@reckona/mreact-router 0.0.203 → 0.0.205

package/dist/prerender-entry.js

@@ -1,5 +1,7 @@
+import { responseHeadersContainCspNonce } from "./csp.js";
 import { hasNavigationRouteMarker } from "./navigation-marker.js";
 export const PRERENDERED_ROUTE_SCHEMA_VERSION = 4;
+const validatedNavigationHtmlByEntry = new WeakMap();
 export function isCurrentPrerenderedRoute(value) {
     if (typeof value !== "object" || value === null || Array.isArray(value)) {
         return false;
@@ -12,14 +14,35 @@ export function isCurrentPrerenderedRoute(value) {
         !hasStoredHstsHeader(entry.headers) &&
         isCanonicalHstsHeader(entry.strictTransportSecurity) &&
         typeof entry.html === "string" &&
-        (entry.navigationHtml === undefined ||
-            (typeof entry.navigationHtml === "string" &&
-                hasNavigationRouteMarker(entry.navigationHtml))) &&
         typeof entry.status === "number" &&
         Number.isInteger(entry.status) &&
         entry.status >= 100 &&
         entry.status <= 599);
 }
+/**
+ * Returns a navigation variant only after validating its route marker.
+ *
+ * Stored entries are stable objects during a runtime's lifetime, so the
+ * marker scan is cached by identity. Document requests never call this
+ * function and therefore never inspect navigation HTML.
+ */
+export function validatedPrerenderedNavigationHtml(entry) {
+    const cached = validatedNavigationHtmlByEntry.get(entry);
+    if (cached !== undefined) {
+        return cached === null ? undefined : cached;
+    }
+    const candidate = entry.navigationHtml;
+    const validated = typeof candidate === "string" && hasNavigationRouteMarker(candidate) ? candidate : null;
+    validatedNavigationHtmlByEntry.set(entry, validated);
+    return validated === null ? undefined : validated;
+}
+/**
+ * Adds a regenerated navigation variant only when it satisfies the marker
+ * contract. Invalid navigation output must not replace a valid document.
+ */
+export function mergePrerenderedNavigationHtml(entry, navigationHtml) {
+    return hasNavigationRouteMarker(navigationHtml) ? { ...entry, navigationHtml } : entry;
+}
 function hasStoredHstsHeader(headers) {
     try {
         return new Headers(headers).has("strict-transport-security");
@@ -36,6 +59,19 @@ function isCanonicalHstsHeader(value) {
 export function isVisitorDependentResponse(response) {
     return isVisitorDependentHeaders(response.headers);
 }
+export function protectNonceBearingResponse(response) {
+    if (!responseHeadersContainCspNonce(response.headers)) {
+        return response;
+    }
+    const headers = new Headers(response.headers);
+    headers.set("cache-control", "private, no-store");
+    headers.set("x-mreact-cache", "DYNAMIC");
+    return new Response(response.body, {
+        headers,
+        status: response.status,
+        statusText: response.statusText,
+    });
+}
 export function storedPrerenderedRouteHeaders(headers) {
     const stored = {};
     headers.forEach((value, key) => {
@@ -87,6 +123,7 @@ function isVisitorDependentHeaders(headers) {
         .some((directive) => /^(?:private|no-cache|no-store)(?:=|$)/i.test(directive.trim()));
     return (headers.get("x-mreact-cache")?.toUpperCase() === "DYNAMIC" ||
         headers.has("set-cookie") ||
+        responseHeadersContainCspNonce(headers) ||
         hasVisitorDependentVary ||
         forbidsSharedStorage);
 }

package/dist/prerender-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"prerender-entry.js","sourceRoot":"","sources":["../src/prerender-entry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,KAAuC,CAAC;IACtD,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,gCAAgC;QACxD,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC;QACtC,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC;QACxC,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;QACnC,qBAAqB,CAAC,KAAK,CAAC,uBAAuB,CAAC;QACpD,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS;YACjC,CAAC,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ;gBACvC,wBAAwB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9B,KAAK,CAAC,MAAM,IAAI,GAAG;QACnB,KAAK,CAAC,MAAM,IAAI,GAAG,CACpB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA+B;IAC1D,IAAI,CAAC;QACH,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,CAAC,OAAO,KAAK,KAAK,QAAQ;YACxB,mEAAmE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACnF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAkB;IAC3D,OAAO,yBAAyB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAgB;IAC5D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7B,IAAI,GAAG,KAAK,2BAA2B,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,KAA4B,EAC5B,OAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE3C,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,KAAK,CAAC,uBAAuB,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAAC,OAA+B;IAChE,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,CACL,OAAO;SACJ,GAAG,CAAC,MAAM,CAAC;QACZ,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,qBAAqB,CAAC,KAAK,IAAI,CAClF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,OAA+B;IAC9D,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAgB;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,uBAAuB,GAC3B,IAAI,KAAK,IAAI;QACb,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,qBAAqB,CAAC,CAAC;IACxF,MAAM,oBAAoB,GAAG,YAAY;SACtC,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,wCAAwC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAExF,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,KAAK,SAAS;QAC1D,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACzB,uBAAuB;QACvB,oBAAoB,CACrB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CACjE,CAAC;AACJ,CAAC","sourcesContent":["import type { BuiltPrerenderedRoute } from \"./build.js\";\nimport { hasNavigationRouteMarker } from \"./navigation-marker.js\";\n\nexport const PRERENDERED_ROUTE_SCHEMA_VERSION = 4;\n\nexport function isCurrentPrerenderedRoute(value: unknown): value is BuiltPrerenderedRoute {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    return false;\n  }\n\n  const entry = value as Partial<BuiltPrerenderedRoute>;\n  return (\n    entry.schemaVersion === PRERENDERED_ROUTE_SCHEMA_VERSION &&\n    isStringRecord(entry.headers) &&\n    isShareableHeaderRecord(entry.headers) &&\n    hasRequiredNavigationVary(entry.headers) &&\n    !hasStoredHstsHeader(entry.headers) &&\n    isCanonicalHstsHeader(entry.strictTransportSecurity) &&\n    typeof entry.html === \"string\" &&\n    (entry.navigationHtml === undefined ||\n      (typeof entry.navigationHtml === \"string\" &&\n        hasNavigationRouteMarker(entry.navigationHtml))) &&\n    typeof entry.status === \"number\" &&\n    Number.isInteger(entry.status) &&\n    entry.status >= 100 &&\n    entry.status <= 599\n  );\n}\n\nfunction hasStoredHstsHeader(headers: Record<string, string>): boolean {\n  try {\n    return new Headers(headers).has(\"strict-transport-security\");\n  } catch {\n    return true;\n  }\n}\n\nfunction isCanonicalHstsHeader(value: unknown): value is string | undefined {\n  return (\n    value === undefined ||\n    (typeof value === \"string\" &&\n      /^max-age=(?:0|[1-9][0-9]*)(?:; includeSubDomains)?