@rsc-kit/core 0.17.0 → 0.18.1

package/dist/hostCalls.js

@@ -16,17 +16,29 @@ import { ActionValidationError } from './action.js';
 import { redirect } from './redirect.js';
 import { ServerAuthenticationError, ServerAuthorizationError } from './js/errors.js';
 const DEFAULT_FORWARDED = ['cookie', 'authorization'];
+/** How many calls one POST carries at most. */
+const BATCH_LIMIT = 50;
+// After the current I/O, before the next timer: what a render issued
+// synchronously - and across the microtasks between one component's awaits -
+// is in the bucket by then. setImmediate where the runtime has it, a zero
+// timer where it does not (a Worker).
+const nextTick = typeof setImmediate === 'function' ? (fn) => setImmediate(fn) : (fn) => setTimeout(fn, 0);
 /**
  * The function to hand to `installHostFn`, or to `hostCalls` on the JS host.
  */
 export function httpHostCalls(options) {
-    const { endpoint, secret, forwardHeaders = DEFAULT_FORWARDED, timeoutMs = 30_000, fetch: fetchImpl, onRevalidate, } = options;
+    const { endpoint, secret, forwardHeaders = DEFAULT_FORWARDED, timeoutMs = 30_000, fetch: fetchImpl, onRevalidate, batch = true, } = options;
     if (!secret) {
         throw new Error('httpHostCalls requires a secret — see the note on the option.');
     }
     const forwarded = forwardHeaders.map((name) => name.toLowerCase());
-    return async function hostCall(name, ...args) {
-        const doFetch = fetchImpl ?? globalThis.fetch;
+    // Off for good the first time the host answers a batch as something else.
+    let batching = batch;
+    // One bucket per set of forwarded headers: two visitors' renders in flight
+    // at once must not share a request, because the host reads the cookie off
+    // the request to know whose session a call runs under.
+    const buckets = new Map();
+    async function forwardedHeaders() {
         const headers = {
             'content-type': 'application/json',
             'x-rsc-host-secret': secret,
@@ -54,6 +66,11 @@ export function httpHostCalls(options) {
             if (!message.startsWith('No request in scope'))
                 throw error;
         }
+        return headers;
+    }
+    /** One POST. `label` names what is being sent, for the error messages. */
+    async function post(body, headers, label) {
+        const doFetch = fetchImpl ?? globalThis.fetch;
         // AbortSignal.timeout is not on every runtime this engine targets, so the
         // controller is written out rather than assumed.
         const controller = new AbortController();
@@ -63,15 +80,15 @@ export function httpHostCalls(options) {
             response = await doFetch(endpoint, {
                 method: 'POST',
                 headers,
-                body: JSON.stringify({ function: name, args }),
+                body: JSON.stringify(body),
                 signal: controller.signal,
             });
         }
         catch (error) {
             if (controller.signal.aborted) {
-                throw new Error(`Host call ${JSON.stringify(name)} timed out after ${timeoutMs}ms`);
+                throw new Error(`Host call ${label} timed out after ${timeoutMs}ms`);
             }
-            throw new Error(`Host call ${JSON.stringify(name)} could not reach the host at ${endpoint}: ${error instanceof Error ? error.message : String(error)}`);
+            throw new Error(`Host call ${label} could not reach the host at ${endpoint}: ${error instanceof Error ? error.message : String(error)}`);
         }
         finally {
             clearTimeout(timer);
@@ -79,14 +96,105 @@ export function httpHostCalls(options) {
         // Read the body before branching on status: a host that reports the error
         // in JSON with a 500 is saying something more useful than "500", and
         // throwing on the status alone discards it.
-        const text = await response.text();
-        let reply = null;
+        return { status: response.status, text: await response.text() };
+    }
+    function parse(text) {
         try {
-            reply = text ? JSON.parse(text) : null;
+            return text ? JSON.parse(text) : null;
         }
         catch {
-            reply = null;
+            return null;
+        }
+    }
+    async function single(name, args, headers) {
+        const { status, text } = await post({ function: name, args }, headers, JSON.stringify(name));
+        return { status, reply: parse(text), text };
+    }
+    /**
+     * Send a bucket. One call goes as itself, so a host that speaks only the
+     * single shape - or a request that happened to be alone - sees nothing
+     * new on the wire.
