vinext 1.2.1 → 1.3.0

package/dist/server/app-rsc-response-finalizer.d.ts

@@ -11,6 +11,11 @@ type FinalizeAppRscResponseOptions = {
    * default-locale URLs (issue #1336, item 4).
    */
   i18nConfig: NextI18nConfig | null;
+  /**
+   * Whether the root keeps its trailing slash when the default locale is
+   * spliced in (`shouldRestoreLocaleRootTrailingSlash` on the raw request).
+   */
+  restoreLocaleRootTrailingSlash?: boolean;
   /**
    * Original pre-middleware request context.
    * Next.js evaluates config header has/missing conditions against the

package/dist/server/app-rsc-response-finalizer.js

@@ -32,7 +32,10 @@ async function applyAppRscConfigHeaders(headers, request, options) {
 	let pathname = url.pathname;
 	const hadBasePath = !options.basePath || hasBasePath(pathname, options.basePath);
 	pathname = stripBasePath(pathname, options.basePath);
-	const matchPathname = options.i18nConfig ? normalizeDefaultLocalePathname(pathname, options.i18nConfig, { hostname: url.hostname }) : pathname;
+	const matchPathname = options.i18nConfig ? normalizeDefaultLocalePathname(pathname, options.i18nConfig, {
+		hostname: url.hostname,
+		restoreRootTrailingSlash: options.restoreLocaleRootTrailingSlash
+	}) : pathname;
 	const { applyConfigHeadersToResponse } = await import("./config-headers.js");
 	applyConfigHeadersToResponse(headers, {
 		configHeaders: options.configHeaders,

package/dist/server/app-rsc-response-stage.js

@@ -71,9 +71,10 @@ function rematchAppWorkerResponseStageRoute(options, normalized, props) {
 async function renderAppWorkerResponseStage(options, rawRequest, ctx, props, stageOptions) {
 	if (props.protocolVersion !== 11 || props.buildId !== options.buildId) return new Response("Incompatible vinext App response stage", { status: 409 });
 	if (props.kind === "app-full-request") return new Response("Invalid vinext App response stage", { status: 400 });
+	const rawRequestSignal = rawRequest.signal;
 	options.registerCacheAdapters();
-	await options.ensureInstrumentation?.();
 	const executionContext = isExecutionContextLike(ctx) ? ctx : getRequestExecutionContext() ?? null;
+	await options.ensureInstrumentation?.(executionContext);
 	const filteredHeaders = executionContext?.isInternalPagesRevalidation ? new Headers(rawRequest.headers) : filterInternalHeaders(rawRequest.headers);
 	filteredHeaders.delete(VINEXT_REVALIDATE_HOST_HEADER);
 	const request = cloneRequestWithHeaders(rawRequest, filteredHeaders);
@@ -103,6 +104,7 @@ async function renderAppWorkerResponseStage(options, rawRequest, ctx, props, sta
 	const requestContext = createRequestContext({
 		headersContext,
 		executionContext,
+		requestSignal: executionContext?.requestSignal ?? rawRequestSignal,
 		unstableCacheRevalidation: "background"
 	});
 	const middlewareContext = {

package/dist/server/app-rsc-route-matching.d.ts

@@ -120,6 +120,7 @@ type AppRscInterceptLookupEntry = {
   slotId: string | null;
   targetRouteGraphId: string | null;
 };
+export declare function isAppRouteHandlerRoute(route: Pick<AppRscRouteForMatching, "__loadRouteHandler" | "routeHandler">): boolean;
 /**
  * @param decodedPathnamePatterns Static page patterns that answer their
  *   segment-decoded pathname (built by `buildAppDecodedPathnamePatterns`).

