferedBodyMetadata(response, new Response(response.body, {
 		headers,

package/dist/server/worker-image-optimization.d.ts

@@ -27,8 +27,8 @@ export declare function fetchWorkerImageSource(imageUrl: string, request: Reques
 export declare function fetchSignalledPublicFile(response: Response, sourceRequest: Request, assets: VinextAssetFetcher): Promise<Response> | null;
 /**
  * Serve the App Router image endpoint once the request handler admitted it
- * through middleware and rewrites. Middleware's response headers are sent with
- * the image, as Next.js does.
+ * through middleware and rewrites. Config and middleware response headers are
+ * sent with the image, as Next.js does.
  */
 export declare function serveWorkerImageOptimization(request: Request, signal: ImageOptimizationSignal, allowedWidths: number[] | undefined, imageConfig: ImageConfig | undefined, options: WorkerImageSourceOptions): Promise<Response>;
 //#endregion

package/dist/server/worker-image-optimization.js

@@ -78,8 +78,8 @@ function fetchSignalledPublicFile(response, sourceRequest, assets) {
 }
 /**
 * Serve the App Router image endpoint once the request handler admitted it
-* through middleware and rewrites. Middleware's response headers are sent with
-* the image, as Next.js does.
+* through middleware and rewrites. Config and middleware response headers are
+* sent with the image, as Next.js does.
 */
 async function serveWorkerImageOptimization(request, signal, allowedWidths, imageConfig, options) {
 	const imageUrl = new URL(request.url);
@@ -93,7 +93,22 @@ async function serveWorkerImageOptimization(request, signal, allowedWidths, imag
 	});
 	const cookies = signal.middlewareHeaders.getSetCookie();
 	if (cookies.length > 0) middlewareHeaders["set-cookie"] = cookies;
-	return mergeHeaders(response, middlewareHeaders);
+	const merged = mergeHeaders(response, middlewareHeaders);
+	if (response.status < 400) return merged;
+	const errorHeaders = new Headers(merged.headers);
+	let replaced = false;
+	for (const name of ["content-type", "content-encoding"]) {
+		const value = signal.middlewareHeaders.get(name);
+		if (value === null) continue;
+		errorHeaders.set(name, value);
+		replaced = true;
+	}
+	if (!replaced) return merged;
+	return new Response(merged.body, {
+		headers: errorHeaders,
+		status: merged.status,
+		statusText: merged.statusText
+	});
 }
 //#endregion
 export { fetchSignalledPublicFile, fetchWorkerImageSource, serveWorkerImageOptimization };

package/dist/server/worker-utils.d.ts

@@ -1,6 +1,14 @@
 //#region src/server/worker-utils.d.ts
 export declare function finalizeMissingStaticAssetResponse(response: Response, missingBuildAsset: boolean): Response;
 export declare function mergeHeaders(response: Response, extraHeaders: Record<string, string | string[]>, statusOverride?: number): Response;
+/**
+ * Merge middleware/config headers into a file served from the asset layer.
+ * Its Cache-Control is only the layer's default (Workers Static Assets sends
+ * `public, max-age=0, must-revalidate` with every file), so one set by
+ * middleware or `headers()` wins, as Next.js's static file server sets its
+ * own only when the response has none.
+ */
+export declare function mergeStaticFileHeaders(response: Response, extraHeaders: Record<string, string | string[]>, statusOverride?: number): Response;
 export declare function resolveStaticAssetSignal(signalResponse: Response, options: {
   /** `requestHeaders` are the post-middleware request headers, when middleware set any. */
   fetchAsset(path: string, requestHeaders: Headers | null): Promise<Response>;

