@nifrajs/web 3.5.0 → 4.0.0

package/dist/internal/page-execution.js

@@ -1,12 +1,101 @@
+import { NIFRA_BACKEND_BIND_PLATFORM, NIFRA_PLATFORM_CLIENT_IP_DERIVED, } from "@nifrajs/core/mount";
+import { status as statusResult } from "@nifrajs/core/server";
 import { boundaryDescriptors, resolveStaticBoundaries, startDynamicBoundaries, } from "../boundary.js";
 import { DEFAULT_CSS_LOADING, normalizeCssLoading } from "../css-contract.js";
 import { defer, ndjsonStream, prepareDeferred } from "../deferred.js";
 import { isDraftEnabled } from "../draft.js";
-import { createMatcher, DATA_HEADER, NAV_FROM_HEADER, RETAIN_HEADER, REVALIDATE_HEADER, STATUS_HEADER, } from "../router.js";
+import { routeTags } from "../isr.js";
+import { createMatcher, DATA_HEADER, NAV_FROM_HEADER, REDIRECT_HEADER, RETAIN_HEADER, REVALIDATE_HEADER, STATUS_HEADER, } from "../router.js";
 import { searchOf, searchOfChain } from "../search.js";
 import { mergeHeads, resolveMeta } from "./head-merge.js";
-import { actionResponse, EMPTY_RETAIN, isControlFlow, isStatusSignal, layoutErrorId, renderPageResult, STATUS_SIGNAL, STATUS_TEXT, scopeParams, tagLayoutError, withDuplicateInstanceHint, } from "./render-document.js";
+import { EMPTY_RETAIN, isControlFlow, isResponseResult, isStatusSignal, layoutErrorId, renderPageResult, STATUS_SIGNAL, STATUS_TEXT, scopeParams, tagLayoutError, withDuplicateInstanceHint, } from "./render-document.js";
 import { urlPartsFor } from "./request-url.js";
+import { ACTION_SCOPE, DATA_RESPONSE_HEADERS, MIDDLEWARE_SCOPE, PAGE_SCOPE, PageResponseControls, PRIVATE_NO_STORE, PRIVATE_PAGE_HEADERS, privateOutcome, varyOnDataHeader, } from "./response-controls.js";
+/** The page slot of an `ssr = false` route with no `HydrateFallback`: a component that renders nothing. */
+const EMPTY_LEAF = () => null;
+/** The request-scoping seam of an in-process `api` (see `inProcessClient`), if it carries one. */
+function platformBinderOf(api) {
+    if ((typeof api !== "object" && typeof api !== "function") || api === null)
+        return undefined;
+    const bind = api[NIFRA_BACKEND_BIND_PLATFORM];
+    return typeof bind === "function" ? bind : undefined;
+}
+/**
+ * The page request's platform identity for loader calls: `clientIp` (read lazily, so a backend that
+ * never reads `c.clientIp` never pays the socket lookup), `env` and `waitUntil` - and nothing else. The
+ * page request's headers (cookie, authorization) never travel; a loader passes them explicitly if it
+ * wants an authenticated call. The prototype marker tells the backend its `clientIp` is already derived,
+ * so its own trust declaration does not re-read forwarding headers the synthesized request does not
+ * carry; a spread copy drops both the getter and the marker, so it falls back to re-deriving.
+ */
+class LoaderPlatform {
+    env;
+    waitUntil;
+    #c;
+    constructor(c) {
+        this.#c = c;
+        this.env = c.env;
+        this.waitUntil = c.waitUntil;
+    }
+    get clientIp() {
+        return this.#c.clientIp;
+    }
+}
+;
+LoaderPlatform.prototype[NIFRA_PLATFORM_CLIENT_IP_DERIVED] = true;
+/**
+ * A redirect answering a data request (a client navigation or form submit), as the client router reads
+ * one: fetch would follow a 3xx and hand the router another page's data, so the target rides
+ * `x-nifra-redirect` on a 204 that keeps the redirect's own headers. `undefined` for any other outcome
+ * or request.
+ */
+function dataRedirect(req, outcome) {
+    if (req.headers.get(DATA_HEADER) === null)
+        return undefined;
+    if (isResponseResult(outcome)) {
+        const plain = outcome.plain;
+        if (plain === undefined)
+            return dataRedirect(req, outcome.toResponse());
+        if (plain.status < 300 || plain.status >= 400)
+            return undefined;
+        const { location, ...own } = plain.headers ?? {};
+        if (location === undefined)
+            return undefined;
+        return statusResult(204, undefined, {
+            headers: {
+                ...own,
+                [REDIRECT_HEADER]: appTarget(location, req.url),
+                ...DATA_RESPONSE_HEADERS,
+            },
+        });
+    }
+    if (!(outcome instanceof Response) || outcome.status < 300 || outcome.status >= 400) {
+        return undefined;
+    }
+    const location = outcome.headers.get("location");
+    if (location === null)
+        return undefined;
+    const headers = new Headers(outcome.headers);
+    headers.delete("location");
+    headers.delete("content-length");
+    headers.set(REDIRECT_HEADER, appTarget(location, req.url));
+    for (const [name, value] of Object.entries(DATA_RESPONSE_HEADERS))
+        headers.set(name, value);
+    return new Response(null, { status: 204, headers });
+}
+/** A same-origin target as a path, which the client router can follow without loading a document. */
+function appTarget(location, requestUrl) {
+    let target;
+    try {
+        target = new URL(location, requestUrl);
+    }
+    catch {
+        return location; // the browser fails on it the same way when it loads it
+    }
+    return target.origin === new URL(requestUrl).origin
+        ? target.pathname + target.search + target.hash
+        : location;
+}
 /**
  * Own the page request program behind one private seam.
