@reckona/mreact-router 0.0.201 → 0.0.203

package/src/render.ts

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { readFileSync } from "node:fs";
 import { access, readFile, stat } from "node:fs/promises";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { formatDiagnostic, transform } from "@reckona/mreact-compiler";
@@ -15,6 +16,7 @@ import {
   installQueryAsyncStorage,
   runWithQueryClient,
   type DehydratedQueryClient,
+  type DehydrateOptions,
   type QueryClient,
 } from "@reckona/mreact-query";
 import {
@@ -34,9 +36,9 @@ import {
 } from "./client-route-inference.js";
 import {
   hydrationMarkerParts,
+  routeMarkerParts,
   routeIdForPath,
   withHydrationMarkers,
-  withRouteMarkers,
 } from "./navigation-runtime.js";
 import { assetPath } from "./assets.js";
 import { escapeHtmlAttribute } from "@reckona/mreact-shared/html-escape";
@@ -60,6 +62,15 @@ import {
   routeCacheKey,
   routeCachePolicyFromSource,
 } from "./cache.js";
+import {
+  trackRequestHeaderReads,
+  type TrackedHeaderRequest,
+  withTrackedRequest,
+} from "./request-header-tracking.js";
+import {
+  configuredHstsHeader,
+  hasInvalidConfiguredHsts,
+} from "./security-headers.js";
 import { resolveRouterCacheLimit } from "./cache-config.js";
 import {
   importAppRouterBuiltFileModule,
@@ -78,6 +89,7 @@ import {
   hasLoaderExport,
   isStreamRouteSource,
   routeClosureMayUseAwaitBoundary,
+  routeClosureMayUseRequestInput,
   stripRouteBuildExports,
   stripRouteModuleExports,
   stripRouteClientOnlyExports,
@@ -191,6 +203,7 @@ export interface RenderAppRequestOptions {
   clientStylesByFile?: ReadonlyMap<string, readonly string[]>;
   clientStyles?: ReadonlyMap<string, readonly string[]>;
   define?: UserConfig["define"] | undefined;
+  dehydrateOptions?: DehydrateOptions | undefined;
   env?: unknown;
   importPolicy?: AppRouterImportPolicy | undefined;
   instrumentation?: RouterInstrumentation | undefined;
@@ -222,6 +235,22 @@ export interface RenderAppRequestOptions {
 }
 
 export interface RenderAppRequestRuntimeOptions extends RenderAppRequestOptions {
+  /**
+   * Receives whether the render depended on the incoming request headers.
+   *
+   * Callers that store the rendered HTML under a key which ignores headers,
+   * such as prerender regeneration, pass this to learn whether the result is
+   * only correct for the current visitor. Initialize it to a function returning
+   * `true`: a render that returns without reporting back stays header
+   * dependent. Call it only after draining the response body, because a
+   * streamed render can read headers while its deferred parts resolve.
+   */
+  renderSignals?:
+    | {
+        headerDependent: () => boolean;
+        strictTransportSecurity: () => string | undefined;
+      }
+    | undefined;
   serverRenderArtifactLoader?: AppRouterServerRenderArtifactLoader | undefined;
 }
 
@@ -617,30 +646,18 @@ export function routerRenderRuntimeCacheStats(): RouterRuntimeCacheStat[] {
       maxComposedRouteMetadataCacheEntries,
       composedRouteMetadataCacheCounters,
     ),
-    routerRuntimeCacheStat(
-      "rendered-shell",
-      renderedShellCache,
-      MAX_RENDERED_SHELL_CACHE_ENTRIES,
-      renderedShellCacheCounters,
-    ),
+    // Preserve the public diagnostics entry while making explicit that rendered HTML reuse is disabled.
+    {
+      evictions: 0,
+      hits: 0,
+      maxEntries: 0,
+      misses: 0,
+      name: "rendered-shell",
+      size: 0,
+    },
   ];
 }
 
