vinext 1.4.2 → 1.4.4

package/dist/server/pages-request-pipeline.js

@@ -19,6 +19,7 @@ import { setFrameworkRequestRoute } from "./request-tracing.js";
 import { withExternalRewriteResponseHeaders } from "./middleware-response-headers.js";
 import { applyConfigHeadersToHeaderRecord } from "./config-headers.js";
 import { finalizeMissingStaticAssetResponse, mergeHeaders, mergeStaticFileHeaders } from "./worker-utils.js";
+import { publicFileRouteKey } from "../utils/public-file-path.js";
 //#region src/server/pages-request-pipeline.ts
 function ruleUsesUnkeyedRequestCondition(rule) {
 	return [...rule.has ?? [], ...rule.missing ?? []].some((condition) => condition.type === "header" || condition.type === "cookie" || condition.type === "host");
@@ -35,24 +36,41 @@ function headersFromRecord(record) {
 	else headers.set(name, value);
 	return headers;
 }
-async function fetchWorkerFilesystemRoute(request, requestPathname, phase, fetchAsset, publicFiles, basePath = "", assetPathPrefix = "", pathnameHasBasePath = true) {
-	const isRetrievalMethod = request.method === "GET" || request.method === "HEAD";
-	const assetUrl = new URL(request.url);
+/**
+* Whether a filesystem route may serve `requestPathname` from the client
+* build directory. Like Next.js, only a public file or a build asset resolves
+* there: the directory also holds build metadata and private artifacts. A
+* direct GET/HEAD reaches this route only for a public file, since servers
+* answer existing build assets before middleware.
+*/
+function isServableFilesystemRoute(requestPathname, phase, method, publicFiles, basePath = "", assetPathPrefix = "", pathnameHasBasePath = true) {
+	const assetUrl = new URL("http://localhost");
 	assetUrl.pathname = requestPathname;
-	assetUrl.search = "";
 	const decodedAssetUrl = new URL(assetUrl);
 	let publicFileKey;
+	let servedPathname;
+	let servedFileKey;
 	try {
 		decodedAssetUrl.pathname = decodeURIComponent(assetUrl.pathname);
 		publicFileKey = normalizePathnameForRouteMatchStrict(assetUrl.pathname);
+		servedPathname = decodeURIComponent(requestPathname);
+		servedFileKey = publicFileRouteKey(servedPathname);
 	} catch {
 		return false;
 	}
-	if (!pathnameHasBasePath && !isAssetPrefixBuildAsset(decodedAssetUrl.pathname, assetPathPrefix)) return false;
-	const isPublicFile = pathnameHasBasePath && publicFiles.has(publicFileKey);
+	const decodedPathname = decodedAssetUrl.pathname;
+	if (!pathnameHasBasePath && !isAssetPrefixBuildAsset(decodedPathname, assetPathPrefix)) return false;
+	const isPublicFile = pathnameHasBasePath && publicFiles.has(publicFileKey) && publicFiles.has(servedFileKey);
 	if (!isPublicFile && (requestPathname === "/api" || requestPathname.startsWith("/api/"))) return false;
-	if (phase === "direct" && isRetrievalMethod && !isPublicFile) return false;
-	if (!isPublicFile && !isNextStaticPath(decodedAssetUrl.pathname, basePath, assetPathPrefix)) return false;
+	if (phase === "direct" && (method === "GET" || method === "HEAD") && !isPublicFile) return false;
+	return isPublicFile || isNextStaticPath(decodedPathname, basePath, assetPathPrefix) && isNextStaticPath(servedPathname, basePath, assetPathPrefix);
+}
+async function fetchWorkerFilesystemRoute(request, requestPathname, phase, fetchAsset, publicFiles, basePath = "", assetPathPrefix = "", pathnameHasBasePath = true) {
+	const isRetrievalMethod = request.method === "GET" || request.method === "HEAD";
+	const assetUrl = new URL(request.url);
+	assetUrl.pathname = requestPathname;
+	assetUrl.search = "";
+	if (!isServableFilesystemRoute(requestPathname, phase, request.method, publicFiles, basePath, assetPathPrefix, pathnameHasBasePath)) return false;
 	const response = await fetchAsset(isRetrievalMethod ? new Request(assetUrl, request) : new Request(assetUrl, {
 		method: "HEAD",
 		headers: request.headers
@@ -179,7 +197,8 @@ async function runPagesRequest(request, deps) {
 	if (!isOnDemandRevalidate && typeof deps.runMiddleware === "function") {
 		const result = await deps.runMiddleware(deps.middlewareRequest ?? request, deps.ctx ?? null, {
 			isDataRequest,
-			isStaleDataRequest: isDataRequest && !!deps.dataNotFoundResponse
+			isStaleDataRequest: isDataRequest && !!deps.dataNotFoundResponse,
+			restoreLocaleRootTrailingSlash: deps.restoreLocaleRootTrailingSlash
 		});
 		if (deps.recordCacheability !== false && result.pathnameEligible) markRouteCacheabilityDynamic("middleware can match this pathname");
 		if (result.waitUntilPromises && result.waitUntilPromises.length > 0) {
@@ -465,4 +484,4 @@ async function runPagesRequest(request, deps) {
 	};
 }
 //#endregion
-export { fetchWorkerFilesystemRoute, runPagesRequest, wrapMiddlewareWithBasePath };
+export { fetchWorkerFilesystemRoute, isServableFilesystemRoute, runPagesRequest, wrapMiddlewareWithBasePath };

