vinext 1.0.0-beta.9 → 1.0.1

package/dist/server/cacheability-manifest.js

@@ -1,7 +1,10 @@
-import { NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERCEPTION_ID_HEADER, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_RSC_STATE_FINGERPRINT_HEADER } from "./headers.js";
+import { NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERCEPTION_ID_HEADER, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_RSC_STATE_FINGERPRINT_HEADER } from "./app-rsc-vary.js";
+import "./headers.js";
 import "./app-rsc-render-mode.js";
 //#region src/server/cacheability-manifest.ts
 const CACHEABILITY_MANIFEST_MODULE = "__vinext_cacheability_manifest.js";
+/** Request-stage projection of the manifest: the App page routes that can admit a query-free entry. */
+const CACHEABILITY_REQUEST_PROJECTION_MODULE = "__vinext_cacheability_request_projection.js";
 function cacheabilityManifestRouteKey(kind, pattern) {
 	return JSON.stringify([kind, pattern]);
 }
@@ -47,9 +50,10 @@ function parseRoute(key, value) {
 	const pathPrefix = typeof route.pathPrefix === "string" && route.pathPrefix.startsWith("/") && new URL(route.pathPrefix, "http://vinext.local").pathname === route.pathPrefix ? route.pathPrefix : void 0;
 	const runtimePaths = route.runtimePaths === void 0 ? void 0 : parsePathList(route.runtimePaths, pathPrefix);
 	const staticPaths = route.staticPaths === void 0 ? void 0 : parseStaticPaths(route.staticPaths, pathPrefix);
+	const runtimeRepresentationPaths = route.runtimeRepresentationPaths === void 0 ? void 0 : parseStaticPaths(route.runtimeRepresentationPaths, pathPrefix);
 	const staticRepresentation = isRepresentation(route.staticRepresentation) ? route.staticRepresentation : void 0;
 	const runtimeRepresentation = isRepresentation(route.runtimeRepresentation) ? route.runtimeRepresentation : void 0;
-	if (route.allowUnknown !== void 0 && route.allowUnknown !== true || route.unknownState !== void 0 && route.unknownState !== "static-candidate" || route.unknownState !== void 0 && route.allowUnknown !== true || route.pathPrefix !== void 0 && pathPrefix === void 0 || route.staticRepresentation !== void 0 && staticRepresentation === void 0 || route.runtimeRepresentation !== void 0 && runtimeRepresentation === void 0 || runtimeRepresentation !== void 0 && (route.state !== "runtime-check" || route.allowUnknown !== void 0 || pathPrefix !== void 0 || staticRepresentation !== void 0 || runtimePaths !== void 0 || staticPaths !== void 0) || staticRepresentation !== void 0 && (route.state !== "runtime-check" || /(^|\/):/.test(route.pattern) || runtimePaths !== void 0 || staticPaths !== void 0) || pathPrefix !== void 0 && !runtimePaths && !staticPaths || route.runtimePaths !== void 0 && !runtimePaths || route.staticPaths !== void 0 && !staticPaths || (runtimePaths || staticPaths || route.allowUnknown === true) && route.state !== "runtime-check") return null;
+	if (route.allowUnknown !== void 0 && route.allowUnknown !== true || route.unknownState !== void 0 && route.unknownState !== "static-candidate" || route.unknownState !== void 0 && route.allowUnknown !== true || route.pathPrefix !== void 0 && pathPrefix === void 0 || route.staticRepresentation !== void 0 && staticRepresentation === void 0 || route.runtimeRepresentation !== void 0 && runtimeRepresentation === void 0 || runtimeRepresentation !== void 0 && (route.state !== "runtime-check" || route.allowUnknown !== void 0 || pathPrefix !== void 0 || staticRepresentation !== void 0 || runtimePaths !== void 0 || staticPaths !== void 0 || runtimeRepresentationPaths !== void 0) || staticRepresentation !== void 0 && (route.state !== "runtime-check" || /(^|\/):/.test(route.pattern) || runtimePaths !== void 0 || staticPaths !== void 0 || runtimeRepresentationPaths !== void 0) || pathPrefix !== void 0 && !runtimePaths && !staticPaths && !runtimeRepresentationPaths || route.runtimePaths !== void 0 && !runtimePaths || route.staticPaths !== void 0 && !staticPaths || route.runtimeRepresentationPaths !== void 0 && !runtimeRepresentationPaths || (runtimePaths || staticPaths || runtimeRepresentationPaths || route.allowUnknown === true) && route.state !== "runtime-check") return null;
 	const parsed = {
 		kind: route.kind,
 		pattern: route.pattern,
@@ -60,13 +64,14 @@ function parseRoute(key, value) {
 		...runtimeRepresentation ? { runtimeRepresentation } : {},
 		...staticRepresentation ? { staticRepresentation } : {},
 		...runtimePaths ? { runtimePaths } : {},
+		...runtimeRepresentationPaths ? { runtimeRepresentationPaths } : {},
 		...staticPaths ? { staticPaths } : {}
 	};
-	const observedPaths = /* @__PURE__ */ new Set();
-	for (const tokens of [runtimePaths, ...Object.values(staticPaths ?? {})]) for (const token of tokens ?? []) {
-		const pathname = expandPathToken(pathPrefix, token);
-		if (observedPaths.has(pathname)) return null;
