@rsc-kit/core 0.17.0 → 0.18.1

package/dist/host.js

@@ -13,21 +13,32 @@
 //
 //   const rsc = createRscHandler({ engine, manifest, assets })
 //   Bun.serve({ fetch: (req) => rsc(req).then((r) => r ?? new Response('', { status: 404 })) })
-import { allowFor, matchApiRoute, matchIntercept, matchRoute, retentionKey, sharedDepth } from './routing.js';
-import { pathKey, patternKey } from './prerender.js';
-import { apiKey } from './apiPrerender.js';
-import { withRevalidation } from './revalidate.js';
-export { revalidate } from './revalidate.js';
-import { currentNotFound, withRedirect } from './redirect.js';
-import { withCache } from './cache.js';
-import { withRequest, withResponseDraft } from './request.js';
-export { redirect } from './redirect.js';
+import { allowFor, matchApiRoute, matchIntercept, matchRoute, retentionKey, sharedDepth, } from "./routing.js";
+import { pathKey, patternKey } from "./prerender.js";
+import { apiKey } from "./apiPrerender.js";
+import { hostPath, hostSegment, routableHost } from "./hostRouting.js";
+import { withRevalidation } from "./revalidate.js";
+/**
+ * @internal For a host adapter that embeds the engine. An app imports this
+ * from `@rsc-kit/core/revalidate`.
+ */
+export { revalidate } from "./revalidate.js";
+import { currentNotFound, withRedirect } from "./redirect.js";
+import { withCache } from "./cache.js";
+import { withRequest, withResponseDraft } from "./request.js";
+/**
+ * @internal For a host adapter that embeds the engine. An app imports this
+ * from `@rsc-kit/core/redirect` - the one the guides teach, and the one an
+ * editor should offer first.
+ */
+export { redirect } from "./redirect.js";
 // Re-exported, not redefined: routing.ts is the one implementation, shared with
 // the prerenderer and the generated bundle, and this stays the adapter's
 // public surface so a host imports from one place.
-export { matchIntercept, matchRoute, sharedDepth } from './routing.js';
-import { FLIGHT_TYPE, HEADER, HTML_TYPE, PER_CLIENT, REVALIDATE, VARY_ON_RSC } from './headers.js';
-import { ServerAuthenticationError, ServerAuthorizationError } from './js/errors.js';
+/** @internal For a host adapter. An app never matches its own routes. */
+export { matchIntercept, matchRoute, sharedDepth } from "./routing.js";
+import { FLIGHT_TYPE, HEADER, HTML_TYPE, PER_CLIENT, REVALIDATE, VARY_ON_RSC, } from "./headers.js";
+import { ServerAuthenticationError, ServerAuthorizationError, } from "./js/errors.js";
 /**
  * The answer to a redirect that was decided before anything was written.
  *
@@ -53,9 +64,9 @@ import { ServerAuthenticationError, ServerAuthorizationError } from './js/errors
  */
 function inScript(value) {
     return JSON.stringify(value)
-        .replace(/</g, '\\u003c')
-        .replace(/\u2028/g, '\\u2028')
-        .replace(/\u2029/g, '\\u2029');
+        .replace(/</g, "\\u003c")
+        .replace(/\u2028/g, "\\u2028")
+        .replace(/\u2029/g, "\\u2029");
 }
 function redirectResponse(to, isPayloadRequest) {
     if (isPayloadRequest) {
@@ -84,7 +95,7 @@ function appendLateRedirect(stream, taken) {
     // An engine that answered with a finished body rather than a stream has no
     // late window at all: the render was over before this was called, so the
     // caller's own check already saw everything there was to see.
-    if (typeof stream?.getReader !== 'function')
+    if (typeof stream?.getReader !== "function")
         return stream;
     const encoder = new TextEncoder();
     const reader = stream.getReader();
@@ -129,22 +140,22 @@ function refusalStatus(error) {
     // raised by another copy of the module: an app's actions are bundled apart
     // from the engine, and instanceof is false across that seam.
     const name = error?.name;
-    if (name === 'ServerAuthenticationError')
+    if (name === "ServerAuthenticationError")
         return 401;
-    if (name === 'ServerAuthorizationError')
+    if (name === "ServerAuthorizationError")
         return 403;
     // A status the host chose — a throttle's 429, a policy's 403 — carried on
     // the error by the transport. Bounded to refusals: a host answering 500
     // should not be able to make this look like a client's fault, and one
     // answering 200 should not turn a failed render into a success.
     const carried = error?.refusalStatus;
-    if (typeof carried === 'number' && carried >= 400 && carried <= 499)
+    if (typeof carried === "number" && carried >= 400 && carried <= 499)
         return carried;
     return null;
 }
 function refusalMessage(error) {
     const message = error?.message;
-    return typeof message === 'string' && message !== '' ? message : 'Refused.';
+    return typeof message === "string" && message !== "" ? message : "Refused.";
 }
 /**
  * Whether a browser was told it could post this action.
