vinext 1.0.1 → 1.2.0

package/dist/server/app-rsc-handler.js

@@ -1,20 +1,22 @@
 import { preserveFullyBufferedBodyMetadata } from "./fully-buffered-response.js";
 import { closeAfterResponse, closeAfterResponseWithBody, createRequestContext, runWithRequestContext } from "../shims/unified-request-context.js";
 import { PRERENDER_REVALIDATE_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
-import { hasMiddlewareRequestHeaderOverrides } from "../utils/middleware-request-headers.js";
+import { buildRequestHeadersFromMiddlewareResponse, hasMiddlewareRequestHeaderOverrides } from "../utils/middleware-request-headers.js";
 import { requestContextFromRequest } from "../config/request-context.js";
 import { isExternalUrl } from "../utils/external-url.js";
 import { assetPrefixPathname, isNextStaticPath } from "../utils/asset-prefix.js";
-import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
+import { normalizePathnameForRouteMatch, normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { addBasePathToPathname, hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { patternToNextFormat } from "../routing/route-validation.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
 import "./app-rsc-vary.js";
-import { ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_REWRITTEN_HEADER, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER } from "./headers.js";
+import { ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_REWRITTEN_HEADER, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_SPECIAL_ERROR_STATUS_HEADER } from "./headers.js";
+import { runOutsideWorkStoreScope } from "../shims/internal/work-store-scope.js";
 import { isInterceptionMatchedUrlPath, normalizePath } from "./normalize-path.js";
 import { badRequestResponse, notFoundResponse, notFoundStaticAssetResponse } from "./http-error-responses.js";
-import { cloneRequestWithHeaders, cloneRequestWithUrl, filterInternalHeaders, normalizeTrailingSlash, resolvePublicFileRoute } from "./request-pipeline.js";
+import { cloneRequestWithHeaders, cloneRequestWithUrl, filterInternalHeaders, normalizeTrailingSlash, normalizeTrailingSlashPathname, resolvePublicFileRoute } from "./request-pipeline.js";
 import { normalizeDefaultLocalePathname } from "./pages-i18n.js";
+import { buildNextDataNotFoundResponse, normalizePagesDataRequest } from "./pages-data-route.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { markRouteCacheabilityDynamic, preserveRouteCacheabilityResponsePolicy } from "../shims/cacheability-classification.js";
 import { NEVER_CACHE_CONTROL, applyCdnResponseHeaders, captureCdnResponsePolicyOverrides, isCdnResponsePolicyHeader, reconcileCdnResponseHeadersAfterOuterPolicy } from "./cache-control.js";
@@ -22,9 +24,8 @@ import { isOnDemandRevalidateRequest } from "./revalidation-request.js";
 import { getDraftModeCookieHeader, getEffectiveRequestCookieHeader, getHeadersContext, hasEffectiveRequestCookieChanges, headersContextFromRequest, isDraftModeEnabled, isDraftModeRequest, runWithHeadersContext } from "../shims/headers.js";
 import { mergeRewriteQuery } from "../utils/query.js";
 import { getScriptNonceFromHeaderSources } from "./csp.js";
-import { buildNextDataNotFoundResponse, normalizePagesDataRequest } from "./pages-data-route.js";
 import { traceFindPageComponents } from "./pages-execution-tracing.js";
-import { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, isImageOptimizationPath, resolveDevImageRedirect } from "./image-optimization.js";
+import { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, isImageOptimizationPath, markImageOptimizationSignal, resolveDevImageRedirect } from "./image-optimization.js";
 import { parseCacheabilityManifest } from "./cacheability-manifest.js";
 import { getRenderedConcreteUrlPathsForRoute } from "./pregenerated-concrete-paths.js";
 import { VINEXT_RSC_CACHE_BUSTING_SEARCH_PARAM, canonicalizeLoadingShellRscRequestHeaders, canonicalizePrewarmableRscRequestHeaders, createCanonicalRscRequestUrl, createRscRedirectLocation, createRscRequestUrl, hasRscCacheBustingSearchParam, resolveInvalidRscCacheBustingRequest, stripRscCacheBustingSearchParam, stripRscSuffix } from "./app-rsc-cache-busting.js";
@@ -33,10 +34,13 @@ import { consumeResponseStageLinkProvenance, copyLinkHeaderProvenance } from "./
 import "./app-page-response.js";
 import { parseNextHttpErrorDigest } from "./next-error-digest.js";
 import { traceAppPageRender } from "./app-page-tracing.js";
+import { openForwardedMiddlewareContext } from "./forwarded-middleware-context.js";
 import { setFrameworkRequestRoute, traceFrameworkRequest } from "./request-tracing.js";
 import { matchPrerenderRouteParamsPayload, readTrustedPrerenderRouteParams, serializePrerenderRouteParamsHeader } from "./prerender-route-params.js";
 import { buildPageCacheTags } from "./implicit-tags.js";
 import { createServerActionNotFoundResponse, getServerActionNotFoundMessage } from "./server-action-not-found.js";
+import { isPossibleAppRouteActionRequest } from "./app-action-request.js";
+import { normalizeInterceptionContextHeader } from "./app-interception-context-header.js";
 import { buildPostMwRequestContext } from "./app-post-middleware-context.js";
 import { pickRootParams, setRootParams } from "../shims/root-params.js";
 import { createRouteTreePrefetchResponse, isRouteTreePrefetchRequest } from "./app-route-tree-prefetch.js";
@@ -51,6 +55,33 @@ import { consumePagesResponseStagePolicyOwner, withoutResponseStageVary } from "
 const HAS_CONFIG_HEADERS = process.env.__VINEXT_HAS_CONFIG_HEADERS !== "false";
 const HAS_CONFIG_REDIRECTS = process.env.__VINEXT_HAS_CONFIG_REDIRECTS !== "false";
 const HAS_CONFIG_REWRITES = process.env.__VINEXT_HAS_CONFIG_REWRITES !== "false";
+/**
+* Decode an interception context to the canonical source pathname it names.
+* Throws for any value the client could not send back as its context header.
+*/
+function decodeInterceptionSourcePathname(context) {
+	if (!isInterceptionMatchedUrlPath(context)) throw new Error("Invalid interception source pathname");
+	if (new URL(context, "http://n").pathname !== context) throw new Error("Interception source is not a parsed URL pathname");
+	const decodedSourcePathname = normalizePathnameForRouteMatchStrict(context);
+	if (/[\t\n\r]/.test(decodedSourcePathname)) throw new Error("Interception source contains a stripped URL character");
+	if (hasUrlParserDotSegment(decodedSourcePathname)) throw new Error("Interception source contains a URL dot segment");
+	const sourcePathname = normalizePath(decodedSourcePathname);
+	if (sourcePathname !== decodedSourcePathname) throw new Error("Non-canonical interception source pathname");
+	return sourcePathname;
+}
+/**
+* Whether a server-derived context satisfies the whole inbound header
+* contract, so the client can send it back unchanged on its next request.