package/dist/server/app-rsc-route-matching.js

@@ -282,4 +282,4 @@ function pickPatternParams(params, patternParts) {
 	return picked;
 }
 //#endregion
-export { SIBLING_PAGE_INTERCEPT_SLOT_KEY, createAppRscRouteMatcher };
+export { SIBLING_PAGE_INTERCEPT_SLOT_KEY, createAppRscRouteMatcher, isAppRouteHandlerRoute };

package/dist/server/app-server-action-execution.d.ts

@@ -19,8 +19,10 @@ type AppServerActionErrorReporter = (error: unknown, request: {
   renderSource: "react-server-components-payload";
   revalidateReason: undefined;
 }) => void;
-type AppServerActionDecoder = (body: FormData) => Promise<unknown>;
-type AppServerActionFormStateDecoder = (actionResult: unknown, body: FormData) => Promise<ReactFormState | undefined>;
+/** React's `decodeAction()`; bound references resolve through `serverManifest`. */
+type AppServerActionDecoder = (body: FormData, serverManifest: object) => Promise<unknown>;
+/** React's `decodeFormState()`, which decodes the bound references again. */
+type AppServerActionFormStateDecoder = (actionResult: unknown, body: FormData, serverManifest: object) => Promise<ReactFormState | undefined>;
 type ReadFormDataWithLimit = (request: Request, maxBytes: number) => Promise<FormData>;
 type ReadBodyWithLimit = (request: Request, maxBytes: number) => Promise<string>;
 type AppServerActionReturnValue = {
@@ -136,19 +138,22 @@ export type HandleProgressiveServerActionRequestOptions = {
   cleanPathname: string;
   clearRequestContext: () => void;
   contentType: string;
+  /** plugin-rsc's server manifest, which resolves any export of a server-reference module. */
+  createServerManifest: () => object;
   decodeAction: AppServerActionDecoder;
   decodeFormState: AppServerActionFormStateDecoder;
   getAndClearPendingCookies: () => string[];
   getDraftModeCookieHeader: () => string | null | undefined;
   forwardAction?: (actionId: string) => Promise<Response | null>;
-  validateActionReferences?: (actionIds: readonly string[]) => boolean;
+  /** Whether these Server Actions belong to the current route. */
+  validateActionReferences: (actionIds: readonly string[]) => boolean;
   /**
    * Whether the posted-to route resolves to an App Router *page* (as opposed to
    * a route handler or no match). Multipart form POSTs to a page are always
    * server-action attempts in Next.js, so a body that decodes to no action must
    * surface as 404 action-not-found rather than rendering the page. Route
-   * handlers (which run *after* this dispatch in vinext) legitimately receive
-   * raw multipart POSTs, so they must still fall through. See issue #1340.
+   * handlers and Pages routes never reach this dispatch (#3886); unmatched
+   * routes fall through. See issue #1340.
    */
   hasPageRoute: boolean;
   maxActionBodySize: number;
@@ -176,7 +181,13 @@ export type HandleServerActionRscRequestOptions<TElement, TRoute extends AppServ
   createPayloadRouteId: (pathname: string, interceptionContext: string | null) => string;
   createRscOnErrorHandler: (request: Request, pathname: string, pattern: string, overrides?: AppRenderErrorContextOverrides) => (error: unknown) => unknown;
   createTemporaryReferenceSet: () => TTemporaryReferences;
-  decodeReply: (body: string | FormData, options: DecodeServerActionReplyOptions<TTemporaryReferences>) => Promise<unknown[]> | unknown[];
+  /** plugin-rsc's server manifest, which resolves any export of a server-reference module. */
+  createServerManifest: () => object;
+  /**
+   * React's `decodeReply()`. Every server reference in the arguments resolves
+   * through `serverManifest`, so the manifest bounds which functions can decode.
+   */
+  decodeReply: (body: string | FormData, serverManifest: object, options: DecodeServerActionReplyOptions<TTemporaryReferences>) => Promise<unknown[]> | unknown[];
   draftModeSecret: string;
   /**
    * Hydrate a route's lazy page/route-handler modules before reading
@@ -192,6 +203,12 @@ export type HandleServerActionRscRequestOptions<TElement, TRoute extends AppServ
   isEdgeRuntime?: boolean;
   isRscRequest: boolean;
   loadServerAction: (actionId: string) => Promise<unknown>;
+  /**
+   * Whether these Server Actions belong to the current route. Next.js resolves
+   * argument references through the current page's server module map, so an
+   * action owned by another route must not decode into a callable function.
+   */
+  validateActionReferences: (actionIds: readonly string[]) => boolean;
   /**
    * Match an action redirect target. Must use *request* route identity — the
    * raw, undecoded pathname — because the target is rendered as if the client