  *
@@ -18,11 +107,56 @@ import { urlPartsFor } from "./request-url.js";
  */
 export function createPageRequestExecutor(options) {
     const { adapter, manifest, clientEntry, api } = options;
+    // Bound once per render, so every loader, action and boundary in that render shares one view of the
+    // in-process client carrying the visitor's platform. An `api` without the seam passes through as-is.
+    const bindApi = platformBinderOf(api);
+    // One view per render, shared by every loader, action and boundary it runs.
+    const apiFor = (c) => bindApi === undefined ? api : bindApi.call(api, new LoaderPlatform(c));
     const cssLoading = normalizeCssLoading(options.cssLoading ?? DEFAULT_CSS_LOADING);
     const titleOption = options.title === undefined ? {} : { title: options.title };
+    const cspOption = options.csp === undefined ? {} : { csp: options.csp };
     const prerenderedSet = new Set(options.prerenderedPaths ?? []);
+    const prerenderedHandover = options.prerenderedListUrl === undefined
+        ? { prerenderedPaths: options.prerenderedPaths ?? [] }
+        : { prerenderedListUrl: options.prerenderedListUrl };
     const matchManifestRoute = createMatcher(manifest.routes.map((route) => ({ routeId: route.id, pattern: route.pattern })));
     const routeById = new Map(manifest.routes.map((route) => [route.id, route]));
+    // A nested `_404` answers an unmatched URL from inside the catch-all, never as a route of its own:
+    // a registered `/admin/*` would take URLs from a route the router only reaches by backtracking.
+    // Param names are indexed by position, so two directories that name one segment differently share
+    // the index; each target keeps its own names to read a match back.
+    const notFoundTargets = [];
+    const notFoundPatterns = [];
+    for (const [id, page] of Object.entries(manifest.notFounds ?? {})) {
+        for (const scope of page.scopes) {
+            const names = [];
+            const pattern = scope.pattern.replace(/([:*])([A-Za-z_][A-Za-z0-9_]*)/g, (_match, sigil, name) => `${sigil}p${names.push(name) - 1}`);
+            notFoundPatterns.push({ routeId: String(notFoundTargets.length), pattern });
+            notFoundTargets.push({
+                id,
+                page,
+                names,
+                route: {
+                    id,
+                    pattern: scope.pattern,
+                    layoutIds: page.layoutIds,
+                    layoutParams: scope.layoutParams,
+                    ...(page.middlewareIds === undefined
+                        ? {}
+                        : {
+                            middlewareIds: page.middlewareIds,
+                            ...(scope.middlewareParams === undefined
+                                ? {}
+                                : { middlewareParams: scope.middlewareParams }),
+                        }),
+                    errorIds: page.errorIds,
+                    file: page.file,
+                    load: page.load,
+                },
+            });
+        }
+    }
+    const matchNotFoundScope = notFoundPatterns.length === 0 ? undefined : createMatcher(notFoundPatterns);
     const draftFlag = (req) => options.draftSecret === undefined
         ? Promise.resolve(false)
         : isDraftEnabled(req, options.draftSecret);
@@ -53,26 +187,46 @@ export function createPageRequestExecutor(options) {
         }
         return modules;
     };
+    // No modules, data, or per-request state: reuse the settled result for page-only routes.
+    const emptyLayoutRun = {
+        modules: [],
+        layoutData: undefined,
+        retained: [],
+        pending: undefined,
+    };
     /** Run layout loaders, awaiting gates before starting the page loader and retaining only safe data. */
-    const runLayoutChain = async (route, ctx, retain = new Set()) => {
+    const runLayoutChain = async (route, ctx, controls, retain) => {
+        if (route.layoutIds.length === 0)
+            return emptyLayoutRun;
         const modules = await loadLayoutModules(route);
         if (!modules.some((m) => m.loader !== undefined)) {
-            return { modules, layoutData: undefined, retained: [], pending: Promise.resolve() };
+            return { modules, layoutData: undefined, retained: [], pending: undefined };
         }
         const results = new Array(modules.length).fill(null);
         const retained = [];
         const pending = [];
         for (let i = 0; i < modules.length; i++) {
-            const loader = modules[i]?.loader;
+            const layout = modules[i];
+            const loader = layout.loader;
             if (loader === undefined)
                 continue;
-            if (retain.has(i) && modules[i]?.gate !== true) {
-                retained.push(i);
-                continue;
+            if (retain !== undefined && layout.gate !== true) {
+                let keep;
+                try {
+                    keep = keepsLayoutData(route, i, layout, ctx.params, retain);
+                }
+                catch (err) {
+                    throw tagLayoutError(err, route.layoutIds[i]);
+                }
+                if (keep) {
+                    retained.push(i);
+                    continue;
+                }
             }
             const scoped = {
                 ...ctx,
                 params: scopeParams(ctx.params, route.layoutParams?.[i]),
+                set: controls.scope(i),
             };
             if (modules[i]?.gate === true) {
                 try {
@@ -85,19 +239,37 @@ export function createPageRequestExecutor(options) {
             }
             const layoutId = route.layoutIds[i];
             const index = i;
-            pending.push((async () => {
-                try {
-                    results[index] = await loader(scoped);
-                }
-                catch (err) {
-                    throw tagLayoutError(err, layoutId);
+            try {
+                const value = loader(scoped);
+                // Scalars settle synchronously. Objects keep await's intrinsic promise/thenable
+                // assimilation: property-presence and prototype probes are unsafe for proxies.