+     */
+    async function flush(bucket) {
+        const { headers, calls } = bucket;
+        if (calls.length === 1) {
+            const [only] = calls;
+            try {
+                only.resolve(await single(only.name, only.args, headers));
+            }
+            catch (error) {
+                only.reject(error);
+            }
+            return;
+        }
+        const label = `batch of ${calls.length} (${calls.map((c) => c.name).join(', ')})`;
+        let status;
+        let text;
+        try {
+            ;
+            ({ status, text } = await post({ calls: calls.map((c) => ({ function: c.name, args: c.args })) }, headers, label));
         }
+        catch (error) {
+            // The host could not be reached, or did not answer in time. Not
+            // re-sent one by one: the calls may have run, and an action run twice
+            // is worse than one reported as failed.
+            for (const call of calls)
+                call.reject(error);
+            return;
+        }
+        const parsed = parse(text);
+        const replies = parsed?.replies;
+        if (status < 400 && Array.isArray(replies) && replies.length === calls.length) {
+            calls.forEach((call, i) => {
+                const { status: own, ...reply } = replies[i];
+                call.resolve({ status: own ?? 200, reply, text: JSON.stringify(reply) });
+            });
+            return;
+        }
+        // Not a batch answer: a host that does not know the envelope refused it
+        // as one malformed call, before running anything. From here on, one at a
+        // time - and these, now.
+        batching = false;
+        await Promise.all(calls.map(async (call) => {
+            try {
+                call.resolve(await single(call.name, call.args, headers));
+            }
+            catch (error) {
+                call.reject(error);
+            }
+        }));
+    }
+    function enqueue(name, args, headers) {
+        return new Promise((resolve, reject) => {
+            const key = JSON.stringify(headers);
+            let bucket = buckets.get(key);
+            if (!bucket) {
+                bucket = { headers, calls: [] };
+                buckets.set(key, bucket);
+                const mine = bucket;
+                nextTick(() => {
+                    if (buckets.get(key) === mine)
+                        buckets.delete(key);
+                    void flush(mine);
+                });
+            }
+            bucket.calls.push({ name, args, resolve, reject });
+            if (bucket.calls.length >= BATCH_LIMIT) {
+                buckets.delete(key);
+                void flush(bucket);
+            }
+        });
+    }
+    /**
+     * What a reply means, in the caller's own async context.
+     *
+     * Deliberately not done where the response arrives: a batch is answered in
+     * a timer, outside every caller's request scope, and `redirect()` and
+     * `revalidate()` both write to that scope. Interpreting here, after the
+     * caller's await resumed, puts each reply back inside the render it belongs
+     * to.
+     */
+    function interpret(name, { status, reply, text }) {
         // Refusing the input is not the call failing — it is the call answering.
         //
         // Thrown rather than returned, so a handler stops where it is instead of
@@ -124,8 +232,8 @@ export function httpHostCalls(options) {
             }
             throw failure;
         }
-        if (!response.ok) {
-            throw new Error(`Host call ${JSON.stringify(name)} failed: ${response.status} ${response.statusText}`.trim() +
+        if (status >= 400) {
+            throw new Error(`Host call ${JSON.stringify(name)} failed: ${status}`.trim() +
                 (text ? ` — ${text.slice(0, 200)}` : ''));
         }
         if (reply === null) {
@@ -134,11 +242,18 @@ export function httpHostCalls(options) {
         if (reply.revalidate?.length) {
             if (onRevalidate)
                 onRevalidate(reply.revalidate);
+            // Named by the host over the wire - Rsc::revalidate('orders') in PHP -
+            // so nothing here can check it; the renderer refuses an unknown name.
