vinext 1.4.0 → 1.4.2

package/dist/server/app-rsc-request-normalization.d.ts

@@ -6,11 +6,9 @@ export type NormalizedRscRequest = {
   url: URL;
   /** Normalized pathname with basePath stripped. Used for all internal routing. */
   pathname: string;
-  /** Pathname with `.rsc` suffix removed. Used for route matching and navigation context. */
-  cleanPathname: string;
-  /** Original encoded request pathname with basePath and `.rsc` removed. */
-  requestCleanPathname: string;
-  /** True when the request targets a canonical `.rsc` payload URL. */
+  /** Original encoded request pathname with basePath stripped. */
+  requestPathname: string;
+  /** True when the request selects the RSC payload with `RSC: 1`. */
   isRscRequest: boolean;
   /** Sanitized X-Vinext-Interception-Context header (null bytes stripped). null when absent. */
   interceptionContextHeader: string | null;
@@ -42,13 +40,13 @@ export type NormalizedRscRequest = {
  *   4. Collapse double-slashes, resolve `.` and `..` segments (normalizePath)
  *   5. basePath check + strip — 404 when pathname lacks the basePath prefix.
  *      `/__vinext/` bypasses this for internal prerender endpoints.
- *   6. RSC detection: `.rsc` suffix or Next-style `RSC: 1`. The internal
- *      `_rsc` cache-busting query is validated separately so full-route Flight
- *      responses do not share the canonical HTML URL in caches that ignore Vary.
- *   7. cleanPathname — pathname with `.rsc` suffix stripped
- *   8. Sanitize X-Vinext-Interception-Context — strip null bytes (header injection)
- *   9. Normalize x-vinext-mounted-slots — dedup and sort for canonical cache keys
- *   10. Read semantic render mode for refresh/action payload rendering
+ *   6. RSC detection: `RSC: 1`, as in Next.js. A `.rsc` suffix is an ordinary
+ *      part of the pathname. The internal `_rsc` cache-busting query is
+ *      validated separately so full-route Flight responses do not share the
+ *      canonical HTML URL in caches that ignore Vary.
+ *   7. Sanitize X-Vinext-Interception-Context — strip null bytes (header injection)
+ *   8. Normalize x-vinext-mounted-slots — dedup and sort for canonical cache keys
+ *   9. Read semantic render mode for refresh/action payload rendering
  *
  * @returns A 400 or 404 Response for invalid or out-of-scope inputs,
  *          or a NormalizedRscRequest for valid requests.

package/dist/server/app-rsc-request-normalization.js

@@ -8,7 +8,7 @@ import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { normalizePath } from "./normalize-path.js";
 import { normalizeMountedSlotsHeader } from "./app-mounted-slots-header.js";
 import { APP_RSC_RENDER_MODE_NAVIGATION, APP_RSC_RENDER_MODE_PREFETCH_EMPTY, APP_RSC_RENDER_MODE_PREFETCH_LOADING_SHELL, parseAppRscRenderMode } from "./app-rsc-render-mode.js";
-import { VINEXT_RSC_CACHE_BUSTING_SEARCH_PARAM, stripRscSuffix } from "./app-rsc-cache-busting.js";
+import { VINEXT_RSC_CACHE_BUSTING_SEARCH_PARAM } from "./app-rsc-cache-busting.js";
 import { normalizeInterceptionContextHeader } from "./app-interception-context-header.js";
 //#region src/server/app-rsc-request-normalization.ts
 function extractFlightRouterStatePath(value, depth = 0) {
@@ -78,13 +78,13 @@ function tryNormalizeComparablePathAndSearch(value, basePath, baseUrl) {
 *   4. Collapse double-slashes, resolve `.` and `..` segments (normalizePath)
 *   5. basePath check + strip — 404 when pathname lacks the basePath prefix.
 *      `/__vinext/` bypasses this for internal prerender endpoints.
-*   6. RSC detection: `.rsc` suffix or Next-style `RSC: 1`. The internal
-*      `_rsc` cache-busting query is validated separately so full-route Flight
-*      responses do not share the canonical HTML URL in caches that ignore Vary.
-*   7. cleanPathname — pathname with `.rsc` suffix stripped
-*   8. Sanitize X-Vinext-Interception-Context — strip null bytes (header injection)
-*   9. Normalize x-vinext-mounted-slots — dedup and sort for canonical cache keys
-*   10. Read semantic render mode for refresh/action payload rendering
+*   6. RSC detection: `RSC: 1`, as in Next.js. A `.rsc` suffix is an ordinary
+*      part of the pathname. The internal `_rsc` cache-busting query is
+*      validated separately so full-route Flight responses do not share the
+*      canonical HTML URL in caches that ignore Vary.
+*   7. Sanitize X-Vinext-Interception-Context — strip null bytes (header injection)
+*   8. Normalize x-vinext-mounted-slots — dedup and sort for canonical cache keys
+*   9. Read semantic render mode for refresh/action payload rendering
 *
 * @returns A 400 or 404 Response for invalid or out-of-scope inputs,
 *          or a NormalizedRscRequest for valid requests.
@@ -110,9 +110,7 @@ function normalizeRscRequest(request, basePath, allowOutsideBasePath = false, as
 			requestPathname = stripBasePath(requestPathname, basePath);
 		}
 	}
-	const isRscRequest = pathname.endsWith(".rsc") || request.headers.get("RSC") === "1";
-	const cleanPathname = stripRscSuffix(pathname);
-	const requestCleanPathname = stripRscSuffix(requestPathname);
+	const isRscRequest = request.headers.get("RSC") === "1";
 	const interceptionContextHeader = normalizeInterceptionContextHeader(request.headers.get(VINEXT_INTERCEPTION_CONTEXT_HEADER));
 	const rawInterceptionId = request.headers.get(VINEXT_INTERCEPTION_ID_HEADER);
 	if (rawInterceptionId !== null && (rawInterceptionId.length > 4096 || !rawInterceptionId.startsWith("interception:"))) return badRequestResponse();
@@ -124,7 +122,7 @@ function normalizeRscRequest(request, basePath, allowOutsideBasePath = false, as
 		const routerState = parsePrefetchRouterState(request.headers.get(NEXT_ROUTER_STATE_TREE_HEADER));
 		if (nextUrl && routerState) {
 			const targetUrl = new URL(url);
-			targetUrl.pathname = cleanPathname;
+			targetUrl.pathname = pathname;
 			targetUrl.searchParams.delete(VINEXT_RSC_CACHE_BUSTING_SEARCH_PARAM);
 			const routerPathAndSearch = tryNormalizeComparablePathAndSearch(routerState.pathAndSearch, basePath, url);
 			const nextPathAndSearch = tryNormalizeComparablePathAndSearch(nextUrl, basePath, url);
@@ -136,8 +134,7 @@ function normalizeRscRequest(request, basePath, allowOutsideBasePath = false, as
 		hadBasePath,
 		url,
 		pathname,
-		cleanPathname,
-		requestCleanPathname,
+		requestPathname,
 		isRscRequest,
 		interceptionContextHeader,
 		interceptionIdHeader,

