vinext 1.2.1 → 1.3.1

package/dist/server/app-rsc-route-matching.d.ts

@@ -35,13 +35,25 @@ type AppRscInterceptForMatching = {
   interceptLoadings?: readonly unknown[];
   interceptLoadingTreePositions?: readonly number[];
   interceptNotFoundBranchSegments?: readonly string[];
+  interceptNotFounds?: readonly unknown[];
+  interceptNotFoundTreePositions?: readonly number[];
   __loadInterceptLayouts?: readonly (() => Promise<unknown>)[] | null;
   __loadInterceptLoadings?: readonly (() => Promise<unknown>)[] | null;
+  __loadInterceptNotFounds?: readonly (() => Promise<unknown>)[] | null;
   page: unknown;
   __pageLoader?: (() => Promise<unknown>) | null;
   notFound?: unknown;
   __loadNotFound?: (() => Promise<unknown>) | null;
   notFoundTreePosition?: number | null;
+  interceptForbiddens?: readonly unknown[];
+  interceptForbiddenTreePositions?: readonly number[];
+  __loadInterceptForbiddens?: readonly (() => Promise<unknown>)[] | null;
+  interceptUnauthorizeds?: readonly unknown[];
+  interceptUnauthorizedTreePositions?: readonly number[];
+  __loadInterceptUnauthorizeds?: readonly (() => Promise<unknown>)[] | null;
+  interceptErrors?: readonly unknown[];
+  interceptErrorTreePositions?: readonly number[];
+  __loadInterceptErrors?: readonly (() => Promise<unknown>)[] | null;
   params: readonly string[];
 };
 type AppRscSlotForMatching = {
@@ -60,13 +72,25 @@ type AppRscSiblingInterceptForMatching = {
   interceptLoadings?: readonly unknown[];
   interceptLoadingTreePositions?: readonly number[];
   interceptNotFoundBranchSegments?: readonly string[];
+  interceptNotFounds?: readonly unknown[];
+  interceptNotFoundTreePositions?: readonly number[];
   __loadInterceptLayouts?: readonly (() => Promise<unknown>)[] | null;
   __loadInterceptLoadings?: readonly (() => Promise<unknown>)[] | null;
+  __loadInterceptNotFounds?: readonly (() => Promise<unknown>)[] | null;
   page: unknown;
   __pageLoader?: (() => Promise<unknown>) | null;
   notFound?: unknown;
   __loadNotFound?: (() => Promise<unknown>) | null;
   notFoundTreePosition?: number | null;
+  interceptForbiddens?: readonly unknown[];
+  interceptForbiddenTreePositions?: readonly number[];
+  __loadInterceptForbiddens?: readonly (() => Promise<unknown>)[] | null;
+  interceptUnauthorizeds?: readonly unknown[];
+  interceptUnauthorizedTreePositions?: readonly number[];
+  __loadInterceptUnauthorizeds?: readonly (() => Promise<unknown>)[] | null;
+  interceptErrors?: readonly unknown[];
+  interceptErrorTreePositions?: readonly number[];
+  __loadInterceptErrors?: readonly (() => Promise<unknown>)[] | null;
   params: readonly string[];
 };
 type AppRscRouteForMatching = {
@@ -108,18 +132,31 @@ type AppRscInterceptLookupEntry = {
   interceptLoadings?: readonly unknown[];
   interceptLoadingTreePositions?: readonly number[];
   interceptNotFoundBranchSegments?: readonly string[];
+  interceptNotFounds?: readonly unknown[];
+  interceptNotFoundTreePositions?: readonly number[];
   __loadInterceptLayouts?: readonly (() => Promise<unknown>)[] | null;
   __loadInterceptLoadings?: readonly (() => Promise<unknown>)[] | null;
+  __loadInterceptNotFounds?: readonly (() => Promise<unknown>)[] | null;
   page: unknown;
   __pageLoader?: (() => Promise<unknown>) | null;
   notFound: unknown;
   __loadNotFound?: (() => Promise<unknown>) | null;
   notFoundTreePosition?: number | null;
+  interceptForbiddens?: readonly unknown[];
+  interceptForbiddenTreePositions?: readonly number[];
+  __loadInterceptForbiddens?: readonly (() => Promise<unknown>)[] | null;
+  interceptUnauthorizeds?: readonly unknown[];
+  interceptUnauthorizedTreePositions?: readonly number[];
+  __loadInterceptUnauthorizeds?: readonly (() => Promise<unknown>)[] | null;
+  interceptErrors?: readonly unknown[];
+  interceptErrorTreePositions?: readonly number[];
+  __loadInterceptErrors?: readonly (() => Promise<unknown>)[] | null;
   __loadState: AppRscInterceptLoadState;
   params: readonly string[];
   slotId: string | null;
   targetRouteGraphId: string | null;
 };
+export declare function isAppRouteHandlerRoute(route: Pick<AppRscRouteForMatching, "__loadRouteHandler" | "routeHandler">): boolean;
 /**
  * @param decodedPathnamePatterns Static page patterns that answer their
  *   segment-decoded pathname (built by `buildAppDecodedPathnamePatterns`).
@@ -140,4 +177,5 @@ export declare function createAppRscRouteMatcher<Route extends AppRscRouteForMat
   } | null;
   findIntercept(pathname: string, sourcePathname?: string | null, interceptionId?: string | null): AppRscInterceptMatch | null;
 };
-//#endregion
+//#endregion
+export {};