package/dist/server/pages-request-stage-entry.js

@@ -73,7 +73,9 @@ const imageConfig = vinextConfig?.images ? {
 	dangerouslyAllowSVG: vinextConfig.images.dangerouslyAllowSVG,
 	dangerouslyAllowLocalIP: vinextConfig.images.dangerouslyAllowLocalIP,
 	contentDispositionType: vinextConfig.images.contentDispositionType,
-	contentSecurityPolicy: vinextConfig.images.contentSecurityPolicy
+	contentSecurityPolicy: vinextConfig.images.contentSecurityPolicy,
+	minimumCacheTTL: vinextConfig.images.minimumCacheTTL,
+	maximumResponseBody: vinextConfig.images.maximumResponseBody
 } : void 0;
 /**
 * Whether the request stage serves this request as a client build file
@@ -384,7 +386,10 @@ async function handleRequestImpl(request, env, platformCtx, dispatchResponseStag
 			});
 			if (sourceResult.type !== "response") return null;
 			await sourceResult.response.body?.cancel().catch(() => {});
-			if (isImageSourceBodyStatus(sourceResult.response.status)) return sourceAsset;
+			if (isImageSourceBodyStatus(sourceResult.response.status) && sourceAsset !== null) {
+				const { withStagedCacheControl } = await import("./worker-image-optimization.js");
+				return withStagedCacheControl(sourceAsset, sourceResult.response.headers.get("Cache-Control"));
+			}
 			await sourceAsset?.body?.cancel().catch(() => {});
 			return null;
 		};

package/dist/server/pages-router-entry.js

@@ -1,10 +1,12 @@
 import { VINEXT_CACHEABILITY_PROBE_HEADER, VINEXT_CACHEABILITY_PROBE_QUERY_PARAM } from "./headers.js";
+import { notFoundResponse } from "./http-error-responses.js";
 import { cloneRequestWithHeaders, cloneRequestWithUrl, stripRequestUrlFragment } from "./request-pipeline.js";
 import { runWithExecutionContext } from "../shims/request-context.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { validateCdnRequest } from "./cache-control.js";
 import { createWorkerRevalidationContext } from "./worker-revalidation-context.js";
 import { createWorkerPrerenderDiscoveryContext, createWorkerPrerenderReadinessResponse } from "./worker-prerender-discovery.js";
+import { isSrvxAbsoluteFormTarget } from "./srvx-request-target.js";
 import { handleRequestStageLocally, isPagesClientBuildFileRequest, pagesRequestStageBuildId, pagesRequestStagePrerenderSecret } from "./pages-request-stage-entry.js";
 import { renderPagesResponse } from "./pages-response-stage-entry.js";
 import { registerConfiguredCacheAdapters } from "virtual:vinext-cache-adapters";
@@ -52,6 +54,7 @@ async function handleSingleStageRequest(request, env, platformCtx) {
 	return finalize ? finalize(response, ctx) : response;
 }
 var pages_router_entry_default = { fetch(request, env, ctx) {
+	if (isSrvxAbsoluteFormTarget(request)) return Promise.resolve(notFoundResponse());
 	const strippedRequest = stripRequestUrlFragment(request);
 	const handle = () => handleSingleStageRequest(strippedRequest, env, ctx);
 	return ctx && typeof ctx.waitUntil === "function" ? runWithExecutionContext(ctx, handle) : handle();

package/dist/server/prod-server.d.ts

@@ -90,7 +90,7 @@ declare function mergeWebResponse(middlewareHeaders: Record<string, string | str
  * Send a compressed response if the content type is compressible and the
  * client supports compression. Otherwise send uncompressed.
  */
-declare function sendCompressed(req: IncomingMessage, res: ServerResponse, body: string | Buffer, contentType: string, statusCode: number, extraHeaders?: Record<string, string | string[]>, compress?: boolean, statusText?: string): void;
+declare function sendCompressed(req: IncomingMessage, res: ServerResponse, body: string | Buffer, contentType: string | undefined, statusCode: number, extraHeaders?: Record<string, string | string[]>, compress?: boolean, statusText?: string): void;
 /**
  * Try to serve a static file from the client build directory.
  *