package/dist/server/app-server-action-execution.js

@@ -9,6 +9,8 @@ import { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS
 import { internalServerErrorResponse, payloadTooLargeResponse } from "./http-error-responses.js";
 import { attachRequestCfMetadata, validateCsrfOrigin, validateServerActionPayload } from "./request-pipeline.js";
 import { splitPathSegments } from "../routing/utils.js";
+import { getRequestExecutionContext } from "../shims/request-context.js";
+import { shareIsolatePromise } from "./isolate-shared-promise.js";
 import { APP_RSC_RENDER_MODE_NAVIGATION } from "./app-rsc-render-mode.js";
 import { isDraftModeRequest, setHeadersContext } from "../shims/headers.js";
 import { _drainPendingRevalidations, getAndClearActionRevalidationKind } from "../shims/cache-request-state.js";
@@ -43,50 +45,47 @@ import { markAppRscResponseConfigHeadersApplied } from "./app-rsc-response-final
 *
 * The result is awaited inside the callback because `decodeReply()` returns a
 * lazy thenable that only resolves (and imports) its references once awaited.
+*
+* The imports are shared with every later request that names the same modules,
+* and the server-reference loader cannot see this request's execution context
+* once it has been left, so the request is kept alive here until they settle.
+* From here a request that starts a load cannot be told apart from one that
+* joins it, so each keeps its own decode alive; it awaits that decode anyway.
 */
 function loadOutsideRequestScopes(load) {
-	return runOutsideRequestScopes(async () => await load());
+	const ctx = getRequestExecutionContext();
+	return shareIsolatePromise(runOutsideRequestScopes(async () => await load()), ctx);
 }
-function parseBoundProgressiveActionReference(body, referencePrefix) {
-	const fieldPrefix = `$ACTION_${referencePrefix}:`;
-	const chunks = /* @__PURE__ */ new Map();
-	for (const [key, value] of body) {
-		if (!key.startsWith(fieldPrefix) || typeof value !== "string") continue;
-		const chunkId = key.slice(fieldPrefix.length);
-		if (chunks.has(chunkId)) return null;
-		try {
-			chunks.set(chunkId, JSON.parse(value));
-		} catch {
-			return null;
-		}
-	}
-	const rootMetadata = chunks.get("0");
-	if (typeof rootMetadata !== "object" || rootMetadata === null || typeof Reflect.get(rootMetadata, "id") !== "string") return null;
-	const actionId = Reflect.get(rootMetadata, "id");
-	const referencedActionIds = /* @__PURE__ */ new Set([actionId]);
-	for (const chunk of chunks.values()) {
-		const values = [chunk];
-		while (values.length > 0) {
-			const value = values.pop();
-			if (typeof value === "string") {
-				if (!value.startsWith("$h")) continue;
-				const [encodedChunkId, ...path] = value.slice(2).split(":");
-				const chunkId = Number.parseInt(encodedChunkId, 16);
-				if (!Number.isSafeInteger(chunkId) || chunkId < 0) return null;
-				let metadata = chunks.get(String(chunkId));
-				for (const segment of path) {
-					if (typeof metadata !== "object" || metadata === null || !Object.hasOwn(metadata, segment)) return null;
-					metadata = Reflect.get(metadata, segment);
-				}
-				if (typeof metadata !== "object" || metadata === null || typeof Reflect.get(metadata, "id") !== "string") return null;
-				referencedActionIds.add(Reflect.get(metadata, "id"));
-			} else if (typeof value === "object" && value !== null) values.push(...Object.values(value));
-		}
+/**
+* Read the action a bound `$ACTION_REF_` submission names, which Next.js checks
+* before decoding (`areAllActionIdsValid()`). The bound arguments are left to
+* React, which resolves their references through the route-scoped manifest.
+*/
+function readBoundProgressiveActionId(body, referencePrefix) {
+	const descriptors = body.getAll(`$ACTION_${referencePrefix}:0`);
+	if (descriptors.length !== 1 || typeof descriptors[0] !== "string") return null;
+	let descriptor;
+	try {
+		descriptor = JSON.parse(descriptors[0]);
+	} catch {
+		return null;
 	}
-	return {
-		actionId,
-		referencedActionIds: [...referencedActionIds]
-	};
+	const actionId = typeof descriptor === "object" && descriptor !== null ? Reflect.get(descriptor, "id") : void 0;
+	return typeof actionId === "string" ? actionId : null;
+}
+/**
+* Scope the manifest React resolves server references through to the current