package/dist/server/app-rsc-response-finalizer.d.ts

@@ -32,6 +32,9 @@ type FinalizeAppRscResponseOptions = {
 };
 /** Mark a response whose final target pipeline has already applied config headers. */
 export declare function markAppRscResponseConfigHeadersApplied(response: Response): Response;
+/** Mark a Server Action redirect that streams its target's render, and so keeps its policy. */
+export declare function markStreamedActionRedirectResponse(response: Response): Response;
+export declare function isStreamedActionRedirectResponse(response: Response): boolean;
 /** Apply only the matching next.config headers for an App Router request. */
 export declare function applyAppRscConfigHeaders(headers: Headers, request: Request, options: FinalizeAppRscResponseOptions): Promise<void>;
 /**

package/dist/server/app-rsc-response-finalizer.js

@@ -25,6 +25,15 @@ function markAppRscResponseConfigHeadersApplied(response) {
 	configHeadersAlreadyApplied.add(response);
 	return response;
 }
+const streamedActionRedirects = /* @__PURE__ */ new WeakSet();
+/** Mark a Server Action redirect that streams its target's render, and so keeps its policy. */
+function markStreamedActionRedirectResponse(response) {
+	streamedActionRedirects.add(response);
+	return response;
+}
+function isStreamedActionRedirectResponse(response) {
+	return streamedActionRedirects.has(response);
+}
 /** Apply only the matching next.config headers for an App Router request. */
 async function applyAppRscConfigHeaders(headers, request, options) {
 	if (!HAS_CONFIG_HEADERS || !options.configHeaders.length) return;
@@ -73,6 +82,7 @@ async function finalizeAppRscResponse(response, request, options) {
 	if (!response.headers.has("Cache-Control")) {
 		applyCdnResponseHeaders(response.headers, { cacheControl: "" });
 		captureRouteCacheabilityResponsePolicy(captureCdnResponsePolicyHeaders(response.headers));
+		if (isStaticFileSignal(response)) response.headers.delete("Cache-Control");
 	}
 	if (configHeadersAlreadyApplied.has(response)) {
 		normalizeExplicitNonCacheablePolicy(response.headers);
@@ -84,4 +94,4 @@ async function finalizeAppRscResponse(response, request, options) {
 	return response;
 }
 //#endregion
-export { applyAppRscConfigHeaders, finalizeAppRscResponse, markAppRscResponseConfigHeadersApplied };
+export { applyAppRscConfigHeaders, finalizeAppRscResponse, isStreamedActionRedirectResponse, markAppRscResponseConfigHeadersApplied, markStreamedActionRedirectResponse };