package/dist/server/app-rsc-route-matching.js

@@ -209,6 +209,9 @@ function createInterceptLookup(routes) {
 					interceptLoadings: intercept.interceptLoadings,
 					interceptLoadingTreePositions: intercept.interceptLoadingTreePositions,
 					interceptNotFoundBranchSegments: intercept.interceptNotFoundBranchSegments,
+					interceptNotFounds: intercept.interceptNotFounds,
+					interceptNotFoundTreePositions: intercept.interceptNotFoundTreePositions,
+					__loadInterceptNotFounds: intercept.__loadInterceptNotFounds,
 					__loadInterceptLayouts: intercept.__loadInterceptLayouts,
 					__loadInterceptLoadings: intercept.__loadInterceptLoadings,
 					page: intercept.page,
@@ -216,6 +219,15 @@ function createInterceptLookup(routes) {
 					notFound: intercept.notFound,
 					__loadNotFound: intercept.__loadNotFound,
 					notFoundTreePosition: intercept.notFoundTreePosition,
+					interceptForbiddens: intercept.interceptForbiddens,
+					interceptForbiddenTreePositions: intercept.interceptForbiddenTreePositions,
+					__loadInterceptForbiddens: intercept.__loadInterceptForbiddens,
+					interceptUnauthorizeds: intercept.interceptUnauthorizeds,
+					interceptUnauthorizedTreePositions: intercept.interceptUnauthorizedTreePositions,
+					__loadInterceptUnauthorizeds: intercept.__loadInterceptUnauthorizeds,
+					interceptErrors: intercept.interceptErrors,
+					interceptErrorTreePositions: intercept.interceptErrorTreePositions,
+					__loadInterceptErrors: intercept.__loadInterceptErrors,
 					__loadState: {
 						page: intercept.page,
 						pageLoading: null,
@@ -248,6 +260,9 @@ function createInterceptLookup(routes) {
 				interceptLoadings: intercept.interceptLoadings,
 				interceptLoadingTreePositions: intercept.interceptLoadingTreePositions,
 				interceptNotFoundBranchSegments: intercept.interceptNotFoundBranchSegments,
+				interceptNotFounds: intercept.interceptNotFounds,
+				interceptNotFoundTreePositions: intercept.interceptNotFoundTreePositions,
+				__loadInterceptNotFounds: intercept.__loadInterceptNotFounds,
 				__loadInterceptLayouts: intercept.__loadInterceptLayouts,
 				__loadInterceptLoadings: intercept.__loadInterceptLoadings,
 				page: intercept.page,
@@ -255,6 +270,15 @@ function createInterceptLookup(routes) {
 				notFound: intercept.notFound,
 				__loadNotFound: intercept.__loadNotFound,
 				notFoundTreePosition: intercept.notFoundTreePosition,
+				interceptForbiddens: intercept.interceptForbiddens,
+				interceptForbiddenTreePositions: intercept.interceptForbiddenTreePositions,
+				__loadInterceptForbiddens: intercept.__loadInterceptForbiddens,
+				interceptUnauthorizeds: intercept.interceptUnauthorizeds,
+				interceptUnauthorizedTreePositions: intercept.interceptUnauthorizedTreePositions,
+				__loadInterceptUnauthorizeds: intercept.__loadInterceptUnauthorizeds,
+				interceptErrors: intercept.interceptErrors,
+				interceptErrorTreePositions: intercept.interceptErrorTreePositions,
+				__loadInterceptErrors: intercept.__loadInterceptErrors,
 				__loadState: {
 					page: intercept.page,
 					pageLoading: null,
@@ -282,4 +306,4 @@ function pickPatternParams(params, patternParts) {
 	return picked;
 }
 //#endregion
-export { SIBLING_PAGE_INTERCEPT_SLOT_KEY, createAppRscRouteMatcher };
+export { SIBLING_PAGE_INTERCEPT_SLOT_KEY, createAppRscRouteMatcher, isAppRouteHandlerRoute };