             else
                 for (const target of reply.revalidate)
                     revalidate(target);
         }
         return reply.result ?? null;
+    }
+    return async function hostCall(name, ...args) {
+        const headers = await forwardedHeaders();
+        const settled = batching ? await enqueue(name, args, headers) : await single(name, args, headers);
+        return interpret(name, settled);
     };
 }
 //# sourceMappingURL=hostCalls.js.map

package/dist/hostCalls.js.map

@@ -1 +1 @@
-{"version":3,"file":"hostCalls.js","sourceRoot":"","sources":["../src/hostCalls.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,uDAAuD;AACvD,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,4EAA4E;AAC5E,+DAA+D;AAE/D,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AA8CpF,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;AAyCrD;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,OAA6B;IAE7B,MAAM,EACJ,QAAQ,EACR,MAAM,EACN,cAAc,GAAG,iBAAiB,EAClC,SAAS,GAAG,MAAM,EAClB,KAAK,EAAE,SAAS,EAChB,YAAY,GACb,GAAG,OAAO,CAAA;IAEX,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;IAElE,OAAO,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,GAAG,IAAe;QAC7D,MAAM,OAAO,GAAG,SAAS,IAAI,UAAU,CAAC,KAAK,CAAA;QAE7C,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,mBAAmB,EAAE,MAAM;SAC5B,CAAA;QAED,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,mBAAmB;QACnB,EAAE;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,+BAA+B;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAA;YAGpC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBAC3B,IAAI,KAAK,KAAK,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YAC1C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAEtE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC;gBAAE,MAAM,KAAK,CAAA;QAC7D,CAAC;QAED,0EAA0E;QAC1E,iDAAiD;QACjD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAA;QAE7D,IAAI,QAAkB,CAAA;QAEtB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;gBACjC,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;gBAC9C,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,SAAS,IAAI,CAAC,CAAA;YACrF,CAAC;YAED,MAAM,IAAI,KAAK,CACb,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,gCAAgC,QAAQ,KACvE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,4CAA4C;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,KAAK,GAAyB,IAAI,CAAA;QAEtC,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC,CAAC,CAAC,IAAI,CAAA;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,IAAI,CAAA;QACd,CAAC;QAED,yEAAyE;QACzE,EAAE;QACF,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,0EAA0E;QAC1E,sEAAsE;QACtE,4CAA4C;QAC5C,EAAE;QACF,yEAAyE;QACzE,2CAA2C;QAC3C,IAAI,KAAK,EAAE,gBAAgB,EAAE,CAAC;YAC5B,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;QACzD,CAAC;QAED,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,IAAI,KAAK,EAAE,QAAQ,EAAE,CAAC;YACpB,QAAQ,CAAC,KAAK,CAAC,QAAiB,EAAE,KAAK,CAAC,cAAc,IAAI,GAAG,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,KAAK,EAAE,eAAe,EAAE,CAAC;YAC3B,MAAM,IAAI,yBAAyB,CAAC,KAAK,CAAC,KAAK,IAAI,kBAAkB,CAAC,CAAA;QACxE,CAAC;QAED,IAAI,KAAK,EAAE,YAAY,EAAE,CAAC;YACxB,MAAM,IAAI,wBAAwB,CAAC,KAAK,CAAC,KAAK,IAAI,8BAA8B,CAAC,CAAA;QACnF,CAAC;QAED,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;YAErF,qEAAqE;YACrE,uEAAuE;YACvE,+BAA+B;YAC/B,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,CAAC;gBAAC,OAA8C,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAA;YACtF,CAAC;YAED,MAAM,OAAO,CAAA;QACf,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE;gBAC1F,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC3C,CAAA;QACH,CAAC;QAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,sCAAsC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC5F,CAAA;QACH,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;YAC7B,IAAI,YAAY;gBAAE,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;;gBAC3C,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,UAAU;oBAAE,UAAU,CAAC,MAAM,CAAC,CAAA;QAChE,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,IAAI,IAAI,CAAA;IAC7B,CAAC,CAAA;AACH,CAAC","sourcesContent":["// Host calls over HTTP, so a host in any language can answer them.\n//\n// A server component writing `await rpc('Orders.recent')` needs the host\n// mid-render. The Laravel path answers on a second unix socket with its own\n// framing (PROTOCOL.md, \"The callback channel\"), which every non-JS host has\n// to reimplement before it can render a single page that fetches anything.\n// This is the same conversation over an ordinary POST.