-// Issue 086: per-shell prefix/suffix cache. Pure layouts (whose
-// exported component takes zero arguments and therefore cannot
-// depend on the request props) produce the same HTML for every
-// request, so we cache the already-split { prefix, suffix } strings
-// keyed by appDir + shellFile + serverModuleCacheVersion. Impure
-// layouts (function.length > 0) are tagged "impure" so we skip the
-// detection on subsequent requests but still render per-request.
-//
-// The cache is only active when a version is present (production
-// builds); dev mode keeps the previous behaviour so reloads pick up
-// edits without server restart.
-const renderedShellCache = new Map<string, RenderedShell | "impure">();
-const MAX_RENDERED_SHELL_CACHE_ENTRIES = 1024;
-const renderedShellCacheCounters = createRouterRuntimeCacheCounters();
-
 interface RenderedShell {
   hasOutOfOrderBoundary: boolean;
   prefix: string;
@@ -654,6 +671,7 @@ interface RouteSourceAnalysis {
   hasLoader: boolean;
   routeCode: string;
   streamRoute: boolean;
+  usesRequestInput: boolean;
   usesRuntimeCacheControl: boolean;
 }
 
@@ -932,6 +950,9 @@ async function renderAppRequestInternal(
         renderAppRequestInternal({
           ...options,
           matchedRoute: undefined,
+          // This renders a different route than the caller asked about, so its
+          // header dependence says nothing about the caller's request.
+          renderSignals: undefined,
           request: singleFlightNavigationRequest({
             path: singleFlight.path,
             request: singleFlight.request,
@@ -983,6 +1004,10 @@ async function renderAppRequestInternal(
         script: string | undefined;
       }
     | undefined;
+  let trackedRequest: TrackedHeaderRequest | undefined;
+  let sourceUsesRequestInput = true;
+  let invalidConfiguredHsts = false;
+  let renderedStrictTransportSecurity: string | undefined;
   return (await withRouteCacheContext(options.routeCache, async () => {
   try {
     if (matched.route.kind === "asset") {
@@ -1055,14 +1080,22 @@ async function renderAppRequestInternal(
       timing,
       vitePlugins: options.vitePlugins,
     });
+    sourceUsesRequestInput = originalAnalysis.usesRequestInput;
     finishRenderTimingPhase(timing, phaseStartedAt, "sourceAnalysisMs");
     const cachePolicy = originalAnalysis.cachePolicy;
     const navigationScript = options.navigationScripts?.get(matched.route.path);
-    const cacheKey = routeCacheKey(options.appDir, matched.route.path, url);
+    const navigationRequest = isNavigationRequest(options.request);
+    const cacheKey = routeCacheKey(
+      options.appDir,
+      matched.route.path,
+      url,
+      navigationRequest ? "navigation" : "document",
+    );
     const mayUseRouteCache =
-      cachePolicy === undefined
+      !sourceUsesRequestInput &&
+      (cachePolicy === undefined
         ? originalAnalysis.usesRuntimeCacheControl
-        : cachePolicy.revalidateSeconds !== 0;
+        : cachePolicy.revalidateSeconds !== 0);
     const reloadRouteCache = isNavigationRouteCacheReloadRequest(options.request);
     phaseStartedAt = renderTimingPhaseStartedAt(timing);
     const cachedResponse =
@@ -1079,6 +1112,18 @@ async function renderAppRequestInternal(
       return cachedResponse;
     }
 
