vinext 1.4.1 → 1.4.3

package/dist/server/app-rsc-response-finalizer.js

@@ -1,3 +1,4 @@
+import { preserveFullyBufferedBodyMetadata } from "./fully-buffered-response.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { VINEXT_RSC_VARY_HEADER } from "./app-rsc-vary.js";
 import { sanitizeMethodNotAllowedHeaders } from "./http-error-responses.js";
@@ -6,12 +7,14 @@ import { normalizeDefaultLocalePathname } from "./pages-i18n.js";
 import { isNonCacheableCacheControl } from "../shims/cdn-cache.js";
 import { captureRouteCacheabilityResponsePolicy } from "../shims/cacheability-classification.js";
 import { NO_STORE_CACHE_CONTROL, applyCdnResponseHeaders, captureCdnResponsePolicyHeaders, hasExplicitNonCacheableResponsePolicy, isCdnResponsePolicyHeader } from "./cache-control.js";
-import { hasPostConfigLinkHeaders } from "./app-response-header-provenance.js";
+import { copyLinkHeaderProvenance, hasPostConfigLinkHeaders } from "./app-response-header-provenance.js";
 import { mergeVaryHeader } from "./middleware-response-headers.js";
 import "./app-rsc-cache-busting.js";
 //#region src/server/app-rsc-response-finalizer.ts
 const HAS_CONFIG_HEADERS = process.env.__VINEXT_HAS_CONFIG_HEADERS !== "false";
 const configHeadersAlreadyApplied = /* @__PURE__ */ new WeakSet();
+const applicationResponses = /* @__PURE__ */ new WeakSet();
+const routeHandlerResponses = /* @__PURE__ */ new WeakMap();
 function normalizeExplicitNonCacheablePolicy(headers) {
 	if (!hasExplicitNonCacheableResponsePolicy(headers)) return;
 	const cacheControl = headers.get("Cache-Control");
@@ -25,6 +28,48 @@ function markAppRscResponseConfigHeadersApplied(response) {
 	configHeadersAlreadyApplied.add(response);
 	return response;
 }
+const streamedActionRedirects = /* @__PURE__ */ new WeakSet();
+/** Mark a Server Action redirect that streams its target's render, and so keeps its policy. */
+function markStreamedActionRedirectResponse(response) {
+	streamedActionRedirects.add(response);
+	return response;
+}
+function isStreamedActionRedirectResponse(response) {
+	return streamedActionRedirects.has(response);
+}
+/**
+* Mark a response that a page, Route Handler, Server Action or Pages route
+* produced. Next.js stages next.config headers before application code runs,
+* so the redirects these return carry them. Redirects that routing answers
+* itself (next.config redirects, trailing slash, middleware) go out without.
+*/
+function markAppRscApplicationResponse(response) {
+	applicationResponses.add(response);
+	return response;
+}
+/** Mark a response a Route Handler produced, so its own headers meet config as in Next.js. */
+function markAppRscRouteHandlerResponse(response, runtime) {
+	routeHandlerResponses.set(response, runtime);
+	return markAppRscApplicationResponse(response);
+}
+/** Response.redirect() creates immutable headers; copy them only when needed. */
+function withMutableHeaders(response) {
+	const probe = "x-vinext-mutable-headers-probe";
+	const probeValue = response.headers.get(probe);
+	try {
+		if (probeValue === null) response.headers.delete(probe);
+		else response.headers.set(probe, probeValue);
+		return response;
+	} catch {
+		const headers = new Headers(response.headers);
+		copyLinkHeaderProvenance(response.headers, headers);
+		return preserveFullyBufferedBodyMetadata(response, new Response(response.body, {
+			headers,
+			status: response.status,
+			statusText: response.statusText
+		}));
+	}
+}
 /** Apply only the matching next.config headers for an App Router request. */
 async function applyAppRscConfigHeaders(headers, request, options) {
 	if (!HAS_CONFIG_HEADERS || !options.configHeaders.length) return;
@@ -48,6 +93,7 @@ async function applyAppRscConfigHeaders(headers, request, options) {
 		appendToPostConfigLink: hasPostConfigLinkHeaders(headers),
 		middlewareHeaders: options.middlewareHeaders,
 		recordCacheability: options.recordCacheability,
+		routeHandlerRuntime: options.routeHandlerRuntime,
 		overwriteExisting: options.overwriteExisting ?? isCdnResponsePolicyHeader
 	});
 }
@@ -59,12 +105,16 @@ async function applyAppRscConfigHeaders(headers, request, options) {
 * handling, so that every response path (page, route handler, server action,
 * metadata, not-found) gets headers applied consistently.
 *
-* Skips 3xx redirect responses. Response.redirect() creates immutable
-* headers that throw on mutation, and Next.js does not apply config headers
-* to redirects regardless.
+* Skips 3xx responses that routing answered itself, as Next.js does not
+* apply config headers to those. A 3xx that application code returned is
+* finalized like any other response.
 */
 async function finalizeAppRscResponse(response, request, options) {
-	if (response.status >= 300 && response.status < 400) return response;
+	const routeHandlerRuntime = routeHandlerResponses.get(response);
+	if (response.status >= 300 && response.status < 400) {
+		if (!applicationResponses.has(response) || configHeadersAlreadyApplied.has(response)) return response;
+		response = withMutableHeaders(response);
+	}
 	if (!isStaticFileSignal(response)) {
 		const varyHeader = response.headers.get("Vary");
 		if (varyHeader === null) response.headers.set("Vary", VINEXT_RSC_VARY_HEADER);
@@ -73,15 +123,19 @@ async function finalizeAppRscResponse(response, request, options) {
 	if (!response.headers.has("Cache-Control")) {
 		applyCdnResponseHeaders(response.headers, { cacheControl: "" });
 		captureRouteCacheabilityResponsePolicy(captureCdnResponsePolicyHeaders(response.headers));
+		if (isStaticFileSignal(response)) response.headers.delete("Cache-Control");
 	}
 	if (configHeadersAlreadyApplied.has(response)) {
 		normalizeExplicitNonCacheablePolicy(response.headers);
 		return response;
 	}
-	await applyAppRscConfigHeaders(response.headers, request, options);
+	await applyAppRscConfigHeaders(response.headers, request, {
+		...options,
+		routeHandlerRuntime
+	});
 	normalizeExplicitNonCacheablePolicy(response.headers);
 	if (response.status === 405 && response.headers.get("Allow") === "GET, HEAD") sanitizeMethodNotAllowedHeaders(response.headers, "GET, HEAD");
 	return response;
 }
 //#endregion
-export { applyAppRscConfigHeaders, finalizeAppRscResponse, markAppRscResponseConfigHeadersApplied };
+export { applyAppRscConfigHeaders, finalizeAppRscResponse, isStreamedActionRedirectResponse, markAppRscApplicationResponse, markAppRscResponseConfigHeadersApplied, markAppRscRouteHandlerResponse, markStreamedActionRedirectResponse };

