vinext 1.4.2 → 1.4.4

package/dist/server/app-rsc-handler.d.ts

@@ -26,6 +26,8 @@ type RunAppMiddlewareOptions = {
   isDataRequest: boolean;
   middlewareRequest?: Request;
   request: Request;
+  /** `shouldRestoreLocaleRootTrailingSlash` for the raw request pathname. */
+  restoreLocaleRootTrailingSlash?: boolean;
   validateExternalRewriteRequest: () => Promise<Response | null>;
 };
 export type AppRscHandlerRoute = {
@@ -186,6 +188,8 @@ type RenderPagesFallbackOptions = {
   pathname?: string;
   pagesDataRequest?: Request | null;
   request: Request;
+  /** The basePath `request.url` still carries, removed before the page renders. */
+  requestBasePath?: string;
   /** The shared cache entry answers every host; a request-time render is not stored. */
   sharedAcrossHosts?: boolean;
   url: URL;

package/dist/server/app-rsc-handler.js

@@ -15,12 +15,13 @@ import { patternToNextFormat } from "../routing/route-validation.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
 import { runOutsideWorkStoreScope } from "../shims/internal/work-store-scope.js";
 import { isInterceptionMatchedUrlPath, normalizePath } from "./normalize-path.js";
-import { normalizeDefaultLocalePathname, shouldRestoreLocaleRootTrailingSlash } from "./pages-i18n.js";
+import { isLocaleRedirect, normalizeDefaultLocalePathname, shouldRestoreLocaleRootTrailingSlash } from "./pages-i18n.js";
 import { buildNextDataNotFoundResponse, normalizePagesDataRequest } from "./pages-data-route.js";
 import { markRouteCacheabilityDynamic, preserveRouteCacheabilityResponsePolicy } from "../shims/cacheability-classification.js";
 import { NEVER_CACHE_CONTROL, SERVER_ACTION_CACHE_CONTROL, applyCdnResponseHeaders, captureCdnResponsePolicyOverrides, isCdnResponsePolicyHeader, reconcileCdnResponseHeadersAfterOuterPolicy } from "./cache-control.js";
 import { isOnDemandRevalidateRequest } from "./revalidation-request.js";
 import { getDraftModeCookieHeader, getEffectiveRequestCookieHeader, getHeadersContext, hasEffectiveRequestCookieChanges, headersContextFromRequest, isDraftModeEnabled, isDraftModeRequest, runWithHeadersContext } from "../shims/headers.js";
+import { normalizePathTrailingSlash } from "../shims/url-utils.js";
 import { mergeRewriteQuery } from "../utils/query.js";
 import { getScriptNonceFromHeaderSources } from "./csp.js";
 import { traceFindPageComponents } from "./pages-execution-tracing.js";
@@ -31,9 +32,11 @@ import { openForwardedMiddlewareContext } from "./forwarded-middleware-context.j
 import { consumeResponseStageLinkProvenance, copyLinkHeaderProvenance } from "./app-response-header-provenance.js";
 import { setFrameworkRequestRoute, traceFrameworkRequest } from "./request-tracing.js";
 import { mergeMiddlewareResponseHeaders, mergeMiddlewareResponseHeadersOntoResponse, withExternalRewriteResponseHeaders } from "./middleware-response-headers.js";
-import { VINEXT_RSC_CACHE_BUSTING_SEARCH_PARAM, canonicalizeLoadingShellRscRequestHeaders, canonicalizePrewarmableRscRequestHeaders, createCanonicalRscRequestUrl, createRscRedirectLocation, createRscRequestUrl, hasRscCacheBustingSearchParam, resolveInvalidRscCacheBustingRequest, stripRscCacheBustingSearchParam } from "./app-rsc-cache-busting.js";
+import { VINEXT_RSC_CACHE_BUSTING_SEARCH_PARAM, canonicalizeDynamicShellRscRequestHeaders, canonicalizeLoadingShellRscRequestHeaders, canonicalizePrewarmableRscRequestHeaders, createCanonicalRscRequestUrl, createRscRedirectLocation, createRscRequestUrl, hasRscCacheBustingSearchParam, resolveInvalidRscCacheBustingRequest, stripRscCacheBustingSearchParam } from "./app-rsc-cache-busting.js";
 import { matchPrerenderRouteParamsPayload, readTrustedPrerenderRouteParams, serializePrerenderRouteParamsHeader } from "./prerender-route-params.js";
-import { applyAppRscConfigHeaders, finalizeAppRscResponse, isStreamedActionRedirectResponse, markAppRscResponseConfigHeadersApplied, markStreamedActionRedirectResponse } from "./app-rsc-response-finalizer.js";
+import { flattenErrorCauses } from "../utils/error-cause.js";
+import { pickRootParams, setRootParams } from "../shims/root-params.js";
+import { applyAppRscConfigHeaders, finalizeAppRscResponse, isStreamedActionRedirectResponse, markAppRscApplicationResponse, markAppRscResponseConfigHeadersApplied, markAppRscRouteHandlerResponse, markStreamedActionRedirectResponse } from "./app-rsc-response-finalizer.js";
 import { createServerActionNotFoundResponse, getServerActionNotFoundMessage } from "./server-action-not-found.js";
 import { isPossibleAppRouteActionRequest } from "./app-action-request.js";
 import "./app-page-response.js";
@@ -44,10 +47,8 @@ import { traceAppPageRender } from "./app-page-tracing.js";
 import { normalizeInterceptionContextHeader } from "./app-interception-context-header.js";
 import { buildPageCacheTags } from "./implicit-tags.js";
 import { buildPostMwRequestContext } from "./app-post-middleware-context.js";
-import { pickRootParams, setRootParams } from "../shims/root-params.js";
 import { createRouteTreePrefetchResponse, isRouteTreePrefetchRequest } from "./app-route-tree-prefetch.js";
 import { createSharedAppCacheIdentity, createSharedAppPageCacheIdentity, createSharedAppRouteCacheIdentity, createSharedHybridPagesCacheIdentity, isStaticCandidateAppPageDispatch, prepareSharedAppPageDispatch, withoutAppPageDispatchQuery } from "./app-worker-stages.js";
-import { flattenErrorCauses } from "../utils/error-cause.js";
 import { normalizeRscRequest } from "./app-rsc-request-normalization.js";
 import { hasPagesPreviewCookie } from "./pages-response-stage.js";
 import { runWithPrerenderWorkUnit } from "./prerender-work-unit-setup.js";
@@ -442,6 +443,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			isDataRequest: isMiddlewareDataRequest,
 			middlewareRequest: isolatedMiddlewareRequest,
 			request: userlandRequest,
+			restoreLocaleRootTrailingSlash,
