@rangojs/router 0.0.0-experimental.13 → 0.0.0-experimental.13221847

package/src/rsc/handler.ts

@@ -1,5 +1,5 @@
 /// <reference types="@vitejs/plugin-rsc/types" />
-/// <reference path="../vite/version.d.ts" />
+/// <reference path="../vite/plugins/version.d.ts" />
 /**
  * RSC Request Handler
  *
@@ -8,72 +8,80 @@
  */
 
 import { createElement } from "react";
-import { renderSegments } from "../segment-system.js";
-import { RouteNotFoundError, RouterError } from "../errors.js";
-import type { ResponseError } from "../urls.js";
-import { getLoaderLazy } from "../server/loader-registry.js";
-import {
-  matchMiddleware,
-  executeMiddleware,
-  executeLoaderMiddleware,
-} from "../router/middleware.js";
+import { RouteNotFoundError } from "../errors.js";
+import { matchMiddleware, executeMiddleware } from "../router/middleware.js";
 import {
   runWithRequestContext,
   setRequestContextParams,
   requireRequestContext,
   createRequestContext,
-  type ExecutionContext,
 } from "../server/request-context.js";
 import * as rscDeps from "@vitejs/plugin-rsc/rsc";
 
 import type {
   RscPayload,
-  ReactFormState,
   CreateRSCHandlerOptions,
+  LoadSSRModule,
+  SSRModule,
 } from "./types.js";
-import { hasBodyContent, createResponseWithMergedHeaders } from "./helpers.js";
-import { generateNonce } from "./nonce.js";
+import {
+  createResponseWithMergedHeaders,
+  finalizeResponse,
+  interceptRedirectForPartial,
+  buildRouteMiddlewareEntries,
+} from "./helpers.js";
+import {
+  handleResponseRoute,
+  type ResponseRouteMatch,
+} from "./response-route-handler.js";
+import { generateNonce, nonce as nonceToken } from "./nonce.js";
 import { VERSION } from "@rangojs/router:version";
 import type { ErrorPhase } from "../types.js";
+import type { RouterRequestInput } from "../router/router-interfaces.js";
 import { invokeOnError } from "../router/error-handling.js";
 import {
-  getGlobalRouteMap,
+  createReverseFunction,
+  stripInternalParams,
+} from "../router/handler-context.js";
+import { getRouterContext } from "../router/router-context.js";
+import { resolveSink, safeEmit } from "../router/telemetry.js";
+import { contextSet } from "../context-var.js";
+import {
   hasCachedManifest,
-  setCachedManifest,
   getRouteTrie,
-  setRouteTrie,
   getPrecomputedEntries,
   waitForManifestReady,
   getRouterManifest,
   getRouterTrie,
-  setRouterManifest,
-  setRouterTrie,
 } from "../route-map-builder.js";
-
-/**
- * Build a ResponseError payload from a caught error.
- * RouterError messages are always exposed (developer-crafted).
- * Standard Error messages are hidden in production.
- */
-function createResponseErrorPayload(error: unknown, isDev: boolean): ResponseError {
-  if (error instanceof RouterError) {
-    return {
-      message: error.message,
-      code: error.code,
-      ...(error.type ? { type: error.type } : {}),
-      ...(isDev && error.stack ? { stack: error.stack } : {}),
-    };
-  }
-  if (error instanceof Error) {
-    return {
-      message: isDev ? error.message : "Internal Server Error",
-      ...(isDev && error.stack ? { stack: error.stack } : {}),
-    };
-  }
-  return {
-    message: isDev ? String(error) : "Internal Server Error",
-  };
-}
+import type { HandlerContext } from "./handler-context.js";
+import { buildRouterTrieFromUrlpatterns } from "./manifest-init.js";
+import { handleProgressiveEnhancement } from "./progressive-enhancement.js";
+import {
+  executeServerAction,
+  revalidateAfterAction,
+  type ActionContinuation,
+} from "./server-action.js";
+import { handleLoaderFetch } from "./loader-fetch.js";
+import { checkRequestOrigin, type OriginCheckPhase } from "./origin-guard.js";
+import { handleRscRendering } from "./rsc-rendering.js";
+import {
+  withTimeout,
+  RouterTimeoutError,
+  createDefaultTimeoutResponse,
+  type TimeoutPhase,
+} from "../router/timeout.js";
+import {
+  createMetricsStore,
+  appendMetric,
+  buildMetricsTiming,
+} from "../router/metrics.js";
+import {
+  startSSRSetup,
+  getSSRSetup,
+  mayNeedSSR,
+  SSR_SETUP_VAR,
+} from "./ssr-setup.js";
 
 /**
  * Create an RSC request handler.
@@ -125,33 +133,179 @@ export function createRSCHandler<
     decodeFormState,
   } = deps;
 
-  // Use provided loadSSRModule or default to vite RSC module loader
-  const loadSSRModule =
+  // Use provided loadSSRModule or default to vite RSC module loader.
+  // In production the SSR module is stable across requests, so memoize
+  // the dynamic import to avoid repeated module resolution overhead.
+  // In dev mode Vite may hot-reload the module, so skip memoization.
+  const rawLoadSSRModule: LoadSSRModule =
     options.loadSSRModule ??
     (() => import.meta.viteRsc.loadModule("ssr", "index"));
+  let _ssrModulePromise: Promise<SSRModule> | undefined;
+  const loadSSRModule: LoadSSRModule =
+    process.env.NODE_ENV === "production"
+      ? () =>
+          (_ssrModulePromise ??= rawLoadSSRModule().catch((err) => {
+            _ssrModulePromise = undefined;
+            throw err;
+          }))
+      : rawLoadSSRModule;
 
   /**
-   * Wrapper for invokeOnError that binds the router's onError callback.
-   * Uses the shared utility from router/error-handling.ts for consistent behavior.
+   * Per-request error reporter that deduplicates via the ALS request context.
+   *
+   * Uses the same _reportedErrors WeakSet as the router layer so errors
+   * that propagate across layers are only reported once per request.
    */
   function callOnError(
     error: unknown,
     phase: ErrorPhase,
     context: Parameters<typeof invokeOnError<TEnv>>[3],
   ): void {
+    if (error != null && typeof error === "object") {
+      const reportedErrors = requireRequestContext()._reportedErrors;
+      if (reportedErrors.has(error)) return;
+      reportedErrors.add(error);
+    }
     invokeOnError(router.onError, error, phase, context, "RSC");
   }
 