package/dist/server/app-rsc-route-matching.d.ts

@@ -101,6 +101,7 @@ type AppRscRouteForMatching = {
   pattern: string;
   patternParts: string[];
   routeHandler?: unknown;
+  routeSegments?: readonly string[] | null;
   slots?: Record<string, AppRscSlotForMatching>;
   siblingIntercepts?: AppRscSiblingInterceptForMatching[];
 };
@@ -108,6 +109,14 @@ type AppRscInterceptMatch = AppRscInterceptLookupEntry & {
   matchedParams: AppRscRouteParams;
   sourceRouteIsConcrete: boolean;
   sourceMatchedParams: AppRscRouteParams;
+  /**
+   * The source route and params the request's interception context names,
+   * which the request handler authorizes. They differ from the rendered
+   * `sourceRouteIndex` only for a sibling intercept opened from a deeper
+   * source, which renders the intercepting route itself.
+   */
+  authorizationSourceRouteIndex: number;
+  authorizationSourceParams: AppRscRouteParams;
 };
 type AppRscInterceptLoadState = {
   page: unknown;
@@ -120,6 +129,11 @@ type AppRscInterceptLookupEntry = {
   interceptionId: string | null;
   interceptionGraphId: string | null;
   sourceRouteIndex: number;
+  /**
+   * A sibling intercept whose owner route's page sits in the directory of the
+   * interception marker, so the owner is the intercepting route itself.
+   */
+  ownerIsInterceptingRoute: boolean;
   slotKey: string;
   targetPattern: string;
   targetPatternParts: string[];

