## Summary
- Drop RFC 7540 §8.1.2.1 pseudo-headers (`:method`, `:authority`, `:path`,
`:scheme`) before constructing WHATWG `Headers` from Node's `req.headers`.
- Fixed at every `Headers`-from-`req.headers` site: the Pages Router
middleware snapshot (index.ts), the edge API request builder
(api-handler.ts), and the shared `appendWebHeader` helper used by
`nodeToWebRequest` (prod-server.ts).
- Also excluded pseudo-headers from the `reportRequestError` header metadata
in both api-handler.ts and dev-server.ts so error reports reflect real
request headers only.
- Added a regression unit test driving `nodeToWebRequest` with a fake HTTP/2
request.
## Root Cause
Over HTTP/2, Node's `http2` server exposes the request pseudo-headers as
`:`-prefixed keys on `req.headers`. The WHATWG `Headers`
constructor/`append`/`set` reject any header name containing `:`
(`TypeError: Headers.set: ":method" is an invalid header name`), so building a
`Headers` object directly from `req.headers` threw and returned a 500 on every
HTTP/2 request. Per RFC 7540 §8.1.2.1, pseudo-headers must not be treated as
regular header fields, so they are stripped at each construction site.
## References
- Issue: cloudflare/vinext#2013
- RFC 7540 §8.1.2.1 (HTTP/2 pseudo-header fields)
- Node `http2` request `:`-prefixed headers; WHATWG Fetch `Headers` name validation
## Verification
- `node -e "new Headers({':method':'GET'})"` → throws (repro).
- `CI=true pnpm test tests/http2-pseudo-headers.test.ts` → red before fix,
green after.
- `CI=true npx vp check` on all changed files → pass (format + lint + types).
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Xplod13