+* route's Server Actions, as Next.js scopes its server module map to the
+* current page. React then fails to resolve any other id wherever a payload
+* carries it, so that module never loads. A denied lookup throws because React
+* retries a missing `module#a#b` as module `module#a` with export `b`, which
+* would reach a non-action export of an owned module.
+*/
+function createRouteServerManifest(manifest, validateActionReferences) {
+	return new Proxy(manifest, { get(target, id, receiver) {
+		if (typeof id === "string" && !validateActionReferences([id])) throw new Error(`Server reference "${id}" is not a Server Action of this route.`);
+		return Reflect.get(target, id, receiver);
+	} });
 }
 function prepareActionPageRerenderContext(options) {
 	if (options.dynamicConfig === "force-static" || options.dynamicConfig === "error") {
@@ -572,32 +571,26 @@ async function handleProgressiveServerActionRequest(options) {
 		let actionKey = null;
 		for (const key of body.keys()) if (key.startsWith("$ACTION_ID_") || key.startsWith("$ACTION_REF_")) actionKey = key;
 		let directActionId = null;
-		let referencedActionIds = [];
 		let invalidDirectActionReference = false;
-		if (actionKey?.startsWith("$ACTION_ID_")) {
-			directActionId = actionKey.slice(11);
-			referencedActionIds = [directActionId];
-		} else if (actionKey?.startsWith("$ACTION_REF_")) {
-			const referencePrefix = actionKey.slice(12);
-			const reference = parseBoundProgressiveActionReference(body, referencePrefix);
-			if (reference) {
-				directActionId = reference.actionId;
-				referencedActionIds = reference.referencedActionIds;
-			} else invalidDirectActionReference = true;
+		if (actionKey?.startsWith("$ACTION_ID_")) directActionId = actionKey.slice(11);
+		else if (actionKey?.startsWith("$ACTION_REF_")) {
+			directActionId = readBoundProgressiveActionId(body, actionKey.slice(12));
+			invalidDirectActionReference = directActionId === null;
 		}
 		if (invalidDirectActionReference) return createActionNotFoundResponse(null, {
 			clearRequestContext: options.clearRequestContext,
 			getAndClearPendingCookies: options.getAndClearPendingCookies
 		});
-		if (directActionId && options.forwardAction) {
+		if (directActionId !== null && options.forwardAction) {
 			const forwardResponse = await options.forwardAction(directActionId);
 			if (forwardResponse) return forwardResponse;
 		}
-		if (options.validateActionReferences && !options.validateActionReferences(referencedActionIds)) return createActionNotFoundResponse(directActionId, {
+		if (directActionId !== null && !options.validateActionReferences([directActionId])) return createActionNotFoundResponse(directActionId, {
 			clearRequestContext: options.clearRequestContext,
 			getAndClearPendingCookies: options.getAndClearPendingCookies
 		});
-		const action = await loadOutsideRequestScopes(() => options.decodeAction(body));
+		const serverManifest = createRouteServerManifest(options.createServerManifest(), options.validateActionReferences);
+		const action = await loadOutsideRequestScopes(() => options.decodeAction(body, serverManifest));
 		if (!isAppServerActionFunction(action)) {
 			if (options.hasPageRoute) return createActionNotFoundResponse(null, {
 				clearRequestContext: options.clearRequestContext,
@@ -676,7 +669,7 @@ async function handleProgressiveServerActionRequest(options) {
 			};
 			return {
 				kind: "form-state",
-				formState: await loadOutsideRequestScopes(() => options.decodeFormState(actionResult, body)) ?? null,
+				formState: await loadOutsideRequestScopes(() => options.decodeFormState(actionResult, body, serverManifest)) ?? null,
 				pendingCookies: actionPendingCookies,
 				draftCookie: actionDraftCookie,
 				revalidationKind
@@ -821,8 +814,9 @@ async function handleServerActionRscRequest(options) {
 			});
 			action = loadedAction;
 		}
+		const serverManifest = createRouteServerManifest(options.createServerManifest(), options.validateActionReferences);
 		const temporaryReferences = options.createTemporaryReferenceSet();
-		const args = await loadOutsideRequestScopes(() => options.decodeReply(body, { temporaryReferences }));
+		const args = await loadOutsideRequestScopes(() => options.decodeReply(body, serverManifest, { temporaryReferences }));
 		let returnValue;
 		let actionRedirect = null;
 		let actionStatus = 200;