-		observedPaths.add(pathname);
+	const runtimePathSet = new Set((runtimePaths ?? []).map((token) => expandPathToken(pathPrefix, token)));
+	for (const tokens of Object.values(staticPaths ?? {})) for (const token of tokens ?? []) if (runtimePathSet.has(expandPathToken(pathPrefix, token))) return null;
+	for (const [representation, tokens] of Object.entries(runtimeRepresentationPaths ?? {})) {
+		const staticTokens = new Set(staticPaths?.[representation]);
+		for (const token of tokens ?? []) if (runtimePathSet.has(expandPathToken(pathPrefix, token)) || staticTokens.has(token)) return null;
 	}
 	return key === cacheabilityManifestRouteKey(parsed.kind, parsed.pattern) ? parsed : null;
 }
@@ -100,11 +105,15 @@ const CONTEXTUAL_RSC_HEADERS = [
 	VINEXT_MOUNTED_SLOTS_HEADER,
 	VINEXT_RSC_STATE_FINGERPRINT_HEADER
 ];
-function cacheabilityRequestIdentity(request) {
+function cacheabilityRequestIdentity(request, trustedRepresentation) {
 	if (request.method !== "GET" && request.method !== "HEAD") return null;
 	if (request.headers.has("next-action") || request.headers.has("x-rsc-action")) return null;
 	const url = new URL(request.url);
 	const requestKey = `${url.pathname}${url.search}`;
+	if (trustedRepresentation) return {
+		representation: trustedRepresentation,
+		requestKey
+	};
 	if (/(?:^|\/)_next\/data\/[^/]+\/.+\.json$/.test(url.pathname)) return {
 		representation: "pages-data",
 		requestKey
@@ -176,7 +185,8 @@ function cacheabilityManifestRouteState(route, routePathname, representation) {
 	if (representation && includesPath(route.staticPaths?.[representation])) return "static-candidate";
 	if (representation && route.staticRepresentation === representation) return "static-candidate";
 	if (route.runtimeRepresentation !== void 0) return representation === route.runtimeRepresentation ? route.state : null;
-	if (!route.staticPaths && !route.runtimePaths && route.allowUnknown !== true) return route.state;
+	if (representation && includesPath(route.runtimeRepresentationPaths?.[representation])) return route.state;
+	if (!route.staticPaths && !route.runtimePaths && !route.runtimeRepresentationPaths && route.allowUnknown !== true) return route.state;
 	if (includesPath(route.runtimePaths)) return route.state;
 	if (route.staticPaths) {
 		for (const paths of Object.values(route.staticPaths)) if (includesPath(paths)) return route.state;
@@ -187,5 +197,45 @@ function cacheabilityManifestRouteState(route, routePathname, representation) {
 function findCacheabilityManifestRoute(manifest, kind, pattern) {
 	return manifest.routes[cacheabilityManifestRouteKey(kind, pattern)] ?? null;
 }
+function resolveCacheabilityRepresentation(representation, routeKind) {
+	if (representation !== "html" && representation !== "app-route") return representation;
+	return routeKind === "app-route" || routeKind === "pages-api" ? "app-route" : "html";
+}
+/** Whether completed-response admission can store a page route under this representation. */
+function cacheabilityRepresentationMatchesPageRoute(routeKind, representation) {
+	return routeKind === "app-page" ? representation === "html" || representation === "rsc-full" || representation === "rsc-loading-shell" : representation === "html" || representation === "pages-data";
+}
+/**
+* The manifest state completed-response admission gives a page request, or
+* null when admission refuses it. `requestRepresentation` is the request
+* identity's, and `routePathname` is built from the resolved pathname with
+* `cacheabilityRoutePathname`, as admission builds it. The Workers Cache
+* request stage decides its query-free dispatch with this same function, so
+* the dispatch and admission always see the same state.
+*/
+function cacheabilityManifestPageState(manifest, route, requestRepresentation, routePathname) {
+	const representation = resolveCacheabilityRepresentation(requestRepresentation, route.kind);
+	if (!cacheabilityRepresentationMatchesPageRoute(route.kind, representation)) return null;
+	const manifestRoute = findCacheabilityManifestRoute(manifest, route.kind, route.pattern);
+	return manifestRoute ? cacheabilityManifestRouteState(manifestRoute, routePathname, representation) : null;
+}
+/** Whether any path or representation of a route can resolve to `static-candidate`. */
+function canResolveStaticCandidate(route) {
+	return route.state === "static-candidate" || route.unknownState === "static-candidate" || route.staticRepresentation !== void 0 || route.staticPaths !== void 0;
+}
+/**
+* Project the manifest onto the Workers Cache request stage, which strips the
+* query from App page dispatches whose manifest state is `static-candidate`.
+* The projection keeps every App page route record that can resolve to that
+* state, unchanged, so a lookup against it returns `static-candidate` exactly
+* when the full manifest does. Every other route is left out.