package/dist/server/prod-server.js

@@ -7,7 +7,7 @@ import { notFoundResponse } from "./http-error-responses.js";
 import { getRepeatedSlashRedirect, isOpenRedirectShaped, sendRepeatedSlashRedirect } from "./open-redirect.js";
 import { readStaticFileSignal } from "./static-file-signal.js";
 import { canonicalizeRequestPathname, filterInternalHeaders } from "./request-pipeline.js";
-import { ASSET_PREFIX_URL_DIR, assetPrefixPathname, isAbsoluteAssetPrefix, isAssetPrefixBuildAsset } from "../utils/asset-prefix.js";
+import { ASSET_PREFIX_URL_DIR, assetPrefixPathname, isAbsoluteAssetPrefix } from "../utils/asset-prefix.js";
 import { StaticFileCache, contentTypeForPath, etagFromFilenameHash, staticFileCacheControl } from "./static-file-cache.js";
 import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { resolveRequestHost, resolveRequestProtocol, resolveTrustedForwardedHost, trustProxy, trustedHosts } from "./proxy-trust.js";
@@ -19,13 +19,13 @@ import { parseHttpDate } from "./http-date.js";
 import { evaluateStaticPreconditions } from "./http-conditional.js";
 import { setPagesClientAssets } from "./pages-client-assets.js";
 import { signalFromNodeResponse } from "./node-response-signal.js";
-import { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, IMAGE_RESPONSE_CACHE_STATE, INVALID_IMAGE_SOURCE_MESSAGE, MUTABLE_IMAGE_SOURCE_CACHE_CONTROL, isImageOptimizationPath, isImageSourceBodyStatus, isSafeImageContentType, parseImageParams, readImageOptimizationSignal } from "./image-optimization.js";
+import { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, IMAGE_RESPONSE_CACHE_STATE, IMAGE_TYPE_NOT_ALLOWED_MESSAGE, INVALID_IMAGE_SOURCE_MESSAGE, isImageOptimizationPath, isImageSourceBodyStatus, isSafeImageContentType, parseImageParams, readImageOptimizationSignal, sourceImageCacheControl } from "./image-optimization.js";
 import { installSocketErrorBackstop } from "./socket-error-backstop.js";
 import { collectInlineCssManifest } from "../build/inline-css.js";
 import { readTrustedRevalidationHostname } from "./revalidation-host.js";
 import { traceFrameworkRequest } from "./request-tracing.js";
 import { mergeHeaders } from "./worker-utils.js";
-import { runPagesRequest, wrapMiddlewareWithBasePath } from "./pages-request-pipeline.js";
+import { isServableFilesystemRoute, runPagesRequest, wrapMiddlewareWithBasePath } from "./pages-request-pipeline.js";
 import { computeClientRuntimeMetadata } from "../utils/client-runtime-metadata.js";
 import { readPrerenderSecret, readServerCompress } from "../build/server-manifest.js";
 import { readTrustedPrerenderRouteParamsFromHeaders, serializePrerenderRouteParamsHeader } from "./prerender-route-params.js";
@@ -339,6 +339,7 @@ function installClientBuildManifestGlobals(clientDir, assetBase, assetPrefix, cr
 	});
 	setPagesClientAssets({
 		appBootstrapPreinitModules: metadata.appBootstrapPreinitModules,
+		appBootstrapPreloadModules: metadata.appBootstrapPreloadModules,
 		appRouteManifestModule: metadata.appRouteManifestModule,
 		lazyChunks: metadata.lazyChunks,
 		dynamicPreloads: metadata.dynamicPreloads,
@@ -444,7 +445,7 @@ function sendCompressed(req, res, body, contentType, statusCode, extraHeaders =
 	if (encoding !== "identity") {
 		writeHead(mergeVaryHeader({
 			...headersWithoutBodyHeaders,
-			"Content-Type": contentType,
+			...contentType !== void 0 && { "Content-Type": contentType },
 			"Content-Encoding": encoding
 		}, "Accept-Encoding"));
 		const compressor = createCompressor(encoding);
@@ -453,7 +454,7 @@ function sendCompressed(req, res, body, contentType, statusCode, extraHeaders =
 	} else {
 		const identityHeaders = {
 			...headersWithoutBodyHeaders,
-			"Content-Type": contentType,
+			...contentType !== void 0 && { "Content-Type": contentType },
 			"Content-Length": String(buf.length)
 		};
 		writeHead(varyByEncoding ? mergeVaryHeader(identityHeaders, "Accept-Encoding") : identityHeaders);
@@ -477,20 +478,18 @@ function staticCacheLookupPath(pathname) {
 }
 /**
 * Give a Node image passthrough Next.js's image Cache-Control instead of the
-* public-file default: a hashed build asset keeps its immutable default, and
-* any other source is revalidated after the default `images.minimumCacheTTL`.
+* public-file default: a build asset keeps its immutable default, and a public
+* file, whatever its path, is revalidated after `images.minimumCacheTTL`, or
+* after the max-age a direct request for it gets (from middleware or