package/dist/server/worker-utils.js

@@ -82,6 +82,23 @@ function mergeHeaders(response, extraHeaders, statusOverride) {
 		headers: merged
 	});
 }
+/**
+* Merge middleware/config headers into a file served from the asset layer.
+* Its Cache-Control is only the layer's default (Workers Static Assets sends
+* `public, max-age=0, must-revalidate` with every file), so one set by
+* middleware or `headers()` wins, as Next.js's static file server sets its
+* own only when the response has none.
+*/
+function mergeStaticFileHeaders(response, extraHeaders, statusOverride) {
+	const merged = mergeHeaders(response, extraHeaders, statusOverride);
+	for (const [name, value] of Object.entries(extraHeaders)) {
+		if (name.toLowerCase() !== "cache-control") continue;
+		const cacheControl = (Array.isArray(value) ? value.join(", ") : value).trim();
+		if (!cacheControl) continue;
+		merged.headers.set(name, cacheControl);
+	}
+	return merged;
+}
 async function resolveStaticAssetSignal(signalResponse, options) {
 	const signal = readStaticFileSignal(signalResponse);
 	if (!signal) return null;
@@ -100,7 +117,7 @@ async function resolveStaticAssetSignal(signalResponse, options) {
 	const requestHeaders = readStaticFileSignalRequestHeaders(signalResponse);
 	cancelResponseBody(signalResponse);
 	const assetResponse = await options.fetchAsset(assetPath, requestHeaders);
-	return mergeHeaders(assetResponse, extraHeaders, assetResponse.ok && assetResponse.status !== 206 && signalResponse.status !== 200 ? signalResponse.status : void 0);
+	return mergeStaticFileHeaders(assetResponse, extraHeaders, assetResponse.ok && assetResponse.status !== 206 && signalResponse.status !== 200 ? signalResponse.status : void 0);
 }
 /**
 * Retarget a Worker asset request without dropping its conditional/range
@@ -116,4 +133,4 @@ function createStaticAssetRequest(assetPath, sourceRequest, headers = null) {
 	});
 }
 //#endregion
-export { createStaticAssetRequest, finalizeMissingStaticAssetResponse, mergeHeaders, resolveStaticAssetSignal };
+export { createStaticAssetRequest, finalizeMissingStaticAssetResponse, mergeHeaders, mergeStaticFileHeaders, resolveStaticAssetSignal };

package/dist/shims/image-props.d.ts

@@ -71,6 +71,12 @@ export declare function resolveImageSource(v: {
  * Configurable via `images.deviceSizes` in next.config.js.
  */
 export declare const RESPONSIVE_WIDTHS: number[];
+/**
+ * Parse a `quality` prop like Next.js's `getInt` (shared/lib/get-img-props.ts):
+ * finite numbers and digit-only strings pass, anything else becomes NaN, which
+ * the default loader treats as 75.
+ */
+export declare function parseImageQuality(quality: unknown): number | undefined;
 /**
  * Build a `/_next/image` optimization URL.
  *