-  return async function handler(
+  function getRequiredRouteMap(): Record<string, string> {
+    const routeMap = getRouterManifest(router.id);
+    if (!routeMap) {
+      throw new Error(
+        `Route manifest for router "${router.id}" is not available.`,
+      );
+    }
+    return routeMap;
+  }
+
+  /**
+   * Handle a timeout by reporting the error, emitting telemetry,
+   * and returning either the custom onTimeout response or a default 504.
+   */
+  async function handleTimeoutResponse(
     request: Request,
-    env: TEnv & { ctx?: ExecutionContext } = {} as TEnv & {
-      ctx?: ExecutionContext;
+    env: TEnv,
+    url: URL,
+    phase: TimeoutPhase,
+    durationMs: number,
+    routeKey?: string,
+    actionId?: string,
+  ): Promise<Response> {
+    const timeoutError = new RouterTimeoutError(phase, durationMs);
+
+    callOnError(timeoutError, phase === "action" ? "action" : "handler", {
+      request,
+      url,
+      env,
+      routeKey,
+      actionId,
+      handledByBoundary: false,
+      metadata: { timeout: true, phase, durationMs },
+    });
+
+    try {
+      const routerCtx = getRouterContext();
+      if (routerCtx?.telemetry) {
+        safeEmit(resolveSink(routerCtx.telemetry), {
+          type: "request.timeout" as const,
+          timestamp: performance.now(),
+          requestId: routerCtx.requestId,
+          phase,
+          pathname: url.pathname,
+          routeKey,
+          actionId,
+          durationMs,
+          customHandler: !!router.onTimeout,
+        });
+      }
+    } catch {
+      // Router context may not be available
+    }
+
+    if (router.onTimeout) {
+      try {
+        return await router.onTimeout({
+          phase,
+          request,
+          url,
+          env,
+          routeKey,
+          actionId,
+          durationMs,
+        });
+      } catch (e) {
+        if (process.env.NODE_ENV !== "production") {
+          console.error("[RSC] onTimeout callback error:", e);
+        }
+        return createDefaultTimeoutResponse(phase);
+      }
+    }
+
+    return createDefaultTimeoutResponse(phase);
+  }
+
+  /**
+   * Build a 200 Flight response that carries a redirect URL and optional state.
+   * Used when a partial/action request results in a redirect -- fetch
+   * auto-follows 3xx so we send the redirect as payload metadata instead.
+   */
+  function createRedirectFlightResponse(
+    redirectUrl: string,
+    locationState?: Record<string, unknown>,
+  ): Response {
+    const redirectPayload: RscPayload = {
+      metadata: {
+        pathname: redirectUrl,
+        segments: [],
+        redirect: { url: redirectUrl },
+        ...(locationState && { locationState }),
+      },
+    };
+    const rscStream = renderToReadableStream<RscPayload>(redirectPayload);
+    return createResponseWithMergedHeaders(rscStream, {
+      status: 200,
+      headers: { "content-type": "text/x-component;charset=utf-8" },
+    });
+  }
+
+  // Bundle shared dependencies for extracted handler functions.
+  // callOnError reads from ALS so it's inherently per-request scoped.
+  const handlerCtx: HandlerContext<TEnv> = {
+    router,
+    version,
+    renderToReadableStream,
+    decodeReply,
+    createTemporaryReferenceSet,
+    loadServerAction,
+    decodeAction,
+    decodeFormState,
+    loadSSRModule,
+    callOnError,
+    getRequiredRouteMap,
+    createRedirectFlightResponse,
+    resolveStreamMode: async (request, env, url) => {
+      const resolver = router.ssr?.resolveStreaming;
+      if (!resolver) return "stream";
+      return resolver({ request, env, url });
     },
+  };
+
+  return async function handler(
+    request: Request,
+    input: RouterRequestInput<TEnv> = {},
   ): Promise<Response> {
     const handlerStart = performance.now();
+    // Create the metrics store at handler start so handler:total has startTime=0
+    // and all metrics are relative to the request entry point.
+    const earlyMetricsStore = router.debugPerformance
+      ? createMetricsStore(true, handlerStart)
+      : undefined;
+
+    const { env = {} as TEnv, vars: initialVars, ctx: executionCtx } = input;
 
     // Connection warmup: return 204 immediately before any processing
-    if (router.warmupEnabled && request.method === "HEAD") {
+    if (router?.warmupEnabled && request.method === "HEAD") {
       const warmupUrl = new URL(request.url);
       if (warmupUrl.searchParams.has("_rsc_warmup")) {
         return new Response(null, { status: 204 });
@@ -175,13 +329,14 @@ export function createRSCHandler<
     const mwMatchDur = performance.now() - mwMatchStart;
 
     // Shared variables between middleware and route handlers
-    // Initialize from env.Variables if provided (allows pre-seeding from worker entry)
-    const variables: Record<string, any> = {
-      ...((env as any)?.Variables ?? {}),
-    };
+    // Initialize from input.vars if provided (allows pre-seeding from worker entry)
+    const variables: Record<string, any> = initialVars
+      ? { ...initialVars }
+      : {};
 
-    // Store nonce in variables so middleware can access via ctx.get('nonce')
+    // Store nonce via ContextVar token and string key for backward compat
     if (nonce) {
+      contextSet(variables, nonceToken, nonce);
       variables.nonce = nonce;
     }
 
@@ -192,7 +347,9 @@ export function createRSCHandler<
     const cacheOption = options.cache ?? router.cache;
     if (cacheOption && !url.searchParams.has("__no_cache")) {
       const cacheConfig =
-        typeof cacheOption === "function" ? cacheOption(env) : cacheOption;
+        typeof cacheOption === "function"
+          ? cacheOption(env, executionCtx)
+          : cacheOption;
 
       if (cacheConfig.enabled !== false) {
         cacheStore = cacheConfig.store;
@@ -223,56 +380,7 @@ export function createRSCHandler<
         // Cloudflare dev: generate manifest inline for this router.
         // Each router generates its own manifest independently so
         // multi-router setups (host routing) work correctly.
-        const { generateManifest } =
-          await import("../build/generate-manifest.js");
-        const generated = generateManifest(router.urlpatterns);
-        if (
-          generated._routeAncestry &&
-          Object.keys(generated._routeAncestry).length > 0
-        ) {
-          const { buildRouteTrie } = await import("../build/route-trie.js");
-          // Map each route to its include() staticPrefix so the trie
-          // returns the correct sp for lazy entry lookup in findMatch.
-          const routeToStaticPrefix: Record<string, string> = {};
-          for (const name of Object.keys(generated.routeManifest)) {
-            routeToStaticPrefix[name] = "";
-          }
-          // Override with prefix from include() entries so the trie
-          // returns the correct sp for lazy entry lookup in findMatch.
-          // Walk recursively to include routes in nested includes.
-          if (generated.prefixTree) {
-            const visitPrefixNode = (node: any): void => {
-              const sp = node.staticPrefix || "";
-              for (const route of (node.routes || [])) {
-                routeToStaticPrefix[route] = sp;
-              }
-              for (const child of Object.values(node.children || {})) {
-                visitPrefixNode(child);
-              }
-            };
-            for (const node of Object.values(generated.prefixTree)) {
-              visitPrefixNode(node);
-            }
-          }
-          const trie = buildRouteTrie(
-            generated.routeManifest,
-            generated._routeAncestry,
-            routeToStaticPrefix,
-            generated.routeTrailingSlash,
-            generated.prerenderRoutes ? new Set(generated.prerenderRoutes) : undefined,
-            generated.passthroughRoutes ? new Set(generated.passthroughRoutes) : undefined,
-            generated.responseTypeRoutes,
-          );
-          setRouterTrie(router.id, trie);
-          // Set global trie only if not already set by another router
-          if (!getRouteTrie()) {
-            setRouteTrie(trie);
-          }
-        }
-        setRouterManifest(router.id, generated.routeManifest);
-        // Merge into global manifest (needed for reverse/href across routers)
-        const existing = hasCachedManifest() ? getGlobalRouteMap() : {};
-        setCachedManifest({ ...existing, ...generated.routeManifest });
+        await buildRouterTrieFromUrlpatterns(router);
       }
       if (!getRouterManifest(router.id) && !hasCachedManifest()) {
         throw new Error(
@@ -280,10 +388,17 @@ export function createRSCHandler<
         );
       }
     }
-    const manifestCacheDur = performance.now() - manifestCacheStart;
 
-    // Note: Route map for useHref() is loaded lazily via getGlobalRouteMap()
-    // This allows it to include all routes from lazy includes after manifest loading
+    // Rebuild the trie when the manifest exists but the per-router trie is
+    // missing. This happens in dev mode after HMR: the virtual module sets
+    // the manifest (from fresh gen files) but the trie is intentionally not
+    // injected to avoid stale discovery-time data. Without the trie, route
+    // matching falls back to regex iteration which does not handle wildcard
+    // priority correctly (catch-all patterns match before specific routes).
+    if (!getRouterTrie(router.id) && router.urlpatterns) {
+      await buildRouterTrieFromUrlpatterns(router);
+    }
+    const manifestCacheDur = performance.now() - manifestCacheStart;
 
