vinext 1.0.0 → 1.1.0

package/dist/server/app-rsc-handler.js

@@ -4,15 +4,16 @@ import { PRERENDER_REVALIDATE_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROU
 import { hasMiddlewareRequestHeaderOverrides } from "../utils/middleware-request-headers.js";
 import { requestContextFromRequest } from "../config/request-context.js";
 import { isExternalUrl } from "../utils/external-url.js";
+import { assetPrefixPathname, isNextStaticPath } from "../utils/asset-prefix.js";
 import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { addBasePathToPathname, hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { patternToNextFormat } from "../routing/route-validation.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
 import "./app-rsc-vary.js";
-import { ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, VINEXT_PARAMS_HEADER, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER } from "./headers.js";
+import { ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_REWRITTEN_HEADER, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_SPECIAL_ERROR_STATUS_HEADER } from "./headers.js";
 import { isInterceptionMatchedUrlPath, normalizePath } from "./normalize-path.js";
-import { badRequestResponse, notFoundResponse } from "./http-error-responses.js";
-import { cloneRequestWithHeaders, cloneRequestWithUrl, filterInternalHeaders, normalizeTrailingSlash, resolvePublicFileRoute } from "./request-pipeline.js";
+import { badRequestResponse, notFoundResponse, notFoundStaticAssetResponse } from "./http-error-responses.js";
+import { cloneRequestWithHeaders, cloneRequestWithUrl, filterInternalHeaders, normalizeTrailingSlash, normalizeTrailingSlashPathname, resolvePublicFileRoute } from "./request-pipeline.js";
 import { normalizeDefaultLocalePathname } from "./pages-i18n.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { markRouteCacheabilityDynamic, preserveRouteCacheabilityResponsePolicy } from "../shims/cacheability-classification.js";
@@ -36,6 +37,8 @@ import { setFrameworkRequestRoute, traceFrameworkRequest } from "./request-traci
 import { matchPrerenderRouteParamsPayload, readTrustedPrerenderRouteParams, serializePrerenderRouteParamsHeader } from "./prerender-route-params.js";
 import { buildPageCacheTags } from "./implicit-tags.js";
 import { createServerActionNotFoundResponse, getServerActionNotFoundMessage } from "./server-action-not-found.js";
+import { isPossibleAppRouteActionRequest } from "./app-action-request.js";
+import { normalizeInterceptionContextHeader } from "./app-interception-context-header.js";
 import { buildPostMwRequestContext } from "./app-post-middleware-context.js";
 import { pickRootParams, setRootParams } from "../shims/root-params.js";
 import { createRouteTreePrefetchResponse, isRouteTreePrefetchRequest } from "./app-route-tree-prefetch.js";
@@ -50,6 +53,33 @@ import { consumePagesResponseStagePolicyOwner, withoutResponseStageVary } from "
 const HAS_CONFIG_HEADERS = process.env.__VINEXT_HAS_CONFIG_HEADERS !== "false";
 const HAS_CONFIG_REDIRECTS = process.env.__VINEXT_HAS_CONFIG_REDIRECTS !== "false";
 const HAS_CONFIG_REWRITES = process.env.__VINEXT_HAS_CONFIG_REWRITES !== "false";
+/**
+* Decode an interception context to the canonical source pathname it names.
+* Throws for any value the client could not send back as its context header.
+*/
+function decodeInterceptionSourcePathname(context) {
+	if (!isInterceptionMatchedUrlPath(context)) throw new Error("Invalid interception source pathname");
+	if (new URL(context, "http://n").pathname !== context) throw new Error("Interception source is not a parsed URL pathname");
+	const decodedSourcePathname = normalizePathnameForRouteMatchStrict(context);
+	if (/[\t\n\r]/.test(decodedSourcePathname)) throw new Error("Interception source contains a stripped URL character");
+	if (hasUrlParserDotSegment(decodedSourcePathname)) throw new Error("Interception source contains a URL dot segment");
+	const sourcePathname = normalizePath(decodedSourcePathname);
+	if (sourcePathname !== decodedSourcePathname) throw new Error("Non-canonical interception source pathname");
+	return sourcePathname;
+}
+/**
+* Whether a server-derived context satisfies the whole inbound header
+* contract, so the client can send it back unchanged on its next request.
+*/
+function isValidInterceptionSourceContext(context) {
+	if (normalizeInterceptionContextHeader(context) !== context) return false;
+	try {
+		decodeInterceptionSourcePathname(context);
+		return true;
+	} catch {
+		return false;
+	}
+}
 function ruleUsesUnkeyedRequestCondition(rule) {
 	return [...rule.has ?? [], ...rule.missing ?? []].some((condition) => condition.type === "header" || condition.type === "cookie" || condition.type === "host");
 }
@@ -122,6 +152,26 @@ function applyMiddlewareContextToResponse(response, middlewareContext, appendToP
 		headers
 	}));
 }
+/**
+* Next.js answers a Link's segment prefetch of a page whose notFound(),
+* forbidden() or unauthorized() it stored with a 200, so its router renders
+* the page's fallback without loading the document. A shared response stage
+* gives that prefetch the navigation's response, so the request's own headers
+* decide the status here.