(?:; preload)?$/.test(value))\n  );\n}\n\nexport function isVisitorDependentResponse(response: Response): boolean {\n  return isVisitorDependentHeaders(response.headers);\n}\n\nexport function storedPrerenderedRouteHeaders(headers: Headers): Record<string, string> {\n  const stored: Record<string, string> = {};\n\n  headers.forEach((value, key) => {\n    if (key !== \"strict-transport-security\") {\n      stored[key] = value;\n    }\n  });\n\n  return stored;\n}\n\nexport function replayedPrerenderedRouteHeaders(\n  entry: BuiltPrerenderedRoute,\n  request: Request,\n): Headers {\n  const headers = new Headers(entry.headers);\n\n  if (!hasNavigationVary(headers)) {\n    headers.append(\"vary\", \"x-mreact-navigation\");\n  }\n\n  if (entry.strictTransportSecurity !== undefined && request.url.startsWith(\"https://\")) {\n    headers.set(\"strict-transport-security\", entry.strictTransportSecurity);\n  }\n\n  return headers;\n}\n\nfunction hasRequiredNavigationVary(headers: Record<string, string>): boolean {\n  try {\n    return hasNavigationVary(new Headers(headers));\n  } catch {\n    return false;\n  }\n}\n\nfunction hasNavigationVary(headers: Headers): boolean {\n  return (\n    headers\n      .get(\"vary\")\n      ?.split(\",\")\n      .some((value) => value.trim().toLowerCase() === \"x-mreact-navigation\") === true\n  );\n}\n\nfunction isShareableHeaderRecord(headers: Record<string, string>): boolean {\n  try {\n    return !isVisitorDependentHeaders(new Headers(headers));\n  } catch {\n    return false;\n  }\n}\n\nfunction isVisitorDependentHeaders(headers: Headers): boolean {\n  const cacheControl = headers.get(\"cache-control\") ?? \"\";\n  const vary = headers.get(\"vary\");\n  const hasVisitorDependentVary =\n    vary !== null &&\n    vary.split(\",\").some((value) => value.trim().toLowerCase() !== \"x-mreact-navigation\");\n  const forbidsSharedStorage = cacheControl\n    .split(\",\")\n    .some((directive) => /^(?:private|no-cache|no-store)(?:=|$)/i.test(directive.trim()));\n\n  return (\n    headers.get(\"x-mreact-cache\")?.toUpperCase() === \"DYNAMIC\" ||\n    headers.has(\"set-cookie\") ||\n    hasVisitorDependentVary ||\n    forbidsSharedStorage\n  );\n}\n\nfunction isStringRecord(value: unknown): value is Record<string, string> {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    !Array.isArray(value) &&\n    Object.values(value).every((entry) => typeof entry === \"string\")\n  );\n}\n"]}
+{"version":3,"file":"prerender-entry.js","sourceRoot":"","sources":["../src/prerender-entry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD,MAAM,8BAA8B,GAAG,IAAI,OAAO,EAAyB,CAAC;AAE5E,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,KAAuC,CAAC;IACtD,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,gCAAgC;QACxD,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC;QACtC,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC;QACxC,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;QACnC,qBAAqB,CAAC,KAAK,CAAC,uBAAuB,CAAC;QACpD,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9B,KAAK,CAAC,MAAM,IAAI,GAAG;QACnB,KAAK,CAAC,MAAM,IAAI,GAAG,CACpB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,KAA4B;IAE5B,MAAM,MAAM,GAAG,8BAA8B,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC;IACvC,MAAM,SAAS,GACb,OAAO,SAAS,KAAK,QAAQ,IAAI,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,8BAA8B,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACrD,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAA4B,EAC5B,cAAsB;IAEtB,OAAO,wBAAwB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACzF,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA+B;IAC1D,IAAI,CAAC;QACH,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,CAAC,OAAO,KAAK,KAAK,QAAQ;YACxB,mEAAmE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACnF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAkB;IAC3D,OAAO,yBAAyB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,QAAkB;IAC5D,IAAI,CAAC,8BAA8B,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACzC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,OAAO;QACP,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAgB;IAC5D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7B,IAAI,GAAG,KAAK,2BAA2B,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,KAA4B,EAC5B,OAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE3C,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,KAAK,CAAC,uBAAuB,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAAC,OAA+B;IAChE,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,CACL,OAAO;SACJ,GAAG,CAAC,MAAM,CAAC;QACZ,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,qBAAqB,CAAC,KAAK,IAAI,CAClF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,OAA+B;IAC9D,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAgB;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,uBAAuB,GAC3B,IAAI,KAAK,IAAI;QACb,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,qBAAqB,CAAC,CAAC;IACxF,MAAM,oBAAoB,GAAG,YAAY;SACtC,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,wCAAwC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAExF,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,KAAK,SAAS;QAC1D,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACzB,8BAA8B,CAAC,OAAO,CAAC;QACvC,uBAAuB;QACvB,oBAAoB,CACrB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CACjE,CAAC;AACJ,CAAC","sourcesContent":["import type { BuiltPrerenderedRoute } from \"./build.js\";\nimport { responseHeadersContainCspNonce } from \"./csp.js\";\nimport { hasNavigationRouteMarker } from \"./navigation-marker.js\";\n\nexport const PRERENDERED_ROUTE_SCHEMA_VERSION = 4;\n\nconst validatedNavigationHtmlByEntry = new WeakMap<object, string | null>();\n\nexport function isCurrentPrerenderedRoute(value: unknown): value is BuiltPrerenderedRoute {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    return false;\n  }\n\n  const entry = value as Partial<BuiltPrerenderedRoute>;\n  return (\n    entry.schemaVersion === PRERENDERED_ROUTE_SCHEMA_VERSION &&\n    isStringRecord(entry.headers) &&\n    isShareableHeaderRecord(entry.headers) &&\n    hasRequiredNavigationVary(entry.headers) &&\n    !hasStoredHstsHeader(entry.headers) &&\n    isCanonicalHstsHeader(entry.strictTransportSecurity) &&\n    typeof entry.html === \"string\" &&\n    typeof entry.status === \"number\" &&\n    Number.isInteger(entry.status) &&\n    entry.status >= 100 &&\n    entry.status <= 599\n  );\n}\n\n/**\n * Returns a navigation variant only after validating its route marker.\n *\n * Stored entries are stable objects during a runtime's lifetime, so the\n * marker scan is cached by identity. Document requests never call this\n * function and therefore never inspect navigation HTML.\n */\nexport function validatedPrerenderedNavigationHtml(\n  entry: BuiltPrerenderedRoute,\n): string | undefined {\n  const cached = validatedNavigationHtmlByEntry.get(entry);\n  if (cached !== undefined) {\n    return cached === null ? undefined : cached;\n  }\n\n  const candidate = entry.navigationHtml;\n  const validated =\n    typeof candidate === \"string\" && hasNavigationRouteMarker(candidate) ? candidate : null;\n  validatedNavigationHtmlByEntry.set(entry, validated);\n  return validated === null ? undefined : validated;\n}\n\n/**\n * Adds a regenerated navigation variant only when it satisfies the marker\n * contract. Invalid navigation output must not replace a valid document.\n */\nexport function mergePrerenderedNavigationHtml(\n  entry: BuiltPrerenderedRoute,\n  navigationHtml: string,\n): BuiltPrerenderedRoute {\n  return hasNavigationRouteMarker(navigationHtml) ? { ...entry, navigationHtml } : entry;\n}\n\nfunction hasStoredHstsHeader(headers: Record<string, string>): boolean {\n  try {\n    return new Headers(headers).has(\"strict-transport-security\");\n  } catch {\n    return true;\n  }\n}\n\nfunction isCanonicalHstsHeader(value: unknown): value is string | undefined {\n  return (\n    value === undefined ||\n    (typeof value === \"string\" &&\n      /^max-age=(?:0|[1-9][0-9]*)(?:; includeSubDomains)?(?:; preload)?$/.test(value))\n  );\n}\n\nexport function isVisitorDependentResponse(response: Response): boolean {\n  return isVisitorDependentHeaders(response.headers);\n}\n\nexport function protectNonceBearingResponse(response: Response): Response {\n  if (!responseHeadersContainCspNonce(response.headers)) {\n    return response;\n  }\n\n  const headers = new Headers(response.headers);\n  headers.set(\"cache-control\", \"private, no-store\");\n  headers.set(\"x-mreact-cache\", \"DYNAMIC\");\n  return new Response(response.body, {\n    headers,\n    status: response.status,\n    statusText: response.statusText,\n  });\n}\n\nexport function storedPrerenderedRouteHeaders(headers: Headers): Record<string, string> {\n  const stored: Record<string, string> = {};\n\n  headers.forEach((value, key) => {\n    if (key !== \"strict-transport-security\") {\n      stored[key] = value;\n    }\n  });\n\n  return stored;\n}\n\nexport function replayedPrerenderedRouteHeaders(\n  entry: BuiltPrerenderedRoute,\n  request: Request,\n): Headers {\n  const headers = new Headers(entry.headers);\n\n  if (!hasNavigationVary(headers)) {\n    headers.append(\"vary\", \"x-mreact-navigation\");\n  }\n\n  if (entry.strictTransportSecurity !== undefined && request.url.startsWith(\"https://\")) {\n    headers.set(\"strict-transport-security\", entry.strictTransportSecurity);\n  }\n\n  return headers;\n}\n\nfunction hasRequiredNavigationVary(headers: Record<string, string>): boolean {\n  try {\n    return hasNavigationVary(new Headers(headers));\n  } catch {\n    return false;\n  }\n}\n\nfunction hasNavigationVary(headers: Headers): boolean {\n  return (\n    headers\n      .get(\"vary\")\n      ?.split(\",\")\n      .some((value) => value.trim().toLowerCase() === \"x-mreact-navigation\") === true\n  );\n}\n\nfunction isShareableHeaderRecord(headers: Record<string, string>): boolean {\n  try {\n    return !isVisitorDependentHeaders(new Headers(headers));\n  } catch {\n    return false;\n  }\n}\n\nfunction isVisitorDependentHeaders(headers: Headers): boolean {\n  const cacheControl = headers.get(\"cache-control\") ?? \"\";\n  const vary = headers.get(\"vary\");\n  const hasVisitorDependentVary =\n    vary !== null &&\n    vary.split(\",\").some((value) => value.trim().toLowerCase() !== \"x-mreact-navigation\");\n  const forbidsSharedStorage = cacheControl\n    .split(\",\")\n    .some((directive) => /^(?:private|no-cache|no-store)(?:=|$)/i.test(directive.trim()));\n\n  return (\n    headers.get(\"x-mreact-cache\")?.toUpperCase() === \"DYNAMIC\" ||\n    headers.has(\"set-cookie\") ||\n    responseHeadersContainCspNonce(headers) ||\n    hasVisitorDependentVary ||\n    forbidsSharedStorage\n  );\n}\n\nfunction isStringRecord(value: unknown): value is Record<string, string> {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    !Array.isArray(value) &&\n    Object.values(value).every((entry) => typeof entry === \"string\")\n  );\n}\n"]}

package/dist/render.d.ts

@@ -47,6 +47,7 @@ export interface RenderAppRequestOptions {
     routeMatcher?: RouteMatcher | undefined;
     routes?: readonly AppRoute[] | undefined;
     serverModules?: ReadonlyMap<string, BuiltServerModuleArtifact> | undefined;
+    serverRenderArtifactLoader?: AppRouterServerRenderArtifactLoader | undefined;
     serverModuleCacheVersion?: string | undefined;
     devServerModuleCacheVersion?: string | undefined;
     dev?: boolean | undefined;
@@ -58,6 +59,14 @@ export interface RenderAppRequestOptions {
     vitePlugins?: readonly PluginOption[] | undefined;
 }
 export interface RenderAppRequestRuntimeOptions extends RenderAppRequestOptions {
+    /**
+     * Wraps a server-only page with build-time variant capture comments.