 			validateExternalRewriteRequest: () => validateClaimedOutsideBasePathRsc(true)
 		});
 		if (!dispatchResponseStage && middlewareResult.pathnameEligible) markRouteCacheabilityDynamic(middlewareResult.matched ? "middleware matched this request" : "middleware is eligible for this pathname");
@@ -499,19 +501,28 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		const responseStagePolicy = await loadResponseStagePolicy();
 		const cache = responseStageProbeMode || isOnDemandRevalidate || (props.kind === "app-page" || props.kind === "app-route-handler") && (props.bypassInterceptionContextCache || props.forceDynamic === true && responseStagePolicy === null) ? "bypass" : canUseSharedWorkerResponseStage ? "shared" : "bypass";
 		let dispatchRequest = props.kind === "app-page" ? prepareSharedAppPageDispatch(stageRequest, cache) : stageRequest;
+		let dispatchProps = props;
 		let canonicalRsc = null;
 		if (cache === "shared" && props.kind === "app-page" && props.isRscRequest && (props.matchKind === "request" || props.matchKind === "resolved") && props.interceptionContext === null && props.interceptionId === null && props.mountedSlotsHeader === null) {
 			const headers = new Headers(dispatchRequest.headers);
-			if (props.renderMode === "navigation" ? canonicalizePrewarmableRscRequestHeaders(headers) : props.renderMode === "prefetch-loading-shell" && props.canUseCanonicalLoadingShell ? canonicalizeLoadingShellRscRequestHeaders(headers) : false) {
+			if (props.renderMode === "navigation" ? canonicalizePrewarmableRscRequestHeaders(headers) : props.renderMode === "prefetch-loading-shell" && props.canUseCanonicalLoadingShell ? canonicalizeLoadingShellRscRequestHeaders(headers) : props.renderMode === "prefetch-dynamic-shell" ? canonicalizeDynamicShellRscRequestHeaders(headers) : false) {
 				canonicalRsc = {
 					headers,
-					navigation: props.renderMode === "navigation"
+					navigation: props.renderMode !== "prefetch-loading-shell"
 				};
 				dispatchRequest = cloneRequestWithHeaders(dispatchRequest, headers);
+				if (props.renderMode === "prefetch-dynamic-shell") {
+					const queryFree = withoutAppPageDispatchQuery(dispatchRequest.url, {
+						...props,
+						renderMode: "navigation"
+					});
+					dispatchRequest = cloneRequestWithUrl(dispatchRequest, queryFree.url);
+					dispatchProps = queryFree.props;
+				}
 			}
 		}
 		let stageProps = {
-			...props,
+			...dispatchProps,
 			cacheability: {
 				...props.cacheability,
 				policyHeaders: responseStagePolicy
@@ -579,7 +590,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		}
 		return options.handleMetadataRouteRequest?.(cleanPathname, metadataRoutePathname) ?? null;
 	};
-	const applyConfigHeadersToResponseStage = async (response, preserveExistingPolicy = false) => {
+	const applyConfigHeadersToResponseStage = async (response, preserveExistingPolicy = false, routeHandlerRuntime) => {
 		const headers = new Headers(response.headers);
 		copyLinkHeaderProvenance(response.headers, headers);
 		await applyAppRscConfigHeaders(headers, request, {
@@ -590,7 +601,8 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			middlewareHeaders: middlewareContext.headers,
 			overwriteExisting: preserveExistingPolicy ? /* @__PURE__ */ new Set() : isCdnResponsePolicyHeader,
 			recordCacheability: dispatchResponseStage === void 0,
-			requestContext: preMiddlewareRequestContext
+			requestContext: preMiddlewareRequestContext,
+			routeHandlerRuntime
 		});
 		return preserveFullyBufferedBodyMetadata(response, new Response(response.body, {
 			headers,
@@ -616,10 +628,10 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	})();
 	let outerResponsePolicyPromise;
 	const loadOuterResponsePolicy = () => outerResponsePolicyPromise ??= Promise.all([loadPreHandlerResponseHeaders(), loadResponseStagePolicy()]).then(([headers, responseStagePolicy]) => captureCdnResponsePolicyOverrides(headers, new Headers(responseStagePolicy ?? [])));
-	const composeResponseStageResponse = async (response) => {
+	const composeResponseStageResponse = async (response, routeHandlerRuntime) => {
 		const transportedLink = consumeResponseStageLinkProvenance(response);
 		response = transportedLink.response;
-		response = await applyConfigHeadersToResponseStage(response, Boolean(dispatchResponseStage || options.renderResponseStageLocally));
+		response = await applyConfigHeadersToResponseStage(response, Boolean(dispatchResponseStage || options.renderResponseStageLocally), routeHandlerRuntime);
 		response = applyMiddlewareContextToResponse(response, middlewareContext, transportedLink.appendToPostConfigLink);
 		reconcileCdnResponseHeadersAfterOuterPolicy(response.headers, await loadOuterResponsePolicy());
 		return markAppRscResponseConfigHeadersApplied(response);
@@ -770,6 +782,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 					hadBasePath: resolvedPathnameHasBasePath,
 					isDataRequest: isMiddlewareDataRequest,
 					request: sourceMiddlewareRequest,
+					restoreLocaleRootTrailingSlash: shouldRestoreLocaleRootTrailingSlash(normalizePathTrailingSlash(sourceUrlPathname, options.trailingSlash ?? false), options),
 					validateExternalRewriteRequest: () => validateClaimedOutsideBasePathRsc(true)
 				}));
 			} finally {
@@ -778,6 +791,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			}
 			if (!dispatchResponseStage && sourceMiddlewareResult.pathnameEligible) markRouteCacheabilityDynamic(sourceMiddlewareResult.matched ? "middleware matched this request" : "middleware is eligible for this pathname");
 			if (sourceMiddlewareResult.kind === "response") {
+				if (request.body && !request.body.locked) request.body.cancel().catch(() => {});
 				options.clearRequestContext();
 				return sourceMiddlewareResult.response;
 			}
@@ -913,7 +927,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			request,
 			routeMatch
 		});
-		if (progressiveActionResult instanceof Response) return markServerActionResponse(progressiveActionResult);