+* `headers()`, else the public-file default) when that is longer.
 */
-function withImageSourceCacheControl(headers, sourcePath) {
-	if (sourcePath.includes(`/_next/static/`)) return headers;
+function withImageSourceCacheControl(headers, publicFileCacheControl, config) {
+	if (publicFileCacheControl === void 0) return headers;
 	return {
 		...headers,
-		"Cache-Control": MUTABLE_IMAGE_SOURCE_CACHE_CONTROL
+		"Cache-Control": sourceImageCacheControl(false, publicFileCacheControl ?? staticFileCacheControl(false), config)
 	};
 }
-/** Pathnames the Pages Router serves from routes rather than the client directory. */
-function isPagesFilesystemExcludedPath(pathname, phase) {
-	return pathname === "/" || pathname === "/api" || pathname.startsWith("/api/") || phase === "direct" && pathname.startsWith(`/_next/static/`);
-}
 /**
 * Try to serve a static file from the client build directory.
 *
@@ -783,32 +782,14 @@ function pipeStaticFileRange(filePath, range, res) {
 		}
 	});
 }
-/**
-* Resolve the actual file to serve, trying extension-less HTML fallbacks.
-* Returns the resolved path + size + mtime, or null if not found.
-*/
+/** Returns the file's path + size + mtime, or null if it is not a regular file. */
 async function resolveStaticFile(staticFile) {
 	const stat = await statIfFile(staticFile);
-	if (stat) return {
+	return stat ? {
 		path: staticFile,
 		size: stat.size,
 		mtimeMs: stat.mtimeMs
-	};
-	const htmlFallback = staticFile + ".html";
-	const htmlStat = await statIfFile(htmlFallback);
-	if (htmlStat) return {
-		path: htmlFallback,
-		size: htmlStat.size,
-		mtimeMs: htmlStat.mtimeMs
-	};
-	const indexFallback = path.join(staticFile, "index.html");
-	const indexStat = await statIfFile(indexFallback);
-	if (indexStat) return {
-		path: indexFallback,
-		size: indexStat.size,
-		mtimeMs: indexStat.mtimeMs
-	};
-	return null;
+	} : null;
 }
 async function statIfFile(filePath) {
 	try {
@@ -1129,6 +1110,7 @@ function installPagesClientAssets(options) {
 	setPagesClientAssets({
 		clientEntry: metadata.clientEntryFile,
 		appBootstrapPreinitModules: metadata.appBootstrapPreinitModules,
+		appBootstrapPreloadModules: metadata.appBootstrapPreloadModules,
 		appRouteManifestModule: metadata.appRouteManifestModule,
 		ssrManifest: Object.keys(ssrManifest).length > 0 ? ssrManifest : void 0,
 		sharedChunks: metadata.sharedChunks,
@@ -1214,7 +1196,7 @@ async function startAppRouterServer(options) {
 			return;
 		}
 		const sendUnsafeContentType = () => {
-			sendBadRequest("The requested resource is not an allowed image type");
+			sendBadRequest(IMAGE_TYPE_NOT_ALLOWED_MESSAGE);
 		};
 		const isSafeSourcePath = (sourcePath) => isSafeImageContentType(contentTypeForPath(sourcePath), imageConfig?.dangerouslyAllowSVG);
 		const imageSecurityHeaders = {
@@ -1222,7 +1204,7 @@ async function startAppRouterServer(options) {
 			"X-Content-Type-Options": "nosniff",
 			"Content-Disposition": imageConfig?.contentDispositionType === "attachment" ? "attachment" : "inline"
 		};
-		const serveSource = (sourcePath) => tryServeStatic(req, res, clientDir, sourcePath, false, staticCache, withImageSourceCacheControl(imageSecurityHeaders, sourcePath), void 0, IMAGE_REPRESENTATION_HEADERS);
+		const serveSource = (sourcePath, publicFileCacheControl) => tryServeStatic(req, res, clientDir, sourcePath, false, staticCache, withImageSourceCacheControl(imageSecurityHeaders, publicFileCacheControl, imageConfig), void 0, IMAGE_REPRESENTATION_HEADERS);
 		const sourceUrl = new URL(params.imageUrl, request.url);
 		let sourcePathname = null;
 		try {
@@ -1248,7 +1230,7 @@ async function startAppRouterServer(options) {
 					sendUnsafeContentType();
 					return;
 				}
-				if (await serveSource(sourcePath)) return;
+				if (await serveSource(sourcePath, sourceResponse.headers.get("Cache-Control"))) return;
 			}
 		}
 		sendBadRequest(INVALID_IMAGE_SOURCE_MESSAGE);
@@ -1440,6 +1422,8 @@ async function createPagesRouterRequestHandler(options) {
 	const ensureInstrumentation = typeof serverEntry.__ensureInstrumentation === "function" ? () => serverEntry.__ensureInstrumentation() : () => void 0;
 	const hasMiddleware = serverEntry.hasMiddleware === true;
 	const pageRoutes = readPagesServerEntryPageRoutes(serverEntry.pageRoutes);
+	const publicFiles = serverEntry.publicFiles instanceof Set ? serverEntry.publicFiles : /* @__PURE__ */ new Set();
+	const clientBuildFiles = serverEntry.clientBuildFiles instanceof Set ? serverEntry.clientBuildFiles : /* @__PURE__ */ new Set();