+     *
+     * This is an in-process render signal. It must not be derived from request
+     * headers because network clients are not allowed to change response shape
+     * outside the route-cache key.
+     */
+    prerenderVariantCapture?: boolean | undefined;
     /**
      * Receives whether the render depended on the incoming request headers.
      *
@@ -72,7 +81,6 @@ export interface RenderAppRequestRuntimeOptions extends RenderAppRequestOptions
         headerDependent: () => boolean;
         strictTransportSecurity: () => string | undefined;
     } | undefined;
-    serverRenderArtifactLoader?: AppRouterServerRenderArtifactLoader | undefined;
 }
 export interface AppRouterRenderPreload {
     promise: Promise<void>;

package/dist/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAEV,gBAAgB,EAChB,eAAe,EAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAOL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EAIL,KAAK,yBAAyB,EAE/B,MAAM,6BAA6B,CAAC;AAUrC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAIjC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,KAAK,cAAc,EAOpB,MAAM,YAAY,CAAC;AAoBpB,OAAO,EAAqC,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEnG,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,KAAK,EAAmC,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAa7F,OAAO,EAAwC,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAKL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,iBAAiB,CAAC;AAqDzB,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,yBAAyB,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAClE,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAChD,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACpD,MAAM,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACrC,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,aAAa,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACvD,UAAU,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC/C,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC;IAC7B,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,UAAU,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACxC,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,MAAM,CAAC,EAAE,SAAS,QAAQ,EAAE,GAAG,SAAS,CAAC;IACzC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAGjD,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,aAAa,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACzD,4BAA4B,CAAC,EACzB,WAAW,CAAC,MAAM,EAAE,SAAS,2BAA2B,EAAE,CAAC,GAC3D,SAAS,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,OAAO,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAC7C,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,8BAA+B,SAAQ,uBAAuB;IAC7E;;;;;;;;;OASG;IACH,aAAa,CAAC,EACV;QACE,eAAe,EAAE,MAAM,OAAO,CAAC;QAC/B,uBAAuB,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;KACnD,GACD,SAAS,CAAC;IACd,0BAA0B,CAAC,EAAE,mCAAmC,GAAG,SAAS,CAAC;CAC9E;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,EAAE,eAAe,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,4BAA4B,KAClC,QAAQ,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;AAExE;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC5B,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,wBAAwB,EAAE,MAAM,CAAC;IACjC,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,4BAA4B,CAAC,EACzB,WAAW,CAAC,MAAM,EAAE,SAAS,2BAA2B,EAAE,CAAC,GAC3D,SAAS,CAAC;IACd,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,IAAI,CAAC,CAsFhB;AAyND,wBAAgB,6BAA6B,IAAI,sBAAsB,EAAE,CAkExE;AAmBD;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwB1F;AAsID,MAAM,MAAM,yBAAyB,GACjC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GACtC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAE7C,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACpD,iBAAiB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAClC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAiBrC;AAi5BD,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,IAAI,CACX,uBAAuB,EACrB,QAAQ,GACR,QAAQ,GACR,6BAA6B,GAC7B,cAAc,GACd,YAAY,GACZ,eAAe,GACf,0BAA0B,GAC1B,mBAAmB,GACnB,aAAa,CAChB,GACA,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAgD5C;AAuJD,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAMA;AAuzBD,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,0BAA0B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,MAAM,CAAC,CA0BlB;AA6CD,iBAAS,qBAAqB,CAAC,OAAO,EAAE;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,6BAA6B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,YAAY,EAAE,gBAAgB,CAAC;IAC/B,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,GAAG,eAAe,CAsFlB;AAED,eAAO,MAAM,iCAAiC,8BAAwB,CAAC;AAIvE,wBAAgB,yCAAyC,IAAI,IAAI,CAGhE;AAKD,wBAAgB,sDAAsD,CAAC,OAAO,EAAE;IAC9E,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;CAC5E,GAAG,IAAI,CAEP;AAmxDD,wBAAsB,2BAA2B,CAAC,OAAO,EAAE;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,8BAA8B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBlB;AAgRD,iBAAS,6BAA6B,CAAC,OAAO,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,MAAM,GAAG,SAAS,CAOrB;AAED,eAAO,MAAM,yCAAyC,sCAAgC,CAAC;AAqMvF,UAAU,YAAY;IACpB,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;CAC1B;AAED,iBAAS,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAmDnD;AAED,eAAO,MAAM,yBAAyB,sBAAgB,CAAC"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAEV,gBAAgB,EAChB,eAAe,EAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAOL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EAIL,KAAK,yBAAyB,EAE/B,MAAM,6BAA6B,CAAC;AAUrC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAIjC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,KAAK,cAAc,EAOpB,MAAM,YAAY,CAAC;AAkBpB,OAAO,EAAqC,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEnG,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,KAAK,EAAmC,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAa7F,OAAO,EAAwC,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAKL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,iBAAiB,CAAC;AAuDzB,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,yBAAyB,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAClE,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAChD,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACpD,MAAM,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACrC,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,aAAa,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACvD,UAAU,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC/C,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC;IAC7B,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,UAAU,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACxC,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,MAAM,CAAC,EAAE,SAAS,QAAQ,EAAE,GAAG,SAAS,CAAC;IACzC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,0BAA0B,CAAC,EAAE,mCAAmC,GAAG,SAAS,CAAC;IAC7E,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAGjD,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,aAAa,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACzD,4BAA4B,CAAC,EACzB,WAAW,CAAC,MAAM,EAAE,SAAS,2BAA2B,EAAE,CAAC,GAC3D,SAAS,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,OAAO,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAC7C,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,8BAA+B,SAAQ,uBAAuB;IAC7E;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C;;;;;;;;;OASG;IACH,aAAa,CAAC,EACV;QACE,eAAe,EAAE,MAAM,OAAO,CAAC;QAC/B,uBAAuB,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;KACnD,GACD,SAAS,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,EAAE,eAAe,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,4BAA4B,KAClC,QAAQ,