+*/
+function projectCacheabilityManifestForRequestStage(manifest) {
+	return {
+		buildId: manifest.buildId,
+		routes: Object.fromEntries(Object.entries(manifest.routes).filter(([, route]) => route.kind === "app-page" && canResolveStaticCandidate(route))),
+		version: 1
+	};
+}
 //#endregion
-export { CACHEABILITY_MANIFEST_MODULE, cacheabilityManifestRouteKey, cacheabilityManifestRouteState, cacheabilityRequestIdentity, cacheabilityRoutePathname, findCacheabilityManifestRoute, normalizeCacheabilityRoutePathname, parseCacheabilityManifest };
+export { CACHEABILITY_MANIFEST_MODULE, CACHEABILITY_REQUEST_PROJECTION_MODULE, cacheabilityManifestPageState, cacheabilityManifestRouteKey, cacheabilityManifestRouteState, cacheabilityRepresentationMatchesPageRoute, cacheabilityRequestIdentity, cacheabilityRoutePathname, findCacheabilityManifestRoute, normalizeCacheabilityRoutePathname, parseCacheabilityManifest, projectCacheabilityManifestForRequestStage, resolveCacheabilityRepresentation };

package/dist/server/cacheability-request.d.ts

@@ -1,7 +1,37 @@
+import { CacheabilityRepresentation, CacheabilityRouteKind } from "./cacheability-manifest.js";
 import { ExecutionContextLike } from "../shims/request-context.js";
 //#region src/server/cacheability-request.d.ts
-declare function createWorkerCacheabilityContext(base: ExecutionContextLike, request: Request, expectedSecret: string | null | undefined, responseVary?: "verbatim"): ExecutionContextLike;
-declare function createWorkerCacheabilityAdmissionContext(base: ExecutionContextLike, request: Request, rawManifest: string | null | undefined, buildId: string | null | undefined, requiresCompletedResponseAdmission?: boolean, responseVary?: "verbatim"): ExecutionContextLike;
+export type WorkerCacheabilityProbeMode = "identity" | "probe";
+export type WorkerCacheabilityProbeRoute = {
+  kind: CacheabilityRouteKind;
+  pattern: string;
+};
+/** Encode the trusted route identity carried by a staged probe request. */
+export declare function serializeWorkerCacheabilityProbeRoute(route: WorkerCacheabilityProbeRoute): string;
+/** Read route identity only after the surrounding probe request is authenticated. */
+export declare function readWorkerCacheabilityProbeRoute(request: Request): WorkerCacheabilityProbeRoute | null;
+/** Authenticate and read the cacheability probe mode before internal headers are filtered. */
+export declare function readWorkerCacheabilityProbeMode(request: Request, expectedSecret: string | null | undefined): WorkerCacheabilityProbeMode | null;
+/** Create probe state from a mode that was authenticated at the request boundary. */
+export declare function createWorkerCacheabilityProbeContext(base: ExecutionContextLike, mode: WorkerCacheabilityProbeMode, responseVary?: "verbatim", resolvedRoutePathname?: string): ExecutionContextLike;
+export declare function createWorkerCacheabilityContext(base: ExecutionContextLike, request: Request, expectedSecret: string | null | undefined, responseVary?: "verbatim"): ExecutionContextLike;
+export declare function createWorkerCacheabilityAdmissionContext(base: ExecutionContextLike, request: Request, rawManifest: string | null | undefined, buildId: string | null | undefined, requiresCompletedResponseAdmission?: boolean, responseVary?: "verbatim", resolvedRoutePathname?: string, trustedRepresentation?: CacheabilityRepresentation, options?: {
+  applyCompletedResponsePolicy?: boolean;
+}): ExecutionContextLike;
+/** Apply request-stage-vetted positive config policy inside the admission boundary. */
+export declare function applyResponseStageCachePolicy(response: Response, ctx: ExecutionContextLike, policyHeaders: ReadonlyArray<readonly [string, string]> | null | undefined): Response;
+/** Record policy that a renderer applied before producing its response. */
+export declare function recordResponseStageCachePolicy(ctx: ExecutionContextLike, policyHeaders: ReadonlyArray<readonly [string, string]> | null | undefined): void;
+/**
+ * Convert an authenticated probe that terminated in request routing into a
+ * valid identity-scoped dynamic result. Middleware redirects, custom responses,
+ * and external rewrites never reach the reusable response stage.
+ */
+export declare function finalizeRequestStageCacheabilityProbe(response: Response, options: {
+  mode: WorkerCacheabilityProbeMode | null;
+  responseStageDispatched: boolean;
+  route: WorkerCacheabilityProbeRoute | null;
+}): Response;
 type CapturedAdmissionBody = {
   body: ReadableStream<Uint8Array> | null;
   kind: "captured";
@@ -9,12 +39,11 @@ type CapturedAdmissionBody = {
   body: ReadableStream<Uint8Array>;
   kind: "fallback";
 };
-type CacheabilityAdmissionCaptureBudget = {
+export type CacheabilityAdmissionCaptureBudget = {
   maxBytes: number;
   reservedBytes: number;
 };
-declare function createCacheabilityAdmissionCaptureBudget(maxBytes: number): CacheabilityAdmissionCaptureBudget;
-declare function captureCacheabilityAdmissionBody(body: ReadableStream<Uint8Array> | null, deadlineAt: number, limit?: number, budget?: CacheabilityAdmissionCaptureBudget): Promise<CapturedAdmissionBody>;
-declare function finalizeWorkerCacheabilityResponse(response: Response, ctx: ExecutionContextLike): Promise<Response>;
-//#endregion
-export { CacheabilityAdmissionCaptureBudget, captureCacheabilityAdmissionBody, createCacheabilityAdmissionCaptureBudget, createWorkerCacheabilityAdmissionContext, createWorkerCacheabilityContext, finalizeWorkerCacheabilityResponse };