+                if (value !== null && (typeof value === "object" || typeof value === "function")) {
+                    pending.push((async () => {
+                        try {
+                            results[index] = await value;
+                        }
+                        catch (err) {
+                            throw tagLayoutError(err, layoutId);
+                        }
+                    })());
                 }
-            })());
+                else
+                    results[index] = value;
+            }
+            catch (err) {
+                // Preserve a synchronous throw as a pending layout failure, just like the async lane.
+                pending.push(Promise.reject(tagLayoutError(err, layoutId)));
+            }
         }
-        return { modules, layoutData: results, retained, pending: Promise.all(pending) };
+        return {
+            modules,
+            layoutData: results,
+            retained,
+            pending: pending.length === 0 ? undefined : pending.length === 1 ? pending[0] : Promise.all(pending),
+        };
     };
     /** Run only authorization gates before an action; ordinary layout data runs after a native action. */
-    const runLayoutGates = async (route, ctx) => {
+    const runLayoutGates = async (route, ctx, controls) => {
         const modules = await loadLayoutModules(route);
         for (let i = 0; i < modules.length; i++) {
             const mod = modules[i];
@@ -107,6 +279,7 @@ export function createPageRequestExecutor(options) {
                 await mod.loader({
                     ...ctx,
                     params: scopeParams(ctx.params, route.layoutParams?.[i]),
+                    set: controls.scope(i),
                 });
             }
             catch (err) {
@@ -115,6 +288,38 @@ export function createPageRequestExecutor(options) {
         }
         return modules;
     };
+    /** Outermost first; a failure carries its directory so the nearest `_error` above it renders. */
+    const runMiddleware = async (route, ctx, controls) => {
+        const ids = route.middlewareIds ?? [];
+        for (let i = 0; i < ids.length; i++) {
+            const id = ids[i];
+            const entry = manifest.middlewares?.[id];
+            const dirTag = `${id.slice(0, id.length - "_middleware".length)}_layout`;
+            let outcome;
+            try {
+                const middleware = (await entry.load()).default;
+                // A `_layout.backend.ts` that exports no middleware is a layout data module, nothing more.
+                if (middleware === undefined)
+                    continue;
+                if (typeof middleware !== "function") {
+                    throw new Error(`[nifra/web] "${entry.file}" exports a middleware that is not a function.`);
+                }
+                outcome = await middleware({
+                    ...ctx,
+                    params: scopeParams(ctx.params, route.middlewareParams?.[i]),
+                    set: controls.scope(MIDDLEWARE_SCOPE + i),
+                });
+            }
+            catch (err) {
+                throw tagLayoutError(err, dirTag);
+            }
+            if (outcome === undefined)
+                continue;
+            throw tagLayoutError(isControlFlow(outcome)
+                ? outcome
+                : new Error(`[nifra/web] the middleware in "${entry.file}" returned a value. Middleware returns nothing to let the request through, or a redirect(), a status such as notFound(), or a Response to answer it.`), dirTag);
+        }
+    };
     const retainedIndices = (header) => {
         if (header === null || header === "")
             return EMPTY_RETAIN;
@@ -126,55 +331,88 @@ export function createPageRequestExecutor(options) {
         }
         return out;
     };
-    const validatedRetainedIndices = (req, route, params) => {
+    /**
+     * The browser's side of a client navigation: the page it is leaving and the layout slots it asked
+     * to keep. Undefined unless this is a data request whose `from` is same-origin and routable.
+     */
+    const retainContextOf = (req) => {
         if (req.headers.get(DATA_HEADER) === null)
-            return EMPTY_RETAIN;
+            return undefined;
         const requested = retainedIndices(req.headers.get(RETAIN_HEADER));
         const from = req.headers.get(NAV_FROM_HEADER);
         if (requested.size === 0 || from === null)
-            return EMPTY_RETAIN;
-        let fromPath;
+            return undefined;
+        let toUrl;
+        let fromUrl;
         try {
-            const current = new URL(req.url);
-            const source = new URL(from, current);
-            if (source.origin !== current.origin)
-                return EMPTY_RETAIN;
-            fromPath = source.pathname + source.search;
+            toUrl = new URL(req.url);
+            fromUrl = new URL(from, toUrl);
         }
         catch {
-            return EMPTY_RETAIN;
+            return undefined;
         }
-        const previousMatch = matchManifestRoute(fromPath);
+        if (fromUrl.origin !== toUrl.origin)
+            return undefined;
+        const previousMatch = matchManifestRoute(fromUrl.pathname + fromUrl.search);
         if (previousMatch === null)
-            return EMPTY_RETAIN;
+            return undefined;
         const previous = routeById.get(previousMatch.routeId);
         if (previous === undefined)
-            return EMPTY_RETAIN;
-        const valid = new Set();
-        for (const index of requested) {
-            if (route.layoutIds[index] !== previous.layoutIds[index])
-                continue;
-            const owned = route.layoutParams?.[index] ?? [];
-            const previouslyOwned = previous.layoutParams?.[index] ?? [];
-            if (owned.length !== previouslyOwned.length ||
-                owned.some((name, i) => name !== previouslyOwned[i]) ||
-                owned.some((name) => params[name] !== previousMatch.params[name])) {
-                continue;
-            }
-            valid.add(index);
-        }
-        return valid;
+            return undefined;
+        return { requested, from: previous, fromParams: previousMatch.params, fromUrl, toUrl };
+    };
+    /** A query change re-runs layout loaders by default: any can read it, and none declares keys. */
+    const keepsLayoutData = (route, index, layout, params, retain) => {
+        if (!retain.requested.has(index))
+            return false;
+        const previous = retain.from;
+        if (route.layoutIds[index] !== previous.layoutIds[index])
+            return false;
+        const owned = route.layoutParams?.[index] ?? [];
+        const previouslyOwned = previous.layoutParams?.[index] ?? [];
+        const defaultShouldRevalidate = retain.fromUrl.search !== retain.toUrl.search ||
+            owned.length !== previouslyOwned.length ||
+            owned.some((name, i) => name !== previouslyOwned[i]) ||
+            owned.some((name) => params[name] !== retain.fromParams[name]);
+        const decide = layout.shouldRevalidate;
+        if (typeof decide !== "function")
+            return !defaultShouldRevalidate;
+        // Copies, so a hook that mutates its arguments cannot reach the request's params or the next
+        // layout's view of the navigation.