+    // Only a route whose result may be stored pays for header-read tracking;
+    // cache hits returned above never construct it. Application code reads
+    // headers through this request so that a render depending on one is never
+    // stored under a key that ignores it. Callers that store by path alone ask
+    // for tracking through `renderSignals` even when the route itself declares
+    // no cache policy.
+    trackedRequest =
+      mayUseRouteCache || options.renderSignals !== undefined
+        ? trackRequestHeaderReads(options.request)
+        : undefined;
+    const appRequest = trackedRequest?.request ?? options.request;
+
     phaseStartedAt = renderTimingPhaseStartedAt(timing);
     const preparedActions = await prepareRouteServerActions({
       appDir: options.appDir,
@@ -1120,12 +1165,11 @@ async function renderAppRequestInternal(
       ? loadRouteDataWithInstrumentation({
           appDir: options.appDir,
           code: originalCode,
-          context: {
+          context: withTrackedRequest({
             env: options.env,
             params: matched.params,
             queryClient,
-            request: options.request,
-          },
+          }, appRequest, trackedRequest),
           filename: matched.route.file,
           importPolicy: options.importPolicy,
           instrumentation: options.instrumentation,
@@ -1146,7 +1190,7 @@ async function renderAppRequestInternal(
       clientRoute,
       props: {
         params: matched.params,
-        request: { url: options.request.url },
+        request: { url: url.pathname },
       },
       routePath: matched.route.path,
       script: clientScript,
@@ -1210,12 +1254,11 @@ async function renderAppRequestInternal(
         const renderedPage = await runWithQueryClient(queryClient, () =>
           runServerModuleWithSlots(
             stringOutput.code,
-            {
+            withTrackedRequest({
               data,
               params: matched.params,
               queryClient,
-              request: options.request,
-            },
+            }, appRequest, trackedRequest),
             matched.route.file,
             options.serverModules,
             options.serverModuleCacheVersion,
@@ -1236,27 +1279,21 @@ async function renderAppRequestInternal(
               script: clientScript,
               props: {
                 params: matched.params,
-                request: { url: options.request.url },
+                request: { url: url.pathname },
                 data,
               },
             })
-          : isNavigationRequest(options.request)
-            ? withRouteMarkers({
-                html: pageHtml,
-                routePath: matched.route.path,
-              })
-            : pageHtml;
+          : withServerOnlyRouteMarkers(pageHtml, matched.route.path, options.request);
         let html = await runWithQueryClient(queryClient, () =>
           applyLayouts({
             appDir: options.appDir,
             pageFile: matched.route.file,
             html: pageHtmlForLayout,
-            props: {
+            props: withTrackedRequest({
               data,
               params: matched.params,
               queryClient,
-              request: options.request,
-            },
+            }, appRequest, trackedRequest),
             slots: renderedPage.slots,
             serverModules: options.serverModules,
             serverModuleCacheVersion: options.serverModuleCacheVersion,
@@ -1270,11 +1307,10 @@ async function renderAppRequestInternal(
         const metadata = await loadComposedRouteMetadata({
           appDir: options.appDir,
           code: originalCode,
-          context: {
+          context: withTrackedRequest({
             data,
             params: matched.params,
-            request: options.request,
-          },
+          }, appRequest, trackedRequest),
           filename: matched.route.file,
           importPolicy: options.importPolicy,
           routes,
@@ -1297,7 +1333,7 @@ async function renderAppRequestInternal(
           html,
           originalAnalysis.authIncludesClaims ? currentAuthClaims() : undefined,
         );
-        html = injectQueryState(html, dehydrate(queryClient));
+        html = injectQueryState(html, dehydrate(queryClient, options.dehydrateOptions));
         const response = withOptionalActionCookie(
           htmlResponse(
             applyActionHtmlReplacements(
@@ -1319,6 +1355,7 @@ async function renderAppRequestInternal(
           preparedActions.csrfToken,
           preparedActions.csrfTokenIsNew === true,
         );
+        appendNavigationVary(response.headers);
         emitRenderTiming(options, timing, response.status);
         return response;
       }
@@ -1385,10 +1422,13 @@ async function renderAppRequestInternal(
           data: streamDataPromise,
           define: options.define,
           loadingFile,
+          markerRequest: options.request,
           pageFile: matched.route.file,
           params: matched.params,
           queryClient,
-          request: options.request,
+          request: appRequest,
+          requestUrl: url.pathname,
+          trackedRequest,
           routePath: matched.route.path,
           routeScripts: options.clientScripts,
           serverModules: options.serverModules,
@@ -1409,23 +1449,25 @@ async function renderAppRequestInternal(
           preparedActions.csrfToken,
           preparedActions.csrfTokenIsNew === true,
         );
+        appendNavigationVary(response.headers);
         emitRenderTiming(options, timing, response.status);
         return response;
       }
 
