vinext 1.4.1 → 1.4.3

package/dist/server/image-source-reader.js

@@ -0,0 +1,126 @@
+//#region src/server/image-source-reader.ts
+/**
+* Streamed reads of an image source for the image optimization endpoint.
+*
+* Animation detection parses a GIF, PNG or WebP source as it streams in rather
+* than buffering it, so a large source cannot exhaust a Worker isolate's
+* memory. Only the source's first bytes are kept, to replay without a refetch.
+*/
+/** Most bytes of a source kept to replay it after animation detection. */
+const HELD_SOURCE_LIMIT = 1048576;
+/** Thrown once a source grows past `images.maximumResponseBody`. */
+var ImageSourceTooLargeError = class extends Error {
+	constructor() {
+		super("Image source exceeds images.maximumResponseBody");
+	}
+};
+var ImageSourceReader = class {
+	#reader;
+	#limit;
+	#read = 0;
+	#done = false;
+	#tooLarge = false;
+	#window = [];
+	#windowStart = 0;
+	#windowEnd = 0;
+	#held = [];
+	#replayed = false;
+	constructor(body, limit) {
+		this.#reader = body.getReader();
+		this.#limit = limit;
+	}
+	/** Whether the source has grown past the limit. */
+	get tooLarge() {
+		return this.#tooLarge;
+	}
+	/** The source's length once it has all been read and held, else null. */
+	get completeLength() {
+		return this.#done && this.#held ? this.#read : null;
+	}
+	/** Stop reading the source without waiting on its cancellation. */
+	cancel() {
+		this.#reader.cancel().catch(() => {});
+	}
+	/** Up to `length` bytes at `offset`, fewer where the source ends. */
+	async bytes(offset, length) {
+		const end = offset + length;
+		await this.#reach(offset, end);
+		const available = Math.min(end, this.#windowEnd);
+		const bytes = new Uint8Array(Math.max(0, available - offset));
+		let start = this.#windowStart;
+		for (const chunk of this.#window) {
+			if (start >= available) break;
+			const from = Math.max(offset - start, 0);
+			const to = Math.min(available - start, chunk.byteLength);
+			if (from < to) bytes.set(chunk.subarray(from, to), start + from - offset);
+			start += chunk.byteLength;
+		}
+		return bytes;
+	}
+	/** The byte at `offset`, or undefined past the source's end. */
+	async byte(offset) {
+		return (await this.bytes(offset, 1))[0];
+	}
+	/**
+	* The whole source as a stream, replaying the bytes already read, or null
+	* once they are no longer all held. An incompletely read source replays
+	* once; the rest streams from the source, still within the limit, and is
+	* held too while the whole source fits.
+	*/
+	body() {
+		const held = this.#held;
+		if (held === null || this.#replayed && !this.#done) return null;
+		this.#replayed = true;
+		this.#window = [];
+		let index = 0;
+		return new ReadableStream({
+			pull: async (controller) => {
+				if (index < held.length) {
+					controller.enqueue(held[index++]);
+					return;
+				}
+				const chunk = await this.#next();
+				if (!chunk) return controller.close();
+				this.#hold(chunk);
+				index = held.length;
+				controller.enqueue(chunk);
+			},
+			cancel: (reason) => this.#reader.cancel(reason)
+		});
+	}
+	async #next() {
+		if (this.#done) return void 0;
+		const { done, value } = await this.#reader.read();
+		if (done) {
+			this.#done = true;
+			return;
+		}
+		this.#read += value.byteLength;
+		if (this.#read > this.#limit) {
+			this.#tooLarge = true;
+			this.cancel();
+			throw new ImageSourceTooLargeError();
+		}
+		return value;
+	}
+	#hold(chunk) {
+		if (!this.#held) return;
+		if (this.#read <= HELD_SOURCE_LIMIT) this.#held.push(chunk);
+		else this.#held = null;
+	}
+	/** Read until `end` is in the window, dropping chunks wholly before `offset`. */
+	async #reach(offset, end) {
+		if (offset < this.#windowStart) throw new Error("Image source reads must not move backwards");
+		for (;;) {
+			while (this.#window.length > 0 && this.#windowStart + this.#window[0].byteLength <= offset) this.#windowStart += this.#window.shift().byteLength;
+			if (this.#windowEnd >= end) return;
+			const chunk = await this.#next();
+			if (!chunk) return;
+			this.#hold(chunk);
+			this.#window.push(chunk);
+			this.#windowEnd += chunk.byteLength;
+		}
+	}
+};
+//#endregion
+export { ImageSourceReader, ImageSourceTooLargeError };

