vinext 1.0.1 → 1.2.0

package/dist/server/app-rsc-request-normalization.d.ts

@@ -35,7 +35,9 @@ export type NormalizedRscRequest = {
  *
  *   1. Parse URL
  *   2. Protocol-relative URL guard — on the raw pathname, BEFORE normalizePath collapses
- *      `//` to `/`. If the guard ran after normalization, `//evil.com` → `/evil.com`
+ *      `//` to `/`. Literal repeated slashes / backslashes get Next.js's 308 to the
+ *      collapsed path; encoded leading `%2F` / `%5C` get a 404. If the guard ran after
+ *      normalization, `//evil.com` → `/evil.com`
  *      would bypass the check and reach the trailing-slash redirector, which echoes the
  *      path into a `Location` header that browsers interpret as protocol-relative.
  *   3. Strict percent-decode each segment — throws on malformed sequences (→ 400). Must

package/dist/server/app-rsc-request-normalization.js

@@ -69,7 +69,9 @@ function tryNormalizeComparablePathAndSearch(value, basePath, baseUrl) {
 *
 *   1. Parse URL
 *   2. Protocol-relative URL guard — on the raw pathname, BEFORE normalizePath collapses
-*      `//` to `/`. If the guard ran after normalization, `//evil.com` → `/evil.com`
+*      `//` to `/`. Literal repeated slashes / backslashes get Next.js's 308 to the
+*      collapsed path; encoded leading `%2F` / `%5C` get a 404. If the guard ran after
+*      normalization, `//evil.com` → `/evil.com`
 *      would bypass the check and reach the trailing-slash redirector, which echoes the
 *      path into a `Location` header that browsers interpret as protocol-relative.
 *   3. Strict percent-decode each segment — throws on malformed sequences (→ 400). Must
@@ -91,7 +93,7 @@ function tryNormalizeComparablePathAndSearch(value, basePath, baseUrl) {
 */
 function normalizeRscRequest(request, basePath, allowOutsideBasePath = false, assetPrefix = "") {
 	const url = new URL(request.url);
-	const protoGuard = guardProtocolRelativeUrl(url.pathname);
+	const protoGuard = guardProtocolRelativeUrl(url.pathname, url.search);
 	if (protoGuard) return protoGuard;
 	let decoded;
 	try {

package/dist/server/app-rsc-response-stage.d.ts

@@ -2,5 +2,5 @@ import { VinextResponseStageDispatchOptions } from "./multi-stage.js";
 import { AppWorkerResponseStageProps } from "./app-worker-stages.js";
 import { AppRscHandlerRoute, CreateAppRscHandlerOptions } from "./app-rsc-handler.js";
 //#region src/server/app-rsc-response-stage.d.ts
-export declare function renderAppWorkerResponseStage<TRoute extends AppRscHandlerRoute>(options: CreateAppRscHandlerOptions<TRoute>, rawRequest: Request, ctx: unknown, props: AppWorkerResponseStageProps, _stageOptions?: VinextResponseStageDispatchOptions): Promise<Response>;
+export declare function renderAppWorkerResponseStage<TRoute extends AppRscHandlerRoute>(options: CreateAppRscHandlerOptions<TRoute>, rawRequest: Request, ctx: unknown, props: AppWorkerResponseStageProps, stageOptions?: VinextResponseStageDispatchOptions): Promise<Response>;
 //#endregion