+*/
+function isValidInterceptionSourceContext(context) {
+	if (normalizeInterceptionContextHeader(context) !== context) return false;
+	try {
+		decodeInterceptionSourcePathname(context);
+		return true;
+	} catch {
+		return false;
+	}
+}
 function ruleUsesUnkeyedRequestCondition(rule) {
 	return [...rule.has ?? [], ...rule.missing ?? []].some((condition) => condition.type === "header" || condition.type === "cookie" || condition.type === "host");
 }
@@ -118,11 +149,32 @@ function applyMiddlewareContextToResponse(response, middlewareContext, appendToP
 	const middlewareLink = middlewareContext.headers?.get("link");
 	if (responseLink && middlewareLink) headers.set("link", `${middlewareLink}, ${responseLink}`);
 	return preserveFullyBufferedBodyMetadata(response, new Response(response.body, {
-		status: middlewareContext.status ?? response.status,
+		status: response.status === 304 ? 304 : middlewareContext.status ?? response.status,
 		statusText: response.statusText,
 		headers
 	}));
 }
+/**
+* Next.js answers a Link's segment prefetch of a page whose notFound(),
+* forbidden() or unauthorized() it stored with a 200, so its router renders
+* the page's fallback without loading the document. A shared response stage
+* gives that prefetch the navigation's response, so the request's own headers
+* decide the status here.
+*/
+function withStoredSpecialErrorStatus(response, isSegmentPrefetch) {
+	const marker = response.headers.get(VINEXT_SPECIAL_ERROR_STATUS_HEADER);
+	if (marker === null) return response;
+	const headers = new Headers(response.headers);
+	headers.delete(VINEXT_SPECIAL_ERROR_STATUS_HEADER);
+	const storedStatus = Number(marker);
+	const isStoredSpecialError = storedStatus === 401 || storedStatus === 403 || storedStatus === 404;
+	const status = response.status === 304 || !isStoredSpecialError ? response.status : isSegmentPrefetch ? 200 : storedStatus;
+	return preserveFullyBufferedBodyMetadata(response, new Response(response.body, {
+		headers,
+		status,
+		statusText: status === response.status ? response.statusText : ""
+	}));
+}
 function hasProperty(value, key) {
 	return key in value;
 }
@@ -155,8 +207,10 @@ async function applyRewrite(options, cleanPathname, recordCacheability = true) {
 	if (isExternalUrl(rewritten)) {
 		const validationResponse = await options.validateExternalRewriteRequest();
 		if (validationResponse) return validationResponse;
+		const { requestWithMiddlewareContextHeaders } = await import("./app-middleware.js");
+		const proxyRequest = requestWithMiddlewareContextHeaders(options.request, options.middlewareContext);
 		options.clearRequestContext();
-		return configMatchers.proxyExternalRequest(options.request, rewritten);
+		return configMatchers.proxyExternalRequest(proxyRequest, rewritten);
 	}
 	return rewritten;
 }
@@ -171,6 +225,16 @@ function requestContextForResolvedUrl(requestContext, resolvedUrl, baseUrl) {
 function pathnameForResolvedUrl(resolvedUrl) {
 	return resolvedUrl.split("#", 1)[0].split("?", 1)[0];
 }
+/**
+* Percent-encode the code points the URL parser encodes in a path (so `é`
+* becomes `%C3%A9`) without resolving dot segments or `\`: Next.js only parses
+* a rewrite destination's template, so a captured `../admin` stays verbatim.
+*/
+function serializeResolvedUrl(resolvedUrl, base) {
+	const resolved = new URL(resolvedUrl, base);
+	stripRscCacheBustingSearchParam(resolved);
+	return pathnameForResolvedUrl(resolvedUrl).replace(/[\0-\x20"<>`{}^\x7F]|[^\0-\x7F]/gu, (char) => char.length === 1 && char >= "\ud800" && char <= "\udfff" ? "%EF%BF%BD" : encodeURIComponent(char)) + resolved.search + resolved.hash;
+}
 async function applyConfigHeadersToMiddlewareRedirect(response, options) {
 	if (response.status < 300 || response.status >= 400) return response;
 	if (!HAS_CONFIG_HEADERS || !options.configHeaders.length) return response;
@@ -206,7 +270,8 @@ function requestWithoutRscSuffix(request) {
 	url.pathname = pathname;
 	return cloneRequestWithUrl(request, url.toString());
 }
-function markUnverifiedInterceptionResponseUncacheable(response) {
+/** Send a response with the never-cache policy, rebuilding immutable headers. */
+function withNeverCacheControl(response) {
 	const applyNoStore = (headers) => {
 		applyCdnResponseHeaders(headers, { cacheControl: NEVER_CACHE_CONTROL });
 	};
@@ -224,6 +289,13 @@ function markUnverifiedInterceptionResponseUncacheable(response) {
 	}
 	return markedResponse;
 }
+const unmatchedRouteResponses = /* @__PURE__ */ new WeakSet();
+/** Send an unmatched route's 404 with the never-cache policy, as Next.js does. */
+function withUnmatchedRouteCacheControl(response) {
+	const markedResponse = withNeverCacheControl(response);
+	unmatchedRouteResponses.add(markedResponse);
+	return markedResponse;
+}
 async function handleAppRscRequest(options, request, preMiddlewareRequestContext, middlewareContext, isDataRequest, isMiddlewareDataRequest, pagesDataRequest, dispatchInternalRequest, allowInternalRscDocumentFallback, dispatchResponseStage, responseStageProbeMode = null, setInterceptionResponseUncacheable = () => {}) {
 	const handlerStart = process.env.NODE_ENV !== "production" ? performance.now() : 0;
 	if (process.env.NODE_ENV !== "production") {
@@ -248,12 +320,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	if (hasRawInterceptionContext) setInterceptionResponseUncacheable(true);
 	let interceptionSourcePathname = null;
 	if (isRscRequest && interceptionContextHeader !== null) try {
-		if (!isInterceptionMatchedUrlPath(interceptionContextHeader)) throw new Error("Invalid interception source pathname");
-		const decodedInterceptionSourcePathname = normalizePathnameForRouteMatchStrict(interceptionContextHeader);
-		if (/[\t\n\r]/.test(decodedInterceptionSourcePathname)) throw new Error("Interception source contains a stripped URL character");
-		if (hasUrlParserDotSegment(decodedInterceptionSourcePathname)) throw new Error("Interception source contains a URL dot segment");
-		interceptionSourcePathname = normalizePath(decodedInterceptionSourcePathname);
-		if (interceptionSourcePathname !== decodedInterceptionSourcePathname) throw new Error("Non-canonical interception source pathname");
+		interceptionSourcePathname = decodeInterceptionSourcePathname(interceptionContextHeader);
 	} catch {
 		options.clearRequestContext();
 		setInterceptionResponseUncacheable(true);
@@ -262,7 +329,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	const { requestCleanPathname } = normalized;
 	let { pathname, cleanPathname } = normalized;