package/dist/server/metadata-route-response.d.ts

@@ -21,6 +21,11 @@ type MetadataRouteRequestOptions = {
   isrRouteKey?: (pathname: string) => string;
   isrSet?: MetadataRouteCacheSetter;
   makeThenableParams: MetadataRouteMakeThenableParams;
+  /**
+   * The pathname params are read from. A direct request passes its raw path
+   * here and its decoded path as `cleanPathname`; a rewrite passes its
+   * destination, still percent-encoded, as both.
+   */
   routePathname?: string;
   scheduleBackgroundRegeneration?: MetadataRouteBackgroundRegenerator;
 };
@@ -36,6 +41,6 @@ export type PrerenderableMetadataRoute = {
  */
 export declare function getPrerenderableMetadataRoutePaths(metadataRoutes: readonly MetadataRuntimeRoute[]): Promise<PrerenderableMetadataRoute[]>;
 export declare function isMetadataRouteRequestPath(metadataRoutes: readonly MetadataRuntimeRoute[], cleanPathname: string): boolean;
-export declare function handleMetadataRouteRequest(options: MetadataRouteRequestOptions): Promise<Response | null>;
+export declare function handleMetadataRouteRequest(requestOptions: MetadataRouteRequestOptions): Promise<Response | null>;
 //#endregion
 export {};