       const data = streamData;
-      const props = {
+      const props = withTrackedRequest({
         data,
         params: matched.params,
         queryClient,
-        request: options.request,
-      };
+      }, appRequest, trackedRequest);
       phaseStartedAt = renderTimingPhaseStartedAt(timing);
       const stream = runServerStreamModule(output.code, {
         appDir: options.appDir,
         assetBaseUrl: options.assetBaseUrl,
         pageFile: matched.route.file,
+        markerRequest: options.request,
         props,
+        requestUrl: url.pathname,
         routePath: matched.route.path,
         routeScripts: options.clientScripts,
         serverModules: options.serverModules,
@@ -1448,6 +1490,7 @@ async function renderAppRequestInternal(
         preparedActions.csrfToken,
         preparedActions.csrfTokenIsNew === true,
       );
+      appendNavigationVary(response.headers);
       emitRenderTiming(options, timing, response.status);
       return response;
     }
@@ -1463,6 +1506,12 @@ async function renderAppRequestInternal(
       emitRenderTiming(options, timing, data.status);
       return data;
     }
+    sourceUsesRequestInput ||= await routeShellsMayUseRequestInput({
+      appDir: options.appDir,
+      pageFile: matched.route.file,
+      serverModuleCacheVersion: options.serverModuleCacheVersion,
+      serverSourceFiles: options.serverSourceFiles,
+    });
     await waitForRenderPreload(options, timing);
     await loadServerRenderArtifacts(options, matched.route.file, timing);
     phaseStartedAt = renderTimingPhaseStartedAt(timing);
@@ -1488,12 +1537,11 @@ async function renderAppRequestInternal(
     const renderedPage = await runWithQueryClient(queryClient, () =>
       runServerModuleWithSlots(
         output.code,
-        {
+        withTrackedRequest({
           data,
           params: matched.params,
           queryClient,
-          request: options.request,
-        },
+        }, appRequest, trackedRequest),
         matched.route.file,
         options.serverModules,
         options.serverModuleCacheVersion,
@@ -1520,28 +1568,22 @@ async function renderAppRequestInternal(
           script: clientScript,
           props: {
             params: matched.params,
-            request: { url: options.request.url },
+            request: { url: url.pathname },
             data,
           },
         })
-      : isNavigationRequest(options.request)
-        ? withRouteMarkers({
-            html: pageHtml,
-            routePath: matched.route.path,
-          })
-        : pageHtml;
+      : withServerOnlyRouteMarkers(pageHtml, matched.route.path, options.request);
     phaseStartedAt = renderTimingPhaseStartedAt(timing);
     let html = await runWithQueryClient(queryClient, () =>
       applyLayouts({
         appDir: options.appDir,
         pageFile: matched.route.file,
         html: pageHtmlForLayout,
-        props: {
+        props: withTrackedRequest({
           data,
           params: matched.params,
           queryClient,
-          request: options.request,
-        },
+        }, appRequest, trackedRequest),
         slots: renderedPage.slots,
         serverModules: options.serverModules,
         serverModuleCacheVersion: options.serverModuleCacheVersion,
@@ -1556,11 +1598,10 @@ async function renderAppRequestInternal(
     const metadata = await loadComposedRouteMetadata({
       appDir: options.appDir,
       code: originalCode,
-      context: {
+      context: withTrackedRequest({
         data,
         params: matched.params,
-        request: options.request,
-      },
+      }, appRequest, trackedRequest),
       filename: matched.route.file,
       importPolicy: options.importPolicy,
       routes,
@@ -1585,7 +1626,7 @@ async function renderAppRequestInternal(
       html,
       originalAnalysis.authIncludesClaims ? currentAuthClaims() : undefined,
     );
-    html = injectQueryState(html, dehydrate(queryClient));
+    html = injectQueryState(html, dehydrate(queryClient, options.dehydrateOptions));
 
     const response = withOptionalActionCookie(
       htmlResponse(
@@ -1606,14 +1647,27 @@ async function renderAppRequestInternal(
       preparedActions.csrfToken,
       preparedActions.csrfTokenIsNew === true,
     );
+    appendNavigationVary(response.headers);
 
     const effectiveCachePolicy = cachePolicy ?? activeRouteCacheContext()?.cachePolicy;
+    const configuredHsts = configuredHstsHeader(metadata?.security);
+    renderedStrictTransportSecurity = configuredHsts;
+    invalidConfiguredHsts = hasInvalidConfiguredHsts(metadata?.security);
 