     // Create unified request context with all methods
     // Includes: stub response, handle store, loader memoization, use(), cookies, headers, cache store
@@ -295,9 +410,27 @@ export function createRSCHandler<
       url,
       variables,
       cacheStore,
-      executionContext: env.ctx,
+      cacheProfiles: router.cacheProfiles,
+      executionContext: executionCtx,
       themeConfig: router.themeConfig,
     });
+    if (earlyMetricsStore) {
+      requestContext._debugPerformance = true;
+      requestContext._metricsStore = earlyMetricsStore;
+    }
+    // Wire background error reporting so "use cache" and other subsystems
+    // can surface non-fatal errors through the router's onError callback.
+    requestContext._reportBackgroundError = (
+      error: unknown,
+      category: string,
+    ) => {
+      callOnError(error, "cache", {
+        request,
+        url,
+        metadata: { category },
+      });
+    };
+
     const ctxCreateDur = performance.now() - ctxCreateStart;
 
     // Accumulate handler-level timing for Server-Timing header
@@ -326,17 +459,71 @@ export function createRSCHandler<
       };
 
       // Execute middleware chain if any, otherwise call core handler directly
+      let response: Response;
       if (matchedMiddleware.length > 0) {
-        return executeMiddleware(
+        const mwResponse = await executeMiddleware(
           matchedMiddleware,
           request,
           env,
           variables,
           coreHandler,
+          createReverseFunction(getRequiredRouteMap()),
+        );
+
+        if (
+          url.searchParams.has("_rsc_partial") ||
+          url.searchParams.has("_rsc_action")
+        ) {
+          const intercepted = interceptRedirectForPartial(
+            mwResponse,
+            createRedirectFlightResponse,
+          );
+          response = intercepted ?? finalizeResponse(mwResponse);
+        } else {
+          response = finalizeResponse(mwResponse);
+        }
+      } else {
+        response = await coreHandler();
+      }
+
+      // Finalize metrics after all middleware (including post-next work)
+      // has completed so :post spans are captured in the timeline.
+      // Handler timing parts are always emitted (even without debug metrics)
+      // so non-debug requests still get bootstrap Server-Timing entries.
+      const handlerTimingArr: string[] = variables.__handlerTiming || [];
+      // Preserve any existing Server-Timing set by response routes or middleware
+      const existingTiming = response.headers.get("Server-Timing");
+      const timingParts = existingTiming
+        ? [existingTiming, ...handlerTimingArr]
+        : [...handlerTimingArr];
+
+      const metricsStore = requestContext._metricsStore;
+      if (metricsStore) {
+        // When the store was created at handler start (earlyMetricsStore),
+        // handler:total covers the full request. When ctx.debugPerformance()
+        // created the store mid-request, use its requestStart to avoid a
+        // negative startTime offset.
+        const totalStart = earlyMetricsStore
+          ? handlerStart
+          : metricsStore.requestStart;
+        appendMetric(
+          metricsStore,
+          "handler:total",
+          totalStart,
+          performance.now() - totalStart,
         );
+        const metricsTiming = buildMetricsTiming(
+          request.method,
+          url.pathname,
+          metricsStore,
+        );
+        if (metricsTiming) timingParts.push(metricsTiming);
       }
 
-      return coreHandler();
+      const fullTiming = timingParts.join(", ");
+      if (fullTiming) response.headers.set("Server-Timing", fullTiming);
+
+      return response;
     });
   };
 
@@ -348,224 +535,314 @@ export function createRSCHandler<
     variables: Record<string, any>,
     nonce: string | undefined,
   ): Promise<Response> {
-    // First, check for route-level middleware
     const previewStart = performance.now();
-    const preview = await router.previewMatch(request, env);
+    const preview = await router.previewMatch(request, { env });
     const previewDur = performance.now() - previewStart;
     const handlerTiming: string[] = variables.__handlerTiming || [];
     handlerTiming.push(`handler-preview-match;dur=${previewDur.toFixed(2)}`);
     // Response route short-circuit: skip entire RSC pipeline
     if (preview?.responseType && preview.handler) {
-      const isPartial = url.searchParams.has("_rsc_partial");
-
-      // Partial requests (client-side navigation) to response routes
-      // get X-RSC-Reload to trigger hard navigation in the browser
-      if (isPartial) {
-        const cleanUrl = new URL(url);
-        cleanUrl.searchParams.delete("_rsc_partial");
-        cleanUrl.searchParams.delete("_rsc_segments");
-        cleanUrl.searchParams.delete("_rsc_v");
-        cleanUrl.searchParams.delete("_rsc_stale");
-        cleanUrl.searchParams.delete("_rsc_action");
-        cleanUrl.searchParams.delete("_rsc_prev");
-
-        return createResponseWithMergedHeaders(null, {
-          status: 200,
-          headers: {
-            "X-RSC-Reload": cleanUrl.toString(),
-            "content-type": "text/x-component;charset=utf-8",
-          },
-        });
+      const responseOutcome = await withTimeout(
+        handleResponseRoute(
+          handlerCtx,
+          preview as ResponseRouteMatch,
+          request,
+          env,
+          url,
+          variables,
+        ),
+        router.timeouts.renderStartMs,
+        "render-start",
+      );
+      if (responseOutcome.timedOut) {
+        return handleTimeoutResponse(
+          request,
+          env,
+          url,
+          "render-start",
+          responseOutcome.durationMs,
+          preview?.routeKey,
+        );
       }
+      return responseOutcome.result;
+    }
 
-      // Build lightweight context for response handler
-      const bindings = (env as any)?.Bindings ?? env;
-      const reqCtx = requireRequestContext();
-      const responseHandlerCtx = {
+    // Kick off SSR module loading + stream mode resolution in parallel with
+    // segment resolution. Placed after the response-route short-circuit so
+    // response/mime routes never pay for SSR work.
+    if (mayNeedSSR(request, url)) {
+      variables[SSR_SETUP_VAR] = startSSRSetup(
+        handlerCtx,
         request,
-        params: preview.params || {},
-        env: bindings,
-        searchParams: url.searchParams,
+        env,
         url,
-        pathname: url.pathname,
-        href: (name: string, hrefParams?: Record<string, string>) => {
-          if (name.startsWith("/")) {
-            if (!hrefParams) return name;
-            return name.replace(/:([^/]+)/g, (_, key) => {
-              const value = hrefParams[key];
-              if (value === undefined) throw new Error(`Missing param "${key}" for path "${name}"`);
-              return encodeURIComponent(value);
-            });
-          }
-          return name;
-        },
-        get: (key: string) => variables[key],
-        header: (name: string, value: string) => reqCtx.header(name, value),
-        setCookie: (name: string, value: string, options?: any) => reqCtx.setCookie(name, value, options),
-      };
+        router.debugPerformance
+          ? () => requireRequestContext()._metricsStore
+          : undefined,
+      );
+    }
 
-      // Call handler directly, wrapped by route middleware if present
-      const callHandler = async () => {
-        // JSON response routes: wrap in { data } / { error } envelope
-        if (preview.responseType === "json") {
-          const errorCtx = { request, url, env };
-          try {
-            const result = await (preview.handler as Function)(responseHandlerCtx);
-            if (result instanceof Response) {
-              const mergedHeaders: Record<string, string> = {};
-              result.headers.forEach((value, key) => {
-                mergedHeaders[key] = value;
-              });
-              return createResponseWithMergedHeaders(result.body, {
-                status: result.status,
-                headers: mergedHeaders,
-              });
-            }
-            return createResponseWithMergedHeaders(
-              JSON.stringify({ data: result }),
-              { status: 200, headers: { "content-type": "application/json;charset=utf-8" } },
-            );
-          } catch (error) {
-            callOnError(error, "handler", errorCtx);
-            const isDev = process.env.NODE_ENV !== "production";
-            const status = error instanceof RouterError ? error.status : 500;
-            return createResponseWithMergedHeaders(
-              JSON.stringify({ error: createResponseErrorPayload(error, isDev) }),
-              { status, headers: { "content-type": "application/json;charset=utf-8" } },
-            );
-          }
-        }
+    const routeReverse = createReverseFunction(getRequiredRouteMap());
 