package/dist/server/metadata-route-response.js

@@ -2,7 +2,7 @@ import { markFullyBufferedBody } from "./fully-buffered-response.js";
 import { closeAfterResponse, createRequestContext, runWithRequestContext } from "../shims/unified-request-context.js";
 import { VINEXT_METADATA_ROUTE_CACHE_HEADER } from "./headers.js";
 import { notFoundResponse } from "./http-error-responses.js";
-import { decodeMatchedParams } from "../routing/utils.js";
+import { decodeMatchedParams, normalizePathnameForRouteMatch } from "../routing/utils.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
 import { runInWorkStoreScope } from "../shims/internal/work-store-scope.js";
 import { beginRouteCacheability, markRouteCacheabilityExplicitResponsePolicy, markRouteCacheabilityResponseBodyComplete, recordRouteCacheability } from "../shims/cacheability-classification.js";
@@ -89,6 +89,20 @@ function getMetadataRouteFunctions(route) {
 	routeFunctionCache.set(route, functions);
 	return functions;
 }
+/**
+* Next.js compiles a metadata route into a Route Handler, and under a dynamic
+* segment its build stores it only when the route's own module generates its
+* params or is `force-static`/`error` (collectAppRouteSegments reads no parent
+* layout). Its metadata loader adds generateStaticParams for
+* generateImageMetadata. Probed on next@16.2.7: a parent layout's
+* generateStaticParams, `revalidate` or `dynamicParams` leave the route
+* dynamic. Generated sitemaps are only served below a static prefix.
+*/
+function isMetadataRouteStaticGenEnabled(route) {
+	if (!route.isDynamic || !route.patternParts) return true;
+	const functions = getMetadataRouteFunctions(route);
+	return route.module?.dynamic === "force-static" || route.module?.dynamic === "error" || functions.generateStaticParams !== null || functions.generateImageMetadata !== null;
+}
 function isUseCacheFunction(value) {
 	return value !== null && Reflect.get(value, USE_CACHE_FUNCTION_SYMBOL) === true;
 }
@@ -165,7 +179,7 @@ async function captureRenderedMetadataRoute(response, route, cleanPathname) {
 		...observedCacheLife,
 		revalidate: frameworkRevalidate
 	};
-	const cacheable = (_isOnDemandRevalidate() || response.status < 400 || response.status === 404) && completed && !isRenderDynamicLatched() && !getActiveDraftModeState() && !hasDraftModeCookieHeader() && route.module?.dynamic !== "force-dynamic" && frameworkRevalidate > 0 && !response.headers.has("set-cookie");
+	const cacheable = (_isOnDemandRevalidate() || response.status < 400 || response.status === 404) && completed && !isRenderDynamicLatched() && !getActiveDraftModeState() && !hasDraftModeCookieHeader() && route.module?.dynamic !== "force-dynamic" && isMetadataRouteStaticGenEnabled(route) && frameworkRevalidate > 0 && !response.headers.has("set-cookie");
 	const cacheControl = cacheable ? buildAppRouteMissIsrCacheControl(frameworkRevalidate, cacheLife?.expire) : NEVER_CACHE_CONTROL;
 	if (isUserResponse && !hasUserPolicy) {
 		response = new Response(response.body, {
@@ -233,7 +247,7 @@ async function runMetadataRouteRegeneration(options, route, render, routeKey, pr
 }
 /** The outer ISR key for a matched metadata route, or null if it's never cached. */
 function getOuterMetadataCacheKey(options, route) {
-	if (!isOuterMetadataCacheEnabled() || !options.isrRouteKey || getActiveDraftModeState() || hasDraftModeCookieHeader() || route.module?.dynamic === "force-dynamic" || route.module?.revalidate === 0) return null;
+	if (!isOuterMetadataCacheEnabled() || !options.isrRouteKey || getActiveDraftModeState() || hasDraftModeCookieHeader() || route.module?.dynamic === "force-dynamic" || route.module?.revalidate === 0 || !isMetadataRouteStaticGenEnabled(route)) return null;
 	return options.isrRouteKey(options.cleanPathname);
 }
 /**
@@ -501,23 +515,41 @@ async function writeMetadataRouteMiss(options, route, rendered, cachedEntry) {
 		console.error("[vinext] Metadata route ISR cache write error:", error);
 	}
 }
-async function handleMetadataRouteRequest(options) {
+async function handleMetadataRouteRequest(requestOptions) {
+	const options = requestOptions.routePathname === requestOptions.cleanPathname ? {
+		...requestOptions,
+		cleanPathname: normalizePathnameForRouteMatch(requestOptions.cleanPathname)
+	} : requestOptions;
 	let urlParts;
 	const getUrlParts = () => urlParts ??= options.cleanPathname.split("/").filter(Boolean);
+	const routePathname = options.routePathname ?? options.cleanPathname;
+	let routeUrlParts;
+	const getRouteUrlParts = () => routeUrlParts ??= routePathname.split("/").filter(Boolean);
+	let cacheOptions = options;
+	const skipDecodedOwner = () => {
+		cacheOptions = {
+			...options,
+			isrGet: void 0,
+			isrRouteKey: void 0,
+			isrSet: void 0
+		};
+	};
 	for (const route of options.metadataRoutes) {
 		const functions = getMetadataRouteFunctions(route);
 		if (route.type === "sitemap" && route.isDynamic) {
 			if (functions.generateSitemaps) {
-				if (isGeneratedSitemapPath(route, options.cleanPathname)) {
+				if (!isGeneratedSitemapPath(route, options.cleanPathname)) continue;
+				if (!isGeneratedSitemapPath(route, routePathname)) skipDecodedOwner();
+				else {
 					beginMetadataRouteCacheability(route);
 					const render = async () => {
 						setCurrentFetchSoftTags(buildMetadataRouteTags(route, options.cleanPathname, []));
 						const response = await handleGeneratedSitemap(route, options.cleanPathname, functions);
 						return response ? captureRenderedMetadataRoute(response, route, options.cleanPathname) : null;
 					};
-					const cached = await readMatchedPrerenderedMetadataRouteResponse(options, route, render);
+					const cached = await readMatchedPrerenderedMetadataRouteResponse(cacheOptions, route, render);
 					if (cached.response) return cached.response;
-					const response = await renderMetadataRouteMiss(options, route, render, cached.cachedEntry);
+					const response = await renderMetadataRouteMiss(cacheOptions, route, render, cached.cachedEntry);
 					if (response) return response;
 				}
 				continue;
@@ -525,8 +557,12 @@ async function handleMetadataRouteRequest(options) {
 		}
 		const match = matchMetadataRoute(route, options.cleanPathname, functions, getUrlParts);
 		if (!match) continue;
+		if (!matchMetadataRoute(route, routePathname, functions, getRouteUrlParts)) {
+			skipDecodedOwner();
+			continue;
+		}
 		beginMetadataRouteCacheability(route);
-		const rawParams = route.patternParts ? metadataRouteRawParams(route, match, options.routePathname ?? options.cleanPathname) : Object.create(null);
+		const rawParams = route.patternParts ? metadataRouteRawParams(route, match, routePathname) : Object.create(null);
 		if (route.patternParts) {
 			const runtimeParams = { ...rawParams };
 			decodeMatchedParams(runtimeParams);
@@ -536,7 +572,7 @@ async function handleMetadataRouteRequest(options) {
 			setCurrentFetchSoftTags(buildMetadataRouteTags(route, options.cleanPathname, []));
 			return captureRenderedMetadataRoute(route.isDynamic ? await callDynamicMetadataRoute(route, match, options.makeThenableParams, functions) : serveStaticMetadataRoute(route), route, options.cleanPathname);
 		};
-		const cached = await readMatchedPrerenderedMetadataRouteResponse(options, route, render);
+		const cached = await readMatchedPrerenderedMetadataRouteResponse(cacheOptions, route, render);
 		if (cached.response) return cached.response;
 		if (route.isDynamic && isImageMetadataRoute(route) && functions.dynamicParams === false) {
 			const validationParams = { ...rawParams };
@@ -552,7 +588,7 @@ async function handleMetadataRouteRequest(options) {
 			});
 			if (dynamicParamsResponse) return dynamicParamsResponse;
 		}
-		return renderMetadataRouteMiss(options, route, render, cached.cachedEntry);
+		return renderMetadataRouteMiss(cacheOptions, route, render, cached.cachedEntry);
 	}
 	return null;
 }