 	const prerenderSecret = readPrerenderSecret(path.dirname(serverEntryPath));
 	const compress = compressOption && readServerCompress(serverDir);
 	const basePath = vinextConfig?.basePath ?? "";
@@ -1464,7 +1448,9 @@ async function createPagesRouterRequestHandler(options) {
 		qualities: vinextConfig.images.qualities,
 		localPatterns: vinextConfig.images.localPatterns,
 		contentDispositionType: vinextConfig.images.contentDispositionType,
-		contentSecurityPolicy: vinextConfig.images.contentSecurityPolicy
+		contentSecurityPolicy: vinextConfig.images.contentSecurityPolicy,
+		minimumCacheTTL: vinextConfig.images.minimumCacheTTL,
+		maximumResponseBody: vinextConfig.images.maximumResponseBody
 	} : void 0;
 	const ssrManifest = installPagesClientAssets({
 		clientDir,
@@ -1554,6 +1540,10 @@ async function createPagesRouterRequestHandler(options) {
 		if (pagesAssetLookup) {
 			if (await tryServeStatic(req, res, clientDir, pagesAssetLookup, compress, staticCache)) return;
 		}
+		if (req.method === "GET" || req.method === "HEAD") {
+			const clientBuildFile = resolveClientBuildFile(rawPagesPathname, basePath, clientBuildFiles);
+			if (clientBuildFile && await tryServeStatic(req, res, clientDir, clientBuildFile, compress, staticCache)) return;
+		}
 		try {
 			const hadBasePath = !basePath || hasBasePath(requestPathname, basePath);
 			const restoreLocaleRootTrailingSlash = shouldRestoreLocaleRootTrailingSlash(requestPathname, {
@@ -1624,6 +1614,7 @@ async function createPagesRouterRequestHandler(options) {
 			const middlewareRequest = isDataReq && skipProxyUrlNormalize ? new Request(new URL(originalRenderUrl, webRequest.url), webRequest) : void 0;
 			const middlewareCtx = createNodeExecutionContext(void 0, { middlewareOrigin: resolveNodeMiddlewareOrigin(req, webRequest.url, host, port) });
 			const runNodeMiddleware = typeof runMiddleware === "function" ? (request, _ctx, opts) => runMiddleware(request, middlewareCtx, opts) : null;
+			/** The public file a source resolves to, with the Cache-Control staged for it. */
 			const resolvePublicImageSource = async (sourceUrl) => {
 				const rawSourcePathname = sourceUrl.pathname;
 				if (getRepeatedSlashRedirect(rawSourcePathname) || isOpenRedirectShaped(rawSourcePathname)) return null;
@@ -1631,7 +1622,7 @@ async function createPagesRouterRequestHandler(options) {
 				const sourceHadBasePath = !basePath || hasBasePath(sourceRequestPathname, basePath);
 				const strippedSourcePathname = stripBasePath(sourceRequestPathname, basePath);
 				if (isNextDataPathname(strippedSourcePathname)) return null;
-				let sourcePath = null;
+				let source = null;
 				const result = await runPagesRequest(new Request(new URL(strippedSourcePathname + sourceUrl.search, sourceUrl), { signal: webRequest.signal }), {
 					...deps,
 					hadBasePath: sourceHadBasePath,
@@ -1649,17 +1640,20 @@ async function createPagesRouterRequestHandler(options) {
 					runMiddleware: runNodeMiddleware ? wrapMiddlewareWithBasePath(runNodeMiddleware, basePath, sourceHadBasePath) : null,
 					renderPage: null,
 					handleApi: null,
-					serveFilesystemRoute: async (candidate, _stagedHeaders, phase, _resolvedUrl, _request, candidateHasBasePath) => {
-						if (!candidateHasBasePath && !isAssetPrefixBuildAsset(candidate, pagesAssetPathPrefix) || isImageOptimizationPath(candidate) || isPagesFilesystemExcludedPath(candidate, phase)) return false;
+					serveFilesystemRoute: async (candidate, stagedHeaders, phase, _resolvedUrl, sourceRequest, candidateHasBasePath) => {
+						if (isImageOptimizationPath(candidate) || !isServableFilesystemRoute(candidate, phase, sourceRequest.method, publicFiles, basePath, pagesAssetPathPrefix, candidateHasBasePath)) return false;
 						const lookupPath = staticCacheLookupPath(candidate);
 						if (lookupPath === null || lookupPath === "/" || !staticCache.lookup(lookupPath)) return false;
-						sourcePath = candidate;
+						source = {
+							path: candidate,
+							cacheControl: readHeaderCaseInsensitive(stagedHeaders, "cache-control") ?? null
+						};
 						return new Response(null);
 					}
 				});
 				if (result.type !== "response") return null;
 				cancelResponseBody(result.response);
-				return isImageSourceBodyStatus(result.response.status) ? sourcePath : null;
+				return isImageSourceBodyStatus(result.response.status) ? source : null;
 			};
 			const deps = {
 				assetPrefix,
