{"version":3,"file":"headers.js","names":[],"sources":["../../src/server/headers.ts"],"sourcesContent":["/**\n * Internal HTTP header name constants used throughout vinext.\n *\n * Centralizes all custom header names so they are defined once and referenced\n * everywhere via imports. Keeping them in one module prevents typos, makes\n * rename-refactors trivial, and lets grep find every consumer instantly.\n *\n * Standard HTTP headers (Content-Type, Cache-Control, etc.) are intentionally\n * omitted — only vinext-internal and Next.js-protocol headers belong here.\n */\n\n// ---------------------------------------------------------------------------\n// Vinext-proprietary headers (`x-vinext-*` / `X-Vinext-*`)\n// ---------------------------------------------------------------------------\n\n/** ISR / page cache state indicator: \"HIT\" | \"MISS\" | \"STALE\" | \"STATIC\". */\nexport const VINEXT_CACHE_HEADER = \"X-Vinext-Cache\";\n\n/** Static file signal — value is URL-encoded pathname. */\nexport const VINEXT_STATIC_FILE_HEADER = \"x-vinext-static-file\";\n\n/** Serialized middleware context (JSON) forwarded from dev server to RSC entry. */\nexport const VINEXT_MW_CTX_HEADER = \"x-vinext-mw-ctx\";\n\n/** Timing metrics: `handlerStart,compileMs,renderMs`. */\nexport const VINEXT_TIMING_HEADER = \"x-vinext-timing\";\n\n/** Build-time prerender authentication secret. */\nexport const VINEXT_PRERENDER_SECRET_HEADER = \"x-vinext-prerender-secret\";\n\n/** TPR (Tailored Per-Request) revalidation interval in seconds. */\nexport const VINEXT_REVALIDATE_HEADER = \"x-vinext-revalidate\";\n\n/** Marker on cached ISR entries indicating RSC payload (value \"1\"). */\nexport const VINEXT_RSC_MARKER_HEADER = \"x-vinext-rsc\";\n\n/** URL-encoded JSON route params carried on RSC responses. */\nexport const VINEXT_PARAMS_HEADER = \"X-Vinext-Params\";\n\n/** Deduplicated, sorted list of mounted layout slots for cache keying. */\nexport const VINEXT_MOUNTED_SLOTS_HEADER = \"X-Vinext-Mounted-Slots\";\n\n/** Route interception context for parallel/intercepting routes. */\nexport const VINEXT_INTERCEPTION_CONTEXT_HEADER = \"X-Vinext-Interception-Context\";\n\n/** RSC render mode (e.g. \"navigation\", \"prefetch\"). */\nexport const VINEXT_RSC_RENDER_MODE_HEADER = \"X-Vinext-Rsc-Render-Mode\";\n\n// ---------------------------------------------------------------------------\n// RSC protocol headers\n// ---------------------------------------------------------------------------\n\n/** Standard RSC header — value \"1\" indicates an RSC payload request. */\nexport const RSC_HEADER = \"RSC\";\n\n/** Server Action invocation header (vinext/vite-rsc protocol). */\nexport const RSC_ACTION_HEADER = \"x-rsc-action\";\n\n// ---------------------------------------------------------------------------\n// Next.js compatibility headers\n// ---------------------------------------------------------------------------\n\n/** Next.js Server Action invocation header (fallback for x-rsc-action). */\nexport const NEXT_ACTION_HEADER = \"next-action\";\n\n/** Next.js action-not-found indicator (value \"1\"). */\nexport const NEXTJS_ACTION_NOT_FOUND_HEADER = \"x-nextjs-action-not-found\";\n\n// ---------------------------------------------------------------------------\n// Server Action response headers (`x-action-*`)\n// ---------------------------------------------------------------------------\n\n/** Indicates revalidation occurred — value is JSON kind (1 = path/tag, 2 = dynamic-only). */\nexport const ACTION_REVALIDATED_HEADER = \"x-action-revalidated\";\n\n/** Redirect URL from a Server Action. */\nexport const ACTION_REDIRECT_HEADER = \"x-action-redirect\";\n\n/** Redirect type from a Server Action (\"push\" | \"replace\"). */\nexport const ACTION_REDIRECT_TYPE_HEADER = \"x-action-redirect-type\";\n\n/** HTTP status for a Server Action redirect (e.g. \"308\"). */\nexport const ACTION_REDIRECT_STATUS_HEADER = \"x-action-redirect-status\";\n\n// ---------------------------------------------------------------------------\n// Middleware protocol