package/dist/server/middleware-matcher.d.ts

@@ -5,6 +5,7 @@ export type MatcherConfig = string | Array<string | MiddlewareMatcherObject>;
 export type MiddlewareLocaleMatchContext = {
   kind: "defaulted";
   defaultLocale: string;
+  restoreRootTrailingSlash?: boolean;
 } | {
   kind: "internal" | "literal";
 } | {

package/dist/server/middleware-matcher.js

@@ -60,7 +60,7 @@ function matchMatcherPattern(pathname, pattern, i18nConfig, localeContext) {
 function matchObjectMatcher(pathname, matcher, i18nConfig, localeContext) {
 	if (localeContext?.kind === "next-data") return matchNextDataPattern(pathname, matcher.source, i18nConfig, matcher.locale !== false);
 	if (matcher.locale !== false) return matchMatcherPattern(pathname, matcher.source, i18nConfig, localeContext);
-	return matchRequestPattern(localeContext?.kind === "defaulted" ? `/${localeContext.defaultLocale}${pathname === "/" ? "" : pathname}` : pathname, matcher.source);
+	return matchRequestPattern(localeContext?.kind === "defaulted" ? `/${localeContext.defaultLocale}${pathname !== "/" ? pathname : localeContext.restoreRootTrailingSlash ? "/" : ""}` : pathname, matcher.source);
 }
 const APP_ROUTE_TRANSPORT_SUFFIX = "\\.rsc|\\.segments/.+\\.segment\\.rsc";
 const APP_ROUTE_TRANSPORT_SUFFIX_RE = /(?:\.rsc|\.segments\/.+\.segment\.rsc)$/;

package/dist/server/middleware-runtime.d.ts

@@ -61,6 +61,11 @@ type ExecuteMiddlewareOptions = {
    * second tee whose preserved side would never be consumed.
    */
   requestBodyAlreadyIsolated?: boolean;
+  /**
+   * `shouldRestoreLocaleRootTrailingSlash` for the raw request pathname. Next.js
+   * then tests the as-requested root as `/en/` after default-locale insertion.
+   */
+  restoreLocaleRootTrailingSlash?: boolean;
   request: Request;
   /**
    * The user's `trailingSlash` config. Plumbed into the NextRequest's NextURL

