vinext 1.4.1 → 1.4.3

package/dist/server/request-pipeline.js

@@ -30,6 +30,16 @@ function canonicalizeRequestUrlPathname(url) {
 	return canonicalizeRequestPathname(pathname) + search;
 }
 /**
+* Whether the pathname has a segment the URL parser resolves as `.` or `..`,
+* literally or percent-encoded. Such a pathname changes when it becomes a URL.
+*/
+function hasUrlParserDotSegment(pathname) {
+	return pathname.split("/").some((segment) => {
+		const decodedDots = segment.replaceAll(/%2e/gi, ".");
+		return decodedDots === "." || decodedDots === "..";
+	});
+}
+/**
 * Shared request pipeline utilities.
 *
 * Extracted from generated entries and server hot paths to keep codegen focused
@@ -472,4 +482,4 @@ function stripRequestUrlFragment(request) {
 	return attachRequestCfMetadata(new Request(stripped, { signal }), request);
 }
 //#endregion
-export { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, attachRequestCfMetadata, canonicalizeRequestPathname, canonicalizeRequestUrlPathname, cloneRequestWithHeaders, cloneRequestWithUrl, createStaticFileSignal, dropEmptyMiddlewareSetCookie, filterInternalHeaders, getRepeatedSlashRedirect, guardProtocolRelativeUrl, hasBasePath, haveSameHeaders, isOpenRedirectShaped, isOriginAllowed, normalizeTrailingSlash, normalizeTrailingSlashPathname, processMiddlewareHeaders, resolvePublicFileRoute, sendRepeatedSlashRedirect, stripBasePath, stripRequestUrlFragment, validateCsrfOrigin, validateServerActionPayload, withRequestHeaders };
+export { INTERNAL_HEADERS, VINEXT_INTERNAL_HEADERS, attachRequestCfMetadata, canonicalizeRequestPathname, canonicalizeRequestUrlPathname, cloneRequestWithHeaders, cloneRequestWithUrl, createStaticFileSignal, dropEmptyMiddlewareSetCookie, filterInternalHeaders, getRepeatedSlashRedirect, guardProtocolRelativeUrl, hasBasePath, hasUrlParserDotSegment, haveSameHeaders, isOpenRedirectShaped, isOriginAllowed, normalizeTrailingSlash, normalizeTrailingSlashPathname, processMiddlewareHeaders, resolvePublicFileRoute, sendRepeatedSlashRedirect, stripBasePath, stripRequestUrlFragment, validateCsrfOrigin, validateServerActionPayload, withRequestHeaders };

package/dist/server/response-stage-cacheability.d.ts

@@ -23,6 +23,13 @@ export type ResponseStageCacheabilityOptions = {
    * shared response drops them before admission and storage.
    */
   recomposesRequestScopedHeaders?: boolean;
+  /**
+   * Keeps `X-Vinext-Params` when the request scoped headers are dropped. An
+   * intercepted response's params include its target's, which the request
+   * stage doesn't match. Its identity holds the interception context, so the
+   * stored params are its own.
+   */
+  keepsParamsHeader?: boolean;
   /** Generated adapter registration, deferred until the response stage executes. */
   registerCacheAdapters(): void;
   request: Request;