@@ -1693,7 +1687,7 @@ async function createPagesRouterRequestHandler(options) {
 					return handleApi(request, apiUrl, createNodeExecutionContext(), resolveTrustedNodeRevalidateOrigin(req, host, port), "node", stagedHeaders);
 				} : null,
 				handleApiAppliesStagedHeaders: true,
-				serveFilesystemRoute: async (requestPathname, stagedHeaders, phase, resolvedUrl, _request, resolvedPathnameHasBasePath) => {
+				serveFilesystemRoute: async (requestPathname, stagedHeaders, phase, resolvedUrl, filesystemRequest, resolvedPathnameHasBasePath) => {
 					if (resolvedPathnameHasBasePath && isImageOptimizationPath(requestPathname)) {
 						for (const [name, value] of Object.entries(stagedHeaders)) res.setHeader(name, value);
 						const parsedUrl = new URL(resolvedUrl, "http://localhost");
@@ -1705,7 +1699,7 @@ async function createPagesRouterRequestHandler(options) {
 						}
 						const sendUnsafeContentType = () => {
 							res.writeHead(400);
-							res.end("The requested resource is not an allowed image type");
+							res.end(IMAGE_TYPE_NOT_ALLOWED_MESSAGE);
 						};
 						const isSafeSourcePath = (sourcePath) => isSafeImageContentType(contentTypeForPath(sourcePath), pagesImageConfig?.dangerouslyAllowSVG);
 						const imageSecurityHeaders = {
@@ -1713,7 +1707,7 @@ async function createPagesRouterRequestHandler(options) {
 							"X-Content-Type-Options": "nosniff",
 							"Content-Disposition": pagesImageConfig?.contentDispositionType === "attachment" ? "attachment" : "inline"
 						};
-						const serveSource = (sourcePath) => tryServeStatic(req, res, clientDir, sourcePath, false, staticCache, withImageSourceCacheControl(imageSecurityHeaders, sourcePath), void 0, IMAGE_REPRESENTATION_HEADERS);
+						const serveSource = (sourcePath, publicFileCacheControl) => tryServeStatic(req, res, clientDir, sourcePath, false, staticCache, withImageSourceCacheControl(imageSecurityHeaders, publicFileCacheControl, pagesImageConfig), void 0, IMAGE_REPRESENTATION_HEADERS);
 						const sourceUrl = new URL(params.imageUrl, webRequest.url);
 						let sourcePathname = null;
 						try {
@@ -1723,22 +1717,22 @@ async function createPagesRouterRequestHandler(options) {
 							sendUnsafeContentType();
 							return true;
 						}
-						const assetLookupPath = sourcePathname !== null ? resolveAppRouterAssetPath(sourcePathname, pagesAssetPathPrefix, assetPrefix) : null;
+						const assetLookupPath = sourcePathname !== null ? resolveAppRouterAssetPath(sourcePathname, pagesAssetPathPrefix, assetPrefix) ?? resolveClientBuildFile(sourceUrl.pathname, basePath, clientBuildFiles) : null;
 						if (assetLookupPath && await serveSource(assetLookupPath)) return true;
-						const sourcePath = sourcePathname !== null ? await resolvePublicImageSource(sourceUrl) : null;
+						const source = sourcePathname !== null ? await resolvePublicImageSource(sourceUrl) : null;
 						if (webRequest.signal.aborted) return true;
-						if (sourcePath !== null) {
-							if (!isSafeSourcePath(staticCacheLookupPath(sourcePath) ?? sourcePath)) {
+						if (source !== null) {
+							if (!isSafeSourcePath(staticCacheLookupPath(source.path) ?? source.path)) {
 								sendUnsafeContentType();
 								return true;
 							}
-							if (await serveSource(sourcePath)) return true;
+							if (await serveSource(source.path, source.cacheControl)) return true;
 						}
 						res.writeHead(400);
 						res.end(INVALID_IMAGE_SOURCE_MESSAGE);
 						return true;
 					}
-					if (!resolvedPathnameHasBasePath && !isAssetPrefixBuildAsset(requestPathname, pagesAssetPathPrefix) || isPagesFilesystemExcludedPath(requestPathname, phase)) return false;
+					if (!isServableFilesystemRoute(requestPathname, phase, filesystemRequest.method, publicFiles, basePath, pagesAssetPathPrefix, resolvedPathnameHasBasePath)) return false;
 					return tryServeStatic(req, res, clientDir, requestPathname, compress, staticCache, stagedHeaders);
 				}
 			};
@@ -1758,7 +1752,7 @@ async function createPagesRouterRequestHandler(options) {
 				}
 				const responseBody = await bufferResponseBodyUntilAborted(response, webRequest.signal);
 				if (!responseBody) return;
-				const ct = response.headers.get("content-type") ?? result.defaultContentType;
+				const ct = response.headers.get("content-type") ?? (responseBody.length > 0 ? result.defaultContentType : void 0);
 				const responseHeaders = {};
 				response.headers.forEach((v, k) => {
 					if (k === "set-cookie") return;