package/dist/server/middleware-runtime.js

@@ -69,9 +69,26 @@ function middlewareMatcher(mod) {
 	if (!isMiddlewareConfigExport(config)) return void 0;
 	return config.matcher;
 }
+const MIDDLEWARE_MESSAGE_HEADER_NAMES = [
+	"accept-encoding",
+	"connection",
+	"content-encoding",
+	"content-length",
+	"expect",
+	"keep-alive",
+	"keepalive",
+	"transfer-encoding"
+];
+function deleteMiddlewareMessageHeaders(headers) {
+	for (const name of MIDDLEWARE_MESSAGE_HEADER_NAMES) headers.delete(name);
+}
+function processMiddlewareResponseHeaders(headers) {
+	processMiddlewareHeaders(headers);
+	deleteMiddlewareMessageHeaders(headers);
+}
 function stripMiddlewareHeadersFromResponse(response) {
 	const headers = new Headers(response.headers);
-	processMiddlewareHeaders(headers);
+	processMiddlewareResponseHeaders(headers);
 	return new Response(response.body, {
 		status: response.status,
 		statusText: response.statusText,
@@ -108,7 +125,7 @@ function relativizeLocation(location, requestUrl) {
 */
 function dataRedirectResponse(target, originalResponse) {
 	const headers = new Headers(originalResponse.headers);
-	processMiddlewareHeaders(headers);
+	processMiddlewareResponseHeaders(headers);
 	headers.delete("Location");
 	headers.set("x-nextjs-redirect", target);
 	return new Response(null, {
@@ -120,6 +137,7 @@ function collectMiddlewareHeaders(response) {
 	const responseHeaders = new Headers();
 	for (const [key, value] of response.headers) if (!key.startsWith("x-middleware-") || shouldKeepMiddlewareHeader(key)) responseHeaders.append(key, value);
 	dropEmptyMiddlewareSetCookie(responseHeaders);
+	deleteMiddlewareMessageHeaders(responseHeaders);
 	return responseHeaders;
 }
 function drainFetchEvent(fetchEvent) {
@@ -209,12 +227,19 @@ async function executeMiddlewareModule(options) {
 	};
 	const isStaleDataRequest = options.isDataRequest === true && options.isStaleDataRequest === true;
 	const toPageMatcherPathname = (candidate) => candidate !== null && options.isDataRequest && !isStaleDataRequest ? nextDataMiddlewareMatchPathname(candidate) ?? candidate : candidate;
-	const encodedMatchPathname = toPageMatcherPathname(prepareMatcherPathname(encodedRequestPathname));
-	let decodedMatchPathname = encodedMatchPathname;
-	try {
-		if (encodedMatchPathname !== null) decodedMatchPathname = decodeURIComponent(encodedMatchPathname);
-		else if (!options.i18nConfig) decodedMatchPathname = toPageMatcherPathname(prepareMatcherPathname(decodeURIComponent(encodedRequestPathname)));
-	} catch {}
+	const toMatchPathnames = (candidate) => {
+		const encoded = toPageMatcherPathname(prepareMatcherPathname(candidate));
+		let decoded = encoded;
+		try {
+			if (encoded !== null) decoded = decodeURIComponent(encoded);
+			else if (!options.i18nConfig) decoded = toPageMatcherPathname(prepareMatcherPathname(decodeURIComponent(candidate)));
+		} catch {}
+		return {
+			decoded,
+			encoded
+		};
+	};
+	const { decoded: decodedMatchPathname, encoded: encodedMatchPathname } = toMatchPathnames(encodedRequestPathname);
 	let localeContext;
 	if (isStaleDataRequest) localeContext = { kind: "next-data" };
 	else if (options.i18nConfig && encodedMatchPathname !== null) {
@@ -226,12 +251,20 @@ async function executeMiddlewareModule(options) {
 			kind: "defaulted"
 		};
 	}
-	const encodedPathMatches = encodedMatchPathname !== null && matchesMiddlewarePathname(encodedMatchPathname, matcher, options.i18nConfig, localeContext);
-	const decodedPathMatches = !encodedPathMatches && decodedMatchPathname !== null && decodedMatchPathname !== encodedMatchPathname && matchesMiddlewarePathname(decodedMatchPathname, matcher, options.i18nConfig, localeContext);
-	if (encodedPathMatches || decodedPathMatches) options.onPathMatch?.();
-	const encodedMatches = encodedMatchPathname !== null && matchesMiddleware(encodedMatchPathname, matcher, options.request, options.i18nConfig, localeContext);
-	const decodedMatches = !encodedMatches && decodedMatchPathname !== null && decodedMatchPathname !== encodedMatchPathname && matchesMiddleware(decodedMatchPathname, matcher, options.request, options.i18nConfig, localeContext);
-	if (!encodedMatches && !decodedMatches) return { continue: true };
+	const slashedRequestPathname = normalizePath(requestPathname);
+	const requestedMatchPathnames = slashedRequestPathname !== encodedRequestPathname ? toMatchPathnames(slashedRequestPathname) : {
+		decoded: decodedMatchPathname,
+		encoded: encodedMatchPathname
+	};
+	const candidatePathnames = [];
+	if (requestedMatchPathnames.encoded !== null) candidatePathnames.push(requestedMatchPathnames.encoded);
+	if (requestedMatchPathnames.decoded !== null && requestedMatchPathnames.decoded !== requestedMatchPathnames.encoded) candidatePathnames.push(requestedMatchPathnames.decoded);
+	const requestedLocaleContext = options.restoreLocaleRootTrailingSlash && localeContext?.kind === "defaulted" ? {
+		...localeContext,
+		restoreRootTrailingSlash: true
+	} : localeContext;
+	if (candidatePathnames.some((candidate) => matchesMiddlewarePathname(candidate, matcher, options.i18nConfig, requestedLocaleContext))) options.onPathMatch?.();
+	if (!candidatePathnames.some((candidate) => matchesMiddleware(candidate, matcher, options.request, options.i18nConfig, requestedLocaleContext))) return { continue: true };
 	options.onMatch?.();
 	const middlewareUrl = withOrigin(requestUrl, getRequestExecutionContext()?.middlewareOrigin ?? requestUrl.origin);
 	const nextRequest = createNextRequest(options.request, middlewareUrl, options.i18nConfig, options.basePath, options.trailingSlash, hadBasePath, options.requestBodyAlreadyIsolated, options.skipTrailingSlashRedirect);
@@ -305,7 +338,7 @@ async function executeMiddlewareModule(options) {
 			}
 			const responseHeaders = new Headers(response.headers);
 			responseHeaders.delete("location");
-			processMiddlewareHeaders(responseHeaders);
+			processMiddlewareResponseHeaders(responseHeaders);
 			const relativizedResponseHeaders = new Headers(response.headers);
 			relativizedResponseHeaders.set("Location", normalizedLocation);
 			const relativizedResponse = new Response(response.body, {