+        const answer = decide({
+            currentUrl: new URL(retain.fromUrl),
+            nextUrl: new URL(retain.toUrl),
+            currentParams: { ...retain.fromParams },
+            nextParams: { ...params },
+            defaultShouldRevalidate,
+        });
+        return answer === false;
     };
     const loaderSearch = (searchSchema, request) => searchOf(searchSchema, urlPartsFor(request).search);
     const searchChainOf = (layoutMods, mod, request) => searchOfChain([...layoutMods.map((m) => m.searchSchema), mod.searchSchema], urlPartsFor(request).search);
-    const resolveChainAndHead = (layoutModules, page, metaArgs) => {
-        const chain = [...layoutModules.map((m) => m.default), page.default];
+    // `ssr = false`: the slot holds `HydrateFallback`, which the browser hydrates before the page.
+    const serverLeafOf = (route, mod) => {
+        if (mod.ssr !== false)
+            return mod.default;
+        if (mod.hydrate === false) {
+            throw new Error(`[nifra/web] route "${route.id}" sets both \`ssr = false\` and \`hydrate = false\`: the ` +
+                "server skips its component and no client would ever render it. Remove one of the two.");
+        }
+        return mod.HydrateFallback ?? EMPTY_LEAF;
+    };
+    const resolveChainAndHead = (layoutModules, page, metaArgs, leaf = page.default) => {
+        const chain = [...layoutModules.map((m) => m.default), leaf];
         const heads = [
             ...layoutModules.map((m) => resolveMeta(m.meta, metaArgs)),
             resolveMeta(page.meta, metaArgs),
         ];
         return { chain, head: mergeHeads(heads) };
     };
+    /** What `useMatches` reports for a chain: the layouts' ids and `handle`s, then the page's. */
+    const matchChainOf = (layoutIds, layoutModules, pageId, page) => ({
+        ids: [...layoutIds, pageId],
+        handles: [...layoutModules.map((layout) => layout.handle), page.handle],
+    });
     const dirOfId = (id, suffix) => id === suffix ? "" : id.slice(0, id.length - suffix.length - 1);
     const boundaryFor = (route, err) => {
         const ids = route.errorIds ?? [];
@@ -206,7 +444,7 @@ export function createPageRequestExecutor(options) {
             return "/";
         }
     };
-    const renderError = async (route, errorId, err, nonce) => {
+    const renderError = async (route, errorId, err, personalized, nonce) => {
         const errDir = dirOfId(errorId, "_error");
         const keptLayoutIds = route.layoutIds.filter((id) => {
             const ld = dirOfId(id, "_layout");
@@ -215,15 +453,21 @@ export function createPageRequestExecutor(options) {
         const layouts = await Promise.all(keptLayoutIds.map((id) => manifest.layouts[id].load().then((m) => m.default)));
         const { default: errComp } = await (manifest.errors?.[errorId]).load();
         const e = err instanceof Error ? err : new Error(String(err));
+        // An error's text can carry a connection string or a query, so a production page gets neither.
+        const production = typeof process === "undefined" || process.env.NODE_ENV === "production";
         return renderPageResult({
             adapter,
             chain: [...layouts, errComp],
-            data: { name: e.name, message: e.message },
+            data: production
+                ? { name: "Error", message: "Internal Server Error" }
+                : { name: e.name, message: e.message },
             clientEntry,
             routeId: errorId,
             status: 500,
             hydrate: false,
+            ...(personalized ? { headers: PRIVATE_PAGE_HEADERS } : {}),
             ...(nonce === undefined ? {} : { nonce }),
+            ...cspOption,
             ...titleOption,
         });
     };
@@ -242,6 +486,7 @@ export function createPageRequestExecutor(options) {
             data: null,
             clientEntry,
             routeId,
+            matchChain: { ids: [routeId], handles: [loaded.handle] },
             ...(path !== undefined
                 ? {
                     search: searchOf(loaded.searchSchema, path.includes("?") ? path.slice(path.indexOf("?")) : ""),
@@ -251,20 +496,36 @@ export function createPageRequestExecutor(options) {
             status,
             ...(extraHeaders !== undefined ? { headers: extraHeaders } : {}),
             ...(nonce === undefined ? {} : { nonce }),
+            ...cspOption,
             ...preloadOf(routeId),
             ...stylesOf(routeId),
-            prerenderedPaths: options.prerenderedPaths ?? [],
+            ...prerenderedHandover,
             ...titleOption,
         });
     };
-    const renderStatusSignal = async (req, env, signal) => {
+    const renderStatusSignal = async (req, env, signal, personalized) => {
         const { status, headers } = signal[STATUS_SIGNAL];
         if (req.headers.get(DATA_HEADER) !== null) {
+            // Same URL as the status page, so it is never storable: a cache keyed on the URL alone would
+            // otherwise answer a document request with this empty body.