@@ -168,10 +179,12 @@ function refusalMessage(error) {
  * the preflight.
  */
 export function actionOriginAllowed(request, url) {
-    const origin = request.headers.get('origin');
+    const origin = request.headers.get("origin");
     if (!origin)
         return true;
-    const expected = request.headers.get('x-forwarded-host') ?? request.headers.get('host') ?? url.host;
+    const expected = request.headers.get("x-forwarded-host") ??
+        request.headers.get("host") ??
+        url.host;
     try {
         return new URL(origin).host === expected;
     }
@@ -190,7 +203,7 @@ const DEFAULT_MAX_ACTION_BODY = 8 * 1024 * 1024;
  * dropped, and the caller answers 413 rather than holding the rest.
  */
 async function readBodyUpTo(request, limit) {
-    const declared = Number(request.headers.get('content-length'));
+    const declared = Number(request.headers.get("content-length"));
     if (Number.isFinite(declared) && declared > limit)
         return null;
     if (!request.body)
@@ -222,11 +235,14 @@ async function readBodyUpTo(request, limit) {
  * null. A header is a string anyone can send, and `new URL` throws on one
  * that is not a url; that must not become a 500 on the action endpoint.
  */
-function refererPath(referer, origin) {
+function refererPath(referer, origin, hosts = []) {
     if (!referer)
         return null;
     try {
-        return new URL(referer, origin).pathname;
+        const parsed = new URL(referer, origin);
+        // The page the action was invoked from is routed the way a request for
+        // it would be: on a tenant host, the referer's host names the segment.
+        return hostPath(parsed.host, parsed.pathname, hosts);
     }
     catch {
         return null;
@@ -244,6 +260,15 @@ function refererPath(referer, origin) {
  * throws on every request instead of being undefined.
  */
 const MAX_QUERY = 8_000;
+/**
+ * The host segment a routed url begins with, by url. Kept beside the url
+ * rather than in it, so the pathname stays what a page and a stored file
+ * are keyed by, and the matcher alone is told the leading part is the host's.
+ */
+const hostOf = new WeakMap();
+function matchPage(routes, url) {
+    return matchRoute(routes, url.pathname, hostOf.get(url) ?? null);
+}
 export function createRscHandler(options) {
     const { engine, assets, version } = options;
     const maxActionBody = options.maxActionBody ?? DEFAULT_MAX_ACTION_BODY;
@@ -251,7 +276,7 @@ export function createRscHandler(options) {
     // closures that use it, and every one of them runs after the throw.
     const manifest = options.manifest ?? engine.manifest?.();
     if (!manifest) {
-        throw new Error('No route table. Pass `manifest`, or build with a plugin version that embeds one in the bundle.');
+        throw new Error("No route table. Pass `manifest`, or build with a plugin version that embeds one in the bundle.");
     }
     const routes = manifest;
     // Only when this host has functions of its own. Installing unconditionally
@@ -272,7 +297,7 @@ export function createRscHandler(options) {
                 return await remote(name, ...args);
             // Louder than returning null: a typo in a server component otherwise
             // renders as missing data with nothing anywhere saying why.
-            throw new Error(`No host function named ${JSON.stringify(name)}. Registered: ${Object.keys(fns).join(', ') || '(none)'}`);
+            throw new Error(`No host function named ${JSON.stringify(name)}. Registered: ${Object.keys(fns).join(", ") || "(none)"}`);
         });
     }
     async function propsFor(match, request) {
@@ -283,7 +308,10 @@ export function createRscHandler(options) {
         return {
             component: match.route.component,
             props,
-            layouts: match.route.layouts.map((component) => ({ component, props: {} })),
+            layouts: match.route.layouts.map((component) => ({
+                component,
+                props: {},
+            })),
             loadings: match.route.loadings,
             parallelSlots: match.route.slots,
             // What may be named in X-RSC-Revalidate — see renderRevalidated.
@@ -298,7 +326,13 @@ export function createRscHandler(options) {
     // server is a reasonable thing to do — previewing an export, or one build
     // used both ways — and without this every navigation 404s in the console
     // while the page itself looks fine.
-    const payloadName = manifest.build?.payloadName || '';
+    const payloadName = manifest.build?.payloadName || "";
+    /** The site's own hosts; any other host is routed with its segment in front of the path. */
+    const siteHosts = manifest.build?.hosts ?? [];
+    /** Whether responses say what built them. How they were served is always said. */
+    const identify = Boolean(manifest.build?.identify);
+    /** How a response was answered, for X-RSC-Kit: a file the build wrote, or a shell of one. */
+    const servedFrom = new WeakMap();
     /**
      * The page a payload url belongs to, if this is one.
      *
@@ -306,14 +340,18 @@ export function createRscHandler(options) {
      * built for export asks for index.seg1.rsc when it already holds a layout,
      * and matching only the plain name leaves that as a 404 no page reports.