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;AAExE;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC5B,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,wBAAwB,EAAE,MAAM,CAAC;IACjC,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,4BAA4B,CAAC,EACzB,WAAW,CAAC,MAAM,EAAE,SAAS,2BAA2B,EAAE,CAAC,GAC3D,SAAS,CAAC;IACd,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,IAAI,CAAC,CAsFhB;AA8ND,wBAAgB,6BAA6B,IAAI,sBAAsB,EAAE,CAkExE;AAmBD;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0B1F;AA2GD,MAAM,MAAM,yBAAyB,GACjC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GACtC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAE7C,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACpD,iBAAiB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAClC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAiBrC;AAq8BD,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,IAAI,CACX,uBAAuB,EACrB,QAAQ,GACR,QAAQ,GACR,6BAA6B,GAC7B,cAAc,GACd,YAAY,GACZ,eAAe,GACf,0BAA0B,GAC1B,mBAAmB,GACnB,aAAa,CAChB,GACA,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAgD5C;AA6JD,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAMA;AA2zBD,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,0BAA0B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,MAAM,CAAC,CA0BlB;AA6CD,iBAAS,qBAAqB,CAAC,OAAO,EAAE;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,6BAA6B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,YAAY,EAAE,gBAAgB,CAAC;IAC/B,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,GAAG,eAAe,CAsFlB;AAED,eAAO,MAAM,iCAAiC,8BAAwB,CAAC;AAIvE,wBAAgB,yCAAyC,IAAI,IAAI,CAGhE;AAKD,wBAAgB,sDAAsD,CAAC,OAAO,EAAE;IAC9E,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;CAC5E,GAAG,IAAI,CAEP;AA8wDD,wBAAsB,2BAA2B,CAAC,OAAO,EAAE;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,8BAA8B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBlB;AAyRD,iBAAS,6BAA6B,CAAC,OAAO,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,MAAM,GAAG,SAAS,CAOrB;AAED,eAAO,MAAM,yCAAyC,sCAAgC,CAAC;AAqMvF,UAAU,YAAY;IACpB,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;CAC1B;AAED,iBAAS,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAmDnD;AAED,eAAO,MAAM,yBAAyB,sBAAgB,CAAC"}

package/dist/render.js

@@ -5,7 +5,7 @@ import { access, readFile, stat } from "node:fs/promises";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { formatDiagnostic, transform } from "@reckona/mreact-compiler";
 import { createQueryClient, dehydrate, __MREACT_QUERY_STATE_SCRIPT_ID, installQueryAsyncStorage, runWithQueryClient, } from "@reckona/mreact-query";
-import { createStringSink, renderAsyncBoundary, renderOutOfOrderReorderScript, renderReactNodeToString, renderToReadableStream, } from "@reckona/mreact-server";
+import { createStringSink, renderOutOfOrderBoundary, renderOutOfOrderReorderScript, renderReactNodeToString, renderToReadableStream, } from "@reckona/mreact-server";
 import { createClientRouteInferenceCache, formatClientRouteInferenceDiagnostic, inferClientRouteModule, } from "./client-route-inference.js";
 import { hydrationMarkerParts, routeMarkerParts, routeIdForPath, withHydrationMarkers, } from "./navigation-runtime.js";
 import { assetPath } from "./assets.js";
@@ -16,8 +16,9 @@ import { dispatchServerActionRequest, prepareRouteServerActionPlaceholders, prep
 import { serverActionCookie } from "./csrf.js";
 import { activeRouteCacheContext, withRouteCacheContext, cachedRouteResponse, cacheRouteResponse, routeCacheKey, routeCachePolicyFromSource, } from "./cache.js";
 import { trackRequestHeaderReads, withTrackedRequest, } from "./request-header-tracking.js";
-import { configuredHstsHeader, hasInvalidConfiguredHsts, } from "./security-headers.js";
+import { configuredHstsHeader, hasInvalidConfiguredHsts } from "./security-headers.js";
 import { resolveRouterCacheLimit } from "./cache-config.js";
+import { protectNonceBearingResponse } from "./prerender-entry.js";
 import { importAppRouterBuiltFileModule, importAppRouterFileModule, importAppRouterSourceModule, fileImportMetaUrlPlugin, rewriteCompatVendorPlaceholderImportsForRunner, } from "./module-runner.js";
 import { bytesResponse, htmlResponse } from "./http.js";
 import { isNotFoundError, isRedirectError, rewriteLocation } from "./navigation.js";
@@ -30,7 +31,7 @@ import { bundleRouterModule } from "./bundle-pipeline.js";
 import { viteDefineCacheKey, vitePluginsCacheKey } from "./vite-plugin-cache-key.js";
 import { invokeRouterInstrumentation, traceContextFromRequest, } from "./trace.js";
 import { mergeRouteMiddlewareControls, middlewareMatches, parseRouteMiddlewareControl, parseStaticMiddlewareConfig, shouldSkipMiddleware, validateRouteMiddlewareControl, } from "./middleware.js";
-import { applyFileConventionMetadata, injectHeadMetadata, mergeRouteMetadata, responseHeadersForMetadata, serializeRobots, serializeSitemap, validateRouteMetadata, } from "./metadata.js";
+import { applyFileConventionMetadataTemplate, fileConventionMetadataTemplate, injectHeadMetadata, mergeRouteMetadata, responseHeadersForMetadata, serializeRobots, serializeSitemap, validateRouteMetadata, } from "./metadata.js";
 import { createSlotRenderContext, markShellBoundary, shellBoundaryId, splitLayoutSlot, warnUnconsumedRouteSlots, } from "./layout-composer.js";
 import { importPolicyCacheKey, memoizedHashText, prebuiltRequestModuleArtifact, prebuiltRouteLoaderModuleArtifact, prebuiltServerComponentModuleCode, prebuiltServerModuleOutputMatches, prebuiltServerModuleOutputOptionsMatch, } from "./route-module-loader.js";
 import { loadRouteDataFromModule, } from "./route-loader-runtime.js";
@@ -272,7 +273,7 @@ export async function renderAppRequest(options) {
     };
     invokeRouterInstrumentation(options.instrumentation?.onRequestStart, requestEvent);
     const response = await renderAppRequestInternal({ ...options, requestUrl: url });
-    const finalResponse = await applyAppRouterResponseHook(response, options);
+    const finalResponse = protectNonceBearingResponse(await applyAppRouterResponseHook(response, options));
     invokeRouterInstrumentation(options.instrumentation?.onRequestEnd, {
         ...requestEvent,
         status: finalResponse.status,
@@ -291,31 +292,14 @@ function finishRenderTimingPhase(timing, startedAt, phaseName) {
     }
     timing.phases[phaseName] = logDurationMs(startedAt);
 }
-async function readSettledPromiseAtNextTask(promise) {
-    return await Promise.race([
-        promise.then((value) => ({ settled: true, value })),
-        new Promise((resolve) => {
-            setTimeout(() => resolve({ settled: false }), 0);
-        }),
-    ]);
-}
-function createDeferredSignal() {
-    let resolve;
-    const promise = new Promise((innerResolve) => {
-        resolve = innerResolve;
+function observePromiseSettlement(promise) {
+    let settlement = { status: "pending" };
+    void promise.then((value) => {
+        settlement = { status: "fulfilled", value };
+    }, (error) => {
+        settlement = { error, status: "rejected" };
     });
-    return {
-        promise,
-        resolve() {
-            resolve?.();
-        },
-    };
-}
-async function waitForLoaderReadyOrSettled(dataPromise, loaderReady) {
-    if (loaderReady === undefined) {
-        return;
-    }
-    await Promise.race([loaderReady, dataPromise.then(() => undefined, () => undefined)]);
+    return () => settlement;
 }
 function addRenderTimingPhaseDuration(timing, startedAt, phaseName) {
     if (timing === undefined || startedAt === undefined) {
@@ -323,11 +307,6 @@ function addRenderTimingPhaseDuration(timing, startedAt, phaseName) {