 	let resolvedUrl = cleanPathname + url.search;
-	const originalResolvedUrl = resolvedUrl;
+	const originalResolvedUrl = serializeResolvedUrl(resolvedUrl, url);
 	const getResolvedSearchParams = () => new URL(resolvedUrl, url).searchParams;
 	const canonicalPathname = cleanPathname;
 	const basePathState = {
@@ -282,10 +349,10 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		});
 		if (selectorCacheBustingRedirect) return selectorCacheBustingRedirect;
 	}
-	const provesConcreteInterceptionSource = (sourceMatch) => {
+	const provesConcreteInterceptionSource = (sourceMatch, sourceContext = interceptionContextHeader) => {
 		if (sourceMatch === null) return false;
 		if (sourceMatch.interceptionSourceIsConcrete !== void 0) return sourceMatch.interceptionSourceIsConcrete;
-		return interceptionSourcePathname !== null && options.matchRoute(interceptionSourcePathname)?.route === sourceMatch.route;
+		return sourceContext !== null && (options.matchRequestRoute ?? options.matchRoute)(sourceContext)?.route === sourceMatch.route;
 	};
 	if (provesConcreteInterceptionSource(hadBasePath && hasRawInterceptionContext && interceptionContextHeader !== null ? options.matchInterceptRoute?.(requestCleanPathname, interceptionContextHeader, interceptionIdHeader) ?? null : null)) setInterceptionResponseUncacheable(false);
 	if (pathname === "/__vinext/prerender/static-params" || pathname === "/__vinext/prerender/pages-static-paths" || pathname === "/__vinext/prerender/metadata-routes") {
@@ -302,15 +369,17 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		});
 		if (prerenderEndpointResponse) return prerenderEndpointResponse;
 	}
-	const trailingSlashRedirect = options.trailingSlash && options.isMetadataRoutePath && await options.isMetadataRoutePath(cleanPathname) ? null : normalizeTrailingSlash(requestCleanPathname, hadBasePath ? options.basePath : "", options.trailingSlash, url.search);
-	if (trailingSlashRedirect) return trailingSlashRedirect;
+	if (!options.skipTrailingSlashRedirect) {
+		const trailingSlashRedirect = options.trailingSlash && options.isMetadataRoutePath && await options.isMetadataRoutePath(cleanPathname) ? null : normalizeTrailingSlash(requestCleanPathname, hadBasePath ? options.basePath : "", options.trailingSlash, url.search);
+		if (trailingSlashRedirect) return trailingSlashRedirect;
+	}
 	const matchPathname = (p) => normalizeDefaultLocalePathname(p, options.i18nConfig, { hostname: url.hostname });
 	const redirectPathname = matchPathname(requestCleanPathname);
 	const configMatchers = HAS_CONFIG_REDIRECTS && options.configRedirects.length ? await import("../config/config-matchers.js") : null;
 	const redirect = configMatchers ? configMatchers.matchRedirect(redirectPathname, options.configRedirects, preMiddlewareRequestContext, basePathState, dispatchResponseStage ? void 0 : markConditionalRedirectCacheability) : null;
 	if (configMatchers && redirect) {
 		const destination = configMatchers.sanitizeDestination(redirectDestinationWithBasePath(redirect.destination, options.basePath, hadBasePath));
-		const location = isRscRequest && request.headers.get("RSC") === "1" ? await createRscRedirectLocation(destination, request) : configMatchers.preserveRedirectDestinationQuery(destination, url.search);
+		const location = isRscRequest && request.headers.get("RSC") === "1" ? await createRscRedirectLocation(destination, request) : configMatchers.preserveRedirectDestinationQuery(destination, url.search, redirect.destinationQuery);
 		return new Response(null, {
 			status: redirect.permanent ? 308 : 307,
 			headers: { Location: location }
@@ -336,6 +405,11 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	const isolatedMiddlewareRequest = isolatedMiddlewareSource ? requestWithoutRscCacheBustingSearchParam(requestWithoutRscSuffix(isolatedMiddlewareSource)) : void 0;
 	let didMiddlewareRewrite = false;
 	let didMiddlewareRewritePathname = false;
+	let resolvedPathnameHasBasePath = hadBasePath;
+	const currentBasePathState = () => ({
+		basePath: options.basePath,
+		hadBasePath: resolvedPathnameHasBasePath
+	});
 	if (runMiddleware) {
 		const middlewareResult = await runMiddleware({
 			cleanPathname,
@@ -360,6 +434,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		}
 		cleanPathname = middlewareResult.cleanPathname;
 		didMiddlewareRewrite = middlewareResult.rewritten;
+		if (didMiddlewareRewrite) resolvedPathnameHasBasePath = middlewareResult.rewriteHadBasePath ?? true;
 		if (didMiddlewareRewrite || cleanPathname !== normalized.cleanPathname) cleanPathnameIsRequestPathname = false;
 		didMiddlewareRewritePathname = cleanPathname !== normalized.cleanPathname;
 		if (middlewareResult.search !== null) url.search = middlewareResult.search;
@@ -461,7 +536,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 				isRscRequest,
 				middlewareCookieOverlay,
 				mountedSlotsHeader,
-				protocolVersion: 10,
+				protocolVersion: 11,
 				requestOrigin: url.origin,
 				renderMode,
 				resolvedUrl,
@@ -522,8 +597,9 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	filesystemRouteEligible ||= didMiddlewareRewrite;
 	for (const rewrite of options.configRewrites.beforeFiles) {
 		const beforeFilesRewrite = await applyRewrite({
-			basePathState,
+			basePathState: currentBasePathState(),
 			clearRequestContext: options.clearRequestContext,
+			middlewareContext,
 			request: normalizedUserlandRequest,
 			requestContext: requestContextForResolvedUrl(postMiddlewareRequestContext, resolvedUrl, url),
 			paramsPathname: matchPathname(cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname),
@@ -536,6 +612,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			cleanPathname = pathnameForResolvedUrl(resolvedUrl);
 			cleanPathnameIsRequestPathname = false;
 			filesystemRouteEligible = true;
+			resolvedPathnameHasBasePath = !options.basePath || rewrite.basePath !== false;
 		}
 	}
 	const claimedRscCacheBustingRedirect = await validateClaimedOutsideBasePathRsc();
@@ -549,8 +626,9 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		let actionMatch = null;
 		for (const rewrite of options.configRewrites.afterFiles) {
 			const rewritten = await applyRewrite({
-				basePathState,
+				basePathState: currentBasePathState(),
 				clearRequestContext: options.clearRequestContext,
+				middlewareContext,
 				request: normalizedUserlandRequest,
 				requestContext: requestContextForResolvedUrl(postMiddlewareRequestContext, resolvedUrl, url),
 				paramsPathname: matchPathname(cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname),