package/dist/shims/image-props.js

@@ -52,6 +52,14 @@ const __imageSizes = (() => {
 		];
 	}
 })();
+const __imageQualities = (() => {
+	try {
+		const qualities = JSON.parse(process.env.__VINEXT_IMAGE_QUALITIES ?? "null");
+		return Array.isArray(qualities) ? qualities.sort((a, b) => a - b) : null;
+	} catch {
+		return null;
+	}
+})();
 /**
 * Whether dangerouslyAllowSVG is enabled in next.config.js.
 * When false (default), .svg sources auto-skip the optimization endpoint
@@ -195,6 +203,33 @@ function extractLocalDeploymentId(src) {
 }
 const __imageEndpoint = `${process.env.__NEXT_ROUTER_BASEPATH ?? ""}/_next/image${process.env.__VINEXT_TRAILING_SLASH === "true" ? "/" : ""}`;
 /**
+* Parse a `quality` prop like Next.js's `getInt` (shared/lib/get-img-props.ts):
+* finite numbers and digit-only strings pass, anything else becomes NaN, which
+* the default loader treats as 75.
+*/
+function parseImageQuality(quality) {
+	if (quality === void 0) return void 0;
+	if (typeof quality === "number") return Number.isFinite(quality) ? quality : NaN;
+	if (typeof quality === "string" && /^[0-9]+$/.test(quality)) return parseInt(quality, 10);
+	return NaN;
+}
+/**
+* Round a `quality` prop to the closest entry of `images.qualities`, as the
+* Next.js default loader does (shared/lib/find-closest-quality.ts), so the
+* URL is one the optimization endpoint accepts.
+*
+* With no list configured the prop is used as written (75 when absent). This
+* is deliberate: Next.js 16 defaults the list to `[75]` and would round every
+* quality to 75, but vinext keeps the Next.js 14/15 behaviour for an unset
+* list so migrating apps keep the qualities they ask for (see
+* ImageConfig.qualities in server/image-optimization.ts).
+*/
+function findClosestQuality(quality) {
+	const q = quality || 75;
+	if (!__imageQualities?.length) return q;
+	return __imageQualities.reduce((prev, cur) => Math.abs(cur - q) < Math.abs(prev - q) ? cur : prev, __imageQualities[0]);
+}
+/**
 * Build a `/_next/image` optimization URL.
 *
 * In production (Cloudflare Workers), the worker intercepts this path and uses
@@ -202,9 +237,10 @@ const __imageEndpoint = `${process.env.__NEXT_ROUTER_BASEPATH ?? ""}/_next/image
 * server handles it as a passthrough (serves the original file).
 */
 function imageOptimizationUrl(src, width, quality = 75) {
+	const q = findClosestQuality(quality);
 	const source = extractLocalDeploymentId(src);
 	const deploymentQuery = source.src.startsWith("/") && source.deploymentId ? `&dpl=${source.deploymentId}` : "";
-	return `${__imageEndpoint}?url=${encodeURIComponent(source.src)}&w=${width}&q=${quality}${deploymentQuery}`;
+	return `${__imageEndpoint}?url=${encodeURIComponent(source.src)}&w=${width}&q=${q}${deploymentQuery}`;
 }
 /**
 * Generate a srcSet string for responsive images.
@@ -283,7 +319,7 @@ function getImageProps(props) {
 			}
 		}
 	}
-	const imgQuality = typeof _quality === "string" ? Number(_quality) : _quality ?? 75;
+	const imgQuality = parseImageQuality(_quality) ?? 75;
 	const resolvedSrc = blockedInProd ? "" : loader ? loader({
 		src,
 		width: imgWidth ?? 0,
@@ -320,4 +356,4 @@ function getImageProps(props) {
 	return { props: Object.assign(imageProps, { "data-nimg": fill ? "fill" : "1" }) };
 }
 //#endregion
-export { RESPONSIVE_WIDTHS, __dangerouslyAllowSVG, __globallyUnoptimized, __isDev, generateImageAttributes, getFillStyle, getImageProps, imageOptimizationUrl, isRemoteUrl, isSvgUrl, resolveImageSource, sanitizeBlurDataURL, validateRemoteUrl };
+export { RESPONSIVE_WIDTHS, __dangerouslyAllowSVG, __globallyUnoptimized, __isDev, generateImageAttributes, getFillStyle, getImageProps, imageOptimizationUrl, isRemoteUrl, isSvgUrl, parseImageQuality, resolveImageSource, sanitizeBlurDataURL, validateRemoteUrl };

