vinext 1.1.0 → 1.2.1

package/dist/server/app-rsc-handler.js

@@ -1,20 +1,22 @@
 import { preserveFullyBufferedBodyMetadata } from "./fully-buffered-response.js";
 import { closeAfterResponse, closeAfterResponseWithBody, createRequestContext, runWithRequestContext } from "../shims/unified-request-context.js";
 import { PRERENDER_REVALIDATE_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
-import { hasMiddlewareRequestHeaderOverrides } from "../utils/middleware-request-headers.js";
+import { buildRequestHeadersFromMiddlewareResponse, hasMiddlewareRequestHeaderOverrides } from "../utils/middleware-request-headers.js";
 import { requestContextFromRequest } from "../config/request-context.js";
 import { isExternalUrl } from "../utils/external-url.js";
-import { assetPrefixPathname, isNextStaticPath } from "../utils/asset-prefix.js";
-import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { addBasePathToPathname, hasBasePath, stripBasePath } from "../utils/base-path.js";
-import { patternToNextFormat } from "../routing/route-validation.js";
-import { getRequestExecutionContext } from "../shims/request-context.js";
 import "./app-rsc-vary.js";
 import { ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_REWRITTEN_HEADER, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_SPECIAL_ERROR_STATUS_HEADER } from "./headers.js";
-import { isInterceptionMatchedUrlPath, normalizePath } from "./normalize-path.js";
 import { badRequestResponse, notFoundResponse, notFoundStaticAssetResponse } from "./http-error-responses.js";
 import { cloneRequestWithHeaders, cloneRequestWithUrl, filterInternalHeaders, normalizeTrailingSlash, normalizeTrailingSlashPathname, resolvePublicFileRoute } from "./request-pipeline.js";
+import { assetPrefixPathname, isNextStaticPath } from "../utils/asset-prefix.js";
+import { normalizePathnameForRouteMatch, normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
+import { patternToNextFormat } from "../routing/route-validation.js";
+import { getRequestExecutionContext } from "../shims/request-context.js";
+import { runOutsideWorkStoreScope } from "../shims/internal/work-store-scope.js";
+import { isInterceptionMatchedUrlPath, normalizePath } from "./normalize-path.js";
 import { normalizeDefaultLocalePathname } from "./pages-i18n.js";
+import { buildNextDataNotFoundResponse, normalizePagesDataRequest } from "./pages-data-route.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
 import { markRouteCacheabilityDynamic, preserveRouteCacheabilityResponsePolicy } from "../shims/cacheability-classification.js";
 import { NEVER_CACHE_CONTROL, applyCdnResponseHeaders, captureCdnResponsePolicyOverrides, isCdnResponsePolicyHeader, reconcileCdnResponseHeadersAfterOuterPolicy } from "./cache-control.js";
@@ -22,9 +24,8 @@ import { isOnDemandRevalidateRequest } from "./revalidation-request.js";
 import { getDraftModeCookieHeader, getEffectiveRequestCookieHeader, getHeadersContext, hasEffectiveRequestCookieChanges, headersContextFromRequest, isDraftModeEnabled, isDraftModeRequest, runWithHeadersContext } from "../shims/headers.js";
 import { mergeRewriteQuery } from "../utils/query.js";
 import { getScriptNonceFromHeaderSources } from "./csp.js";
-import { buildNextDataNotFoundResponse, normalizePagesDataRequest } from "./pages-data-route.js";
 import { traceFindPageComponents } from "./pages-execution-tracing.js";
-import { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, isImageOptimizationPath, resolveDevImageRedirect } from "./image-optimization.js";
+import { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, isImageOptimizationPath, markImageOptimizationSignal, resolveDevImageRedirect } from "./image-optimization.js";
 import { parseCacheabilityManifest } from "./cacheability-manifest.js";
 import { getRenderedConcreteUrlPathsForRoute } from "./pregenerated-concrete-paths.js";
 import { VINEXT_RSC_CACHE_BUSTING_SEARCH_PARAM, canonicalizeLoadingShellRscRequestHeaders, canonicalizePrewarmableRscRequestHeaders, createCanonicalRscRequestUrl, createRscRedirectLocation, createRscRequestUrl, hasRscCacheBustingSearchParam, resolveInvalidRscCacheBustingRequest, stripRscCacheBustingSearchParam, stripRscSuffix } from "./app-rsc-cache-busting.js";
@@ -33,6 +34,7 @@ import { consumeResponseStageLinkProvenance, copyLinkHeaderProvenance } from "./
 import "./app-page-response.js";
 import { parseNextHttpErrorDigest } from "./next-error-digest.js";
 import { traceAppPageRender } from "./app-page-tracing.js";
+import { openForwardedMiddlewareContext } from "./forwarded-middleware-context.js";
 import { setFrameworkRequestRoute, traceFrameworkRequest } from "./request-tracing.js";
 import { matchPrerenderRouteParamsPayload, readTrustedPrerenderRouteParams, serializePrerenderRouteParamsHeader } from "./prerender-route-params.js";
 import { buildPageCacheTags } from "./implicit-tags.js";
@@ -147,7 +149,7 @@ function applyMiddlewareContextToResponse(response, middlewareContext, appendToP
 	const middlewareLink = middlewareContext.headers?.get("link");
 	if (responseLink && middlewareLink) headers.set("link", `${middlewareLink}, ${responseLink}`);
 	return preserveFullyBufferedBodyMetadata(response, new Response(response.body, {
-		status: middlewareContext.status ?? response.status,