package/dist/server/app-ssr-entry.d.ts

@@ -25,6 +25,12 @@ export declare function handleSsr(rscStream: ReadableStream<Uint8Array>, navCont
     value: Promise<ArrayBuffer> | null;
   };
   pprFallbackShellSignal?: AbortSignal;
+  /**
+   * Pattern of the route this render shows, whose client references load
+   * before it starts, or null for a render without a route (a route-miss
+   * 404). Omitted, every client reference loads first.
+   */
+  preloadRoutePattern?: string | null;
   formState?: ReactFormState | null;
   basePath?: string;
   /**

package/dist/server/app-ssr-entry.js

@@ -15,14 +15,15 @@ import "./app-elements.js";
 import { ServerInsertedHTMLContext, clearServerInsertedHTML, getBfcacheIdMapContext, registerServerInsertedHTMLCallback, renderServerInsertedHTML, setNavigationContext } from "../shims/navigation-context-state.js";
 import "../shims/navigation-server.js";
 import DefaultGlobalError from "../shims/default-global-error.js";
-import { BfcacheIdentityMapContext, ElementsContext, Slot } from "../shims/slot.js";
+import { BfcacheIdentityMapContext } from "../shims/slot.js";
 import { getNextErrorDigest } from "./next-error-digest.js";
 import { createSsrErrorMetaRenderer } from "./app-ssr-error-meta.js";
 import { createRenderStreamCancellation, isAppRenderAbortError } from "./app-render-abort-error.js";
 import { RSC_FORM_STATE_GLOBAL } from "../client/browser-globals.js";
-import { createNavigationRuntimeRenderedSearchScript, createNavigationRuntimeRscMetadataScript, createRscEmbedTransform, createTickBufferedTransform, waitAtLeastOneReactRenderTask } from "./app-ssr-stream.js";
+import { createNavigationRuntimeRenderedSearchScript, createNavigationRuntimeRscCompatibilityScript, createNavigationRuntimeRscMetadataScript, createRscEmbedTransform, createTickBufferedTransform, waitAtLeastOneReactRenderTask } from "./app-ssr-stream.js";
 import { createInitialBfcacheMaps } from "./app-bfcache-identity.js";
-import { createClientReferencePreloader } from "./app-client-reference-preloader.js";
+import { createAppRouteTree } from "./app-route-tree.js";
+import { createClientReferencePreloader, resolveRouteClientReferences } from "./app-client-reference-preloader.js";
 import { createClientPageSsrSearchParamsSource } from "./app-page-search-params-observation.js";
 import { runWithRootParamsScope } from "../shims/root-params.js";
 import { runWithNavigationContext } from "../shims/navigation-state.js";
@@ -36,7 +37,7 @@ import { Fragment, createElement, use } from "react";
 import { renderToReadableStream, renderToStaticMarkup } from "react-dom/server.edge";
 import { preinitModule } from "react-dom";
 import { createFromReadableStream } from "@vitejs/plugin-rsc/ssr";
-import clientReferences from "virtual:vite-rsc/client-references";
+import clientReferences, { routeClientReferences } from "virtual:vite-rsc/client-references";
 import pagesClientAssets from "virtual:vinext-pages-client-assets";
 //#region src/server/app-ssr-entry.ts
 setPagesClientAssets(pagesClientAssets);
@@ -164,7 +165,11 @@ function buildHeadInjectionHtml(navContext, bootstrapModuleUrl, formState, inser
 		pathname: navContext.pathname,
 		searchParams: [...navContext.searchParams.entries()]
 	};
-	return createInlineScriptTag(createNavigationRuntimeRscMetadataScript(navContext.params, navPayload, dynamicStaleTimeSeconds, searchParamsFromBrowser), scriptNonce) + (formState === null ? "" : createInlineScriptTag("self[" + safeJsonStringify(RSC_FORM_STATE_GLOBAL) + "]=" + safeJsonStringify(formState), scriptNonce)) + buildModulePreloadHtml(bootstrapModuleUrl, scriptNonce) + insertedHTML + fontHTML;
+	const rscMetadataScript = createInlineScriptTag(createNavigationRuntimeRscMetadataScript(navContext.params, navPayload, dynamicStaleTimeSeconds, searchParamsFromBrowser), scriptNonce);
+	const compatibilityScript = createNavigationRuntimeRscCompatibilityScript();
+	const rscCompatibilityScript = compatibilityScript === "" ? "" : createInlineScriptTag(compatibilityScript, scriptNonce);
+	const formStateScript = formState === null ? "" : createInlineScriptTag("self[" + safeJsonStringify(RSC_FORM_STATE_GLOBAL) + "]=" + safeJsonStringify(formState), scriptNonce);
+	return rscMetadataScript + rscCompatibilityScript + formStateScript + buildModulePreloadHtml(bootstrapModuleUrl, scriptNonce) + insertedHTML + fontHTML;
 }
 function requireNavigationContext(navContext) {
 	if (!navContext) throw new Error("App SSR requires navigation context for BFCache state keys");
@@ -189,7 +194,7 @@ async function handleSsr(rscStream, navContext, fontData, options) {
 				isPprFallbackShell: options?.pprFallbackShellSignal !== void 0
 			})
 		};
-		await clientReferencePreloader.preload();
+		await clientReferencePreloader.preload(options?.pprFallbackShellSignal ? void 0 : resolveRouteClientReferences(routeClientReferences, options?.preloadRoutePattern));
 		setNavigationContext(ssrNavigationContext);
 		clearServerInsertedHTML();
 		const cleanup = () => {
@@ -235,7 +240,11 @@ async function handleSsr(rscStream, navContext, fontData, options) {
 						elements,
 						metadata
 					});
-					const routeTree = createElement(ElementsContext.Provider, { value: elements }, createElement(Slot, { id: metadata.routeId }));
+					const routeTree = createAppRouteTree({
+						elements,
+						historyCommit: null,
+						routeId: metadata.routeId
+					});
 					const identityMapTree = createElement(BfcacheIdentityMapContext.Provider, { value: bfcacheMaps.identities }, routeTree);
 					return BfcacheIdMapContext ? createElement(BfcacheIdMapContext.Provider, { value: bfcacheMaps.bfcacheIds }, identityMapTree) : identityMapTree;
 				}