package/dist/server/middleware.d.ts

@@ -44,6 +44,6 @@ export declare function findMiddlewareFile(root: string, fileMatcher: ValidFileM
  * @param request - The incoming Request object
  * @returns Middleware result describing what action to take
  */
-export declare function runMiddleware(runner: ModuleRunner, middlewarePath: string, request: Request, i18nConfig?: NextI18nConfig | null, basePath?: string, trailingSlash?: boolean, isDataRequest?: boolean, normalizedPathname?: string, isStaleDataRequest?: boolean, skipTrailingSlashRedirect?: boolean): Promise<MiddlewareResult>;
+export declare function runMiddleware(runner: ModuleRunner, middlewarePath: string, request: Request, i18nConfig?: NextI18nConfig | null, basePath?: string, trailingSlash?: boolean, isDataRequest?: boolean, normalizedPathname?: string, isStaleDataRequest?: boolean, skipTrailingSlashRedirect?: boolean, restoreLocaleRootTrailingSlash?: boolean): Promise<MiddlewareResult>;
 //#endregion
 export { matchPattern, matchesMiddleware };

package/dist/server/middleware.js

@@ -77,7 +77,7 @@ function isMiddlewareModule(value) {
 * @param request - The incoming Request object
 * @returns Middleware result describing what action to take
 */
-async function runMiddleware(runner, middlewarePath, request, i18nConfig, basePath, trailingSlash, isDataRequest, normalizedPathname, isStaleDataRequest, skipTrailingSlashRedirect) {
+async function runMiddleware(runner, middlewarePath, request, i18nConfig, basePath, trailingSlash, isDataRequest, normalizedPathname, isStaleDataRequest, skipTrailingSlashRedirect, restoreLocaleRootTrailingSlash) {
 	const mod = await runner.import(middlewarePath);
 	if (!isMiddlewareModule(mod)) throw new Error(`Middleware module "${middlewarePath}" did not evaluate to an object.`);
 	return runGeneratedMiddleware({
@@ -92,6 +92,7 @@ async function runMiddleware(runner, middlewarePath, request, i18nConfig, basePa
 		module: mod,
 		normalizedPathname,
 		request,
+		restoreLocaleRootTrailingSlash,
 		skipTrailingSlashRedirect,
 		trailingSlash
 	});

package/dist/server/nitro-public-files-plugin.js

@@ -53,17 +53,26 @@ function toH3Pathname(pathname) {
 	}
 }
 /**
+* The key Nitro's static handler looks a pathname up under, following
+* `runtime/internal/static.mjs`: without one trailing slash and decoded
+* except for `%2F`.
+*/
+function toAssetId(pathname) {
+	const id = pathname.length > 1 && pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
+	try {
+		return decodeURIComponent(id.replace(/%2f/gi, "%252F"));
+	} catch {
+		return id;
+	}
+}
+/**
 * Whether Nitro's static handler would answer a request for a pathname with
-* a public file, following its lookup in `runtime/internal/static.mjs`. It
-* looks h3's pathname up without one trailing slash and decoded except for
-* `%2F`, and then as a directory with an `index.html`, each first with the
-* extension of a compressed copy for every encoding the request accepts.
+* a public file. It looks h3's pathname up under its key, and then as a
+* directory with an `index.html`, each first with the extension of a
+* compressed copy for every encoding the request accepts.
 */
 function isPublicFilePathname(pathname, extensions, publicAssets) {
-	let id = pathname.length > 1 && pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
-	try {
-		id = decodeURIComponent(id.replace(/%2f/gi, "%252F"));
-	} catch {}
+	const id = toAssetId(pathname);
 	const index = id.endsWith("/") ? `${id}index.html` : `${id}/index.html`;
 	return extensions.some((extension) => publicAssets.has(id + extension) || publicAssets.has(index + extension));
 }
@@ -86,6 +95,9 @@ function createNitroPublicFilesPlugin(options) {
 		const token = crypto.randomUUID();
 		Reflect.set(globalThis, Symbol.for(NITRO_ASSETS_KEY), {
 			async fetch(request) {
+				const { pathname } = new URL(request.url);
+				const h3Pathname = toH3Pathname(pathname);
+				if (h3Pathname === void 0 || toAssetId(h3Pathname) !== toAssetId(pathname)) return new Response(null, { status: 404 });
 				const headers = new Headers(request.headers);
 				headers.set(ASSET_REQUEST_HEADER, token);
 				return appFetch(new Request(request, { headers }));