package/dist/server/app-rsc-route-matching.js

@@ -1,7 +1,8 @@
-import { decodeMatchedParams, decodeRouteSegment, splitPathSegments, splitPathnameForRouteMatch } from "../routing/utils.js";
+import { decodeMatchedParams, decodeRouteSegment, splitPathSegments } from "../routing/utils.js";
 import { createAppRouteGraphInterceptionId } from "../routing/app-route-ids.js";
 import { buildRouteTrie, trieMatchRaw } from "../routing/route-trie.js";
 import { extractRawRoutePatternParams, matchRoutePatternPrefix, matchRoutePatternRaw } from "../routing/route-pattern.js";
+import { getRenderedConcreteUrlPathsForRoute } from "./pregenerated-concrete-paths.js";
 import { canonicalizeAppPageParams } from "./app-page-segment-state.js";
 //#region src/server/app-rsc-route-matching.ts
 /**
@@ -13,10 +14,19 @@ const SIBLING_PAGE_INTERCEPT_SLOT_KEY = "__vinext_page_intercept";
 function createRouteParams() {
 	return Object.create(null);
 }
-function appRscPathnameParts(pathname, isNormalized = false) {
+/**
+* Whether each encoded raw segment is exactly the spelling the URL parser, as
+* a browser runs it, gives its decoded form: `caf%C3%A9` for `café`, but `q&a`
+* for `q&a`. `%61dmin`, `caf%c3%a9`, `%63af%C3%A9` and `q%26a` are other
+* spellings of a page, which middleware never compared as its pathname.
+*/
+function isCanonicalPathEncoding(rawParts, decodedParts) {
+	return rawParts.every((rawPart, index) => !rawPart.includes("%") || rawPart === new URL(`/${decodedParts[index]}`, "http://n").pathname.slice(1));
+}
+function appRscPathnameParts(pathname) {
 	const pathOnly = pathname.split("?")[0];
 	const normalizedPathname = pathOnly === "/" ? "/" : pathOnly.replace(/\/$/, "");
-	return isNormalized ? splitPathSegments(normalizedPathname) : splitPathnameForRouteMatch(normalizedPathname);
+	return splitPathSegments(normalizedPathname);
 }
 function isAppRouteHandlerRoute(route) {
 	return route.routeHandler != null || typeof route.__loadRouteHandler === "function";
@@ -49,8 +59,10 @@ function createAppRscRouteMatcher(routes, decodedPathnamePatterns = []) {
 		const result = matchRawRequestParts(rawParts);
 		if (!result) return null;
 		if (decodedPathnameRoutes.size > 0 && result.route.patternParts.some((part) => part.startsWith(":")) && !isAppRouteHandlerRoute(result.route) && rawParts.some((part) => part.includes("%"))) {
-			const route = decodedPathnameRoutes.get(rawParts.map(decodeRouteSegment).join("/"));
-			if (route && route !== result.route) return {
+			const decodedParts = rawParts.map(decodeRouteSegment);
+			const decodedPathname = decodedParts.join("/");
+			const route = decodedPathnameRoutes.get(decodedPathname);
+			if (route && route !== result.route && (isCanonicalPathEncoding(rawParts, decodedParts) || getRenderedConcreteUrlPathsForRoute(route.pattern)?.has(`/${decodedPathname}`) === true)) return {
 				route,
 				params: createRouteParams()
 			};
@@ -62,23 +74,18 @@ function createAppRscRouteMatcher(routes, decodedPathnamePatterns = []) {
 			return interceptionIds.has(interceptionId);
 		},
 		matchRoute(url) {
-			const rawParts = appRscPathnameParts(url, true);
-			const result = trieMatchRaw(routeTrie, appRscPathnameParts(url, false));
-			if (!result) return null;
-			result.params = extractRawRoutePatternParams(result.route.patternParts, rawParts);
-			normalizeMatchedParamsForRoute(result);
-			return result;
+			return matchRequestParts(appRscPathnameParts(url));
 		},
 		matchRequestRoute(url) {
-			return matchRequestParts(appRscPathnameParts(url, true));
+			return matchRequestParts(appRscPathnameParts(url));
 		},
 		matchRawRequestRoute(url) {
-			return matchRawRequestParts(appRscPathnameParts(url, true));
+			return matchRawRequestParts(appRscPathnameParts(url));
 		},
 		findIntercept(pathname, sourcePathname = null, interceptionId = null) {
 			if (sourcePathname === null) return null;
-			const urlParts = appRscPathnameParts(pathname, true);
-			const sourceParts = appRscPathnameParts(sourcePathname, true);
+			const urlParts = appRscPathnameParts(pathname);
+			const sourceParts = appRscPathnameParts(sourcePathname);
 			const matchedSourceRoute = matchRawRequestParts(sourceParts);