+export declare function createCacheabilityAdmissionCaptureBudget(maxBytes: number): CacheabilityAdmissionCaptureBudget;
+export declare function captureCacheabilityAdmissionBody(body: ReadableStream<Uint8Array> | null, deadlineAt: number, limit?: number, budget?: CacheabilityAdmissionCaptureBudget): Promise<CapturedAdmissionBody>;
+export declare function finalizeWorkerCacheabilityResponse(response: Response, ctx: ExecutionContextLike): Promise<Response>;
+//#endregion

package/dist/server/cacheability-request.js

@@ -1,30 +1,62 @@
 import "../utils/protocol-headers.js";
-import { VINEXT_CACHEABILITY_PROBE_HEADER, VINEXT_RSC_VARY_HEADER } from "./headers.js";
+import { isVinextRscVaryField } from "./app-rsc-vary.js";
+import { VINEXT_CACHEABILITY_PROBE_HEADER, VINEXT_CACHEABILITY_PROBE_ROUTE_HEADER } from "./headers.js";
 import { isNonCacheableCacheControl } from "../shims/cdn-cache.js";
-import { NO_STORE_CACHE_CONTROL, applyCdnResponseBuildIdentityHeaders, applyCdnResponseHeaders, hasExplicitNonCacheableResponsePolicy } from "./cache-control.js";
-import { cacheabilityManifestRouteState, cacheabilityRequestIdentity, cacheabilityRoutePathname, findCacheabilityManifestRoute, parseCacheabilityManifest } from "./cacheability-manifest.js";
-import { CACHEABILITY_POLICY_HEADERS, CACHEABILITY_REQUEST_STATE } from "../shims/cacheability-classification.js";
-import { CACHEABILITY_ADMISSION_ISOLATE_BODY_LIMIT, CACHEABILITY_ADMISSION_RESPONSE_BODY_LIMIT, CACHEABILITY_PROBE_TIMEOUT_MS } from "./cacheability-limits.js";
+import { CACHEABILITY_REQUEST_STATE, recordConfigCdnCachePolicyHeader } from "../shims/cacheability-classification.js";
+import { NO_STORE_CACHE_CONTROL, applyCdnResponseBuildIdentityHeaders, applyCdnResponseHeaders, hasExplicitNonCacheableResponsePolicy, isCdnResponsePolicyHeader, readCdnResponseCacheControl, readCdnResponsePolicyHeaderName } from "./cache-control.js";
+import { cacheabilityManifestPageState, cacheabilityManifestRouteState, cacheabilityRepresentationMatchesPageRoute, cacheabilityRequestIdentity, cacheabilityRoutePathname, findCacheabilityManifestRoute, parseCacheabilityManifest, resolveCacheabilityRepresentation } from "./cacheability-manifest.js";
 import { workerCapabilityMatches } from "./worker-prerender-discovery.js";
+import { CACHEABILITY_ADMISSION_ISOLATE_BODY_LIMIT, CACHEABILITY_ADMISSION_RESPONSE_BODY_LIMIT, CACHEABILITY_PROBE_TIMEOUT_MS } from "./cacheability-limits.js";
+import { applyResponseStagePolicyHeaders } from "./response-stage-policy.js";
 //#region src/server/cacheability-request.ts
-const FRAMEWORK_CACHEABILITY_VARY_FIELDS = new Set(VINEXT_RSC_VARY_HEADER.split(",").map((name) => name.trim().toLowerCase()));
 function cacheabilityVaryRejectionReason(headers, state) {
 	const fields = (headers.get("Vary") ?? "").split(",").map((name) => name.trim().toLowerCase()).filter(Boolean);
 	if (fields.includes("*")) return "response uses Vary: *";
 	if (state.responseVary === "verbatim") return null;
-	return fields.some((name) => !FRAMEWORK_CACHEABILITY_VARY_FIELDS.has(name)) ? "response cache does not support custom Vary fields" : null;
+	return fields.some((name) => !isVinextRscVaryField(name)) ? "response cache does not support custom Vary fields" : null;
 }
-function createWorkerCacheabilityContext(base, request, expectedSecret, responseVary) {
+/** Encode the trusted route identity carried by a staged probe request. */
+function serializeWorkerCacheabilityProbeRoute(route) {
+	return encodeURIComponent(JSON.stringify([route.kind, route.pattern]));
+}
+/** Read route identity only after the surrounding probe request is authenticated. */
+function readWorkerCacheabilityProbeRoute(request) {
+	const raw = request.headers.get(VINEXT_CACHEABILITY_PROBE_ROUTE_HEADER);
+	if (!raw) return null;
+	try {
+		const value = JSON.parse(decodeURIComponent(raw));
+		if (!Array.isArray(value) || value.length !== 2) return null;
+		const [kind, pattern] = value;
+		if (kind !== "app-page" && kind !== "app-route" && kind !== "pages-page" || typeof pattern !== "string" || !pattern.startsWith("/")) return null;
+		return {
+			kind,
+			pattern
+		};
+	} catch {
+		return null;
+	}
+}
+/** Authenticate and read the cacheability probe mode before internal headers are filtered. */
+function readWorkerCacheabilityProbeMode(request, expectedSecret) {
 	const requestedMode = request.headers.get(VINEXT_CACHEABILITY_PROBE_HEADER);
-	if (requestedMode !== "1" && requestedMode !== "identity") return base;
-	if (!expectedSecret || !workerCapabilityMatches(request.headers.get("x-vinext-prerender-secret") ?? "", expectedSecret)) return base;
+	if (requestedMode !== "1" && requestedMode !== "identity") return null;
+	if (!expectedSecret || !workerCapabilityMatches(request.headers.get("x-vinext-prerender-secret") ?? "", expectedSecret)) return null;
+	return requestedMode === "identity" ? "identity" : "probe";
+}
+/** Create probe state from a mode that was authenticated at the request boundary. */
+function createWorkerCacheabilityProbeContext(base, mode, responseVary, resolvedRoutePathname) {
 	const state = {
 		captureDeadlineAt: Date.now() + CACHEABILITY_PROBE_TIMEOUT_MS,
-		mode: requestedMode === "identity" ? "identity" : "probe",
-		responseVary
+		mode,
+		responseVary,
+		resolvedRoutePathname
 	};