-        // Non-JSON response routes: catch errors and return plain Response
-        const errorCtx = { request, url, env };
-        try {
-          const result = await (preview.handler as Function)(responseHandlerCtx);
+    const isAction =
+      request.headers.has("rsc-action") || url.searchParams.has("_rsc_action");
+    const isLoaderFetch = url.searchParams.has("_rsc_loader");
+    const actionId =
+      request.headers.get("rsc-action") || url.searchParams.get("_rsc_action");
 
-          if (result instanceof Response) {
-            // Handler returned a Response directly -- pass through
-            const mergedHeaders: Record<string, string> = {};
-            result.headers.forEach((value, key) => {
-              mergedHeaders[key] = value;
-            });
-            return createResponseWithMergedHeaders(result.body, {
-              status: result.status,
-              headers: mergedHeaders,
+    // Origin guard: reject cross-origin actions, loader fetches, and
+    // PE form submissions before any execution. Regular page navigations
+    // (GET without _rsc_loader/_rsc_action) are not affected.
+    const originPhase: OriginCheckPhase | null = isAction
+      ? "action"
+      : isLoaderFetch
+        ? "loader"
+        : request.method === "POST"
+          ? "pe-form"
+          : null;
+    if (originPhase) {
+      const originResult = await checkRequestOrigin(
+        request,
+        url,
+        router.originCheck,
+        env,
+        router.id,
+        originPhase,
+      );
+      if (originResult) {
+        const originError = new Error(
+          `Origin check rejected: ${request.headers.get("origin") ?? "none"} vs ${request.headers.get("host") ?? "none"}`,
+        );
+        originError.name = "OriginCheckError";
+
+        callOnError(originError, "origin", {
+          request,
+          url,
+          env,
+          handledByBoundary: false,
+          metadata: {
+            phase: originPhase,
+            origin: request.headers.get("origin"),
+            host: request.headers.get("host"),
+          },
+        });
+
+        try {
+          const routerCtx = getRouterContext();
+          if (routerCtx?.telemetry) {
+            safeEmit(resolveSink(routerCtx.telemetry), {
+              type: "request.origin-rejected" as const,
+              timestamp: performance.now(),
+              requestId: routerCtx.requestId,
+              method: request.method,
+              pathname: url.pathname,
+              phase: originPhase,
+              origin: request.headers.get("origin"),
+              host: request.headers.get("host"),
             });
           }
+        } catch {
+          // Router context may not be available
+        }
 
-          // Auto-wrap based on response type tag
-          switch (preview.responseType) {
-            case "text":
-              return createResponseWithMergedHeaders(
-                String(result),
-                { status: 200, headers: { "content-type": "text/plain;charset=utf-8" } },
-              );
-            case "html":
-              return createResponseWithMergedHeaders(
-                String(result),
-                { status: 200, headers: { "content-type": "text/html;charset=utf-8" } },
-              );
-            case "xml":
-              return createResponseWithMergedHeaders(
-                String(result),
-                { status: 200, headers: { "content-type": "application/xml;charset=utf-8" } },
-              );
-            case "md":
-              return createResponseWithMergedHeaders(
-                String(result),
-                { status: 200, headers: { "content-type": "text/markdown;charset=utf-8" } },
-              );
-            default:
-              // image, stream, any -- must return Response
-              throw new Error(
-                `Response route handler for "${preview.responseType}" must return a Response object, got ${typeof result}`
-              );
-          }
-        } catch (error) {
-          callOnError(error, "handler", errorCtx);
-          const isDev = process.env.NODE_ENV !== "production";
-          const status = error instanceof RouterError ? error.status : 500;
-          const message = error instanceof RouterError
-            ? error.message
-            : isDev && error instanceof Error
-              ? error.message
-              : "Internal Server Error";
-          return createResponseWithMergedHeaders(message, {
-            status,
-            headers: { "content-type": "text/plain;charset=utf-8" },
+        return originResult;
+      }
+    }
+
+    // Get handle store from request context
+    const handleStore = requireRequestContext()._handleStore;
+
+    // Wire up error reporting for late streaming-handle failures
+    // (LateHandlePushError: handle pushed after stream completion).
+    // Without this, these errors are only caught by React's error boundary
+    // and never reach the router's onError callback or telemetry.
+    handleStore.onError = (error: Error) => {
+      const reqCtx = requireRequestContext();
+      callOnError(error, "handler", {
+        request,
+        url,
+        routeKey: reqCtx._routeName,
+        params: reqCtx.params as Record<string, string>,
+        handledByBoundary: true,
+      });
+      try {
+        const routerCtx = getRouterContext();
+        if (routerCtx?.telemetry) {
+          safeEmit(resolveSink(routerCtx.telemetry), {
+            type: "handler.error" as const,
+            timestamp: performance.now(),
+            requestId: routerCtx.requestId,
+            error,
+            handledByBoundary: true,
+            pathname: url.pathname,
+            routeKey: reqCtx._routeName,
+            params: reqCtx.params as Record<string, string>,
           });
         }
-      };
+      } catch {
+        // Router context may not be available (e.g. prerender path)
+      }
+    };
 
-      // Wrap callHandler to append Vary: Accept on content-negotiated responses
-      const callHandlerWithVary = async () => {
-        const response = await callHandler();
-        if (preview.negotiated) {
-          response.headers.append("Vary", "Accept");
-        }
-        return response;
-      };
+    // Set route params early so all execution paths can access ctx.params.
+    if (preview?.params) {
+      setRequestContextParams(preview.params, preview.routeKey);
+    }
 
-      if (preview.routeMiddleware && preview.routeMiddleware.length > 0) {
-        const middlewareEntries = preview.routeMiddleware.map((mw) => ({
-          entry: {
-            pattern: null,
-            regex: null,
-            paramNames: [],
-            handler: mw.handler,
-            mountPrefix: null,
-          },
-          params: mw.params,
-        }));
-        return executeMiddleware(middlewareEntries, request, env, variables, callHandlerWithVary);
-      }
+    // Progressive enhancement runs before the normal action/render paths.
+    // Route middleware wraps the PE re-render so handlers see the same
+    // context variables regardless of JS/no-JS transport.
+    const progressiveResult = await handleProgressiveEnhancement(
+      handlerCtx,
+      request,
+      env,
+      url,
+      isAction,
+      handleStore,
+      nonce,
+      {
+        routeMiddleware: preview?.routeMiddleware,
+        variables,
+        routeReverse,
+      },
+    );
+    if (progressiveResult) {
+      return progressiveResult;
+    }
 
-      return callHandlerWithVary();
+    // --- Action execution: runs BEFORE route middleware ---
+    // Route middleware wraps rendering only. For actions, the action runs
+    // first in the global middleware context, then route middleware wraps
+    // the revalidation pass (identical to a normal render).
+    let actionContinuation: ActionContinuation | undefined;
+    if (isAction && actionId) {
+      try {
+        const actionOutcome = await withTimeout(
+          executeServerAction(
+            handlerCtx,
+            request,
+            env,
+            url,
+            actionId,
+            handleStore,
+          ),
+          router.timeouts.actionMs,
+          "action",
+        );
+        if (actionOutcome.timedOut) {
+          return handleTimeoutResponse(
+            request,
+            env,
+            url,
+            "action",
+            actionOutcome.durationMs,
+            preview?.routeKey,
+            actionId,
+          );
+        }
+        const result = actionOutcome.result;
+        // Response means redirect or error boundary — done.
+        if (result instanceof Response) return result;
+        actionContinuation = result;
+      } catch (error) {
+        callOnError(error, "action", {
+          request,
+          url,
+          env,
+          actionId,
+          handledByBoundary: false,
+        });
+        console.error(`[RSC] Action error:`, error);
+        throw error;
+      }
     }
 