             const responseHeaders = new Headers(headers);
             responseHeaders.set(STATUS_HEADER, String(status));
+            responseHeaders.set("cache-control", PRIVATE_NO_STORE);
+            responseHeaders.set("vary", varyOnDataHeader(responseHeaders.get("vary")));
             return new Response(null, { status, headers: responseHeaders });
         }
-        return renderTerminalStatus(status, pathOf(req), headers, await resolveNonce(req, env));
+        const nonce = await resolveNonce(req, env);
+        if (headers === undefined && !personalized) {
+            return renderTerminalStatus(status, pathOf(req), undefined, nonce);
+        }
+        const documentHeaders = new Headers(headers);
+        if (headers !== undefined) {
+            documentHeaders.set("vary", varyOnDataHeader(documentHeaders.get("vary")));
+        }
+        // A cookie queued before the signal makes the status page specific to this visitor.
+        if (personalized)
+            documentHeaders.set("cache-control", PRIVATE_NO_STORE);
+        return renderTerminalStatus(status, pathOf(req), documentHeaders, nonce);
     };
     const reportLoaderError = (route, req, params, err) => {
         if (options.onLoaderError === undefined)
@@ -276,9 +537,9 @@ export function createPageRequestExecutor(options) {
             // A faulty reporter must never break error rendering.
         }
     };
-    const handleDataOrDocument = async (req, env, route, params, mod, data, layoutData, layoutModules, layoutRetained, boundaryStates, assemblyCache) => {
+    const handleDataOrDocument = async (req, env, route, params, mod, data, layoutData, layoutModules, layoutRetained, boundaryStates, assemblyCache, responseHeaders, personalized) => {
         if (isStatusSignal(data))
-            return renderStatusSignal(req, env, data);
+            return renderStatusSignal(req, env, data, personalized);
         if (isControlFlow(data))
             return data;
         if (req.headers.get(DATA_HEADER) !== null) {
@@ -305,18 +566,23 @@ export function createPageRequestExecutor(options) {
                     retained: layoutRetained,
                     ...(boundarySplit === undefined ? {} : { boundaries: boundarySplit.forClient }),
                 };
-            if (allDeferred.length === 0)
-                return Response.json(payload ?? null);
+            if (allDeferred.length === 0) {
+                return Response.json(payload ?? null, { headers: DATA_RESPONSE_HEADERS });
+            }
             return new Response(ndjsonStream(payload, allDeferred), {
-                headers: { "content-type": "application/x-ndjson; charset=utf-8" },
+                headers: {
+                    "content-type": "application/x-ndjson; charset=utf-8",
+                    ...DATA_RESPONSE_HEADERS,
+                },
             });
         }
+        const nonce = options.nonce === undefined ? undefined : await resolveNonce(req, env);
         const { chain, head } = resolveChainAndHead(layoutModules, mod, {
             data,
             params,
             origin: originOf(req),
-        });
-        const nonce = options.nonce === undefined ? undefined : await resolveNonce(req, env);
+            ...(nonce === undefined ? {} : { nonce }),
+        }, serverLeafOf(route, mod));
         try {
             return await renderPageResult({
                 adapter,
@@ -328,38 +594,168 @@ export function createPageRequestExecutor(options) {
                 params,
                 path: pathOf(req),
                 search: searchChainOf(layoutModules, mod, req),
+                matchChain: matchChainOf(route.layoutIds, layoutModules, route.id, mod),
                 hydrate: mod.hydrate !== false,
                 ...(layoutData !== undefined ? { layoutData } : {}),
                 ...(boundaryStates !== undefined ? { boundaries: boundaryStates } : {}),
                 ...preloadOf(route.id),
                 ...stylesOf(route.id),
-                prerenderedPaths: options.prerenderedPaths ?? [],
-                ...(mod.revalidate !== undefined ? { revalidate: mod.revalidate } : {}),
-                ...(mod.revalidateTags !== undefined ? { revalidateTags: mod.revalidateTags } : {}),
+                ...prerenderedHandover,
+                ...(responseHeaders === undefined ? {} : { headers: responseHeaders }),
+                // A response that sets a cookie is one visitor's: it never advertises ISR freshness.
+                ...(mod.revalidate !== undefined && !personalized && options.cacheChannel?.enabled === true
+                    ? { revalidate: mod.revalidate }
+                    : {}),
+                ...(mod.revalidateTags !== undefined &&
+                    !personalized &&
+                    options.cacheChannel?.enabled === true
+                    ? {
+                        revalidateTags: routeTags(mod.revalidateTags, { params, url: new URL(req.url) }, route.id),
+                    }
+                    : {}),
                 ...(mod.islandScripts !== undefined ? { islandScripts: mod.islandScripts } : {}),
                 ...(nonce === undefined ? {} : { nonce }),
+                ...cspOption,
                 ...titleOption,
                 ...(assemblyCache === undefined ? {} : { assemblyCache }),
             });
         }
         catch (err) {
             if (isStatusSignal(err))
-                return renderStatusSignal(req, env, err);
+                return renderStatusSignal(req, env, err, personalized);
             if (isControlFlow(err))
                 throw err;
             reportLoaderError(route, req, { ...params }, err);
             const errorId = boundaryFor(route, err);
             if (errorId === undefined)
                 throw err;
-            return renderError(route, errorId, withDuplicateInstanceHint(err), nonce);
+            return renderError(route, errorId, withDuplicateInstanceHint(err), personalized, nonce);
         }
     };
+    /** What a failed loader answers with, once a status signal has been ruled out. */
+    const renderLoaderFailure = async (route, req, env, params, err, personalized) => {
+        if (isControlFlow(err))
+            throw err;
+        reportLoaderError(route, req, params, err);
+        const errorId = boundaryFor(route, err);
+        if (errorId === undefined)
+            throw err;
+        if (req.headers.get(DATA_HEADER) !== null) {
+            return new Response("Internal Server Error", {
+                status: 500,
+                headers: { "content-type": "text/plain; charset=utf-8" },
+            });
+        }
+        return renderError(route, errorId, withDuplicateInstanceHint(err), personalized, options.nonce === undefined ? undefined : await resolveNonce(req, env));
+    };
+    /**
+     * Render a nested `_404` inside its layouts. `layoutModules` and `layoutData` are exactly the
+     * layouts at or above the page, their gates already passed.