package/dist/server/response-stage-cacheability.js

@@ -24,13 +24,13 @@ async function withResponseStageCacheability(options, render) {
 	const stripsRequestScopedHeaders = options.recomposesRequestScopedHeaders === true && options.cache === "shared" && !options.probeMode;
 	if (!cacheability) {
 		const rendered = await render(context);
-		return stripsRequestScopedHeaders ? withoutRequestScopedHeaders(rendered) : rendered;
+		return stripsRequestScopedHeaders ? withoutRequestScopedHeaders(rendered, options.keepsParamsHeader === true) : rendered;
 	}
 	if (options.policyHeadersAppliedBeforeRender) cacheability.recordResponseStageCachePolicy(context, options.policyHeaders);
 	const state = Reflect.get(context, CACHEABILITY_REQUEST_STATE);
 	if (options.probeMode && options.forceDynamic && !options.policyHeaders?.length && state) state.patternDynamicReason = "dynamic = \"force-dynamic\"";
 	const renderedResponse = await render(context);
-	const rendered = stripsRequestScopedHeaders ? withoutRequestScopedHeaders(renderedResponse) : renderedResponse;
+	const rendered = stripsRequestScopedHeaders ? withoutRequestScopedHeaders(renderedResponse, options.keepsParamsHeader === true) : renderedResponse;
 	const response = options.policyHeadersAppliedBeforeRender ? rendered : cacheability.applyResponseStageCachePolicy(rendered, context, options.policyHeaders);
 	const complete = (candidate) => cacheability.finalizeWorkerCacheabilityResponse(candidate, context);
 	const route = state?.route;
@@ -40,10 +40,11 @@ async function withResponseStageCacheability(options, render) {
 	}
 	return complete(response);
 }
-function withoutRequestScopedHeaders(response) {
-	if (!response.headers.has("X-Vinext-Params") && !response.headers.has("X-Vinext-Rendered-Path-And-Search")) return response;
+function withoutRequestScopedHeaders(response, keepsParams) {
+	const dropsParams = !keepsParams && response.headers.has("X-Vinext-Params");
+	if (!dropsParams && !response.headers.has("X-Vinext-Rendered-Path-And-Search")) return response;
 	const headers = new Headers(response.headers);
-	headers.delete(VINEXT_PARAMS_HEADER);
+	if (dropsParams) headers.delete(VINEXT_PARAMS_HEADER);
 	headers.delete(VINEXT_RENDERED_PATH_AND_SEARCH_HEADER);
 	return preserveFullyBufferedBodyMetadata(response, new Response(response.body, {
 		headers,

package/dist/server/srvx-middleware-origin.d.ts

@@ -0,0 +1,13 @@
+//#region src/server/srvx-middleware-origin.d.ts
+/**
+ * The server-owned origin middleware runs against when srvx serves the
+ * request on Node. srvx builds `request.url` from the client's Host and
+ * `X-Forwarded-Proto` headers, which must not decide whether a rewrite to
+ * another host is external, so like the Node production server (and Next.js,
+ * which uses its hostname and port) this uses the socket's TLS state and
+ * local port, or a trusted `X-Forwarded-Proto` and `X-Forwarded-Host`.
+ * Undefined on other hosts, and on Vercel, which routes by hostname like
+ * Workers; they keep the request URL's origin.
+ */
+export declare function resolveSrvxMiddlewareOrigin(request: Request): string | undefined;
+//#endregion

package/dist/server/srvx-middleware-origin.js

@@ -0,0 +1,19 @@
+import { resolveRequestProtocol, resolveTrustedForwardedHost } from "./proxy-trust.js";
+//#region src/server/srvx-middleware-origin.ts
+/**
+* The server-owned origin middleware runs against when srvx serves the
+* request on Node. srvx builds `request.url` from the client's Host and
+* `X-Forwarded-Proto` headers, which must not decide whether a rewrite to
+* another host is external, so like the Node production server (and Next.js,
+* which uses its hostname and port) this uses the socket's TLS state and
+* local port, or a trusted `X-Forwarded-Proto` and `X-Forwarded-Host`.
+* Undefined on other hosts, and on Vercel, which routes by hostname like
+* Workers; they keep the request URL's origin.
+*/
+function resolveSrvxMiddlewareOrigin(request) {
+	const socket = request.runtime?.node?.req?.socket;
+	if (!socket || process.env.VERCEL) return void 0;
+	return `${socket.encrypted === true || resolveRequestProtocol(request.headers) === "https" ? "https:" : "http:"}//${resolveTrustedForwardedHost(request.headers) ?? (socket.localPort === void 0 ? "localhost" : `localhost:${socket.localPort}`)}`;
+}
+//#endregion
+export { resolveSrvxMiddlewareOrigin };

package/dist/server/srvx-request-target.d.ts

@@ -0,0 +1,12 @@
+//#region src/server/srvx-request-target.d.ts
+/**
+ * Whether srvx, serving the request on Node, got a request target that is not
+ * origin-form (`GET https://other.example/x`). srvx then takes the origin of
+ * `request.url` from the target, as RFC 9112 §3.2.2 asks of an origin server.
+ * `vinext start` 404s every such target (see `getRepeatedSlashRedirect`) and
+ * Next.js never routes one, so the request-based entries Nitro calls refuse
+ * them too. The raw target is the one `nitroRequestTargetPlugin` saved before
+ * h3 could rewrite `req.url`.
+ */
+export declare function isSrvxAbsoluteFormTarget(request: Request): boolean;
+//#endregion