-    // Wrap RSC handler to append Vary: Accept on content-negotiated routes
-    const rscHandler = async () => {
-      const response = await coreRequestHandlerInner(request, env, url, variables, nonce);
+    // --- Rendering (action revalidation or navigation) ---
+    // Route middleware wraps this — same code path for both cases.
+    const renderHandler = async () => {
+      const response = await coreRequestHandlerInner(
+        request,
+        env,
+        url,
+        variables,
+        nonce,
+        preview?.params,
+        preview?.routeKey,
+        handleStore,
+        actionContinuation,
+      );
       if (preview?.negotiated) {
         response.headers.append("Vary", "Accept");
       }
       return response;
     };
 
-    if (preview?.routeMiddleware && preview.routeMiddleware.length > 0) {
-      // Convert route middleware to app middleware format for execution
-      const middlewareEntries = preview.routeMiddleware.map((mw) => ({
-        entry: {
-          pattern: null,
-          regex: null,
-          paramNames: [],
-          handler: mw.handler,
-          mountPrefix: null,
-        },
-        params: mw.params,
-      }));
+    // Wrap the render path (with or without route middleware) in a
+    // renderStartMs timeout so slow renders are caught before output.
+    const executeRender = async (): Promise<Response> => {
+      if (preview?.routeMiddleware && preview.routeMiddleware.length > 0) {
+        const mwResponse = await executeMiddleware(
+          buildRouteMiddlewareEntries<TEnv>(preview.routeMiddleware),
+          request,
+          env,
+          variables,
+          renderHandler,
+          routeReverse,
+        );
 
-      // Execute route middleware wrapping the actual request handling
-      return executeMiddleware(middlewareEntries, request, env, variables, rscHandler);
-    }
+        if (
+          url.searchParams.has("_rsc_partial") ||
+          url.searchParams.has("_rsc_action")
+        ) {
+          const intercepted = interceptRedirectForPartial(
+            mwResponse,
+            createRedirectFlightResponse,
+          );
+          if (intercepted) return intercepted;
+        }
+
+        return finalizeResponse(mwResponse);
+      }
+
+      // No route middleware, proceed directly
+      return renderHandler();
+    };
 
-    // No route middleware, proceed directly
-    return rscHandler();
+    const renderOutcome = await withTimeout(
+      executeRender(),
+      router.timeouts.renderStartMs,
+      "render-start",
+    );
+    if (renderOutcome.timedOut) {
+      return handleTimeoutResponse(
+        request,
+        env,
+        url,
+        "render-start",
+        renderOutcome.durationMs,
+        preview?.routeKey,
+      );
+    }
+    return renderOutcome.result;
   }
 
-  // Inner request handler (actual RSC logic, wrapped by route middleware if any)
+  // Inner request handler: rendering logic wrapped by route middleware.
+  // Handles action revalidation (when actionContinuation is present),
+  // loader fetches, and regular RSC rendering.
   async function coreRequestHandlerInner(
     request: Request,
     env: TEnv,
     url: URL,
     variables: Record<string, any>,
     nonce: string | undefined,
+    routeParams?: Record<string, string>,
+    routeKey?: string,
+    handleStore?: ReturnType<typeof requireRequestContext>["_handleStore"],
+    actionContinuation?: ActionContinuation,
   ): Promise<Response> {
     const isPartial = url.searchParams.has("_rsc_partial");
     const isAction =
       request.headers.has("rsc-action") || url.searchParams.has("_rsc_action");
-    const actionId =
-      request.headers.get("rsc-action") || url.searchParams.get("_rsc_action");
 
     // Version mismatch detection - client may have stale code after HMR/deployment
     // If versions don't match, tell the client to reload
@@ -575,20 +852,23 @@ export function createRSCHandler<
         `[RSC] Version mismatch: client=${clientVersion}, server=${version}. Forcing reload.`,
       );
 
-      // Clean URL by removing RSC params
-      const cleanUrl = new URL(url);
-      cleanUrl.searchParams.delete("_rsc_partial");
-      cleanUrl.searchParams.delete("_rsc_segments");
-      cleanUrl.searchParams.delete("_rsc_v");
-      cleanUrl.searchParams.delete("_rsc_stale");
-      cleanUrl.searchParams.delete("_rsc_action");
-      cleanUrl.searchParams.delete("_rsc_prev");
-
-      // For actions, reload current page (referer)
-      // For navigation, load the target URL
-      const reloadUrl = isAction
-        ? request.headers.get("referer") || cleanUrl.toString()
-        : cleanUrl.toString();
+      // For actions, reload current page (referer) if same origin.
+      // For navigation, load the target URL.
+      // Validate referer origin to prevent open redirect via crafted header.
+      let reloadUrl = stripInternalParams(url).toString();
+      if (isAction) {
+        const referer = request.headers.get("referer");
+        if (referer) {
+          try {
+            const refererUrl = new URL(referer);
+            if (refererUrl.origin === url.origin) {
+              reloadUrl = referer;
+            }
+          } catch {
+            // Malformed referer, fall back to cleanUrl
+          }
+        }
+      }
 
       // Return special response that tells client to reload
       return createResponseWithMergedHeaders(null, {
@@ -607,8 +887,9 @@ export function createRSCHandler<
       (isDev || router.allowDebugManifest)
     ) {
       const trie = getRouterTrie(router.id) ?? getRouteTrie();
-      const routeManifest = getRouterManifest(router.id) ?? getGlobalRouteMap();
-      const { extractAncestryFromTrie } = await import("../build/route-trie.js");
+      const routeManifest = getRequiredRouteMap();
+      const { extractAncestryFromTrie } =
+        await import("../build/route-trie.js");
       return new Response(
         JSON.stringify(
           {
@@ -627,30 +908,27 @@ export function createRSCHandler<
       );
     }
 
-    // Get handle store from request context (created at start of request)
-    const handleStore = requireRequestContext()._handleStore;
+    const store = handleStore ?? requireRequestContext()._handleStore;
 
     try {
-      // ============================================================================
-      // PROGRESSIVE ENHANCEMENT: No-JS Form Submissions
-      // ============================================================================
-      const progressiveResult = await handleProgressiveEnhancement(
-        request,
-        env,
-        url,
-        isAction,
-        handleStore,
-        nonce,
-      );
-      if (progressiveResult) {
-        return progressiveResult;
+      // Route params were already set in coreRequestHandler, but set again
+      // for callers that enter coreRequestHandlerInner directly.
+      if (routeParams) {
+        setRequestContextParams(routeParams, routeKey);
       }
 
       // ============================================================================
-      // SERVER ACTION EXECUTION (JavaScript-enabled client)
+      // ACTION REVALIDATION (action already executed, revalidate segments)
       // ============================================================================
-      if (isAction && actionId) {
-        return handleServerAction(request, env, url, actionId, handleStore);
+      if (actionContinuation) {
+        return await revalidateAfterAction(
+          handlerCtx,
+          request,
+          env,
+          url,
+          store,
+          actionContinuation,
+        );
       }
 
       // ============================================================================
@@ -658,7 +936,14 @@ export function createRSCHandler<
       // ============================================================================
       const isLoaderRequest = url.searchParams.has("_rsc_loader");
       if (isLoaderRequest) {
-        return handleLoaderFetch(request, env, url, variables);
+        return handleLoaderFetch(
+          handlerCtx,
+          request,
+          env,
+          url,
+          variables,
+          routeParams,
+        );
       }
 