+*/
+function withStoredSpecialErrorStatus(response, isSegmentPrefetch) {
+	const marker = response.headers.get(VINEXT_SPECIAL_ERROR_STATUS_HEADER);
+	if (marker === null) return response;
+	const headers = new Headers(response.headers);
+	headers.delete(VINEXT_SPECIAL_ERROR_STATUS_HEADER);
+	const storedStatus = Number(marker);
+	const status = !(storedStatus === 401 || storedStatus === 403 || storedStatus === 404) ? response.status : isSegmentPrefetch ? 200 : storedStatus;
+	return preserveFullyBufferedBodyMetadata(response, new Response(response.body, {
+		headers,
+		status,
+		statusText: status === response.status ? response.statusText : ""
+	}));
+}
 function hasProperty(value, key) {
 	return key in value;
 }
@@ -205,7 +255,8 @@ function requestWithoutRscSuffix(request) {
 	url.pathname = pathname;
 	return cloneRequestWithUrl(request, url.toString());
 }
-function markUnverifiedInterceptionResponseUncacheable(response) {
+/** Send a response with the never-cache policy, rebuilding immutable headers. */
+function withNeverCacheControl(response) {
 	const applyNoStore = (headers) => {
 		applyCdnResponseHeaders(headers, { cacheControl: NEVER_CACHE_CONTROL });
 	};
@@ -223,6 +274,13 @@ function markUnverifiedInterceptionResponseUncacheable(response) {
 	}
 	return markedResponse;
 }
+const unmatchedRouteResponses = /* @__PURE__ */ new WeakSet();
+/** Send an unmatched route's 404 with the never-cache policy, as Next.js does. */
+function withUnmatchedRouteCacheControl(response) {
+	const markedResponse = withNeverCacheControl(response);
+	unmatchedRouteResponses.add(markedResponse);
+	return markedResponse;
+}
 async function handleAppRscRequest(options, request, preMiddlewareRequestContext, middlewareContext, isDataRequest, isMiddlewareDataRequest, pagesDataRequest, dispatchInternalRequest, allowInternalRscDocumentFallback, dispatchResponseStage, responseStageProbeMode = null, setInterceptionResponseUncacheable = () => {}) {
 	const handlerStart = process.env.NODE_ENV !== "production" ? performance.now() : 0;
 	if (process.env.NODE_ENV !== "production") {
@@ -236,7 +294,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		...options.configRewrites.fallback,
 		...options.configHeaders
 	].some((rule) => rule.basePath === false);
-	const normalized = normalizeRscRequest(request, options.basePath, canHandleOutsideBasePath);
+	const normalized = normalizeRscRequest(request, options.basePath, canHandleOutsideBasePath, options.assetPrefix);
 	if (normalized instanceof Response) {
 		if (request.headers.has("X-Vinext-Interception-Context") || request.headers.has("X-Vinext-Interception-Id")) setInterceptionResponseUncacheable(true);
 		return normalized;
@@ -247,12 +305,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	if (hasRawInterceptionContext) setInterceptionResponseUncacheable(true);
 	let interceptionSourcePathname = null;
 	if (isRscRequest && interceptionContextHeader !== null) try {
-		if (!isInterceptionMatchedUrlPath(interceptionContextHeader)) throw new Error("Invalid interception source pathname");
-		const decodedInterceptionSourcePathname = normalizePathnameForRouteMatchStrict(interceptionContextHeader);
-		if (/[\t\n\r]/.test(decodedInterceptionSourcePathname)) throw new Error("Interception source contains a stripped URL character");
-		if (hasUrlParserDotSegment(decodedInterceptionSourcePathname)) throw new Error("Interception source contains a URL dot segment");
-		interceptionSourcePathname = normalizePath(decodedInterceptionSourcePathname);
-		if (interceptionSourcePathname !== decodedInterceptionSourcePathname) throw new Error("Non-canonical interception source pathname");
+		interceptionSourcePathname = decodeInterceptionSourcePathname(interceptionContextHeader);
 	} catch {
 		options.clearRequestContext();
 		setInterceptionResponseUncacheable(true);
@@ -281,10 +334,10 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		});
 		if (selectorCacheBustingRedirect) return selectorCacheBustingRedirect;
 	}
-	const provesConcreteInterceptionSource = (sourceMatch) => {
+	const provesConcreteInterceptionSource = (sourceMatch, sourceContext = interceptionContextHeader) => {
 		if (sourceMatch === null) return false;
 		if (sourceMatch.interceptionSourceIsConcrete !== void 0) return sourceMatch.interceptionSourceIsConcrete;
-		return interceptionSourcePathname !== null && options.matchRoute(interceptionSourcePathname)?.route === sourceMatch.route;
+		return sourceContext !== null && (options.matchRequestRoute ?? options.matchRoute)(sourceContext)?.route === sourceMatch.route;
 	};
 	if (provesConcreteInterceptionSource(hadBasePath && hasRawInterceptionContext && interceptionContextHeader !== null ? options.matchInterceptRoute?.(requestCleanPathname, interceptionContextHeader, interceptionIdHeader) ?? null : null)) setInterceptionResponseUncacheable(false);
 	if (pathname === "/__vinext/prerender/static-params" || pathname === "/__vinext/prerender/pages-static-paths" || pathname === "/__vinext/prerender/metadata-routes") {
@@ -460,7 +513,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 				isRscRequest,