      */
-    const payloadNames = new RegExp('/' + payloadName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&').replace(/^index\\\./, 'index(\\.seg\\d+)?\\.') + '$');
+    const payloadNames = new RegExp("/" +
+        payloadName
+            .replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
+            .replace(/^index\\\./, "index(\\.seg\\d+)?\\.") +
+        "$");
     function pageForPayload(pathname) {
-        if (payloadName === '')
+        if (payloadName === "")
             return null;
         const match = payloadNames.exec(pathname);
         if (!match)
             return null;
-        return pathname.slice(0, match.index) || '/';
+        return pathname.slice(0, match.index) || "/";
     }
     // One memo table per request, opened at the outermost point so that
     // everything below shares it: middleware, layouts, the page, and an action. A
@@ -334,7 +372,7 @@ export function createRscHandler(options) {
                 // Set-Cookie is applied below, once per cookie: iterating a Headers
                 // gives it joined in some runtimes and per-cookie in others, and a
                 // joined one is a single malformed cookie the browser discards.
-                if (name.toLowerCase() === 'set-cookie')
+                if (name.toLowerCase() === "set-cookie")
                     return;
                 // set, not append: a middleware asking for a header means that
                 // value, not that value added to whatever the host already chose.
@@ -342,20 +380,52 @@ export function createRscHandler(options) {
             });
             // Appended, because several cookies are several headers.
             for (const cookie of collected.getSetCookie()) {
-                response.headers.append('Set-Cookie', cookie);
+                response.headers.append("Set-Cookie", cookie);
             }
+            // How this answer was served - the header a developer reads in the
+            // Network tab, the way X-Nextjs-Cache is. Always: it names no
+            // product, and a CDN rule or a check can key on it.
+            response.headers.set("X-RSC-Kit", servedFrom.get(response) ?? "rendered");
+            // What built it. The name only, never the version - a version in
+            // every response is what a vulnerability scanner filters on - and
+            // off for a team whose policy strips every framework identifier.
+            if (identify)
+                response.headers.set("X-Powered-By", "rsc-kit");
             return response;
         })));
     };
     async function route(request) {
         let url = new URL(request.url);
+        // A host other than the site's own is matched with its segment in front
+        // of the path, once, here: everything below - the api match, the page
+        // match, the stored answer, the payload - sees that path and nothing
+        // else knows a host was involved. The visitor's url is untouched.
+        // Compared against X-Forwarded-Host first, for the same reason the
+        // action's origin check is: a proxied deployment is the common one.
+        // Only when a route can begin with that segment - a [domain] directory or
+        // one named for the host - so an app with a metadataBase and no tenant
+        // tree routes every host by path, and a proxy forwarding by an internal
+        // name is not read as a tenant.
+        if (siteHosts.length > 0) {
+            const host = request.headers.get("x-forwarded-host") ??
+                request.headers.get("host") ??
+                url.host;
+            const segment = hostSegment(host, siteHosts);
+            if (segment !== null && routableHost(segment, routes.routes)) {
+                url = new URL(hostPath(host, url.pathname, siteHosts) + url.search, url.origin);
+                hostOf.set(url, segment);
+            }
+        }
         const asPayload = pageForPayload(url.pathname);
         if (asPayload !== null) {
             // Rewritten to the page it is asking about, with the header the rest of
             // this handler reads — one path through, however the client asked.
+            const host = hostOf.get(url);
             url = new URL(asPayload + url.search, url.origin);
+            if (host !== undefined)
+                hostOf.set(url, host);
             const headers = new Headers(request.headers);
-            headers.set(HEADER.rsc, '1');
+            headers.set(HEADER.rsc, "1");
             request = new Request(url, { method: request.method, headers });
         }
         if (assets) {
@@ -363,9 +433,9 @@ export function createRscHandler(options) {
             if (asset)
                 return asset;
         }
-        if (request.method === 'POST' && url.pathname === HEADER.actionPath) {
+        if (request.method === "POST" && url.pathname === HEADER.actionPath) {
             if (!actionOriginAllowed(request, url)) {
-                return new Response('Cross-origin action', { status: 403 });
+                return new Response("Cross-origin action", { status: 403 });
             }
             return await handleAction(request, url);
         }
@@ -385,13 +455,13 @@ export function createRscHandler(options) {
                 return stored;
             return await engine.handleApiRoute(api.route.name, request, api.params, allowFor(api.route));
         }
-        if (request.method === 'GET' && url.pathname === HEADER.queryPath) {
+        if (request.method === "GET" && url.pathname === HEADER.queryPath) {
             // Same check as an action, for a smaller reason: a cross-origin page
             // cannot read this answer — CORS sees to that — but it can still cause
             // the read to run with the visitor's cookies. A query is side-effect
             // free by contract, so this is depth rather than the only defence.