package/dist/shims/image.js

@@ -1,6 +1,6 @@
 "use client";
 import { useMergedRef } from "./use-merged-ref.js";
-import { RESPONSIVE_WIDTHS, __dangerouslyAllowSVG, __globallyUnoptimized, __isDev, generateImageAttributes, getFillStyle, getImageProps, imageOptimizationUrl, isRemoteUrl, isSvgUrl, resolveImageSource, sanitizeBlurDataURL, validateRemoteUrl } from "./image-props.js";
+import { RESPONSIVE_WIDTHS, __dangerouslyAllowSVG, __globallyUnoptimized, __isDev, generateImageAttributes, getFillStyle, getImageProps, imageOptimizationUrl, isRemoteUrl, isSvgUrl, parseImageQuality, resolveImageSource, sanitizeBlurDataURL, validateRemoteUrl } from "./image-props.js";
 import { forwardRef, useEffect, useLayoutEffect, useRef, useState } from "react";
 import { jsx } from "react/jsx-runtime";
 import * as ReactDOM from "react-dom";
@@ -197,7 +197,7 @@ const Image = forwardRef(function Image({ src: srcProp, alt, width, height, fill
 		});
 	}
 	if (loader) {
-		const resolvedQuality = typeof quality === "string" ? Number(quality) : quality ?? 75;
+		const resolvedQuality = parseImageQuality(quality) ?? 75;
 		const resolvedSrc = loader({
 			src,
 			width: imgWidth ?? 0,
@@ -293,7 +293,7 @@ const Image = forwardRef(function Image({ src: srcProp, alt, width, height, fill
 			});
 		}
 	}
-	const imgQuality = typeof quality === "string" ? Number(quality) : quality ?? 75;
+	const imgQuality = parseImageQuality(quality) ?? 75;
 	const skipOptimization = isSvgUrl(src) && !__dangerouslyAllowSVG;
 	const optimizedAttributes = imgWidth && !fill && !skipOptimization ? generateImageAttributes(src, imgWidth, imgQuality, sizes) : void 0;
 	const srcSet = optimizedAttributes ? optimizedAttributes.srcSet : imgWidth && !fill ? RESPONSIVE_WIDTHS.filter((w) => w <= imgWidth * 2).map((w) => `${src} ${w}w`).join(", ") || `${src} ${imgWidth}w` : void 0;

package/dist/shims/slot.d.ts

@@ -28,10 +28,13 @@ export declare function setAppElementsRenderedSearch(elements: AppElements, sear
  * that arrives after the head (initial hydration) is still seen.
  */
 export declare function bindAppElementsRenderedSearch(elements: AppElements, snapshot: Pick<ClientNavigationRenderSnapshot, "renderedSearch" | "search">): void;
+export declare function isBfcacheIdentityRetained(identity: string): boolean;
 export declare const BfcacheIdentityMapContext: React$1.Context<Readonly<Record<string, string>>>;
 export type BfcacheSlotEntry = {
   content: React$1.ReactNode;
   elements?: AppElements;
+  /** Every entry key inside a hidden entry, its own included. */
+  retainedKeys?: readonly string[];
   segmentId?: string;
   stateKey: string;
   stateKeyMap?: Readonly<Record<string, string>>;