package/dist/server/remove-request-headers.d.ts

@@ -0,0 +1,16 @@
+import { IncomingMessage } from "node:http";
+import { Http2ServerRequest } from "node:http2";
+//#region src/server/remove-request-headers.d.ts
+/**
+ * Remove headers from every view of a Node request.
+ *
+ * Node keeps each client header in req.rawHeaders as well as req.headers, and
+ * srvx (plugin-rsc's dev request adapter) answers Headers reads from rawHeaders
+ * once anything iterates them, so later handlers must not find a removed
+ * header in either. On HTTP/1, Node builds req.headers and req.headersDistinct
+ * lazily from rawHeaders and the header count it parsed, so both must exist
+ * before rawHeaders gets shorter. HTTP/2 compatibility requests (Vite with
+ * `server.https`) have no headersDistinct.
+ */
+export declare function removeRequestHeaders(req: IncomingMessage | Http2ServerRequest, names: ReadonlySet<string>): void;
+//#endregion

package/dist/server/remove-request-headers.js

@@ -0,0 +1,23 @@
+//#region src/server/remove-request-headers.ts
+/**
+* Remove headers from every view of a Node request.
+*
+* Node keeps each client header in req.rawHeaders as well as req.headers, and
+* srvx (plugin-rsc's dev request adapter) answers Headers reads from rawHeaders
+* once anything iterates them, so later handlers must not find a removed
+* header in either. On HTTP/1, Node builds req.headers and req.headersDistinct
+* lazily from rawHeaders and the header count it parsed, so both must exist
+* before rawHeaders gets shorter. HTTP/2 compatibility requests (Vite with
+* `server.https`) have no headersDistinct.
+*/
+function removeRequestHeaders(req, names) {
+	const headersDistinct = "headersDistinct" in req ? req.headersDistinct : void 0;
+	for (const name of names) {
+		delete req.headers[name];
+		if (headersDistinct) delete headersDistinct[name];
+	}
+	const rawHeaders = req.rawHeaders;
+	for (let i = rawHeaders.length - 2; i >= 0; i -= 2) if (names.has(rawHeaders[i].toLowerCase())) rawHeaders.splice(i, 2);
+}
+//#endregion
+export { removeRequestHeaders };

package/dist/server/srvx-middleware-origin.d.ts

@@ -0,0 +1,13 @@
+//#region src/server/srvx-middleware-origin.d.ts
+/**
+ * The server-owned origin middleware runs against when srvx serves the
+ * request on Node. srvx builds `request.url` from the client's Host and
+ * `X-Forwarded-Proto` headers, which must not decide whether a rewrite to
+ * another host is external, so like the Node production server (and Next.js,
+ * which uses its hostname and port) this uses the socket's TLS state and
+ * local port, or a trusted `X-Forwarded-Proto` and `X-Forwarded-Host`.
+ * Undefined on other hosts, and on Vercel, which routes by hostname like
+ * Workers; they keep the request URL's origin.
+ */
+export declare function resolveSrvxMiddlewareOrigin(request: Request): string | undefined;
+//#endregion

package/dist/server/srvx-middleware-origin.js

@@ -0,0 +1,19 @@
+import { resolveRequestProtocol, resolveTrustedForwardedHost } from "./proxy-trust.js";
+//#region src/server/srvx-middleware-origin.ts
+/**
+* The server-owned origin middleware runs against when srvx serves the
+* request on Node. srvx builds `request.url` from the client's Host and
+* `X-Forwarded-Proto` headers, which must not decide whether a rewrite to
+* another host is external, so like the Node production server (and Next.js,
+* which uses its hostname and port) this uses the socket's TLS state and
+* local port, or a trusted `X-Forwarded-Proto` and `X-Forwarded-Host`.
+* Undefined on other hosts, and on Vercel, which routes by hostname like
+* Workers; they keep the request URL's origin.
+*/
+function resolveSrvxMiddlewareOrigin(request) {
+	const socket = request.runtime?.node?.req?.socket;
+	if (!socket || process.env.VERCEL) return void 0;
+	return `${socket.encrypted === true || resolveRequestProtocol(request.headers) === "https" ? "https:" : "http:"}//${resolveTrustedForwardedHost(request.headers) ?? (socket.localPort === void 0 ? "localhost" : `localhost:${socket.localPort}`)}`;
+}
+//#endregion
+export { resolveSrvxMiddlewareOrigin };