 				middlewareCookieOverlay,
 				mountedSlotsHeader,
-				protocolVersion: 10,
+				protocolVersion: 11,
 				requestOrigin: url.origin,
 				renderMode,
 				resolvedUrl,
@@ -617,8 +670,9 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	});
 	const directPreActionMatch = filesystemRouteEligible ? matchCleanPathname() : null;
 	const preActionRoutePathname = cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname;
-	const interceptionSourceMatch = filesystemRouteEligible && interceptionSourcePathname !== null && interceptionContextHeader !== null ? options.matchInterceptRoute?.(preActionRoutePathname, interceptionContextHeader, interceptionIdHeader) ?? null : null;
-	const hasVerifiedInterceptionSource = provesConcreteInterceptionSource(interceptionSourceMatch);
+	let interceptionSourceContext = interceptionContextHeader;
+	let interceptionSourceMatch = filesystemRouteEligible && interceptionSourcePathname !== null && interceptionContextHeader !== null ? options.matchInterceptRoute?.(preActionRoutePathname, interceptionContextHeader, interceptionIdHeader) ?? null : null;
+	let hasVerifiedInterceptionSource = provesConcreteInterceptionSource(interceptionSourceMatch);
 	if (interceptionIdHeader !== null && !hasVerifiedInterceptionSource) {
 		options.clearRequestContext();
 		setInterceptionResponseUncacheable(true);
@@ -633,81 +687,142 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		bypassInterceptionContextCache = true;
 		setInterceptionResponseUncacheable(true);
 	};
-	if (interceptionSourceMatch !== null && interceptionSourcePathname !== null && runMiddleware && interceptionSourceMatch.route !== directPreActionMatch?.route) {
-		const sourceUrl = new URL(userlandRequest.url);
-		sourceUrl.search = new URL(resolvedUrl, url).search;
-		sourceUrl.pathname = hadBasePath ? addBasePathToPathname(interceptionSourcePathname, options.basePath) : interceptionSourcePathname;
-		const sourceRequest = userlandRequest.body ? userlandRequest.clone() : userlandRequest;
-		const sourceMiddlewareRequest = cloneRequestWithUrl(sourceRequest, sourceUrl.href);
-		sourceMiddlewareRequest.headers.delete(VINEXT_MW_CTX_HEADER);
-		for (const header of FLIGHT_HEADERS) sourceMiddlewareRequest.headers.delete(header);
-		const targetHeadersContext = getHeadersContext();
-		const targetRequestHeaders = targetHeadersContext ? new Headers(targetHeadersContext.headers) : null;
-		targetRequestHeaders?.delete(VINEXT_MW_CTX_HEADER);
-		for (const header of FLIGHT_HEADERS) targetRequestHeaders?.delete(header);
-		if (targetRequestHeaders) {
-			const sourceHeaderNames = Array.from(sourceMiddlewareRequest.headers.keys());
-			for (const header of sourceHeaderNames) sourceMiddlewareRequest.headers.delete(header);
-			for (const [name, value] of targetRequestHeaders) sourceMiddlewareRequest.headers.append(name, value);
-		}
-		const sourceMiddlewareContext = {
-			headers: null,
-			requestHeaders: null,
-			status: null
-		};
-		const sourceHeadersContext = headersContextFromRequest(sourceMiddlewareRequest, { draftModeSecret: options.draftModeSecret });
-		let sourceMiddlewareResult;
-		try {
-			sourceMiddlewareResult = await runWithHeadersContext(sourceHeadersContext, () => runMiddleware({
-				cleanPathname: interceptionSourcePathname,
-				context: sourceMiddlewareContext,
-				externalRewriteRequest: normalizedUserlandRequest,
-				hadBasePath,
-				isDataRequest: isMiddlewareDataRequest,
-				request: sourceMiddlewareRequest,
-				validateExternalRewriteRequest: () => validateClaimedOutsideBasePathRsc(true)
-			}));
-		} finally {
-			if (sourceMiddlewareRequest.body && !sourceMiddlewareRequest.bodyUsed && !sourceMiddlewareRequest.body.locked) sourceMiddlewareRequest.body.cancel().catch(() => {});
-			if (sourceRequest !== userlandRequest && sourceRequest.body && !sourceRequest.bodyUsed && !sourceRequest.body.locked) sourceRequest.body.cancel().catch(() => {});
-		}
-		if (!dispatchResponseStage && sourceMiddlewareResult.pathnameEligible) markRouteCacheabilityDynamic(sourceMiddlewareResult.matched ? "middleware matched this request" : "middleware is eligible for this pathname");
-		if (sourceMiddlewareResult.kind === "response") {
-			options.clearRequestContext();
-			return sourceMiddlewareResult.response;
-		}
-		let sourceHeadersCompatible = true;
-		if (targetRequestHeaders) {
-			for (const [name, value] of targetRequestHeaders) if (sourceHeadersContext.headers.get(name) !== value) {
-				sourceHeadersCompatible = false;
-				break;
+	if (interceptionSourceMatch !== null && interceptionContextHeader !== null && interceptionSourcePathname !== null && !(interceptionSourceMatch.route === directPreActionMatch?.route && haveSamePageParams(interceptionSourceMatch.params, directPreActionMatch.params))) {
+		const sourceRequestPathname = normalizeTrailingSlashPathname(interceptionContextHeader, options.trailingSlash) ?? interceptionContextHeader;
+		const decodedSourceRequestPathname = normalizeTrailingSlashPathname(interceptionSourcePathname, options.trailingSlash) ?? interceptionSourcePathname;