package/dist/server/nitro-request-target-plugin.d.ts

@@ -0,0 +1,17 @@
+//#region src/server/nitro-request-target-plugin.d.ts
+/**
+ * Nitro runtime plugin that records each request's raw target before h3 sees
+ * it. srvx 0.11 writes the pathname h3 decodes (one with a `%`) back into the
+ * Node request's `url`, dropping the authority of an absolute-form target,
+ * so vinext's request-based entries read the target this plugin saved.
+ *
+ * This module runs in Nitro's server bundle, separate from vinext's request
+ * handlers, so it imports nothing and shares state through `Symbol.for`.
+ */
+export declare const NITRO_REQUEST_TARGET_KEY = "vinext.nitro.requestTarget";
+type NitroApp = {
+  fetch: (request: Request) => Response | Promise<Response>;
+};
+export default function nitroRequestTargetPlugin(nitroApp: NitroApp): void;
+//#endregion
+export {};

package/dist/server/nitro-request-target-plugin.js

@@ -0,0 +1,22 @@
+//#region src/server/nitro-request-target-plugin.ts
+/**
+* Nitro runtime plugin that records each request's raw target before h3 sees
+* it. srvx 0.11 writes the pathname h3 decodes (one with a `%`) back into the
+* Node request's `url`, dropping the authority of an absolute-form target,
+* so vinext's request-based entries read the target this plugin saved.
+*
+* This module runs in Nitro's server bundle, separate from vinext's request
+* handlers, so it imports nothing and shares state through `Symbol.for`.
+*/
+const NITRO_REQUEST_TARGET_KEY = "vinext.nitro.requestTarget";
+function nitroRequestTargetPlugin(nitroApp) {
+	const appFetch = nitroApp.fetch;
+	const key = Symbol.for(NITRO_REQUEST_TARGET_KEY);
+	nitroApp.fetch = (request) => {
+		const req = request.runtime?.node?.req;
+		if (req && !Reflect.has(req, key)) Reflect.set(req, key, req.url);
+		return appFetch(request);
+	};
+}
+//#endregion
+export { NITRO_REQUEST_TARGET_KEY, nitroRequestTargetPlugin as default };

package/dist/server/open-redirect.d.ts

@@ -43,7 +43,8 @@ export type RepeatedSlashRedirect = {
  * `//` after the scheme trips the same check) and 500s `OPTIONS *`. Routing
  * them would let the request line choose the origin of `request.url` that
  * middleware and handlers see, bypassing the Host trust policy. Request-based
- * entries always pass a pathname.
+ * entries pass a pathname. Where srvx builds `request.url` from the raw target
+ * (Nitro's Node server), `isSrvxAbsoluteFormTarget` 404s these instead.
  *
  * @param rawUrl - The raw request target: pathname plus optional `?query`
  */

package/dist/server/open-redirect.js

@@ -44,7 +44,8 @@ const REDIRECT_LOCATION_BASE = "http://vinext.invalid";
 * `//` after the scheme trips the same check) and 500s `OPTIONS *`. Routing
 * them would let the request line choose the origin of `request.url` that
 * middleware and handlers see, bypassing the Host trust policy. Request-based
-* entries always pass a pathname.
+* entries pass a pathname. Where srvx builds `request.url` from the raw target
+* (Nitro's Node server), `isSrvxAbsoluteFormTarget` 404s these instead.
 *
 * @param rawUrl - The raw request target: pathname plus optional `?query`
 */

package/dist/server/pages-client-assets.d.ts

@@ -4,6 +4,7 @@ export type AssetCrossOrigin = "" | "anonymous" | "use-credentials";
 export type PagesClientAssets = {
   clientEntry?: string;
   appBootstrapPreinitModules?: string[];
+  appBootstrapPreloadModules?: string[];
   appRouteManifestModule?: string;
   /** What each App Router client reference loads in the browser, by URL. */
   appClientReferenceChunks?: ClientReferenceChunks;

package/dist/server/pages-data-route.d.ts

@@ -59,8 +59,12 @@ export declare function encodeUrlParserIgnoredCharacters(pathname: string): stri
  * `/_next/data/<buildId>/en.json`            → `/en`
  * `/_next/data/<wrong-id>/about.json`        → null
  * `/_next/data/<buildId>/about`              → null  (missing .json suffix)
+ * `/_next/data/<buildId>/blog/...json`       → null  (strips to a dot segment)
+ *
+ * `decoded` marks a percent-decoded copy of a pathname whose raw form already
+ * parsed: a `%2e` left in it was `%252e` on the wire, an ordinary character.
  */
-export declare function parseNextDataPathname(pathname: string, buildId: string): NextDataMatch | null;
+export declare function parseNextDataPathname(pathname: string, buildId: string, decoded?: boolean): NextDataMatch | null;
 /**
  * The page pathname a `_next/data` URL addresses, whatever its buildId. Next.js
  * compiles every middleware matcher with an optional `/_next/data/<buildId>`