package/dist/server/app-rsc-response-stage.js

@@ -3,6 +3,7 @@ import { closeAfterResponse, closeAfterResponseWithBody, createRequestContext, r
 import { VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
 import "./headers.js";
+import { runOutsideWorkStoreScope } from "../shims/internal/work-store-scope.js";
 import { cloneRequestWithHeaders, cloneRequestWithUrl, filterInternalHeaders } from "./request-pipeline.js";
 import { applyEffectiveRequestCookieHeader, getDraftModeCookieHeader, headersContextFromRequest, restoreDraftModeTransition } from "../shims/headers.js";
 import { ensureFetchPatch, setCurrentFetchSoftTags } from "../shims/fetch-cache.js";
@@ -60,14 +61,15 @@ function rematchAppWorkerResponseStageRoute(options, normalized, props) {
 	let match = null;
 	if (props.matchKind === "interception") {
 		if (normalized.interceptionContextHeader !== null) match = options.matchInterceptRoute?.(props.routePathname, normalized.interceptionContextHeader, props.interceptionId) ?? null;
-	} else if (props.matchKind === "request") match = options.matchRequestRoute?.(props.routePathname) ?? null;
+	} else if (props.matchKind === "raw-request") match = options.matchRawRequestRoute?.(props.routePathname) ?? null;
+	else if (props.matchKind === "request") match = options.matchRequestRoute?.(props.routePathname) ?? null;
 	else match = options.matchRoute(props.routePathname);
 	if (!match) return null;
 	if (match.route.pattern !== props.routePattern || !haveSamePageParams(match.params, props.params)) return null;
 	return match;
 }
-async function renderAppWorkerResponseStage(options, rawRequest, ctx, props, _stageOptions) {
-	if (props.protocolVersion !== 10 || props.buildId !== options.buildId) return new Response("Incompatible vinext App response stage", { status: 409 });
+async function renderAppWorkerResponseStage(options, rawRequest, ctx, props, stageOptions) {
+	if (props.protocolVersion !== 11 || props.buildId !== options.buildId) return new Response("Incompatible vinext App response stage", { status: 409 });
 	if (props.kind === "app-full-request") return new Response("Invalid vinext App response stage", { status: 400 });
 	options.registerCacheAdapters();
 	await options.ensureInstrumentation?.();
@@ -152,7 +154,8 @@ async function renderAppWorkerResponseStage(options, rawRequest, ctx, props, _st
 			const pageRequest = props.isDataRequest ? cloneRequestWithUrl(request, new URL(props.resolvedUrl, request.url).toString()) : request;
 			const preHandlerHeaders = props.preHandlerHeaders === null ? void 0 : new Headers(props.preHandlerHeaders);
 			preHandlerHeaders?.delete("Content-Length");
-			let pagesResponse = await options.renderPagesFallback({
+			const renderPagesFallback = options.renderPagesFallback;
+			let pagesResponse = await runOutsideWorkStoreScope(() => renderPagesFallback({
 				allowRscDocumentFallback: props.allowRscDocumentFallback,
 				appRouteMatch: props.appRouteMatch ? { route: {
 					isDynamic: props.appRouteMatch.isDynamic,
@@ -167,7 +170,7 @@ async function renderAppWorkerResponseStage(options, rawRequest, ctx, props, _st
 				pagesDataRequest: props.isDataRequest ? request : null,
 				request: pageRequest,
 				url: new URL(props.requestUrl)
-			});
+			}));
 			if (!pagesResponse) return new Response("Invalid vinext App response stage", { status: 404 });
 			if (preHandlerHeaders) pagesResponse = stripInheritedResponseStageCookies(pagesResponse, preHandlerHeaders);
 			return pagesResponse;
@@ -232,7 +235,8 @@ async function renderAppWorkerResponseStage(options, rawRequest, ctx, props, _st
 			route,
 			searchParams,
 			scriptNonce: props.scriptNonce ?? void 0,
-			renderMode: normalized.renderMode
+			renderMode: normalized.renderMode,
+			renderWholeDocument: stageOptions?.renderWholeDocument === true
 		});
 	}, {
 		cacheComponents: options.createPprFallbackShells !== void 0,

package/dist/server/app-rsc-route-matching.d.ts

@@ -120,7 +120,11 @@ type AppRscInterceptLookupEntry = {
   slotId: string | null;
   targetRouteGraphId: string | null;
 };
-export declare function createAppRscRouteMatcher<Route extends AppRscRouteForMatching>(routes: Route[]): {
+/**
+ * @param decodedPathnamePatterns Static page patterns that answer their
+ *   segment-decoded pathname (built by `buildAppDecodedPathnamePatterns`).
+ */
+export declare function createAppRscRouteMatcher<Route extends AppRscRouteForMatching>(routes: Route[], decodedPathnamePatterns?: readonly string[]): {
   hasInterceptionId(interceptionId: string): boolean;
   matchRoute(url: string): {
     route: Route;
@@ -130,6 +134,10 @@ export declare function createAppRscRouteMatcher<Route extends AppRscRouteForMat
     route: Route;
     params: AppRscRouteParams;
   } | null;
+  matchRawRequestRoute(url: string): {
+    route: Route;
+    params: AppRscRouteParams;
+  } | null;
   findIntercept(pathname: string, sourcePathname?: string | null, interceptionId?: string | null): AppRscInterceptMatch | null;
 };
 //#endregion