     }
     timing.phases[phaseName] = (timing.phases[phaseName] ?? 0) + logDurationMs(startedAt);
 }
-function routeLoaderMayReturnControlResponse(code) {
-    return (/\b(?:redirect|redirectExternal|rewrite|notFound|throwNotFound)\s*\(/.test(code) ||
-        /\bnew\s+Response\s*\(/.test(code) ||
-        /\bResponse\.(?:redirect|json)\s*\(/.test(code));
-}
 async function waitForRenderPreload(options, timing) {
     if (options.preload?.wait !== "before-render") {
         return;
@@ -627,7 +606,6 @@ async function renderAppRequestInternal(options) {
             const clientInference = routeAnalysis.clientInference;
             const clientRoute = clientInference.client;
             phaseStartedAt = renderTimingPhaseStartedAt(timing);
-            const loaderReady = routeAnalysis.hasLoader ? createDeferredSignal() : undefined;
             const dataPromise = routeAnalysis.hasLoader
                 ? loadRouteDataWithInstrumentation({
                     appDir: options.appDir,
@@ -649,9 +627,12 @@ async function renderAppRequestInternal(options) {
                     define: options.define,
                     vitePlugins: options.vitePlugins,
                     timing,
-                    onLoaderReady: loaderReady?.resolve,
                 })
                 : undefined;
+            // Route analysis and loading-boundary discovery can continue before the loader is awaited.
+            // Observe an early rejection immediately so strict unhandled-rejection runtimes do not
+            // terminate before the request-level control/error handler receives the same promise.
+            void dataPromise?.catch(() => { });
             finishRenderTimingPhase(timing, phaseStartedAt, "loaderStartMs");
             recoveryRoute = {
                 clientRoute,
@@ -734,7 +715,7 @@ async function renderAppRequestInternal(options) {
                                 data,
                             },
                         })
-                        : withServerOnlyRouteMarkers(pageHtml, matched.route.path, options.request);
+                        : withServerOnlyRouteMarkers(pageHtml, matched.route.path, options.request, options.prerenderVariantCapture === true);
                     let html = await runWithQueryClient(queryClient, () => applyLayouts({
                         appDir: options.appDir,
                         pageFile: matched.route.file,
@@ -796,39 +777,19 @@ async function renderAppRequestInternal(options) {
                     return response;
                 }
                 let streamData;
-                let streamDataPromise = dataPromise ?? Promise.resolve(undefined);
                 phaseStartedAt = renderTimingPhaseStartedAt(timing);
-                if (loadingFile === undefined || routeLoaderMayReturnControlResponse(originalCode)) {
-                    try {
-                        streamData = dataPromise === undefined ? undefined : await dataPromise;
-                    }
-                    finally {
-                        finishRenderTimingPhase(timing, phaseStartedAt, "loaderWaitMs");
-                    }
-                    if (streamData instanceof Response) {
-                        emitRenderTiming(options, timing, streamData.status);
-                        return streamData;
-                    }
-                    streamDataPromise = Promise.resolve(streamData);
+                try {
+                    streamData = dataPromise === undefined ? undefined : await dataPromise;
                 }
-                else {
-                    try {
-                        const settledData = await readSettledPromiseAtNextTask(streamDataPromise);
-                        if (settledData.settled) {
-                            if (settledData.value instanceof Response) {
-                                emitRenderTiming(options, timing, settledData.value.status);
-                                return settledData.value;
-                            }
-                            streamDataPromise = Promise.resolve(settledData.value);
-                        }
-                        else {
-                            await waitForLoaderReadyOrSettled(streamDataPromise, loaderReady?.promise);
-                        }
-                    }
-                    finally {
-                        finishRenderTimingPhase(timing, phaseStartedAt, "loaderWaitMs");
-                    }
+                finally {
+                    finishRenderTimingPhase(timing, phaseStartedAt, "loaderWaitMs");
                 }
+                if (streamData instanceof Response) {
+                    emitRenderTiming(options, timing, streamData.status);
+                    return streamData;
+                }
+                const streamDataPromise = Promise.resolve(streamData);
+                const streamDataSettlement = loadingFile === undefined ? undefined : observePromiseSettlement(streamDataPromise);
                 await waitForRenderPreload(options, timing);
                 await loadServerRenderArtifacts(options, matched.route.file, timing);
                 phaseStartedAt = renderTimingPhaseStartedAt(timing);
@@ -849,16 +810,26 @@ async function renderAppRequestInternal(options) {
                         headers: { "content-type": "text/plain; charset=utf-8" },
                     });
                 }
-                if (loadingFile !== undefined) {
+                if (loadingFile !== undefined && streamDataSettlement !== undefined) {
                     phaseStartedAt = renderTimingPhaseStartedAt(timing);
-                    const stream = await runServerStreamModuleWithLoading(output.code, {
+                    const errorFile = await nearestExistingBoundaryFileForPage({
+                        appDir: options.appDir,
+                        filename: "error.mreact.tsx",
+                        pageFile: matched.route.file,
+                        serverSourceFiles: options.serverSourceFiles,
+                    });
+                    const streamResult = await runServerStreamModuleWithLoading(output.code, {
                         appDir: options.appDir,
                         assetBaseUrl: options.assetBaseUrl,
                         clientRoute,
                         data: streamDataPromise,
+                        dataSettlement: streamDataSettlement,
                         define: options.define,
+                        errorFile,
                         loadingFile,
                         markerRequest: options.request,
+                        onRenderError: options.onRenderError,
+                        prerenderVariantCapture: options.prerenderVariantCapture,
                         pageFile: matched.route.file,
                         params: matched.params,
                         queryClient,
@@ -877,7 +848,11 @@ async function renderAppRequestInternal(options) {
                         clientReferenceManifest: output.metadata.clientReferenceManifest,
                     });
                     finishRenderTimingPhase(timing, phaseStartedAt, "streamConstructionMs");
-                    const response = withOptionalActionCookie(new Response(stream, {
+                    if (streamResult instanceof Response) {
+                        emitRenderTiming(options, timing, streamResult.status);
+                        return streamResult;
+                    }
+                    const response = withOptionalActionCookie(new Response(streamResult, {
                         headers: streamShellResponseHeaders,