 			for (const entry of interceptLookup) {
 				if (interceptionId !== null && entry.interceptionId !== interceptionId) continue;
@@ -92,15 +99,21 @@ function createAppRscRouteMatcher(routes, decodedPathnamePatterns = []) {
 				if (sourceRoute && isAppRouteHandlerRoute(sourceRoute)) continue;
 				const matchedSourceParams = concreteSourceRoute ? concreteSourceRoute.params : sourceRoute ? matchSlotOwnerSourceParams(sourceParts, sourceRoute.patternParts, entry.sourceMatchPatternParts !== null) : null;
 				if (!concreteSourceRoute && matchedSourceParams) canonicalizeAppPageParams(matchedSourceParams);
+				const ownerRoute = routes[entry.sourceRouteIndex];
+				const rendersOwnerRoute = entry.ownerIsInterceptingRoute && concreteSourceRouteIndex !== entry.sourceRouteIndex && ownerRoute !== void 0;
+				const renderedSourceParams = rendersOwnerRoute ? matchSlotOwnerSourceParams(sourceParts, ownerRoute.patternParts, true) : matchedSourceParams;
+				if (rendersOwnerRoute && renderedSourceParams) canonicalizeAppPageParams(renderedSourceParams);
 				if (matchedSourceParams === null && entry.sourceMatchPatternParts === null) continue;
-				const sourceParams = matchedSourceParams && entry.sourceMatchPatternParts !== null ? pickPatternParams(matchedSourceParams, entry.sourceMatchPatternParts) : matchedSourceParams ?? createRouteParams();
+				const sourceParams = renderedSourceParams && entry.sourceMatchPatternParts !== null ? pickPatternParams(renderedSourceParams, entry.sourceMatchPatternParts) : renderedSourceParams ?? createRouteParams();
 				return {
 					...entry,
 					page: entry.__loadState.page,
 					sourceRouteIsConcrete: concreteSourceRoute !== null,
-					sourceRouteIndex: concreteSourceRouteIndex,
+					sourceRouteIndex: rendersOwnerRoute ? entry.sourceRouteIndex : concreteSourceRouteIndex,
 					matchedParams: mergeMatchedParams(sourceParams, params),
-					sourceMatchedParams: matchedSourceParams ?? createRouteParams()
+					sourceMatchedParams: renderedSourceParams ?? createRouteParams(),
+					authorizationSourceRouteIndex: concreteSourceRouteIndex,
+					authorizationSourceParams: matchedSourceParams ?? createRouteParams()
 				};
 			}
 			return null;
@@ -108,6 +121,15 @@ function createAppRscRouteMatcher(routes, decodedPathnamePatterns = []) {
 	};
 }
 /**
+* Whether a sibling intercept's owner route is the intercepting route: its
+* page lives in the directory that holds the interception marker. An owner
+* found elsewhere stands in for a marker directory without a page.
+*/
+function isInterceptingRoute(routeSegments, sourcePageSegments) {
+	if (!routeSegments || !sourcePageSegments) return false;
+	return sourcePageSegments.findIndex((segment) => /^\(\.+\)/.test(segment)) === routeSegments.length && routeSegments.every((segment, index) => segment === sourcePageSegments[index]);
+}
+/**
 * Params for the slot owner when interception falls back to it instead of a
 * concrete descendant source route. The owner is what renders, and
 * `matchInterceptRoute` reads the promoted route's params solely from these,
@@ -195,6 +217,7 @@ function createInterceptLookup(routes) {
 					interceptionId: typeof slotModule.id === "string" && sourceMatchPattern !== null ? createAppRouteGraphInterceptionId(slotModule.id, sourceMatchPattern, intercept.targetPattern) : null,
 					interceptionGraphId: null,
 					sourceRouteIndex: ownerRouteIndex,
+					ownerIsInterceptingRoute: false,
 					slotKey,
 					slotId: typeof slotModule.id === "string" ? slotModule.id : null,
 					targetRouteGraphId: resolveTargetRouteGraphId(intercept.targetPattern),
@@ -246,6 +269,7 @@ function createInterceptLookup(routes) {
 				interceptionId: typeof intercept.id === "string" ? intercept.id : null,
 				interceptionGraphId: typeof intercept.id === "string" ? intercept.id : null,
 				sourceRouteIndex: routeIndex,
+				ownerIsInterceptingRoute: !isAppRouteHandlerRoute(route) && isInterceptingRoute(route.routeSegments, intercept.sourcePageSegments),
 				slotKey: SIBLING_PAGE_INTERCEPT_SLOT_KEY,
 				slotId: typeof intercept.slotId === "string" ? intercept.slotId : null,
 				targetRouteGraphId: resolveTargetRouteGraphId(intercept.targetPattern),