       // ============================================================================
@@ -666,11 +951,12 @@ export function createRSCHandler<
       // ============================================================================
       // Note: Must use "return await" for try/catch to catch async rejections
       return await handleRscRendering(
+        handlerCtx,
         request,
         env,
         url,
         isPartial,
-        handleStore,
+        store,
         nonce,
       );
     } catch (error) {
@@ -684,23 +970,25 @@ export function createRSCHandler<
         if (isPartial && error.status === 200) {
           console.warn(
             `[RSC] Route handler at ${url.pathname} returned a Response during client-side navigation. ` +
-            `Falling back to hard navigation. Use data-external on the <Link> to avoid the extra round-trip.`,
+              `Falling back to hard navigation. Use data-external on the <Link> to avoid the extra round-trip.`,
           );
-          const cleanUrl = new URL(url);
-          cleanUrl.searchParams.delete("_rsc_partial");
-          cleanUrl.searchParams.delete("_rsc_segments");
-          cleanUrl.searchParams.delete("_rsc_v");
-          cleanUrl.searchParams.delete("_rsc_stale");
-          cleanUrl.searchParams.delete("_rsc_action");
-          cleanUrl.searchParams.delete("_rsc_prev");
           return createResponseWithMergedHeaders(null, {
             status: 200,
             headers: {
-              "X-RSC-Reload": cleanUrl.toString(),
+              "X-RSC-Reload": stripInternalParams(url).toString(),
               "content-type": "text/x-component;charset=utf-8",
             },
           });
         }
+
+        if (isPartial) {
+          const intercepted = interceptRedirectForPartial(
+            error,
+            createRedirectFlightResponse,
+          );
+          if (intercepted) return intercepted;
+        }
+
         return error;
       }
 
@@ -734,21 +1022,15 @@ export function createRSCHandler<
           params: {},
         };
 
-        // Render with rootLayout to maintain app shell
-        const root = await renderSegments([notFoundSegment], {
-          rootLayout: router.rootLayout,
-          // No routeName for not-found routes
-        });
-
         const payload: RscPayload = {
-          root,
           metadata: {
             pathname: url.pathname,
             segments: [notFoundSegment],
             matched: [],
             diff: [],
             isPartial: false,
-            handles: handleStore.stream(),
+            rootLayout: router.rootLayout,
+            handles: store.stream(),
             version,
             themeConfig: router.themeConfig,
             warmupEnabled: router.warmupEnabled,
@@ -759,8 +1041,10 @@ export function createRSCHandler<
 
         const rscStream = renderToReadableStream(payload);
 
-        // Determine if this is an RSC request or HTML request
+        // Determine if this is an RSC request or HTML request.
+        // Partial requests are always RSC (see main isRscRequest comment).
         const isRscRequest =
+          isPartial ||
           (!request.headers.get("accept")?.includes("text/html") &&
             !url.searchParams.has("__html")) ||
           url.searchParams.has("__rsc");
@@ -772,9 +1056,18 @@ export function createRSCHandler<
           });
         }
 
-        // Delegate to SSR for HTML response
-        const ssrModule = await loadSSRModule();
-        const htmlStream = await ssrModule.renderHTML(rscStream, { nonce });
+        // Delegate to SSR for HTML response (reuse early setup if available)
+        const [ssrModule, streamMode] = await getSSRSetup(
+          handlerCtx,
+          request,
+          env,
+          url,
+          requireRequestContext()._metricsStore,
+        );
+        const htmlStream = await ssrModule.renderHTML(rscStream, {
+          nonce,
+          streamMode,
+        });
 