+		if (progressiveActionResult instanceof Response) return markServerActionResponse(markAppRscApplicationResponse(progressiveActionResult));
 		if (progressiveActionResult?.kind !== "form-state") return null;
 		if ("actionError" in progressiveActionResult && middlewareContext.status === null && progressiveActionHttpFallbackStatus(progressiveActionResult.actionError) === null) middlewareContext.status = 500;
 		return progressiveActionResult;
@@ -998,23 +1012,24 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			pathname: pagesRouteUrl,
 			pagesDataRequest,
 			request,
+			requestBasePath: hadBasePath ? options.basePath : "",
 			url
 		})) ?? null : null;
 		if (response) preserveRouteCacheabilityResponsePolicy();
 		if (!response) return null;
 		if (sharedOuterPolicyNeedsReconciliation) reconcileCdnResponseHeadersAfterOuterPolicy(response.headers, await loadOuterResponsePolicy());
+		const markPagesResponse = (pagesResponse) => dispatchPagesResponseStage ? markAppRscResponseConfigHeadersApplied(pagesResponse) : isLocaleRedirect(response) ? pagesResponse : markAppRscApplicationResponse(pagesResponse);
 		const isRewritten = resolvedUrl !== originalResolvedUrl;
 		const isPrerender = typeof process !== "undefined" && process.env?.VINEXT_PRERENDER === "1";
-		if ((!pagesDataRequest || !isRewritten) && !isPrerender) return dispatchPagesResponseStage ? markAppRscResponseConfigHeadersApplied(response) : response;
+		if ((!pagesDataRequest || !isRewritten) && !isPrerender) return markPagesResponse(response);
 		const headers = new Headers(response.headers);
 		if (pagesDataRequest && isRewritten) headers.set("x-nextjs-rewrite", resolvedUrl);
 		if (isPrerender) headers.set(VINEXT_PRERENDER_REWRITTEN_HEADER, isRewritten ? "1" : "0");
-		const markedResponse = new Response(response.body, {
+		return markPagesResponse(new Response(response.body, {
 			headers,
 			status: response.status,
 			statusText: response.statusText
-		});
-		return dispatchPagesResponseStage ? markAppRscResponseConfigHeadersApplied(markedResponse) : markedResponse;
+		}));
 	};
 	const staticPagesFallbackResponse = await renderPagesForMatchKind("static");
 	if (staticPagesFallbackResponse) {
@@ -1198,7 +1213,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			route: null,
 			scriptNonce
 		}));
-		if (renderedNotFoundResponse) return withUnmatchedRouteCacheControl(renderedNotFoundResponse);
+		if (renderedNotFoundResponse) return markAppRscApplicationResponse(withUnmatchedRouteCacheControl(renderedNotFoundResponse));
 		options.clearRequestContext();
 		const headers = new Headers();
 		mergeMiddlewareResponseHeaders(headers, middlewareContext.headers);
@@ -1249,9 +1264,10 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 	const rootParams = pickRootParams(renderParams, route.rootParamNames);
 	setRootParams(rootParams);
 	if (route.routeHandler) {
-		const routeHandlerRequest = isEdgeRouteHandler(route.routeHandler) ? userlandRequest : request;
+		const routeHandlerRuntime = isEdgeRouteHandler(route.routeHandler) ? "edge" : "node";
+		const routeHandlerRequest = routeHandlerRuntime === "edge" ? userlandRequest : request;
 		const routeHandlerUrl = new URL(routeHandlerRequest.url);
-		const internalRscValues = isEdgeRouteHandler(route.routeHandler) ? [] : routeHandlerUrl.searchParams.getAll(VINEXT_RSC_CACHE_BUSTING_SEARCH_PARAM);
+		const internalRscValues = routeHandlerRuntime === "edge" ? [] : routeHandlerUrl.searchParams.getAll(VINEXT_RSC_CACHE_BUSTING_SEARCH_PARAM);
 		routeHandlerUrl.search = resolvedSearchParams.toString();
 		for (const internalRscValue of internalRscValues) routeHandlerUrl.searchParams.append(VINEXT_RSC_CACHE_BUSTING_SEARCH_PARAM, internalRscValue);
 		if (matchedResponseStage) return composeResponseStageResponse(await matchedResponseStage(responseStageRequest(), {
@@ -1279,10 +1295,10 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			routePattern: route.pattern,
 			routePathname: responseStageRoutePathname,
 			scriptNonce: scriptNonce ?? null
-		}));
+		}), routeHandlerRuntime);
 		const { setCurrentFetchSoftTags } = await import("../shims/fetch-cache.js");
 		setCurrentFetchSoftTags(buildPageCacheTags(cleanPathname, [], [...route.routeSegments], "route"));
-		return options.dispatchMatchedRouteHandler({
+		const routeHandlerResponse = await options.dispatchMatchedRouteHandler({
 			bypassInterceptionContextCache,
 			cachePathname,
 			cleanPathname,
@@ -1292,6 +1308,7 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 			route,
 			searchParams: resolvedSearchParams
 		});
+		return markAppRscRouteHandlerResponse(routeHandlerResponse, routeHandlerRuntime);
 	}
 	const failedProgressiveActionResult = progressiveActionFormState && "actionError" in progressiveActionFormState ? progressiveActionFormState : null;
 	const actionHttpFallbackStatus = failedProgressiveActionResult ? progressiveActionHttpFallbackStatus(failedProgressiveActionResult.actionError) : null;
@@ -1354,8 +1371,8 @@ async function handleAppRscRequest(options, request, preMiddlewareRequestContext
 		searchParams: resolvedSearchParams,
 		renderMode
 	}), isRscRequest && request.headers.get("Next-Router-Prefetch") === "1" && request.headers.has("Next-Router-Segment-Prefetch"));
-	if (progressiveActionFormState) return markServerActionResponse(applyProgressiveActionSideEffects(pageResponse, progressiveActionFormState));
-	return pageResponse;
+	if (progressiveActionFormState) return markServerActionResponse(markAppRscApplicationResponse(applyProgressiveActionSideEffects(pageResponse, progressiveActionFormState)));
+	return markAppRscApplicationResponse(pageResponse);
 }
 function progressiveActionHttpFallbackStatus(actionError) {
 	const actionErrorDigest = actionError && typeof actionError === "object" && "digest" in actionError ? String(actionError.digest) : null;

