fix(cache): gate CDN admission on probed routes

packages/cloudflare/src/cache/cdn-adapter.runtime.ts

@@ -180,6 +180,8 @@ function formatCacheTag(tags: readonly string[]): string | null {
 }
 
 export class CloudflareCdnCacheAdapter implements CdnCacheAdapter {
+  readonly requiresCompletedResponseAdmission = true;
+
   constructor(
     private readonly versionMetadata?: WorkerVersionMetadata,
     private readonly versionMetadataBinding = DEFAULT_VERSION_METADATA_BINDING,
@@ -237,6 +239,14 @@ export class CloudflareCdnCacheAdapter implements CdnCacheAdapter {
   }
 
   buildResponseHeaders(input: CdnCacheableHeaderInput): CdnResponseHeaders {
+    // App Page MISS streams may discover request-bound dynamic APIs after the
+    // response object is created. Only the outer Worker admission boundary may
+    // replace this private policy after clean EOF; without that proof, the CDN
+    // must fail closed.
+    if (input.pendingDynamicCheck) {
+      return clearCloudflareCdnResponseHeaders(NO_STORE);
+    }
+
     // No cacheable policy → nobody stores it.
     if (!input.cacheControl) {
       return clearCloudflareCdnResponseHeaders(NO_STORE);

packages/vinext/src/config/config-matchers.ts

@@ -835,6 +835,7 @@ export function matchRedirect(
   redirects: NextRedirect[],
   ctx: RequestContext,
   basePathState: BasePathMatchState = _BASEPATH_DEFAULT,
+  onRuleSourceMatch?: (rule: NextRedirect) => void,
 ): { destination: string; permanent: boolean } | null {
   if (redirects.length === 0) return null;
 
@@ -875,6 +876,7 @@ export function matchRedirect(
         if (entry.originalIndex >= localeMatchIndex) continue; // already have a better match
         const redirect = entry.redirect;
         if (!shouldEvaluateRule(redirect.basePath, basePathState)) continue;
+        onRuleSourceMatch?.(redirect);
         const conditionParams =
           redirect.has || redirect.missing
             ? collectConditionParams(redirect.has, redirect.missing, ctx)
@@ -906,6 +908,7 @@ export function matchRedirect(
           if (!entry.altRe.test(localePart)) continue;
           const redirect = entry.redirect;
           if (!shouldEvaluateRule(redirect.basePath, basePathState)) continue;
+          onRuleSourceMatch?.(redirect);
           const conditionParams =
             redirect.has || redirect.missing
               ? collectConditionParams(redirect.has, redirect.missing, ctx)
@@ -936,6 +939,7 @@ export function matchRedirect(
     if (!shouldEvaluateRule(redirect.basePath, basePathState)) continue;
     const params = matchConfigPattern(pathname, redirect.source);
     if (params) {
+      onRuleSourceMatch?.(redirect);
       const conditionParams =
         redirect.has || redirect.missing
           ? collectConditionParams(redirect.has, redirect.missing, ctx)
@@ -968,11 +972,13 @@ export function matchRewrite(
   ctx: RequestContext,
   basePathState: BasePathMatchState = _BASEPATH_DEFAULT,
   paramsPathname: string = pathname,
+  onRuleSourceMatch?: (rule: NextRewrite) => void,
 ): string | null {
   for (const rewrite of rewrites) {
     if (!shouldEvaluateRule(rewrite.basePath, basePathState)) continue;
     const matchedParams = matchConfigPattern(pathname, rewrite.source);
     if (matchedParams) {
+      onRuleSourceMatch?.(rewrite);
       // App request routing matches against a segment-normalized pathname but
       // Next.js prepareDestination substitutes the encoded source captures.
       // Prefer those captures when the caller retained the encoded pathname.
@@ -1384,6 +1390,7 @@ export function matchHeaders(
   headers: NextHeader[],
   ctx: RequestContext,
   basePathState: BasePathMatchState = _BASEPATH_DEFAULT,
+  onRuleSourceMatch?: (rule: NextHeader) => void,
 ): Array<{ key: string; value: string }> {
   const pathnameHadTrailingSlash = pathname.length > 1 && pathname.endsWith("/");
   pathname = stripTrailingSlashForConfigMatch(pathname);
@@ -1400,6 +1407,7 @@ export function matchHeaders(
       safeRegExp("^" + escapeHeaderSource(source) + "$", "i"),
     );
     if (sourceRegex && sourceRegex.test(pathname)) {
+      onRuleSourceMatch?.(rule);
       if (rule.has || rule.missing) {
         if (!checkHasConditions(rule.has, rule.missing, ctx)) {
           continue;