package/dist/server/pages-data-route.js

@@ -1,7 +1,7 @@
 import { MIDDLEWARE_SKIP_HEADER } from "../utils/protocol-headers.js";
-import { addBasePathToPathname, hasBasePath, stripBasePath } from "../utils/base-path.js";
+import { hasBasePath, restoreBasePath, stripBasePath } from "../utils/base-path.js";
 import { NEXTJS_DEPLOYMENT_ID_HEADER } from "./headers.js";
-import { cloneRequestWithUrl } from "./request-pipeline.js";
+import { cloneRequestWithUrl, hasUrlParserDotSegment } from "./request-pipeline.js";
 //#region src/server/pages-data-route.ts
 /**
 * Helpers for the Pages Router `/_next/data/{buildId}/{...page}.json` endpoint.
@@ -62,13 +62,19 @@ function encodeUrlParserIgnoredCharacters(pathname) {
 * `/_next/data/<buildId>/en.json`            → `/en`
 * `/_next/data/<wrong-id>/about.json`        → null
 * `/_next/data/<buildId>/about`              → null  (missing .json suffix)
+* `/_next/data/<buildId>/blog/...json`       → null  (strips to a dot segment)
+*
+* `decoded` marks a percent-decoded copy of a pathname whose raw form already
+* parsed: a `%2e` left in it was `%252e` on the wire, an ordinary character.
 */
-function parseNextDataPathname(pathname, buildId) {
+function parseNextDataPathname(pathname, buildId, decoded = false) {
 	if (!buildId) return null;
 	if (!isNextDataPathname(pathname)) return null;
 	const expectedPrefix = `${NEXT_DATA_PREFIX}${buildId}/`;
 	if (!pathname.startsWith(expectedPrefix)) return null;
-	return pageFromNextDataRest(pathname.slice(expectedPrefix.length, -5));
+	const rest = pathname.slice(expectedPrefix.length, -5);
+	if (!decoded && hasUrlParserDotSegment(rest)) return null;
+	return pageFromNextDataRest(rest);
 }
 /**
 * The page pathname a `_next/data` URL addresses, whatever its buildId. Next.js
@@ -83,7 +89,9 @@ function nextDataMiddlewareMatchPathname(pathname) {
 	if (!isNextDataPathname(pathname)) return null;
 	const buildIdEnd = pathname.indexOf("/", 12);
 	if (buildIdEnd <= 12) return null;
-	return pageFromNextDataRest(pathname.slice(buildIdEnd + 1, -5))?.pagePathname ?? null;
+	const rest = pathname.slice(buildIdEnd + 1, -5);
+	if (hasUrlParserDotSegment(rest)) return null;
+	return pageFromNextDataRest(rest)?.pagePathname ?? null;
 }
 function pageFromNextDataRest(rest) {
 	if (rest.length === 0) return null;
@@ -189,7 +197,7 @@ function normalizePagesDataRequest(request, buildId, basePath = "", trailingSlas
 	};
 	const pagePathname = normalizeNextDataPagePathname(dataMatch.pagePathname, trailingSlash);
 	const normalizedUrl = new URL(reqUrl);
-	normalizedUrl.pathname = hadBasePath ? addBasePathToPathname(pagePathname, basePath) : pagePathname;
+	normalizedUrl.pathname = hadBasePath ? restoreBasePath(pagePathname, basePath) : pagePathname;
 	return {
 		isDataReq: true,
 		request: cloneRequestWithUrl(request, normalizedUrl.href),

package/dist/server/pages-i18n.d.ts

@@ -24,6 +24,13 @@ type PagesI18nRequestInfo = {
   domainLocale?: DomainLocale;
   redirectUrl?: string;
 };
+/**
+ * Mark a locale-detection redirect. Next.js answers it before next.config
+ * headers are staged, so it goes out without them. The global symbol crosses
+ * the App Router / Pages Router module graph boundary.
+ */
+export declare function markLocaleRedirect(response: Response): Response;
+export declare function isLocaleRedirect(response: Response): boolean;
 /**
  * Return the configured locale that the first pathname segment names, compared
  * case-insensitively (`/EN/about` -> `"en"`), or `undefined` when there is none.