package/dist/server/app-server-action-execution.js

@@ -12,6 +12,7 @@ import { attachRequestCfMetadata, validateCsrfOrigin, validateServerActionPayloa
 import { splitPathSegments } from "../routing/utils.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
 import { logRequestError } from "./request-error-log.js";
+import { SERVER_ACTION_CACHE_CONTROL, applyCdnResponseHeaders } from "./cache-control.js";
 import { shareIsolatePromise } from "./isolate-shared-promise.js";
 import { APP_RSC_RENDER_MODE_NAVIGATION } from "./app-rsc-render-mode.js";
 import { isDraftModeRequest, setHeadersContext } from "../shims/headers.js";
@@ -21,17 +22,18 @@ import { readStreamAsTextWithLimit } from "../utils/text-stream.js";
 import { mergeMiddlewareResponseHeaders } from "./middleware-response-headers.js";
 import { VINEXT_RSC_CONTENT_TYPE, applyRscCompatibilityIdHeader, createRscRequestUrl, stripRscCacheBustingSearchParam } from "./app-rsc-cache-busting.js";
 import { getSetCookieName } from "./cookie-utils.js";
+import { markAppRscResponseConfigHeadersApplied, markStreamedActionRedirectResponse } from "./app-rsc-response-finalizer.js";
 import { createServerActionNotFoundResponse, getServerActionNotFoundMessage, isServerActionNotFoundError } from "./server-action-not-found.js";
 import { applyEdgeRuntimeHeader } from "./app-page-response.js";
 import { getNextErrorDigest, parseNextHttpErrorDigest, parseNextRedirectDigest } from "./next-error-digest.js";
-import { hasDigest } from "./app-rsc-errors.js";
-import { resolveAppPageNavigationParams } from "./app-page-element-builder.js";
+import { resolveAppPageNavigationParams } from "./app-page-navigation-params.js";
 import "./app-page-stream.js";
+import { hasDigest } from "./app-rsc-errors.js";
 import { buildAppPageTags } from "./implicit-tags.js";
+import { resolveAppPageInterceptSegmentConfig } from "./app-page-intercept-segment-config.js";
 import { resolveAppPageActionRerenderTarget } from "./app-page-request.js";
 import { createRootParamsUsageController, runWithRootParamsUsage } from "../shims/root-params.js";
 import { createStaticGenerationHeadersContext } from "./app-static-generation.js";
-import { markAppRscResponseConfigHeadersApplied } from "./app-rsc-response-finalizer.js";
 //#region src/server/app-server-action-execution.ts
 /**
 * Run a server-reference load or decode outside every request scope.
@@ -659,7 +661,7 @@ async function handleProgressiveServerActionRequest(options) {
 				options.clearRequestContext();
 				const headers = new Headers();
 				mergeMiddlewareResponseHeaders(headers, options.middlewareHeaders);
-				headers.set("Cache-Control", "no-cache, no-store, max-age=0, must-revalidate");
+				headers.set("Cache-Control", SERVER_ACTION_CACHE_CONTROL);
 				for (const cookie of actionPendingCookies) headers.append("Set-Cookie", cookie);
 				if (actionDraftCookie) headers.append("Set-Cookie", actionDraftCookie);
 				return internalServerErrorResponse(process.env.NODE_ENV === "production" ? void 0 : "Server action failed: " + getServerActionFailureMessage(actionError), { headers });
@@ -879,6 +881,7 @@ async function handleServerActionRscRequest(options) {
 			applyEdgeRuntimeHeader(redirectHeaders, options.isEdgeRuntime);
 			mergeActionRedirectSourceHeaders(redirectHeaders, options.sourceConfigHeaders ?? null);
 			mergeActionRedirectSourceHeaders(redirectHeaders, options.middlewareHeaders);
+			applyCdnResponseHeaders(redirectHeaders, { cacheControl: SERVER_ACTION_CACHE_CONTROL });
 			applyRscCompatibilityIdHeader(redirectHeaders);
 			const actionRedirectUrl = applyActionRedirectBasePath(actionRedirect.url, options.basePath ?? "");
 			redirectHeaders.set(ACTION_REDIRECT_HEADER, actionRedirectUrl);
@@ -938,10 +941,10 @@ async function handleServerActionRscRequest(options) {
 				targetPathname,
 				targetRoute: targetMatch?.route ?? null
 			}) ? 200 : 303;
-			return markAppRscResponseConfigHeadersApplied(createServerActionRscResponse(targetResponse.body, {
+			return markStreamedActionRedirectResponse(markAppRscResponseConfigHeadersApplied(createServerActionRscResponse(targetResponse.body, {
 				status: redirectResponseStatus,
 				headers: redirectHeaders
-			}, options.clearRequestContext));
+			}, options.clearRequestContext)));
 		}
 		const actionPendingCookies = dedupePendingCookies(options.getAndClearPendingCookies());
 		const actionDraftCookie = options.getDraftModeCookieHeader();
@@ -976,6 +979,7 @@ async function handleServerActionRscRequest(options) {
 		let element;
 		let errorPattern = match ? match.route.pattern : options.cleanPathname;
 		let renderedPathAndSearch = null;
+		let actionRerenderIsEdgeRuntime = options.isEdgeRuntime;
 		const actionRerenderIsRscRequest = true;
 		if (match) {
 			const { route: actionRoute, params: actionParams } = match;
@@ -991,7 +995,9 @@ async function handleServerActionRscRequest(options) {
 			});
 			const resolvedActionNavigationParams = resolveAppPageNavigationParams(actionRerenderTarget.route, actionRerenderTarget.navigationParams, options.cleanPathname, actionRerenderTarget.interceptOpts);
 			await options.ensureRouteLoaded?.(actionRerenderTarget.route);
-			const actionRerenderDynamicConfig = options.resolveRouteDynamicConfig?.(actionRerenderTarget.route);
+			const actionInterceptConfig = actionRerenderTarget.interceptOpts ? resolveAppPageInterceptSegmentConfig(actionRerenderTarget.route, actionRerenderTarget.interceptOpts) : null;
+			if (actionInterceptConfig) actionRerenderIsEdgeRuntime = actionInterceptConfig.isEdgeRuntime;
+			const actionRerenderDynamicConfig = actionInterceptConfig ? actionInterceptConfig.dynamicConfig : options.resolveRouteDynamicConfig?.(actionRerenderTarget.route);
 			const actionRerenderSearchParams = prepareActionPageRerenderContext({
 				draftModeCookie: actionDraftCookie,
 				draftModeSecret: options.draftModeSecret,
@@ -1007,8 +1013,8 @@ async function handleServerActionRscRequest(options) {
 			});
 			const renderedSearch = options.searchParams.toString();
 			renderedPathAndSearch = renderedSearch ? `${options.cleanPathname}?${renderedSearch}` : options.cleanPathname;
-			setCurrentFetchCacheMode(options.resolveRouteFetchCacheMode?.(actionRerenderTarget.route) ?? null);
-			setCurrentFetchRevalidate(options.resolveRouteRevalidateSeconds?.(actionRerenderTarget.route) ?? null);
+			setCurrentFetchCacheMode(actionInterceptConfig ? actionInterceptConfig.fetchCacheMode : options.resolveRouteFetchCacheMode?.(actionRerenderTarget.route) ?? null);
+			setCurrentFetchRevalidate(actionInterceptConfig ? actionInterceptConfig.revalidateSeconds : options.resolveRouteRevalidateSeconds?.(actionRerenderTarget.route) ?? null);
 			setCurrentForceDynamicFetchDefault(actionRerenderDynamicConfig === "force-dynamic");
 			setCurrentFetchSoftTags(buildServerActionPageTags(actionRerenderTarget.route, options.cleanPathname));
 			const buildActionRerenderElement = () => options.buildPageElement({
@@ -1047,7 +1053,7 @@ async function handleServerActionRscRequest(options) {
 			"Content-Type": VINEXT_RSC_CONTENT_TYPE,
 			Vary: VINEXT_RSC_VARY_HEADER
 		});
-		applyEdgeRuntimeHeader(actionHeaders, options.isEdgeRuntime);
+		applyEdgeRuntimeHeader(actionHeaders, actionRerenderIsEdgeRuntime);
 		mergeMiddlewareResponseHeaders(actionHeaders, options.middlewareHeaders);
 		applyRscCompatibilityIdHeader(actionHeaders);
 		setActionRevalidatedHeader(actionHeaders, actionRevalidationKind);