+		status: response.status === 304 ? 304 : middlewareContext.status ?? response.status,
 		statusText: response.statusText,
 		headers
 	}));
@@ -165,7 +167,8 @@ function withStoredSpecialErrorStatus(response, isSegmentPrefetch) {
 	const headers = new Headers(response.headers);
 	headers.delete(VINEXT_SPECIAL_ERROR_STATUS_HEADER);
 	const storedStatus = Number(marker);
-	const status = !(storedStatus === 401 || storedStatus === 403 || storedStatus === 404) ? response.status : isSegmentPrefetch ? 200 : storedStatus;
+	const isStoredSpecialError = storedStatus === 401 || storedStatus === 403 || storedStatus === 404;
+	const status = response.status === 304 || !isStoredSpecialError ? response.status : isSegmentPrefetch ? 200 : storedStatus;
 	return preserveFullyBufferedBodyMetadata(response, new Response(response.body, {
 		headers,
 		status,
@@ -204,8 +207,10 @@ async function applyRewrite(options, cleanPathname, recordCacheability = true) {
 	if (isExternalUrl(rewritten)) {
 		const validationResponse = await options.validateExternalRewriteRequest();
 		if (validationResponse) return validationResponse;
+		const { requestWithMiddlewareContextHeaders } = await import("./app-middleware.js");
+		const proxyRequest = requestWithMiddlewareContextHeaders(options.request, options.middlewareContext);
 		options.clearRequestContext();
-		return configMatchers.proxyExternalRequest(options.request, rewritten);
+		return configMatchers.proxyExternalRequest(proxyRequest, rewritten);
 	}
 	return rewritten;
 }
@@ -220,6 +225,16 @@ function requestContextForResolvedUrl(requestContext, resolvedUrl, baseUrl) {
 function pathnameForResolvedUrl(resolvedUrl) {
 	return resolvedUrl.split("#", 1)[0].split("?", 1)[0];
 }
+/**
+* Percent-encode the code points the URL parser encodes in a path (so `é`
+* becomes `%C3%A9`) without resolving dot segments or `\`: Next.js only parses
+* a rewrite destination's template, so a captured `../admin` stays verbatim.
+*/
+function serializeResolvedUrl(resolvedUrl, base) {
+	const resolved = new URL(resolvedUrl, base);
+	stripRscCacheBustingSearchParam(resolved);
+	return pathnameForResolvedUrl(resolvedUrl).replace(/[\0-\x20"<>`{}^\x7F]|[^\0-\x7F]/gu, (char) => char.length === 1 && char >= "\ud800" && char <= "\udfff" ? "%EF%BF%BD" : encodeURIComponent(char)) + resolved.search + resolved.hash;
+}
 async function applyConfigHeadersToMiddlewareRedirect(response, options) {
 	if (response.status < 300 || response.status >= 400) return response;
 	if (!HAS_CONFIG_HEADERS || !options.configHeaders.length) return response;
@@ -314,7 +329,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	const { requestCleanPathname } = normalized;
 	let { pathname, cleanPathname } = normalized;
 	let resolvedUrl = cleanPathname + url.search;
-	const originalResolvedUrl = resolvedUrl;
+	const originalResolvedUrl = serializeResolvedUrl(resolvedUrl, url);
 	const getResolvedSearchParams = () => new URL(resolvedUrl, url).searchParams;
 	const canonicalPathname = cleanPathname;
 	const basePathState = {
@@ -354,15 +369,17 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		});
 		if (prerenderEndpointResponse) return prerenderEndpointResponse;
 	}
-	const trailingSlashRedirect = options.trailingSlash && options.isMetadataRoutePath && await options.isMetadataRoutePath(cleanPathname) ? null : normalizeTrailingSlash(requestCleanPathname, hadBasePath ? options.basePath : "", options.trailingSlash, url.search);
-	if (trailingSlashRedirect) return trailingSlashRedirect;
+	if (!options.skipTrailingSlashRedirect) {
+		const trailingSlashRedirect = options.trailingSlash && options.isMetadataRoutePath && await options.isMetadataRoutePath(cleanPathname) ? null : normalizeTrailingSlash(requestCleanPathname, hadBasePath ? options.basePath : "", options.trailingSlash, url.search);
+		if (trailingSlashRedirect) return trailingSlashRedirect;
+	}
 	const matchPathname = (p) => normalizeDefaultLocalePathname(p, options.i18nConfig, { hostname: url.hostname });
 	const redirectPathname = matchPathname(requestCleanPathname);
 	const configMatchers = HAS_CONFIG_REDIRECTS && options.configRedirects.length ? await import("../config/config-matchers.js") : null;
 	const redirect = configMatchers ? configMatchers.matchRedirect(redirectPathname, options.configRedirects, preMiddlewareRequestContext, basePathState, dispatchResponseStage ? void 0 : markConditionalRedirectCacheability) : null;
 	if (configMatchers && redirect) {
 		const destination = configMatchers.sanitizeDestination(redirectDestinationWithBasePath(redirect.destination, options.basePath, hadBasePath));
-		const location = isRscRequest && request.headers.get("RSC") === "1" ? await createRscRedirectLocation(destination, request) : configMatchers.preserveRedirectDestinationQuery(destination, url.search);
+		const location = isRscRequest && request.headers.get("RSC") === "1" ? await createRscRedirectLocation(destination, request) : configMatchers.preserveRedirectDestinationQuery(destination, url.search, redirect.destinationQuery);
 		return new Response(null, {
 			status: redirect.permanent ? 308 : 307,
 			headers: { Location: location }