@@ -563,13 +641,15 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			cleanPathname = pathnameForResolvedUrl(resolvedUrl);
 			cleanPathnameIsRequestPathname = false;
 			filesystemRouteEligible = true;
+			resolvedPathnameHasBasePath = !options.basePath || rewrite.basePath !== false;
 			actionMatch = matchCleanPathname();
 			if (actionMatch) break;
 		}
 		if (!actionMatch) for (const rewrite of options.configRewrites.fallback) {
 			const rewritten = await applyRewrite({
-				basePathState,
+				basePathState: currentBasePathState(),
 				clearRequestContext: options.clearRequestContext,
+				middlewareContext,
 				request: normalizedUserlandRequest,
 				requestContext: requestContextForResolvedUrl(postMiddlewareRequestContext, resolvedUrl, url),
 				paramsPathname: matchPathname(cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname),
@@ -582,6 +662,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			cleanPathname = pathnameForResolvedUrl(resolvedUrl);
 			cleanPathnameIsRequestPathname = false;
 			filesystemRouteEligible = true;
+			resolvedPathnameHasBasePath = !options.basePath || rewrite.basePath !== false;
 			actionMatch = matchCleanPathname();
 			if (actionMatch) break;
 		}
@@ -589,15 +670,29 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	}
 	const lateActionRscCacheBustingRedirect = await validateClaimedOutsideBasePathRsc();
 	if (lateActionRscCacheBustingRedirect) return lateActionRscCacheBustingRedirect;
-	if (filesystemRouteEligible && isImageOptimizationPath(cleanPathname)) {
-		const imageRedirect = resolveDevImageRedirect(url, [...options.imageConfig?.deviceSizes ?? DEFAULT_DEVICE_SIZES, ...options.imageConfig?.imageSizes ?? DEFAULT_IMAGE_SIZES], options.imageConfig?.qualities, { isDev: options.isDev });
-		if (!imageRedirect) return new Response("Invalid image optimization parameters", { status: 400 });
-		return Response.redirect(new URL(imageRedirect, url.origin).href, 302);
-	}
+	const serveImageEndpointIfMatched = () => {
+		if (!filesystemRouteEligible || !resolvedPathnameHasBasePath || !isImageOptimizationPath(cleanPathname)) return null;
+		const imageUrl = new URL(resolvedUrl, url);
+		const imageRedirect = resolveDevImageRedirect(imageUrl, [...options.imageConfig?.deviceSizes ?? DEFAULT_DEVICE_SIZES, ...options.imageConfig?.imageSizes ?? DEFAULT_IMAGE_SIZES], options.imageConfig?.qualities, { isDev: options.isDev });
+		const middlewareHeaders = new Headers();
+		mergeMiddlewareResponseHeaders(middlewareHeaders, middlewareContext.headers);
+		if (!imageRedirect) return new Response("Invalid image optimization parameters", {
+			status: 400,
+			headers: middlewareHeaders
+		});
+		const overrideHeaders = middlewareContext.requestHeaders ?? middlewareContext.headers;
+		return markImageOptimizationSignal(Response.redirect(new URL(imageRedirect, url.origin).href, 302), {
+			middlewareHeaders,
+			requestHeaders: overrideHeaders ? buildRequestHeadersFromMiddlewareResponse(request.headers, overrideHeaders) : null,
+			search: imageUrl.search
+		});
+	};
+	const imageEndpointResponse = serveImageEndpointIfMatched();
+	if (imageEndpointResponse) return imageEndpointResponse;
 	const metadataRouteResponse = await renderMetadataRouteIfMatched();
 	if (metadataRouteResponse) return composeResponseStageResponse(metadataRouteResponse);
 	const publicFileResponse = filesystemRouteEligible ? resolvePublicFileRoute({
-		cleanPathname,
+		cleanPathname: cleanPathnameIsRequestPathname ? cleanPathname : normalizePathnameForRouteMatch(cleanPathname),
 		middlewareContext,
 		pathname,
 		publicFiles: options.publicFiles,
@@ -608,9 +703,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		return publicFileResponse;
 	}
 	stripRscCacheBustingSearchParam(url);
-	const resolved = new URL(resolvedUrl, url);
-	stripRscCacheBustingSearchParam(resolved);
-	resolvedUrl = resolved.pathname + resolved.search + resolved.hash;
+	resolvedUrl = serializeResolvedUrl(resolvedUrl, url);
 	options.setNavigationContext({
 		pathname: canonicalPathname,
 		searchParams: getResolvedSearchParams(),
@@ -618,8 +711,9 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	});
 	const directPreActionMatch = filesystemRouteEligible ? matchCleanPathname() : null;
 	const preActionRoutePathname = cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname;
-	const interceptionSourceMatch = filesystemRouteEligible && interceptionSourcePathname !== null && interceptionContextHeader !== null ? options.matchInterceptRoute?.(preActionRoutePathname, interceptionContextHeader, interceptionIdHeader) ?? null : null;
-	const hasVerifiedInterceptionSource = provesConcreteInterceptionSource(interceptionSourceMatch);
+	let interceptionSourceContext = interceptionSourcePathname !== null ? interceptionContextHeader : null;
+	let interceptionSourceMatch = filesystemRouteEligible && interceptionSourcePathname !== null && interceptionContextHeader !== null ? options.matchInterceptRoute?.(preActionRoutePathname, interceptionContextHeader, interceptionIdHeader) ?? null : null;
+	let hasVerifiedInterceptionSource = provesConcreteInterceptionSource(interceptionSourceMatch);
 	if (interceptionIdHeader !== null && !hasVerifiedInterceptionSource) {
 		options.clearRequestContext();
 		setInterceptionResponseUncacheable(true);
@@ -634,81 +728,142 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		bypassInterceptionContextCache = true;
 		setInterceptionResponseUncacheable(true);
 	};
-	if (interceptionSourceMatch !== null && interceptionSourcePathname !== null && runMiddleware && interceptionSourceMatch.route !== directPreActionMatch?.route) {
-		const sourceUrl = new URL(userlandRequest.url);
-		sourceUrl.search = new URL(resolvedUrl, url).search;
-		sourceUrl.pathname = hadBasePath ? addBasePathToPathname(interceptionSourcePathname, options.basePath) : interceptionSourcePathname;
-		const sourceRequest = userlandRequest.body ? userlandRequest.clone() : userlandRequest;
-		const sourceMiddlewareRequest = cloneRequestWithUrl(sourceRequest, sourceUrl.href);
-		sourceMiddlewareRequest.headers.delete(VINEXT_MW_CTX_HEADER);
-		for (const header of FLIGHT_HEADERS) sourceMiddlewareRequest.headers.delete(header);
-		const targetHeadersContext = getHeadersContext();
-		const targetRequestHeaders = targetHeadersContext ? new Headers(targetHeadersContext.headers) : null;
-		targetRequestHeaders?.delete(VINEXT_MW_CTX_HEADER);
-		for (const header of FLIGHT_HEADERS) targetRequestHeaders?.delete(header);