         return createResponseWithMergedHeaders(htmlStream, {
           status: 404,
@@ -793,685 +1086,4 @@ export function createRSCHandler<
       throw error;
     }
   }
-
-  // ============================================================================
-  // PROGRESSIVE ENHANCEMENT HANDLER
-  // When JavaScript is disabled, React renders forms with hidden fields
-  // ($ACTION_REF_*, $ACTION_KEY) containing the action reference.
-  // We detect these and return HTML instead of RSC stream.
-  // ============================================================================
-  async function handleProgressiveEnhancement(
-    request: Request,
-    env: TEnv,
-    url: URL,
-    isAction: boolean,
-    handleStore: ReturnType<typeof requireRequestContext>["_handleStore"],
-    nonce: string | undefined,
-  ): Promise<Response | null> {
-    const contentType = request.headers.get("content-type") || "";
-    const isFormSubmission =
-      contentType.includes("multipart/form-data") ||
-      contentType.includes("application/x-www-form-urlencoded");
-
-    if (request.method !== "POST" || isAction || !isFormSubmission) {
-      return null;
-    }
-
-    // Clone the request to read FormData without consuming it
-    const formData = await request.clone().formData();
-
-    // Look for React's progressive enhancement hidden fields
-    let isDirectAction = false;
-    let isUseActionState = false;
-    let directActionId: string | null = null;
-
-    formData.forEach((_value, key) => {
-      if (key.startsWith("$ACTION_ID_")) {
-        isDirectAction = true;
-        directActionId = key.slice("$ACTION_ID_".length);
-      } else if (key.startsWith("$ACTION_REF_")) {
-        isUseActionState = true;
-      }
-    });
-
-    if (!isDirectAction && !isUseActionState) {
-      return null;
-    }
-
-    // Execute action and return HTML
-    let actionResult: unknown = undefined;
-    let reactFormState: ReactFormState | null = null;
-
-    if (isUseActionState) {
-      try {
-        const boundAction = await decodeAction(formData);
-        actionResult = await boundAction();
-      } catch (error) {
-        callOnError(error, "action", {
-          request,
-          url,
-          env,
-          handledByBoundary: false,
-        });
-        console.error("[RSC] Progressive enhancement action error:", error);
-      }
-    } else if (isDirectAction && directActionId) {
-      const temporaryReferences = createTemporaryReferenceSet();
-
-      let args: unknown[] = [];
-      try {
-        args = await decodeReply(formData, { temporaryReferences });
-      } catch {
-        args = [formData];
-      }
-
-      try {
-        const loadedAction = await loadServerAction(directActionId);
-        actionResult = await loadedAction.apply(null, args);
-      } catch (error) {
-        callOnError(error, "action", {
-          request,
-          url,
-          env,
-          actionId: directActionId,
-          handledByBoundary: false,
-        });
-        console.error("[RSC] Progressive enhancement action error:", error);
-      }
-    }
-
-    // Decode form state for useActionState progressive enhancement
-    try {
-      reactFormState = await decodeFormState(actionResult, formData);
-    } catch (error) {
-      callOnError(error, "action", {
-        request,
-        url,
-        env,
-        handledByBoundary: false,
-      });
-      console.error("[RSC] Failed to decode form state:", error);
-    }
-
-    // Re-render the page and return HTML
-    const renderRequest = new Request(url.toString(), {
-      method: "GET",
-      headers: new Headers({ accept: "text/html" }),
-    });
-
-    const match = await router.match(renderRequest, env);
-
-    if (match.redirect) {
-      return new Response(null, {
-        status: 308,
-        headers: { Location: match.redirect },
-      });
-    }
-
-    const root = renderSegments(match.segments, {
-      rootLayout: router.rootLayout,
-    });
-
-    const payload: RscPayload = {
-      root,
-      metadata: {
-        pathname: url.pathname,
-        segments: match.segments,
-        matched: match.matched,
-        diff: match.diff,
-        isPartial: false,
-        rootLayout: router.rootLayout,
-        handles: handleStore.stream(),
-        version,
-        themeConfig: router.themeConfig,
-        warmupEnabled: router.warmupEnabled,
-        initialTheme: requireRequestContext().theme,
-      },
-      formState: actionResult,
-    };
-
-    const rscStream = renderToReadableStream<RscPayload>(payload);
-    const ssrModule = await loadSSRModule();
-    const htmlStream = await ssrModule.renderHTML(rscStream, {
-      formState: reactFormState,
-      nonce,
-    });
-
-    return new Response(htmlStream, {
-      headers: { "content-type": "text/html;charset=utf-8" },
-    });
-  }
-
-  // ============================================================================
-  // SERVER ACTION HANDLER
-  // ============================================================================
-  async function handleServerAction(
-    request: Request,
-    env: TEnv,
-    url: URL,
-    actionId: string,
-    handleStore: ReturnType<typeof requireRequestContext>["_handleStore"],
-  ): Promise<Response> {
-    const temporaryReferences = createTemporaryReferenceSet();
-
-    // Decode action arguments from request body
-    const contentType = request.headers.get("content-type") || "";
-    let args: unknown[] = [];
-    let actionFormData: FormData | undefined;
-
-    try {
-      const body = contentType.includes("multipart/form-data")
-        ? await request.formData()
-        : await request.text();
-
-      if (body instanceof FormData) {
-        actionFormData = body;
-      }
-
-      if (hasBodyContent(body)) {
-        args = await decodeReply(body, { temporaryReferences });
-      }
-    } catch (error) {
-      callOnError(error, "action", {
-        request,
-        url,
-        env,
-        actionId,
-        handledByBoundary: false,
-      });
-      throw new Error(`Failed to decode action arguments: ${error}`, {
-        cause: error,
-      });
-    }
-
-    // Execute the server action
-    let returnValue: { ok: boolean; data: unknown };
-    let actionStatus = 200;
-    let loadedAction: Function | undefined;
-
-    try {
-      loadedAction = await loadServerAction(actionId);
-      const data = await loadedAction!.apply(null, args);
-      returnValue = { ok: true, data };
-    } catch (error) {
-      returnValue = { ok: false, data: error };
-      actionStatus = 500;
-
-      // Try to render error boundary
-      const errorResult = await router.matchError(request, env, error, "route");
-
-      // Report the action error (handledByBoundary indicates if error boundary will render)
-      callOnError(error, "action", {
-        request,
-        url,
-        env,
-        actionId,
-        handledByBoundary: !!errorResult,
-      });
-
-      if (errorResult) {
-        setRequestContextParams(errorResult.params);
-
-        const payload: RscPayload = {
-          root: null,
-          metadata: {
-            pathname: url.pathname,
-            segments: errorResult.segments,
-            isPartial: true,
-            matched: errorResult.matched,
-            diff: errorResult.diff,
-            isError: true,
-            handles: handleStore.stream(),
-            version,
-          },
-          returnValue,
-        };
-
-        const rscStream = renderToReadableStream<RscPayload>(payload, {
-          temporaryReferences,
-        });
-
-        return createResponseWithMergedHeaders(rscStream, {
-          status: actionStatus,
-          headers: { "content-type": "text/x-component;charset=utf-8" },
-        });
-      }
-    }
-
-    // Revalidate after action
-    const resolvedActionId =
-      (loadedAction as { $id?: string; $$id?: string } | undefined)?.$id ??
-      (loadedAction as { $$id?: string } | undefined)?.$$id ??
-      actionId;
-    const actionContext = {
-      actionId: resolvedActionId,
-      actionUrl: new URL(request.url),
-      actionResult: returnValue.data,
-      formData: actionFormData,
-    };
-
-    const matchResult = await router.matchPartial(request, env, actionContext);
-
-    if (!matchResult) {
-      // Fall back to full render
-      const fullMatch = await router.match(request, env);
-      setRequestContextParams(fullMatch.params);
-
-      if (fullMatch.redirect) {
-        return createResponseWithMergedHeaders(null, {
-          status: 308,
-          headers: { Location: fullMatch.redirect },
-        });
-      }
-
-      const renderStart = performance.now();
-      const root = renderSegments(fullMatch.segments, {
-        rootLayout: router.rootLayout,
-        isAction: true,
-      });
-      const renderDuration = performance.now() - renderStart;
-      const serverTiming = fullMatch.serverTiming
-        ? `${fullMatch.serverTiming}, rendering;dur=${renderDuration.toFixed(2)}`
-        : `rendering;dur=${renderDuration.toFixed(2)}`;
-
-      const payload: RscPayload = {
-        root,
-        metadata: {
-          pathname: url.pathname,
-          segments: fullMatch.segments,
-          matched: fullMatch.matched,
-          diff: fullMatch.diff,
-          handles: handleStore.stream(),
-          version,
-        },
-        returnValue,
-      };
-
-      const rscStream = renderToReadableStream<RscPayload>(payload, {
-        temporaryReferences,
-      });
-
-      const headers: Record<string, string> = {
-        "content-type": "text/x-component;charset=utf-8",
-      };
-      if (serverTiming) {
-        headers["Server-Timing"] = serverTiming;
-      }
-
-      return createResponseWithMergedHeaders(rscStream, {
-        status: actionStatus,
-        headers,
-      });
-    }
-
-    // Return updated segments
-    setRequestContextParams(matchResult.params);
-
-    const renderStart = performance.now();
-
-    const renderDuration = performance.now() - renderStart;
-    const serverTiming = matchResult.serverTiming
-      ? `${matchResult.serverTiming}, rendering;dur=${renderDuration.toFixed(2)}`
-      : `rendering;dur=${renderDuration.toFixed(2)}`;
-
-    const payload: RscPayload = {
-      root: null,
-      metadata: {
-        pathname: url.pathname,
-        segments: matchResult.segments,
-        isPartial: true,
-        matched: matchResult.matched,
-        diff: matchResult.diff,
-        slots: matchResult.slots,
-        handles: handleStore.stream(),
-        version,
-      },
-      returnValue,
-    };
-
-    const rscStream = renderToReadableStream<RscPayload>(payload, {
-      temporaryReferences,
-    });
-
-    const actionHeaders: Record<string, string> = {
-      "content-type": "text/x-component;charset=utf-8",
-    };
-    if (serverTiming) {
-      actionHeaders["Server-Timing"] = serverTiming;
-    }
-
-    return createResponseWithMergedHeaders(rscStream, {
-      status: actionStatus,
-      headers: actionHeaders,
-    });
-  }
-
-  // ============================================================================