package/dist/server/app-ssr-entry.js

@@ -32,6 +32,7 @@ import { createRenderStreamCancellation, isAppRenderAbortError } from "./app-ren
 import { runWithRootParamsScope } from "../shims/root-params.js";
 import { runWithNavigationContext } from "../shims/navigation-state.js";
 import { startCandidateSearchParamsGate } from "./app-ssr-search-params-gate.js";
+import { isSrvxAbsoluteFormTarget } from "./srvx-request-target.js";
 import { withAppRouterTree } from "../shims/app-router-tree-context.js";
 import { BeforeInteractiveContext } from "../shims/before-interactive-context.js";
 import { renderBeforeInteractiveInlineScripts } from "./before-interactive-head.js";
@@ -230,6 +231,12 @@ async function handleSsr(rscStream, navContext, fontData, options) {
 						fetchPriority: "low",
 						nonce: options?.scriptNonce
 					});
+					for (const moduleUrl of pagesClientAssets.appBootstrapPreloadModules ?? []) preloadModule(moduleUrl, {
+						as: "script",
+						crossOrigin: assetCrossOrigin,
+						fetchPriority: "low",
+						nonce: options?.scriptNonce
+					});
 					if (pagesClientAssets.appRouteManifestModule) preloadModule(pagesClientAssets.appRouteManifestModule, {
 						as: "script",
 						crossOrigin: assetCrossOrigin,
@@ -420,6 +427,7 @@ async function handleSsr(rscStream, navContext, fontData, options) {
 	});
 }
 var app_ssr_entry_default = { async fetch(request) {
+	if (isSrvxAbsoluteFormTarget(request)) return notFoundResponse();
 	const url = new URL(request.url);
 	const slashRedirect = repeatedSlashRedirectResponse(url.pathname + url.search);
 	if (slashRedirect) return slashRedirect;

package/dist/server/cache-control.d.ts

@@ -1,6 +1,8 @@
 import { CdnCacheableHeaderInput, isNonCacheableCacheControl } from "../shims/cdn-cache.js";
 //#region src/server/cache-control.d.ts
 export declare const NEVER_CACHE_CONTROL = "private, no-cache, no-store, max-age=0, must-revalidate";
+/** The policy Next.js sends on every Server Action response. */
+export declare const SERVER_ACTION_CACHE_CONTROL = "no-cache, no-store, max-age=0, must-revalidate";
 export declare const BROWSER_REVALIDATE_CACHE_CONTROL = "public, max-age=0, must-revalidate";
 export declare const STATIC_CACHE_CONTROL = "s-maxage=31536000, stale-while-revalidate";
 export declare const NO_STORE_CACHE_CONTROL = "no-store, must-revalidate";

package/dist/server/cache-control.js

@@ -2,6 +2,8 @@ import { getCdnCacheAdapter, isNonCacheableCacheControl } from "../shims/cdn-cac
 import { recordRouteCacheabilityCdnTags } from "../shims/cacheability-classification.js";
 //#region src/server/cache-control.ts
 const NEVER_CACHE_CONTROL = "private, no-cache, no-store, max-age=0, must-revalidate";
+/** The policy Next.js sends on every Server Action response. */
+const SERVER_ACTION_CACHE_CONTROL = "no-cache, no-store, max-age=0, must-revalidate";
 const BROWSER_REVALIDATE_CACHE_CONTROL = "public, max-age=0, must-revalidate";
 const STATIC_CACHE_CONTROL = "s-maxage=31536000, stale-while-revalidate";
 const STALE_REVALIDATE_CACHE_CONTROL = "s-maxage=0, stale-while-revalidate";
@@ -167,4 +169,4 @@ function buildCachedRevalidateCacheControl(cacheState, revalidateSeconds, expire
 	return buildRevalidateCacheControl(revalidateSeconds, expireSeconds);
 }
 //#endregion
-export { BROWSER_REVALIDATE_CACHE_CONTROL, NEVER_CACHE_CONTROL, NO_STORE_CACHE_CONTROL, STATIC_CACHE_CONTROL, applyCdnResponseBuildIdentityHeaders, applyCdnResponseHeaders, applyCdnResponseIdentityHeaders, buildCachedRevalidateCacheControl, buildRevalidateCacheControl, captureCdnResponsePolicyHeaders, captureCdnResponsePolicyOverrides, hasCdnResponsePolicy, hasExplicitNonCacheableResponsePolicy, isCdnResponsePolicyHeader, isNonCacheableCacheControl, isNonCacheableCdnResponsePolicy, readCdnResponseCacheControl, readCdnResponsePolicyHeaderName, reconcileCdnResponseHeadersAfterOuterPolicy, shouldUseNextDeployCacheControl, validateCdnRequest };
+export { BROWSER_REVALIDATE_CACHE_CONTROL, NEVER_CACHE_CONTROL, NO_STORE_CACHE_CONTROL, SERVER_ACTION_CACHE_CONTROL, STATIC_CACHE_CONTROL, applyCdnResponseBuildIdentityHeaders, applyCdnResponseHeaders, applyCdnResponseIdentityHeaders, buildCachedRevalidateCacheControl, buildRevalidateCacheControl, captureCdnResponsePolicyHeaders, captureCdnResponsePolicyOverrides, hasCdnResponsePolicy, hasExplicitNonCacheableResponsePolicy, isCdnResponsePolicyHeader, isNonCacheableCacheControl, isNonCacheableCdnResponsePolicy, readCdnResponseCacheControl, readCdnResponsePolicyHeaderName, reconcileCdnResponseHeadersAfterOuterPolicy, shouldUseNextDeployCacheControl, validateCdnRequest };