-		if (targetRequestHeaders) {
-			const sourceHeaderNames = Array.from(sourceMiddlewareRequest.headers.keys());
-			for (const header of sourceHeaderNames) sourceMiddlewareRequest.headers.delete(header);
-			for (const [name, value] of targetRequestHeaders) sourceMiddlewareRequest.headers.append(name, value);
-		}
-		const sourceMiddlewareContext = {
-			headers: null,
-			requestHeaders: null,
-			status: null
-		};
-		const sourceHeadersContext = headersContextFromRequest(sourceMiddlewareRequest, { draftModeSecret: options.draftModeSecret });
-		let sourceMiddlewareResult;
-		try {
-			sourceMiddlewareResult = await runWithHeadersContext(sourceHeadersContext, () => runMiddleware({
-				cleanPathname: interceptionSourcePathname,
-				context: sourceMiddlewareContext,
-				externalRewriteRequest: normalizedUserlandRequest,
-				hadBasePath,
-				isDataRequest: isMiddlewareDataRequest,
-				request: sourceMiddlewareRequest,
-				validateExternalRewriteRequest: () => validateClaimedOutsideBasePathRsc(true)
-			}));
-		} finally {
-			if (sourceMiddlewareRequest.body && !sourceMiddlewareRequest.bodyUsed && !sourceMiddlewareRequest.body.locked) sourceMiddlewareRequest.body.cancel().catch(() => {});
-			if (sourceRequest !== userlandRequest && sourceRequest.body && !sourceRequest.bodyUsed && !sourceRequest.body.locked) sourceRequest.body.cancel().catch(() => {});
-		}
-		if (!dispatchResponseStage && sourceMiddlewareResult.pathnameEligible) markRouteCacheabilityDynamic(sourceMiddlewareResult.matched ? "middleware matched this request" : "middleware is eligible for this pathname");
-		if (sourceMiddlewareResult.kind === "response") {
-			options.clearRequestContext();
-			return sourceMiddlewareResult.response;
-		}
-		let sourceHeadersCompatible = true;
-		if (targetRequestHeaders) {
-			for (const [name, value] of targetRequestHeaders) if (sourceHeadersContext.headers.get(name) !== value) {
-				sourceHeadersCompatible = false;
-				break;
+	if (interceptionSourceMatch !== null && interceptionContextHeader !== null && interceptionSourcePathname !== null && !(interceptionSourceMatch.route === directPreActionMatch?.route && haveSamePageParams(interceptionSourceMatch.params, directPreActionMatch.params))) {
+		const sourceRequestPathname = options.skipTrailingSlashRedirect ? interceptionContextHeader : normalizeTrailingSlashPathname(interceptionContextHeader, options.trailingSlash) ?? interceptionContextHeader;
+		const decodedSourceRequestPathname = options.skipTrailingSlashRedirect ? interceptionSourcePathname : normalizeTrailingSlashPathname(interceptionSourcePathname, options.trailingSlash) ?? interceptionSourcePathname;
+		const adoptRewrittenInterceptionSource = (rewrittenPathname) => {
+			const rewrittenInterceptionSourceMatch = isValidInterceptionSourceContext(rewrittenPathname) ? options.matchInterceptRoute?.(preActionRoutePathname, rewrittenPathname, interceptionIdHeader) ?? null : null;
+			if (rewrittenInterceptionSourceMatch !== null) {
+				interceptionSourceMatch = rewrittenInterceptionSourceMatch;
+				interceptionSourceContext = rewrittenPathname;
 			}
-		}
-		if (!targetHeadersContext || !targetRequestHeaders || !sourceHeadersCompatible || !haveSameRequestCookies(targetHeadersContext.cookies, sourceHeadersContext.cookies)) {
+			const rewrittenSourceMatch = options.matchRoute(rewrittenPathname);
+			return interceptionSourceMatch !== null && rewrittenSourceMatch?.route === interceptionSourceMatch.route && haveSamePageParams(rewrittenSourceMatch.params, interceptionSourceMatch.params);
+		};
+		if (configMatchers?.matchRedirect(matchPathname(sourceRequestPathname), options.configRedirects, preMiddlewareRequestContext, basePathState, dispatchResponseStage ? void 0 : markConditionalRedirectCacheability)) {
 			options.clearRequestContext();
 			return notFoundResponse();
 		}
-		let addedSourceHeader = false;
-		for (const [name, value] of sourceHeadersContext.headers) if (!targetRequestHeaders.has(name)) {
-			targetHeadersContext.headers.set(name, value);
-			addedSourceHeader = true;
-		}
-		if (addedSourceHeader) {
-			targetHeadersContext.readonlyHeaders = void 0;
-			canUseSharedWorkerResponseStage = false;
+		let sourceRulesPathname = sourceRequestPathname;
+		if (runMiddleware) {
+			const sourceUrl = new URL(userlandRequest.url);
+			sourceUrl.search = new URL(resolvedUrl, url).search;
+			const sourceUrlPathname = hadBasePath && options.basePath ? sourceRequestPathname === "/" ? options.basePath : options.basePath + sourceRequestPathname : sourceRequestPathname;
+			sourceUrl.pathname = sourceUrlPathname;
+			if (sourceUrl.pathname !== sourceUrlPathname) {
+				options.clearRequestContext();
+				setInterceptionResponseUncacheable(true);
+				return badRequestResponse();
+			}
+			const sourceRequest = userlandRequest.body ? userlandRequest.clone() : userlandRequest;
+			const sourceMiddlewareRequest = cloneRequestWithUrl(sourceRequest, sourceUrl.href);
+			sourceMiddlewareRequest.headers.delete(VINEXT_MW_CTX_HEADER);
+			for (const header of FLIGHT_HEADERS) sourceMiddlewareRequest.headers.delete(header);
+			const targetHeadersContext = getHeadersContext();
+			const targetRequestHeaders = targetHeadersContext ? new Headers(targetHeadersContext.headers) : null;
+			targetRequestHeaders?.delete(VINEXT_MW_CTX_HEADER);
+			for (const header of FLIGHT_HEADERS) targetRequestHeaders?.delete(header);
+			if (targetRequestHeaders) {
+				const sourceHeaderNames = Array.from(sourceMiddlewareRequest.headers.keys());
+				for (const header of sourceHeaderNames) sourceMiddlewareRequest.headers.delete(header);
+				for (const [name, value] of targetRequestHeaders) sourceMiddlewareRequest.headers.append(name, value);
+			}
+			const sourceMiddlewareContext = {
+				headers: null,
+				requestHeaders: null,
+				status: null
+			};
+			const sourceHeadersContext = headersContextFromRequest(sourceMiddlewareRequest, { draftModeSecret: options.draftModeSecret });
+			let sourceMiddlewareResult;
+			try {
+				sourceMiddlewareResult = await runWithHeadersContext(sourceHeadersContext, () => runMiddleware({
+					cleanPathname: decodedSourceRequestPathname,
+					context: sourceMiddlewareContext,
+					externalRewriteRequest: normalizedUserlandRequest,
+					hadBasePath,
+					isDataRequest: isMiddlewareDataRequest,
+					request: sourceMiddlewareRequest,
+					validateExternalRewriteRequest: () => validateClaimedOutsideBasePathRsc(true)
+				}));
+			} finally {