     const finalResponse = preparedActions.hasFormActions
       ? withRouteCacheHeader(response, effectiveCachePolicy)
       : await cacheRouteResponse({
           key: cacheKey,
           cache: options.routeCache,
+          // A policy can still arrive from a runtime cacheControl() call made
+          // outside the page source, which is what `mayUseRouteCache` scans.
+          // Without a tracker there is no evidence the render ignored request
+          // headers, so the entry is treated as header dependent.
+          headerDependent:
+            sourceUsesRequestInput ||
+            invalidConfiguredHsts ||
+            (trackedRequest?.requestDependent() ?? true),
+          ...(configuredHsts === undefined ? {} : { strictTransportSecurity: configuredHsts }),
           path: matched.route.path,
           policy: effectiveCachePolicy,
           request: options.request,
@@ -1686,6 +1740,18 @@ async function renderAppRequestInternal(
     });
     emitRenderTiming(options, timing, response.status);
     return response;
+  } finally {
+    // Reported from every return path, including the streaming ones, so that a
+    // caller storing by path alone never mistakes an unreported render for a
+    // shareable one. The value stays lazy because a streamed render can still
+    // read request headers while its deferred parts resolve; callers read it
+    // after draining the body.
+    if (options.renderSignals !== undefined) {
+      const tracked = trackedRequest;
+      options.renderSignals.headerDependent = () =>
+        sourceUsesRequestInput || invalidConfiguredHsts || (tracked?.requestDependent() ?? true);
+      options.renderSignals.strictTransportSecurity = () => renderedStrictTransportSecurity;
+    }
   }
   })).value;
 }
@@ -1695,9 +1761,24 @@ async function applyAppRouterResponseHook(
   options: RenderAppRequestOptions,
 ): Promise<Response> {
   const onResponse = await resolveAppRouterResponseHook(options);
-  const hooked = await onResponse?.(response, {
-    request: options.request,
-  });
+
+  if (onResponse === undefined) {
+    return response;
+  }
+
+  const renderSignals = (options as RenderAppRequestRuntimeOptions).renderSignals;
+  const trackedRequest =
+    renderSignals === undefined ? undefined : trackRequestHeaderReads(options.request);
+  const hooked = await onResponse(
+    response,
+    withTrackedRequest({}, trackedRequest?.request ?? options.request, trackedRequest),
+  );
+
+  if (renderSignals !== undefined && trackedRequest !== undefined) {
+    const renderHeaderDependent = renderSignals.headerDependent;
+    renderSignals.headerDependent = () =>
+      renderHeaderDependent() || trackedRequest.requestDependent();
+  }
 
   return hooked instanceof Response ? hooked : response;
 }
@@ -1899,6 +1980,44 @@ function isNavigationRequest(request: Request): boolean {
   return request.headers.get("x-mreact-navigation") === "1";
 }
 
+function withServerOnlyRouteMarkers(html: string, routePath: string, request: Request): string {
+  const marker = serverOnlyRouteMarkerParts(routePath, request);
+  return marker === undefined ? html : `${marker.prefix}${html}${marker.suffix}`;
+}
+
+function serverOnlyRouteMarkerParts(
+  routePath: string,
+  request: Request,
+): { prefix: string; suffix: string } | undefined {
+  if (request.headers.get("x-mreact-prerender-variant-capture") === "1") {
+    return prerenderVariantMarkerParts(routePath);
+  }
+  return isNavigationRequest(request) ? routeMarkerParts(routePath) : undefined;
+}
+
+export function prerenderVariantMarkerParts(routePath: string): {
+  prefix: string;
+  suffix: string;
+} {
+  const routeId = routeIdForPath(routePath);
+  return {
+    prefix: `<!--mreact-route-variant-start:${routeId}-->`,
+    suffix: `<!--mreact-route-variant-end:${routeId}-->`,
+  };
+}
+
+function appendNavigationVary(headers: Headers): void {
+  const vary = headers.get("vary");
+  if (
+    vary
+      ?.split(",")
+      .some((value) => value.trim().toLowerCase() === "x-mreact-navigation") === true
+  ) {
+    return;
+  }
+  headers.append("vary", "x-mreact-navigation");
+}
+
 function isNavigationRouteCacheReloadRequest(request: Request): boolean {
   return (
     isNavigationRequest(request) && request.headers.get("x-mreact-navigation-cache") === "reload"
@@ -3010,6 +3129,9 @@ function routeSourceAnalysisFromArtifact(
     hasLoader: artifact.hasLoader,
     routeCode: artifact.routeCode,
     streamRoute: artifact.streamRoute,
+    // Older built artifacts predate request-input safety analysis. Treat them
+    // as dependent until rebuilt rather than trusting an absent safety signal.
+    usesRequestInput: artifact.usesRequestInput ?? true,
     usesRuntimeCacheControl: artifact.usesRuntimeCacheControl,
   };
 }
@@ -3052,17 +3174,77 @@ async function analyzeRouteSourceUncached(options: {
         projectRoot: options.appDir,
         source: options.code,
       }),
+    usesRequestInput: routeClosureMayUseRequestInput({
+      filename: options.filename,
+      files: routeSourceFilesForAnalysis(options),
+      projectRoot: options.appDir,
+      source: options.code,
+    }),
     usesRuntimeCacheControl: usesRuntimeCacheControl(options.code),
   };
 }
 