             if (!actionOriginAllowed(request, url)) {
-                return new Response('Cross-origin query', { status: 403 });
+                return new Response("Cross-origin query", { status: 403 });
             }
             return await handleQuery(request, url);
         }
@@ -400,12 +470,12 @@ export function createRscHandler(options) {
         if (options.prerendered && url.pathname === HEADER.pprShellPath) {
             return await servePprShell(request, url, options.prerendered);
         }
-        if (request.method === 'POST' &&
+        if (request.method === "POST" &&
             options.prerendered &&
             url.pathname === HEADER.pprResumePath) {
             return await servePprResume(request, url, options.prerendered);
         }
-        if (request.method !== 'GET' && request.method !== 'HEAD')
+        if (request.method !== "GET" && request.method !== "HEAD")
             return null;
         // One named region of this page, asked for without mutating anything to
         // earn it. What an action invalidated does not come through here — that
@@ -427,7 +497,7 @@ export function createRscHandler(options) {
         // something smaller than one: answering a named region with the whole
         // document puts the entire page inside that region, and answering an
         // interception with it replaces the page the modal was opening over.
-        const match = matchRoute(routes, url.pathname);
+        const match = matchPage(routes, url);
         if (options.prerendered) {
             // A guarded route can still be frozen: whether the content is the same
             // for everyone, and whether this caller may see it, are different
@@ -437,13 +507,20 @@ export function createRscHandler(options) {
             if (refusal)
                 return refusal;
             const frozen = await servePrerendered(request, url, options.prerendered);
+            // A whole page from a file, or a shell of one with the holes rendered
+            // now: the header says which. servePrerendered marks the shell.
+            if (frozen && !servedFrom.has(frozen))
+                servedFrom.set(frozen, "stored");
             if (frozen)
                 return frozen;
         }
         if (!match)
             return null;
         const props = await propsFor(match, request);
-        const layouts = match.route.layouts.map((component) => ({ component, props: {} }));
+        const layouts = match.route.layouts.map((component) => ({
+            component,
+            props: {},
+        }));
         const chain = match.route.layouts;
         // A payload request says so with a header on the page's own url, so one
         // route serves both the document and the navigation that follows it.
@@ -457,7 +534,6 @@ export function createRscHandler(options) {
                 // still available. Nothing is buffered to make that true.
                 let htmlStream;
                 try {
-                    ;
                     ({ htmlStream } = await engine.handleRscHtmlStream(match.route.component, props, layouts, match.route.loadings, match.route.slots, {}, undefined, url.pathname, 
                     // A route that ships no runtime gets no bootstrap and no segment
                     // boundary — the boundary is itself a client component, so leaving
@@ -506,10 +582,12 @@ export function createRscHandler(options) {
                     return null;
                 return new Response(appendLateRedirect(htmlStream, taken), {
                     headers: withVersion({
-                        'Content-Type': HTML_TYPE,
-                        [HEADER.layouts]: chain.join(','),
+                        "Content-Type": HTML_TYPE,
+                        [HEADER.layouts]: chain.join(","),
                         Vary: VARY_ON_RSC,
-                        'Cache-Control': match.route.middleware?.length ? PER_CLIENT : REVALIDATE,
+                        "Cache-Control": match.route.middleware?.length
+                            ? PER_CLIENT
+                            : REVALIDATE,
                     }),
                 });
             });
@@ -522,7 +600,6 @@ export function createRscHandler(options) {
             let stream;
             let segmentDepth;
             try {
-                ;
                 ({ stream, segmentDepth } = await engine.handleRscStream(match.route.component, props, layouts, match.route.loadings, match.route.slots, {}, from, url.pathname));
             }
             catch (error) {
@@ -550,11 +627,11 @@ export function createRscHandler(options) {
                 return redirectResponse(early, true);
             return new Response(stream, {
                 headers: withVersion({
-                    'Content-Type': FLIGHT_TYPE,
+                    "Content-Type": FLIGHT_TYPE,
                     [HEADER.segmentDepth]: String(segmentDepth),
-                    [HEADER.layouts]: chain.join(','),
+                    [HEADER.layouts]: chain.join(","),
                     Vary: VARY_ON_RSC,
-                    'Cache-Control': PER_CLIENT,
+                    "Cache-Control": PER_CLIENT,
                 }),
             });
         });
@@ -602,7 +679,7 @@ export function createRscHandler(options) {
     async function frozenApi(request, url, api) {
         if (!options.prerendered)
             return null;
-        if (request.method !== 'GET' && request.method !== 'HEAD')
+        if (request.method !== "GET" && request.method !== "HEAD")
             return null;
         if (api.route.middleware.length > 0)
             return null;
@@ -628,32 +705,35 @@ export function createRscHandler(options) {
         // guessing on the unsafe side.