package/dist/server/app-rsc-response-finalizer.d.ts

@@ -1,5 +1,6 @@
 import { NextHeader, NextI18nConfig } from "../config/next-config.js";
 import { RequestContext } from "../config/request-context.js";
+import { RouteHandlerRuntime } from "./config-headers.js";
 //#region src/server/app-rsc-response-finalizer.d.ts
 type FinalizeAppRscResponseOptions = {
   basePath: string;
@@ -29,12 +30,23 @@ type FinalizeAppRscResponseOptions = {
   middlewareHeaders?: Headers | null;
   /** Whether config matching should update the active cacheability classification. */
   recordCacheability?: boolean;
+  /** The runtime of the Route Handler that produced the response, if one did. */
+  routeHandlerRuntime?: RouteHandlerRuntime;
 };
 /** Mark a response whose final target pipeline has already applied config headers. */
 export declare function markAppRscResponseConfigHeadersApplied(response: Response): Response;
 /** Mark a Server Action redirect that streams its target's render, and so keeps its policy. */
 export declare function markStreamedActionRedirectResponse(response: Response): Response;
 export declare function isStreamedActionRedirectResponse(response: Response): boolean;
+/**
+ * Mark a response that a page, Route Handler, Server Action or Pages route
+ * produced. Next.js stages next.config headers before application code runs,
+ * so the redirects these return carry them. Redirects that routing answers
+ * itself (next.config redirects, trailing slash, middleware) go out without.
+ */
+export declare function markAppRscApplicationResponse(response: Response): Response;
+/** Mark a response a Route Handler produced, so its own headers meet config as in Next.js. */
+export declare function markAppRscRouteHandlerResponse(response: Response, runtime: RouteHandlerRuntime): Response;
 /** Apply only the matching next.config headers for an App Router request. */
 export declare function applyAppRscConfigHeaders(headers: Headers, request: Request, options: FinalizeAppRscResponseOptions): Promise<void>;
 /**
@@ -45,9 +57,9 @@ export declare function applyAppRscConfigHeaders(headers: Headers, request: Requ
  * handling, so that every response path (page, route handler, server action,
  * metadata, not-found) gets headers applied consistently.
  *
- * Skips 3xx redirect responses. Response.redirect() creates immutable
- * headers that throw on mutation, and Next.js does not apply config headers
- * to redirects regardless.
+ * Skips 3xx responses that routing answered itself, as Next.js does not
+ * apply config headers to those. A 3xx that application code returned is
+ * finalized like any other response.
  */
 export declare function finalizeAppRscResponse(response: Response, request: Request, options: FinalizeAppRscResponseOptions): Promise<Response>;
 //#endregion