package/dist/server/app-rsc-response-stage.js

@@ -10,7 +10,7 @@ import { applyEffectiveRequestCookieHeader, getDraftModeCookieHeader, headersCon
 import { ensureFetchPatch, setCurrentFetchSoftTags } from "../shims/fetch-cache.js";
 import { traceFindPageComponents } from "./pages-execution-tracing.js";
 import { getRenderedConcreteUrlPathsForRoute } from "./pregenerated-concrete-paths.js";
-import { VINEXT_RSC_CACHE_BUSTING_SEARCH_PARAM, hasRscCacheBustingSearchParam, stripRscCacheBustingSearchParam, stripRscSuffix } from "./app-rsc-cache-busting.js";
+import { VINEXT_RSC_CACHE_BUSTING_SEARCH_PARAM, hasRscCacheBustingSearchParam, stripRscCacheBustingSearchParam } from "./app-rsc-cache-busting.js";
 import { traceAppPageRender } from "./app-page-tracing.js";
 import { buildPageCacheTags } from "./implicit-tags.js";
 import { pickRootParams, setRootParams } from "../shims/root-params.js";
@@ -48,13 +48,6 @@ function requestWithoutRscCacheBustingSearchParam(request) {
 	stripRscCacheBustingSearchParam(url);
 	return cloneRequestWithUrl(request, url.toString());
 }
-function requestWithoutRscSuffix(request) {
-	const url = new URL(request.url);
-	const pathname = stripRscSuffix(url.pathname);
-	if (pathname === url.pathname) return request;
-	url.pathname = pathname;
-	return cloneRequestWithUrl(request, url.toString());
-}
 function pathnameForResolvedUrl(resolvedUrl) {
 	return resolvedUrl.split("#", 1)[0].split("?", 1)[0];
 }
@@ -192,9 +185,8 @@ async function renderAppWorkerResponseStage(options, rawRequest, ctx, props, sta
 		setRootParams(rootParams);
 		if (props.kind === "app-route-handler") {
 			setCurrentFetchSoftTags(buildPageCacheTags(props.cleanPathname, [], [...route.routeSegments], "route"));
-			const normalizedUserlandRequest = requestWithoutRscSuffix(request);
-			const userlandRequest = requestWithoutRscCacheBustingSearchParam(normalizedUserlandRequest);
-			const routeHandlerRequest = isEdgeRouteHandler(route.routeHandler) ? userlandRequest : normalizedUserlandRequest;
+			const userlandRequest = requestWithoutRscCacheBustingSearchParam(request);
+			const routeHandlerRequest = isEdgeRouteHandler(route.routeHandler) ? userlandRequest : request;
 			const routeHandlerUrl = new URL(routeHandlerRequest.url);
 			const internalRscValues = isEdgeRouteHandler(route.routeHandler) ? [] : routeHandlerUrl.searchParams.getAll(VINEXT_RSC_CACHE_BUSTING_SEARCH_PARAM);
 			routeHandlerUrl.search = searchParams.toString();
@@ -225,7 +217,7 @@ async function renderAppWorkerResponseStage(options, rawRequest, ctx, props, sta
 			handlerStart: process.env.NODE_ENV !== "production" ? performance.now() : 0,
 			interceptionContext: normalized.interceptionContextHeader,
 			interceptionId: normalized.interceptionIdHeader,
-			interceptionPathname: props.matchKind === "resolved" ? props.cleanPathname : normalized.requestCleanPathname,
+			interceptionPathname: props.matchKind === "resolved" ? props.cleanPathname : normalized.requestPathname,
 			isProgressiveActionRender: false,
 			isRscRequest: normalized.isRscRequest,
 			middlewareContext,

package/dist/server/app-rsc-route-matching.d.ts

@@ -101,6 +101,7 @@ type AppRscRouteForMatching = {
   pattern: string;
   patternParts: string[];
   routeHandler?: unknown;
+  routeSegments?: readonly string[] | null;
   slots?: Record<string, AppRscSlotForMatching>;
   siblingIntercepts?: AppRscSiblingInterceptForMatching[];
 };
@@ -108,6 +109,14 @@ type AppRscInterceptMatch = AppRscInterceptLookupEntry & {
   matchedParams: AppRscRouteParams;
   sourceRouteIsConcrete: boolean;
   sourceMatchedParams: AppRscRouteParams;
+  /**
+   * The source route and params the request's interception context names,
+   * which the request handler authorizes. They differ from the rendered
+   * `sourceRouteIndex` only for a sibling intercept opened from a deeper
+   * source, which renders the intercepting route itself.
+   */
+  authorizationSourceRouteIndex: number;
+  authorizationSourceParams: AppRscRouteParams;
 };
 type AppRscInterceptLoadState = {
   page: unknown;
@@ -120,6 +129,11 @@ type AppRscInterceptLookupEntry = {
   interceptionId: string | null;
   interceptionGraphId: string | null;
   sourceRouteIndex: number;
+  /**
+   * A sibling intercept whose owner route's page sits in the directory of the
+   * interception marker, so the owner is the intercepting route itself.
+   */
+  ownerIsInterceptingRoute: boolean;
   slotKey: string;
   targetPattern: string;
   targetPatternParts: string[];