package/dist/server/app-segment-config.d.ts

@@ -169,4 +169,5 @@ export declare function isAppPageStaticEligible(options: {
   isStaticGenerationEdgeRuntime: boolean;
   revalidateSeconds: number | null;
 }): boolean;
-//#endregion
+//#endregion
+export {};

package/dist/server/app-segment-config.js

@@ -1,3 +1,4 @@
+import { compareFolderNames } from "../utils/compare.js";
 import { isEdgeApiRuntime } from "./edge-api-runtime.js";
 //#region src/server/app-segment-config.ts
 const DYNAMIC_VALUES = /* @__PURE__ */ new Set([
@@ -310,20 +311,6 @@ function hasGenerateStaticParamsExport(segment) {
 }
 const DEFAULT_SEGMENT_NAME = "__DEFAULT__";
 /**
-* Turbopack reads a folder's subfolders from a `BTreeMap<RcStr, _>`, whose
-* keys compare as Rust `str`s: by UTF-8 bytes. That is Unicode code point
-* order, which JavaScript's `<` (UTF-16 code units) doesn't match above the
-* Basic Multilingual Plane.
-* https://github.com/vercel/next.js/blob/v16.2.7/crates/next-core/src/app_structure.rs#L188-L192
-* https://github.com/vercel/next.js/blob/v16.2.7/turbopack/crates/turbo-rcstr/src/lib.rs#L350-L354
-*/
-function compareFolderNames(a, b) {
-	const left = Array.from(a, (char) => char.codePointAt(0) ?? 0);
-	const right = Array.from(b, (char) => char.codePointAt(0) ?? 0);
-	for (let index = 0; index < Math.min(left.length, right.length); index++) if (left[index] !== right[index]) return left[index] - right[index];
-	return left.length - right.length;
-}
-/**
 * Collect the loader-tree segments of an App page route from its layout, page
 * and parallel-slot modules, for `lastDynamicSegmentHasGenerateStaticParams`.
 *