package/dist/server/app-rsc-response-finalizer.js

@@ -1,3 +1,4 @@
+import { preserveFullyBufferedBodyMetadata } from "./fully-buffered-response.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
 import { VINEXT_RSC_VARY_HEADER } from "./app-rsc-vary.js";
 import { sanitizeMethodNotAllowedHeaders } from "./http-error-responses.js";
@@ -6,12 +7,14 @@ import { normalizeDefaultLocalePathname } from "./pages-i18n.js";
 import { isNonCacheableCacheControl } from "../shims/cdn-cache.js";
 import { captureRouteCacheabilityResponsePolicy } from "../shims/cacheability-classification.js";
 import { NO_STORE_CACHE_CONTROL, applyCdnResponseHeaders, captureCdnResponsePolicyHeaders, hasExplicitNonCacheableResponsePolicy, isCdnResponsePolicyHeader } from "./cache-control.js";
-import { hasPostConfigLinkHeaders } from "./app-response-header-provenance.js";
+import { copyLinkHeaderProvenance, hasPostConfigLinkHeaders } from "./app-response-header-provenance.js";
 import { mergeVaryHeader } from "./middleware-response-headers.js";
 import "./app-rsc-cache-busting.js";
 //#region src/server/app-rsc-response-finalizer.ts
 const HAS_CONFIG_HEADERS = process.env.__VINEXT_HAS_CONFIG_HEADERS !== "false";
 const configHeadersAlreadyApplied = /* @__PURE__ */ new WeakSet();
+const applicationResponses = /* @__PURE__ */ new WeakSet();
+const routeHandlerResponses = /* @__PURE__ */ new WeakMap();
 function normalizeExplicitNonCacheablePolicy(headers) {
 	if (!hasExplicitNonCacheableResponsePolicy(headers)) return;
 	const cacheControl = headers.get("Cache-Control");
@@ -34,6 +37,39 @@ function markStreamedActionRedirectResponse(response) {
 function isStreamedActionRedirectResponse(response) {
 	return streamedActionRedirects.has(response);
 }
+/**
+* Mark a response that a page, Route Handler, Server Action or Pages route
+* produced. Next.js stages next.config headers before application code runs,
+* so the redirects these return carry them. Redirects that routing answers
+* itself (next.config redirects, trailing slash, middleware) go out without.
+*/
+function markAppRscApplicationResponse(response) {
+	applicationResponses.add(response);
+	return response;
+}
+/** Mark a response a Route Handler produced, so its own headers meet config as in Next.js. */
+function markAppRscRouteHandlerResponse(response, runtime) {
+	routeHandlerResponses.set(response, runtime);
+	return markAppRscApplicationResponse(response);
+}
+/** Response.redirect() creates immutable headers; copy them only when needed. */
+function withMutableHeaders(response) {
+	const probe = "x-vinext-mutable-headers-probe";
+	const probeValue = response.headers.get(probe);
+	try {
+		if (probeValue === null) response.headers.delete(probe);
+		else response.headers.set(probe, probeValue);
+		return response;
+	} catch {
+		const headers = new Headers(response.headers);
+		copyLinkHeaderProvenance(response.headers, headers);
+		return preserveFullyBufferedBodyMetadata(response, new Response(response.body, {
+			headers,
+			status: response.status,
+			statusText: response.statusText
+		}));
+	}
+}
 /** Apply only the matching next.config headers for an App Router request. */
 async function applyAppRscConfigHeaders(headers, request, options) {
 	if (!HAS_CONFIG_HEADERS || !options.configHeaders.length) return;
@@ -57,6 +93,7 @@ async function applyAppRscConfigHeaders(headers, request, options) {
 		appendToPostConfigLink: hasPostConfigLinkHeaders(headers),
 		middlewareHeaders: options.middlewareHeaders,
 		recordCacheability: options.recordCacheability,
+		routeHandlerRuntime: options.routeHandlerRuntime,
 		overwriteExisting: options.overwriteExisting ?? isCdnResponsePolicyHeader
 	});
 }
@@ -68,12 +105,16 @@ async function applyAppRscConfigHeaders(headers, request, options) {
 * handling, so that every response path (page, route handler, server action,
 * metadata, not-found) gets headers applied consistently.
 *
-* Skips 3xx redirect responses. Response.redirect() creates immutable
-* headers that throw on mutation, and Next.js does not apply config headers
-* to redirects regardless.
+* Skips 3xx responses that routing answered itself, as Next.js does not
+* apply config headers to those. A 3xx that application code returned is
+* finalized like any other response.
 */
 async function finalizeAppRscResponse(response, request, options) {
-	if (response.status >= 300 && response.status < 400) return response;
+	const routeHandlerRuntime = routeHandlerResponses.get(response);
+	if (response.status >= 300 && response.status < 400) {
+		if (!applicationResponses.has(response) || configHeadersAlreadyApplied.has(response)) return response;
+		response = withMutableHeaders(response);
+	}
 	if (!isStaticFileSignal(response)) {
 		const varyHeader = response.headers.get("Vary");
 		if (varyHeader === null) response.headers.set("Vary", VINEXT_RSC_VARY_HEADER);
@@ -88,10 +129,13 @@ async function finalizeAppRscResponse(response, request, options) {
 		normalizeExplicitNonCacheablePolicy(response.headers);
 		return response;
 	}
-	await applyAppRscConfigHeaders(response.headers, request, options);
+	await applyAppRscConfigHeaders(response.headers, request, {
+		...options,
+		routeHandlerRuntime
+	});
 	normalizeExplicitNonCacheablePolicy(response.headers);
 	if (response.status === 405 && response.headers.get("Allow") === "GET, HEAD") sanitizeMethodNotAllowedHeaders(response.headers, "GET, HEAD");
 	return response;
 }
 //#endregion
-export { applyAppRscConfigHeaders, finalizeAppRscResponse, isStreamedActionRedirectResponse, markAppRscResponseConfigHeadersApplied, markStreamedActionRedirectResponse };
+export { applyAppRscConfigHeaders, finalizeAppRscResponse, isStreamedActionRedirectResponse, markAppRscApplicationResponse, markAppRscResponseConfigHeadersApplied, markAppRscRouteHandlerResponse, markStreamedActionRedirectResponse };