packages/vinext/src/entries/app-rsc-entry.ts

@@ -301,6 +301,8 @@ import ${JSON.stringify(appRouteRequestBuiltInsPath)};`
     : ""
 }
 import ${JSON.stringify(serverGlobalsPath)};
+import __cacheabilityManifest from "virtual:vinext-cacheability-manifest";
+export { __cacheabilityManifest };
 import {
   renderToReadableStream as _renderToReadableStream,
   ${

packages/vinext/src/index.ts

@@ -1099,6 +1099,9 @@ const RESOLVED_PAGES_CLIENT_ASSETS = VIRTUAL_PREFIX + VIRTUAL_PAGES_CLIENT_ASSET
 // Virtual module IDs for App Router entries
 const VIRTUAL_RSC_ENTRY = "virtual:vinext-rsc-entry";
 const RESOLVED_RSC_ENTRY = VIRTUAL_PREFIX + VIRTUAL_RSC_ENTRY;
+const VIRTUAL_CACHEABILITY_MANIFEST = "virtual:vinext-cacheability-manifest";
+const RESOLVED_CACHEABILITY_MANIFEST = VIRTUAL_PREFIX + VIRTUAL_CACHEABILITY_MANIFEST;
+const CACHEABILITY_MANIFEST_MODULE = "__vinext_cacheability_manifest.js";
 const VIRTUAL_APP_SSR_ENTRY = "virtual:vinext-app-ssr-entry";
 const RESOLVED_APP_SSR_ENTRY = VIRTUAL_PREFIX + VIRTUAL_APP_SSR_ENTRY;
 const VIRTUAL_APP_BROWSER_ENTRY = "virtual:vinext-app-browser-entry";
@@ -3901,6 +3904,12 @@ export default function vinext(options: VinextOptions = {}): PluginOption[] {
           }
           // App Router virtual modules
           if (cleanId === VIRTUAL_RSC_ENTRY) return RESOLVED_RSC_ENTRY;
+          if (cleanId === VIRTUAL_CACHEABILITY_MANIFEST) {
+            if (this.environment?.name === "rsc" && this.environment.config?.command === "build") {
+              return { id: `./${CACHEABILITY_MANIFEST_MODULE}`, external: true };
+            }
+            return RESOLVED_CACHEABILITY_MANIFEST;
+          }
           if (cleanId === VIRTUAL_APP_SSR_ENTRY) return RESOLVED_APP_SSR_ENTRY;
           if (cleanId === VIRTUAL_APP_BROWSER_ENTRY) return RESOLVED_APP_BROWSER_ENTRY;
           if (cleanId === VIRTUAL_APP_CAPABILITIES) return RESOLVED_APP_CAPABILITIES;
@@ -4005,6 +4014,9 @@ export default function vinext(options: VinextOptions = {}): PluginOption[] {
             return `export default ${JSON.stringify(metadata)};`;
           }
           // App Router virtual modules
+          if (id === RESOLVED_CACHEABILITY_MANIFEST) {
+            return "export default null;";
+          }
           if (id === RESOLVED_RSC_ENTRY && hasAppDir) {
             const routes = await appRouter(appDir, nextConfig?.pageExtensions, fileMatcher);
             const metaRoutes = scanMetadataFiles(appDir);
@@ -4393,6 +4405,19 @@ export const loadServerActionClient = ${
         return null;
       },
     },
+    {
+      name: "vinext:cacheability-manifest-asset",
+      apply: "build",
+
+      generateBundle() {
+        if (this.environment?.name !== "rsc") return;
+        this.emitFile({
+          type: "asset",
+          fileName: CACHEABILITY_MANIFEST_MODULE,
+          source: "export default null;\n",
+        });
+      },
+    },
     {
       name: "vinext:css-url-assets-restore",
       enforce: "post",

packages/vinext/src/server/app-middleware.ts

@@ -54,13 +54,17 @@ export type ApplyAppMiddlewareResult =
       cleanPathname: string;
       /** Present on real middleware results; optional for older generated callers. */
       matched?: boolean;
+      /** True when this pathname can match middleware for some request context. */
+      pathnameEligible?: boolean;
       rewritten: boolean;
       search: string | null;
     }
   | {
       kind: "response";
       /** Present on real middleware results; optional for older generated callers. */
       matched?: boolean;
+      /** True when this pathname can match middleware for some request context. */
+      pathnameEligible?: boolean;
       response: Response;
     };
 