package/dist/server/config-headers.d.ts

@@ -3,6 +3,7 @@ import { RequestContext } from "../config/request-context.js";
 import { BasePathMatchState } from "../config/config-matchers.js";
 import { HeaderRecord } from "./request-pipeline.js";
 //#region src/server/config-headers.d.ts
+export type RouteHandlerRuntime = "node" | "edge";
 export type ResponseStageCachePolicyOptions = {
   basePathState?: BasePathMatchState;
   configHeaders: NextHeader[];
@@ -34,6 +35,12 @@ type ApplyConfigHeadersOptions = {
   middlewareHeaders?: Headers | null;
   /** Whether this composition participates in response-cache admission. */
   recordCacheability?: boolean;
+  /**
+   * Set when a Route Handler produced the response. Next.js copies a Node
+   * handler's headers only where config left none, and appends an edge
+   * handler's after config. Cache policy headers keep their own rules.
+   */
+  routeHandlerRuntime?: RouteHandlerRuntime;
 };
 /** Apply matched next.config.js headers to a Web Headers object. */
 export declare function applyConfigHeadersToResponse(responseHeaders: Headers, options: ApplyConfigHeadersOptions): void;

package/dist/server/config-headers.js

@@ -5,6 +5,15 @@ import { isCdnResponsePolicyHeader, isNonCacheableCdnResponsePolicy } from "./ca
 import { mergeVaryHeader } from "./middleware-response-headers.js";
 //#region src/server/config-headers.ts
 const ADDITIVE_CONFIG_HEADER_NAMES = /* @__PURE__ */ new Set(["set-cookie", "vary"]);
+const ROUTE_HANDLER_APPENDED_HEADER_NAMES = /* @__PURE__ */ new Set(["www-authenticate", "proxy-authenticate"]);
+/**
+* Next.js sets x-nextjs-cache over config only on the responses its cache
+* manages, which vinext marks with x-vinext-cache too. A Route Handler's own
+* x-nextjs-cache meets config like any other header.
+*/
+function isFrameworkCacheStateHeader(headers, lowerName) {
+	return lowerName === "X-Vinext-Cache".toLowerCase() || lowerName === "x-nextjs-cache" && headers.has("X-Vinext-Cache");
+}
 /**
 * Resolve positive config cache policy that must accompany an inner artifact.
 * The request stage evaluates every condition. Shared stage transports must key
@@ -77,6 +86,7 @@ function applyConfigHeadersToResponse(responseHeaders, options) {
 	const matched = retainLastSingularConfigValues(matchHeaders(options.pathname, options.configHeaders, options.requestContext, options.basePathState, options.recordCacheability === false ? void 0 : markConditionalConfigHeaderCacheability));
 	if (options.recordCacheability !== false) markExplicitConfigResponseVeto(matched);
 	const configCookies = [];
+	const configVary = [];
 	for (const header of matched) {
 		const lowerName = header.key.toLowerCase();
 		if (lowerName === "x-vinext-special-error-status") continue;
@@ -86,9 +96,18 @@ function applyConfigHeadersToResponse(responseHeaders, options) {
 			const postConfigLink = options.appendToPostConfigLink ? responseHeaders.get(lowerName) : null;
 			responseHeaders.set(header.key, postConfigLink ? `${header.value}, ${postConfigLink}` : header.value);
 		} else if (!ADDITIVE_CONFIG_HEADER_NAMES.has(lowerName) && options.middlewareHeaders?.has(lowerName)) continue;
-		else if (lowerName === "vary") mergeVaryHeader(responseHeaders, header.value);
+		else if (lowerName === "vary") configVary.push(header.value);
 		else if (ADDITIVE_CONFIG_HEADER_NAMES.has(lowerName)) responseHeaders.append(header.key, header.value);
 		else if ((typeof options.overwriteExisting === "function" ? options.overwriteExisting(lowerName) : options.overwriteExisting?.has(lowerName)) || !responseHeaders.has(lowerName)) responseHeaders.set(header.key, header.value);
+		else if (options.routeHandlerRuntime && !isFrameworkCacheStateHeader(responseHeaders, lowerName) && !isCdnResponsePolicyHeader(lowerName)) {
+			const handlerValue = responseHeaders.get(lowerName);
+			responseHeaders.set(header.key, handlerValue !== header.value && (options.routeHandlerRuntime === "edge" || ROUTE_HANDLER_APPENDED_HEADER_NAMES.has(lowerName)) ? `${header.value}, ${handlerValue}` : header.value);
+		}
+	}
+	if (configVary.length > 0) {
+		const routeHandlerVary = options.routeHandlerRuntime ? responseHeaders.get("vary") : null;
+		if (routeHandlerVary) responseHeaders.delete("vary");
+		for (const value of [...configVary, ...routeHandlerVary ? [routeHandlerVary] : []]) mergeVaryHeader(responseHeaders, value);
 	}
 	if (configCookies.length > 0 && !options.middlewareHeaders?.get("set-cookie")) {
 		const responseCookies = responseHeaders.getSetCookie();