package/dist/server/srvx-request-target.js

@@ -0,0 +1,20 @@
+import { NITRO_REQUEST_TARGET_KEY } from "./nitro-request-target-plugin.js";
+//#region src/server/srvx-request-target.ts
+/**
+* Whether srvx, serving the request on Node, got a request target that is not
+* origin-form (`GET https://other.example/x`). srvx then takes the origin of
+* `request.url` from the target, as RFC 9112 §3.2.2 asks of an origin server.
+* `vinext start` 404s every such target (see `getRepeatedSlashRedirect`) and
+* Next.js never routes one, so the request-based entries Nitro calls refuse
+* them too. The raw target is the one `nitroRequestTargetPlugin` saved before
+* h3 could rewrite `req.url`.
+*/
+function isSrvxAbsoluteFormTarget(request) {
+	const req = request.runtime?.node?.req;
+	if (!req) return false;
+	const saved = Reflect.get(req, Symbol.for(NITRO_REQUEST_TARGET_KEY));
+	const target = typeof saved === "string" ? saved : req.url;
+	return !!target && !target.startsWith("/");
+}
+//#endregion
+export { isSrvxAbsoluteFormTarget };

package/dist/server/static-file-cache.js

@@ -29,9 +29,11 @@ const CONTENT_TYPES = {
 	".css": "text/css; charset=utf-8",
 	".html": "text/html; charset=utf-8",
 	".ico": "image/x-icon",
+	".icns": "image/x-icns",
 	".jpeg": "image/jpeg",
 	".jpg": "image/jpeg",
 	".json": "application/json; charset=utf-8",
+	".jxl": "image/jxl",
 	".map": "application/json; charset=utf-8",
 	".mp3": "audio/mpeg",
 	".mp4": "video/mp4",
@@ -148,30 +150,16 @@ var StaticFileCache = class StaticFileCache {
 			}
 			const pathname = "/" + relativePath;
 			entries.set(pathname, entry);
-			if (ext === ".html") {
-				if (relativePath.endsWith("/index.html")) {
-					const dirPath = "/" + relativePath.slice(0, -11);
-					if (dirPath !== "/") entries.set(dirPath, entry);
-				} else {
-					const withoutExt = "/" + relativePath.slice(0, -ext.length);
-					entries.set(withoutExt, entry);
-				}
-			}
 		}
 		const toBuffer = [];
-		const seenEntries = /* @__PURE__ */ new Set();
-		for (const entry of entries.values()) {
-			if (seenEntries.has(entry)) continue;
-			seenEntries.add(entry);
-			for (const variant of [
-				entry.original,
-				entry.br,
-				entry.gz,
-				entry.zst
-			]) {
-				if (!variant || variant.size > BUFFER_THRESHOLD) continue;
-				toBuffer.push(variant);
-			}
+		for (const entry of entries.values()) for (const variant of [
+			entry.original,
+			entry.br,
+			entry.gz,
+			entry.zst
+		]) {
+			if (!variant || variant.size > BUFFER_THRESHOLD) continue;
+			toBuffer.push(variant);
 		}
 		for (let i = 0; i < toBuffer.length; i += 64) await Promise.all(toBuffer.slice(i, i + 64).map(async (v) => {
 			v.buffer = await fsp.readFile(v.path);

package/dist/server/worker-image-optimization.d.ts

@@ -19,16 +19,23 @@ export type WorkerImageSourceOptions = {
  * served only when the application pipeline selects a public file for it.
  */
 export declare function fetchWorkerImageSource(imageUrl: string, request: Request, options: WorkerImageSourceOptions): Promise<Response>;
+/**
+ * Give a public-file source the Cache-Control middleware or `headers()` staged
+ * for it, which a direct request receives in place of the asset default and
+ * Next.js' internal source fetch reads.
+ */
+export declare function withStagedCacheControl(asset: Response, cacheControl: string | null): Response;
 /**
  * Return the public file a framework static-file signal selects, provided the
  * pipeline answered with a body-bearing 2xx outcome. The file is fetched with middleware's
- * request header overrides, as resolveStaticAssetSignal fetches it.
+ * request header overrides, as resolveStaticAssetSignal fetches it, and keeps
+ * the Cache-Control the pipeline staged.
  */
 export declare function fetchSignalledPublicFile(response: Response, sourceRequest: Request, assets: VinextAssetFetcher): Promise<Response> | null;
 /**
  * Serve the App Router image endpoint once the request handler admitted it
- * through middleware and rewrites. Middleware's response headers are sent with
- * the image, as Next.js does.
+ * through middleware and rewrites. Config and middleware response headers are
+ * sent with the image, as Next.js does.
  */
 export declare function serveWorkerImageOptimization(request: Request, signal: ImageOptimizationSignal, allowedWidths: number[] | undefined, imageConfig: ImageConfig | undefined, options: WorkerImageSourceOptions): Promise<Response>;
 //#endregion