package/dist/server/app-rsc-route-matching.js

@@ -1,4 +1,4 @@
-import { decodeMatchedParams, splitPathSegments, splitPathnameForRouteMatch } from "../routing/utils.js";
+import { decodeMatchedParams, decodeRouteSegment, splitPathSegments, splitPathnameForRouteMatch } from "../routing/utils.js";
 import { createAppRouteGraphInterceptionId } from "../routing/app-route-ids.js";
 import { buildRouteTrie, trieMatchRaw } from "../routing/route-trie.js";
 import { extractRawRoutePatternParams, matchRoutePatternPrefix, matchRoutePatternRaw } from "../routing/route-pattern.js";
@@ -18,17 +18,6 @@ function appRscPathnameParts(pathname, isNormalized = false) {
 	const normalizedPathname = pathOnly === "/" ? "/" : pathOnly.replace(/\/$/, "");
 	return isNormalized ? splitPathSegments(normalizedPathname) : splitPathnameForRouteMatch(normalizedPathname);
 }
-function appRscInterceptionSourcePathnameParts(pathname) {
-	const pathOnly = pathname.split("?")[0];
-	const normalizedPathname = pathOnly === "/" ? "/" : pathOnly.replace(/\/$/, "");
-	return splitPathSegments(normalizedPathname).map((segment) => {
-		try {
-			return decodeURIComponent(segment);
-		} catch {
-			return segment;
-		}
-	});
-}
 function isAppRouteHandlerRoute(route) {
 	return route.routeHandler != null || typeof route.__loadRouteHandler === "function";
 }
@@ -36,11 +25,38 @@ function normalizeMatchedParamsForRoute(result) {
 	if (isAppRouteHandlerRoute(result.route)) decodeMatchedParams(result.params);
 	else canonicalizeAppPageParams(result.params);
 }
-function createAppRscRouteMatcher(routes) {
+/**
+* @param decodedPathnamePatterns Static page patterns that answer their
+*   segment-decoded pathname (built by `buildAppDecodedPathnamePatterns`).
+*/
+function createAppRscRouteMatcher(routes, decodedPathnamePatterns = []) {
 	const routeTrie = buildRouteTrie(routes);
 	const interceptLookup = createInterceptLookup(routes);
 	const interceptionIds = new Set(interceptLookup.flatMap((entry) => entry.interceptionId === null ? [] : [entry.interceptionId]));
 	const routeIndexes = new Map(routes.map((route, index) => [route, index]));
+	const decodedPathnamePatternSet = new Set(decodedPathnamePatterns);
+	const decodedPathnameRoutes = /* @__PURE__ */ new Map();
+	for (const route of routes) {
+		const key = route.patternParts.join("/");
+		if (decodedPathnamePatternSet.has(route.pattern) && !decodedPathnameRoutes.has(key)) decodedPathnameRoutes.set(key, route);
+	}
+	function matchRawRequestParts(rawParts) {
+		const result = trieMatchRaw(routeTrie, rawParts);
+		if (result) normalizeMatchedParamsForRoute(result);
+		return result;
+	}
+	function matchRequestParts(rawParts) {
+		const result = matchRawRequestParts(rawParts);
+		if (!result) return null;
+		if (decodedPathnameRoutes.size > 0 && result.route.patternParts.some((part) => part.startsWith(":")) && !isAppRouteHandlerRoute(result.route) && rawParts.some((part) => part.includes("%"))) {
+			const route = decodedPathnameRoutes.get(rawParts.map(decodeRouteSegment).join("/"));
+			if (route && route !== result.route) return {
+				route,
+				params: createRouteParams()
+			};
+		}
+		return result;
+	}
 	return {
 		hasInterceptionId(interceptionId) {
 			return interceptionIds.has(interceptionId);
@@ -54,16 +70,16 @@ function createAppRscRouteMatcher(routes) {
 			return result;
 		},
 		matchRequestRoute(url) {
-			const result = trieMatchRaw(routeTrie, appRscPathnameParts(url, true));
-			if (!result) return null;
-			normalizeMatchedParamsForRoute(result);
-			return result;
+			return matchRequestParts(appRscPathnameParts(url, true));
+		},
+		matchRawRequestRoute(url) {
+			return matchRawRequestParts(appRscPathnameParts(url, true));
 		},
 		findIntercept(pathname, sourcePathname = null, interceptionId = null) {
 			if (sourcePathname === null) return null;
 			const urlParts = appRscPathnameParts(pathname, true);
-			const sourceParts = appRscInterceptionSourcePathnameParts(sourcePathname);
-			const matchedSourceRoute = trieMatchRaw(routeTrie, sourceParts);
+			const sourceParts = appRscPathnameParts(sourcePathname, true);
+			const matchedSourceRoute = matchRawRequestParts(sourceParts);
 			for (const entry of interceptLookup) {
 				if (interceptionId !== null && entry.interceptionId !== interceptionId) continue;
 				if (!matchInterceptSource(sourceParts, entry)) continue;
@@ -75,6 +91,7 @@ function createAppRscRouteMatcher(routes) {
 				const sourceRoute = routes[concreteSourceRouteIndex];
 				if (sourceRoute && isAppRouteHandlerRoute(sourceRoute)) continue;
 				const matchedSourceParams = concreteSourceRoute ? concreteSourceRoute.params : sourceRoute ? matchSlotOwnerSourceParams(sourceParts, sourceRoute.patternParts, entry.sourceMatchPatternParts !== null) : null;
+				if (!concreteSourceRoute && matchedSourceParams) canonicalizeAppPageParams(matchedSourceParams);
 				if (matchedSourceParams === null && entry.sourceMatchPatternParts === null) continue;
 				const sourceParams = matchedSourceParams && entry.sourceMatchPatternParts !== null ? pickPatternParams(matchedSourceParams, entry.sourceMatchPatternParts) : matchedSourceParams ?? createRouteParams();
 				return {