@@ -388,6 +405,11 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	const isolatedMiddlewareRequest = isolatedMiddlewareSource ? requestWithoutRscCacheBustingSearchParam(requestWithoutRscSuffix(isolatedMiddlewareSource)) : void 0;
 	let didMiddlewareRewrite = false;
 	let didMiddlewareRewritePathname = false;
+	let resolvedPathnameHasBasePath = hadBasePath;
+	const currentBasePathState = () => ({
+		basePath: options.basePath,
+		hadBasePath: resolvedPathnameHasBasePath
+	});
 	if (runMiddleware) {
 		const middlewareResult = await runMiddleware({
 			cleanPathname,
@@ -412,6 +434,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		}
 		cleanPathname = middlewareResult.cleanPathname;
 		didMiddlewareRewrite = middlewareResult.rewritten;
+		if (didMiddlewareRewrite) resolvedPathnameHasBasePath = middlewareResult.rewriteHadBasePath ?? true;
 		if (didMiddlewareRewrite || cleanPathname !== normalized.cleanPathname) cleanPathnameIsRequestPathname = false;
 		didMiddlewareRewritePathname = cleanPathname !== normalized.cleanPathname;
 		if (middlewareResult.search !== null) url.search = middlewareResult.search;
@@ -574,8 +597,9 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	filesystemRouteEligible ||= didMiddlewareRewrite;
 	for (const rewrite of options.configRewrites.beforeFiles) {
 		const beforeFilesRewrite = await applyRewrite({
-			basePathState,
+			basePathState: currentBasePathState(),
 			clearRequestContext: options.clearRequestContext,
+			middlewareContext,
 			request: normalizedUserlandRequest,
 			requestContext: requestContextForResolvedUrl(postMiddlewareRequestContext, resolvedUrl, url),
 			paramsPathname: matchPathname(cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname),
@@ -588,6 +612,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			cleanPathname = pathnameForResolvedUrl(resolvedUrl);
 			cleanPathnameIsRequestPathname = false;
 			filesystemRouteEligible = true;
+			resolvedPathnameHasBasePath = !options.basePath || rewrite.basePath !== false;
 		}
 	}
 	const claimedRscCacheBustingRedirect = await validateClaimedOutsideBasePathRsc();
@@ -601,8 +626,9 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		let actionMatch = null;
 		for (const rewrite of options.configRewrites.afterFiles) {
 			const rewritten = await applyRewrite({
-				basePathState,
+				basePathState: currentBasePathState(),
 				clearRequestContext: options.clearRequestContext,
+				middlewareContext,
 				request: normalizedUserlandRequest,
 				requestContext: requestContextForResolvedUrl(postMiddlewareRequestContext, resolvedUrl, url),
 				paramsPathname: matchPathname(cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname),
@@ -615,13 +641,15 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			cleanPathname = pathnameForResolvedUrl(resolvedUrl);
 			cleanPathnameIsRequestPathname = false;
 			filesystemRouteEligible = true;
+			resolvedPathnameHasBasePath = !options.basePath || rewrite.basePath !== false;
 			actionMatch = matchCleanPathname();
 			if (actionMatch) break;
 		}
 		if (!actionMatch) for (const rewrite of options.configRewrites.fallback) {
 			const rewritten = await applyRewrite({
-				basePathState,
+				basePathState: currentBasePathState(),
 				clearRequestContext: options.clearRequestContext,
+				middlewareContext,
 				request: normalizedUserlandRequest,
 				requestContext: requestContextForResolvedUrl(postMiddlewareRequestContext, resolvedUrl, url),
 				paramsPathname: matchPathname(cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname),
@@ -634,6 +662,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			cleanPathname = pathnameForResolvedUrl(resolvedUrl);
 			cleanPathnameIsRequestPathname = false;
 			filesystemRouteEligible = true;
+			resolvedPathnameHasBasePath = !options.basePath || rewrite.basePath !== false;
 			actionMatch = matchCleanPathname();
 			if (actionMatch) break;
 		}
@@ -641,15 +670,29 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	}
 	const lateActionRscCacheBustingRedirect = await validateClaimedOutsideBasePathRsc();
 	if (lateActionRscCacheBustingRedirect) return lateActionRscCacheBustingRedirect;
-	if (filesystemRouteEligible && isImageOptimizationPath(cleanPathname)) {
-		const imageRedirect = resolveDevImageRedirect(url, [...options.imageConfig?.deviceSizes ?? DEFAULT_DEVICE_SIZES, ...options.imageConfig?.imageSizes ?? DEFAULT_IMAGE_SIZES], options.imageConfig?.qualities, { isDev: options.isDev });
-		if (!imageRedirect) return new Response("Invalid image optimization parameters", { status: 400 });
-		return Response.redirect(new URL(imageRedirect, url.origin).href, 302);
-	}
+	const serveImageEndpointIfMatched = () => {
+		if (!filesystemRouteEligible || !resolvedPathnameHasBasePath || !isImageOptimizationPath(cleanPathname)) return null;
+		const imageUrl = new URL(resolvedUrl, url);
+		const imageRedirect = resolveDevImageRedirect(imageUrl, [...options.imageConfig?.deviceSizes ?? DEFAULT_DEVICE_SIZES, ...options.imageConfig?.imageSizes ?? DEFAULT_IMAGE_SIZES], options.imageConfig?.qualities, { isDev: options.isDev });
+		const middlewareHeaders = new Headers();
+		mergeMiddlewareResponseHeaders(middlewareHeaders, middlewareContext.headers);
+		if (!imageRedirect) return new Response("Invalid image optimization parameters", {
+			status: 400,
+			headers: middlewareHeaders
