@@ -18,7 +18,7 @@ import {
 } from './isr.ts';
 import { recordRequest, sendUsageEvent, type RequestType } from './metering.ts';
 import { applyRoutingRules, mergeQueryIntoLocation, type RedirectRule } from './routing-rules.ts';
-import { resolveStaticPath, resolveAssetContentType } from './static.ts';
+import { resolveStaticPath, resolveAssetContentType, safeDecodePathname } from './static.ts';
 import type { AssetConfig } from './static.ts';
 import { buildVariantOriginalUrl, type QueryAllowlist } from './variant-key.ts';
 
@@ -539,9 +539,20 @@ export default {
             cacheTtl: 86400,
           });
           const assetManifest: Record<string, string> = manifestRaw ? JSON.parse(manifestRaw) : {};
-          const hash = assetManifest[pathname];
+          // Manifest keys are decoded on-disk paths, but `pathname` stays
+          // percent-encoded. Try the raw key, then the decoded key (e.g. a
+          // hashed file named `oxc masthead.riv` requested as `oxc%20masthead.riv`).
+          let assetPath = pathname;
+          let hash = assetManifest[pathname];
+          if (!hash) {
+            const decoded = safeDecodePathname(pathname);
+            if (decoded !== pathname && assetManifest[decoded]) {
+              assetPath = decoded;
+              hash = assetManifest[decoded];
+            }
+          }
           const response = hash
-            ? ((await fetchStaticAsset(env, hash, pathname, routing.projectId)) ??
+            ? ((await fetchStaticAsset(env, hash, assetPath, routing.projectId)) ??
               createErrorResponse(request, 404, 'Not Found'))
             : createErrorResponse(request, 404, 'Not Found');
           if (response.ok && !isEventStreamResponse(response)) {
 
@@ -12,21 +12,88 @@ export type ResolvedAsset = Readonly<{
 }>;
 
 /**
- * Resolve a request pathname to a manifest entry using AssetConfig rules.
- * Replicates Cloudflare Workers Assets path resolution behavior.
+ * Percent-decode a request pathname for a manifest lookup, honoring ONLY the
+ * encodings a conformant URL is required to use. Returns the raw value
+ * unchanged on a malformed sequence (e.g. a lone `%`) or on any non-canonical /
+ * over-encoded spelling.
+ *
+ * Request pathnames arrive percent-encoded — WHATWG `URL.pathname` never
+ * decodes — but manifest keys are the asset's decoded on-disk path (a file
+ * named `oxc masthead.riv` is stored under `/assets/oxc masthead.riv`, not
+ * `%20`). Callers try the raw key first, then this decoded form.
+ *
+ * The decoded form is accepted only when re-encoding it reproduces the request
+ * path (up to percent-escape letter case) — i.e. the only encoded bytes were
+ * characters a URL MUST encode (space, `#`, non-ASCII, …). This rejects
+ * over-encoded spellings of ordinary path text (`%2F`→`/`, `%61`→`a`, `%5F`→`_`,
+ * `%2e%2e`→`..`), which a browser would never send and which would otherwise let
+ * a request reconstruct a guarded path (`/assets%2Fx`, `/%61ssets/x`,
+ * `/%5F%5Fvoid/x`) and serve the manifest entry while the raw-`url.pathname`
+ * policy gates — the `/__void/*` reserved-route block, the hashed-asset prefix
+ * gate, and the header/redirect rules — never fire. The URL pathname setter
+ * applies exactly the WHATWG "path percent-encode set", making it the canonical
+ * re-encoder.
+ *
+ * Known limitation: a file whose name contains a literal `%` (e.g. `logo%20.svg`,
+ * requested as `logo%2520.svg`) is not resolved — the path encoder leaves `%`
+ * as-is, so the round-trip can't reproduce the double-escaped request. Such
+ * names 404'd before this change too, so this is not a regression.
  */
-export function resolveStaticPath(
+export function safeDecodePathname(pathname: string): string {
+  let decoded: string;
+  try {
+    decoded = decodeURIComponent(pathname);
+  } catch {
+    return pathname;
+  }
+  if (decoded === pathname) {
+    return pathname;
+  }
+  const canonical = reencodePathname(decoded);
+  if (canonical === null) {
+    return pathname;
+  }
+  // Compare up to percent-escape letter case: the URL encoder emits upper-case
+  // (`%C3`), but a client may send lower-case (`%c3`), and both are valid.
+  return normalizePercentCase(canonical) === normalizePercentCase(pathname) ? decoded : pathname;
+}
+
+/** Uppercase the hex digits of every `%xx` escape so encodings compare equal
+ * regardless of the letter case a client used. */
+function normalizePercentCase(pathname: string): string {
+  return pathname.replace(/%[0-9a-fA-F]{2}/g, (escape) => escape.toUpperCase());
+}
+
+/**
+ * Serialize a decoded path back to a safe URL pathname via the WHATWG "path
+ * percent-encode set" (the `URL.pathname` setter). Returns null if the value
+ * can't be encoded. Used to canonicalize the decoded lookup key and to make a
+ * redirect Location URL-safe.
+ */
+function reencodePathname(pathname: string): string | null {
+  try {
+    const encoder = new URL('https://void.invalid/');
+    encoder.pathname = pathname;
+    return encoder.pathname;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Match a pathname against the manifest via exact match + html_handling rules
+ * (no not-found fallback). Returns null when nothing matches.
+ */
+function matchManifestEntry(
   pathname: string,
   manifest: Record<string, string>,
-  config: AssetConfig,
+  htmlHandling: NonNullable<AssetConfig['html_handling']>,
 ): ResolvedAsset | null {
   // Exact match always wins
   if (manifest[pathname]) {
     return { path: pathname, hash: manifest[pathname] };
   }
 