package/dist/server/worker-image-optimization.js

@@ -2,7 +2,7 @@ import { VINEXT_PRERENDER_SPECIAL_ERROR_HEADER } from "./headers.js";
 import { readStaticFileSignal, readStaticFileSignalRequestHeaders } from "./static-file-signal.js";
 import { attachRequestCfMetadata, cloneRequestWithUrl } from "./request-pipeline.js";
 import { isNextStaticPath } from "../utils/asset-prefix.js";
-import { handleConfiguredImageOptimization, invalidImageSourceResponse, isImageSourceBodyStatus } from "./image-optimization.js";
+import { handleConfiguredImageOptimization, invalidImageSourceResponse, isImageSourceBodyStatus, markImageBuildAsset } from "./image-optimization.js";
 import { createStaticAssetRequest, mergeHeaders } from "./worker-utils.js";
 import { resolveClientBuildFile } from "./client-build-files.js";
 //#region src/server/worker-image-optimization.ts
@@ -53,33 +53,52 @@ async function fetchWorkerImageSource(imageUrl, request, options) {
 	} catch {
 		return invalidImageSourceResponse();
 	}
-	const buildAssetPath = resolveNextStaticFile(decodedPathname, options) ?? resolveClientBuildFile(sourceUrl.pathname, options.basePath, options.clientBuildFiles);
-	if (buildAssetPath !== null) return options.assets.fetch(new Request(new URL(buildAssetPath, request.url)));
+	const nextStaticFile = resolveNextStaticFile(decodedPathname, options);
+	if (nextStaticFile !== null) return markImageBuildAsset(await options.assets.fetch(new Request(new URL(nextStaticFile, request.url))));
+	const clientBuildFile = resolveClientBuildFile(sourceUrl.pathname, options.basePath, options.clientBuildFiles);
+	if (clientBuildFile !== null) return options.assets.fetch(new Request(new URL(clientBuildFile, request.url)));
 	const sourceResponse = await options.fetchPublicFile(attachRequestCfMetadata(new Request(sourceUrl, { signal: request.signal }), request));
 	if (sourceResponse && isImageSourceBodyStatus(sourceResponse.status)) return sourceResponse;
 	if (sourceResponse) cancelResponseBody(sourceResponse);
 	return invalidImageSourceResponse();
 }
 /**
+* Give a public-file source the Cache-Control middleware or `headers()` staged
+* for it, which a direct request receives in place of the asset default and
+* Next.js' internal source fetch reads.
+*/
+function withStagedCacheControl(asset, cacheControl) {
+	if (cacheControl === null) return asset;
+	const headers = new Headers(asset.headers);
+	headers.set("Cache-Control", cacheControl);
+	return new Response(asset.body, {
+		status: asset.status,
+		statusText: asset.statusText,
+		headers
+	});
+}
+/**
 * Return the public file a framework static-file signal selects, provided the
 * pipeline answered with a body-bearing 2xx outcome. The file is fetched with middleware's
-* request header overrides, as resolveStaticAssetSignal fetches it.
+* request header overrides, as resolveStaticAssetSignal fetches it, and keeps
+* the Cache-Control the pipeline staged.
 */
 function fetchSignalledPublicFile(response, sourceRequest, assets) {
 	const signal = isImageSourceBodyStatus(response.status) ? readStaticFileSignal(response) : null;
 	const requestHeaders = readStaticFileSignalRequestHeaders(response);
+	const stagedCacheControl = response.headers.get("Cache-Control");
 	cancelResponseBody(response);
 	if (signal === null) return null;
 	let assetPath = signal;
 	try {
 		assetPath = decodeURIComponent(signal);
 	} catch {}
-	return Promise.resolve(assets.fetch(createStaticAssetRequest(assetPath, sourceRequest, requestHeaders)));
+	return Promise.resolve(assets.fetch(createStaticAssetRequest(assetPath, sourceRequest, requestHeaders))).then((asset) => withStagedCacheControl(asset, stagedCacheControl));
 }
 /**
 * Serve the App Router image endpoint once the request handler admitted it
-* through middleware and rewrites. Middleware's response headers are sent with
-* the image, as Next.js does.
+* through middleware and rewrites. Config and middleware response headers are
+* sent with the image, as Next.js does.
 */
 async function serveWorkerImageOptimization(request, signal, allowedWidths, imageConfig, options) {
 	const imageUrl = new URL(request.url);
@@ -93,7 +112,22 @@ async function serveWorkerImageOptimization(request, signal, allowedWidths, imag
 	});
 	const cookies = signal.middlewareHeaders.getSetCookie();
 	if (cookies.length > 0) middlewareHeaders["set-cookie"] = cookies;
-	return mergeHeaders(response, middlewareHeaders);
+	const merged = mergeHeaders(response, middlewareHeaders);
+	if (response.status < 400) return merged;
+	const errorHeaders = new Headers(merged.headers);
+	let replaced = false;
+	for (const name of ["content-type", "content-encoding"]) {
+		const value = signal.middlewareHeaders.get(name);
+		if (value === null) continue;
+		errorHeaders.set(name, value);
+		replaced = true;
+	}
+	if (!replaced) return merged;
+	return new Response(merged.body, {
+		headers: errorHeaders,
+		status: merged.status,
+		statusText: merged.statusText
+	});
 }
 //#endregion
-export { fetchSignalledPublicFile, fetchWorkerImageSource, serveWorkerImageOptimization };
+export { fetchSignalledPublicFile, fetchWorkerImageSource, serveWorkerImageOptimization, withStagedCacheControl };