+		});
+		const overrideHeaders = middlewareContext.requestHeaders ?? middlewareContext.headers;
+		return markImageOptimizationSignal(Response.redirect(new URL(imageRedirect, url.origin).href, 302), {
+			middlewareHeaders,
+			requestHeaders: overrideHeaders ? buildRequestHeadersFromMiddlewareResponse(request.headers, overrideHeaders) : null,
+			search: imageUrl.search
+		});
+	};
+	const imageEndpointResponse = serveImageEndpointIfMatched();
+	if (imageEndpointResponse) return imageEndpointResponse;
 	const metadataRouteResponse = await renderMetadataRouteIfMatched();
 	if (metadataRouteResponse) return composeResponseStageResponse(metadataRouteResponse);
 	const publicFileResponse = filesystemRouteEligible ? resolvePublicFileRoute({
-		cleanPathname,
+		cleanPathname: cleanPathnameIsRequestPathname ? cleanPathname : normalizePathnameForRouteMatch(cleanPathname),
 		middlewareContext,
 		pathname,
 		publicFiles: options.publicFiles,
@@ -660,9 +703,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		return publicFileResponse;
 	}
 	stripRscCacheBustingSearchParam(url);
-	const resolved = new URL(resolvedUrl, url);
-	stripRscCacheBustingSearchParam(resolved);
-	resolvedUrl = resolved.pathname + resolved.search + resolved.hash;
+	resolvedUrl = serializeResolvedUrl(resolvedUrl, url);
 	options.setNavigationContext({
 		pathname: canonicalPathname,
 		searchParams: getResolvedSearchParams(),
@@ -670,7 +711,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	});
 	const directPreActionMatch = filesystemRouteEligible ? matchCleanPathname() : null;
 	const preActionRoutePathname = cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname;
-	let interceptionSourceContext = interceptionContextHeader;
+	let interceptionSourceContext = interceptionSourcePathname !== null ? interceptionContextHeader : null;
 	let interceptionSourceMatch = filesystemRouteEligible && interceptionSourcePathname !== null && interceptionContextHeader !== null ? options.matchInterceptRoute?.(preActionRoutePathname, interceptionContextHeader, interceptionIdHeader) ?? null : null;
 	let hasVerifiedInterceptionSource = provesConcreteInterceptionSource(interceptionSourceMatch);
 	if (interceptionIdHeader !== null && !hasVerifiedInterceptionSource) {
@@ -688,8 +729,8 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		setInterceptionResponseUncacheable(true);
 	};
 	if (interceptionSourceMatch !== null && interceptionContextHeader !== null && interceptionSourcePathname !== null && !(interceptionSourceMatch.route === directPreActionMatch?.route && haveSamePageParams(interceptionSourceMatch.params, directPreActionMatch.params))) {
-		const sourceRequestPathname = normalizeTrailingSlashPathname(interceptionContextHeader, options.trailingSlash) ?? interceptionContextHeader;
-		const decodedSourceRequestPathname = normalizeTrailingSlashPathname(interceptionSourcePathname, options.trailingSlash) ?? interceptionSourcePathname;
+		const sourceRequestPathname = options.skipTrailingSlashRedirect ? interceptionContextHeader : normalizeTrailingSlashPathname(interceptionContextHeader, options.trailingSlash) ?? interceptionContextHeader;
+		const decodedSourceRequestPathname = options.skipTrailingSlashRedirect ? interceptionSourcePathname : normalizeTrailingSlashPathname(interceptionSourcePathname, options.trailingSlash) ?? interceptionSourcePathname;
 		const adoptRewrittenInterceptionSource = (rewrittenPathname) => {
 			const rewrittenInterceptionSourceMatch = isValidInterceptionSourceContext(rewrittenPathname) ? options.matchInterceptRoute?.(preActionRoutePathname, rewrittenPathname, interceptionIdHeader) ?? null : null;
 			if (rewrittenInterceptionSourceMatch !== null) {
@@ -892,6 +933,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	let match = preActionMatch;
 	const renderPagesForMatchKind = async (matchKind) => {
 		if (!filesystemRouteEligible) return null;
+		const pagesRouteUrl = cleanPathnameIsRequestPathname ? requestCleanPathname + resolvedUrl.slice(pathnameForResolvedUrl(resolvedUrl).length) : resolvedUrl;
 		let sharedOuterPolicyNeedsReconciliation = false;
 		const dispatchPagesResponseStage = dispatchResponseStage ? async (stageRequest, resourceKind, dataKind, hasRequestAwareDocument) => {
 			const pagesOnDemandRevalidate = resourceKind === "page" && isOnDemandRevalidateRequest(stageRequest.headers.get("x-prerender-revalidate"));
@@ -921,7 +963,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 				requestOrigin: url.origin,
 				resourceKind,
 				requestUrl: request.url,
-				resolvedUrl,
+				resolvedUrl: pagesRouteUrl,
 				scriptNonce: scriptNonce ?? null
 			}, { cache });
 			const policyOwner = resourceKind === "page" ? consumePagesResponseStagePolicyOwner(response) : {
@@ -936,7 +978,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			if (!responseStageHasContentLength) response.headers.delete("Content-Length");
 			return response;
 		} : void 0;
-		const response = !isInterceptionMatch && (match === null || match.route.isDynamic) ? await options.renderPagesFallback?.({
+		const response = !isInterceptionMatch && (match === null || match.route.isDynamic) ? await runOutsideWorkStoreScope(() => options.renderPagesFallback?.({
 			appRouteMatch: match ?? null,