         if (url.search && frozen.varies !== false)
             return null;
-        return new Response(request.method === 'HEAD' ? null : frozen.body, {
+        const answer = new Response(request.method === "HEAD" ? null : frozen.body, {
             status: frozen.status,
             headers: withVersion(Object.fromEntries(frozen.headers)),
         });
+        servedFrom.set(answer, "stored");
+        return answer;
     }
     async function servePprShell(request, url, read) {
-        if (request.method !== 'GET' && request.method !== 'HEAD')
+        if (request.method !== "GET" && request.method !== "HEAD")
             return null;
-        const target = url.searchParams.get('url');
-        if (!target || !target.startsWith('/')) {
-            return new Response('A url is required', { status: 400 });
+        const target = url.searchParams.get("url");
+        if (!target || !target.startsWith("/")) {
+            return new Response("A url is required", { status: 400 });
         }
         // Matched from the url asked for, never from anything else the caller sent.
         const route = matchRoute(routes, new URL(target, url.origin).pathname);
         if (!route)
-            return new Response('No such page', { status: 404 });
+            return new Response("No such page", { status: 404 });
         if (route.route.middleware?.length) {
-            return new Response('This route is not edge-cacheable', { status: 404 });
+            return new Response("This route is not edge-cacheable", { status: 404 });
         }
         const key = pathKey(new URL(target, url.origin).pathname);
-        const shell = (await read(`${key}.ppr.html`)) ?? (await read(`${patternKey(route.route)}.ppr.html`));
+        const shell = (await read(`${key}.ppr.html`)) ??
+            (await read(`${patternKey(route.route)}.ppr.html`));
         if (shell === null)
-            return new Response('No shell for this page', { status: 404 });
+            return new Response("No shell for this page", { status: 404 });
         return new Response(JSON.stringify({ shell, version: version ?? null }), {
             headers: withVersion({
-                'Content-Type': 'application/json',
+                "Content-Type": "application/json",
                 // Deliberately NOT the REVALIDATE the rest of the host sends. That is
                 // `max-age=0, must-revalidate`, which a cache honours by treating the
                 // entry as stale the moment it arrives — an edge would store this and
@@ -665,7 +745,7 @@ export function createRscHandler(options) {
                 // route never reaches here at all, so it is genuinely cacheable. An
                 // hour bounds how long a deploy can be served against a stale shell;
                 // the version below catches it sooner than that.
-                'Cache-Control': 'public, max-age=3600',
+                "Cache-Control": "public, max-age=3600",
             }),
         });
     }
@@ -683,21 +763,21 @@ export function createRscHandler(options) {
      * gets an anonymous answer.
      */
     async function servePprResume(request, url, read) {
-        const target = url.searchParams.get('url');
-        if (!target || !target.startsWith('/')) {
-            return new Response('A url is required', { status: 400 });
+        const target = url.searchParams.get("url");
+        if (!target || !target.startsWith("/")) {
+            return new Response("A url is required", { status: 400 });
         }
         const pathname = new URL(target, url.origin).pathname;
         const route = matchRoute(routes, pathname);
         if (!route)
-            return new Response('No such page', { status: 404 });
+            return new Response("No such page", { status: 404 });
         // The same refusal the document would get, before a byte of the holes is
         // rendered. Nothing below runs for a caller this turns away.
         const refusal = await refuseUnlessAllowed(request, route);
         if (refusal)
             return refusal;
         if (!engine.handleRscResume) {
-            return new Response('This engine cannot resume', { status: 500 });
+            return new Response("This engine cannot resume", { status: 500 });
         }
         const key = pathKey(pathname);
         const pattern = patternKey(route.route);
@@ -710,8 +790,8 @@ export function createRscHandler(options) {
         // difference between this and the protocol it is modelled on.
         const state = shellKey === null ? null : await read(`${shellKey}.postponed.json`);
         if (state === null)
-            return new Response('Nothing to resume', { status: 404 });
-        const { htmlStream } = await engine.handleRscResume(route.route.component, route.params, route.route.layouts.map((component) => ({ component, props: {} })), route.route.loadings, route.route.slots, {}, JSON.parse(state), undefined, shellKey === key ? pathname : '');
+            return new Response("Nothing to resume", { status: 404 });
+        const { htmlStream } = await engine.handleRscResume(route.route.component, route.params, route.route.layouts.map((component) => ({ component, props: {} })), route.route.loadings, route.route.slots, {}, JSON.parse(state), undefined, shellKey === key ? pathname : "");
         // Carries the build version so a caller holding a cached shell can tell
         // that it no longer belongs to this origin. A shell from an older build
         // does not make the resume fail — it replays against slots that have moved
@@ -719,9 +799,9 @@ export function createRscHandler(options) {
         // else would ever report it.
         return new Response(htmlStream, {
             headers: withVersion({
-                'Content-Type': HTML_TYPE,
+                "Content-Type": HTML_TYPE,
                 // Rendered for whoever asked. Never cacheable.