package/dist/server/app-segment-config.d.ts

@@ -1,4 +1,5 @@
-import { FetchCacheMode } from "../shims/fetch-cache.js";
+import { FetchCacheMode } from "../shims/fetch-cache-state.js";
+import "../shims/fetch-cache.js";
 //#region src/server/app-segment-config.d.ts
 type AppRouteSegmentDynamic = "auto" | "error" | "force-dynamic" | "force-static";
 type AppRouteSegmentConfigModule = {

package/dist/server/app-server-action-execution.d.ts

@@ -1,7 +1,8 @@
 import { AppRscRenderMode } from "./app-rsc-render-mode.js";
 import { ActionRevalidationKind } from "../shims/cache-request-state.js";
 import { AppRenderErrorContextOverrides } from "./app-rsc-error-handler.js";
-import { FetchCacheMode } from "../shims/fetch-cache.js";
+import { FetchCacheMode } from "../shims/fetch-cache-state.js";
+import "../shims/fetch-cache.js";
 import { HeadersAccessPhase } from "../shims/internal/headers-state.js";
 import "../shims/headers.js";
 import { ReactFormState } from "react-dom/client";

package/dist/server/app-server-action-execution.js

@@ -1,3 +1,4 @@
+import { runOutsideRequestScopes } from "../shims/internal/als-registry.js";
 import { VINEXT_MW_CTX_HEADER } from "../utils/protocol-headers.js";
 import { buildRequestHeadersFromMiddlewareResponse } from "../utils/middleware-request-headers.js";
 import { parseEdgeRequestCookieHeader } from "../utils/parse-cookie.js";
@@ -18,16 +19,34 @@ import { VINEXT_RSC_CONTENT_TYPE, applyRscCompatibilityIdHeader, createRscReques
 import { mergeMiddlewareResponseHeaders } from "./middleware-response-headers.js";
 import { applyEdgeRuntimeHeader } from "./app-page-response.js";
 import { getNextErrorDigest, parseNextHttpErrorDigest, parseNextRedirectDigest } from "./next-error-digest.js";
+import { hasDigest } from "./app-rsc-errors.js";
 import { buildAppPageTags } from "./implicit-tags.js";
+import "./app-page-stream.js";
 import { getSetCookieName } from "./cookie-utils.js";
 import { createServerActionNotFoundResponse, getServerActionNotFoundMessage, isServerActionNotFoundError } from "./server-action-not-found.js";
 import { resolveAppPageNavigationParams } from "./app-page-element-builder.js";
-import "./app-page-stream.js";
 import { resolveAppPageActionRerenderTarget } from "./app-page-request.js";
 import { createRootParamsUsageController, runWithRootParamsUsage } from "../shims/root-params.js";
 import { createStaticGenerationHeadersContext } from "./app-static-generation.js";
 import { markAppRscResponseConfigHeadersApplied } from "./app-rsc-response-finalizer.js";
 //#region src/server/app-server-action-execution.ts
+/**
+* Run a server-reference load or decode outside every request scope.
+*
+* Server reference modules are imported on the first request that names them
+* — `loadServerAction()` imports the action's module, and the decoders import
+* any reference the body carries — and a dynamic `import()` carries
+* AsyncLocalStorage into the module's top-level evaluation. Module-scope
+* `cookies()`/`headers()` would then capture that first caller's request for
+* every later caller in the isolate. Next.js evaluates action modules outside
+* the request store, where those calls throw.
+*
+* The result is awaited inside the callback because `decodeReply()` returns a
+* lazy thenable that only resolves (and imports) its references once awaited.
+*/
+function loadOutsideRequestScopes(load) {
+	return runOutsideRequestScopes(async () => await load());
+}
 function parseBoundProgressiveActionReference(body, referencePrefix) {
 	const fieldPrefix = `$ACTION_${referencePrefix}:`;
 	const chunks = /* @__PURE__ */ new Map();
@@ -473,6 +492,25 @@ function shouldUseForwardedActionRedirectStatus(options) {
 	if (!options.currentRoute || !options.targetRoute || !options.resolveRouteRuntime) return false;
 	return normalizeRuntime(options.resolveRouteRuntime(options.currentRoute)) !== normalizeRuntime(options.resolveRouteRuntime(options.targetRoute));
 }
+/**