 			allowRscDocumentFallback: didMiddlewareRewritePathname || allowInternalRscDocumentFallback,
 			dispatchPagesResponseStage,
@@ -944,11 +986,11 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			isRscRequest,
 			matchKind,
 			middlewareContext,
-			pathname: resolvedUrl,
+			pathname: pagesRouteUrl,
 			pagesDataRequest,
 			request,
 			url
-		}) ?? null : null;
+		})) ?? null : null;
 		if (response) preserveRouteCacheabilityResponsePolicy();
 		if (!response) return null;
 		if (sharedOuterPolicyNeedsReconciliation) reconcileCdnResponseHeadersAfterOuterPolicy(response.headers, await loadOuterResponsePolicy());
@@ -972,8 +1014,9 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	}
 	if (!isInterceptionMatch && !resolvedLateRewritesForAction && (!match || match.route.isDynamic)) for (const rewrite of options.configRewrites.afterFiles) {
 		const afterFilesRewrite = await applyRewrite({
-			basePathState,
+			basePathState: currentBasePathState(),
 			clearRequestContext: options.clearRequestContext,
+			middlewareContext,
 			request: normalizedUserlandRequest,
 			requestContext: requestContextForResolvedUrl(postMiddlewareRequestContext, resolvedUrl, url),
 			paramsPathname: matchPathname(cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname),
@@ -990,8 +1033,11 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		cleanPathnameIsRequestPathname = false;
 		invalidateInterceptionCacheProof();
 		filesystemRouteEligible = true;
+		resolvedPathnameHasBasePath = !options.basePath || rewrite.basePath !== false;
 		const claimedRscCacheBustingRedirect = await validateClaimedOutsideBasePathRsc();
 		if (claimedRscCacheBustingRedirect) return claimedRscCacheBustingRedirect;
+		const rewrittenImageEndpointResponse = serveImageEndpointIfMatched();
+		if (rewrittenImageEndpointResponse) return rewrittenImageEndpointResponse;
 		const rewrittenMetadataResponse = await renderMetadataRouteIfMatched();
 		if (rewrittenMetadataResponse) return composeResponseStageResponse(rewrittenMetadataResponse);
 		match = matchCleanPathname();
@@ -1014,8 +1060,9 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	}
 	if (!resolvedLateRewritesForAction && !match) for (const rewrite of options.configRewrites.fallback) {
 		const fallbackRewrite = await applyRewrite({
-			basePathState,
+			basePathState: currentBasePathState(),
 			clearRequestContext: options.clearRequestContext,
+			middlewareContext,
 			request: normalizedUserlandRequest,
 			requestContext: requestContextForResolvedUrl(postMiddlewareRequestContext, resolvedUrl, url),
 			paramsPathname: matchPathname(cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname),
@@ -1032,8 +1079,11 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		cleanPathnameIsRequestPathname = false;
 		invalidateInterceptionCacheProof();
 		filesystemRouteEligible = true;
+		resolvedPathnameHasBasePath = !options.basePath || rewrite.basePath !== false;
 		const claimedRscCacheBustingRedirect = await validateClaimedOutsideBasePathRsc();
 		if (claimedRscCacheBustingRedirect) return claimedRscCacheBustingRedirect;
+		const rewrittenImageEndpointResponse = serveImageEndpointIfMatched();
+		if (rewrittenImageEndpointResponse) return rewrittenImageEndpointResponse;
 		const rewrittenMetadataResponse = await renderMetadataRouteIfMatched();
 		if (rewrittenMetadataResponse) return composeResponseStageResponse(rewrittenMetadataResponse);
 		match = matchCleanPathname();
@@ -1226,7 +1276,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		cleanPathname,
 		draftModeCookie,
 		forceDynamic: route.forceDynamic === true,
-		interceptionContext: isRscRequest ? interceptionSourceContext : null,
+		interceptionContext: interceptionSourceContext,
 		interceptionId: interceptionIdHeader,
 		isRscRequest,
 		matchKind: responseStageMatchKind,
@@ -1250,7 +1300,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		actionError: normalizedProgressiveActionError,
 		actionFailed,
 		handlerStart,
-		interceptionContext: isRscRequest ? interceptionSourceContext : null,
+		interceptionContext: interceptionSourceContext,
 		interceptionId: interceptionIdHeader,
 		interceptionPathname: cleanPathnameIsRequestPathname ? requestCleanPathname : cleanPathname,
 		isProgressiveActionRender,
@@ -1312,7 +1362,7 @@ function applyProgressiveActionSideEffects(response, sideEffects) {
 /** Build the request-only handler without retaining the response renderer graph. */
 function createAppRscRequestHandler(options) {
 	const handleAppRscRequestLifecycle = async (rawRequest, ctx, allowInternalRscDocumentFallback = false, dispatchResponseStage, responseStageProbeMode = null, transportedPrerenderState) => {
-		const mwCtx = rawRequest.headers.get(VINEXT_MW_CTX_HEADER);
+		const mwCtx = openForwardedMiddlewareContext(rawRequest.headers.get(VINEXT_MW_CTX_HEADER), options.devForwardedMiddlewareContextKey);
 		const pagesDataUrl = new URL(rawRequest.url);
 		const pagesDataInScope = !options.basePath || hasBasePath(pagesDataUrl.pathname, options.basePath);
 		if (pagesDataInScope) pagesDataUrl.pathname = stripBasePath(pagesDataUrl.pathname, options.basePath);

package/dist/server/app-rsc-request-normalization.js

@@ -1,11 +1,11 @@
-import { assetPrefixPathname, isNextStaticPath } from "../utils/asset-prefix.js";