 	return Object.assign(Object.create(Object.getPrototypeOf(base)), base, { [CACHEABILITY_REQUEST_STATE]: state });
 }
+function createWorkerCacheabilityContext(base, request, expectedSecret, responseVary) {
+	const mode = readWorkerCacheabilityProbeMode(request, expectedSecret);
+	return mode ? createWorkerCacheabilityProbeContext(base, mode, responseVary) : base;
+}
 let cachedManifest;
 function readBoundManifest(raw, buildId) {
 	if (cachedManifest?.raw === raw && cachedManifest.buildId === buildId) return cachedManifest.manifest;
@@ -36,18 +68,22 @@ function readBoundManifest(raw, buildId) {
 	};
 	return manifest;
 }
-function createWorkerCacheabilityAdmissionContext(base, request, rawManifest, buildId, requiresCompletedResponseAdmission = rawManifest != null, responseVary) {
-	const identity = cacheabilityRequestIdentity(request);
+function createWorkerCacheabilityAdmissionContext(base, request, rawManifest, buildId, requiresCompletedResponseAdmission = rawManifest != null, responseVary, resolvedRoutePathname, trustedRepresentation, options) {
+	const identity = cacheabilityRequestIdentity(request, trustedRepresentation);
+	const credentialedRequest = request.headers.has("authorization") || request.headers.has("cookie") || request.headers.has("proxy-authorization");
+	const routePathname = identity ? cacheabilityRoutePathname(resolvedRoutePathname ?? new URL(request.url).pathname, identity.representation) : void 0;
 	if (!rawManifest) {
 		if (!requiresCompletedResponseAdmission) return base;
 		const state = {
 			admission: identity ? {
 				policy: "runtime",
 				...identity,
-				routePathname: cacheabilityRoutePathname(new URL(request.url).pathname, identity.representation)
+				routePathname
 			} : { policy: "deny" },
 			captureDeadlineAt: Date.now() + CACHEABILITY_PROBE_TIMEOUT_MS,
+			credentialedRequest,
 			mode: "admit",
+			applyCompletedResponsePolicy: options?.applyCompletedResponsePolicy,
 			responseVary
 		};
 		return Object.assign(Object.create(Object.getPrototypeOf(base)), base, { [CACHEABILITY_REQUEST_STATE]: state });
@@ -58,10 +94,12 @@ function createWorkerCacheabilityAdmissionContext(base, request, rawManifest, bu
 			manifest,
 			policy: "manifest",
 			...identity,
-			routePathname: cacheabilityRoutePathname(new URL(request.url).pathname, identity.representation)
+			routePathname
 		} : { policy: "deny" },
 		captureDeadlineAt: Date.now() + CACHEABILITY_PROBE_TIMEOUT_MS,
+		credentialedRequest,
 		mode: "admit",
+		applyCompletedResponsePolicy: options?.applyCompletedResponsePolicy,
 		responseVary
 	};
 	return Object.assign(Object.create(Object.getPrototypeOf(base)), base, { [CACHEABILITY_REQUEST_STATE]: state });
@@ -69,13 +107,45 @@ function createWorkerCacheabilityAdmissionContext(base, request, rawManifest, bu
 function readState(ctx) {
 	return Reflect.get(ctx, CACHEABILITY_REQUEST_STATE) ?? null;
 }
-function probeResponse(state, routeState, outcome, status, rendererStatic) {
+/** Apply request-stage-vetted positive config policy inside the admission boundary. */
+function applyResponseStageCachePolicy(response, ctx, policyHeaders) {
+	if (!policyHeaders?.length) return response;
+	recordConfigCachePolicy(readState(ctx), policyHeaders);
+	try {
+		applyResponseStagePolicyHeaders(response.headers, policyHeaders);
+		return response;
+	} catch {
+		const headers = new Headers(response.headers);
+		applyResponseStagePolicyHeaders(headers, policyHeaders);
+		return new Response(response.body, {
+			headers,
+			status: response.status,
+			statusText: response.statusText
+		});
+	}
+}
+/** Record policy that a renderer applied before producing its response. */
+function recordResponseStageCachePolicy(ctx, policyHeaders) {
+	if (!policyHeaders?.length) return;
+	recordConfigCachePolicy(readState(ctx), policyHeaders);
+}
+function recordConfigCachePolicy(state, policyHeaders) {
+	if (!state) return;
+	state.explicitConfigCachePolicy = true;
+	for (const [name, value] of policyHeaders) if (isCdnResponsePolicyHeader(name)) recordConfigCdnCachePolicyHeader(state, name, value);
+}
+function probeResponse(state, routeState, outcome, status, renderer) {
+	const dynamicUsage = renderer?.dynamicUsage === true || outcome.dynamicUsage === true || state.patternDynamicReason !== void 0;
 	const body = {
 		cacheControl: outcome.cacheControl,
+		...dynamicUsage ? { dynamicUsage: true } : {},
+		...state.explicitConfigCachePolicy ? { explicitConfigCachePolicy: true } : {},
 		kind: state.route?.kind,
 		pattern: state.route?.pattern,
 		reason: outcome.reason,
-		...rendererStatic !== void 0 ? { rendererStatic } : {},
+		...renderer ? { rendererStatic: renderer.static } : {},
+		...outcome.retryable ? { retryable: true } : {},
+		...state.resolvedRoutePathname ? { routePathname: state.resolvedRoutePathname } : {},
 		...routeState === "dynamic" ? { scope: state.patternDynamicReason ? "pattern" : "identity" } : {},
 		state: routeState,
 		status,
@@ -83,6 +153,26 @@ function probeResponse(state, routeState, outcome, status, rendererStatic) {
 	};
 	return applyCdnResponseBuildIdentityHeaders(Response.json(body, { headers: { "Cache-Control": NO_STORE_CACHE_CONTROL } }));
 }
+/**
+* Convert an authenticated probe that terminated in request routing into a
+* valid identity-scoped dynamic result. Middleware redirects, custom responses,
+* and external rewrites never reach the reusable response stage.