package/dist/server/app-rsc-route-matching.js

@@ -1,7 +1,8 @@
-import { decodeMatchedParams, decodeRouteSegment, splitPathSegments, splitPathnameForRouteMatch } from "../routing/utils.js";
+import { decodeMatchedParams, decodeRouteSegment, splitPathSegments } from "../routing/utils.js";
 import { createAppRouteGraphInterceptionId } from "../routing/app-route-ids.js";
 import { buildRouteTrie, trieMatchRaw } from "../routing/route-trie.js";
 import { extractRawRoutePatternParams, matchRoutePatternPrefix, matchRoutePatternRaw } from "../routing/route-pattern.js";
+import { getRenderedConcreteUrlPathsForRoute } from "./pregenerated-concrete-paths.js";
 import { canonicalizeAppPageParams } from "./app-page-segment-state.js";
 //#region src/server/app-rsc-route-matching.ts
 /**
@@ -13,10 +14,19 @@ const SIBLING_PAGE_INTERCEPT_SLOT_KEY = "__vinext_page_intercept";
 function createRouteParams() {
 	return Object.create(null);
 }
-function appRscPathnameParts(pathname, isNormalized = false) {
+/**
+* Whether each encoded raw segment is exactly the spelling the URL parser, as
+* a browser runs it, gives its decoded form: `caf%C3%A9` for `café`, but `q&a`
+* for `q&a`. `%61dmin`, `caf%c3%a9`, `%63af%C3%A9` and `q%26a` are other
+* spellings of a page, which middleware never compared as its pathname.
+*/
+function isCanonicalPathEncoding(rawParts, decodedParts) {
+	return rawParts.every((rawPart, index) => !rawPart.includes("%") || rawPart === new URL(`/${decodedParts[index]}`, "http://n").pathname.slice(1));
+}
+function appRscPathnameParts(pathname) {
 	const pathOnly = pathname.split("?")[0];
 	const normalizedPathname = pathOnly === "/" ? "/" : pathOnly.replace(/\/$/, "");
-	return isNormalized ? splitPathSegments(normalizedPathname) : splitPathnameForRouteMatch(normalizedPathname);
+	return splitPathSegments(normalizedPathname);
 }
 function isAppRouteHandlerRoute(route) {
 	return route.routeHandler != null || typeof route.__loadRouteHandler === "function";
@@ -49,8 +59,10 @@ function createAppRscRouteMatcher(routes, decodedPathnamePatterns = []) {
 		const result = matchRawRequestParts(rawParts);
 		if (!result) return null;
 		if (decodedPathnameRoutes.size > 0 && result.route.patternParts.some((part) => part.startsWith(":")) && !isAppRouteHandlerRoute(result.route) && rawParts.some((part) => part.includes("%"))) {
-			const route = decodedPathnameRoutes.get(rawParts.map(decodeRouteSegment).join("/"));
-			if (route && route !== result.route) return {
+			const decodedParts = rawParts.map(decodeRouteSegment);
+			const decodedPathname = decodedParts.join("/");
+			const route = decodedPathnameRoutes.get(decodedPathname);
+			if (route && route !== result.route && (isCanonicalPathEncoding(rawParts, decodedParts) || getRenderedConcreteUrlPathsForRoute(route.pattern)?.has(`/${decodedPathname}`) === true)) return {
 				route,
 				params: createRouteParams()
 			};
@@ -62,23 +74,18 @@ function createAppRscRouteMatcher(routes, decodedPathnamePatterns = []) {
 			return interceptionIds.has(interceptionId);
 		},
 		matchRoute(url) {
-			const rawParts = appRscPathnameParts(url, true);
-			const result = trieMatchRaw(routeTrie, appRscPathnameParts(url, false));
-			if (!result) return null;
-			result.params = extractRawRoutePatternParams(result.route.patternParts, rawParts);
-			normalizeMatchedParamsForRoute(result);
-			return result;
+			return matchRequestParts(appRscPathnameParts(url));
 		},
 		matchRequestRoute(url) {
-			return matchRequestParts(appRscPathnameParts(url, true));
+			return matchRequestParts(appRscPathnameParts(url));
 		},
 		matchRawRequestRoute(url) {
-			return matchRawRequestParts(appRscPathnameParts(url, true));
+			return matchRawRequestParts(appRscPathnameParts(url));
 		},
 		findIntercept(pathname, sourcePathname = null, interceptionId = null) {
 			if (sourcePathname === null) return null;
-			const urlParts = appRscPathnameParts(pathname, true);
-			const sourceParts = appRscPathnameParts(sourcePathname, true);
+			const urlParts = appRscPathnameParts(pathname);
+			const sourceParts = appRscPathnameParts(sourcePathname);
 			const matchedSourceRoute = matchRawRequestParts(sourceParts);