-import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERCEPTION_ID_HEADER, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_RSC_RENDER_MODE_HEADER } from "./app-rsc-vary.js";
 import { VINEXT_CLIENT_REUSE_MANIFEST_HEADER } from "./headers.js";
-import { normalizePath } from "./normalize-path.js";
 import { badRequestResponse, notFoundResponse } from "./http-error-responses.js";
 import { guardProtocolRelativeUrl } from "./request-pipeline.js";
+import { assetPrefixPathname, isNextStaticPath } from "../utils/asset-prefix.js";
+import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
+import { normalizePath } from "./normalize-path.js";
 import { normalizeMountedSlotsHeader } from "./app-mounted-slots-header.js";
 import { APP_RSC_RENDER_MODE_NAVIGATION, APP_RSC_RENDER_MODE_PREFETCH_EMPTY, APP_RSC_RENDER_MODE_PREFETCH_LOADING_SHELL, parseAppRscRenderMode } from "./app-rsc-render-mode.js";
 import { VINEXT_RSC_CACHE_BUSTING_SEARCH_PARAM, stripRscSuffix } from "./app-rsc-cache-busting.js";

package/dist/server/app-rsc-response-stage.js

@@ -1,9 +1,10 @@
 import { preserveFullyBufferedBodyMetadata } from "./fully-buffered-response.js";
 import { closeAfterResponse, closeAfterResponseWithBody, createRequestContext, runWithRequestContext } from "../shims/unified-request-context.js";
 import { VINEXT_REVALIDATE_HOST_HEADER } from "../utils/protocol-headers.js";
-import { getRequestExecutionContext } from "../shims/request-context.js";
 import "./headers.js";
 import { cloneRequestWithHeaders, cloneRequestWithUrl, filterInternalHeaders } from "./request-pipeline.js";
+import { getRequestExecutionContext } from "../shims/request-context.js";
+import { runOutsideWorkStoreScope } from "../shims/internal/work-store-scope.js";
 import { applyEffectiveRequestCookieHeader, getDraftModeCookieHeader, headersContextFromRequest, restoreDraftModeTransition } from "../shims/headers.js";
 import { ensureFetchPatch, setCurrentFetchSoftTags } from "../shims/fetch-cache.js";
 import { traceFindPageComponents } from "./pages-execution-tracing.js";
@@ -153,7 +154,8 @@ async function renderAppWorkerResponseStage(options, rawRequest, ctx, props, sta
 			const pageRequest = props.isDataRequest ? cloneRequestWithUrl(request, new URL(props.resolvedUrl, request.url).toString()) : request;
 			const preHandlerHeaders = props.preHandlerHeaders === null ? void 0 : new Headers(props.preHandlerHeaders);
 			preHandlerHeaders?.delete("Content-Length");
-			let pagesResponse = await options.renderPagesFallback({
+			const renderPagesFallback = options.renderPagesFallback;
+			let pagesResponse = await runOutsideWorkStoreScope(() => renderPagesFallback({
 				allowRscDocumentFallback: props.allowRscDocumentFallback,
 				appRouteMatch: props.appRouteMatch ? { route: {
 					isDynamic: props.appRouteMatch.isDynamic,
@@ -168,7 +170,7 @@ async function renderAppWorkerResponseStage(options, rawRequest, ctx, props, sta
 				pagesDataRequest: props.isDataRequest ? request : null,
 				request: pageRequest,
 				url: new URL(props.requestUrl)
-			});
+			}));
 			if (!pagesResponse) return new Response("Invalid vinext App response stage", { status: 404 });
 			if (preHandlerHeaders) pagesResponse = stripInheritedResponseStageCookies(pagesResponse, preHandlerHeaders);
 			return pagesResponse;

package/dist/server/app-segment-config.d.ts

@@ -1,4 +1,5 @@
-import { FetchCacheMode } from "../shims/fetch-cache.js";
+import { FetchCacheMode } from "../shims/fetch-cache-state.js";
+import "../shims/fetch-cache.js";
 //#region src/server/app-segment-config.d.ts
 type AppRouteSegmentDynamic = "auto" | "error" | "force-dynamic" | "force-static";
 type AppRouteSegmentConfigModule = {

package/dist/server/app-server-action-execution.d.ts

@@ -1,7 +1,8 @@
 import { AppRscRenderMode } from "./app-rsc-render-mode.js";
 import { ActionRevalidationKind } from "../shims/cache-request-state.js";
 import { AppRenderErrorContextOverrides } from "./app-rsc-error-handler.js";
-import { FetchCacheMode } from "../shims/fetch-cache.js";
+import { FetchCacheMode } from "../shims/fetch-cache-state.js";
+import "../shims/fetch-cache.js";
 import { HeadersAccessPhase } from "../shims/internal/headers-state.js";
 import "../shims/headers.js";
 import { ReactFormState } from "react-dom/client";

package/dist/server/app-server-action-execution.js

@@ -1,13 +1,14 @@
+import { runOutsideRequestScopes } from "../shims/internal/als-registry.js";
 import { VINEXT_MW_CTX_HEADER } from "../utils/protocol-headers.js";
 import { buildRequestHeadersFromMiddlewareResponse } from "../utils/middleware-request-headers.js";
 import { parseEdgeRequestCookieHeader } from "../utils/parse-cookie.js";
 import { isExternalUrl } from "../utils/external-url.js";
-import { splitPathSegments } from "../routing/utils.js";
 import { addBasePathToPathname, hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { NEXT_ROUTER_STATE_TREE_HEADER, VINEXT_RSC_VARY_HEADER } from "./app-rsc-vary.js";
 import { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER } from "./headers.js";
 import { internalServerErrorResponse, payloadTooLargeResponse } from "./http-error-responses.js";