package/dist/server/srvx-request-target.d.ts

@@ -0,0 +1,12 @@
+//#region src/server/srvx-request-target.d.ts
+/**
+ * Whether srvx, serving the request on Node, got a request target that is not
+ * origin-form (`GET https://other.example/x`). srvx then takes the origin of
+ * `request.url` from the target, as RFC 9112 §3.2.2 asks of an origin server.
+ * `vinext start` 404s every such target (see `getRepeatedSlashRedirect`) and
+ * Next.js never routes one, so the request-based entries Nitro calls refuse
+ * them too. The raw target is the one `nitroRequestTargetPlugin` saved before
+ * h3 could rewrite `req.url`.
+ */
+export declare function isSrvxAbsoluteFormTarget(request: Request): boolean;
+//#endregion

package/dist/server/srvx-request-target.js

@@ -0,0 +1,20 @@
+import { NITRO_REQUEST_TARGET_KEY } from "./nitro-request-target-plugin.js";
+//#region src/server/srvx-request-target.ts
+/**
+* Whether srvx, serving the request on Node, got a request target that is not
+* origin-form (`GET https://other.example/x`). srvx then takes the origin of
+* `request.url` from the target, as RFC 9112 §3.2.2 asks of an origin server.
+* `vinext start` 404s every such target (see `getRepeatedSlashRedirect`) and
+* Next.js never routes one, so the request-based entries Nitro calls refuse
+* them too. The raw target is the one `nitroRequestTargetPlugin` saved before
+* h3 could rewrite `req.url`.
+*/
+function isSrvxAbsoluteFormTarget(request) {
+	const req = request.runtime?.node?.req;
+	if (!req) return false;
+	const saved = Reflect.get(req, Symbol.for(NITRO_REQUEST_TARGET_KEY));
+	const target = typeof saved === "string" ? saved : req.url;
+	return !!target && !target.startsWith("/");
+}
+//#endregion
+export { isSrvxAbsoluteFormTarget };

package/dist/server/static-file-cache.js

@@ -29,9 +29,11 @@ const CONTENT_TYPES = {
 	".css": "text/css; charset=utf-8",
 	".html": "text/html; charset=utf-8",
 	".ico": "image/x-icon",
+	".icns": "image/x-icns",
 	".jpeg": "image/jpeg",
 	".jpg": "image/jpeg",
 	".json": "application/json; charset=utf-8",
+	".jxl": "image/jxl",
 	".map": "application/json; charset=utf-8",
 	".mp3": "audio/mpeg",
 	".mp4": "video/mp4",
@@ -148,30 +150,16 @@ var StaticFileCache = class StaticFileCache {
 			}
 			const pathname = "/" + relativePath;
 			entries.set(pathname, entry);
-			if (ext === ".html") {
-				if (relativePath.endsWith("/index.html")) {
-					const dirPath = "/" + relativePath.slice(0, -11);
-					if (dirPath !== "/") entries.set(dirPath, entry);
-				} else {
-					const withoutExt = "/" + relativePath.slice(0, -ext.length);
-					entries.set(withoutExt, entry);
-				}
-			}
 		}
 		const toBuffer = [];
-		const seenEntries = /* @__PURE__ */ new Set();
-		for (const entry of entries.values()) {
-			if (seenEntries.has(entry)) continue;
-			seenEntries.add(entry);
-			for (const variant of [
-				entry.original,
-				entry.br,
-				entry.gz,
-				entry.zst
-			]) {
-				if (!variant || variant.size > BUFFER_THRESHOLD) continue;
-				toBuffer.push(variant);
-			}
+		for (const entry of entries.values()) for (const variant of [
+			entry.original,
+			entry.br,
+			entry.gz,
+			entry.zst
+		]) {
+			if (!variant || variant.size > BUFFER_THRESHOLD) continue;
+			toBuffer.push(variant);
 		}
 		for (let i = 0; i < toBuffer.length; i += 64) await Promise.all(toBuffer.slice(i, i + 64).map(async (v) => {
 			v.buffer = await fsp.readFile(v.path);

package/dist/server/worker-image-optimization.d.ts

@@ -19,10 +19,17 @@ export type WorkerImageSourceOptions = {
  * served only when the application pipeline selects a public file for it.
  */
 export declare function fetchWorkerImageSource(imageUrl: string, request: Request, options: WorkerImageSourceOptions): Promise<Response>;
+/**
+ * Give a public-file source the Cache-Control middleware or `headers()` staged
+ * for it, which a direct request receives in place of the asset default and
+ * Next.js' internal source fetch reads.
+ */
+export declare function withStagedCacheControl(asset: Response, cacheControl: string | null): Response;
 /**
  * Return the public file a framework static-file signal selects, provided the
  * pipeline answered with a body-bearing 2xx outcome. The file is fetched with middleware's
- * request header overrides, as resolveStaticAssetSignal fetches it.
+ * request header overrides, as resolveStaticAssetSignal fetches it, and keeps
+ * the Cache-Control the pipeline staged.
  */
 export declare function fetchSignalledPublicFile(response: Response, sourceRequest: Request, assets: VinextAssetFetcher): Promise<Response> | null;
 /**