@@ -275,6 +279,7 @@ export async function applyAppMiddleware(
 ): Promise<ApplyAppMiddlewareResult> {
   const forwarded = applyForwardedMiddlewareContext(options.request, options.context);
   let matched = forwarded.applied;
+  let pathnameEligible = forwarded.applied;
   let cleanPathname = options.cleanPathname;
   let rewritten = false;
   let search: string | null = null;
@@ -288,6 +293,7 @@ export async function applyAppMiddleware(
           return {
             kind: "response",
             matched,
+            pathnameEligible,
             response: validationResponseWithMiddlewareHeaders(validationResponse, options.context),
           };
         }
@@ -296,6 +302,7 @@ export async function applyAppMiddleware(
         return {
           kind: "response",
           matched,
+          pathnameEligible,
           response: await proxyExternalMiddlewareRewrite(
             externalRequest,
             forwarded.rewriteUrl,
@@ -335,6 +342,9 @@ export async function applyAppMiddleware(
         onMatch() {
           matched = true;
         },
+        onPathMatch() {
+          pathnameEligible = true;
+        },
         requestBodyAlreadyIsolated: true,
         request: middlewareRequest,
         trailingSlash: options.trailingSlash,
@@ -349,12 +359,22 @@ export async function applyAppMiddleware(
     if (!result.continue) {
       cancelRequestBody(options.request);
       if (result.redirectUrl) {
-        return { kind: "response", matched, response: responseFromMiddlewareRedirect(result) };
+        return {
+          kind: "response",
+          matched,
+          pathnameEligible,
+          response: responseFromMiddlewareRedirect(result),
+        };
       }
       if (result.response) {
-        return { kind: "response", matched, response: result.response };
+        return { kind: "response", matched, pathnameEligible, response: result.response };
       }
-      return { kind: "response", matched, response: internalServerErrorResponse() };
+      return {
+        kind: "response",
+        matched,
+        pathnameEligible,
+        response: internalServerErrorResponse(),
+      };
     }
 
     if (result.responseHeaders) {
@@ -375,13 +395,15 @@ export async function applyAppMiddleware(
           return {
             kind: "response",
             matched,
+            pathnameEligible,
             response: validationResponseWithMiddlewareHeaders(validationResponse, options.context),
           };
         }
         const externalRequest = options.externalRewriteRequest ?? options.request;
         return {
           kind: "response",
           matched,
+          pathnameEligible,
           response: await proxyExternalMiddlewareRewrite(
             externalRequest,
             result.rewriteUrl,
@@ -408,5 +430,12 @@ export async function applyAppMiddleware(
     processMiddlewareHeaders(options.context.headers);
   }
 
-  return { kind: "continue", cleanPathname, matched, rewritten, search };
+  return {
+    kind: "continue",
+    cleanPathname,
+    matched,
+    pathnameEligible,
+    rewritten,
+    search,
+  };
 }

packages/vinext/src/server/app-page-cache-finalizer.ts

@@ -20,8 +20,9 @@ import { readStreamAsText } from "../utils/text-stream.js";
 import { markFrameworkLinkHeaders } from "./app-response-header-provenance.js";
 import { deferUntilStreamConsumed } from "./defer-until-stream-consumed.js";
 import {
+  captureRouteCacheabilityResponsePolicy,
   deferRouteCacheability,
-  isRouteCacheabilityProbe,
+  isRouteCacheabilityEvaluation,
   type RouteCacheabilityOutcome,
 } from "vinext/shims/cacheability-classification";
 
@@ -43,6 +44,16 @@ type BuildAppPageCacheRenderObservation = (input: {
   state: AppPageRenderObservationState;
 }) => RenderObservation;
 
+type FinalizeAppPageCacheabilityEvaluationOptions = {
+  capturedDynamicUsageBeforeContextCleanup?: () => boolean;
+  consumeDynamicUsage: () => boolean;
+  consumeRenderObservationState?: () => AppPageRenderObservationState;
+  getPageTags: () => string[];
+  getRequestCacheLife?: () => AppPageRequestCacheLife | null;
+  expireSeconds?: number;
+  revalidateSeconds: number | null;
+};
+
 type FinalizeAppPageHtmlCacheResponseOptions = {
   capturedDynamicUsageBeforeContextCleanup?: () => boolean;
   capturedRscDataPromise: Promise<ArrayBuffer> | null;
@@ -175,21 +186,14 @@ function appPageCacheControlHeader(cacheControl: CacheControlMetadata): string {
     : buildRevalidateCacheControl(cacheControl.revalidate, cacheControl.expire);
 }
 