package/dist/server/image-animation.d.ts

@@ -0,0 +1,9 @@
+import { ImageSourceReader } from "./image-source-reader.js";
+//#region src/server/image-animation.d.ts
+/**
+ * Whether a source is an animated GIF, PNG or WebP, judged by its signature.
+ * The source is parsed as it streams in, so only the bytes a format's check
+ * needs are read, and none are kept beyond what the reader holds to replay.
+ */
+export declare function isAnimatedImage(source: ImageSourceReader): Promise<boolean>;
+//#endregion

package/dist/server/image-animation.js

@@ -0,0 +1,118 @@
+//#region src/server/image-animation.ts
+const PNG_SIGNATURE = [
+	137,
+	80,
+	78,
+	71,
+	13,
+	10,
+	26,
+	10
+];
+const WEBP_FOURCC = [
+	87,
+	69,
+	66,
+	80
+];
+const WEBP_ANIM_CHUNK = [
+	65,
+	78,
+	73,
+	77
+];
+function bytesAt(bytes, offset, expected) {
+	return expected.every((byte, index) => bytes[offset + index] === byte);
+}
+function ascii(bytes, start, end) {
+	return String.fromCharCode(...bytes.subarray(start, end));
+}
+/** Length of a run of GIF data sub-blocks, including its zero terminator. */
+async function gifDataBlocksLength(source, offset) {
+	let length = 0;
+	for (;;) {
+		const size = await source.byte(offset + length) ?? 0;
+		if (size === 0) return length + 1;
+		length += size + 1;
+	}
+}
+async function isAnimatedGif(source, head) {
+	let hasColorTable = head[10] & 128;
+	let colorTableSize = head[10] & 7;
+	let offset = 13 + (hasColorTable ? 3 * 2 ** (colorTableSize + 1) : 0);
+	let frames = 0;
+	while (frames < 2) switch (await source.byte(offset) ?? 59) {
+		case 44: {
+			frames += 1;
+			const flags = await source.byte(offset + 9) ?? 0;
+			hasColorTable = flags & 128;
+			colorTableSize = flags & 7;
+			offset += 10 + (hasColorTable ? 3 * 2 ** (colorTableSize + 1) : 0);
+			offset += await gifDataBlocksLength(source, offset + 1) + 1;
+			break;
+		}
+		case 33:
+			offset += 2;
+			offset += await gifDataBlocksLength(source, offset);
+			break;
+		default: return false;
+	}
+	return true;
+}
+/** An APNG has an `acTL` chunk before its first `IDAT`, and `fdAT` frames after. */
+async function isAnimatedPng(source) {
+	let hasAnimationControl = false;
+	let hasImageData = false;
+	let hasFrameData = false;
+	let previousChunk = null;
+	let offset = 8;
+	for (;;) {
+		const header = await source.bytes(offset, 8);
+		if (header.byteLength < 8) break;
+		const length = new DataView(header.buffer).getUint32(0);
+		const chunk = ascii(header, 4, 8);
+		switch (chunk) {
+			case "acTL":
+				hasAnimationControl = true;
+				break;
+			case "IDAT":
+				if (!hasAnimationControl) return false;
+				if (previousChunk !== "fcTL" && previousChunk !== "IDAT") return false;
+				hasImageData = true;
+				break;
+			case "fdAT":
+				if (!hasImageData) return false;
+				if (previousChunk !== "fcTL" && previousChunk !== "fdAT") return false;
+				hasFrameData = true;
+		}
+		previousChunk = chunk;
+		offset += 12 + length;
+	}
+	return hasAnimationControl && hasImageData && hasFrameData;
+}
+/** Bytes of a WebP source searched per read. */
+const WEBP_SCAN_STEP = 65536;
+/** Like is-animated, any `ANIM` in a WebP source marks it animated. */
+async function isAnimatedWebp(source) {
+	const first = WEBP_ANIM_CHUNK[0];
+	const readLength = WEBP_SCAN_STEP + WEBP_ANIM_CHUNK.length - 1;
+	for (let start = 0;; start += WEBP_SCAN_STEP) {
+		const bytes = await source.bytes(start, readLength);
+		for (let offset = 0; offset < bytes.length; offset++) if (bytes[offset] === first && bytesAt(bytes, offset, WEBP_ANIM_CHUNK)) return true;
+		if (bytes.length < readLength) return false;
+	}
+}
+/**
+* Whether a source is an animated GIF, PNG or WebP, judged by its signature.
+* The source is parsed as it streams in, so only the bytes a format's check
+* needs are read, and none are kept beyond what the reader holds to replay.
+*/
+async function isAnimatedImage(source) {
+	const head = await source.bytes(0, 12);
+	if (ascii(head, 0, 3) === "GIF") return isAnimatedGif(source, head);
+	if (bytesAt(head, 0, PNG_SIGNATURE)) return isAnimatedPng(source);
+	if (bytesAt(head, 8, WEBP_FOURCC)) return isAnimatedWebp(source);
+	return false;
+}
+//#endregion
+export { isAnimatedImage };