 			for (const entry of interceptLookup) {
 				if (interceptionId !== null && entry.interceptionId !== interceptionId) continue;
@@ -92,15 +99,21 @@ function createAppRscRouteMatcher(routes, decodedPathnamePatterns = []) {
 				if (sourceRoute && isAppRouteHandlerRoute(sourceRoute)) continue;
 				const matchedSourceParams = concreteSourceRoute ? concreteSourceRoute.params : sourceRoute ? matchSlotOwnerSourceParams(sourceParts, sourceRoute.patternParts, entry.sourceMatchPatternParts !== null) : null;
 				if (!concreteSourceRoute && matchedSourceParams) canonicalizeAppPageParams(matchedSourceParams);
+				const ownerRoute = routes[entry.sourceRouteIndex];
+				const rendersOwnerRoute = entry.ownerIsInterceptingRoute && concreteSourceRouteIndex !== entry.sourceRouteIndex && ownerRoute !== void 0;
+				const renderedSourceParams = rendersOwnerRoute ? matchSlotOwnerSourceParams(sourceParts, ownerRoute.patternParts, true) : matchedSourceParams;
+				if (rendersOwnerRoute && renderedSourceParams) canonicalizeAppPageParams(renderedSourceParams);
 				if (matchedSourceParams === null && entry.sourceMatchPatternParts === null) continue;
-				const sourceParams = matchedSourceParams && entry.sourceMatchPatternParts !== null ? pickPatternParams(matchedSourceParams, entry.sourceMatchPatternParts) : matchedSourceParams ?? createRouteParams();
+				const sourceParams = renderedSourceParams && entry.sourceMatchPatternParts !== null ? pickPatternParams(renderedSourceParams, entry.sourceMatchPatternParts) : renderedSourceParams ?? createRouteParams();
 				return {
 					...entry,
 					page: entry.__loadState.page,
 					sourceRouteIsConcrete: concreteSourceRoute !== null,
-					sourceRouteIndex: concreteSourceRouteIndex,
+					sourceRouteIndex: rendersOwnerRoute ? entry.sourceRouteIndex : concreteSourceRouteIndex,
 					matchedParams: mergeMatchedParams(sourceParams, params),
-					sourceMatchedParams: matchedSourceParams ?? createRouteParams()
+					sourceMatchedParams: renderedSourceParams ?? createRouteParams(),
+					authorizationSourceRouteIndex: concreteSourceRouteIndex,
+					authorizationSourceParams: matchedSourceParams ?? createRouteParams()
 				};
 			}
 			return null;
@@ -108,6 +121,15 @@ function createAppRscRouteMatcher(routes, decodedPathnamePatterns = []) {
 	};
 }
 /**
+* Whether a sibling intercept's owner route is the intercepting route: its
+* page lives in the directory that holds the interception marker. An owner
+* found elsewhere stands in for a marker directory without a page.
+*/
+function isInterceptingRoute(routeSegments, sourcePageSegments) {
+	if (!routeSegments || !sourcePageSegments) return false;
+	return sourcePageSegments.findIndex((segment) => /^\(\.+\)/.test(segment)) === routeSegments.length && routeSegments.every((segment, index) => segment === sourcePageSegments[index]);
+}
+/**
 * Params for the slot owner when interception falls back to it instead of a
 * concrete descendant source route. The owner is what renders, and
 * `matchInterceptRoute` reads the promoted route's params solely from these,
@@ -195,6 +217,7 @@ function createInterceptLookup(routes) {
 					interceptionId: typeof slotModule.id === "string" && sourceMatchPattern !== null ? createAppRouteGraphInterceptionId(slotModule.id, sourceMatchPattern, intercept.targetPattern) : null,
 					interceptionGraphId: null,
 					sourceRouteIndex: ownerRouteIndex,
+					ownerIsInterceptingRoute: false,
 					slotKey,
 					slotId: typeof slotModule.id === "string" ? slotModule.id : null,
 					targetRouteGraphId: resolveTargetRouteGraphId(intercept.targetPattern),
@@ -246,6 +269,7 @@ function createInterceptLookup(routes) {
 				interceptionId: typeof intercept.id === "string" ? intercept.id : null,
 				interceptionGraphId: typeof intercept.id === "string" ? intercept.id : null,
 				sourceRouteIndex: routeIndex,
+				ownerIsInterceptingRoute: !isAppRouteHandlerRoute(route) && isInterceptingRoute(route.routeSegments, intercept.sourcePageSegments),
 				slotKey: SIBLING_PAGE_INTERCEPT_SLOT_KEY,
 				slotId: typeof intercept.slotId === "string" ? intercept.slotId : null,
 				targetRouteGraphId: resolveTargetRouteGraphId(intercept.targetPattern),