+*/
+function finalizeRequestStageCacheabilityProbe(response, options) {
+	if (!options.mode || options.responseStageDispatched || !options.route) return response;
+	response.body?.cancel().catch(() => {});
+	const body = {
+		kind: options.route.kind,
+		pattern: options.route.pattern,
+		reason: "request routing completed without response-stage rendering",
+		scope: "identity",
+		state: "dynamic",
+		status: response.status,
+		terminal: true,
+		version: 1
+	};
+	return applyCdnResponseBuildIdentityHeaders(Response.json(body, { headers: { "Cache-Control": NO_STORE_CACHE_CONTROL } }));
+}
 async function drainProbeBody(response, deadlineAt) {
 	if (!response.body) return null;
 	const reader = response.body.getReader();
@@ -258,46 +348,41 @@ async function captureCacheabilityAdmissionBody(body, deadlineAt, limit = CACHEA
 		throw error;
 	}
 }
-function responseWithCachePolicy(response, body, outcome) {
+function responseWithCachePolicy(response, body, outcome, browserCacheControl) {
 	const headers = new Headers(response.headers);
+	if (typeof body === "string") headers.delete("Content-Length");
 	applyCdnResponseHeaders(headers, outcome?.cacheable === true && outcome.cacheControl ? {
 		cacheControl: outcome.cacheControl,
-		tags: outcome.tags
-	} : { cacheControl: NO_STORE_CACHE_CONTROL });
+		tags: outcome.tags,
+		browserCacheControl
+	} : {
+		cacheControl: NO_STORE_CACHE_CONTROL,
+		browserCacheControl
+	});
 	return new Response(body, {
 		headers,
 		status: response.status,
 		statusText: response.statusText
 	});
 }
-function inferFinalAppPageCacheability(response, state) {
-	if (!state.explicitConfigCachePolicy && !state.frameworkResponseCachePolicy) return null;
-	const changedPolicy = [
-		"cloudflare-cdn-cache-control",
-		"cdn-cache-control",
-		"cache-control"
-	].find((name) => {
-		const value = response.headers.get(name);
-		return value !== null && (state.explicitConfigCachePolicy || value !== state.frameworkResponseCachePolicy?.[name]);
-	});
-	if (!changedPolicy) return null;
-	const cacheControl = response.headers.get(changedPolicy);
-	if (isNonCacheableCacheControl(cacheControl)) return { cacheable: false };
-	const cacheTag = response.headers.get("Cache-Tag");
-	return {
-		cacheable: true,
-		cacheControl,
-		...cacheTag ? { tags: cacheTag.split(",").map((tag) => tag.trim()).filter(Boolean) } : {}
-	};
+async function stripSharedHtmlClientTraceMetadata(body, marker) {
+	if (!body) return null;
+	const html = await new Response(body).text();
+	const { stripClientTraceMetadataBlock } = await import("./client-trace-metadata.js");
+	return stripClientTraceMetadataBlock(html, marker);
 }
-function inferPagesPageCacheability(response) {
-	const cacheControl = response.headers.get("Cloudflare-CDN-Cache-Control") ?? response.headers.get("CDN-Cache-Control") ?? response.headers.get("Cache-Control");
-	if (!cacheControl || isNonCacheableCacheControl(cacheControl)) return { cacheable: false };
-	const cacheTag = response.headers.get("Cache-Tag");
-	return {
+/** Only an explicitly authored provider policy may override framework storage. */
+function explicitProviderOutcome(response, state) {
+	const name = readCdnResponsePolicyHeaderName(response.headers);
+	if (!name || name === "cache-control") return null;
+	const value = response.headers.get(name);
+	if (!(state.explicitResponseCachePolicy || state.configCdnCachePolicy?.get(name) === value || state.frameworkResponseCachePolicy && state.frameworkResponseCachePolicy.get(name) !== value) || !value) return null;
+	const cacheControl = readCdnResponseCacheControl(response.headers);
+	if (!cacheControl) return null;
+	return isNonCacheableCacheControl(cacheControl) ? { cacheable: false } : {
 		cacheable: true,
 		cacheControl,
-		...cacheTag ? { tags: cacheTag.split(",").map((tag) => tag.trim()).filter(Boolean) } : {}
+		...state.cdnCacheTags ? { tags: state.cdnCacheTags } : {}
 	};
 }
 function completedRouteOutcome(response, state, rendererOutcome = state.outcome ?? null) {
@@ -310,18 +395,17 @@ function completedRouteOutcome(response, state, rendererOutcome = state.outcome
 		cacheable: false,
 		reason: varyRejectionReason
 	};
-	if (state.route?.kind === "app-route") {
-		if (response.headers.has("set-cookie")) return {
-			cacheable: false,
-			reason: "response sets a cookie"
-		};
-		return inferPagesPageCacheability(response);
-	}
-	if (state.route?.kind === "app-page") return inferFinalAppPageCacheability(response, state) ?? rendererOutcome;
-	if (state.route?.kind !== "pages-page") return rendererOutcome;
-	if (response.headers.has("set-cookie") || hasExplicitNonCacheableResponsePolicy(response.headers)) return { cacheable: false };
-	const responseOutcome = inferPagesPageCacheability(response);
-	return responseOutcome.cacheable ? responseOutcome : rendererOutcome ?? responseOutcome;
+	if (response.headers.has("set-cookie")) return {
+		cacheable: false,
+		reason: "response sets a cookie"
+	};
+	if (rendererOutcome?.dynamicUsage) return rendererOutcome;
+	const outcome = explicitProviderOutcome(response, state) ?? rendererOutcome;
+	const tags = outcome?.tags ?? rendererOutcome?.tags ?? state.cdnCacheTags;
+	return outcome && tags && outcome.tags !== tags ? {
+		...outcome,
+		tags
+	} : outcome;
 }
 function staticToDynamicResponse(route) {
 	const headers = new Headers({ "Content-Type": "text/plain; charset=utf-8" });
@@ -340,68 +424,82 @@ function cacheabilityEvaluationFailureResponse(pattern) {
 	});
 }
 function hasStrictFinalResponseVeto(response, state) {
-	if (state.finalResponseVetoReason || response.headers.has("set-cookie")) return true;
-	for (const name of CACHEABILITY_POLICY_HEADERS) {
-		const value = response.headers.get(name);