+* A failed fetch action's result, as Next.js sends it: a rejected promise.
+* React's Flight error channel reports the rejection through the render's
+* onError and gives the client error its digest, where an Error value would
+* reach the client without one.
+*/
+function createRejectedActionResult(error) {
+	const result = Promise.reject(error);
+	result.catch(() => {});
+	return result;
+}
+/**
+* In development the render's onError logs a rejected action result unless it
+* already has a digest; log those here, so each failure is logged once. As in
+* Next.js, a thrown string is not logged in development.
+*/
+function logRejectedActionResult(error) {
+	if (process.env.NODE_ENV === "production" || hasDigest(error)) console.error("[vinext] Server action error:", error);
+}
 function getActionHttpFallbackStatus(error) {
 	const digest = getNextErrorDigest(error);
 	if (!digest) return null;
@@ -559,7 +597,7 @@ async function handleProgressiveServerActionRequest(options) {
 			clearRequestContext: options.clearRequestContext,
 			getAndClearPendingCookies: options.getAndClearPendingCookies
 		});
-		const action = await options.decodeAction(body);
+		const action = await loadOutsideRequestScopes(() => options.decodeAction(body));
 		if (!isAppServerActionFunction(action)) {
 			if (options.hasPageRoute) return createActionNotFoundResponse(null, {
 				clearRequestContext: options.clearRequestContext,
@@ -579,6 +617,7 @@ async function handleProgressiveServerActionRequest(options) {
 		let actionRedirect = null;
 		let actionError = void 0;
 		let actionFailed = false;
+		let actionFailedWithError = false;
 		let actionThrew = false;
 		let actionResult;
 		const rootParamsUsage = createRootParamsUsageController();
@@ -591,7 +630,8 @@ async function handleProgressiveServerActionRequest(options) {
 			if (!actionRedirect) {
 				actionError = error;
 				actionFailed = true;
-				if (!(getActionHttpFallbackStatus(error) !== null || isServerActionNotFoundError(error, null))) {
+				actionFailedWithError = getActionHttpFallbackStatus(error) === null && !isServerActionNotFoundError(error, null);
+				if (actionFailedWithError) {
 					console.error("[vinext] Server action error:", error);
 					options.reportRequestError(error, {
 						path: options.cleanPathname,
@@ -616,6 +656,15 @@ async function handleProgressiveServerActionRequest(options) {
 			const actionPendingCookies = dedupePendingCookies(options.getAndClearPendingCookies());
 			const actionDraftCookie = options.getDraftModeCookieHeader();
 			const revalidationKind = resolveActionRevalidationKind(actionPendingCookies.length > 0 || Boolean(actionDraftCookie));
+			if (actionFailedWithError) {
+				options.clearRequestContext();
+				const headers = new Headers();
+				mergeMiddlewareResponseHeaders(headers, options.middlewareHeaders);
+				headers.set("Cache-Control", "no-cache, no-store, max-age=0, must-revalidate");
+				for (const cookie of actionPendingCookies) headers.append("Set-Cookie", cookie);
+				if (actionDraftCookie) headers.append("Set-Cookie", actionDraftCookie);
+				return internalServerErrorResponse(process.env.NODE_ENV === "production" ? void 0 : "Server action failed: " + getServerActionFailureMessage(actionError), { headers });
+			}
 			if (actionFailed) return {
 				kind: "form-state",
 				formState: null,
@@ -627,7 +676,7 @@ async function handleProgressiveServerActionRequest(options) {
 			};
 			return {
 				kind: "form-state",
-				formState: await options.decodeFormState(actionResult, body) ?? null,
+				formState: await loadOutsideRequestScopes(() => options.decodeFormState(actionResult, body)) ?? null,
 				pendingCookies: actionPendingCookies,
 				draftCookie: actionDraftCookie,
 				revalidationKind
@@ -680,29 +729,18 @@ async function handleProgressiveServerActionRequest(options) {
 * with status 500 carrying the rejected action result, so the nearest client