package/dist/server/app-ssr-stream.d.ts

@@ -32,6 +32,13 @@ export declare function createNavigationRuntimeRscMetadataScript(params: Record<
   pathname: string;
   searchParams: [string, string][];
 }, dynamicStaleTimeSeconds?: number, searchParamsFromBrowser?: boolean): string;
+/**
+ * The compatibility ID of the server rendering this page. The browser compares
+ * RSC responses against it, so it is sent with the page rather than inlined
+ * into the client bundle, where a per-build value would rename chunks on every
+ * build. Static export skips the check, so its pages omit it.
+ */
+export declare function createNavigationRuntimeRscCompatibilityScript(): string;
 /**
  * The query a client page read during SSR, for a render that turned dynamic
  * after its head told the browser to read the query from its own URL.

package/dist/server/app-ssr-stream.js

@@ -1,4 +1,5 @@
 import { createInlineScriptTag, escapeHtmlAttr, htmlTokenListContains, safeJsonStringify } from "./html.js";
+import { getVinextRscCompatibilityId } from "./app-rsc-cache-busting.js";
 import { bytesToBase64, concatUint8Arrays } from "./app-rsc-embedded-chunks.js";
 import { NAVIGATION_RUNTIME_SYMBOL_DESCRIPTION } from "../client/browser-globals.js";
 //#region src/server/app-ssr-stream.ts
@@ -14,6 +15,17 @@ function createNavigationRuntimeRscMetadataScript(params, nav, dynamicStaleTimeS
 	return "Object.assign(" + navigationRuntimeRscBootstrapExpression() + ",{params:" + safeJsonStringify(params) + ",nav:" + safeJsonStringify(nav) + (searchParamsFromBrowser === void 0 ? "" : ",searchParamsFromBrowser:" + safeJsonStringify(searchParamsFromBrowser)) + (dynamicStaleTimeSeconds === void 0 ? "" : ",dynamicStaleTimeSeconds:" + safeJsonStringify(dynamicStaleTimeSeconds)) + "})";
 }
 /**
+* The compatibility ID of the server rendering this page. The browser compares
+* RSC responses against it, so it is sent with the page rather than inlined
+* into the client bundle, where a per-build value would rename chunks on every
+* build. Static export skips the check, so its pages omit it.
+*/
+function createNavigationRuntimeRscCompatibilityScript() {
+	const compatibilityId = getVinextRscCompatibilityId();
+	if (compatibilityId === null || process.env.NODE_ENV === "production" && process.env.__NEXT_CONFIG_OUTPUT === "export") return "";
+	return "Object.assign(" + navigationRuntimeRscBootstrapExpression() + ",{compatibilityId:" + safeJsonStringify(compatibilityId) + "})";
+}
+/**
 * The query a client page read during SSR, for a render that turned dynamic
 * after its head told the browser to read the query from its own URL.
 */
@@ -474,4 +486,4 @@ function createTickBufferedTransform(rscEmbed, injectHTML = "", injectAfterHeadO
 	});
 }
 //#endregion
-export { createNavigationRuntimeRenderedSearchScript, createNavigationRuntimeRscMetadataScript, createRscEmbedTransform, createTickBufferedTransform, fixPreloadAs, navigationRuntimeRscBootstrapExpression, waitAtLeastOneReactRenderTask };