+     */
+    const renderNestedNotFound = async (req, env, id, page, params, layoutModules, layoutData, personalized, signalHeaders) => {
+        // The page can show what a layout loaded for this visitor, and a 404 is storable by default.
+        const isPrivate = personalized || layoutData !== undefined;
+        if (req.headers.get(DATA_HEADER) !== null) {
+            // No status header: the page has no client chunk, so the navigation falls back to loading the
+            // URL as a document, which renders it here.
+            const headers = new Headers(signalHeaders);
+            headers.set("cache-control", PRIVATE_NO_STORE);
+            headers.set("vary", varyOnDataHeader(headers.get("vary")));
+            return new Response(null, { status: 404, headers });
+        }
+        const mod = await page.load();
+        const nonce = options.nonce === undefined ? undefined : await resolveNonce(req, env);
+        const { chain, head } = resolveChainAndHead(layoutModules, mod, {
+            data: null,
+            params,
+            origin: originOf(req),
+            ...(nonce === undefined ? {} : { nonce }),
+        });
+        let headers;
+        if (signalHeaders !== undefined || isPrivate) {
+            headers = new Headers(signalHeaders);
+            if (signalHeaders !== undefined)
+                headers.set("vary", varyOnDataHeader(headers.get("vary")));
+            if (isPrivate)
+                headers.set("cache-control", PRIVATE_NO_STORE);
+        }
+        return renderPageResult({
+            adapter,
+            chain,
+            data: null,
+            head,
+            clientEntry,
+            routeId: id,
+            params,
+            path: pathOf(req),
+            search: searchChainOf(layoutModules, mod, req),
+            matchChain: matchChainOf(page.layoutIds, layoutModules, id, mod),
+            status: 404,
+            hydrate: false,
+            ...(layoutData !== undefined ? { layoutData } : {}),
+            ...stylesOf(id),
+            ...(headers === undefined ? {} : { headers }),
+            ...(nonce === undefined ? {} : { nonce }),
+            ...cspOption,
+            ...titleOption,
+        });
+    };
+    /** The nearest nested `_404` for the route's own `notFound()`, else `undefined` (root page). */
+    const renderRouteNotFound = async (req, env, route, params, signal, run, personalized) => {
+        const id = route.notFoundIds?.at(-1);
+        if (id === undefined || run === undefined)
+            return undefined;
+        if (signal[STATUS_SIGNAL].status !== 404 || layoutErrorId(signal) !== undefined) {
+            return undefined;
+        }
+        const page = manifest.notFounds?.[id];
+        if (page === undefined)
+            return undefined;
+        try {
+            await run.pending;
+        }
+        catch {
+            return undefined;
+        }
+        // The page's layouts are the leading ones of the route's: its directory contains the route.
+        const kept = page.layoutIds.length;
+        return renderNestedNotFound(req, env, id, page, params, run.modules.slice(0, kept), run.layoutData?.slice(0, kept), personalized, signal[STATUS_SIGNAL].headers);
+    };
     const renderNotFound = async (request, env, path) => {
         const page = manifest.statusPages?.["404"] ?? manifest.notFound;
         if (page === undefined)
             return renderTerminalStatus(404, path);
         return renderTerminalStatus(404, path, undefined, options.nonce === undefined ? undefined : await resolveNonce(request, env));
     };
+    /**
+     * Run a page handler with the request's `ctx.set`, sealed once the handler settles - whatever it
+     * answered with - so a write that arrives after the response was decided throws. A request that
+     * queued a cookie answers with a response no shared cache may store, returned or thrown. A redirect
+     * answering a data request, returned or thrown, reaches the client router intact.
+     */
+    const withResponseControls = (run) => async (c) => {
+        const controls = new PageResponseControls(c);
+        try {
+            const outcome = await run(c, controls);
+            const answer = dataRedirect(c.req, outcome) ?? outcome;
+            return controls.personalized ? privateOutcome(answer) : answer;
+        }
+        catch (err) {
+            if (!isControlFlow(err))
+                throw err;
+            const answer = dataRedirect(c.req, err);
+            // Returned rather than rethrown: the serving app sends a thrown `Response` exactly as it is,
+            // without the cookies the request queued.
+            if (controls.personalized)
+                return privateOutcome(answer ?? err);
+            if (answer !== undefined)
+                return answer;
+            throw err;
+        }
+        finally {
+            controls.seal();
+        }
+    };
     return {
         get: (route) => {
             const is404Fallback = options.staticFallbacks?.[route.pattern] === "404";
@@ -382,28 +778,37 @@ export function createPageRequestExecutor(options) {
                 }
                 return assemblySlot;
             };
-            return async (c) => {
+            return withResponseControls(async (c, controls) => {
                 if (is404Fallback && !prerenderedSet.has(urlPartsFor(c.req).pathname)) {
                     return renderNotFound(c.req, c.env, pathOf(c.req));
                 }
                 const mod = await route.load();
                 const draft = await draftFlag(c.req);
+                // Unpublished content is the editor's alone: whatever cache-control a loader sets, no cache keeps it.