package/dist/shims/slot.js

@@ -1,6 +1,6 @@
 "use client";
 import { APP_BFCACHE_SEGMENT_IDENTITIES_KEY, AppElementsWire, UNMATCHED_SLOT } from "../server/app-elements-wire.js";
-import "../server/app-elements.js";
+import { readOptimisticStateKeyRebinder } from "../server/app-elements.js";
 import { isNestedBfcacheSlotSegmentId, isNestedBfcacheSlotSegmentIdFor } from "../server/bfcache-identity.js";
 import { notFound } from "./navigation-errors.js";
 import { getBfcacheIdMapContext, getBfcacheSegmentIdContext } from "./navigation-context-state.js";
@@ -51,6 +51,25 @@ const BfcacheSegmentIdContext = getBfcacheSegmentIdContext();
 const EMPTY_BFCACHE_STATE_KEYS = Object.freeze({});
 const MAX_BFCACHE_SLOT_ENTRIES_WITH_CACHE_COMPONENTS = 3;
 const MAX_BFCACHE_SLOT_ENTRIES_WITHOUT_CACHE_COMPONENTS = 1;
+const rootBfcacheRetainedKeysReports = /* @__PURE__ */ new Map();
+function isBfcacheIdentityRetained(identity) {
+	return hasBfcacheRetainedKey(rootBfcacheRetainedKeysReports, identity);
+}
+function hasBfcacheRetainedKey(reports, identity) {
+	for (const report of reports.values()) {
+		if (report.keys.includes(identity) || report.hiddenKeys.includes(identity)) return true;
+		if (hasBfcacheRetainedKey(report.activeReports, identity)) return true;
+	}
+	return false;
+}
+const BfcacheRetainedKeysContext = React$1.createContext(rootBfcacheRetainedKeysReports);
+function collectBfcacheRetainedKeys(reports, keys) {
+	for (const report of reports.values()) {
+		for (const key of report.keys) keys.add(key);
+		for (const key of report.hiddenKeys) keys.add(key);
+		collectBfcacheRetainedKeys(report.activeReports, keys);
+	}
+}
 const BfcacheIdentityMapContext = React$1.createContext(EMPTY_BFCACHE_STATE_KEYS);
 function isCacheComponentsEnabled() {
 	return String(process.env.__NEXT_CACHE_COMPONENTS) === "true";
@@ -136,34 +155,71 @@ function warnTransportMetadataEntry(id) {
 * falling back to the live boundary values for entries that predate per-entry
 * capture.
 */
-function BfcacheEntryProviders({ entry, fallbackElements, fallbackSegmentId, fallbackStateKeyMap, SegmentContext }) {
+function BfcacheEntryProviders({ entry, fallbackElements, fallbackSegmentId, fallbackStateKeyMap, retainedKeysReports, SegmentContext }) {
 	return /* @__PURE__ */ jsx(BfcacheIdentityMapContext.Provider, {
 		value: entry.stateKeyMap ?? fallbackStateKeyMap,
 		children: /* @__PURE__ */ jsx(ElementsContext.Provider, {
 			value: entry.elements ?? fallbackElements,
 			children: /* @__PURE__ */ jsx(SegmentContext.Provider, {
 				value: entry.segmentId ?? fallbackSegmentId,
-				children: entry.content
+				children: /* @__PURE__ */ jsx(BfcacheRetainedKeysContext.Provider, {
+					value: retainedKeysReports,
+					children: entry.content
+				})
 			})
 		})
 	});
 }
-function useBfcacheSlotEntries(activeEntry) {
+function useBfcacheSlotEntries(listId, activeEntry) {
 	const snapshotsByStateKey = React$1.useRef(/* @__PURE__ */ new Map());
 	const [entryOrder, setEntryOrder] = React$1.useState(() => [activeEntry.stateKey]);
+	const [retainedKeysReportsByStateKey] = React$1.useState(() => /* @__PURE__ */ new Map());
+	const getRetainedKeysReports = (stateKey) => {
+		let reports = retainedKeysReportsByStateKey.get(stateKey);
+		if (!reports) {
+			reports = /* @__PURE__ */ new Map();
+			retainedKeysReportsByStateKey.set(stateKey, reports);
+		}
+		return reports;
+	};
 	const committedSnapshots = snapshotsByStateKey.current;
 	const staged = stageBfcacheSlotEntryForRender(committedSnapshots, entryOrder, activeEntry);
+	for (const [index, entry] of staged.entries.entries()) {
+		if (entry.stateKey === activeEntry.stateKey || entry.retainedKeys) continue;
+		const retainedKeys = /* @__PURE__ */ new Set([entry.stateKey]);
+		collectBfcacheRetainedKeys(getRetainedKeysReports(entry.stateKey), retainedKeys);