 function routeSourceFilesForAnalysis(options: {
+  appDir: string;
   code: string;
   filename: string;
   serverSourceFiles?: ReadonlyMap<string, string> | undefined;
 }): (file: string) => string | undefined {
-  return (file) =>
-    file === options.filename ? options.code : options.serverSourceFiles?.get(file);
+  return (file) => {
+    const known = file === options.filename ? options.code : options.serverSourceFiles?.get(file);
+    if (known !== undefined) {
+      return known;
+    }
+
+    const relativeFile = relative(resolve(options.appDir), resolve(file));
+    if (relativeFile === "" || relativeFile === ".." || relativeFile.startsWith(`..${sep}`)) {
+      return undefined;
+    }
+
+    try {
+      return readFileSync(file, "utf8");
+    } catch {
+      return undefined;
+    }
+  };
+}
+
+async function routeShellsMayUseRequestInput(options: {
+  appDir: string;
+  pageFile: string;
+  serverModuleCacheVersion: string | undefined;
+  serverSourceFiles: ReadonlyMap<string, string> | undefined;
+}): Promise<boolean> {
+  const shells = await shellFilesForPage(
+    options.appDir,
+    options.pageFile,
+    options.serverModuleCacheVersion,
+  );
+
+  for (const shell of shells) {
+    const source = await readServerSourceFile(
+      shell.file,
+      options.serverModuleCacheVersion,
+      options.serverSourceFiles,
+    );
+    if (
+      routeClosureMayUseRequestInput({
+        filename: shell.file,
+        files: routeSourceFilesForAnalysis({
+          appDir: options.appDir,
+          code: source,
+          filename: shell.file,
+          serverSourceFiles: options.serverSourceFiles,
+        }),
+        projectRoot: options.appDir,
+        source,
+      })
+    ) {
+      return true;
+    }
+  }
+
+  return false;
 }
 
 async function runServerModule(
@@ -3269,8 +3451,10 @@ function runServerStreamModule(
     appDir: string;
     assetBaseUrl?: string | undefined;
     clientRouteInferenceCache: ClientRouteInferenceCache;
+    markerRequest: Request;
     pageFile: string;
     props: ServerComponentProps;
+    requestUrl: string;
     routePath: string;
     routeScripts?: ReadonlyMap<string, string> | undefined;
     clientRoute: boolean;
@@ -3315,11 +3499,11 @@ function runServerStreamModule(
           script: options.script,
           props: {
             params: options.props.params,
-            request: { url: options.props.request.url },
+            request: { url: options.requestUrl },
             data: options.props.data,
           },
         })
-      : undefined;
+      : serverOnlyRouteMarkerParts(options.routePath, options.markerRequest);
 