-  const htmlHandling = config.html_handling ?? 'auto-trailing-slash';
-
   switch (htmlHandling) {
     case 'auto-trailing-slash': {
       // Try appending .html first (preferred over /index.html)
@@ -91,6 +158,44 @@ export function resolveStaticPath(
       break;
   }
 
+  return null;
+}
+
+/**
+ * Resolve a request pathname to a manifest entry using AssetConfig rules.
+ * Replicates Cloudflare Workers Assets path resolution behavior.
+ */
+export function resolveStaticPath(
+  pathname: string,
+  manifest: Record<string, string>,
+  config: AssetConfig,
+): ResolvedAsset | null {
+  const htmlHandling = config.html_handling ?? 'auto-trailing-slash';
+
+  // Try the raw (percent-encoded) path first — the fast path, and it lets a
+  // filename that literally contains a `%` win. On a miss, retry with the
+  // decoded path so a file named e.g. `a b.txt` resolves for an `a%20b.txt`
+  // request (manifest keys are decoded on-disk paths).
+  let matched = matchManifestEntry(pathname, manifest, htmlHandling);
+  if (!matched) {
+    const decoded = safeDecodePathname(pathname);
+    if (decoded !== pathname) {
+      matched = matchManifestEntry(decoded, manifest, htmlHandling);
+      if (matched?.redirect !== undefined) {
+        // The Location was derived from the decoded path; serialize it back to
+        // a safe URL pathname (`/docs/a#b/` → `/docs/a%23b/`) so the client
+        // doesn't read `#`/space/etc. as URL structure.
+        const safeRedirect = reencodePathname(matched.redirect);
+        if (safeRedirect !== null) {
+          matched = { ...matched, redirect: safeRedirect };
+        }
+      }
+    }
+  }
+  if (matched) {
+    return matched;
+  }
+
   // Not found handling
   switch (config.not_found_handling ?? 'none') {
     case 'single-page-application':
 