\n//\n// The transport is the only thing that changes. The engine still sees one\n// function, the deferred-release ordering in streaming.ts still applies, and a\n// reply may still carry `revalidate` — a Go host that answers this endpoint\n// gets the same semantics the socket has, without the framing.\n\nimport { headers as incomingHeaders } from './request.js'\nimport { revalidate } from './revalidate.js'\nimport { ActionValidationError } from './action.js'\nimport { redirect } from './redirect.js'\nimport { ServerAuthenticationError, ServerAuthorizationError } from './js/errors.js'\n\nexport interface HttpHostCallsOptions {\n  /**\n   * Where calls are POSTed. A loopback address or a unix socket url — see the\n   * note on `secret` for why this must not be a public one.\n   */\n  endpoint: string\n  /**\n   * Sent as `X-RSC-Host-Secret`, and required rather than optional.\n   *\n   * This endpoint runs functions by name on behalf of a render. PROTOCOL.md\n   * Part 3b draws the line at client-supplied input deciding what RUNS, and an\n   * unauthenticated callback endpoint is on the wrong side of it: anyone who\n   * can reach it can invoke any registered host function directly, with\n   * whatever arguments they like and none of the app's routing in front. A\n   * default of \"off\" would be the kind that ships.\n   */\n  secret: string\n  /**\n   * Request headers copied from the render's own request onto the call.\n   *\n   * This is what makes a host call run as the person browsing: the backend's\n   * session middleware reads its cookie and finds the same user. Nothing else\n   * is forwarded, because everything else is either meaningless to the backend\n   * or actively wrong — `content-length` and `content-type` describe this POST,\n   * not the page request.\n   */\n  forwardHeaders?: string[]\n  /** Defaults to 30s. A render blocked on a host that never answers is a hung request. */\n  timeoutMs?: number\n  /** Injectable for tests and for a runtime whose fetch is not global. */\n  fetch?: typeof fetch\n  /**\n   * What to do with whatever a reply reported as invalidated.\n   *\n   * Defaults to marking it on the engine, which is the only thing that makes\n   * `Revalidate(ctx, \"orders\")` on the host side mean anything: an action's\n   * answer carries the re-rendered region only if the target reached the\n   * revalidation scope before the action returned. Without it a host reports\n   * what it dirtied, nothing listens, and the browser is told nothing — the\n   * page simply shows stale data with no error anywhere.\n   */\n  onRevalidate?: (targets: string[]) => void\n}\n\nconst DEFAULT_FORWARDED = ['cookie', 'authorization']\n\nexport interface HostCallReply {\n  result?: unknown\n  error?: string\n  revalidate?: string[]\n  /**\n   * Field name to messages, when the host refused the input.\n   *\n   * The same shape everything else here already uses: Laravel's own\n   * `$e->errors()`, the socket protocol's `validation_errors`, and what\n   * `issuesToErrors` turns a Standard Schema result into. Dot-joined for a\n   * nested field, the empty string for a message about the form rather than\n   * any one field.\n   */\n  validationErrors?: Record<string, string[]>\n  /** The caller has no session. Becomes the engine's own authentication error. */\n  unauthenticated?: boolean\n  /** The caller has a session and still may not. */\n  unauthorized?: boolean\n  /**\n   * Where the host says this request should go instead.\n   *\n   * Answered with a 200 and this field, never as a 3xx: fetch follows a\n   * redirect transparently, so a real one would send the host call itself to\n   * the destination and hand whatever came back to the render as the\n   * function's result.\n   */\n  redirect?: string\n  /** The status to redirect with. Defaults to 307, which preserves the method. */\n  redirectStatus?: number\n  /**\n   * The status a refusal should be answered with.\n   *\n   * A middleware that aborted meant what it aborted with — throttle answers\n   * 429, a signed-url check 403 — and collapsing those to 500 makes a\n   * rate-limited visitor indistinguishable from a broken server.\n   */\n  refusalStatus?: number\n}\n\n/**\n * The function to hand to `installHostFn`, or to `hostCalls` on the JS host.\n */\nexport function httpHostCalls(\n  options: HttpHostCallsOptions,\n): (name: string, ...args: unknown[]) => Promise<unknown> {\n  const {\n    endpoint,\n    secret,\n    forwardHeaders = DEFAULT_FORWARDED,\n    timeoutMs = 30_000,\n    fetch: fetchImpl,\n    onRevalidate,\n  } = options\n\n  if (!secret) {\n    throw new Error('httpHostCalls requires a secret — see the note on the option.')