                     }), preparedActions.csrfToken, preparedActions.csrfTokenIsNew === true);
                     appendNavigationVary(response.headers);
@@ -896,6 +871,7 @@ async function renderAppRequestInternal(options) {
                     assetBaseUrl: options.assetBaseUrl,
                     pageFile: matched.route.file,
                     markerRequest: options.request,
+                    prerenderVariantCapture: options.prerenderVariantCapture,
                     props,
                     requestUrl: url.pathname,
                     routePath: matched.route.path,
@@ -982,7 +958,7 @@ async function renderAppRequestInternal(options) {
                         data,
                     },
                 })
-                : withServerOnlyRouteMarkers(pageHtml, matched.route.path, options.request);
+                : withServerOnlyRouteMarkers(pageHtml, matched.route.path, options.request, options.prerenderVariantCapture === true);
             phaseStartedAt = renderTimingPhaseStartedAt(timing);
             let html = await runWithQueryClient(queryClient, () => applyLayouts({
                 appDir: options.appDir,
@@ -1137,7 +1113,9 @@ async function renderAppRequestInternal(options) {
             // after draining the body.
             if (options.renderSignals !== undefined) {
                 const tracked = trackedRequest;
-                options.renderSignals.headerDependent = () => sourceUsesRequestInput || invalidConfiguredHsts || (tracked?.requestDependent() ?? true);
+                options.renderSignals.headerDependent = () => sourceUsesRequestInput ||
+                    invalidConfiguredHsts ||
+                    (tracked?.requestDependent() ?? true);
                 options.renderSignals.strictTransportSecurity = () => renderedStrictTransportSecurity;
             }
         }
@@ -1276,12 +1254,12 @@ function routePrefetchManifestScript(routeScripts, assetBaseUrl) {
 function isNavigationRequest(request) {
     return request.headers.get("x-mreact-navigation") === "1";
 }
-function withServerOnlyRouteMarkers(html, routePath, request) {
-    const marker = serverOnlyRouteMarkerParts(routePath, request);
+function withServerOnlyRouteMarkers(html, routePath, request, prerenderVariantCapture) {
+    const marker = serverOnlyRouteMarkerParts(routePath, request, prerenderVariantCapture);
     return marker === undefined ? html : `${marker.prefix}${html}${marker.suffix}`;
 }
-function serverOnlyRouteMarkerParts(routePath, request) {
-    if (request.headers.get("x-mreact-prerender-variant-capture") === "1") {
+function serverOnlyRouteMarkerParts(routePath, request, prerenderVariantCapture) {
+    if (prerenderVariantCapture) {
         return prerenderVariantMarkerParts(routePath);
     }
     return isNavigationRequest(request) ? routeMarkerParts(routePath) : undefined;
@@ -1295,9 +1273,7 @@ export function prerenderVariantMarkerParts(routePath) {
 }
 function appendNavigationVary(headers) {
     const vary = headers.get("vary");
-    if (vary
-        ?.split(",")
-        .some((value) => value.trim().toLowerCase() === "x-mreact-navigation") === true) {
+    if (vary?.split(",").some((value) => value.trim().toLowerCase() === "x-mreact-navigation") === true) {
         return;
     }
     headers.append("vary", "x-mreact-navigation");
@@ -1415,15 +1391,7 @@ async function renderSpecialRoute(options) {
         }
     }
     const props = {
-        data: undefined,
-        debug: errorDebugContext(options.error, options.routePath),
-        error: normalizeErrorForProps(options.error),
-        params: {},
-        queryClient: createQueryClient(),
-        request: options.request,
-        requestId: requestIdForErrorContext(options.request),
-        routeId: routeIdForPath(options.routePath ?? new URL(options.request.url).pathname),
-        traceId: traceContextFromRequest(options.request)?.traceId,
+        ...errorBoundaryProps(options.error, options.request, options.routePath),
     };
     const pageHtml = await renderServerFileToHtml(options.routeFile, props, options.serverModules, options.serverModuleCacheVersion, options.serverSourceFiles, options.define, options.vitePlugins);
     const pageHtmlForLayout = options.navigation?.clientRoute === true
@@ -1457,6 +1425,19 @@ async function renderSpecialRoute(options) {
         status: options.status,
     });
 }
+function errorBoundaryProps(error, request, routePath) {
+    return {
+        data: undefined,
+        debug: errorDebugContext(error, routePath),
+        error: normalizeErrorForProps(error),
+        params: {},
+        queryClient: createQueryClient(),
+        request,
+        requestId: requestIdForErrorContext(request),
+        routeId: routeIdForPath(routePath ?? new URL(request.url).pathname),
+        traceId: traceContextFromRequest(request)?.traceId,
+    };
+}
 async function renderServerFileToHtml(file, props, serverModules, serverModuleCacheVersion, serverSourceFiles, define, vitePlugins) {
     const code = await readServerSourceFile(file, serverModuleCacheVersion, serverSourceFiles);
     const output = transformServerModule({
@@ -2216,7 +2197,7 @@ function runServerStreamModule(code, options) {
                     data: options.props.data,
                 },
             })
-            : serverOnlyRouteMarkerParts(options.routePath, options.markerRequest);
+            : serverOnlyRouteMarkerParts(options.routePath, options.markerRequest, options.prerenderVariantCapture === true);
         sink.append("<!DOCTYPE html>");
         sink.append(clientNavigationHeadTags({
             assetBaseUrl: options.assetBaseUrl,
@@ -2348,7 +2329,14 @@ async function runServerStreamModuleWithLoading(code, options) {
                 request: { url: options.requestUrl },
             },
         })
-        : serverOnlyRouteMarkerParts(options.routePath, options.markerRequest);
+        : serverOnlyRouteMarkerParts(options.routePath, options.markerRequest, options.prerenderVariantCapture === true);
+    const dataSettlement = options.dataSettlement();
+    if (dataSettlement.status === "rejected") {
+        throw dataSettlement.error;
+    }
+    if (dataSettlement.status === "fulfilled" && dataSettlement.value instanceof Response) {
+        return dataSettlement.value;
+    }
     return renderToReadableStream((sink) => {
         sink.append("<!DOCTYPE html>");
         sink.append(clientNavigationHeadTags({
@@ -2360,13 +2348,31 @@ async function runServerStreamModuleWithLoading(code, options) {
             sink.append(shell.prefix);
         }
         sink.append(marker?.prefix ?? "");
-        renderVisibleOutOfOrderBoundary(sink, "mreact-route", options.data, async (boundarySink, data) => {
+        renderOutOfOrderBoundary(sink, "mreact-route", options.data, async (boundarySink, data) => {
             await appendServerStreamModule(code, boundarySink, withTrackedRequest({
                 data,
                 params: options.params,
                 queryClient: options.queryClient,
             }, options.request, options.trackedRequest), options.pageFile, options.serverModules, options.serverModuleCacheVersion, options.define, options.vitePlugins, options.importPolicy);
         }, {
+            async catch(boundarySink, error) {
+                try {
+                    options.onRenderError?.(error);
+                }
+                catch {
+                    // Error reporting is best-effort and must not truncate a response that already flushed.