@@ -2925,6 +2925,33 @@ describe('static deployment caching (KV/R2)', () => {
       'public, s-maxage=31536000, max-age=0, must-revalidate',
     );
   });
+
+  it('serves a hashed asset whose filename contains a space (%20-encoded request)', async () => {
+    // Regression: the oxc.rs hero `.riv` 404'd. The manifest key is the decoded
+    // on-disk path (literal space), but the browser requests it `%20`-encoded and
+    // `url.pathname` never decodes. Routing carries `hashedAssetsPrefix`, so the
+    // request hits the hashed-asset fast path — which must decode before the
+    // manifest lookup.
+    const { env } = createStaticDeployEnv({
+      routing: {
+        workerName: '',
+        projectId: 'proj-1',
+        staticDeploymentId: 'deploy-abc',
+        version: 'deploy-abc',
+        hashedAssetsPrefix: 'assets',
+      },
+      manifest: { '/assets/640_x_630_oxc masthead_.B7dLtkJB.riv': 'hash_riv' },
+      assets: { hash_riv: { body: 'RIVE-BYTES', contentType: 'application/octet-stream' } },
+    });
+
+    const res = await app.fetch(
+      new Request('https://test.void.app/assets/640_x_630_oxc%20masthead_.B7dLtkJB.riv'),
+      env,
+      createCtx(),
+    );
+    expect(res.status).toBe(200);
+    expect(await res.text()).toBe('RIVE-BYTES');
+  });
 });
 