+				if (sourceMiddlewareRequest.body && !sourceMiddlewareRequest.bodyUsed && !sourceMiddlewareRequest.body.locked) sourceMiddlewareRequest.body.cancel().catch(() => {});
+				if (sourceRequest !== userlandRequest && sourceRequest.body && !sourceRequest.bodyUsed && !sourceRequest.body.locked) sourceRequest.body.cancel().catch(() => {});
+			}
+			if (!dispatchResponseStage && sourceMiddlewareResult.pathnameEligible) markRouteCacheabilityDynamic(sourceMiddlewareResult.matched ? "middleware matched this request" : "middleware is eligible for this pathname");
+			if (sourceMiddlewareResult.kind === "response") {
+				options.clearRequestContext();
+				return sourceMiddlewareResult.response;
+			}
+			let sourceHeadersCompatible = true;
+			if (targetRequestHeaders) {
+				for (const [name, value] of targetRequestHeaders) if (sourceHeadersContext.headers.get(name) !== value) {
+					sourceHeadersCompatible = false;
+					break;
+				}
+			}
+			if (!targetHeadersContext || !targetRequestHeaders || !sourceHeadersCompatible || !haveSameRequestCookies(targetHeadersContext.cookies, sourceHeadersContext.cookies)) {
+				options.clearRequestContext();
+				return notFoundResponse();
+			}
+			let addedSourceHeader = false;
+			for (const [name, value] of sourceHeadersContext.headers) if (!targetRequestHeaders.has(name)) {
+				targetHeadersContext.headers.set(name, value);
+				addedSourceHeader = true;
+			}
+			if (addedSourceHeader) {
+				targetHeadersContext.readonlyHeaders = void 0;
+				canUseSharedWorkerResponseStage = false;
+			}
+			if (sourceMiddlewareResult.rewritten) {
+				if (sourceMiddlewareResult.search !== sourceUrl.search || !adoptRewrittenInterceptionSource(sourceMiddlewareResult.cleanPathname)) {
+					options.clearRequestContext();
+					return notFoundResponse();
+				}
+				sourceRulesPathname = sourceMiddlewareResult.cleanPathname;
+			}
 		}
-		if (sourceMiddlewareResult.rewritten) {
-			const rewrittenSourceMatch = options.matchRoute(sourceMiddlewareResult.cleanPathname);
-			if (sourceMiddlewareResult.search !== sourceUrl.search || rewrittenSourceMatch?.route !== interceptionSourceMatch.route || !haveSamePageParams(rewrittenSourceMatch.params, interceptionSourceMatch.params)) {
+		if (HAS_CONFIG_REWRITES && options.configRewrites.beforeFiles.length) {
+			const { matchRewrite } = await import("../config/config-matchers.js");
+			const sourceRewriteContext = requestContextForResolvedUrl(buildPostMwRequestContext(userlandRequest), resolvedUrl, url);
+			let didRewriteSource = false;
+			for (const rewrite of options.configRewrites.beforeFiles) {
+				const destination = matchRewrite(matchPathname(sourceRulesPathname), [rewrite], sourceRewriteContext, basePathState, matchPathname(sourceRulesPathname), dispatchResponseStage === void 0 ? markConditionalRewriteCacheability : void 0);
+				if (!destination) continue;
+				if (isExternalUrl(destination) || destination.includes("?")) {
+					options.clearRequestContext();
+					return notFoundResponse();
+				}
+				sourceRulesPathname = pathnameForResolvedUrl(destination);
+				didRewriteSource = true;
+			}
+			if (didRewriteSource && !adoptRewrittenInterceptionSource(sourceRulesPathname)) {
 				options.clearRequestContext();
 				return notFoundResponse();
 			}
 		}
 	}
+	if (interceptionSourceMatch !== null) {
+		hasVerifiedInterceptionSource = provesConcreteInterceptionSource(interceptionSourceMatch, interceptionSourceContext);
+		if (!hasVerifiedInterceptionSource) {
+			if (interceptionIdHeader !== null) {
+				options.clearRequestContext();
+				setInterceptionResponseUncacheable(true);
+				return badRequestResponse();
+			}
+			interceptionSourceMatch = null;
+			interceptionSourceContext = null;
+		}
+		bypassInterceptionContextCache = hasRawInterceptionContext && !hasVerifiedInterceptionSource;
+		setInterceptionResponseUncacheable(bypassInterceptionContextCache);
+	}
 	const interceptionPreActionMatch = filesystemRouteEligible && directPreActionMatch === null && isRscRequest && interceptionSourcePathname !== null ? interceptionSourceMatch : null;
 	const preActionMatch = directPreActionMatch ?? interceptionPreActionMatch;
 	const isInterceptionMatch = interceptionPreActionMatch !== null;
-	if (preActionMatch) setRootParams(pickRootParams(preActionMatch.params, preActionMatch.route.rootParamNames));
+	const rendersRawRequestMatch = options.matchRawRequestRoute !== void 0 && (isPossibleAppRouteActionRequest(request) || isDraftModeRequest(request, options.draftModeSecret) || isDraftModeEnabled());
+	const usesRawRequestMatch = () => rendersRawRequestMatch && cleanPathnameIsRequestPathname && !isInterceptionMatch;
+	const renderedRouteMatch = (routeMatch) => routeMatch !== null && usesRawRequestMatch() ? options.matchRawRequestRoute(requestCleanPathname) ?? routeMatch : routeMatch;
+	const renderedPreActionMatch = renderedRouteMatch(preActionMatch);
+	if (renderedPreActionMatch) setRootParams(pickRootParams(renderedPreActionMatch.params, renderedPreActionMatch.route.rootParamNames));
 	if (pagesDataRequest && didMiddlewareRewritePathname && preActionMatch && !preActionMatch.route.isDynamic) {
 		const headers = new Headers();
 		mergeMiddlewareResponseHeaders(headers, middlewareContext.headers);
@@ -729,7 +884,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			contentType,
 			middlewareContext,
 			request,
-			routeMatch: preActionMatch
+			routeMatch: renderedPreActionMatch
 		});
 		else if (preActionMatch?.route.__loadPage && !preActionMatch.route.__loadRouteHandler) return createMissingServerActionResponse(options, null);
 	}
@@ -761,13 +916,13 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		actionId,
 		cleanPathname,
 		contentType,
-		interceptionContext: interceptionContextHeader,
+		interceptionContext: interceptionSourceContext,
 		isRscRequest,
 		middlewareContext,
 		mountedSlotsHeader,
 		request,
 		scriptNonce,
-		routeMatch: preActionMatch,
+		routeMatch: renderedPreActionMatch,
 		routePathname: preActionRoutePathname,
 		dispatchRedirectTargetRequest: dispatchInternalRequest,
 		sourceConfigHeaders,
@@ -778,6 +933,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	let match = preActionMatch;
 	const renderPagesForMatchKind = async (matchKind) => {
 		if (!filesystemRouteEligible) return null;
+		const pagesRouteUrl = cleanPathnameIsRequestPathname ? requestCleanPathname + resolvedUrl.slice(pathnameForResolvedUrl(resolvedUrl).length) : resolvedUrl;
 		let sharedOuterPolicyNeedsReconciliation = false;
 		const dispatchPagesResponseStage = dispatchResponseStage ? async (stageRequest, resourceKind, dataKind, hasRequestAwareDocument) => {