\n  }\n\n  const forwarded = forwardHeaders.map((name) => name.toLowerCase())\n\n  return async function hostCall(name: string, ...args: unknown[]): Promise<unknown> {\n    const doFetch = fetchImpl ?? globalThis.fetch\n\n    const headers: Record<string, string> = {\n      'content-type': 'application/json',\n      'x-rsc-host-secret': secret,\n    }\n\n    // Outside a render — a prerender pass, or a host calling one directly —\n    // there is no request to forward from, and that is not an error. The call\n    // simply carries no session, which is exactly what a build-time render\n    // should be doing.\n    //\n    // Only that one condition is swallowed. A blanket catch here is the wrong\n    // shape: anything else going wrong while reading the request would come\n    // out as a call with no session, which is not a failure the caller sees —\n    // it is the visitor silently becoming anonymous, and the page rendering as\n    // though they were logged out.\n    try {\n      const from = await incomingHeaders()\n\n\n      for (const key of forwarded) {\n        const value = from.get(key)\n        if (value !== null) headers[key] = value\n      }\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error)\n\n      if (!message.startsWith('No request in scope')) throw error\n    }\n\n    // AbortSignal.timeout is not on every runtime this engine targets, so the\n    // controller is written out rather than assumed.\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n\n    let response: Response\n\n    try {\n      response = await doFetch(endpoint, {\n        method: 'POST',\n        headers,\n        body: JSON.stringify({ function: name, args }),\n        signal: controller.signal,\n      })\n    } catch (error) {\n      if (controller.signal.aborted) {\n        throw new Error(`Host call ${JSON.stringify(name)} timed out after ${timeoutMs}ms`)\n      }\n\n      throw new Error(\n        `Host call ${JSON.stringify(name)} could not reach the host at ${endpoint}: ${\n          error instanceof Error ? error.message : String(error)\n        }`,\n      )\n    } finally {\n      clearTimeout(timer)\n    }\n\n    // Read the body before branching on status: a host that reports the error\n    // in JSON with a 500 is saying something more useful than \"500\", and\n    // throwing on the status alone discards it.\n    const text = await response.text()\n    let reply: HostCallReply | null = null\n\n    try {\n      reply = text ? (JSON.parse(text) as HostCallReply) : null\n    } catch {\n      reply = null\n    }\n\n    // Refusing the input is not the call failing — it is the call answering.\n    //\n    // Thrown rather than returned, so a handler stops where it is instead of\n    // carrying on with data the host rejected. createActionClient catches this\n    // on the way out and returns { validationErrors }, which is the shape\n    // useForm reads: React serialises a REJECTED server action opaquely, so a\n    // validation error that stays thrown reaches the browser as \"an error\n    // occurred\" with every field it named gone.\n    //\n    // Checked before `error`, so a host that sends both is read as a refusal\n    // rather than as a failure with no fields.\n    if (reply?.validationErrors) {\n      throw new ActionValidationError(reply.validationErrors)\n    }\n\n    // Raised as the engine's own redirect, so it travels the path every other\n    // redirect travels — a real 3xx above a Suspense boundary, the digest\n    // below one — rather than becoming an error the page has to interpret.\n    if (reply?.redirect) {\n      redirect(reply.redirect as never, reply.redirectStatus ?? 307)\n    }\n\n    if (reply?.unauthenticated) {\n      throw new ServerAuthenticationError(reply.error ?? 'Unauthenticated.')\n    }\n\n    if (reply?.unauthorized) {\n      throw new ServerAuthorizationError(reply.error ?? 'This action is unauthorized.')\n    }\n\n    if (reply?.error !== undefined) {\n      const failure = new Error(`Host call ${JSON.stringify(name)} failed: ${reply.error}`)\n\n      // Carried on the error rather than thrown as another class: the host\n      // chose a status and the only job here is not to lose it on the way to\n      // whoever writes the response.\n      if (reply.refusalStatus) {\n        ;(failure as Error & { refusalStatus?: number }).refusalStatus = reply.refusalStatus\n      }\n\n      throw failure\n    }\n\n    if (!response.ok) {\n      throw new Error(\n        `Host call ${JSON.stringify(name)} failed: ${response.status} ${response.statusText}`.trim() +\n          (text ? ` — ${text.slice(0, 200)}` : ''),\n      )\n    }\n\n    if (reply === null) {\n      throw new Error(\n        `Host call ${JSON.stringify(name)} returned a body that is not JSON: ${text.slice(0, 200)}`,\n      )\n    }\n\n    if (reply.revalidate?.length) {\n      if (onRevalidate) onRevalidate(reply.revalidate)\n      else for (const target of reply.revalidate) revalidate(target)\n    }\n\n    return reply.result ?? null\n  }\n}\n"]}