-		if (value !== null && value !== state.frameworkResponseCachePolicy?.[name] && isNonCacheableCacheControl(value)) return true;
-	}
-	return false;
+	const providerHeaders = new Headers(response.headers);
+	providerHeaders.delete("Cache-Control");
+	return Boolean(state.finalResponseVetoReason || response.headers.has("set-cookie") || hasExplicitNonCacheableResponsePolicy(providerHeaders, state.frameworkResponseCachePolicy));
 }
 async function finalizeWorkerCacheabilityAdmission(response, state) {
 	if (state.preserveResponseCachePolicy) return response;
+	const browserCacheControl = state.explicitResponseCachePolicy || state.configCdnCachePolicy?.has("cache-control") || state.route?.kind === "pages-api" || state.route?.kind === "pages-page" && state.outcome?.cacheable !== true ? response.headers.get("Cache-Control") ?? void 0 : void 0;
 	const admission = state.admission;
-	if (state.route?.kind === "app-route") {
+	if (state.route?.kind === "app-route" || state.route?.kind === "pages-api") {
 		let manifestRoute = null;
-		const hasExplicitRuntimePolicy = state.explicitResponseCachePolicy === true || state.explicitConfigCachePolicy === true;
-		if (!admission || admission.policy === "deny" || !admission.representation || !admission.requestKey) return responseWithCachePolicy(response, response.body, null);
-		if (admission.policy === "manifest") {
+		const responseOutcome = completedRouteOutcome(response, state);
+		const representation = admission?.representation ? resolveCacheabilityRepresentation(admission.representation, state.route.kind) : null;
+		const hasExplicitRuntimePolicy = responseOutcome?.cacheable === true;
+		if (!admission || admission.policy === "deny" || !representation || !admission.requestKey) return responseWithCachePolicy(response, response.body, null, browserCacheControl);
+		if (admission.policy === "manifest" && state.route.kind === "app-route") {
 			const manifest = admission.manifest;
 			manifestRoute = findCacheabilityManifestRoute(manifest, state.route.kind, state.route.pattern);
 		}
-		const isManifestAuthorized = manifestRoute !== null && admission.routePathname !== void 0 && cacheabilityManifestRouteState(manifestRoute, admission.routePathname, admission.representation) !== null;
+		const isManifestAuthorized = manifestRoute !== null && admission.routePathname !== void 0 && cacheabilityManifestRouteState(manifestRoute, admission.routePathname, representation) !== null;
 		const canUseBoundedRuntimeAdmission = hasExplicitRuntimePolicy && (admission.policy === "runtime" || admission.policy === "manifest" && !isManifestAuthorized);
-		if (!isManifestAuthorized && !canUseBoundedRuntimeAdmission || response.status >= 500 || state.forcedDynamicReason || hasStrictFinalResponseVeto(response, state) || cacheabilityVaryRejectionReason(response.headers, state) !== null) return responseWithCachePolicy(response, response.body, null);
-		const outcome = inferPagesPageCacheability(response);
-		if (!outcome.cacheable || !outcome.cacheControl) return responseWithCachePolicy(response, response.body, null);
-		if (state.completedResponseBody) return response;
+		if (!isManifestAuthorized && !canUseBoundedRuntimeAdmission || response.status >= 500 || state.credentialedRequest || state.forcedDynamicReason || hasStrictFinalResponseVeto(response, state) || cacheabilityVaryRejectionReason(response.headers, state) !== null) return responseWithCachePolicy(response, response.body, null, browserCacheControl);
+		const outcome = responseOutcome;
+		if (state.completedResponseBody) {
+			if (!outcome?.cacheable || !outcome.cacheControl) return responseWithCachePolicy(response, response.body, null, browserCacheControl);
+			if (!state.applyCompletedResponsePolicy) return response;
+			return responseWithCachePolicy(response, response.body, outcome, browserCacheControl);
+		}
 		let captured;
 		try {
 			captured = await captureCacheabilityAdmissionBody(response.body, state.captureDeadlineAt, CACHEABILITY_ADMISSION_RESPONSE_BODY_LIMIT, state.captureBudget ?? isolateCaptureBudget);
 		} catch {
 			return cacheabilityEvaluationFailureResponse(state.route.pattern);
 		}
-		if (captured.kind === "fallback") return responseWithCachePolicy(response, captured.body, null);
-		return responseWithCachePolicy(response, captured.body, outcome);
+		if (captured.kind === "fallback") return responseWithCachePolicy(response, captured.body, null, browserCacheControl);
+		return responseWithCachePolicy(response, captured.body, outcome, browserCacheControl);
 	}
-	if (!admission || admission.policy === "deny" || !admission.representation || !admission.requestKey || !state.route || response.status >= 500) return responseWithCachePolicy(response, response.body, null);
-	if (!(state.route.kind === "app-page" ? admission.representation === "html" || admission.representation === "rsc-full" || admission.representation === "rsc-loading-shell" : admission.representation === "html" || admission.representation === "pages-data")) return responseWithCachePolicy(response, response.body, null);
+	if (!admission || admission.policy === "deny" || !admission.representation || !admission.requestKey || !state.route || response.status >= 500) return responseWithCachePolicy(response, response.body, null, browserCacheControl);
+	const pageRoute = {
+		kind: state.route.kind,
+		pattern: state.route.pattern
+	};
+	const requestRepresentation = admission.representation;
+	const representation = resolveCacheabilityRepresentation(requestRepresentation, pageRoute.kind);
+	if (!cacheabilityRepresentationMatchesPageRoute(pageRoute.kind, representation)) return responseWithCachePolicy(response, response.body, null, browserCacheControl);
 	let manifestRoute = null;
 	let manifestRouteState = null;
 	if (admission.policy === "manifest") {