package/dist/server/app-server-action-execution.d.ts

@@ -19,8 +19,10 @@ type AppServerActionErrorReporter = (error: unknown, request: {
   renderSource: "react-server-components-payload";
   revalidateReason: undefined;
 }) => void;
-type AppServerActionDecoder = (body: FormData) => Promise<unknown>;
-type AppServerActionFormStateDecoder = (actionResult: unknown, body: FormData) => Promise<ReactFormState | undefined>;
+/** React's `decodeAction()`; bound references resolve through `serverManifest`. */
+type AppServerActionDecoder = (body: FormData, serverManifest: object) => Promise<unknown>;
+/** React's `decodeFormState()`, which decodes the bound references again. */
+type AppServerActionFormStateDecoder = (actionResult: unknown, body: FormData, serverManifest: object) => Promise<ReactFormState | undefined>;
 type ReadFormDataWithLimit = (request: Request, maxBytes: number) => Promise<FormData>;
 type ReadBodyWithLimit = (request: Request, maxBytes: number) => Promise<string>;
 type AppServerActionReturnValue = {
@@ -136,19 +138,22 @@ export type HandleProgressiveServerActionRequestOptions = {
   cleanPathname: string;
   clearRequestContext: () => void;
   contentType: string;
+  /** plugin-rsc's server manifest, which resolves any export of a server-reference module. */
+  createServerManifest: () => object;
   decodeAction: AppServerActionDecoder;
   decodeFormState: AppServerActionFormStateDecoder;
   getAndClearPendingCookies: () => string[];
   getDraftModeCookieHeader: () => string | null | undefined;
   forwardAction?: (actionId: string) => Promise<Response | null>;
-  validateActionReferences?: (actionIds: readonly string[]) => boolean;
+  /** Whether these Server Actions belong to the current route. */
+  validateActionReferences: (actionIds: readonly string[]) => boolean;
   /**
    * Whether the posted-to route resolves to an App Router *page* (as opposed to
    * a route handler or no match). Multipart form POSTs to a page are always
    * server-action attempts in Next.js, so a body that decodes to no action must
    * surface as 404 action-not-found rather than rendering the page. Route
-   * handlers (which run *after* this dispatch in vinext) legitimately receive
-   * raw multipart POSTs, so they must still fall through. See issue #1340.
+   * handlers and Pages routes never reach this dispatch (#3886); unmatched
+   * routes fall through. See issue #1340.
    */
   hasPageRoute: boolean;
   maxActionBodySize: number;
@@ -176,7 +181,13 @@ export type HandleServerActionRscRequestOptions<TElement, TRoute extends AppServ
   createPayloadRouteId: (pathname: string, interceptionContext: string | null) => string;
   createRscOnErrorHandler: (request: Request, pathname: string, pattern: string, overrides?: AppRenderErrorContextOverrides) => (error: unknown) => unknown;
   createTemporaryReferenceSet: () => TTemporaryReferences;
-  decodeReply: (body: string | FormData, options: DecodeServerActionReplyOptions<TTemporaryReferences>) => Promise<unknown[]> | unknown[];
+  /** plugin-rsc's server manifest, which resolves any export of a server-reference module. */
+  createServerManifest: () => object;
+  /**
+   * React's `decodeReply()`. Every server reference in the arguments resolves
+   * through `serverManifest`, so the manifest bounds which functions can decode.
+   */
+  decodeReply: (body: string | FormData, serverManifest: object, options: DecodeServerActionReplyOptions<TTemporaryReferences>) => Promise<unknown[]> | unknown[];
   draftModeSecret: string;
   /**
    * Hydrate a route's lazy page/route-handler modules before reading
@@ -192,6 +203,12 @@ export type HandleServerActionRscRequestOptions<TElement, TRoute extends AppServ
   isEdgeRuntime?: boolean;
   isRscRequest: boolean;
   loadServerAction: (actionId: string) => Promise<unknown>;
+  /**
+   * Whether these Server Actions belong to the current route. Next.js resolves
+   * argument references through the current page's server module map, so an
+   * action owned by another route must not decode into a callable function.
+   */
+  validateActionReferences: (actionIds: readonly string[]) => boolean;
   /**
    * Match an action redirect target. Must use *request* route identity — the
    * raw, undecoded pathname — because the target is rendered as if the client
@@ -265,4 +282,5 @@ export declare function applyActionRedirectBasePath(url: string, basePath: strin
 export declare function isProgressiveServerActionRequest(request: Pick<Request, "method">, contentType: string, actionId: string | null): boolean;
 export declare function handleProgressiveServerActionRequest(options: HandleProgressiveServerActionRequestOptions): Promise<Response | ProgressiveServerActionResult | null>;
 export declare function handleServerActionRscRequest<TElement, TRoute extends AppServerActionRoute, TInterceptOpts, TTemporaryReferences, TPage = unknown>(options: HandleServerActionRscRequestOptions<TElement, TRoute, TInterceptOpts, TTemporaryReferences, TPage>): Promise<Response | null>;
-//#endregion
+//#endregion
+export {};