 * error boundary catches it (see action-handler.ts, the `isFetchAction` branch
 * of the generic error path). vinext mirrors that by rendering a Flight stream
-* with `returnValue: { ok: false }` and no page root (the action never ran, so
+* with a rejected `returnValue: { ok: false }` and no page root (the action never ran, so
 * nothing was revalidated and the page render is skipped). A bare 413 plain
 * response would bypass the boundary and surface the wrong status/content-type.
 */
 async function renderFetchActionBodyExceededResponse(options) {
 	const error = createBodyExceededError(options.maxActionBodySizeLabel);
-	console.error("[vinext] Server action error:", error);
-	options.reportRequestError(error, {
-		path: options.cleanPathname,
-		method: options.request.method,
-		headers: Object.fromEntries(options.request.headers.entries())
-	}, {
-		routerKind: "App Router",
-		routePath: options.currentRouteMatch?.route.pattern ?? options.cleanPathname,
-		routeType: "action",
-		renderSource: "react-server-components-payload",
-		revalidateReason: void 0
-	});
+	logRejectedActionResult(error);
 	getAndClearActionRevalidationKind();
 	options.getAndClearPendingCookies();
 	const returnValue = {
 		ok: false,
-		data: options.sanitizeErrorForClient(error)
+		data: createRejectedActionResult(options.sanitizeErrorForClient(error))
 	};
 	const temporaryReferences = options.createTemporaryReferenceSet();
 	const onRenderError = options.createRscOnErrorHandler(options.request, options.cleanPathname, options.currentRouteMatch?.route.pattern ?? options.cleanPathname, {
@@ -727,6 +765,7 @@ async function renderFetchActionBodyExceededResponse(options) {
 }
 async function handleServerActionRscRequest(options) {
 	if (options.request.method.toUpperCase() !== "POST" || !options.actionId) return null;
+	const actionId = options.actionId;
 	const csrfResponse = validateCsrfOrigin(options.request, options.allowedOrigins);
 	if (csrfResponse) return csrfResponse;
 	if (parseInt(options.request.headers.get("content-length") || "0", 10) > options.maxActionBodySize) {
@@ -738,7 +777,7 @@ async function handleServerActionRscRequest(options) {
 		if (options.contentType.startsWith("multipart/form-data")) {
 			let loadedAction;
 			try {
-				loadedAction = await options.loadServerAction(options.actionId);
+				loadedAction = await loadOutsideRequestScopes(() => options.loadServerAction(actionId));
 			} catch (error) {
 				if (isServerActionNotFoundError(error, options.actionId)) return createActionNotFoundResponse(options.actionId, {
 					clearRequestContext: options.clearRequestContext,
@@ -768,7 +807,7 @@ async function handleServerActionRscRequest(options) {
 		if (action === void 0) {
 			let loadedAction;
 			try {
-				loadedAction = await options.loadServerAction(options.actionId);
+				loadedAction = await loadOutsideRequestScopes(() => options.loadServerAction(actionId));
 			} catch (error) {
 				if (isServerActionNotFoundError(error, options.actionId)) return createActionNotFoundResponse(options.actionId, {
 					clearRequestContext: options.clearRequestContext,
@@ -783,7 +822,7 @@ async function handleServerActionRscRequest(options) {
 			action = loadedAction;
 		}
 		const temporaryReferences = options.createTemporaryReferenceSet();
-		const args = await options.decodeReply(body, { temporaryReferences });
+		const args = await loadOutsideRequestScopes(() => options.decodeReply(body, { temporaryReferences }));
 		let returnValue;
 		let actionRedirect = null;
 		let actionStatus = 200;
@@ -815,10 +854,10 @@ async function handleServerActionRscRequest(options) {
 						};
 					} else {
 						actionStatus = 500;
-						console.error("[vinext] Server action error:", error);
+						logRejectedActionResult(error);
 						returnValue = {
 							ok: false,
-							data: options.sanitizeErrorForClient(error)
+							data: createRejectedActionResult(options.sanitizeErrorForClient(error))
 						};
 					}
 				}