 		const manifest = admission.manifest;
-		manifestRoute = findCacheabilityManifestRoute(manifest, state.route.kind, state.route.pattern);
-		manifestRouteState = manifestRoute && admission.routePathname ? cacheabilityManifestRouteState(manifestRoute, admission.routePathname, admission.representation) : null;
-		if (!manifestRoute || !manifestRouteState) return responseWithCachePolicy(response, response.body, null);
+		manifestRoute = findCacheabilityManifestRoute(manifest, pageRoute.kind, pageRoute.pattern);
+		manifestRouteState = admission.routePathname ? cacheabilityManifestPageState(manifest, pageRoute, requestRepresentation, admission.routePathname) : null;
+		if (!manifestRoute || !manifestRouteState) return responseWithCachePolicy(response, response.body, null, browserCacheControl);
 	}
-	if (state.forcedDynamicReason) return responseWithCachePolicy(response, response.body, null);
-	if (hasStrictFinalResponseVeto(response, state)) return responseWithCachePolicy(response, response.body, null);
-	if (cacheabilityVaryRejectionReason(response.headers, state) !== null) return responseWithCachePolicy(response, response.body, null);
+	if (state.forcedDynamicReason) return responseWithCachePolicy(response, response.body, null, browserCacheControl);
+	if (hasStrictFinalResponseVeto(response, state)) return responseWithCachePolicy(response, response.body, null, browserCacheControl);
+	if (cacheabilityVaryRejectionReason(response.headers, state) !== null) return responseWithCachePolicy(response, response.body, null, browserCacheControl);
+	if (state.route.kind === "pages-page" && !state.completion && completedRouteOutcome(response, state)?.cacheable !== true) return responseWithCachePolicy(response, response.body, null, browserCacheControl);
 	let captured;
 	try {
 		captured = await captureCacheabilityAdmissionBody(response.body, state.captureDeadlineAt, CACHEABILITY_ADMISSION_RESPONSE_BODY_LIMIT, state.captureBudget ?? isolateCaptureBudget);
 	} catch {
 		return cacheabilityEvaluationFailureResponse(state.route.pattern);
 	}
-	if (captured.kind === "fallback") return responseWithCachePolicy(response, captured.body, null);
-	const outcome = completedRouteOutcome(response, state, state.completion ? await state.completion : state.outcome ?? null);
+	if (captured.kind === "fallback") return responseWithCachePolicy(response, captured.body, null, browserCacheControl);
+	const rendererOutcome = state.completion ? await state.completion : state.outcome ?? null;
+	const outcome = completedRouteOutcome(response, state, rendererOutcome);
 	if (outcome?.cacheable !== true || !outcome.cacheControl) {
 		if (manifestRoute && manifestRouteState === "static-candidate" && outcome?.dynamicUsage === true) {
 			await captured.body?.cancel().catch(() => {});
 			return staticToDynamicResponse(manifestRoute);
 		}
-		return responseWithCachePolicy(response, captured.body, null);
+		return responseWithCachePolicy(response, captured.body, null, browserCacheControl);
 	}
-	return responseWithCachePolicy(response, captured.body, outcome);
+	const effectivePolicyHeader = readCdnResponsePolicyHeaderName(response.headers);
+	const replacesRendererPolicy = outcome !== rendererOutcome && effectivePolicyHeader !== null && state.configCdnCachePolicy?.get(effectivePolicyHeader) === response.headers.get(effectivePolicyHeader);
+	if (state.route.kind === "app-page" && !replacesRendererPolicy && rendererOutcome?.searchParamsUnread !== true) return responseWithCachePolicy(response, captured.body, null, browserCacheControl);
+	return responseWithCachePolicy(response, representation === "html" && state.clientTraceMetadataMarker ? await stripSharedHtmlClientTraceMetadata(captured.body, state.clientTraceMetadataMarker) : captured.body, outcome, browserCacheControl);
 }
 async function finalizeWorkerCacheabilityResponse(response, ctx) {
 	const state = readState(ctx);
@@ -443,7 +541,8 @@ async function finalizeWorkerCacheabilityResponse(response, ctx) {
 	if (drainFailure) return probeResponse(state, "probe-failed", {
 		cacheable: false,
 		classificationFailure: true,
-		reason: drainFailure
+		reason: drainFailure,
+		retryable: true
 	}, response.status);
 	const rendererOutcome = state.completion ? await state.completion : state.outcome ?? null;
 	const outcome = completedRouteOutcome(response, state, rendererOutcome);
@@ -451,7 +550,10 @@ async function finalizeWorkerCacheabilityResponse(response, ctx) {
 		cacheable: false,
 		reason: "completed render did not produce a reusable cache policy"
 	}, response.status);
-	return probeResponse(state, outcome.cacheable ? "static-candidate" : outcome.classificationFailure ? "probe-failed" : "dynamic", outcome, response.status, rendererOutcome?.cacheable === true && rendererOutcome.dynamicUsage !== true);
+	return probeResponse(state, outcome.cacheable ? "static-candidate" : outcome.classificationFailure ? "probe-failed" : "dynamic", outcome, response.status, {
+		dynamicUsage: rendererOutcome?.dynamicUsage === true,
+		static: rendererOutcome?.cacheable === true && rendererOutcome.dynamicUsage !== true
+	});
 }
 //#endregion
-export { captureCacheabilityAdmissionBody, createCacheabilityAdmissionCaptureBudget, createWorkerCacheabilityAdmissionContext, createWorkerCacheabilityContext, finalizeWorkerCacheabilityResponse };
+export { applyResponseStageCachePolicy, captureCacheabilityAdmissionBody, createCacheabilityAdmissionCaptureBudget, createWorkerCacheabilityAdmissionContext, createWorkerCacheabilityContext, createWorkerCacheabilityProbeContext, finalizeRequestStageCacheabilityProbe, finalizeWorkerCacheabilityResponse, readWorkerCacheabilityProbeMode, readWorkerCacheabilityProbeRoute, recordResponseStageCachePolicy, serializeWorkerCacheabilityProbeRoute };