package/dist/server/app-server-action-execution.js

@@ -11,6 +11,8 @@ import { internalServerErrorResponse, payloadTooLargeResponse } from "./http-err
 import { attachRequestCfMetadata, validateCsrfOrigin, validateServerActionPayload } from "./request-pipeline.js";
 import { splitPathSegments } from "../routing/utils.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
+import { logRequestError } from "./request-error-log.js";
+import { SERVER_ACTION_CACHE_CONTROL, applyCdnResponseHeaders } from "./cache-control.js";
 import { shareIsolatePromise } from "./isolate-shared-promise.js";
 import { APP_RSC_RENDER_MODE_NAVIGATION } from "./app-rsc-render-mode.js";
 import { isDraftModeRequest, setHeadersContext } from "../shims/headers.js";
@@ -20,17 +22,18 @@ import { readStreamAsTextWithLimit } from "../utils/text-stream.js";
 import { mergeMiddlewareResponseHeaders } from "./middleware-response-headers.js";
 import { VINEXT_RSC_CONTENT_TYPE, applyRscCompatibilityIdHeader, createRscRequestUrl, stripRscCacheBustingSearchParam } from "./app-rsc-cache-busting.js";
 import { getSetCookieName } from "./cookie-utils.js";
+import { markAppRscResponseConfigHeadersApplied, markStreamedActionRedirectResponse } from "./app-rsc-response-finalizer.js";
 import { createServerActionNotFoundResponse, getServerActionNotFoundMessage, isServerActionNotFoundError } from "./server-action-not-found.js";
 import { applyEdgeRuntimeHeader } from "./app-page-response.js";
 import { getNextErrorDigest, parseNextHttpErrorDigest, parseNextRedirectDigest } from "./next-error-digest.js";
-import { hasDigest } from "./app-rsc-errors.js";
-import { resolveAppPageNavigationParams } from "./app-page-element-builder.js";
+import { resolveAppPageNavigationParams } from "./app-page-navigation-params.js";
 import "./app-page-stream.js";
+import { hasDigest } from "./app-rsc-errors.js";
 import { buildAppPageTags } from "./implicit-tags.js";
+import { resolveAppPageInterceptSegmentConfig } from "./app-page-intercept-segment-config.js";
 import { resolveAppPageActionRerenderTarget } from "./app-page-request.js";
 import { createRootParamsUsageController, runWithRootParamsUsage } from "../shims/root-params.js";
 import { createStaticGenerationHeadersContext } from "./app-static-generation.js";
-import { markAppRscResponseConfigHeadersApplied } from "./app-rsc-response-finalizer.js";
 //#region src/server/app-server-action-execution.ts
 /**
 * Run a server-reference load or decode outside every request scope.
@@ -509,7 +512,10 @@ function createRejectedActionResult(error) {
 * Next.js, a thrown string is not logged in development.
 */
 function logRejectedActionResult(error) {
-	if (process.env.NODE_ENV === "production" || hasDigest(error)) console.error("[vinext] Server action error:", error);
+	if (process.env.NODE_ENV === "production" || hasDigest(error)) {
+		if (typeof error === "string") console.error("[vinext] Server action error:", error);
+		else logRequestError("[vinext] Server action error:", error);
+	}
 }
 function getActionHttpFallbackStatus(error) {
 	const digest = getNextErrorDigest(error);
@@ -520,7 +526,7 @@ function getActionHttpFallbackStatus(error) {
 }
 function createServerActionErrorResponse(error, options) {
 	options.getAndClearPendingCookies();
-	console.error("[vinext] Server action error:", error);
+	logRequestError("[vinext] Server action error:", error);
 	options.reportRequestError(error, {
 		path: options.cleanPathname,
 		method: options.request.method,
@@ -627,7 +633,7 @@ async function handleProgressiveServerActionRequest(options) {
 				actionFailed = true;
 				actionFailedWithError = getActionHttpFallbackStatus(error) === null && !isServerActionNotFoundError(error, null);
 				if (actionFailedWithError) {
-					console.error("[vinext] Server action error:", error);
+					logRequestError("[vinext] Server action error:", error);
 					options.reportRequestError(error, {
 						path: options.cleanPathname,
 						method: options.request.method,
@@ -655,7 +661,7 @@ async function handleProgressiveServerActionRequest(options) {
 				options.clearRequestContext();
 				const headers = new Headers();
 				mergeMiddlewareResponseHeaders(headers, options.middlewareHeaders);
-				headers.set("Cache-Control", "no-cache, no-store, max-age=0, must-revalidate");
+				headers.set("Cache-Control", SERVER_ACTION_CACHE_CONTROL);
 				for (const cookie of actionPendingCookies) headers.append("Set-Cookie", cookie);
 				if (actionDraftCookie) headers.append("Set-Cookie", actionDraftCookie);
 				return internalServerErrorResponse(process.env.NODE_ENV === "production" ? void 0 : "Server action failed: " + getServerActionFailureMessage(actionError), { headers });