-                'Cache-Control': PER_CLIENT,
+                "Cache-Control": PER_CLIENT,
             }),
         });
     }
@@ -740,15 +820,17 @@ export function createRscHandler(options) {
             // pattern. Nothing in a shell varies by param, so one shell serves every
             // url its route matches — which is the only way a route whose urls were
             // never listed gets anything frozen at all.
-            const route = matchRoute(routes, url.pathname);
+            const route = matchPage(routes, url);
             const whole = await read(`${key}.html`);
             // A whole page is finished. Nothing to resume, nothing to render.
             if (whole !== null) {
                 return new Response(whole, {
                     headers: withVersion({
-                        'Content-Type': HTML_TYPE,
+                        "Content-Type": HTML_TYPE,
                         Vary: VARY_ON_RSC,
-                        'Cache-Control': route?.route.middleware?.length ? PER_CLIENT : REVALIDATE,
+                        "Cache-Control": route?.route.middleware?.length
+                            ? PER_CLIENT
+                            : REVALIDATE,
                     }),
                 });
             }
@@ -785,7 +867,7 @@ export function createRscHandler(options) {
             // A shell found under the route's pattern was frozen for no particular
             // url, so it was rendered with no page key. Handing one over now would
             // key the tree differently from the one being resumed.
-            shellKey === key ? url.pathname : '');
+            shellKey === key ? url.pathname : "");
             // The shell first, then whatever the resume writes. React's own script
             // travels with the resumed segments and moves them into place, so this is
             // a plain concatenation and the holes land without hydration.
@@ -806,15 +888,17 @@ export function createRscHandler(options) {
                     }
                 },
             });
-            return new Response(body, {
+            const withHoles = new Response(body, {
                 headers: withVersion({
-                    'Content-Type': HTML_TYPE,
+                    "Content-Type": HTML_TYPE,
                     Vary: VARY_ON_RSC,
                     // The shell is cacheable; this response is not. It carries the holes,
                     // which were rendered for whoever asked.
-                    'Cache-Control': PER_CLIENT,
+                    "Cache-Control": PER_CLIENT,
                 }),
             });
+            servedFrom.set(withHoles, "shell");
+            return withHoles;
         }
         // Only the document is ever served frozen for a shell. The payload is what
         // fills it in, and it has to be rendered now — answering with a frozen one
@@ -836,11 +920,11 @@ export function createRscHandler(options) {
             return null;
         return new Response(payload, {
             headers: withVersion({
-                'Content-Type': FLIGHT_TYPE,
+                "Content-Type": FLIGHT_TYPE,
                 [HEADER.segmentDepth]: String(variant ? shared : 0),
-                [HEADER.layouts]: chain.join(','),
+                [HEADER.layouts]: chain.join(","),
                 Vary: VARY_ON_RSC,
-                'Cache-Control': PER_CLIENT,
+                "Cache-Control": PER_CLIENT,
             }),
         });
     }
@@ -861,7 +945,8 @@ export function createRscHandler(options) {
         // until the build froze the page, then silently stop.
         if (!match)
             return null;
-        const guarded = (match.route.middleware?.length ?? 0) > 0 || (match.route.hostMiddleware?.length ?? 0) > 0;
+        const guarded = (match.route.middleware?.length ?? 0) > 0 ||
+            (match.route.hostMiddleware?.length ?? 0) > 0;
         if (!guarded)
             return null;
         // A route that declares middleware and an engine that cannot run it is not
@@ -870,8 +955,8 @@ export function createRscHandler(options) {
         // guarded page. Reachable when a host runs a bundle built by an older
         // plugin, where the export did not exist.
         if (!engine.runRouteMiddleware) {
-            return new Response('This route declares middleware, and the engine cannot run it. ' +
-                'Rebuild the app against the current @rsc-kit/core.', { status: 500 });
+            return new Response("This route declares middleware, and the engine cannot run it. " +
+                "Rebuild the app against the current @rsc-kit/core.", { status: 500 });
         }
         const asPayload = request.headers.get(HEADER.rsc) !== null;
         return await withRedirect(async (taken) => {
@@ -896,17 +981,16 @@ export function createRscHandler(options) {
     }
     async function handleRevalidate(request, url, target) {
         if (!engine.handleRscRevalidate) {
-            return new Response('This build cannot revalidate', { status: 501 });
+            return new Response("This build cannot revalidate", { status: 501 });
         }
-        const match = matchRoute(routes, url.pathname);
+        const match = matchPage(routes, url);
         if (!match)
-            return new Response('No such page', { status: 404 });
+            return new Response("No such page", { status: 404 });
         // Scoped like the render paths: a guard above the target may refuse, and
         // that refusal is an answer rather than a failure.
         return await withRedirect(async (taken) => {
             let rscPayload;
             try {
-                ;
                 ({ rscPayload } = await engine.handleRscRevalidate(target, pageContext(match, await propsFor(match, request))));
             }
             catch (error) {
@@ -920,11 +1004,11 @@ export function createRscHandler(options) {
                 return redirectResponse(refused, true);
             return new Response(rscPayload, {
                 headers: withVersion({
-                    'Content-Type': FLIGHT_TYPE,
+                    "Content-Type": FLIGHT_TYPE,
                     // Echoed so the client can tell which region it is holding.