 describe('static asset content-type normalization', () => {
 
@@ -169,6 +169,112 @@ describe('resolveStaticPath', () => {
       expect(resolveStaticPath('/unknown', manifest, config)).toBeNull();
     });
   });
+
+  describe('percent-encoded request paths', () => {
+    // Manifest keys are the asset's decoded on-disk path, but `url.pathname`
+    // arrives percent-encoded (WHATWG URL never decodes it). A filename with a
+    // space is stored as a literal space yet requested as `%20`, so the raw
+    // lookup misses. Regression: the oxc.rs hero `.riv` (a file literally named
+    // `640_x_630_oxc masthead_.B7dLtkJB.riv`) 404'd because `%20` != ' '.
+    const m: Record<string, string> = {
+      '/assets/640_x_630_oxc masthead_.B7dLtkJB.riv': 'hash_riv',
+      '/files/a#b.txt': 'hash_hash',
+    };
+
+    it('resolves a %20-encoded request to a literal-space manifest key', () => {
+      expect(
+        resolveStaticPath('/assets/640_x_630_oxc%20masthead_.B7dLtkJB.riv', m, {
+          html_handling: 'none',
+        }),
+      ).toEqual({ path: '/assets/640_x_630_oxc masthead_.B7dLtkJB.riv', hash: 'hash_riv' });
+    });
+
+    it('resolves other percent-encoded characters (e.g. %23 for #)', () => {
+      expect(resolveStaticPath('/files/a%23b.txt', m, { html_handling: 'none' })).toEqual({
+        path: '/files/a#b.txt',
+        hash: 'hash_hash',
+      });
+    });
+
+    it('still prefers an exact raw match over the decoded key', () => {
+      // A file whose name literally contains "%20" must win on the raw path.
+      const literal: Record<string, string> = {
+        '/x%20y.txt': 'raw_hit',
+        '/x y.txt': 'decoded_hit',
+      };
+      expect(resolveStaticPath('/x%20y.txt', literal, { html_handling: 'none' })).toEqual({
+        path: '/x%20y.txt',
+        hash: 'raw_hit',
+      });
+    });
+
+    it('does not throw on a malformed percent-sequence, just misses', () => {
+      expect(resolveStaticPath('/bad%2', m, { html_handling: 'none' })).toBeNull();
+    });
+
+    it('only honors decodings a conformant URL must encode (canonical-encoding guard)', () => {
+      // The decoded fallback must accept ONLY percent-encodings that a conformant
+      // URL is required to use (space, #, UTF-8, …). An over-encoded spelling of
+      // ordinary path text — %2F for '/', %61 for 'a', %5F for '_', %2e%2e for
+      // '..' — must be rejected: otherwise a request could reconstruct a guarded
+      // path (`/assets%2Fapp.js`, `/%61ssets/app.js`, `/%5F%5Fvoid/secret.js`)
+      // and serve the manifest entry while the raw-`url.pathname` policy gates
+      // — the `/__void/*` reserved-route block, the hashed-asset prefix gate,
+      // and the header/redirect rules — never fire.
+      const guarded: Record<string, string> = {
+        '/assets/app.js': 'hash_app',
+        '/__void/secret.js': 'hash_secret',
+      };
+      const cfg = { html_handling: 'none' } as const;
+      // encoded slash (both cases)
+      expect(resolveStaticPath('/assets%2Fapp.js', guarded, cfg)).toBeNull();
+      expect(resolveStaticPath('/assets%2fapp.js', guarded, cfg)).toBeNull();
+      expect(resolveStaticPath('/__void%2Fsecret.js', guarded, cfg)).toBeNull();
+      // over-encoded ordinary characters
+      expect(resolveStaticPath('/%61ssets/app.js', guarded, cfg)).toBeNull();
+      expect(resolveStaticPath('/%5F%5Fvoid/secret.js', guarded, cfg)).toBeNull();
+      // reconstructed dot-segments
+      expect(resolveStaticPath('/assets/%2e%2e/app.js', guarded, cfg)).toBeNull();
+    });
+
+    it('resolves a UTF-8 (non-ASCII) filename requested percent-encoded', () => {
+      const m: Record<string, string> = { '/assets/café.png': 'hash_cafe' };
+      // "café" → the é is C3 A9 in UTF-8
+      expect(resolveStaticPath('/assets/caf%C3%A9.png', m, { html_handling: 'none' })).toEqual({
+        path: '/assets/café.png',
+        hash: 'hash_cafe',
+      });
+    });
+
+    it('accepts lower-case percent escapes (browsers emit upper, but both are valid)', () => {
+      const m: Record<string, string> = { '/assets/café.png': 'hash_cafe' };
+      expect(resolveStaticPath('/assets/caf%c3%a9.png', m, { html_handling: 'none' })).toEqual({
+        path: '/assets/café.png',
+        hash: 'hash_cafe',
+      });
+    });
+
+    it('re-encodes a redirect Location produced from a decoded match', () => {
+      // force-trailing-slash: `/docs/a#b` (requested `%23`) is backed by
+      // `/docs/a#b/index.html`, so it redirects to the trailing-slash form. The
+      // Location must be URL-safe (`/docs/a%23b/`), not the decoded `/docs/a#b/`
+      // — otherwise the browser reads `#b/` as a fragment.
+      const m: Record<string, string> = { '/docs/a#b/index.html': 'hash_idx' };
+      expect(
+        resolveStaticPath('/docs/a%23b', m, { html_handling: 'force-trailing-slash' }),
+      ).toEqual({ path: '/docs/a#b/index.html', hash: 'hash_idx', redirect: '/docs/a%23b/' });
+    });
+
+    it('does not support a literal % in a filename (known limitation, not a regression)', () => {
+      // A file literally named `logo%20.svg` is requested as `logo%2520.svg`.
+      // decodeURIComponent yields the key, but re-encoding can't reproduce the
+      // double-escaped request (the URL path encoder leaves `%` alone), so it
+      // misses — same as before this change. Locked here so the behavior is
+      // intentional, not an accidental regression.
+      const m: Record<string, string> = { '/assets/logo%20.svg': 'hash_logo' };
+      expect(resolveStaticPath('/assets/logo%2520.svg', m, { html_handling: 'none' })).toBeNull();
+    });
+  });
 });
 
 describe('getContentType', () => {