+		const adoptRewrittenInterceptionSource = (rewrittenPathname) => {
+			const rewrittenInterceptionSourceMatch = isValidInterceptionSourceContext(rewrittenPathname) ? options.matchInterceptRoute?.(preActionRoutePathname, rewrittenPathname, interceptionIdHeader) ?? null : null;
+			if (rewrittenInterceptionSourceMatch !== null) {
+				interceptionSourceMatch = rewrittenInterceptionSourceMatch;
+				interceptionSourceContext = rewrittenPathname;
 			}
-		}
-		if (!targetHeadersContext || !targetRequestHeaders || !sourceHeadersCompatible || !haveSameRequestCookies(targetHeadersContext.cookies, sourceHeadersContext.cookies)) {
+			const rewrittenSourceMatch = options.matchRoute(rewrittenPathname);
+			return interceptionSourceMatch !== null && rewrittenSourceMatch?.route === interceptionSourceMatch.route && haveSamePageParams(rewrittenSourceMatch.params, interceptionSourceMatch.params);
+		};
+		if (configMatchers?.matchRedirect(matchPathname(sourceRequestPathname), options.configRedirects, preMiddlewareRequestContext, basePathState, dispatchResponseStage ? void 0 : markConditionalRedirectCacheability)) {
 			options.clearRequestContext();
 			return notFoundResponse();
 		}
-		let addedSourceHeader = false;
-		for (const [name, value] of sourceHeadersContext.headers) if (!targetRequestHeaders.has(name)) {
-			targetHeadersContext.headers.set(name, value);
-			addedSourceHeader = true;
-		}
-		if (addedSourceHeader) {
-			targetHeadersContext.readonlyHeaders = void 0;
-			canUseSharedWorkerResponseStage = false;
+		let sourceRulesPathname = sourceRequestPathname;
+		if (runMiddleware) {
+			const sourceUrl = new URL(userlandRequest.url);
+			sourceUrl.search = new URL(resolvedUrl, url).search;
+			const sourceUrlPathname = hadBasePath && options.basePath ? sourceRequestPathname === "/" ? options.basePath : options.basePath + sourceRequestPathname : sourceRequestPathname;
+			sourceUrl.pathname = sourceUrlPathname;
+			if (sourceUrl.pathname !== sourceUrlPathname) {
+				options.clearRequestContext();
+				setInterceptionResponseUncacheable(true);
+				return badRequestResponse();
+			}
+			const sourceRequest = userlandRequest.body ? userlandRequest.clone() : userlandRequest;
+			const sourceMiddlewareRequest = cloneRequestWithUrl(sourceRequest, sourceUrl.href);
+			sourceMiddlewareRequest.headers.delete(VINEXT_MW_CTX_HEADER);
+			for (const header of FLIGHT_HEADERS) sourceMiddlewareRequest.headers.delete(header);
+			const targetHeadersContext = getHeadersContext();
+			const targetRequestHeaders = targetHeadersContext ? new Headers(targetHeadersContext.headers) : null;
+			targetRequestHeaders?.delete(VINEXT_MW_CTX_HEADER);
+			for (const header of FLIGHT_HEADERS) targetRequestHeaders?.delete(header);
+			if (targetRequestHeaders) {
+				const sourceHeaderNames = Array.from(sourceMiddlewareRequest.headers.keys());
+				for (const header of sourceHeaderNames) sourceMiddlewareRequest.headers.delete(header);
+				for (const [name, value] of targetRequestHeaders) sourceMiddlewareRequest.headers.append(name, value);
+			}
+			const sourceMiddlewareContext = {
+				headers: null,
+				requestHeaders: null,
+				status: null
+			};
+			const sourceHeadersContext = headersContextFromRequest(sourceMiddlewareRequest, { draftModeSecret: options.draftModeSecret });
+			let sourceMiddlewareResult;
+			try {
+				sourceMiddlewareResult = await runWithHeadersContext(sourceHeadersContext, () => runMiddleware({
+					cleanPathname: decodedSourceRequestPathname,
+					context: sourceMiddlewareContext,
+					externalRewriteRequest: normalizedUserlandRequest,
+					hadBasePath,
+					isDataRequest: isMiddlewareDataRequest,
+					request: sourceMiddlewareRequest,
+					validateExternalRewriteRequest: () => validateClaimedOutsideBasePathRsc(true)
+				}));
+			} finally {
+				if (sourceMiddlewareRequest.body && !sourceMiddlewareRequest.bodyUsed && !sourceMiddlewareRequest.body.locked) sourceMiddlewareRequest.body.cancel().catch(() => {});
+				if (sourceRequest !== userlandRequest && sourceRequest.body && !sourceRequest.bodyUsed && !sourceRequest.body.locked) sourceRequest.body.cancel().catch(() => {});
+			}
+			if (!dispatchResponseStage && sourceMiddlewareResult.pathnameEligible) markRouteCacheabilityDynamic(sourceMiddlewareResult.matched ? "middleware matched this request" : "middleware is eligible for this pathname");
+			if (sourceMiddlewareResult.kind === "response") {
+				options.clearRequestContext();
+				return sourceMiddlewareResult.response;
+			}
+			let sourceHeadersCompatible = true;
+			if (targetRequestHeaders) {
+				for (const [name, value] of targetRequestHeaders) if (sourceHeadersContext.headers.get(name) !== value) {
+					sourceHeadersCompatible = false;
+					break;
+				}
+			}
+			if (!targetHeadersContext || !targetRequestHeaders || !sourceHeadersCompatible || !haveSameRequestCookies(targetHeadersContext.cookies, sourceHeadersContext.cookies)) {
+				options.clearRequestContext();
+				return notFoundResponse();
+			}
+			let addedSourceHeader = false;
+			for (const [name, value] of sourceHeadersContext.headers) if (!targetRequestHeaders.has(name)) {