package/dist/server/app-server-action-execution.js

@@ -1,4 +1,5 @@
 import { runOutsideRequestScopes } from "../shims/internal/als-registry.js";
+import { deferUntilStreamConsumed } from "./defer-until-stream-consumed.js";
 import { VINEXT_MW_CTX_HEADER } from "../utils/protocol-headers.js";
 import { buildRequestHeadersFromMiddlewareResponse } from "../utils/middleware-request-headers.js";
 import { parseEdgeRequestCookieHeader } from "../utils/parse-cookie.js";
@@ -9,22 +10,23 @@ import { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS
 import { internalServerErrorResponse, payloadTooLargeResponse } from "./http-error-responses.js";
 import { attachRequestCfMetadata, validateCsrfOrigin, validateServerActionPayload } from "./request-pipeline.js";
 import { splitPathSegments } from "../routing/utils.js";
+import { getRequestExecutionContext } from "../shims/request-context.js";
+import { shareIsolatePromise } from "./isolate-shared-promise.js";
 import { APP_RSC_RENDER_MODE_NAVIGATION } from "./app-rsc-render-mode.js";
 import { isDraftModeRequest, setHeadersContext } from "../shims/headers.js";
 import { _drainPendingRevalidations, getAndClearActionRevalidationKind } from "../shims/cache-request-state.js";
 import { setCurrentFetchCacheMode, setCurrentFetchRevalidate, setCurrentFetchSoftTags, setCurrentForceDynamicFetchDefault } from "../shims/fetch-cache.js";
 import { readStreamAsTextWithLimit } from "../utils/text-stream.js";
-import { deferUntilStreamConsumed } from "./defer-until-stream-consumed.js";
 import { VINEXT_RSC_CONTENT_TYPE, applyRscCompatibilityIdHeader, createRscRequestUrl, stripRscCacheBustingSearchParam } from "./app-rsc-cache-busting.js";
 import { mergeMiddlewareResponseHeaders } from "./middleware-response-headers.js";
 import { applyEdgeRuntimeHeader } from "./app-page-response.js";
 import { getNextErrorDigest, parseNextHttpErrorDigest, parseNextRedirectDigest } from "./next-error-digest.js";
 import { hasDigest } from "./app-rsc-errors.js";
-import { buildAppPageTags } from "./implicit-tags.js";
-import "./app-page-stream.js";
 import { getSetCookieName } from "./cookie-utils.js";
 import { createServerActionNotFoundResponse, getServerActionNotFoundMessage, isServerActionNotFoundError } from "./server-action-not-found.js";
 import { resolveAppPageNavigationParams } from "./app-page-element-builder.js";
+import "./app-page-stream.js";
+import { buildAppPageTags } from "./implicit-tags.js";
 import { resolveAppPageActionRerenderTarget } from "./app-page-request.js";
 import { createRootParamsUsageController, runWithRootParamsUsage } from "../shims/root-params.js";
 import { createStaticGenerationHeadersContext } from "./app-static-generation.js";
@@ -43,50 +45,47 @@ import { markAppRscResponseConfigHeadersApplied } from "./app-rsc-response-final
 *
 * The result is awaited inside the callback because `decodeReply()` returns a
 * lazy thenable that only resolves (and imports) its references once awaited.
+*
+* The imports are shared with every later request that names the same modules,
+* and the server-reference loader cannot see this request's execution context
+* once it has been left, so the request is kept alive here until they settle.
+* From here a request that starts a load cannot be told apart from one that
+* joins it, so each keeps its own decode alive; it awaits that decode anyway.
 */
 function loadOutsideRequestScopes(load) {
-	return runOutsideRequestScopes(async () => await load());
+	const ctx = getRequestExecutionContext();
+	return shareIsolatePromise(runOutsideRequestScopes(async () => await load()), ctx);
 }
-function parseBoundProgressiveActionReference(body, referencePrefix) {
-	const fieldPrefix = `$ACTION_${referencePrefix}:`;
-	const chunks = /* @__PURE__ */ new Map();
-	for (const [key, value] of body) {
-		if (!key.startsWith(fieldPrefix) || typeof value !== "string") continue;
-		const chunkId = key.slice(fieldPrefix.length);
-		if (chunks.has(chunkId)) return null;
-		try {
-			chunks.set(chunkId, JSON.parse(value));
-		} catch {
-			return null;
-		}
-	}
-	const rootMetadata = chunks.get("0");
-	if (typeof rootMetadata !== "object" || rootMetadata === null || typeof Reflect.get(rootMetadata, "id") !== "string") return null;
-	const actionId = Reflect.get(rootMetadata, "id");
-	const referencedActionIds = /* @__PURE__ */ new Set([actionId]);
-	for (const chunk of chunks.values()) {
-		const values = [chunk];
-		while (values.length > 0) {
-			const value = values.pop();
-			if (typeof value === "string") {
-				if (!value.startsWith("$h")) continue;
-				const [encodedChunkId, ...path] = value.slice(2).split(":");
-				const chunkId = Number.parseInt(encodedChunkId, 16);
-				if (!Number.isSafeInteger(chunkId) || chunkId < 0) return null;
-				let metadata = chunks.get(String(chunkId));
-				for (const segment of path) {
-					if (typeof metadata !== "object" || metadata === null || !Object.hasOwn(metadata, segment)) return null;
-					metadata = Reflect.get(metadata, segment);
-				}
-				if (typeof metadata !== "object" || metadata === null || typeof Reflect.get(metadata, "id") !== "string") return null;
-				referencedActionIds.add(Reflect.get(metadata, "id"));
-			} else if (typeof value === "object" && value !== null) values.push(...Object.values(value));