                     [HEADER.revalidate]: target,
                     Vary: VARY_ON_RSC,
-                    'Cache-Control': 'private, no-store',
+                    "Cache-Control": "private, no-store",
                 }),
             });
         });
@@ -932,7 +1016,7 @@ export function createRscHandler(options) {
     async function handleIntercept(request, url, slot) {
         const intercept = matchIntercept(routes, url.pathname, slot);
         if (!intercept)
-            return new Response('No interceptor for this url', { status: 404 });
+            return new Response("No interceptor for this url", { status: 404 });
         // The guards of the route being intercepted, before anything is rendered.
         //
         // An interceptor exists to show the same resource as the route it stands in
@@ -944,18 +1028,18 @@ export function createRscHandler(options) {
         //
         // Derived from the url, never from X-RSC-Referer. The referer is a header
         // the caller writes, and guarding by it means the caller picks the guard.
-        const intercepted = matchRoute(routes, url.pathname);
+        const intercepted = matchPage(routes, url);
         // Nothing to guard means nothing to serve. A url that matches an
         // interceptor but no route has no middleware chain to consult, so there is
         // no way to know whether this caller may see it — and an interceptor
         // stands in for a route, so a url with no route behind it is not a page
         // anyone was entitled to open a modal over.
         if (!intercepted)
-            return new Response('No such page', { status: 404 });
+            return new Response("No such page", { status: 404 });
         const refusal = await refuseUnlessAllowed(request, intercepted);
         if (refusal)
             return refusal;
-        const from = refererPath(request.headers.get(HEADER.referer), url.origin);
+        const from = refererPath(request.headers.get(HEADER.referer), url.origin, siteHosts);
         const under = from ? matchRoute(routes, from) : null;
         // Without a page to open over there is nothing to intercept: render the
         // interceptor on its own rather than answering with the wrong page.
@@ -986,25 +1070,25 @@ export function createRscHandler(options) {
             });
             return new Response(rscPayload, {
                 headers: withVersion({
-                    'Content-Type': FLIGHT_TYPE,
+                    "Content-Type": FLIGHT_TYPE,
                     // Says what this payload is, so the client puts it in the slot
                     // instead of treating it as a segment of the page.
                     [HEADER.revalidate]: slot,
                     Vary: VARY_ON_RSC,
                     // Per-client by construction: which region this is was chosen by a
                     // request header, so a shared cache has nothing useful to key on.
-                    'Cache-Control': 'private, no-store',
+                    "Cache-Control": "private, no-store",
                 }),
             });
         }
         const { stream, segmentDepth } = await engine.handleRscStream(component, props, chain.map((layout) => ({ component: layout, props: {} })), loadings, slots, {}, sharedDepth(request.headers.get(HEADER.segments), chain), retentionKey(url.pathname, slot));
         return new Response(stream, {
             headers: withVersion({
-                'Content-Type': FLIGHT_TYPE,
+                "Content-Type": FLIGHT_TYPE,
                 [HEADER.segmentDepth]: String(segmentDepth),
-                [HEADER.layouts]: chain.join(','),
+                [HEADER.layouts]: chain.join(","),
                 Vary: VARY_ON_RSC,
-                'Cache-Control': PER_CLIENT,
+                "Cache-Control": PER_CLIENT,
             }),
         });
     }
@@ -1022,8 +1106,8 @@ export function createRscHandler(options) {
         // A route that declares middleware and an engine that cannot run it is not
         // "no middleware" — it is a check that silently does not happen.
         if (!engine.runRouteMiddleware) {
-            return new Response('This route declares middleware, and the engine cannot run it. ' +
-                'Rebuild the app against the current @rsc-kit/core.', { status: 500 });
+            return new Response("This route declares middleware, and the engine cannot run it. " +
+                "Rebuild the app against the current @rsc-kit/core.", { status: 500 });
         }
         return await withRedirect(async (taken) => {
             try {
@@ -1034,9 +1118,9 @@ export function createRscHandler(options) {
                 // followed, so a client can decide for itself.