+                if (draft)
+                    controls.personalize();
                 let data;
                 let layoutData;
                 let boundaryStates;
                 let layoutModules;
                 let layoutRetained = [];
+                let responseHeaders;
+                const requestApi = apiFor(c);
+                let run;
                 try {
                     const ctx = {
                         params: c.params,
                         request: c.req,
                         req: c.req,
-                        api,
+                        api: requestApi,
                         env: c.env,
                         draft,
                         search: loaderSearch(mod.searchSchema, c.req),
+                        set: controls.scope(PAGE_SCOPE),
                     };
-                    const run = await runLayoutChain(route, ctx, validatedRetainedIndices(c.req, route, c.params));
+                    if (route.middlewareIds !== undefined)
+                        await runMiddleware(route, ctx, controls);
+                    run = await runLayoutChain(route, ctx, controls, retainContextOf(c.req));
                     layoutModules = run.modules;
                     layoutRetained = run.retained;
                     const boundaryDefinitions = [
@@ -418,20 +823,21 @@ export function createPageRequestExecutor(options) {
                         : startDynamicBoundaries(boundaryDefinitions, {
                             request: c.req,
                             params: c.params,
-                            api,
+                            api: requestApi,
                             env: c.env,
                             draft,
                             search: effectiveSearch,
                             signal: c.req.signal,
                         });
                     const staticBoundaryPromise = boundaryDefinitions.length === 0
-                        ? Promise.resolve(undefined)
-                        : resolveStaticBoundaries(boundaryDefinitions, { phase: "build", origin: originOf(c.req) }, options.staticBoundaryCache);
-                    const [pageData, , staticBoundaries] = await Promise.all([
-                        mod.loader ? mod.loader({ ...ctx, search: effectiveSearch }) : null,
-                        run.pending,
-                        staticBoundaryPromise,
-                    ]);
+                        ? undefined
+                        : resolveStaticBoundaries(boundaryDefinitions, { phase: "build" }, options.staticBoundaryCache);
+                    const pageResult = mod.loader ? mod.loader({ ...ctx, search: effectiveSearch }) : null;
+                    const [pageData, , staticBoundaries] = run.pending === undefined && staticBoundaryPromise === undefined
+                        ? [await pageResult, undefined, undefined]
+                        : staticBoundaryPromise === undefined
+                            ? await Promise.all([pageResult, run.pending])
+                            : await Promise.all([pageResult, run.pending, staticBoundaryPromise]);
                     data = pageData;
                     layoutData = run.layoutData;
                     if (boundaryBatch !== undefined) {
@@ -446,70 +852,85 @@ export function createPageRequestExecutor(options) {
                     else if (staticBoundaries !== undefined) {
                         boundaryStates = staticBoundaries;
                     }
+                    // Inside the loader `try`: a header the response cannot carry is a loader error, rendered
+                    // by the same boundary as one.
+                    responseHeaders = controls.documentHeaders();
                 }
                 catch (err) {
-                    if (isStatusSignal(err))
-                        return renderStatusSignal(c.req, c.env, err);
-                    if (isControlFlow(err))
-                        throw err;
-                    reportLoaderError(route, c.req, c.params, err);
-                    const errorId = boundaryFor(route, err);
-                    if (errorId === undefined)
-                        throw err;
-                    if (c.req.headers.get(DATA_HEADER) !== null) {
-                        return new Response("Internal Server Error", {
-                            status: 500,
-                            headers: { "content-type": "text/plain; charset=utf-8" },
-                        });
+                    if (isStatusSignal(err)) {
+                        return ((await renderRouteNotFound(c.req, c.env, route, c.params, err, run, controls.personalized)) ?? renderStatusSignal(c.req, c.env, err, controls.personalized));
                     }
-                    return renderError(route, errorId, withDuplicateInstanceHint(err), options.nonce === undefined ? undefined : await resolveNonce(c.req, c.env));
+                    return renderLoaderFailure(route, c.req, c.env, c.params, err, controls.personalized);
                 }
-                return handleDataOrDocument(c.req, c.env, route, c.params, mod, data, layoutData, layoutModules ?? (await loadLayoutModules(route)), layoutRetained, boundaryStates, layoutModules === undefined ? undefined : assemblyCacheFor(mod, layoutModules));
-            };
+                if (isStatusSignal(data)) {
+                    const nested = await renderRouteNotFound(c.req, c.env, route, c.params, data, run, controls.personalized);
+                    if (nested !== undefined)
+                        return nested;
+                }
+                return handleDataOrDocument(c.req, c.env, route, c.params, mod, data, layoutData, layoutModules ?? (await loadLayoutModules(route)), layoutRetained, boundaryStates, layoutModules === undefined ? undefined : assemblyCacheFor(mod, layoutModules), responseHeaders, controls.personalized);
+            });
         },
-        post: (route) => async (c) => {
+        post: (route) => withResponseControls(async (c, controls) => {
             const mod = await route.load();
             const draft = await draftFlag(c.req);
+            if (draft)
+                controls.personalize();
             if (mod.action === undefined) {
                 return new Response("Method Not Allowed", {
                     status: 405,
                     headers: { allow: "GET", "content-type": "text/plain; charset=utf-8" },
                 });
             }
+            const requestApi = apiFor(c);
             const actionContext = {
                 params: c.params,
                 request: c.req,
                 req: c.req,
-                api,
+                api: requestApi,
                 env: c.env,
                 draft,
                 search: loaderSearch(mod.searchSchema, c.req),
+                set: controls.scope(ACTION_SCOPE),
             };
             const isDataRequest = c.req.headers.get(DATA_HEADER) !== null;
             let layoutModules;
             let result;
             try {
-                layoutModules = await runLayoutGates(route, actionContext);
+                if (route.middlewareIds !== undefined)
+                    await runMiddleware(route, actionContext, controls);
+                layoutModules = await runLayoutGates(route, actionContext, controls);
                 result = await mod.action(actionContext);
             }
             catch (err) {
                 if (isControlFlow(err))
-                    return actionResponse(err, isDataRequest);
+                    return err;
                 throw err;
             }
             const isRevalidate = result !== null && typeof result === "object" && "__nifraRevalidate" in result;
             const actionResult = isRevalidate ? result.data : result;
             const revalidateHeader = isRevalidate
-                ? { [REVALIDATE_HEADER]: result.__nifraRevalidate.join(",") }
+                ? {
+                    [REVALIDATE_HEADER]: result.__nifraRevalidate.join(","),
+                }
                 : {};
             if (isControlFlow(actionResult))
-                return actionResponse(actionResult, isDataRequest);
+                return actionResult;
             if (isDataRequest) {
+                // Headers shape the document only, but a bad one fails here too, so a navigation and a full
+                // page load agree on whether the action's response is valid.