headers (`x-middleware-*`)\n// ---------------------------------------------------------------------------\n\n/** Prefix for forwarded request headers (e.g. `x-middleware-request-cookie`). */\nexport const MIDDLEWARE_REQUEST_HEADER_PREFIX = \"x-middleware-request-\";\n\n/** Comma-separated list of header names that middleware wants to override. */\nexport const MIDDLEWARE_OVERRIDE_HEADERS = \"x-middleware-override-headers\";\n\n/** Carries cookies set by middleware for same-render reads. */\nexport const MIDDLEWARE_SET_COOKIE_HEADER = \"x-middleware-set-cookie\";\n\n/** Signal from `NextResponse.next()` — value \"1\" means \"continue to next handler\". */\nexport const MIDDLEWARE_NEXT_HEADER = \"x-middleware-next\";\n\n/** Rewrite destination URL set by `NextResponse.rewrite()`. */\nexport const MIDDLEWARE_REWRITE_HEADER = \"x-middleware-rewrite\";\n\n/** Redirect URL set by middleware. */\nconst MIDDLEWARE_REDIRECT_HEADER = \"x-middleware-redirect\";\n\n/** Skip-middleware signal. */\nconst MIDDLEWARE_SKIP_HEADER = \"x-middleware-skip\";\n\n/** Generic prefix for all middleware internal headers. */\nexport const MIDDLEWARE_HEADER_PREFIX = \"x-middleware-\";\n\n// ---------------------------------------------------------------------------\n// Next.js / RSC flight headers (forwarded through middleware)\n// ---------------------------------------------------------------------------\n\nexport const NEXT_ROUTER_STATE_TREE_HEADER = \"Next-Router-State-Tree\";\nexport const NEXT_ROUTER_PREFETCH_HEADER = \"Next-Router-Prefetch\";\nexport const NEXT_ROUTER_SEGMENT_PREFETCH_HEADER = \"Next-Router-Segment-Prefetch\";\nexport const NEXT_URL_HEADER = \"Next-Url\";\n\n/** Lowercase flight header variants used in middleware forwarding. */\nexport const FLIGHT_HEADERS: readonly string[] = [\n  \"rsc\",\n  \"next-router-state-tree\",\n  \"next-router-prefetch\",\n  \"next-hmr-refresh\",\n  \"next-router-segment-prefetch\",\n];\n\n// ---------------------------------------------------------------------------\n// Vercel / Now.sh legacy internal headers (stripped from inbound requests)\n// ---------------------------------------------------------------------------\n\nconst NOW_ROUTE_MATCHES_HEADER = \"x-now-route-matches\";\nconst MATCHED_PATH_HEADER = \"x-matched-path\";\nconst NEXTJS_DATA_HEADER = \"x-nextjs-data\";\nconst NEXT_RESUME_STATE_LENGTH_HEADER = \"x-next-resume-state-length\";\n\n// ---------------------------------------------------------------------------\n// Internal headers blocklist — stripped from inbound requests for security\n// ---------------------------------------------------------------------------\n\n/**\n * Headers that must be stripped from external requests before any handler\n * processes them. An attacker could forge these to influence routing or\n * impersonate internal data fetches.\n *\n * Ported from Next.js `INTERNAL_HEADERS`:\n * https://github.com/vercel/next.js/blob/canary/packages/next/src/server/lib/server-ipc/utils.ts\n */\nexport const INTERNAL_HEADERS = [\n  MIDDLEWARE_REWRITE_HEADER,\n  MIDDLEWARE_REDIRECT_HEADER,\n  MIDDLEWARE_SET_COOKIE_HEADER,\n  MIDDLEWARE_SKIP_HEADER,\n  MIDDLEWARE_OVERRIDE_HEADERS,\n  MIDDLEWARE_NEXT_HEADER,\n  NOW_ROUTE_MATCHES_HEADER,\n  MATCHED_PATH_HEADER,\n  NEXTJS_DATA_HEADER,\n  NEXT_RESUME_STATE_LENGTH_HEADER,\n];\n"],"mappings":";;;;;;;;;;;;AAgBA,MAAa,sBAAsB;;AAGnC,MAAa,4BAA4B;;AAGzC,MAAa,uBAAuB;;AAGpC,MAAa,uBAAuB;;AAGpC,MAAa,iCAAiC;;AAG9C,MAAa,2BAA2B;;AAGxC,MAAa,2BAA2B;;AAGxC,MAAa,uBAAuB;;AAGpC,MAAa,8BAA8B;;AAG3C,MAAa,qCAAqC;;AAGlD,MAAa,gCAAgC;;AAO7C,MAAa,aAAa;;AAG1B,MAAa,oBAAoB;;AAOjC,MAAa,qBAAqB;;AAGlC,MAAa,iCAAiC;;AAO9C,MAAa,4BAA4B;;AAGzC,MAAa,yBAAyB;;AAGtC,MAAa,8BAA8B;;AAG3C,MAAa,gCAAgC;;AAO7C,MAAa,mCAAmC;;AAGhD,MAAa,8BAA8B;;AAG3C,MAAa,+BAA+B;;AAG5C,MAAa,yBAAyB;;AAGtC,MAAa,4BAA4B;;AAGzC,MAAM,6BAA6B;;AAGnC,MAAM,yBAAyB;;AAG/B,MAAa,2BAA2B;AAMxC,MAAa,gCAAgC;AAC7C,MAAa,8BAA8B;AAC3C,MAAa,sCAAsC;AACnD,MAAa,kBAAkB;;AAG/B,MAAa,iBAAoC;CAC/C;CACA;CACA;CACA;CACA;CACD;;;;;;;;;AAuBD,MAAa,mBAAmB;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD"}