     sink.append("<!DOCTYPE html>");
     sink.append(
@@ -3537,10 +3721,13 @@ async function runServerStreamModuleWithLoading(
     data: Promise<unknown>;
     define?: UserConfig["define"] | undefined;
     loadingFile: string;
+    markerRequest: Request;
     pageFile: string;
     params: RouteParams;
     queryClient: QueryClient;
     request: Request;
+    requestUrl: string;
+    trackedRequest?: TrackedHeaderRequest | undefined;
     routePath: string;
     routeScripts?: ReadonlyMap<string, string> | undefined;
     serverModules?: ReadonlyMap<string, BuiltServerModuleArtifact> | undefined;
@@ -3551,12 +3738,11 @@ async function runServerStreamModuleWithLoading(
     importPolicy?: AppRouterImportPolicy | undefined;
   },
 ): Promise<ReadableStream<Uint8Array>> {
-  const loadingProps = {
+  const loadingProps = withTrackedRequest({
     data: undefined,
     params: options.params,
     queryClient: options.queryClient,
-    request: options.request,
-  };
+  }, options.request, options.trackedRequest);
   const layoutShells = await layoutShellsForPage(
     options.appDir,
     options.pageFile,
@@ -3587,10 +3773,10 @@ async function runServerStreamModuleWithLoading(
         script: options.script,
         props: {
           params: options.params,
-          request: { url: options.request.url },
+          request: { url: options.requestUrl },
         },
       })
-    : undefined;
+    : serverOnlyRouteMarkerParts(options.routePath, options.markerRequest);
 
   return renderToReadableStream((sink) => {
     sink.append("<!DOCTYPE html>");
@@ -3616,12 +3802,11 @@ async function runServerStreamModuleWithLoading(
         await appendServerStreamModule(
           code,
           boundarySink,
-          {
+          withTrackedRequest({
             data,
             params: options.params,
             queryClient: options.queryClient,
-            request: options.request,
-          },
+          }, options.request, options.trackedRequest),
           options.pageFile,
           options.serverModules,
           options.serverModuleCacheVersion,
@@ -4014,17 +4199,6 @@ async function renderShellPrefixSuffix(
     serverModuleCacheVersion === undefined || hasNamedSlots || shell.kind === "template"
       ? undefined
       : `${appDir}\0${shell.file}\0${serverModuleCacheVersion}\0${importPolicyCacheKey(importPolicy)}\0${viteDefineCacheKey(define)}\0${vitePluginsCacheKey(vitePlugins)}`;
-  if (cacheKey !== undefined) {
-    const cached = readRouterRuntimeCacheEntry(
-      renderedShellCache,
-      cacheKey,
-      renderedShellCacheCounters,
-    );
-    if (cached !== undefined && cached !== "impure") {
-      return cached;
-    }
-  }
-
   const staticEntry = cacheKey === undefined ? undefined : shellStaticRenderCache.get(cacheKey);
   const loadedStaticEntry =
     staticEntry ??
@@ -4052,34 +4226,6 @@ async function renderShellPrefixSuffix(
     hasOutOfOrderBoundary: loadedStaticEntry.hasOutOfOrderBoundary,
   };
   addRenderTimingPhaseDuration(timing, phaseStartedAt, "layoutSlotSplitMs");
-  const shellCacheKey = loadedStaticEntry.shellUsesAwait ? undefined : cacheKey;
-  const cached =
-    shellCacheKey !== undefined
-      ? readRouterRuntimeCacheEntry(renderedShellCache, shellCacheKey, renderedShellCacheCounters)
-      : undefined;
-
-  // Detect purity: a zero-arg component cannot depend on props. The
-  // markShellBoundary + splitLayoutSlot output is then constant for
-  // the (appDir, shellFile, version) tuple. We only set the cache
-  // entry on the first request that observes the function arity; on
-  // an "impure" tag we never overwrite it.
-  if (shellCacheKey !== undefined && cached !== "impure") {
-    if (loadedStaticEntry.component.length === 0) {
-      if (renderedShellCache.size >= MAX_RENDERED_SHELL_CACHE_ENTRIES) {
-        const oldestKey = renderedShellCache.keys().next().value;
-        if (oldestKey !== undefined) {
-          renderedShellCache.delete(oldestKey);
-          renderedShellCacheCounters.evictions += 1;
-        }
-      }
-      renderedShellCache.set(shellCacheKey, rendered);
-    } else {
-      // Impure — stamp the cache so subsequent lookups short-circuit
-      // without re-checking arity. We still run the per-request
-      // render path above so the props are honoured.
-      renderedShellCache.set(shellCacheKey, "impure");
-    }
-  }
 
   return rendered;
 }