-  // LOADER FETCH HANDLER
-  // Supports GET (params in query string) and POST/PUT/PATCH/DELETE (JSON body)
-  // ============================================================================
-  async function handleLoaderFetch(
-    request: Request,
-    env: TEnv,
-    url: URL,
-    variables: Record<string, any>,
-  ): Promise<Response> {
-    const loaderId = url.searchParams.get("_rsc_loader");
-
-    if (!loaderId) {
-      return createResponseWithMergedHeaders("Missing _rsc_loader parameter", {
-        status: 400,
-      });
-    }
-
-    // Look up loader lazily
-    const registeredLoader = await getLoaderLazy(loaderId);
-    if (!registeredLoader) {
-      return createResponseWithMergedHeaders(
-        `Loader "${loaderId}" not found in registry`,
-        { status: 404 },
-      );
-    }
-
-    // Parse params and body based on request method
-    let loaderParams: Record<string, string> = {};
-    let loaderBody: unknown = undefined;
-    const isBodyMethod = request.method !== "GET" && request.method !== "HEAD";
-
-    if (isBodyMethod) {
-      try {
-        const contentType = request.headers.get("content-type") || "";
-        if (contentType.includes("application/json")) {
-          const jsonBody = (await request.json()) as {
-            params?: Record<string, string>;
-            body?: unknown;
-          };
-          loaderParams = jsonBody.params ?? {};
-          loaderBody = jsonBody.body;
-        }
-      } catch {
-        return createResponseWithMergedHeaders("Invalid JSON body", {
-          status: 400,
-        });
-      }
-    } else {
-      const loaderParamsJson = url.searchParams.get("_rsc_loader_params");
-      if (loaderParamsJson) {
-        try {
-          loaderParams = JSON.parse(loaderParamsJson);
-        } catch {
-          return createResponseWithMergedHeaders(
-            "Invalid _rsc_loader_params JSON",
-            { status: 400 },
-          );
-        }
-      }
-    }
-
-    // Execute the loader with middleware
-    try {
-      const { fn, middleware } = registeredLoader;
-
-      return await executeLoaderMiddleware(
-        middleware,
-        request,
-        env,
-        loaderParams,
-        variables,
-        async () => {
-          const ctx = requireRequestContext();
-          const loaderCtx: any = {
-            ...ctx,
-            params: loaderParams,
-            body: loaderBody,
-          };
-
-          const result = await fn(loaderCtx);
-
-          interface LoaderPayload {
-            loaderResult: unknown;
-          }
-          const loaderPayload: LoaderPayload = { loaderResult: result };
-          const rscStream =
-            renderToReadableStream<LoaderPayload>(loaderPayload);
-
-          return createResponseWithMergedHeaders(rscStream, {
-            headers: { "content-type": "text/x-component;charset=utf-8" },
-          });
-        },
-      );
-    } catch (error) {
-      const err = error instanceof Error ? error : new Error(String(error));
-      const isDev = process.env.NODE_ENV !== "production";
-
-      console.error("[RSC] Loader error:", error);
-
-      callOnError(error, "loader", {
-        request,
-        url,
-        env,
-        loaderName: loaderId,
-        handledByBoundary: false,
-      });
-
-      const errorPayload = {
-        loaderResult: null,
-        loaderError: {
-          message: isDev ? err.message : "An error occurred",
-          name: err.name,
-        },
-      };
-      const rscStream = renderToReadableStream(errorPayload);
-
-      return createResponseWithMergedHeaders(rscStream, {
-        status: 500,
-        headers: { "content-type": "text/x-component;charset=utf-8" },
-      });
-    }
-  }
-
-  // ============================================================================
-  // RSC RENDERING HANDLER (Navigation)
-  // ============================================================================
-  async function handleRscRendering(
-    request: Request,
-    env: TEnv,
-    url: URL,
-    isPartial: boolean,
-    handleStore: ReturnType<typeof requireRequestContext>["_handleStore"],
-    nonce: string | undefined,
-  ): Promise<Response> {
-    // Retrieve handler-level timing from variables
-    const reqCtx = requireRequestContext();
-    const handlerTimingArr: string[] = reqCtx.var.__handlerTiming || [];
-    const handlerStart: number = reqCtx.var.__handlerStart || 0;
-
-    let payload: RscPayload;
-    let serverTiming: string | undefined;
-
-    if (isPartial) {
-      // Partial render (navigation)
-      const result = await router.matchPartial(request, env);
-
-      if (!result) {
-        // Fall back to full render
-        const match = await router.match(request, env);
-        setRequestContextParams(match.params);
-
-        if (match.redirect) {
-          return createResponseWithMergedHeaders(null, {
-            status: 308,
-            headers: { Location: match.redirect },
-          });
-        }
-
-        const renderStart = performance.now();
-        const root = renderSegments(match.segments, {
-          rootLayout: router.rootLayout,
-        });
-        const renderDuration = performance.now() - renderStart;
-        serverTiming = match.serverTiming
-          ? `${match.serverTiming}, rendering;dur=${renderDuration.toFixed(2)}`
-          : `rendering;dur=${renderDuration.toFixed(2)}`;
-
-        payload = {
-          root,
-          metadata: {
-            pathname: url.pathname,
-            segments: match.segments,
-            matched: match.matched,
-            diff: match.diff,
-            isPartial: false,
-            handles: handleStore.stream(),
-            version,
-            themeConfig: router.themeConfig,
-            initialTheme: reqCtx.theme,
-          },
-        };
-      } else {
-        setRequestContextParams(result.params);
-        serverTiming = result.serverTiming;
-
-        payload = {
-          root: null,
-          metadata: {
-            pathname: url.pathname,
-            segments: result.segments,
-            matched: result.matched,
-            diff: result.diff,
-            isPartial: true,
-            slots: result.slots,
-            handles: handleStore.stream(),
-            version,
-          },
-        };
-      }
-    } else {
-      // Full render (initial page load)
-      const match = await router.match(request, env);
-      setRequestContextParams(match.params);
-
-      if (match.redirect) {
-        return createResponseWithMergedHeaders(null, {
-          status: 308,
-          headers: { Location: match.redirect },
-        });
-      }
-
-      // Caching is now handled in router.match() via cache provider in request context
-      // match.segments already contains cached or fresh segments as appropriate
-
-      if (url.searchParams.has("__prerender_collect")) {
-        // Build-time prerender collection: serialize segments and handle data
-        // to JSON for storage as build artifacts. At runtime the worker
-        // deserializes these and feeds them through the normal segment pipeline.
-        const nonLoaderSegments = match.segments.filter((s) => s.type !== "loader");
-        await handleStore.settled;
-        const { serializeSegments } = await import("../cache/cache-scope.js");
-        const serializedSegments = await serializeSegments(nonLoaderSegments);
-        const handles: Record<string, Record<string, unknown[]>> = {};
-        for (const seg of nonLoaderSegments) {
-          const segHandles = handleStore.getDataForSegment(seg.id);
-          if (Object.keys(segHandles).length > 0) {
-            handles[seg.id] = segHandles;
-          }
-        }
-        return new Response(
-          JSON.stringify({
-            segments: serializedSegments,
-            handles,
-            routeName: match.routeName,
-            params: match.params,
-          }),
-          { headers: { "Content-Type": "application/json" } },
-        );
-      } else {
-        const renderStart = performance.now();
-        const root = renderSegments(match.segments, {
-          rootLayout: router.rootLayout,
-        });
-        const renderDuration = performance.now() - renderStart;
-        serverTiming = match.serverTiming
-          ? `${match.serverTiming}, rendering;dur=${renderDuration.toFixed(2)}`
-          : `rendering;dur=${renderDuration.toFixed(2)}`;
-
-        payload = {
-          root,
-          metadata: {
-            pathname: url.pathname,
-            segments: match.segments,
-            matched: match.matched,
-            diff: match.diff,
-            isPartial: false,
-            rootLayout: router.rootLayout,
-            handles: handleStore.stream(),
-            version,
-            themeConfig: router.themeConfig,
-            initialTheme: reqCtx.theme,
-          },
-        };
-      }
-    }
-
-    // Serialize to RSC stream
-    const rscSerializeStart = performance.now();
-    const rscStream = renderToReadableStream<RscPayload>(payload);
-    const rscSerializeDur = performance.now() - rscSerializeStart;
-
-    // Determine if this is an RSC request or HTML request
-    const isRscRequest =
-      (!request.headers.get("accept")?.includes("text/html") &&
-        !url.searchParams.has("__html")) ||
-      url.searchParams.has("__rsc");
-
-    // Build complete Server-Timing: handler phases + match/manifest + rendering + RSC serialize
-    const timingParts: string[] = [...handlerTimingArr];
-    if (serverTiming) {
-      timingParts.push(serverTiming);
-    }
-    timingParts.push(`rsc-serialize;dur=${rscSerializeDur.toFixed(2)}`);
-
-    if (isRscRequest) {
-      const fullTiming = timingParts.join(", ");
-      const rscHeaders: Record<string, string> = {
-        "content-type": "text/x-component;charset=utf-8",
-        vary: "accept",
-      };
-      if (fullTiming) {
-        rscHeaders["Server-Timing"] = fullTiming;
-      }
-      return createResponseWithMergedHeaders(rscStream, {
-        headers: rscHeaders,
-      });
-    }
-
-    // Delegate to SSR for HTML response
-    const ssrModuleStart = performance.now();
-    const ssrModule = await loadSSRModule();
-    const ssrModuleDur = performance.now() - ssrModuleStart;
-    timingParts.push(`ssr-module-load;dur=${ssrModuleDur.toFixed(2)}`);
-
-    const ssrRenderStart = performance.now();
-    const htmlStream = await ssrModule.renderHTML(rscStream, { nonce });
-    const ssrRenderDur = performance.now() - ssrRenderStart;
-    timingParts.push(`ssr-render-html;dur=${ssrRenderDur.toFixed(2)}`);
-
-    // Add total handler duration
-    if (handlerStart) {
-      const totalHandler = performance.now() - handlerStart;
-      timingParts.push(`handler-total;dur=${totalHandler.toFixed(2)}`);
-    }
-
-    const fullTiming = timingParts.join(", ");
-    const htmlHeaders: Record<string, string> = {
-      "content-type": "text/html;charset=utf-8",
-    };
-    if (fullTiming) {
-      htmlHeaders["Server-Timing"] = fullTiming;
-    }
-
-    return createResponseWithMergedHeaders(htmlStream, {
-      headers: htmlHeaders,
-    });
-  }
 }