@@ -699,7 +705,7 @@ async function handleProgressiveServerActionRequest(options) {
 		});
 		getAndClearActionRevalidationKind();
 		options.getAndClearPendingCookies();
-		console.error("[vinext] Server action payload parsing error:", error);
+		logRequestError("[vinext] Server action payload parsing error:", error);
 		options.reportRequestError(error, {
 			path: options.cleanPathname,
 			method: options.request.method,
@@ -875,6 +881,7 @@ async function handleServerActionRscRequest(options) {
 			applyEdgeRuntimeHeader(redirectHeaders, options.isEdgeRuntime);
 			mergeActionRedirectSourceHeaders(redirectHeaders, options.sourceConfigHeaders ?? null);
 			mergeActionRedirectSourceHeaders(redirectHeaders, options.middlewareHeaders);
+			applyCdnResponseHeaders(redirectHeaders, { cacheControl: SERVER_ACTION_CACHE_CONTROL });
 			applyRscCompatibilityIdHeader(redirectHeaders);
 			const actionRedirectUrl = applyActionRedirectBasePath(actionRedirect.url, options.basePath ?? "");
 			redirectHeaders.set(ACTION_REDIRECT_HEADER, actionRedirectUrl);
@@ -934,10 +941,10 @@ async function handleServerActionRscRequest(options) {
 				targetPathname,
 				targetRoute: targetMatch?.route ?? null
 			}) ? 200 : 303;
-			return markAppRscResponseConfigHeadersApplied(createServerActionRscResponse(targetResponse.body, {
+			return markStreamedActionRedirectResponse(markAppRscResponseConfigHeadersApplied(createServerActionRscResponse(targetResponse.body, {
 				status: redirectResponseStatus,
 				headers: redirectHeaders
-			}, options.clearRequestContext));
+			}, options.clearRequestContext)));
 		}
 		const actionPendingCookies = dedupePendingCookies(options.getAndClearPendingCookies());
 		const actionDraftCookie = options.getDraftModeCookieHeader();
@@ -972,6 +979,7 @@ async function handleServerActionRscRequest(options) {
 		let element;
 		let errorPattern = match ? match.route.pattern : options.cleanPathname;
 		let renderedPathAndSearch = null;
+		let actionRerenderIsEdgeRuntime = options.isEdgeRuntime;
 		const actionRerenderIsRscRequest = true;
 		if (match) {
 			const { route: actionRoute, params: actionParams } = match;
@@ -987,7 +995,9 @@ async function handleServerActionRscRequest(options) {
 			});
 			const resolvedActionNavigationParams = resolveAppPageNavigationParams(actionRerenderTarget.route, actionRerenderTarget.navigationParams, options.cleanPathname, actionRerenderTarget.interceptOpts);
 			await options.ensureRouteLoaded?.(actionRerenderTarget.route);
-			const actionRerenderDynamicConfig = options.resolveRouteDynamicConfig?.(actionRerenderTarget.route);
+			const actionInterceptConfig = actionRerenderTarget.interceptOpts ? resolveAppPageInterceptSegmentConfig(actionRerenderTarget.route, actionRerenderTarget.interceptOpts) : null;
+			if (actionInterceptConfig) actionRerenderIsEdgeRuntime = actionInterceptConfig.isEdgeRuntime;
+			const actionRerenderDynamicConfig = actionInterceptConfig ? actionInterceptConfig.dynamicConfig : options.resolveRouteDynamicConfig?.(actionRerenderTarget.route);
 			const actionRerenderSearchParams = prepareActionPageRerenderContext({
 				draftModeCookie: actionDraftCookie,
 				draftModeSecret: options.draftModeSecret,
@@ -1003,8 +1013,8 @@ async function handleServerActionRscRequest(options) {
 			});
 			const renderedSearch = options.searchParams.toString();
 			renderedPathAndSearch = renderedSearch ? `${options.cleanPathname}?${renderedSearch}` : options.cleanPathname;
-			setCurrentFetchCacheMode(options.resolveRouteFetchCacheMode?.(actionRerenderTarget.route) ?? null);
-			setCurrentFetchRevalidate(options.resolveRouteRevalidateSeconds?.(actionRerenderTarget.route) ?? null);
+			setCurrentFetchCacheMode(actionInterceptConfig ? actionInterceptConfig.fetchCacheMode : options.resolveRouteFetchCacheMode?.(actionRerenderTarget.route) ?? null);
+			setCurrentFetchRevalidate(actionInterceptConfig ? actionInterceptConfig.revalidateSeconds : options.resolveRouteRevalidateSeconds?.(actionRerenderTarget.route) ?? null);
 			setCurrentForceDynamicFetchDefault(actionRerenderDynamicConfig === "force-dynamic");
 			setCurrentFetchSoftTags(buildServerActionPageTags(actionRerenderTarget.route, options.cleanPathname));
 			const buildActionRerenderElement = () => options.buildPageElement({
@@ -1043,7 +1053,7 @@ async function handleServerActionRscRequest(options) {
 			"Content-Type": VINEXT_RSC_CONTENT_TYPE,
 			Vary: VINEXT_RSC_VARY_HEADER
 		});
-		applyEdgeRuntimeHeader(actionHeaders, options.isEdgeRuntime);
+		applyEdgeRuntimeHeader(actionHeaders, actionRerenderIsEdgeRuntime);
 		mergeMiddlewareResponseHeaders(actionHeaders, options.middlewareHeaders);
 		applyRscCompatibilityIdHeader(actionHeaders);
 		setActionRevalidatedHeader(actionHeaders, actionRevalidationKind);