+                }
+                if (options.errorFile === undefined) {
+                    boundarySink.append("Internal Server Error");
+                    return;
+                }
+                try {
+                    boundarySink.append(await renderServerFileToHtml(options.errorFile, errorBoundaryProps(error, options.request, options.routePath), options.serverModules, options.serverModuleCacheVersion, options.serverSourceFiles, options.define, options.vitePlugins));
+                }
+                catch {
+                    boundarySink.append("Internal Server Error");
+                }
+            },
             placeholder(boundarySink) {
                 boundarySink.append(loadingHtml);
             },
@@ -2379,35 +2385,6 @@ async function runServerStreamModuleWithLoading(code, options) {
         renderOutOfOrderReorderScript(sink);
     });
 }
-function renderVisibleOutOfOrderBoundary(sink, id, value, render, options = {}) {
-    const placeholderSink = createStringSink();
-    void options.placeholder?.(placeholderSink);
-    const placeholderTag = normalizeVisibleOutOfOrderPlaceholderTag(options.placeholderTag);
-    sink.append(`<${placeholderTag} data-mreact-oob-placeholder="${escapeHtmlAttribute(id)}">${placeholderSink.toString()}</${placeholderTag}>`);
-    const task = renderVisibleOutOfOrderFragment(sink, id, value, render, options);
-    if (sink.defer === undefined) {
-        void task;
-        return;
-    }
-    sink.defer(task);
-}
-function normalizeVisibleOutOfOrderPlaceholderTag(tag) {
-    if (typeof tag !== "string") {
-        return "span";
-    }
-    const normalized = tag.trim().toLowerCase();
-    return /^[a-z][a-z0-9-]*$/.test(normalized) ? normalized : "span";
-}
-async function renderVisibleOutOfOrderFragment(sink, id, value, render, options) {
-    const fragmentSink = createStringSink();
-    await renderAsyncBoundary(fragmentSink, value, render, options.catch === undefined ? {} : { catch: options.catch });
-    await fragmentSink.drain();
-    sink.append(renderVisibleOutOfOrderFragmentHtml(id, fragmentSink.toString()));
-}
-function renderVisibleOutOfOrderFragmentHtml(id, html) {
-    const escapedId = escapeHtmlAttribute(id);
-    return `<template data-mreact-oob-fragment="${escapedId}">${html}</template><mreact-oob-complete hidden data-mreact-oob-complete="${escapedId}"></mreact-oob-complete>`;
-}
 async function appendServerStreamModule(code, sink, props, sourcefile, serverModules, serverModuleCacheVersion, define, vitePlugins, importPolicy) {
     const module = await loadServerStreamModule(code, sourcefile, serverModules, serverModuleCacheVersion, define, vitePlugins, importPolicy);
     const component = selectStreamComponent(module);
@@ -3117,15 +3094,16 @@ async function loadComposedRouteMetadata(options) {
     if (cacheKey !== undefined) {
         const cached = readRouterRuntimeCacheEntry(composedRouteMetadataCache, cacheKey, composedRouteMetadataCacheCounters);
         if (cached !== undefined) {
-            return cached;
+            const entry = await cached;
+            return applyFileConventionMetadataTemplate(entry.metadata, entry.template, options.context.params);
         }
     }
     try {
         const loaded = await loadComposedRouteMetadataUncached(options);
         if (cacheKey !== undefined && !loaded.dynamic) {
-            setBoundedCacheEntry(composedRouteMetadataCache, cacheKey, Promise.resolve(loaded.metadata), maxComposedRouteMetadataCacheEntries, composedRouteMetadataCacheCounters);
+            setBoundedCacheEntry(composedRouteMetadataCache, cacheKey, Promise.resolve({ metadata: loaded.metadata, template: loaded.template }), maxComposedRouteMetadataCacheEntries, composedRouteMetadataCacheCounters);
         }
-        return loaded.metadata;
+        return applyFileConventionMetadataTemplate(loaded.metadata, loaded.template, options.context.params);
     }
     catch (error) {
         if (cacheKey !== undefined) {
@@ -3191,7 +3169,8 @@ async function loadComposedRouteMetadataUncached(options) {
     }
     return {
         dynamic,
-        metadata: applyFileConventionMetadata(mergeRouteMetadata(metadata), options.routes, options.filename, options.context.params),
+        metadata: mergeRouteMetadata(metadata),
+        template: fileConventionMetadataTemplate(options.routes, options.filename),
     };
 }
 function hasMetadataExport(code) {