 import { attachRequestCfMetadata, validateCsrfOrigin, validateServerActionPayload } from "./request-pipeline.js";
+import { splitPathSegments } from "../routing/utils.js";
 import { APP_RSC_RENDER_MODE_NAVIGATION } from "./app-rsc-render-mode.js";
 import { isDraftModeRequest, setHeadersContext } from "../shims/headers.js";
 import { _drainPendingRevalidations, getAndClearActionRevalidationKind } from "../shims/cache-request-state.js";
@@ -18,6 +19,7 @@ import { VINEXT_RSC_CONTENT_TYPE, applyRscCompatibilityIdHeader, createRscReques
 import { mergeMiddlewareResponseHeaders } from "./middleware-response-headers.js";
 import { applyEdgeRuntimeHeader } from "./app-page-response.js";
 import { getNextErrorDigest, parseNextHttpErrorDigest, parseNextRedirectDigest } from "./next-error-digest.js";
+import { hasDigest } from "./app-rsc-errors.js";
 import { buildAppPageTags } from "./implicit-tags.js";
 import "./app-page-stream.js";
 import { getSetCookieName } from "./cookie-utils.js";
@@ -28,6 +30,23 @@ import { createRootParamsUsageController, runWithRootParamsUsage } from "../shim
 import { createStaticGenerationHeadersContext } from "./app-static-generation.js";
 import { markAppRscResponseConfigHeadersApplied } from "./app-rsc-response-finalizer.js";
 //#region src/server/app-server-action-execution.ts
+/**
+* Run a server-reference load or decode outside every request scope.
+*
+* Server reference modules are imported on the first request that names them
+* — `loadServerAction()` imports the action's module, and the decoders import
+* any reference the body carries — and a dynamic `import()` carries
+* AsyncLocalStorage into the module's top-level evaluation. Module-scope
+* `cookies()`/`headers()` would then capture that first caller's request for
+* every later caller in the isolate. Next.js evaluates action modules outside
+* the request store, where those calls throw.
+*
+* The result is awaited inside the callback because `decodeReply()` returns a
+* lazy thenable that only resolves (and imports) its references once awaited.
+*/
+function loadOutsideRequestScopes(load) {
+	return runOutsideRequestScopes(async () => await load());
+}
 function parseBoundProgressiveActionReference(body, referencePrefix) {
 	const fieldPrefix = `$ACTION_${referencePrefix}:`;
 	const chunks = /* @__PURE__ */ new Map();
@@ -473,6 +492,25 @@ function shouldUseForwardedActionRedirectStatus(options) {
 	if (!options.currentRoute || !options.targetRoute || !options.resolveRouteRuntime) return false;
 	return normalizeRuntime(options.resolveRouteRuntime(options.currentRoute)) !== normalizeRuntime(options.resolveRouteRuntime(options.targetRoute));
 }
+/**
+* A failed fetch action's result, as Next.js sends it: a rejected promise.
+* React's Flight error channel reports the rejection through the render's
+* onError and gives the client error its digest, where an Error value would
+* reach the client without one.
+*/
+function createRejectedActionResult(error) {
+	const result = Promise.reject(error);
+	result.catch(() => {});
+	return result;
+}
+/**
+* In development the render's onError logs a rejected action result unless it
+* already has a digest; log those here, so each failure is logged once. As in
+* Next.js, a thrown string is not logged in development.
+*/
+function logRejectedActionResult(error) {
+	if (process.env.NODE_ENV === "production" || hasDigest(error)) console.error("[vinext] Server action error:", error);
+}
 function getActionHttpFallbackStatus(error) {
 	const digest = getNextErrorDigest(error);
 	if (!digest) return null;
@@ -559,7 +597,7 @@ async function handleProgressiveServerActionRequest(options) {
 			clearRequestContext: options.clearRequestContext,
 			getAndClearPendingCookies: options.getAndClearPendingCookies
 		});
-		const action = await options.decodeAction(body);
+		const action = await loadOutsideRequestScopes(() => options.decodeAction(body));
 		if (!isAppServerActionFunction(action)) {
 			if (options.hasPageRoute) return createActionNotFoundResponse(null, {
 				clearRequestContext: options.clearRequestContext,
@@ -579,6 +617,7 @@ async function handleProgressiveServerActionRequest(options) {
 		let actionRedirect = null;
 		let actionError = void 0;
 		let actionFailed = false;
+		let actionFailedWithError = false;
 		let actionThrew = false;
 		let actionResult;
 		const rootParamsUsage = createRootParamsUsageController();
@@ -591,7 +630,8 @@ async function handleProgressiveServerActionRequest(options) {
 			if (!actionRedirect) {
 				actionError = error;
 				actionFailed = true;
-				if (!(getActionHttpFallbackStatus(error) !== null || isServerActionNotFoundError(error, null))) {
+				actionFailedWithError = getActionHttpFallbackStatus(error) === null && !isServerActionNotFoundError(error, null);
+				if (actionFailedWithError) {
 					console.error("[vinext] Server action error:", error);
 					options.reportRequestError(error, {
 						path: options.cleanPathname,
@@ -616,6 +656,15 @@ async function handleProgressiveServerActionRequest(options) {
 			const actionPendingCookies = dedupePendingCookies(options.getAndClearPendingCookies());
 			const actionDraftCookie = options.getDraftModeCookieHeader();
 			const revalidationKind = resolveActionRevalidationKind(actionPendingCookies.length > 0 || Boolean(actionDraftCookie));