package/dist/server/app-rsc-response-stage.js

@@ -11,9 +11,9 @@ import { ensureFetchPatch, setCurrentFetchSoftTags } from "../shims/fetch-cache.
 import { traceFindPageComponents } from "./pages-execution-tracing.js";
 import { getRenderedConcreteUrlPathsForRoute } from "./pregenerated-concrete-paths.js";
 import { VINEXT_RSC_CACHE_BUSTING_SEARCH_PARAM, hasRscCacheBustingSearchParam, stripRscCacheBustingSearchParam } from "./app-rsc-cache-busting.js";
+import { pickRootParams, setRootParams } from "../shims/root-params.js";
 import { traceAppPageRender } from "./app-page-tracing.js";
 import { buildPageCacheTags } from "./implicit-tags.js";
-import { pickRootParams, setRootParams } from "../shims/root-params.js";
 import "./app-worker-stages.js";
 import { normalizeRscRequest } from "./app-rsc-request-normalization.js";
 import { runWithPrerenderWorkUnit } from "./prerender-work-unit-setup.js";

package/dist/server/app-server-action-execution.js

@@ -22,6 +22,7 @@ import { readStreamAsTextWithLimit } from "../utils/text-stream.js";
 import { mergeMiddlewareResponseHeaders } from "./middleware-response-headers.js";
 import { VINEXT_RSC_CONTENT_TYPE, applyRscCompatibilityIdHeader, createRscRequestUrl, stripRscCacheBustingSearchParam } from "./app-rsc-cache-busting.js";
 import { getSetCookieName } from "./cookie-utils.js";
+import { createRootParamsUsageController, runWithRootParamsUsage } from "../shims/root-params.js";
 import { markAppRscResponseConfigHeadersApplied, markStreamedActionRedirectResponse } from "./app-rsc-response-finalizer.js";
 import { createServerActionNotFoundResponse, getServerActionNotFoundMessage, isServerActionNotFoundError } from "./server-action-not-found.js";
 import { applyEdgeRuntimeHeader } from "./app-page-response.js";
@@ -32,7 +33,6 @@ import { hasDigest } from "./app-rsc-errors.js";
 import { buildAppPageTags } from "./implicit-tags.js";
 import { resolveAppPageInterceptSegmentConfig } from "./app-page-intercept-segment-config.js";
 import { resolveAppPageActionRerenderTarget } from "./app-page-request.js";
-import { createRootParamsUsageController, runWithRootParamsUsage } from "../shims/root-params.js";
 import { createStaticGenerationHeadersContext } from "./app-static-generation.js";
 //#region src/server/app-server-action-execution.ts
 /**