+export { createNavigationRuntimeRenderedSearchScript, createNavigationRuntimeRscCompatibilityScript, createNavigationRuntimeRscMetadataScript, createRscEmbedTransform, createTickBufferedTransform, fixPreloadAs, navigationRuntimeRscBootstrapExpression, waitAtLeastOneReactRenderTask };

package/dist/server/config-headers.js

@@ -76,10 +76,12 @@ function appendVaryHeaderRecord(headers, value) {
 function applyConfigHeadersToResponse(responseHeaders, options) {
 	const matched = retainLastSingularConfigValues(matchHeaders(options.pathname, options.configHeaders, options.requestContext, options.basePathState, options.recordCacheability === false ? void 0 : markConditionalConfigHeaderCacheability));
 	if (options.recordCacheability !== false) markExplicitConfigResponseVeto(matched);
+	const configCookies = [];
 	for (const header of matched) {
 		const lowerName = header.key.toLowerCase();
 		if (lowerName === "x-vinext-special-error-status") continue;
-		if (lowerName === "link") {
+		if (lowerName === "set-cookie") configCookies.push(header.value);
+		else if (lowerName === "link") {
 			if (options.middlewareHeaders?.get(lowerName)) continue;
 			const postConfigLink = options.appendToPostConfigLink ? responseHeaders.get(lowerName) : null;
 			responseHeaders.set(header.key, postConfigLink ? `${header.value}, ${postConfigLink}` : header.value);
@@ -88,15 +90,22 @@ function applyConfigHeadersToResponse(responseHeaders, options) {
 		else if (ADDITIVE_CONFIG_HEADER_NAMES.has(lowerName)) responseHeaders.append(header.key, header.value);
 		else if ((typeof options.overwriteExisting === "function" ? options.overwriteExisting(lowerName) : options.overwriteExisting?.has(lowerName)) || !responseHeaders.has(lowerName)) responseHeaders.set(header.key, header.value);
 	}
+	if (configCookies.length > 0 && !options.middlewareHeaders?.get("set-cookie")) {
+		const responseCookies = responseHeaders.getSetCookie();
+		responseHeaders.delete("set-cookie");
+		for (const cookie of [...configCookies, ...responseCookies]) responseHeaders.append("set-cookie", cookie);
+	}
 }
 /** Apply matched next.config.js headers to an early response header record. */
 function applyConfigHeadersToHeaderRecord(headers, options) {
 	const matched = retainLastSingularConfigValues(matchHeaders(options.pathname, options.configHeaders, options.requestContext, options.basePathState, options.recordCacheability === false ? void 0 : markConditionalConfigHeaderCacheability));
 	if (options.recordCacheability !== false) markExplicitConfigResponseVeto(matched);
+	const middlewareSetsCookie = Boolean(options.middlewareHeaders?.get("set-cookie")) || findHeaderRecordKey(headers, "set-cookie") !== void 0;
 	for (const header of matched) {
 		const lowerName = header.key.toLowerCase();
-		if (lowerName === "set-cookie") appendHeaderRecord(headers, lowerName, header.value);
-		else if (lowerName === "vary") appendVaryHeaderRecord(headers, header.value);
+		if (lowerName === "set-cookie") {
+			if (!middlewareSetsCookie) appendHeaderRecord(headers, lowerName, header.value);
+		} else if (lowerName === "vary") appendVaryHeaderRecord(headers, header.value);
 		else if (findHeaderRecordKey(headers, lowerName) === void 0) headers[lowerName] = header.value;
 	}
 }