package/dist/server/worker-revalidation-context.js

@@ -12,6 +12,7 @@ function deriveExecutionContext(base, dispatchPagesRevalidate, isInternalPagesRe
 		...base?.cache === void 0 ? {} : { cache: base.cache },
 		...base?.assets === void 0 ? {} : { assets: base.assets },
 		...base?.trustedRevalidateOrigin === void 0 ? {} : { trustedRevalidateOrigin: base.trustedRevalidateOrigin },
+		...base?.middlewareOrigin === void 0 ? {} : { middlewareOrigin: base.middlewareOrigin },
 		dispatchPagesRevalidate,
 		isInternalPagesRevalidation
 	};

package/dist/server/worker-utils.d.ts

@@ -1,6 +1,14 @@
 //#region src/server/worker-utils.d.ts
 export declare function finalizeMissingStaticAssetResponse(response: Response, missingBuildAsset: boolean): Response;
 export declare function mergeHeaders(response: Response, extraHeaders: Record<string, string | string[]>, statusOverride?: number): Response;
+/**
+ * Merge middleware/config headers into a file served from the asset layer.
+ * Its Cache-Control is only the layer's default (Workers Static Assets sends
+ * `public, max-age=0, must-revalidate` with every file), so one set by
+ * middleware or `headers()` wins, as Next.js's static file server sets its
+ * own only when the response has none.
+ */
+export declare function mergeStaticFileHeaders(response: Response, extraHeaders: Record<string, string | string[]>, statusOverride?: number): Response;
 export declare function resolveStaticAssetSignal(signalResponse: Response, options: {
   /** `requestHeaders` are the post-middleware request headers, when middleware set any. */
   fetchAsset(path: string, requestHeaders: Headers | null): Promise<Response>;