+			if (actionFailedWithError) {
+				options.clearRequestContext();
+				const headers = new Headers();
+				mergeMiddlewareResponseHeaders(headers, options.middlewareHeaders);
+				headers.set("Cache-Control", "no-cache, no-store, max-age=0, must-revalidate");
+				for (const cookie of actionPendingCookies) headers.append("Set-Cookie", cookie);
+				if (actionDraftCookie) headers.append("Set-Cookie", actionDraftCookie);
+				return internalServerErrorResponse(process.env.NODE_ENV === "production" ? void 0 : "Server action failed: " + getServerActionFailureMessage(actionError), { headers });
+			}
 			if (actionFailed) return {
 				kind: "form-state",
 				formState: null,
@@ -627,7 +676,7 @@ async function handleProgressiveServerActionRequest(options) {
 			};
 			return {
 				kind: "form-state",
-				formState: await options.decodeFormState(actionResult, body) ?? null,
+				formState: await loadOutsideRequestScopes(() => options.decodeFormState(actionResult, body)) ?? null,
 				pendingCookies: actionPendingCookies,
 				draftCookie: actionDraftCookie,
 				revalidationKind
@@ -680,29 +729,18 @@ async function handleProgressiveServerActionRequest(options) {
 * with status 500 carrying the rejected action result, so the nearest client
 * error boundary catches it (see action-handler.ts, the `isFetchAction` branch
 * of the generic error path). vinext mirrors that by rendering a Flight stream
-* with `returnValue: { ok: false }` and no page root (the action never ran, so
+* with a rejected `returnValue: { ok: false }` and no page root (the action never ran, so
 * nothing was revalidated and the page render is skipped). A bare 413 plain
 * response would bypass the boundary and surface the wrong status/content-type.
 */
 async function renderFetchActionBodyExceededResponse(options) {
 	const error = createBodyExceededError(options.maxActionBodySizeLabel);
-	console.error("[vinext] Server action error:", error);
-	options.reportRequestError(error, {
-		path: options.cleanPathname,
-		method: options.request.method,
-		headers: Object.fromEntries(options.request.headers.entries())
-	}, {
-		routerKind: "App Router",
-		routePath: options.currentRouteMatch?.route.pattern ?? options.cleanPathname,
-		routeType: "action",
-		renderSource: "react-server-components-payload",
-		revalidateReason: void 0
-	});
+	logRejectedActionResult(error);
 	getAndClearActionRevalidationKind();
 	options.getAndClearPendingCookies();
 	const returnValue = {
 		ok: false,
-		data: options.sanitizeErrorForClient(error)
+		data: createRejectedActionResult(options.sanitizeErrorForClient(error))
 	};
 	const temporaryReferences = options.createTemporaryReferenceSet();
 	const onRenderError = options.createRscOnErrorHandler(options.request, options.cleanPathname, options.currentRouteMatch?.route.pattern ?? options.cleanPathname, {
@@ -727,6 +765,7 @@ async function renderFetchActionBodyExceededResponse(options) {
 }
 async function handleServerActionRscRequest(options) {
 	if (options.request.method.toUpperCase() !== "POST" || !options.actionId) return null;
+	const actionId = options.actionId;
 	const csrfResponse = validateCsrfOrigin(options.request, options.allowedOrigins);
 	if (csrfResponse) return csrfResponse;
 	if (parseInt(options.request.headers.get("content-length") || "0", 10) > options.maxActionBodySize) {
@@ -738,7 +777,7 @@ async function handleServerActionRscRequest(options) {
 		if (options.contentType.startsWith("multipart/form-data")) {
 			let loadedAction;
 			try {
-				loadedAction = await options.loadServerAction(options.actionId);
+				loadedAction = await loadOutsideRequestScopes(() => options.loadServerAction(actionId));
 			} catch (error) {
 				if (isServerActionNotFoundError(error, options.actionId)) return createActionNotFoundResponse(options.actionId, {
 					clearRequestContext: options.clearRequestContext,
@@ -768,7 +807,7 @@ async function handleServerActionRscRequest(options) {
 		if (action === void 0) {
 			let loadedAction;
 			try {
-				loadedAction = await options.loadServerAction(options.actionId);
+				loadedAction = await loadOutsideRequestScopes(() => options.loadServerAction(actionId));
 			} catch (error) {
 				if (isServerActionNotFoundError(error, options.actionId)) return createActionNotFoundResponse(options.actionId, {
 					clearRequestContext: options.clearRequestContext,
@@ -783,7 +822,7 @@ async function handleServerActionRscRequest(options) {
 			action = loadedAction;
 		}
 		const temporaryReferences = options.createTemporaryReferenceSet();
-		const args = await options.decodeReply(body, { temporaryReferences });
+		const args = await loadOutsideRequestScopes(() => options.decodeReply(body, { temporaryReferences }));
 		let returnValue;
 		let actionRedirect = null;
 		let actionStatus = 200;
@@ -815,10 +854,10 @@ async function handleServerActionRscRequest(options) {
 						};
 					} else {
 						actionStatus = 500;
-						console.error("[vinext] Server action error:", error);
+						logRejectedActionResult(error);
 						returnValue = {
 							ok: false,
-							data: options.sanitizeErrorForClient(error)
+							data: createRejectedActionResult(options.sanitizeErrorForClient(error))
 						};
 					}
 				}