 			const pagesOnDemandRevalidate = resourceKind === "page" && isOnDemandRevalidateRequest(stageRequest.headers.get("x-prerender-revalidate"));
@@ -803,11 +959,11 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 				matchKind,
 				middlewareCookieOverlay,
 				preHandlerHeaders: cache === "shared" && resourceKind === "page" && dataKind === "static" ? null : [...await loadPreHandlerResponseHeaders()],
-				protocolVersion: 10,
+				protocolVersion: 11,
 				requestOrigin: url.origin,
 				resourceKind,
 				requestUrl: request.url,
-				resolvedUrl,
+				resolvedUrl: pagesRouteUrl,
 				scriptNonce: scriptNonce ?? null
 			}, { cache });
 			const policyOwner = resourceKind === "page" ? consumePagesResponseStagePolicyOwner(response) : {
@@ -822,7 +978,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			if (!responseStageHasContentLength) response.headers.delete("Content-Length");
 			return response;
 		} : void 0;
-		const response = !isInterceptionMatch && (match === null || match.route.isDynamic) ? await options.renderPagesFallback?.({
+		const response = !isInterceptionMatch && (match === null || match.route.isDynamic) ? await runOutsideWorkStoreScope(() => options.renderPagesFallback?.({
 			appRouteMatch: match ?? null,
 			allowRscDocumentFallback: didMiddlewareRewritePathname || allowInternalRscDocumentFallback,
 			dispatchPagesResponseStage,
@@ -830,11 +986,11 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			isRscRequest,
 			matchKind,
 			middlewareContext,
-			pathname: resolvedUrl,
+			pathname: pagesRouteUrl,
 			pagesDataRequest,
 			request,
 			url
-		}) ?? null : null;
+		})) ?? null : null;
 		if (response) preserveRouteCacheabilityResponsePolicy();
 		if (!response) return null;
 		if (sharedOuterPolicyNeedsReconciliation) reconcileCdnResponseHeadersAfterOuterPolicy(response.headers, await loadOuterResponsePolicy());
@@ -858,8 +1014,9 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	}
 	if (!isInterceptionMatch && !resolvedLateRewritesForAction && (!match || match.route.isDynamic)) for (const rewrite of options.configRewrites.afterFiles) {
 		const afterFilesRewrite = await applyRewrite({
-			basePathState,
+			basePathState: currentBasePathState(),
 			clearRequestContext: options.clearRequestContext,
+			middlewareContext,
 			request: normalizedUserlandRequest,
 			requestContext: requestContextForResolvedUrl(postMiddlewareRequestContext, resolvedUrl, url),
 			paramsPathname: matchPathname(cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname),
@@ -876,8 +1033,11 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		cleanPathnameIsRequestPathname = false;
 		invalidateInterceptionCacheProof();
 		filesystemRouteEligible = true;
+		resolvedPathnameHasBasePath = !options.basePath || rewrite.basePath !== false;
 		const claimedRscCacheBustingRedirect = await validateClaimedOutsideBasePathRsc();
 		if (claimedRscCacheBustingRedirect) return claimedRscCacheBustingRedirect;
+		const rewrittenImageEndpointResponse = serveImageEndpointIfMatched();
+		if (rewrittenImageEndpointResponse) return rewrittenImageEndpointResponse;
 		const rewrittenMetadataResponse = await renderMetadataRouteIfMatched();
 		if (rewrittenMetadataResponse) return composeResponseStageResponse(rewrittenMetadataResponse);
 		match = matchCleanPathname();
@@ -900,8 +1060,9 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	}
 	if (!resolvedLateRewritesForAction && !match) for (const rewrite of options.configRewrites.fallback) {
 		const fallbackRewrite = await applyRewrite({
-			basePathState,
+			basePathState: currentBasePathState(),
 			clearRequestContext: options.clearRequestContext,
+			middlewareContext,
 			request: normalizedUserlandRequest,
 			requestContext: requestContextForResolvedUrl(postMiddlewareRequestContext, resolvedUrl, url),
 			paramsPathname: matchPathname(cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname),
@@ -918,8 +1079,11 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		cleanPathnameIsRequestPathname = false;
 		invalidateInterceptionCacheProof();
 		filesystemRouteEligible = true;
+		resolvedPathnameHasBasePath = !options.basePath || rewrite.basePath !== false;
 		const claimedRscCacheBustingRedirect = await validateClaimedOutsideBasePathRsc();
 		if (claimedRscCacheBustingRedirect) return claimedRscCacheBustingRedirect;
+		const rewrittenImageEndpointResponse = serveImageEndpointIfMatched();
+		if (rewrittenImageEndpointResponse) return rewrittenImageEndpointResponse;
 		const rewrittenMetadataResponse = await renderMetadataRouteIfMatched();
 		if (rewrittenMetadataResponse) return composeResponseStageResponse(rewrittenMetadataResponse);
 		match = matchCleanPathname();
@@ -935,15 +1099,16 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		}
 		if (match) break;
 	}
-	if (interceptionCacheProofInvalidated && interceptionContextHeader !== null) {
+	if (interceptionCacheProofInvalidated && interceptionSourceContext !== null) {
 		const finalInterceptionTargetPathname = cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname;
-		const finalInterceptionSourceMatch = filesystemRouteEligible && match !== null ? options.matchInterceptRoute?.(finalInterceptionTargetPathname, interceptionContextHeader, interceptionIdHeader) ?? null : null;
+		const finalInterceptionSourceMatch = filesystemRouteEligible && match !== null ? options.matchInterceptRoute?.(finalInterceptionTargetPathname, interceptionSourceContext, interceptionIdHeader) ?? null : null;
 		const hasVerifiedFinalInterceptionSource = hasVerifiedInterceptionSource && interceptionSourceMatch !== null && provesConcreteInterceptionSource(finalInterceptionSourceMatch) && finalInterceptionSourceMatch?.route === interceptionSourceMatch.route && haveSamePageParams(finalInterceptionSourceMatch.params, interceptionSourceMatch.params);
 		if (interceptionIdHeader !== null && !hasVerifiedFinalInterceptionSource) {
 			options.clearRequestContext();
 			setInterceptionResponseUncacheable(true);
 			return badRequestResponse();
 		}
+		if (!hasVerifiedFinalInterceptionSource) interceptionSourceContext = null;
 		bypassInterceptionContextCache = !hasVerifiedFinalInterceptionSource;
 		setInterceptionResponseUncacheable(bypassInterceptionContextCache);
 	}
@@ -958,7 +1123,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		options.clearRequestContext();
 		const headers = new Headers();
 		mergeMiddlewareResponseHeaders(headers, middlewareContext.headers);