package/dist/server/worker-utils.js

@@ -82,6 +82,23 @@ function mergeHeaders(response, extraHeaders, statusOverride) {
 		headers: merged
 	});
 }
+/**
+* Merge middleware/config headers into a file served from the asset layer.
+* Its Cache-Control is only the layer's default (Workers Static Assets sends
+* `public, max-age=0, must-revalidate` with every file), so one set by
+* middleware or `headers()` wins, as Next.js's static file server sets its
+* own only when the response has none.
+*/
+function mergeStaticFileHeaders(response, extraHeaders, statusOverride) {
+	const merged = mergeHeaders(response, extraHeaders, statusOverride);
+	for (const [name, value] of Object.entries(extraHeaders)) {
+		if (name.toLowerCase() !== "cache-control") continue;
+		const cacheControl = (Array.isArray(value) ? value.join(", ") : value).trim();
+		if (!cacheControl) continue;
+		merged.headers.set(name, cacheControl);
+	}
+	return merged;
+}
 async function resolveStaticAssetSignal(signalResponse, options) {
 	const signal = readStaticFileSignal(signalResponse);
 	if (!signal) return null;
@@ -100,7 +117,7 @@ async function resolveStaticAssetSignal(signalResponse, options) {
 	const requestHeaders = readStaticFileSignalRequestHeaders(signalResponse);
 	cancelResponseBody(signalResponse);
 	const assetResponse = await options.fetchAsset(assetPath, requestHeaders);
-	return mergeHeaders(assetResponse, extraHeaders, assetResponse.ok && assetResponse.status !== 206 && signalResponse.status !== 200 ? signalResponse.status : void 0);
+	return mergeStaticFileHeaders(assetResponse, extraHeaders, assetResponse.ok && assetResponse.status !== 206 && signalResponse.status !== 200 ? signalResponse.status : void 0);
 }
 /**
 * Retarget a Worker asset request without dropping its conditional/range
@@ -116,4 +133,4 @@ function createStaticAssetRequest(assetPath, sourceRequest, headers = null) {
 	});
 }
 //#endregion
-export { createStaticAssetRequest, finalizeMissingStaticAssetResponse, mergeHeaders, resolveStaticAssetSignal };
+export { createStaticAssetRequest, finalizeMissingStaticAssetResponse, mergeHeaders, mergeStaticFileHeaders, resolveStaticAssetSignal };

package/dist/shims/error-boundary.d.ts

@@ -6,6 +6,8 @@ export type ErrorBoundaryProps = {
     reset: () => void;
   }>;
   children: React.ReactNode;
+  /** Whether this boundary renders global-error, at the root of the page. */
+  isGlobalErrorBoundary?: boolean;
   resetKey?: string | null;
 };
 export type SerializedBoundaryError = {
@@ -38,6 +40,7 @@ type RedirectBoundaryProps = {
 type ErrorBoundaryInnerProps = {
   isImplicitRootErrorBoundary?: boolean;
   pathname: string | null;
+  wrapsGlobalErrorBoundary?: boolean;
 } & ErrorBoundaryProps;
 export type ErrorBoundaryState = {
   error: CapturedError | null;
@@ -66,13 +69,14 @@ export declare class ErrorBoundaryInner extends React.Component<ErrorBoundaryInn
   reset: () => void;
   render(): string | number | bigint | boolean | React.JSX.Element | Iterable<React.ReactNode> | Promise<string | number | bigint | boolean | Iterable<React.ReactNode> | React.ReactElement<unknown, string | React.JSXElementConstructor<any>> | React.ReactPortal | null | undefined> | null | undefined;
 }
-export declare function ErrorBoundary({ fallback, children, resetKey }: ErrorBoundaryProps): React.JSX.Element;
-export declare function GlobalErrorBoundary({ fallback, children }: {
+export declare function ErrorBoundary({ fallback, children, isGlobalErrorBoundary, resetKey }: ErrorBoundaryProps): React.JSX.Element;
+export declare function GlobalErrorBoundary({ fallback, children, wrapsGlobalErrorBoundary }: {
   fallback: React.ComponentType<{
     error: unknown;
     reset: () => void;
   }>;
   children: React.ReactNode;
+  wrapsGlobalErrorBoundary?: boolean;
 }): React.JSX.Element;
 type NotFoundBoundaryProps = {
   fallback: React.ReactNode;

package/dist/shims/error-boundary.js

@@ -174,21 +174,23 @@ var ErrorBoundaryInner = class extends React.Component {
 		return this.props.children;
 	}
 };
-function ErrorBoundary({ fallback, children, resetKey }) {
+function ErrorBoundary({ fallback, children, isGlobalErrorBoundary, resetKey }) {
 	const pathname = useErrorBoundaryPathname();
 	return /* @__PURE__ */ jsx(ErrorBoundaryInner, {
 		pathname,
 		resetKey,
 		fallback,
+		isGlobalErrorBoundary,
 		children
 	});
 }
-function GlobalErrorBoundary({ fallback, children }) {
+function GlobalErrorBoundary({ fallback, children, wrapsGlobalErrorBoundary }) {
 	const pathname = useErrorBoundaryPathname();
 	return /* @__PURE__ */ jsx(ErrorBoundaryInner, {
 		pathname,
 		fallback,
 		isImplicitRootErrorBoundary: fallback === DefaultGlobalError,
+		wrapsGlobalErrorBoundary,
 		children
 	});
 }