+				targetHeadersContext.headers.set(name, value);
+				addedSourceHeader = true;
+			}
+			if (addedSourceHeader) {
+				targetHeadersContext.readonlyHeaders = void 0;
+				canUseSharedWorkerResponseStage = false;
+			}
+			if (sourceMiddlewareResult.rewritten) {
+				if (sourceMiddlewareResult.search !== sourceUrl.search || !adoptRewrittenInterceptionSource(sourceMiddlewareResult.cleanPathname)) {
+					options.clearRequestContext();
+					return notFoundResponse();
+				}
+				sourceRulesPathname = sourceMiddlewareResult.cleanPathname;
+			}
 		}
-		if (sourceMiddlewareResult.rewritten) {
-			const rewrittenSourceMatch = options.matchRoute(sourceMiddlewareResult.cleanPathname);
-			if (sourceMiddlewareResult.search !== sourceUrl.search || rewrittenSourceMatch?.route !== interceptionSourceMatch.route || !haveSamePageParams(rewrittenSourceMatch.params, interceptionSourceMatch.params)) {
+		if (HAS_CONFIG_REWRITES && options.configRewrites.beforeFiles.length) {
+			const { matchRewrite } = await import("../config/config-matchers.js");
+			const sourceRewriteContext = requestContextForResolvedUrl(buildPostMwRequestContext(userlandRequest), resolvedUrl, url);
+			let didRewriteSource = false;
+			for (const rewrite of options.configRewrites.beforeFiles) {
+				const destination = matchRewrite(matchPathname(sourceRulesPathname), [rewrite], sourceRewriteContext, basePathState, matchPathname(sourceRulesPathname), dispatchResponseStage === void 0 ? markConditionalRewriteCacheability : void 0);
+				if (!destination) continue;
+				if (isExternalUrl(destination) || destination.includes("?")) {
+					options.clearRequestContext();
+					return notFoundResponse();
+				}
+				sourceRulesPathname = pathnameForResolvedUrl(destination);
+				didRewriteSource = true;
+			}
+			if (didRewriteSource && !adoptRewrittenInterceptionSource(sourceRulesPathname)) {
 				options.clearRequestContext();
 				return notFoundResponse();
 			}
 		}
 	}
+	if (interceptionSourceMatch !== null) {
+		hasVerifiedInterceptionSource = provesConcreteInterceptionSource(interceptionSourceMatch, interceptionSourceContext);
+		if (!hasVerifiedInterceptionSource) {
+			if (interceptionIdHeader !== null) {
+				options.clearRequestContext();
+				setInterceptionResponseUncacheable(true);
+				return badRequestResponse();
+			}
+			interceptionSourceMatch = null;
+			interceptionSourceContext = null;
+		}
+		bypassInterceptionContextCache = hasRawInterceptionContext && !hasVerifiedInterceptionSource;
+		setInterceptionResponseUncacheable(bypassInterceptionContextCache);
+	}
 	const interceptionPreActionMatch = filesystemRouteEligible && directPreActionMatch === null && isRscRequest && interceptionSourcePathname !== null ? interceptionSourceMatch : null;
 	const preActionMatch = directPreActionMatch ?? interceptionPreActionMatch;
 	const isInterceptionMatch = interceptionPreActionMatch !== null;
-	if (preActionMatch) setRootParams(pickRootParams(preActionMatch.params, preActionMatch.route.rootParamNames));
+	const rendersRawRequestMatch = options.matchRawRequestRoute !== void 0 && (isPossibleAppRouteActionRequest(request) || isDraftModeRequest(request, options.draftModeSecret) || isDraftModeEnabled());
+	const usesRawRequestMatch = () => rendersRawRequestMatch && cleanPathnameIsRequestPathname && !isInterceptionMatch;
+	const renderedRouteMatch = (routeMatch) => routeMatch !== null && usesRawRequestMatch() ? options.matchRawRequestRoute(requestCleanPathname) ?? routeMatch : routeMatch;
+	const renderedPreActionMatch = renderedRouteMatch(preActionMatch);
+	if (renderedPreActionMatch) setRootParams(pickRootParams(renderedPreActionMatch.params, renderedPreActionMatch.route.rootParamNames));
 	if (pagesDataRequest && didMiddlewareRewritePathname && preActionMatch && !preActionMatch.route.isDynamic) {
 		const headers = new Headers();
 		mergeMiddlewareResponseHeaders(headers, middlewareContext.headers);
@@ -728,7 +843,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			contentType,
 			middlewareContext,
 			request,
-			routeMatch: preActionMatch
+			routeMatch: renderedPreActionMatch
 		});
 		else if (preActionMatch?.route.__loadPage && !preActionMatch.route.__loadRouteHandler) return createMissingServerActionResponse(options, null);
 	}
@@ -760,13 +875,13 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		actionId,
 		cleanPathname,
 		contentType,
-		interceptionContext: interceptionContextHeader,
+		interceptionContext: interceptionSourceContext,
 		isRscRequest,
 		middlewareContext,
 		mountedSlotsHeader,
 		request,
 		scriptNonce,
-		routeMatch: preActionMatch,
+		routeMatch: renderedPreActionMatch,
 		routePathname: preActionRoutePathname,
 		dispatchRedirectTargetRequest: dispatchInternalRequest,
 		sourceConfigHeaders,
@@ -802,7 +917,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 				matchKind,
 				middlewareCookieOverlay,
 				preHandlerHeaders: cache === "shared" && resourceKind === "page" && dataKind === "static" ? null : [...await loadPreHandlerResponseHeaders()],
-				protocolVersion: 10,
+				protocolVersion: 11,
 				requestOrigin: url.origin,