package/dist/server/app-ssr-entry.js

@@ -13,27 +13,28 @@ import { getClientTraceMetadataHTML, markClientTraceMetadataBlock } from "./clie
 import { setPagesClientAssets } from "./pages-client-assets.js";
 import { RSC_FORM_STATE_GLOBAL } from "../client/browser-globals.js";
 import { createNavigationRuntimeRenderedSearchScript, createNavigationRuntimeRscCompatibilityScript, createNavigationRuntimeRscMetadataScript, createRscEmbedTransform, createTickBufferedTransform, rewriteInlineCssStylesheetLinks, waitAtLeastOneReactRenderTask } from "./app-ssr-stream.js";
-import { AppElementsWire } from "./app-elements-wire.js";
-import "./app-elements.js";
-import { createInitialBfcacheMaps } from "./app-bfcache-identity.js";
-import { isBailoutToCSRError, isDynamicServerError } from "../shims/navigation-errors.js";
+import { withAppRouterTree } from "../shims/app-router-tree-context.js";
+import { BeforeInteractiveContext } from "../shims/before-interactive-context.js";
+import { runWithRootParamsScope } from "../shims/root-params.js";
+import { CAUGHT_NOT_FOUND_BOUNDARIES_GLOBAL, withCaughtNotFoundBoundaries } from "../shims/caught-not-found-boundaries.js";
 import { ServerInsertedHTMLContext, clearServerInsertedHTML, getBfcacheIdMapContext, registerServerInsertedHTMLCallback, renderServerInsertedHTML, setNavigationContext } from "../shims/navigation-context-state.js";
+import { isBailoutToCSRError, isDynamicServerError } from "../shims/navigation-errors.js";
 import "../shims/navigation-server.js";
+import { AppElementsWire } from "./app-elements-wire.js";
+import "./app-elements.js";
 import { BfcacheIdentityMapContext } from "../shims/slot.js";
-import { createAppRouteTree } from "./app-route-tree.js";
 import DefaultGlobalError from "../shims/default-global-error.js";
-import { CAUGHT_NOT_FOUND_BOUNDARIES_GLOBAL, withCaughtNotFoundBoundaries } from "../shims/caught-not-found-boundaries.js";
+import { runWithNavigationContext } from "../shims/navigation-state.js";
+import { createInitialBfcacheMaps } from "./app-bfcache-identity.js";
+import { createAppRouteTree } from "./app-route-tree.js";
 import { ssrServerConsumerManifest } from "./app-client-reference-manifest.js";
 import { createClientReferencePreloader, resolveRouteClientReferences } from "./app-client-reference-preloader.js";
 import { getNextErrorDigest } from "./next-error-digest.js";
 import { createSsrErrorMetaRenderer } from "./app-ssr-error-meta.js";
 import { createClientPageSsrSearchParamsSource } from "./app-page-search-params-observation.js";
 import { createRenderStreamCancellation, isAppRenderAbortError } from "./app-render-abort-error.js";
-import { runWithRootParamsScope } from "../shims/root-params.js";
-import { runWithNavigationContext } from "../shims/navigation-state.js";
 import { startCandidateSearchParamsGate } from "./app-ssr-search-params-gate.js";
-import { withAppRouterTree } from "../shims/app-router-tree-context.js";
-import { BeforeInteractiveContext } from "../shims/before-interactive-context.js";
+import { isSrvxAbsoluteFormTarget } from "./srvx-request-target.js";
 import { renderBeforeInteractiveInlineScripts } from "./before-interactive-head.js";
 import { createInitialDevServerErrorScript } from "./dev-initial-server-error.js";
 import { createStreamedClientReferences, renderStreamedStylesheets, resetStreamedClientReferences, runWithStreamedClientReferences, wrapClientReferenceRequire } from "./app-streamed-client-references.js";
@@ -230,6 +231,12 @@ async function handleSsr(rscStream, navContext, fontData, options) {
 						fetchPriority: "low",
 						nonce: options?.scriptNonce
 					});
+					for (const moduleUrl of pagesClientAssets.appBootstrapPreloadModules ?? []) preloadModule(moduleUrl, {
+						as: "script",
+						crossOrigin: assetCrossOrigin,
+						fetchPriority: "low",
+						nonce: options?.scriptNonce
+					});
 					if (pagesClientAssets.appRouteManifestModule) preloadModule(pagesClientAssets.appRouteManifestModule, {
 						as: "script",
 						crossOrigin: assetCrossOrigin,
@@ -420,6 +427,7 @@ async function handleSsr(rscStream, navContext, fontData, options) {
 	});
 }
 var app_ssr_entry_default = { async fetch(request) {
+	if (isSrvxAbsoluteFormTarget(request)) return notFoundResponse();
 	const url = new URL(request.url);
 	const slashRedirect = repeatedSlashRedirectResponse(url.pathname + url.search);
 	if (slashRedirect) return slashRedirect;

package/dist/server/config-headers.d.ts

@@ -3,6 +3,7 @@ import { RequestContext } from "../config/request-context.js";
 import { BasePathMatchState } from "../config/config-matchers.js";
 import { HeaderRecord } from "./request-pipeline.js";
 //#region src/server/config-headers.d.ts
+export type RouteHandlerRuntime = "node" | "edge";
 export type ResponseStageCachePolicyOptions = {
   basePathState?: BasePathMatchState;
   configHeaders: NextHeader[];
@@ -34,6 +35,12 @@ type ApplyConfigHeadersOptions = {
   middlewareHeaders?: Headers | null;
   /** Whether this composition participates in response-cache admission. */
   recordCacheability?: boolean;
+  /**
+   * Set when a Route Handler produced the response. Next.js copies a Node
+   * handler's headers only where config left none, and appends an edge
+   * handler's after config. Cache policy headers keep their own rules.
+   */
+  routeHandlerRuntime?: RouteHandlerRuntime;
 };
 /** Apply matched next.config.js headers to a Web Headers object. */
 export declare function applyConfigHeadersToResponse(responseHeaders: Headers, options: ApplyConfigHeadersOptions): void;