package/dist/shims/image-props.d.ts

@@ -71,6 +71,12 @@ export declare function resolveImageSource(v: {
  * Configurable via `images.deviceSizes` in next.config.js.
  */
 export declare const RESPONSIVE_WIDTHS: number[];
+/**
+ * Parse a `quality` prop like Next.js's `getInt` (shared/lib/get-img-props.ts):
+ * finite numbers and digit-only strings pass, anything else becomes NaN, which
+ * the default loader treats as 75.
+ */
+export declare function parseImageQuality(quality: unknown): number | undefined;
 /**
  * Build a `/_next/image` optimization URL.
  *

package/dist/shims/image-props.js

@@ -52,6 +52,14 @@ const __imageSizes = (() => {
 		];
 	}
 })();
+const __imageQualities = (() => {
+	try {
+		const qualities = JSON.parse(process.env.__VINEXT_IMAGE_QUALITIES ?? "null");
+		return Array.isArray(qualities) ? qualities.sort((a, b) => a - b) : null;
+	} catch {
+		return null;
+	}
+})();
 /**
 * Whether dangerouslyAllowSVG is enabled in next.config.js.
 * When false (default), .svg sources auto-skip the optimization endpoint
@@ -195,6 +203,33 @@ function extractLocalDeploymentId(src) {
 }
 const __imageEndpoint = `${process.env.__NEXT_ROUTER_BASEPATH ?? ""}/_next/image${process.env.__VINEXT_TRAILING_SLASH === "true" ? "/" : ""}`;
 /**
+* Parse a `quality` prop like Next.js's `getInt` (shared/lib/get-img-props.ts):
+* finite numbers and digit-only strings pass, anything else becomes NaN, which
+* the default loader treats as 75.
+*/
+function parseImageQuality(quality) {
+	if (quality === void 0) return void 0;
+	if (typeof quality === "number") return Number.isFinite(quality) ? quality : NaN;
+	if (typeof quality === "string" && /^[0-9]+$/.test(quality)) return parseInt(quality, 10);
+	return NaN;
+}
+/**
+* Round a `quality` prop to the closest entry of `images.qualities`, as the
+* Next.js default loader does (shared/lib/find-closest-quality.ts), so the
+* URL is one the optimization endpoint accepts.
+*
+* With no list configured the prop is used as written (75 when absent). This
+* is deliberate: Next.js 16 defaults the list to `[75]` and would round every
+* quality to 75, but vinext keeps the Next.js 14/15 behaviour for an unset
+* list so migrating apps keep the qualities they ask for (see
+* ImageConfig.qualities in server/image-optimization.ts).
+*/
+function findClosestQuality(quality) {
+	const q = quality || 75;
+	if (!__imageQualities?.length) return q;
+	return __imageQualities.reduce((prev, cur) => Math.abs(cur - q) < Math.abs(prev - q) ? cur : prev, __imageQualities[0]);
+}
+/**
 * Build a `/_next/image` optimization URL.
 *
 * In production (Cloudflare Workers), the worker intercepts this path and uses
@@ -202,9 +237,10 @@ const __imageEndpoint = `${process.env.__NEXT_ROUTER_BASEPATH ?? ""}/_next/image
 * server handles it as a passthrough (serves the original file).
 */
 function imageOptimizationUrl(src, width, quality = 75) {
+	const q = findClosestQuality(quality);
 	const source = extractLocalDeploymentId(src);
 	const deploymentQuery = source.src.startsWith("/") && source.deploymentId ? `&dpl=${source.deploymentId}` : "";
-	return `${__imageEndpoint}?url=${encodeURIComponent(source.src)}&w=${width}&q=${quality}${deploymentQuery}`;
+	return `${__imageEndpoint}?url=${encodeURIComponent(source.src)}&w=${width}&q=${q}${deploymentQuery}`;
 }
 /**
 * Generate a srcSet string for responsive images.
@@ -283,7 +319,7 @@ function getImageProps(props) {
 			}
 		}
 	}
-	const imgQuality = typeof _quality === "string" ? Number(_quality) : _quality ?? 75;
+	const imgQuality = parseImageQuality(_quality) ?? 75;
 	const resolvedSrc = blockedInProd ? "" : loader ? loader({
 		src,
 		width: imgWidth ?? 0,
@@ -320,4 +356,4 @@ function getImageProps(props) {
 	return { props: Object.assign(imageProps, { "data-nimg": fill ? "fill" : "1" }) };
 }
 //#endregion
-export { RESPONSIVE_WIDTHS, __dangerouslyAllowSVG, __globallyUnoptimized, __isDev, generateImageAttributes, getFillStyle, getImageProps, imageOptimizationUrl, isRemoteUrl, isSvgUrl, resolveImageSource, sanitizeBlurDataURL, validateRemoteUrl };
+export { RESPONSIVE_WIDTHS, __dangerouslyAllowSVG, __globallyUnoptimized, __isDev, generateImageAttributes, getFillStyle, getImageProps, imageOptimizationUrl, isRemoteUrl, isSvgUrl, parseImageQuality, resolveImageSource, sanitizeBlurDataURL, validateRemoteUrl };