 				resourceKind,
 				requestUrl: request.url,
@@ -837,15 +952,18 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		if (response) preserveRouteCacheabilityResponsePolicy();
 		if (!response) return null;
 		if (sharedOuterPolicyNeedsReconciliation) reconcileCdnResponseHeadersAfterOuterPolicy(response.headers, await loadOuterResponsePolicy());
-		if (!pagesDataRequest || resolvedUrl === originalResolvedUrl) return dispatchPagesResponseStage ? markAppRscResponseConfigHeadersApplied(response) : response;
+		const isRewritten = resolvedUrl !== originalResolvedUrl;
+		const isPrerender = typeof process !== "undefined" && process.env?.VINEXT_PRERENDER === "1";
+		if ((!pagesDataRequest || !isRewritten) && !isPrerender) return dispatchPagesResponseStage ? markAppRscResponseConfigHeadersApplied(response) : response;
 		const headers = new Headers(response.headers);
-		headers.set("x-nextjs-rewrite", resolvedUrl);
-		const rewrittenResponse = new Response(response.body, {
+		if (pagesDataRequest && isRewritten) headers.set("x-nextjs-rewrite", resolvedUrl);
+		if (isPrerender) headers.set(VINEXT_PRERENDER_REWRITTEN_HEADER, isRewritten ? "1" : "0");
+		const markedResponse = new Response(response.body, {
 			headers,
 			status: response.status,
 			statusText: response.statusText
 		});
-		return dispatchPagesResponseStage ? markAppRscResponseConfigHeadersApplied(rewrittenResponse) : rewrittenResponse;
+		return dispatchPagesResponseStage ? markAppRscResponseConfigHeadersApplied(markedResponse) : markedResponse;
 	};
 	const staticPagesFallbackResponse = await renderPagesForMatchKind("static");
 	if (staticPagesFallbackResponse) {
@@ -931,23 +1049,31 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		}
 		if (match) break;
 	}
-	if (interceptionCacheProofInvalidated && interceptionContextHeader !== null) {
+	if (interceptionCacheProofInvalidated && interceptionSourceContext !== null) {
 		const finalInterceptionTargetPathname = cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname;
-		const finalInterceptionSourceMatch = filesystemRouteEligible && match !== null ? options.matchInterceptRoute?.(finalInterceptionTargetPathname, interceptionContextHeader, interceptionIdHeader) ?? null : null;
+		const finalInterceptionSourceMatch = filesystemRouteEligible && match !== null ? options.matchInterceptRoute?.(finalInterceptionTargetPathname, interceptionSourceContext, interceptionIdHeader) ?? null : null;
 		const hasVerifiedFinalInterceptionSource = hasVerifiedInterceptionSource && interceptionSourceMatch !== null && provesConcreteInterceptionSource(finalInterceptionSourceMatch) && finalInterceptionSourceMatch?.route === interceptionSourceMatch.route && haveSamePageParams(finalInterceptionSourceMatch.params, interceptionSourceMatch.params);
 		if (interceptionIdHeader !== null && !hasVerifiedFinalInterceptionSource) {
 			options.clearRequestContext();
 			setInterceptionResponseUncacheable(true);
 			return badRequestResponse();
 		}
+		if (!hasVerifiedFinalInterceptionSource) interceptionSourceContext = null;
 		bypassInterceptionContextCache = !hasVerifiedFinalInterceptionSource;
 		setInterceptionResponseUncacheable(bypassInterceptionContextCache);
 	}
+	if ((!filesystemRouteEligible || !match) && isNextStaticPath(cleanPathname, "", assetPrefixPathname(options.assetPrefix ?? ""))) {
+		options.clearRequestContext();
+		const headers = new Headers();
+		mergeMiddlewareResponseHeaders(headers, middlewareContext.headers);
+		applyCdnResponseHeaders(headers, { cacheControl: NEVER_CACHE_CONTROL });
+		return notFoundStaticAssetResponse(headers);
+	}
 	if (!filesystemRouteEligible) {
 		options.clearRequestContext();
 		const headers = new Headers();
 		mergeMiddlewareResponseHeaders(headers, middlewareContext.headers);
-		return notFoundResponse({ headers });
+		return withUnmatchedRouteCacheControl(notFoundResponse({ headers }));
 	}
 	if (pagesDataRequest) {
 		options.clearRequestContext();
@@ -971,7 +1097,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		}
 		setFrameworkRequestRoute("/404", isRscRequest);
 		const notFoundResponseStage = transportedResponseStage ?? options.renderResponseStageLocally;
-		if (notFoundResponseStage) return composeResponseStageResponse(await notFoundResponseStage(responseStageRequest(), {
+		if (notFoundResponseStage) return withUnmatchedRouteCacheControl(await composeResponseStageResponse(await notFoundResponseStage(responseStageRequest(), {
 			kind: "app-not-found",
 			buildId: options.buildId,
 			cacheability: responseStageCacheability(resolvedUrl),
@@ -981,12 +1107,12 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			isRscRequest,
 			middlewareCookieOverlay,
 			mountedSlotsHeader,
-			protocolVersion: 10,
+			protocolVersion: 11,
 			requestOrigin: url.origin,
 			renderMode,
 			resolvedUrl,
 			scriptNonce: scriptNonce ?? null
-		}));
+		})));
 		const renderedNotFoundResponse = await traceAppPageRender("/404", "render", () => options.renderNotFound({
 			isRscRequest,
 			middlewareContext,
@@ -994,12 +1120,13 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			route: null,