-function finalizeProbeAppPageResponse(
+function finalizeEvaluatedAppPageResponse(
   response: Response,
-  options: {
-    capturedDynamicUsageBeforeContextCleanup?: () => boolean;
-    consumeDynamicUsage: () => boolean;
-    consumeRenderObservationState?: () => AppPageRenderObservationState;
-    getPageTags: () => string[];
-    getRequestCacheLife?: () => AppPageRequestCacheLife | null;
-    expireSeconds?: number;
-    revalidateSeconds: number | null;
-  },
+  options: FinalizeAppPageCacheabilityEvaluationOptions,
 ): Response | null {
-  if (!isRouteCacheabilityProbe()) return null;
+  if (!isRouteCacheabilityEvaluation()) return null;
   const complete = deferRouteCacheability();
   if (!complete) return response;
+  captureRouteCacheabilityResponsePolicy(response.headers);
 
   let completed = false;
   const finish = (): void => {
@@ -240,11 +244,22 @@ function finalizeProbeAppPageResponse(
   });
 }
 
+/**
+ * Complete probe/admission classification for an App Page response that does
+ * not enter the ISR cache-write path. Ordinary requests pass through unchanged.
+ */
+export function finalizeAppPageCacheabilityEvaluationResponse(
+  response: Response,
+  options: FinalizeAppPageCacheabilityEvaluationOptions,
+): Response {
+  return finalizeEvaluatedAppPageResponse(response, options) ?? response;
+}
+
 export function finalizeAppPageHtmlCacheResponse(
   response: Response,
   options: FinalizeAppPageHtmlCacheResponseOptions,
 ): Response {
-  const probeResponse = finalizeProbeAppPageResponse(response, options);
+  const probeResponse = finalizeEvaluatedAppPageResponse(response, options);
   if (probeResponse) {
     void options.capturedRscDataPromise?.catch(() => {});
     return probeResponse;
@@ -350,7 +365,7 @@ export function finalizeAppPageRscCacheResponse(
   response: Response,
   options: ScheduleAppPageRscCacheWriteOptions,
 ): Response {
-  const probeResponse = finalizeProbeAppPageResponse(response, options);
+  const probeResponse = finalizeEvaluatedAppPageResponse(response, options);
   if (probeResponse) {
     void options.capturedRscDataPromise?.catch(() => {});
     return probeResponse;

packages/vinext/src/server/app-page-render.ts

@@ -8,6 +8,7 @@ import { resolveClientStaleTimeSeconds } from "../utils/cache-control-metadata.j
 import { AppElementsWire, isAppElementsRecord, type AppOutgoingElements } from "./app-elements.js";
 import { hasDigest } from "./app-rsc-errors.js";
 import {
+  finalizeAppPageCacheabilityEvaluationResponse,
   finalizeAppPageHtmlCacheResponse,
   finalizeAppPageRscCacheResponse,
 } from "./app-page-cache-finalizer.js";
@@ -1297,7 +1298,7 @@ export async function renderAppPageLifecycle(
     });
   }
 
-  return buildAppPageHtmlResponse(safeHtmlStream, {
+  const response = buildAppPageHtmlResponse(safeHtmlStream, {
     cacheTags: options.isPrerender === true ? options.getPageTags() : undefined,
     draftCookie,
     linkHeader,
@@ -1307,6 +1308,25 @@ export async function renderAppPageLifecycle(
     requestCacheLife: requestCacheLifeForPrerender,
     timing: htmlResponseTiming,
   });
+  return finalizeAppPageCacheabilityEvaluationResponse(response, {
+    capturedDynamicUsageBeforeContextCleanup() {
+      return dynamicUsedBeforeContextCleanup;
+    },
+    consumeDynamicUsage: consumeRenderDynamicUsage,
+    consumeRenderObservationState: options.consumeRenderObservationState,
+    getPageTags() {
+      return options.getPageTags();
+    },
+    getRequestCacheLife() {
+      return readRequestCacheLifeForCachePolicy(options);
+    },
+    expireSeconds,
+    revalidateSeconds: resolveAppPageCacheWriteRevalidateSeconds({
+      isDynamicError: options.isDynamicError,
+      isForceStatic: options.isForceStatic,
+      revalidateSeconds,
+    }),
+  });
 }
 
 async function settleCapturedRscRenderForCacheMetadata(