package/dist/shims/image.js

@@ -1,6 +1,6 @@
 "use client";
 import { useMergedRef } from "./use-merged-ref.js";
-import { RESPONSIVE_WIDTHS, __dangerouslyAllowSVG, __globallyUnoptimized, __isDev, generateImageAttributes, getFillStyle, getImageProps, imageOptimizationUrl, isRemoteUrl, isSvgUrl, resolveImageSource, sanitizeBlurDataURL, validateRemoteUrl } from "./image-props.js";
+import { RESPONSIVE_WIDTHS, __dangerouslyAllowSVG, __globallyUnoptimized, __isDev, generateImageAttributes, getFillStyle, getImageProps, imageOptimizationUrl, isRemoteUrl, isSvgUrl, parseImageQuality, resolveImageSource, sanitizeBlurDataURL, validateRemoteUrl } from "./image-props.js";
 import { forwardRef, useEffect, useLayoutEffect, useRef, useState } from "react";
 import { jsx } from "react/jsx-runtime";
 import * as ReactDOM from "react-dom";
@@ -197,7 +197,7 @@ const Image = forwardRef(function Image({ src: srcProp, alt, width, height, fill
 		});
 	}
 	if (loader) {
-		const resolvedQuality = typeof quality === "string" ? Number(quality) : quality ?? 75;
+		const resolvedQuality = parseImageQuality(quality) ?? 75;
 		const resolvedSrc = loader({
 			src,
 			width: imgWidth ?? 0,
@@ -293,7 +293,7 @@ const Image = forwardRef(function Image({ src: srcProp, alt, width, height, fill
 			});
 		}
 	}
-	const imgQuality = typeof quality === "string" ? Number(quality) : quality ?? 75;
+	const imgQuality = parseImageQuality(quality) ?? 75;
 	const skipOptimization = isSvgUrl(src) && !__dangerouslyAllowSVG;
 	const optimizedAttributes = imgWidth && !fill && !skipOptimization ? generateImageAttributes(src, imgWidth, imgQuality, sizes) : void 0;
 	const srcSet = optimizedAttributes ? optimizedAttributes.srcSet : imgWidth && !fill ? RESPONSIVE_WIDTHS.filter((w) => w <= imgWidth * 2).map((w) => `${src} ${w}w`).join(", ") || `${src} ${imgWidth}w` : void 0;

package/dist/shims/request-context.d.ts

@@ -46,7 +46,9 @@ export type ExecutionContextLike = {
   requestSignal?: AbortSignal;
   /**
    * Server-owned origin middleware runs against. Set by the Node production
-   * server, whose request URL comes from the client's Host header. Without it
+   * server and by entries that srvx serves on Node (Nitro's Node presets,
+   * @vitejs/plugin-rsc's dev and preview handlers), whose request URL comes
+   * from the client's Host header. Without it
    * middleware uses the request URL's origin, which Workers can trust because
    * the platform routes by hostname.
    */

package/dist/shims/slot.d.ts

@@ -28,10 +28,13 @@ export declare function setAppElementsRenderedSearch(elements: AppElements, sear
  * that arrives after the head (initial hydration) is still seen.
  */
 export declare function bindAppElementsRenderedSearch(elements: AppElements, snapshot: Pick<ClientNavigationRenderSnapshot, "renderedSearch" | "search">): void;
+export declare function isBfcacheIdentityRetained(identity: string): boolean;
 export declare const BfcacheIdentityMapContext: React$1.Context<Readonly<Record<string, string>>>;
 export type BfcacheSlotEntry = {
   content: React$1.ReactNode;
   elements?: AppElements;
+  /** Every entry key inside a hidden entry, its own included. */
+  retainedKeys?: readonly string[];
   segmentId?: string;
   stateKey: string;
   stateKeyMap?: Readonly<Record<string, string>>;