+                controls.commit();
                 const { forClient, deferred } = prepareDeferred(actionResult);
-                if (deferred.length === 0)
-                    return Response.json(actionResult ?? null, { headers: revalidateHeader });
+                if (deferred.length === 0) {
+                    return Response.json(actionResult ?? null, {
+                        headers: { ...DATA_RESPONSE_HEADERS, ...revalidateHeader },
+                    });
+                }
                 return new Response(ndjsonStream(forClient, deferred), {
-                    headers: { "content-type": "application/x-ndjson; charset=utf-8", ...revalidateHeader },
+                    headers: {
+                        "content-type": "application/x-ndjson; charset=utf-8",
+                        ...DATA_RESPONSE_HEADERS,
+                        ...revalidateHeader,
+                    },
                 });
             }
             const search = searchChainOf(layoutModules, mod, c.req);
@@ -518,18 +939,21 @@ export function createPageRequestExecutor(options) {
                     params: c.params,
                     request: c.req,
                     req: c.req,
-                    api,
+                    api: requestApi,
                     env: c.env,
                     draft,
                     search,
+                    set: controls.scope(PAGE_SCOPE),
                 })
                 : null;
+            const responseHeaders = controls.documentHeaders();
+            const nonce = options.nonce === undefined ? undefined : await resolveNonce(c.req, c.env);
             const { chain, head } = resolveChainAndHead(layoutModules, mod, {
                 data,
                 params: c.params,
                 origin: originOf(c.req),
-            });
-            const nonce = options.nonce === undefined ? undefined : await resolveNonce(c.req, c.env);
+                ...(nonce === undefined ? {} : { nonce }),
+            }, serverLeafOf(route, mod));
             return renderPageResult({
                 adapter,
                 chain,
@@ -541,15 +965,57 @@ export function createPageRequestExecutor(options) {
                 params: c.params,
                 path: pathOf(c.req),
                 search,
+                matchChain: matchChainOf(route.layoutIds, layoutModules, route.id, mod),
                 hydrate: mod.hydrate !== false,
                 ...preloadOf(route.id),
                 ...stylesOf(route.id),
-                prerenderedPaths: options.prerenderedPaths ?? [],
+                ...prerenderedHandover,
+                ...(responseHeaders === undefined ? {} : { headers: responseHeaders }),
                 ...(nonce === undefined ? {} : { nonce }),
+                ...cspOption,
                 ...titleOption,
             });
-        },
-        notFound: renderNotFound,
+        }),
+        fallback: withResponseControls(async (c, controls) => {
+            const match = matchNotFoundScope?.(pathOf(c.req)) ?? null;
+            const target = match === null ? undefined : notFoundTargets[Number(match.routeId)];
+            if (match === null || target === undefined) {
+                return renderNotFound(c.req, c.env, pathOf(c.req));
+            }
+            const params = {};
+            for (let i = 0; i < target.names.length; i++) {
+                params[target.names[i]] = match.params[`p${i}`];
+            }
+            const mod = await target.page.load();
+            const draft = await draftFlag(c.req);
+            if (draft)
+                controls.personalize();
+            let run;
+            try {
+                const ctx = {
+                    params,
+                    request: c.req,
+                    req: c.req,
+                    api: apiFor(c),
+                    env: c.env,
+                    draft,
+                    search: loaderSearch(mod.searchSchema, c.req),
+                    set: controls.scope(PAGE_SCOPE),
+                };
+                if (target.route.middlewareIds !== undefined) {
+                    await runMiddleware(target.route, ctx, controls);
+                }
+                run = await runLayoutChain(target.route, ctx, controls);
+                await run.pending;
+            }
+            catch (err) {
+                if (isStatusSignal(err)) {
+                    return renderStatusSignal(c.req, c.env, err, controls.personalized);
+                }
+                return renderLoaderFailure(target.route, c.req, c.env, params, err, controls.personalized);
+            }
+            return renderNestedNotFound(c.req, c.env, target.id, target.page, params, run.modules, run.layoutData, controls.personalized);
+        }),
     };
 }
 //# sourceMappingURL=page-execution.js.map