package/dist/server/config-headers.js

@@ -5,6 +5,15 @@ import { isCdnResponsePolicyHeader, isNonCacheableCdnResponsePolicy } from "./ca
 import { mergeVaryHeader } from "./middleware-response-headers.js";
 //#region src/server/config-headers.ts
 const ADDITIVE_CONFIG_HEADER_NAMES = /* @__PURE__ */ new Set(["set-cookie", "vary"]);
+const ROUTE_HANDLER_APPENDED_HEADER_NAMES = /* @__PURE__ */ new Set(["www-authenticate", "proxy-authenticate"]);
+/**
+* Next.js sets x-nextjs-cache over config only on the responses its cache
+* manages, which vinext marks with x-vinext-cache too. A Route Handler's own
+* x-nextjs-cache meets config like any other header.
+*/
+function isFrameworkCacheStateHeader(headers, lowerName) {
+	return lowerName === "X-Vinext-Cache".toLowerCase() || lowerName === "x-nextjs-cache" && headers.has("X-Vinext-Cache");
+}
 /**
 * Resolve positive config cache policy that must accompany an inner artifact.
 * The request stage evaluates every condition. Shared stage transports must key
@@ -77,6 +86,7 @@ function applyConfigHeadersToResponse(responseHeaders, options) {
 	const matched = retainLastSingularConfigValues(matchHeaders(options.pathname, options.configHeaders, options.requestContext, options.basePathState, options.recordCacheability === false ? void 0 : markConditionalConfigHeaderCacheability));
 	if (options.recordCacheability !== false) markExplicitConfigResponseVeto(matched);
 	const configCookies = [];
+	const configVary = [];
 	for (const header of matched) {
 		const lowerName = header.key.toLowerCase();
 		if (lowerName === "x-vinext-special-error-status") continue;
@@ -86,9 +96,18 @@ function applyConfigHeadersToResponse(responseHeaders, options) {
 			const postConfigLink = options.appendToPostConfigLink ? responseHeaders.get(lowerName) : null;
 			responseHeaders.set(header.key, postConfigLink ? `${header.value}, ${postConfigLink}` : header.value);
 		} else if (!ADDITIVE_CONFIG_HEADER_NAMES.has(lowerName) && options.middlewareHeaders?.has(lowerName)) continue;
-		else if (lowerName === "vary") mergeVaryHeader(responseHeaders, header.value);
+		else if (lowerName === "vary") configVary.push(header.value);
 		else if (ADDITIVE_CONFIG_HEADER_NAMES.has(lowerName)) responseHeaders.append(header.key, header.value);
 		else if ((typeof options.overwriteExisting === "function" ? options.overwriteExisting(lowerName) : options.overwriteExisting?.has(lowerName)) || !responseHeaders.has(lowerName)) responseHeaders.set(header.key, header.value);
+		else if (options.routeHandlerRuntime && !isFrameworkCacheStateHeader(responseHeaders, lowerName) && !isCdnResponsePolicyHeader(lowerName)) {
+			const handlerValue = responseHeaders.get(lowerName);
+			responseHeaders.set(header.key, handlerValue !== header.value && (options.routeHandlerRuntime === "edge" || ROUTE_HANDLER_APPENDED_HEADER_NAMES.has(lowerName)) ? `${header.value}, ${handlerValue}` : header.value);
+		}
+	}
+	if (configVary.length > 0) {
+		const routeHandlerVary = options.routeHandlerRuntime ? responseHeaders.get("vary") : null;
+		if (routeHandlerVary) responseHeaders.delete("vary");
+		for (const value of [...configVary, ...routeHandlerVary ? [routeHandlerVary] : []]) mergeVaryHeader(responseHeaders, value);
 	}
 	if (configCookies.length > 0 && !options.middlewareHeaders?.get("set-cookie")) {
 		const responseCookies = responseHeaders.getSetCookie();

package/dist/server/edge-api-runtime.d.ts

@@ -5,8 +5,12 @@ export type EdgeApiExecutionRuntime = "node" | "worker";
  * Remove wire-level body headers after Node's fetch implementation has decoded
  * an Edge API response. Next.js applies the same boundary in its edge sandbox.
  *
- * Workers keep the original response untouched: workerd preserves the encoded
- * body/header pair and can stream it directly to the client.
+ * Workers otherwise keep the original response untouched: workerd preserves
+ * the encoded body/header pair and can stream it directly to the client.
+ *
+ * Both runtimes drop `x-middleware-set-cookie`, the internal copy of the
+ * cookies that `NextResponse.cookies` keeps for middleware. Next.js's
+ * send-response never writes it to the client.
  */
 export declare function finalizeEdgeApiResponse(response: Response, runtime: EdgeApiExecutionRuntime): Response;
 //#endregion

package/dist/server/edge-api-runtime.js

@@ -1,3 +1,5 @@
+import { MIDDLEWARE_SET_COOKIE_HEADER } from "../utils/protocol-headers.js";
+import "./headers.js";
 //#region src/server/edge-api-runtime.ts
 function isEdgeApiRuntime(runtime) {
 	return runtime === "edge" || runtime === "experimental-edge";
@@ -11,13 +13,28 @@ const NODE_EDGE_RESPONSE_FORBIDDEN_HEADERS = [
 * Remove wire-level body headers after Node's fetch implementation has decoded
 * an Edge API response. Next.js applies the same boundary in its edge sandbox.
 *
-* Workers keep the original response untouched: workerd preserves the encoded
-* body/header pair and can stream it directly to the client.
+* Workers otherwise keep the original response untouched: workerd preserves
+* the encoded body/header pair and can stream it directly to the client.
+*
+* Both runtimes drop `x-middleware-set-cookie`, the internal copy of the
+* cookies that `NextResponse.cookies` keeps for middleware. Next.js's
+* send-response never writes it to the client.
 */
 function finalizeEdgeApiResponse(response, runtime) {
-	if (runtime === "worker") return response;
+	if (runtime === "worker") {
+		if (!response.headers.has("x-middleware-set-cookie")) return response;
+		try {
+			response.headers.delete(MIDDLEWARE_SET_COOKIE_HEADER);
+			return response;
+		} catch {
+			const copy = new Response(response.body, response);
+			copy.headers.delete(MIDDLEWARE_SET_COOKIE_HEADER);
+			return copy;
+		}
+	}
 	const headers = new Headers(response.headers);
-	let changed = false;
+	let changed = headers.has(MIDDLEWARE_SET_COOKIE_HEADER);
+	headers.delete(MIDDLEWARE_SET_COOKIE_HEADER);
 	for (const name of NODE_EDGE_RESPONSE_FORBIDDEN_HEADERS) {
 		if (!headers.has(name)) continue;
 		headers.delete(name);

package/dist/server/image-animation.d.ts

@@ -0,0 +1,9 @@
+import { ImageSourceReader } from "./image-source-reader.js";
+//#region src/server/image-animation.d.ts
+/**
+ * Whether a source is an animated GIF, PNG or WebP, judged by its signature.
+ * The source is parsed as it streams in, so only the bytes a format's check
+ * needs are read, and none are kept beyond what the reader holds to replay.
+ */
+export declare function isAnimatedImage(source: ImageSourceReader): Promise<boolean>;
+//#endregion