-		return notFoundResponse({ headers });
+		return withUnmatchedRouteCacheControl(notFoundResponse({ headers }));
 	}
 	if (pagesDataRequest) {
 		options.clearRequestContext();
@@ -982,7 +1147,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		}
 		setFrameworkRequestRoute("/404", isRscRequest);
 		const notFoundResponseStage = transportedResponseStage ?? options.renderResponseStageLocally;
-		if (notFoundResponseStage) return composeResponseStageResponse(await notFoundResponseStage(responseStageRequest(), {
+		if (notFoundResponseStage) return withUnmatchedRouteCacheControl(await composeResponseStageResponse(await notFoundResponseStage(responseStageRequest(), {
 			kind: "app-not-found",
 			buildId: options.buildId,
 			cacheability: responseStageCacheability(resolvedUrl),
@@ -992,12 +1157,12 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			isRscRequest,
 			middlewareCookieOverlay,
 			mountedSlotsHeader,
-			protocolVersion: 10,
+			protocolVersion: 11,
 			requestOrigin: url.origin,
 			renderMode,
 			resolvedUrl,
 			scriptNonce: scriptNonce ?? null
-		}));
+		})));
 		const renderedNotFoundResponse = await traceAppPageRender("/404", "render", () => options.renderNotFound({
 			isRscRequest,
 			middlewareContext,
@@ -1005,12 +1170,13 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			route: null,
 			scriptNonce
 		}));
-		if (renderedNotFoundResponse) return renderedNotFoundResponse;
+		if (renderedNotFoundResponse) return withUnmatchedRouteCacheControl(renderedNotFoundResponse);
 		options.clearRequestContext();
 		const headers = new Headers();
 		mergeMiddlewareResponseHeaders(headers, middlewareContext.headers);
-		return notFoundResponse({ headers });
+		return withUnmatchedRouteCacheControl(notFoundResponse({ headers }));
 	}
+	match = renderedRouteMatch(match);
 	const { route, params } = match;
 	const requestPathnameDiffersFromCachePath = requestCleanPathname !== cleanPathname;
 	const rawRequestPathnameIsObservable = isInterceptionMatch || route.routeHandler != null || typeof route.__loadRouteHandler === "function";
@@ -1038,7 +1204,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	const prerenderRouteParams = prerenderRouteParamsMatch?.params ?? null;
 	const isPrerenderFallbackShell = prerenderRouteParamsMatch?.kind === "fallback-shell";
 	const renderParams = prerenderRouteParams ?? params;
-	const responseStageMatchKind = isInterceptionMatch ? "interception" : cleanPathnameIsRequestPathname && options.matchRequestRoute ? "request" : "resolved";
+	const responseStageMatchKind = isInterceptionMatch ? "interception" : cleanPathnameIsRequestPathname && options.matchRequestRoute ? usesRawRequestMatch() ? "raw-request" : "request" : "resolved";
 	const responseStageRoutePathname = isInterceptionMatch ? preActionRoutePathname : cleanPathnameIsRequestPathname ? requestCleanPathname || "/" : cleanPathname || "/";
 	const matchedResponseStage = transportedResponseStage ?? options.renderResponseStageLocally;
 	let runtimeFallbackShells = [];
@@ -1078,7 +1244,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			middlewareCookieOverlay,
 			mountedSlotsHeader,
 			params,
-			protocolVersion: 10,
+			protocolVersion: 11,
 			requestOrigin: url.origin,
 			renderMode,
 			resolvedUrl,
@@ -1099,7 +1265,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			searchParams: resolvedSearchParams
 		});
 	}
-	const pageResponse = matchedResponseStage ? await matchedResponseStage(responseStageRequest(), {
+	const pageResponse = withStoredSpecialErrorStatus(matchedResponseStage ? await matchedResponseStage(responseStageRequest(), {
 		kind: "app-page",
 		buildId: options.buildId,
 		cacheability: responseStageCacheability(resolvedUrl),
@@ -1110,14 +1276,14 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		cleanPathname,
 		draftModeCookie,
 		forceDynamic: route.forceDynamic === true,
-		interceptionContext: isRscRequest ? interceptionContextHeader : null,
+		interceptionContext: interceptionSourceContext,
 		interceptionId: interceptionIdHeader,
 		isRscRequest,
 		matchKind: responseStageMatchKind,
 		middlewareCookieOverlay,
 		mountedSlotsHeader,
 		params,
-		protocolVersion: 10,
+		protocolVersion: 11,
 		requestOrigin: url.origin,
 		renderMode,
 		resolvedUrl,
@@ -1134,7 +1300,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		actionError: normalizedProgressiveActionError,
 		actionFailed,
 		handlerStart,
-		interceptionContext: isRscRequest ? interceptionContextHeader : null,
+		interceptionContext: interceptionSourceContext,
 		interceptionId: interceptionIdHeader,
 		interceptionPathname: cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname,
 		isProgressiveActionRender,
@@ -1157,7 +1323,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		scriptNonce,
 		searchParams: resolvedSearchParams,
 		renderMode
-	});
+	}), isRscRequest && request.headers.get("Next-Router-Prefetch") === "1" && request.headers.has("Next-Router-Segment-Prefetch"));
 	if (isProgressiveActionRender) return applyProgressiveActionSideEffects(pageResponse, progressiveActionFormState);
 	return pageResponse;
 }
@@ -1196,7 +1362,7 @@ function applyProgressiveActionSideEffects(response, sideEffects) {
 /** Build the request-only handler without retaining the response renderer graph. */
 function createAppRscRequestHandler(options) {
 	const handleAppRscRequestLifecycle = async (rawRequest, ctx, allowInternalRscDocumentFallback = false, dispatchResponseStage, responseStageProbeMode = null, transportedPrerenderState) => {
-		const mwCtx = rawRequest.headers.get(VINEXT_MW_CTX_HEADER);
+		const mwCtx = openForwardedMiddlewareContext(rawRequest.headers.get(VINEXT_MW_CTX_HEADER), options.devForwardedMiddlewareContextKey);
 		const pagesDataUrl = new URL(rawRequest.url);
 		const pagesDataInScope = !options.basePath || hasBasePath(pagesDataUrl.pathname, options.basePath);
 		if (pagesDataInScope) pagesDataUrl.pathname = stripBasePath(pagesDataUrl.pathname, options.basePath);
@@ -1261,7 +1427,7 @@ function createAppRscRequestHandler(options) {
 				recordCacheability: dispatchResponseStage === void 0,
 				requestContext: preMiddlewareRequestContext
 			});
-			return interceptionResponseUncacheable ? markUnverifiedInterceptionResponseUncacheable(response) : response;
+			return interceptionResponseUncacheable || unmatchedRouteResponses.has(response) ? withNeverCacheControl(response) : response;
 		}, {
 			cacheComponents: options.createPprFallbackShells !== void 0,
 			route: () => new URL(request.url).pathname