-		}
+/**
+* Read the action a bound `$ACTION_REF_` submission names, which Next.js checks
+* before decoding (`areAllActionIdsValid()`). The bound arguments are left to
+* React, which resolves their references through the route-scoped manifest.
+*/
+function readBoundProgressiveActionId(body, referencePrefix) {
+	const descriptors = body.getAll(`$ACTION_${referencePrefix}:0`);
+	if (descriptors.length !== 1 || typeof descriptors[0] !== "string") return null;
+	let descriptor;
+	try {
+		descriptor = JSON.parse(descriptors[0]);
+	} catch {
+		return null;
 	}
-	return {
-		actionId,
-		referencedActionIds: [...referencedActionIds]
-	};
+	const actionId = typeof descriptor === "object" && descriptor !== null ? Reflect.get(descriptor, "id") : void 0;
+	return typeof actionId === "string" ? actionId : null;
+}
+/**
+* Scope the manifest React resolves server references through to the current
+* route's Server Actions, as Next.js scopes its server module map to the
+* current page. React then fails to resolve any other id wherever a payload
+* carries it, so that module never loads. A denied lookup throws because React
+* retries a missing `module#a#b` as module `module#a` with export `b`, which
+* would reach a non-action export of an owned module.
+*/
+function createRouteServerManifest(manifest, validateActionReferences) {
+	return new Proxy(manifest, { get(target, id, receiver) {
+		if (typeof id === "string" && !validateActionReferences([id])) throw new Error(`Server reference "${id}" is not a Server Action of this route.`);
+		return Reflect.get(target, id, receiver);
+	} });
 }
 function prepareActionPageRerenderContext(options) {
 	if (options.dynamicConfig === "force-static" || options.dynamicConfig === "error") {
@@ -572,32 +571,26 @@ async function handleProgressiveServerActionRequest(options) {
 		let actionKey = null;
 		for (const key of body.keys()) if (key.startsWith("$ACTION_ID_") || key.startsWith("$ACTION_REF_")) actionKey = key;
 		let directActionId = null;
-		let referencedActionIds = [];
 		let invalidDirectActionReference = false;
-		if (actionKey?.startsWith("$ACTION_ID_")) {
-			directActionId = actionKey.slice(11);
-			referencedActionIds = [directActionId];
-		} else if (actionKey?.startsWith("$ACTION_REF_")) {
-			const referencePrefix = actionKey.slice(12);
-			const reference = parseBoundProgressiveActionReference(body, referencePrefix);
-			if (reference) {
-				directActionId = reference.actionId;
-				referencedActionIds = reference.referencedActionIds;
-			} else invalidDirectActionReference = true;
+		if (actionKey?.startsWith("$ACTION_ID_")) directActionId = actionKey.slice(11);
+		else if (actionKey?.startsWith("$ACTION_REF_")) {
+			directActionId = readBoundProgressiveActionId(body, actionKey.slice(12));
+			invalidDirectActionReference = directActionId === null;
 		}
 		if (invalidDirectActionReference) return createActionNotFoundResponse(null, {
 			clearRequestContext: options.clearRequestContext,
 			getAndClearPendingCookies: options.getAndClearPendingCookies
 		});
-		if (directActionId && options.forwardAction) {
+		if (directActionId !== null && options.forwardAction) {
 			const forwardResponse = await options.forwardAction(directActionId);
 			if (forwardResponse) return forwardResponse;
 		}
-		if (options.validateActionReferences && !options.validateActionReferences(referencedActionIds)) return createActionNotFoundResponse(directActionId, {
+		if (directActionId !== null && !options.validateActionReferences([directActionId])) return createActionNotFoundResponse(directActionId, {
 			clearRequestContext: options.clearRequestContext,
 			getAndClearPendingCookies: options.getAndClearPendingCookies
 		});
-		const action = await loadOutsideRequestScopes(() => options.decodeAction(body));
+		const serverManifest = createRouteServerManifest(options.createServerManifest(), options.validateActionReferences);
+		const action = await loadOutsideRequestScopes(() => options.decodeAction(body, serverManifest));
 		if (!isAppServerActionFunction(action)) {
 			if (options.hasPageRoute) return createActionNotFoundResponse(null, {
 				clearRequestContext: options.clearRequestContext,
@@ -676,7 +669,7 @@ async function handleProgressiveServerActionRequest(options) {
 			};
 			return {
 				kind: "form-state",
-				formState: await loadOutsideRequestScopes(() => options.decodeFormState(actionResult, body)) ?? null,
+				formState: await loadOutsideRequestScopes(() => options.decodeFormState(actionResult, body, serverManifest)) ?? null,
 				pendingCookies: actionPendingCookies,
 				draftCookie: actionDraftCookie,
 				revalidationKind
@@ -821,8 +814,9 @@ async function handleServerActionRscRequest(options) {
 			});
 			action = loadedAction;
 		}
+		const serverManifest = createRouteServerManifest(options.createServerManifest(), options.validateActionReferences);
 		const temporaryReferences = options.createTemporaryReferenceSet();
-		const args = await loadOutsideRequestScopes(() => options.decodeReply(body, { temporaryReferences }));
+		const args = await loadOutsideRequestScopes(() => options.decodeReply(body, serverManifest, { temporaryReferences }));
 		let returnValue;
 		let actionRedirect = null;
 		let actionStatus = 200;