 			scriptNonce
 		}));
-		if (renderedNotFoundResponse) return renderedNotFoundResponse;
+		if (renderedNotFoundResponse) return withUnmatchedRouteCacheControl(renderedNotFoundResponse);
 		options.clearRequestContext();
 		const headers = new Headers();
 		mergeMiddlewareResponseHeaders(headers, middlewareContext.headers);
-		return notFoundResponse({ headers });
+		return withUnmatchedRouteCacheControl(notFoundResponse({ headers }));
 	}
+	match = renderedRouteMatch(match);
 	const { route, params } = match;
 	const requestPathnameDiffersFromCachePath = requestCleanPathname !== cleanPathname;
 	const rawRequestPathnameIsObservable = isInterceptionMatch || route.routeHandler != null || typeof route.__loadRouteHandler === "function";
@@ -1027,7 +1154,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	const prerenderRouteParams = prerenderRouteParamsMatch?.params ?? null;
 	const isPrerenderFallbackShell = prerenderRouteParamsMatch?.kind === "fallback-shell";
 	const renderParams = prerenderRouteParams ?? params;
-	const responseStageMatchKind = isInterceptionMatch ? "interception" : cleanPathnameIsRequestPathname && options.matchRequestRoute ? "request" : "resolved";
+	const responseStageMatchKind = isInterceptionMatch ? "interception" : cleanPathnameIsRequestPathname && options.matchRequestRoute ? usesRawRequestMatch() ? "raw-request" : "request" : "resolved";
 	const responseStageRoutePathname = isInterceptionMatch ? preActionRoutePathname : cleanPathnameIsRequestPathname ? requestCleanPathname || "/" : cleanPathname || "/";
 	const matchedResponseStage = transportedResponseStage ?? options.renderResponseStageLocally;
 	let runtimeFallbackShells = [];
@@ -1067,7 +1194,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			middlewareCookieOverlay,
 			mountedSlotsHeader,
 			params,
-			protocolVersion: 10,
+			protocolVersion: 11,
 			requestOrigin: url.origin,
 			renderMode,
 			resolvedUrl,
@@ -1088,7 +1215,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			searchParams: resolvedSearchParams
 		});
 	}
-	const pageResponse = matchedResponseStage ? await matchedResponseStage(responseStageRequest(), {
+	const pageResponse = withStoredSpecialErrorStatus(matchedResponseStage ? await matchedResponseStage(responseStageRequest(), {
 		kind: "app-page",
 		buildId: options.buildId,
 		cacheability: responseStageCacheability(resolvedUrl),
@@ -1099,14 +1226,14 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		cleanPathname,
 		draftModeCookie,
 		forceDynamic: route.forceDynamic === true,
-		interceptionContext: isRscRequest ? interceptionContextHeader : null,
+		interceptionContext: isRscRequest ? interceptionSourceContext : null,
 		interceptionId: interceptionIdHeader,
 		isRscRequest,
 		matchKind: responseStageMatchKind,
 		middlewareCookieOverlay,
 		mountedSlotsHeader,
 		params,
-		protocolVersion: 10,
+		protocolVersion: 11,
 		requestOrigin: url.origin,
 		renderMode,
 		resolvedUrl,
@@ -1123,7 +1250,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		actionError: normalizedProgressiveActionError,
 		actionFailed,
 		handlerStart,
-		interceptionContext: isRscRequest ? interceptionContextHeader : null,
+		interceptionContext: isRscRequest ? interceptionSourceContext : null,
 		interceptionId: interceptionIdHeader,
 		interceptionPathname: cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname,
 		isProgressiveActionRender,
@@ -1146,7 +1273,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		scriptNonce,
 		searchParams: resolvedSearchParams,
 		renderMode
-	});
+	}), isRscRequest && request.headers.get("Next-Router-Prefetch") === "1" && request.headers.has("Next-Router-Segment-Prefetch"));
 	if (isProgressiveActionRender) return applyProgressiveActionSideEffects(pageResponse, progressiveActionFormState);
 	return pageResponse;
 }
@@ -1250,7 +1377,7 @@ function createAppRscRequestHandler(options) {
 				recordCacheability: dispatchResponseStage === void 0,
 				requestContext: preMiddlewareRequestContext
 			});
-			return interceptionResponseUncacheable ? markUnverifiedInterceptionResponseUncacheable(response) : response;
+			return interceptionResponseUncacheable || unmatchedRouteResponses.has(response) ? withNeverCacheControl(response) : response;
 		}, {
 			cacheComponents: options.createPprFallbackShells !== void 0,
 			route: () => new URL(request.url).pathname

package/dist/server/app-rsc-request-normalization.d.ts

@@ -35,7 +35,9 @@ export type NormalizedRscRequest = {
  *
  *   1. Parse URL
  *   2. Protocol-relative URL guard — on the raw pathname, BEFORE normalizePath collapses
- *      `//` to `/`. If the guard ran after normalization, `//evil.com` → `/evil.com`
+ *      `//` to `/`. Literal repeated slashes / backslashes get Next.js's 308 to the
+ *      collapsed path; encoded leading `%2F` / `%5C` get a 404. If the guard ran after
+ *      normalization, `//evil.com` → `/evil.com`
  *      would bypass the check and reach the trailing-slash redirector, which echoes the
  *      path into a `Location` header that browsers interpret as protocol-relative.