package/dist/server/isolate-shared-promise.d.ts

@@ -0,0 +1,10 @@
+import { ExecutionContextLike } from "../shims/request-context.js";
+//#region src/server/isolate-shared-promise.d.ts
+/**
+ * Register `promise` with the creating request's `waitUntil()` and return it.
+ *
+ * @param ctx - The creating request's execution context. Defaults to the one
+ *   in scope, for callers inside `runWithExecutionContext()`.
+ */
+export declare function shareIsolatePromise<T>(promise: Promise<T>, ctx?: Partial<Pick<ExecutionContextLike, "waitUntil">> | null): Promise<T>;
+//#endregion

package/dist/server/isolate-shared-promise.js

@@ -0,0 +1,33 @@
+import { getRequestExecutionContext } from "../shims/request-context.js";
+//#region src/server/isolate-shared-promise.ts
+/**
+* Keep the request that creates an isolate-shared promise alive until it
+* settles.
+*
+* workerd binds the I/O a promise waits on (timers, fetches, dynamic
+* `import()` under the legacy module registry) to the request that started it.
+* If that request is canceled first, for example because the client navigated
+* away or aborted a prefetch, the continuations are dropped and the promise
+* never settles. A promise memoized for the isolate is awaited by every later
+* request too, so they would all wait forever. `waitUntil()` keeps the creating
+* request's context running after cancellation, so the work finishes for
+* everyone.
+*
+* Call this only where the shared promise is created. Later requests that
+* merely await it need nothing.
+*/
+function ignore() {}
+/**
+* Register `promise` with the creating request's `waitUntil()` and return it.
+*
+* @param ctx - The creating request's execution context. Defaults to the one
+*   in scope, for callers inside `runWithExecutionContext()`.
+*/
+function shareIsolatePromise(promise, ctx) {
+	(typeof ctx?.waitUntil === "function" ? ctx : getRequestExecutionContext())?.waitUntil?.(promise.then(ignore, ignore));
+	return promise;
+}
+const SHARE_ISOLATE_PROMISE_KEY = Symbol.for("vinext.shareIsolatePromise");
+globalThis[SHARE_ISOLATE_PROMISE_KEY] ??= shareIsolatePromise;
+//#endregion
+export { shareIsolatePromise };

package/dist/server/isr-cache.js

@@ -4,6 +4,7 @@ import { getRequestExecutionContext } from "../shims/request-context.js";
 import { isInterceptionMatchedUrlPath } from "./normalize-path.js";
 import { reportRequestError } from "./instrumentation.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
+import { shareIsolatePromise } from "./isolate-shared-promise.js";
 import { normalizeMountedSlotsHeader } from "./app-mounted-slots-header.js";
 import { APP_RSC_RENDER_MODE_NAVIGATION, getRscRenderModeCacheVariant } from "./app-rsc-render-mode.js";
 import { getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret } from "./revalidation-request.js";
@@ -93,9 +94,9 @@ const pendingOnDemandRegenerations = _g[_PENDING_ON_DEMAND_REGEN_KEY] ??= /* @__
 function coalesceOnDemandRevalidation(key, renderFn) {
 	const pending = pendingOnDemandRegenerations.get(key);
 	if (pending) return pending;
-	const promise = Promise.resolve().then(renderFn).finally(() => {
+	const promise = shareIsolatePromise(Promise.resolve().then(renderFn).finally(() => {
 		if (pendingOnDemandRegenerations.get(key) === promise) pendingOnDemandRegenerations.delete(key);
-	});
+	}));
 	pendingOnDemandRegenerations.set(key, promise);
 	return promise;
 }

package/dist/server/middleware-matcher-pattern.d.ts

@@ -6,7 +6,6 @@ export type CompiledMiddlewareMatcherPattern = {
 } | {
   regexp?: never;
   error: string;
-  kind: "invalid" | "unsafe";
 };
 export type MiddlewareMatcherObject = {
   source: string;