package/dist/server/app-ssr-entry.d.ts

@@ -72,6 +72,12 @@ export declare function handleSsr(rscStream: ReadableStream<Uint8Array>, navCont
    */
   isCacheCandidate?: boolean;
   fallbackToErrorDocumentOnShellError?: boolean;
+  /**
+   * Whether the RSC render threw the given shell error. As in Next.js, in
+   * dev the error document carries only an error that the HTML render alone
+   * threw, for the overlay: the browser reports the others itself.
+   */
+  isServerComponentError?: (error: unknown) => boolean;
   /**
    * The parallel slot not-found boundaries that catch the error that
    * rejected the shell, or null when none catches it. The document then

package/dist/server/app-ssr-entry.js

@@ -2,6 +2,7 @@ import { deferUntilStreamConsumed } from "./defer-until-stream-consumed.js";
 import { notFoundResponse } from "./http-error-responses.js";
 import { isOpenRedirectShaped, repeatedSlashRedirectResponse } from "./open-redirect.js";
 import "./server-globals.js";
+import { isNavigationSignalError } from "../utils/navigation-signal.js";
 import { isPprFallbackShellAbortError } from "../shims/ppr-fallback-shell.js";
 import { onRenderDynamicLatched } from "../shims/internal/headers-state.js";
 import { AppRouterContext } from "../shims/internal/app-router-context.js";
@@ -15,6 +16,7 @@ import { createNavigationRuntimeRenderedSearchScript, createNavigationRuntimeRsc
 import { AppElementsWire } from "./app-elements-wire.js";
 import "./app-elements.js";
 import { createInitialBfcacheMaps } from "./app-bfcache-identity.js";
+import { isBailoutToCSRError, isDynamicServerError } from "../shims/navigation-errors.js";
 import { ServerInsertedHTMLContext, clearServerInsertedHTML, getBfcacheIdMapContext, registerServerInsertedHTMLCallback, renderServerInsertedHTML, setNavigationContext } from "../shims/navigation-context-state.js";
 import "../shims/navigation-server.js";
 import { BfcacheIdentityMapContext } from "../shims/slot.js";
@@ -71,13 +73,14 @@ function createUtf8Stream(html) {
 		controller.close();
 	} });
 }
-function buildBootstrapModuleScript(bootstrapModuleUrl, nonce) {
+function buildBootstrapModuleScript(bootstrapModuleUrl, nonce, crossOrigin) {
 	if (!bootstrapModuleUrl) return "";
-	return `<script type="module"${createNonceAttribute(nonce)} src="` + escapeHtmlAttr(bootstrapModuleUrl) + "\" id=\"_R_\" async=\"\" fetchPriority=\"low\"><\/script>";
+	const crossOriginAttribute = crossOrigin === void 0 ? "" : ` crossorigin="${crossOrigin === "use-credentials" ? "use-credentials" : ""}"`;
+	return `<script type="module"${createNonceAttribute(nonce)} src="` + escapeHtmlAttr(bootstrapModuleUrl) + `"${crossOriginAttribute} id="_R_" async="" fetchPriority="low"><\/script>`;
 }
-function renderSsrErrorDocumentShell(bootstrapModuleUrl, nonce) {
-	const html = renderToStaticMarkup(createElement(DefaultGlobalError, { error: null })).replace("<style>", "<style data-vinext-error-shell-style=\"\">");
-	const bootstrapScript = buildBootstrapModuleScript(bootstrapModuleUrl, nonce);
+function renderSsrErrorDocumentShell(bootstrapModuleUrl, nonce, crossOrigin) {
+	const html = renderToStaticMarkup(createElement(DefaultGlobalError, { error: null })).replace("<head>", "<head><meta name=\"robots\" content=\"noindex\"/>").replace("<style>", "<style data-vinext-error-shell-style=\"\">");
+	const bootstrapScript = buildBootstrapModuleScript(bootstrapModuleUrl, nonce, crossOrigin);
 	if (!bootstrapScript) return createUtf8Stream(`<!DOCTYPE html>${html}`);
 	const documentClose = "</body></html>";
 	if (!html.endsWith(documentClose)) return createUtf8Stream(`<!DOCTYPE html>${html}${bootstrapScript}`);
@@ -292,6 +295,7 @@ async function handleSsr(rscStream, navContext, fontData, options) {
 				let htmlStream;
 				let renderComplete = Promise.resolve();
 				let shellErrorRecovered = false;
+				let ssrOnlyShellError;
 				let caughtShellError;
 				let caughtBoundaries = null;
 				let shouldDelayInitialHtmlPull = false;
@@ -355,10 +359,11 @@ async function handleSsr(rscStream, navContext, fontData, options) {
 							shouldDelayInitialHtmlPull = options?.waitForAllReady !== true;
 							caughtShellError = error;
 							htmlStream = caughtHtmlStream;
-						} else if (options?.fallbackToErrorDocumentOnShellError !== true || options?.waitForAllReady === true || typeof error?.digest === "string") throw error;
+						} else if (options?.fallbackToErrorDocumentOnShellError !== true || isNavigationSignalError(error) || isBailoutToCSRError(error) || isDynamicServerError(error)) throw error;
 						else {
 							shellErrorRecovered = true;
-							htmlStream = renderSsrErrorDocumentShell(bootstrapModuleUrl, options?.scriptNonce);
+							if (options?.isServerComponentError?.(error) !== true) ssrOnlyShellError = error;
+							htmlStream = renderSsrErrorDocumentShell(bootstrapModuleUrl, options?.scriptNonce, assetCrossOrigin);
 						}
 					}
 				}
@@ -385,7 +390,7 @@ async function handleSsr(rscStream, navContext, fontData, options) {
 				const getInsertedHTML = () => {
 					const insertedHTML = renderInsertedHtml(renderServerInsertedHTML());
 					const errorMetaHTML = errorMetaRenderer.flush();
-					const initialDevServerErrorHTML = createInitialDevServerErrorScript(options?.initialDevServerError, options?.scriptNonce);
+					const initialDevServerErrorHTML = createInitialDevServerErrorScript(options?.initialDevServerError ?? ssrOnlyShellError, options?.scriptNonce);
 					if (didInjectHeadHTML) return insertedHTML + errorMetaHTML + getRenderedSearchHTML();
 					didInjectHeadHTML = true;
 					const hidesQuery = searchParamsGate !== null && searchParamsGate.gate.decision !== "real";

package/dist/server/app-worker-stages.d.ts

@@ -107,11 +107,20 @@ export type SharedAppCacheIdentityProps = Exclude<AppWorkerResponseStageProps, {
 export declare function createSharedAppCacheIdentity(request: Request, props: SharedAppCacheIdentityProps): SharedAppCacheIdentity;
 /**
  * Build the query-free cache identity of a shared App page dispatch. The user
- * query leaves both the URL and `resolvedUrl`; the `.rsc` suffix, an RSC
- * request's validated `_rsc`, and the render mode stay because they select the
- * representation. HTML identities also drop the RSC selector headers.
+ * query leaves both the URL and `resolvedUrl`; an RSC request's validated
+ * `_rsc` and the render mode stay because they select the representation. HTML identities also drop the RSC selector headers.
  */
 export declare function createSharedAppPageCacheIdentity(request: Request, props: AppMatchedWorkerResponseStageProps): SharedAppCacheIdentity;
+/**
+ * Build the query-free cache identity of a shared Route Handler or metadata
+ * route dispatch. Next.js keys a route handler by its pathname: the query and
+ * the RSC selectors pick no representation of a handler's response, and a
+ * handler that reads the request's URL or headers is dynamic, so admission
+ * refuses its response. Keeping them in the identity would only let a client
+ * store one entry per query or selector value. The method, path and route
+ * props stay; the selector headers and the props derived from them leave.
+ */
+export declare function createSharedAppRouteCacheIdentity(request: Request, props: AppMatchedWorkerResponseStageProps | AppMetadataWorkerResponseStageProps): SharedAppCacheIdentity;
 /**
  * Build the cache identity of a shared hybrid Pages page dispatch: the
  * dispatched request and props under `origin`, so every host that names it