  *   3. Strict percent-decode each segment — throws on malformed sequences (→ 400). Must
@@ -55,6 +57,6 @@ export type NormalizedRscRequest = {
  * @returns A 400 or 404 Response for invalid or out-of-scope inputs,
  *          or a NormalizedRscRequest for valid requests.
  */
-export declare function normalizeRscRequest(request: Request, basePath: string, allowOutsideBasePath?: boolean): Response | NormalizedRscRequest;
+export declare function normalizeRscRequest(request: Request, basePath: string, allowOutsideBasePath?: boolean, assetPrefix?: string): Response | NormalizedRscRequest;
 //#endregion
 export { normalizeMountedSlotsHeader };

package/dist/server/app-rsc-request-normalization.js

@@ -1,3 +1,4 @@
+import { assetPrefixPathname, isNextStaticPath } from "../utils/asset-prefix.js";
 import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERCEPTION_ID_HEADER, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_RSC_RENDER_MODE_HEADER } from "./app-rsc-vary.js";
@@ -68,7 +69,9 @@ function tryNormalizeComparablePathAndSearch(value, basePath, baseUrl) {
 *
 *   1. Parse URL
 *   2. Protocol-relative URL guard — on the raw pathname, BEFORE normalizePath collapses
-*      `//` to `/`. If the guard ran after normalization, `//evil.com` → `/evil.com`
+*      `//` to `/`. Literal repeated slashes / backslashes get Next.js's 308 to the
+*      collapsed path; encoded leading `%2F` / `%5C` get a 404. If the guard ran after
+*      normalization, `//evil.com` → `/evil.com`
 *      would bypass the check and reach the trailing-slash redirector, which echoes the
 *      path into a `Location` header that browsers interpret as protocol-relative.
 *   3. Strict percent-decode each segment — throws on malformed sequences (→ 400). Must
@@ -88,9 +91,9 @@ function tryNormalizeComparablePathAndSearch(value, basePath, baseUrl) {
 * @returns A 400 or 404 Response for invalid or out-of-scope inputs,
 *          or a NormalizedRscRequest for valid requests.
 */
-function normalizeRscRequest(request, basePath, allowOutsideBasePath = false) {
+function normalizeRscRequest(request, basePath, allowOutsideBasePath = false, assetPrefix = "") {
 	const url = new URL(request.url);
-	const protoGuard = guardProtocolRelativeUrl(url.pathname);
+	const protoGuard = guardProtocolRelativeUrl(url.pathname, url.search);
 	if (protoGuard) return protoGuard;
 	let decoded;
 	try {
@@ -103,7 +106,7 @@ function normalizeRscRequest(request, basePath, allowOutsideBasePath = false) {
 	let hadBasePath = true;
 	if (basePath) {
 		hadBasePath = hasBasePath(requestPathname, basePath);
-		if (!hadBasePath && !pathname.startsWith("/__vinext/") && !allowOutsideBasePath) return notFoundResponse();
+		if (!hadBasePath && !pathname.startsWith("/__vinext/") && !allowOutsideBasePath && !isNextStaticPath(pathname, "", assetPrefixPathname(assetPrefix))) return notFoundResponse();
 		if (hadBasePath) {
 			pathname = stripBasePath(pathname, basePath);
 			requestPathname = stripBasePath(requestPathname, basePath);

package/dist/server/app-rsc-response-finalizer.js

@@ -15,7 +15,10 @@ const configHeadersAlreadyApplied = /* @__PURE__ */ new WeakSet();
 function normalizeExplicitNonCacheablePolicy(headers) {
 	if (!hasExplicitNonCacheableResponsePolicy(headers)) return;
 	const cacheControl = headers.get("Cache-Control");
-	applyCdnResponseHeaders(headers, { cacheControl: cacheControl && isNonCacheableCacheControl(cacheControl) ? cacheControl : NO_STORE_CACHE_CONTROL });
+	applyCdnResponseHeaders(headers, {
+		cacheControl: cacheControl && isNonCacheableCacheControl(cacheControl) ? cacheControl : NO_STORE_CACHE_CONTROL,
+		browserCacheControl: cacheControl ?? void 0
+	});
 }
 /** Mark a response whose final target pipeline has already applied config headers. */
 function markAppRscResponseConfigHeadersApplied(response) {