                 const redirected = taken();
                 if (redirected) {
-                    return new Response('Unauthorized', {
+                    return new Response("Unauthorized", {
                         status: 401,
-                        headers: { 'X-RSC-Redirect': redirected.location },
+                        headers: { "X-RSC-Redirect": redirected.location },
                     });
                 }
                 // A visitor who may not use this endpoint has not caused a server
@@ -1046,13 +1130,15 @@ export function createRscHandler(options) {
                 const status = refusalStatus(error);
                 if (status === null)
                     throw error;
-                return new Response(status === 401 ? 'Unauthorized' : 'Forbidden', { status });
+                return new Response(status === 401 ? "Unauthorized" : "Forbidden", {
+                    status,
+                });
             }
             const redirected = taken();
             if (redirected) {
-                return new Response('Unauthorized', {
+                return new Response("Unauthorized", {
                     status: 401,
-                    headers: { 'X-RSC-Redirect': redirected.location },
+                    headers: { "X-RSC-Redirect": redirected.location },
                 });
             }
             return null;
@@ -1069,64 +1155,73 @@ export function createRscHandler(options) {
         // and nothing here answers a preflight — the same protection a POST
         // carrying X-RSC-Action already had.
         if (!request.headers.get(HEADER.query)) {
-            return new Response('Missing ' + HEADER.query, { status: 400 });
+            return new Response("Missing " + HEADER.query, { status: 400 });
         }
-        const id = url.searchParams.get('id');
-        const args = url.searchParams.get('args');
+        const id = url.searchParams.get("id");
+        const args = url.searchParams.get("args");
         if (!id || args === null)
-            return new Response('Missing id or args', { status: 400 });
+            return new Response("Missing id or args", { status: 400 });
         // Enforced here as well as in the client, because the limit is what keeps
         // an attacker from making this endpoint decode megabytes of their payload
         // per request.
         if (url.search.length > MAX_QUERY)
-            return new Response('Query too large', { status: 414 });
+            return new Response("Query too large", { status: 414 });
         const answered = await engine.handleQuery(id, args);
         // Unknown id and registered-but-not-a-query are the same answer on purpose.
         if (!answered)
-            return new Response('No such query', { status: 404 });
+            return new Response("No such query", { status: 404 });
         // The read refused. Answered as a status with the message in the body, so
         // the fetcher rejects with something a person can read — a failure rendered
         // into a 200 would reach the browser as React's opaque error instead.
-        if (!('stream' in answered)) {
+        if (!("stream" in answered)) {
             return new Response(JSON.stringify({ message: answered.message, errors: answered.errors }), {
                 status: answered.status,
-                headers: withVersion({ 'Content-Type': 'application/json', 'Cache-Control': PER_CLIENT }),
+                headers: withVersion({
+                    "Content-Type": "application/json",
+                    "Cache-Control": PER_CLIENT,
+                }),
             });
         }
         return new Response(answered.stream, {
             headers: withVersion({
-                'Content-Type': FLIGHT_TYPE,
-                'Cache-Control': answered.cacheControl,
+                "Content-Type": FLIGHT_TYPE,
+                "Cache-Control": answered.cacheControl,
                 // The answer is narrowed by who is asking whenever a read touches the
                 // session, and the request that carries that is the cookie. Without
                 // this a shared cache keyed on the url alone hands one visitor
                 // another's answer — for any query that opted out of no-store.
-                Vary: 'Cookie, ' + HEADER.referer,
+                Vary: "Cookie, " + HEADER.referer,
             }),
         });
     }
     async function handleAction(request, url) {
         const actionId = request.headers.get(HEADER.action);
         if (!actionId)
-            return new Response('Missing X-RSC-Action', { status: 400 });
+            return new Response("Missing X-RSC-Action", { status: 400 });
         // The body travels as application/octet-stream so a host that parses
         // multipart cannot consume it first; its real type rides in a header.
         const body = await readBodyUpTo(request, maxActionBody);
         if (body === null) {
-            return new Response(`Action body over ${maxActionBody} bytes`, { status: 413 });
+            return new Response(`Action body over ${maxActionBody} bytes`, {
+                status: 413,
+            });
         }
-        const contentType = request.headers.get(HEADER.contentType) ?? 'text/plain;charset=UTF-8';
+        const contentType = request.headers.get(HEADER.contentType) ?? "text/plain;charset=UTF-8";
         // Where it was invoked from, so anything the action invalidates can be
         // re-rendered against the page that is actually on screen.
-        const from = refererPath(request.headers.get(HEADER.referer), url.origin);
+        const from = refererPath(request.headers.get(HEADER.referer), url.origin, siteHosts);
         const match = from ? matchRoute(routes, from) : null;
-        const page = match ? pageContext(match, await propsFor(match, request)) : undefined;
+        const page = match
+            ? pageContext(match, await propsFor(match, request))
+            : undefined;
         // Scoped to this action: revalidate() called anywhere inside it, at any
         // depth, marks here and nowhere else — two requests can be in flight and
         // marking is per-request state.
         const { stream } = await withRevalidation((taken) => engine.handleAction(actionId, body, contentType, page, taken));
         return new Response(stream, {
-            headers: withVersion({ 'Content-Type': 'text/x-component; charset=utf-8' }),
+            headers: withVersion({
+                "Content-Type": "text/x-component; charset=utf-8",
+            }),
         });
     }
 }