package/dist/server/app-ssr-entry.d.ts

@@ -46,8 +46,9 @@ export declare function handleSsr(rscStream: ReadableStream<Uint8Array>, navCont
   initialDevServerError?: unknown;
   /** Report an SSR/Fizz render failure through instrumentation. */
   onSsrError?: (error: unknown) => unknown;
-  /** Mirror inline Flight chunks into Next.js's `self.__next_f` transport. */
-  mirrorNextFlight?: boolean;
+  /** Mirror inline Flight chunks into Next.js's `self.__next_f` transport, or start
+   *  mirroring once a function returns true. */
+  mirrorNextFlight?: boolean | (() => boolean);
   /** When true, wait for the full React tree (including Suspense boundaries)
    *  to resolve before returning the HTML stream. Used for static prerender
    *  and ISR cache writes to avoid caching fallback content. */

package/dist/server/app-ssr-entry.js

@@ -1,8 +1,6 @@
 import "./server-globals.js";
 import { notFoundResponse } from "./http-error-responses.js";
-import { isOpenRedirectShaped } from "./open-redirect.js";
-import { AppElementsWire } from "./app-elements-wire.js";
-import "./app-elements.js";
+import { isOpenRedirectShaped, repeatedSlashRedirectResponse } from "./open-redirect.js";
 import { isPprFallbackShellAbortError } from "../shims/ppr-fallback-shell.js";
 import { onRenderDynamicLatched } from "../shims/internal/headers-state.js";
 import { AppRouterContext } from "../shims/internal/app-router-context.js";
@@ -12,21 +10,24 @@ import { createInlineScriptTag, createNonceAttribute, escapeHtmlAttr, safeJsonSt
 import { getClientTraceMetadataHTML, markClientTraceMetadataBlock } from "./client-trace-metadata.js";
 import { deferUntilStreamConsumed } from "./defer-until-stream-consumed.js";
 import { setPagesClientAssets } from "./pages-client-assets.js";
+import { AppElementsWire } from "./app-elements-wire.js";
+import "./app-elements.js";
 import { ServerInsertedHTMLContext, clearServerInsertedHTML, getBfcacheIdMapContext, registerServerInsertedHTMLCallback, renderServerInsertedHTML, setNavigationContext } from "../shims/navigation-context-state.js";
 import "../shims/navigation-server.js";
 import DefaultGlobalError from "../shims/default-global-error.js";
 import { BfcacheIdentityMapContext, ElementsContext, Slot } from "../shims/slot.js";
 import { getNextErrorDigest } from "./next-error-digest.js";
 import { createSsrErrorMetaRenderer } from "./app-ssr-error-meta.js";
-import { createClientPageSsrSearchParamsSource } from "./app-page-search-params-observation.js";
 import { isAppRenderAbortError } from "./app-render-abort-error.js";
 import { RSC_FORM_STATE_GLOBAL } from "../client/browser-globals.js";
 import { createNavigationRuntimeRenderedSearchScript, createNavigationRuntimeRscMetadataScript, createRscEmbedTransform, createTickBufferedTransform, waitAtLeastOneReactRenderTask } from "./app-ssr-stream.js";
 import { createInitialBfcacheMaps } from "./app-bfcache-identity.js";
 import { createClientReferencePreloader } from "./app-client-reference-preloader.js";
+import { createClientPageSsrSearchParamsSource } from "./app-page-search-params-observation.js";
 import { runWithRootParamsScope } from "../shims/root-params.js";
 import { runWithNavigationContext } from "../shims/navigation-state.js";
 import { startCandidateSearchParamsGate } from "./app-ssr-search-params-gate.js";
+import { withAppRouterTree } from "../shims/app-router-tree-context.js";
 import { BeforeInteractiveContext } from "../shims/before-interactive-context.js";
 import { renderBeforeInteractiveInlineScripts } from "./before-interactive-head.js";
 import { createInitialDevServerErrorScript } from "./dev-initial-server-error.js";
@@ -246,7 +247,7 @@ async function handleSsr(rscStream, navContext, fontData, options) {
 					beforeInteractiveInlineScripts.push(script);
 				};
 				const treeWithBeforeInteractive = createElement(BeforeInteractiveContext.Provider, { value: registerBeforeInteractiveInlineScript }, ssrTree);
-				const ssrRoot = withScriptNonce(treeWithBeforeInteractive, options?.scriptNonce);
+				const ssrRoot = withScriptNonce(withAppRouterTree(treeWithBeforeInteractive), options?.scriptNonce);
 				const bootstrapModuleUrl = extractBootstrapModuleUrl(await import.meta.viteRsc.loadBootstrapScriptContent("index"));
 				const errorMetaRenderer = createSsrErrorMetaRenderer({ basePath: options?.basePath });
 				const pprFallbackShellSignal = options?.pprFallbackShellSignal;
@@ -357,6 +358,8 @@ async function handleSsr(rscStream, navContext, fontData, options) {
 }
 var app_ssr_entry_default = { async fetch(request) {
 	const url = new URL(request.url);
+	const slashRedirect = repeatedSlashRedirectResponse(url.pathname + url.search);
+	if (slashRedirect) return slashRedirect;
 	if (isOpenRedirectShaped(url.pathname)) return notFoundResponse();
 	const result = await (await import.meta.viteRsc.loadModule("rsc", "index")).default(request);
 	if (result instanceof Response) return result;

package/dist/server/app-ssr-stream.d.ts

@@ -6,7 +6,12 @@ type RscEmbedTransform = {
   getRawBuffer(): Promise<ArrayBuffer>;
 };
 type RscEmbedTransformOptions = {
-  mirrorNextFlight?: boolean;
+  /**
+   * Mirror inline Flight chunks into Next.js's `self.__next_f` transport. A
+   * function is checked at each flush; once it returns true, the chunks
+   * already embedded are mirrored first.
+   */
+  mirrorNextFlight?: boolean | (() => boolean);
   scriptNonce?: string;
   getInitialNavigationCacheMetadata?: () => InitialNavigationCacheMetadata;
 };