package/dist/server/app-ssr-entry.d.ts

@@ -25,6 +25,12 @@ export declare function handleSsr(rscStream: ReadableStream<Uint8Array>, navCont
     value: Promise<ArrayBuffer> | null;
   };
   pprFallbackShellSignal?: AbortSignal;
+  /**
+   * Pattern of the route this render shows, whose client references load
+   * before it starts, or null for a render without a route (a route-miss
+   * 404). Omitted, every client reference loads first.
+   */
+  preloadRoutePattern?: string | null;
   formState?: ReactFormState | null;
   basePath?: string;
   /**
@@ -64,6 +70,12 @@ export declare function handleSsr(rscStream: ReadableStream<Uint8Array>, navCont
    */
   isCacheCandidate?: boolean;
   fallbackToErrorDocumentOnShellError?: boolean;
+  /**
+   * The parallel slot not-found boundaries that catch the error that
+   * rejected the shell, or null when none catches it. The document then
+   * renders again from the same payload with them caught.
+   */
+  resolveCaughtNotFoundBoundaries?: (error: unknown) => readonly string[] | null;
   dynamicStaleTimeSeconds?: number;
   getInitialNavigationCacheMetadata?: () => InitialNavigationCacheMetadata;
 }): Promise<AppSsrRenderResult>;