+		const hiddenEntry = {
+			...entry,
+			retainedKeys: [...retainedKeys]
+		};
+		staged.entries[index] = hiddenEntry;
+		staged.snapshots.set(entry.stateKey, hiddenEntry);
+	}
 	const nextOrder = staged.order;
 	const orderChanged = !haveSameBfcacheSlotEntryOrder(entryOrder, nextOrder);
 	React$1.useLayoutEffect(() => {
 		snapshotsByStateKey.current = staged.snapshots;
-	}, [staged.snapshots]);
+		for (const stateKey of retainedKeysReportsByStateKey.keys()) if (!staged.snapshots.has(stateKey)) retainedKeysReportsByStateKey.delete(stateKey);
+	}, [retainedKeysReportsByStateKey, staged.snapshots]);
+	const hiddenKeys = [...new Set(staged.entries.flatMap((entry) => entry.retainedKeys ?? []))];
+	const enclosingReports = React$1.useContext(BfcacheRetainedKeysContext);
+	const report = {
+		activeReports: getRetainedKeysReports(activeEntry.stateKey),
+		hiddenKeys,
+		keys: staged.entries.map((entry) => entry.stateKey)
+	};
+	React$1.useLayoutEffect(() => {
+		enclosingReports.set(listId, report);
+	});
 	if (process.env.NODE_ENV !== "production" && !staged.snapshots.has(activeEntry.stateKey)) throw new Error("BFCache Activity slot is missing the active entry snapshot");
 	if (orderChanged) setEntryOrder(nextOrder);
-	return staged.entries;
+	return {
+		entries: staged.entries,
+		getRetainedKeysReports
+	};
 }
 function BfcacheActivitySlotBoundary({ activeStateKey, content, elements, id, SegmentContext, stateKeyMap }) {
-	const renderEntries = useBfcacheSlotEntries({
+	const { entries: renderEntries, getRetainedKeysReports } = useBfcacheSlotEntries(id, {
 		content,
 		elements,
 		segmentId: id,
@@ -177,6 +233,7 @@ function BfcacheActivitySlotBoundary({ activeStateKey, content, elements, id, Se
 			fallbackElements: elements,
 			fallbackSegmentId: id,
 			fallbackStateKeyMap: stateKeyMap,
+			retainedKeysReports: getRetainedKeysReports(entry.stateKey),
 			SegmentContext
 		})
 	}, entry.stateKey)) });
@@ -228,7 +285,8 @@ function BfcacheChildrenActivityBoundary({ children, id, IdMapContext, SegmentCo
 	const identityMap = React$1.useContext(BfcacheIdentityMapContext);
 	const bfcacheIdMap = React$1.useContext(IdMapContext);
 	const segmentId = React$1.useContext(SegmentContext);
-	const activeStateKey = stateKey ?? (id === void 0 ? void 0 : resolveBfcacheSegmentStateKey(id, identityMap, bfcacheIdMap));
+	const rebindStateKey = readOptimisticStateKeyRebinder(elements);
+	const activeStateKey = stateKey !== void 0 ? rebindStateKey?.(stateKey) ?? stateKey : id === void 0 ? void 0 : resolveBfcacheSegmentStateKey(id, identityMap, bfcacheIdMap);
 	if (segmentId === null || activeStateKey === void 0) return /* @__PURE__ */ jsx(Fragment$1, { children });
 	return /* @__PURE__ */ jsx(BfcacheActivitySlotBoundary, {
 		activeStateKey,
@@ -375,4 +433,4 @@ function ParallelSlot({ name }) {
 	return React$1.useContext(ParallelSlotsContext)?.[name] ?? null;
 }
 //#endregion
-export { BfcacheChildrenBoundary, BfcacheIdentityMapContext, BfcacheSegmentBoundary, Children, ChildrenContext, ElementsContext, ParallelSlot, ParallelSlotsContext, RenderedSearchContext, Slot, UNMATCHED_SLOT, bindAppElementsRenderedSearch, getNonCacheComponentsSegmentKey, mergeElements, resolveBfcacheSegmentStateKey, setAppElementsRenderedSearch, stageBfcacheSlotEntryForRender, updateBfcacheSlotEntryOrder };
+export { BfcacheChildrenBoundary, BfcacheIdentityMapContext, BfcacheSegmentBoundary, Children, ChildrenContext, ElementsContext, ParallelSlot, ParallelSlotsContext, RenderedSearchContext, Slot, UNMATCHED_SLOT, bindAppElementsRenderedSearch, getNonCacheComponentsSegmentKey, isBfcacheIdentityRetained, mergeElements, resolveBfcacheSegmentStateKey, setAppElementsRenderedSearch, stageBfcacheSlotEntryForRender, updateBfcacheSlotEntryOrder };