package/dist/server/app-ssr-stream.js

@@ -49,12 +49,36 @@ function createRscEmbedTransform(embedStream, optionsOrNonce = {}) {
 	const reader = embedStream.getReader();
 	let pendingChunks = [];
 	const rawChunks = [];
+	let embeddedRawChunkCount = 0;
+	let rawBufferTaken = false;
+	let finalized = false;
 	let reading = false;
 	let mirroredNextFlightBootstrap = false;
 	const textDecoder = new TextDecoder("utf-8", {
 		fatal: true,
 		ignoreBOM: true
 	});
+	function decodeChunk(bytes) {
+		try {
+			return textDecoder.decode(bytes);
+		} catch {
+			return [3, bytesToBase64(bytes)];
+		}
+	}
+	function releaseRawChunks() {
+		const mayStartMirror = typeof options.mirrorNextFlight === "function" && !mirroredNextFlightBootstrap && !finalized;
+		if (rawBufferTaken && !mayStartMirror) rawChunks.length = 0;
+	}
+	function startNextFlightMirror() {
+		if (mirroredNextFlightBootstrap) return "";
+		const mirror = options.mirrorNextFlight;
+		if (mirror !== true && (typeof mirror !== "function" || !mirror())) return "";
+		mirroredNextFlightBootstrap = true;
+		let scripts = createInlineScriptTag(createNextFlightBootstrapScript(), options.scriptNonce) + createInlineScriptTag(createNextFlightCleanupScript(), options.scriptNonce);
+		for (let index = 0; index < embeddedRawChunkCount; index++) scripts += createInlineScriptTag(createNextFlightChunkScript(decodeChunk(rawChunks[index])), options.scriptNonce);
+		releaseRawChunks();
+		return scripts;
+	}
 	async function pumpReader() {
 		if (reading) return;
 		reading = true;
@@ -63,11 +87,7 @@ function createRscEmbedTransform(embedStream, optionsOrNonce = {}) {
 				const result = await reader.read();
 				if (result.done) break;
 				rawChunks.push(result.value);
-				try {
-					pendingChunks.push(textDecoder.decode(result.value));
-				} catch {
-					pendingChunks.push([3, bytesToBase64(result.value)]);
-				}
+				pendingChunks.push(decodeChunk(result.value));
 			}
 		} catch (error) {
 			if (process.env.NODE_ENV !== "production") console.warn("[vinext] RSC embed stream read error:", error);
@@ -80,8 +100,10 @@ function createRscEmbedTransform(embedStream, optionsOrNonce = {}) {
 	return {
 		flush() {
 			if (pendingChunks.length === 0) return "";
+			const mirrorScripts = startNextFlightMirror();
 			const chunks = pendingChunks;
 			pendingChunks = [];
+			embeddedRawChunkCount += chunks.length;
 			const embeddedChunks = [];
 			let textChunks = [];
 			let textLength = 0;
@@ -100,30 +122,27 @@ function createRscEmbedTransform(embedStream, optionsOrNonce = {}) {
 				embeddedChunks.push(chunk);
 			}
 			flushTextChunks();
-			let scripts = "";
+			let scripts = mirrorScripts;
 			for (const chunk of embeddedChunks) {
 				scripts += createInlineScriptTag(createNavigationRuntimeRscChunkScript(chunk), options.scriptNonce);
-				if (options.mirrorNextFlight) {
-					if (!mirroredNextFlightBootstrap) {
-						scripts += createInlineScriptTag(createNextFlightBootstrapScript(), options.scriptNonce);
-						scripts += createInlineScriptTag(createNextFlightCleanupScript(), options.scriptNonce);
-						mirroredNextFlightBootstrap = true;
-					}
-					scripts += createInlineScriptTag(createNextFlightChunkScript(chunk), options.scriptNonce);
-				}
+				if (mirroredNextFlightBootstrap) scripts += createInlineScriptTag(createNextFlightChunkScript(chunk), options.scriptNonce);
 			}
 			return scripts;
 		},
 		async finalize() {
 			await pumpPromise;
 			let scripts = this.flush();
+			scripts += startNextFlightMirror();
+			finalized = true;
+			releaseRawChunks();
 			scripts += createInlineScriptTag(createNavigationRuntimeRscDoneScript(options.getInitialNavigationCacheMetadata?.()), options.scriptNonce);
 			return scripts;
 		},
 		async getRawBuffer() {
 			await pumpPromise;
 			const buffer = concatUint8Arrays(rawChunks);
-			rawChunks.length = 0;
+			rawBufferTaken = true;
+			releaseRawChunks();
 			return buffer.buffer;
 		}
 	};

package/dist/server/app-worker-stages.d.ts

@@ -3,7 +3,7 @@ import { VinextResponseStageCacheability, VinextResponseStageDispatchOptions, Vi
 import { AppRscRenderMode } from "./app-rsc-render-mode.js";
 import { TrustedPrerenderState } from "./prerender-route-params.js";
 //#region src/server/app-worker-stages.d.ts
-export declare const APP_WORKER_RESPONSE_STAGE_PROTOCOL_VERSION = 10;
+export declare const APP_WORKER_RESPONSE_STAGE_PROTOCOL_VERSION = 11;
 export declare const APP_METADATA_RESPONSE_STAGE_NO_MATCH_HEADER = "x-vinext-app-metadata-stage-no-match";
 type AppPageParams = Record<string, string | string[]>;
 type AppWorkerResponseStageEnvelope = {
@@ -18,6 +18,11 @@ type AppWorkerResponseStageEnvelope = {
 };
 type AppFullRequestWorkerResponseStageProps = AppWorkerResponseStageEnvelope & {
   kind: "app-full-request";
+  /**
+   * The public request is HEAD. It is dispatched as GET so a transport that
+   * applies HEAD semantics cannot drop the static-file signal's body.
+   */
+  headRequest: boolean;
   prerenderDiscovery: boolean;
   staticFileSignalToken: string;
   trustedPrerenderState: TrustedPrerenderState | null;
@@ -34,7 +39,7 @@ export type AppMatchedWorkerResponseStageProps = AppWorkerResponseStageEnvelope
   interceptionContext: string | null;
   interceptionId: string | null;
   isRscRequest: boolean;
-  matchKind: "interception" | "request" | "resolved";
+  matchKind: "interception" | "raw-request" | "request" | "resolved";
   mountedSlotsHeader: string | null;
   params: AppPageParams;
   resolvedUrl: string;