+{"version":3,"file":"hostCalls.js","sourceRoot":"","sources":["../src/hostCalls.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,uDAAuD;AACvD,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,4EAA4E;AAC5E,+DAA+D;AAE/D,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAE5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAoDpF,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;AA2DrD,+CAA+C;AAC/C,MAAM,WAAW,GAAG,EAAE,CAAA;AAgBtB,qEAAqE;AACrE,6EAA6E;AAC7E,0EAA0E;AAC1E,sCAAsC;AACtC,MAAM,QAAQ,GACZ,OAAO,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AAE3F;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,OAA6B;IAE7B,MAAM,EACJ,QAAQ,EACR,MAAM,EACN,cAAc,GAAG,iBAAiB,EAClC,SAAS,GAAG,MAAM,EAClB,KAAK,EAAE,SAAS,EAChB,YAAY,EACZ,KAAK,GAAG,IAAI,GACb,GAAG,OAAO,CAAA;IAEX,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;IAElE,0EAA0E;IAC1E,IAAI,QAAQ,GAAG,KAAK,CAAA;IAEpB,2EAA2E;IAC3E,0EAA0E;IAC1E,uDAAuD;IACvD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IAEzC,KAAK,UAAU,gBAAgB;QAC7B,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,mBAAmB,EAAE,MAAM;SAC5B,CAAA;QAED,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,mBAAmB;QACnB,EAAE;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,+BAA+B;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAA;YAEpC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBAC3B,IAAI,KAAK,KAAK,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YAC1C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAEtE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC;gBAAE,MAAM,KAAK,CAAA;QAC7D,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,0EAA0E;IAC1E,KAAK,UAAU,IAAI,CACjB,IAAa,EACb,OAA+B,EAC/B,KAAa;QAEb,MAAM,OAAO,GAAG,SAAS,IAAI,UAAU,CAAC,KAAK,CAAA;QAE7C,0EAA0E;QAC1E,iDAAiD;QACjD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAA;QAE7D,IAAI,QAAkB,CAAA;QAEtB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;gBACjC,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,oBAAoB,SAAS,IAAI,CAAC,CAAA;YACtE,CAAC;YAED,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,gCAAgC,QAAQ,KACxD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,4CAA4C;QAC5C,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAA;IACjE,CAAC;IAED,SAAS,KAAK,CAAC,IAAY;QACzB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,IAAe,EAAE,OAA+B;QAClF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QAE5F,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAA;IAC7C,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,KAAK,CAAC,MAAc;QACjC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,CAAA;QAEjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;YAEpB,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACpB,CAAC;YAED,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;QACjF,IAAI,MAAc,CAAA;QAClB,IAAI,IAAY,CAAA;QAEhB,IAAI,CAAC;YACH,CAAC;YAAA,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAC7B,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAA0B,EACzF,OAAO,EACP,KAAK,CACN,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gEAAgE;YAChE,sEAAsE;YACtE,wCAAwC;YACxC,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAE5C,OAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAuC,CAAA;QAChE,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,CAAA;QAE/B,IAAI,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC9E,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;gBACxB,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC,CAAC,CAAE,CAAA;gBAE7C,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC1E,CAAC,CAAC,CAAA;YAEF,OAAM;QACR,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,yBAAyB;QACzB,QAAQ,GAAG,KAAK,CAAA;QAEhB,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACvB,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACpB,CAAC;QACH,CAAC,CAAC,CACH,CAAA;IACH,CAAC;IAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAe,EAAE,OAA+B;QAC7E,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;YACnC,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAE7B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;gBAC/B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;gBAExB,MAAM,IAAI,GAAG,MAAM,CAAA;gBAEnB,QAAQ,CAAC,GAAG,EAAE;oBACZ,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI;wBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;oBAElD,KAAK,KAAK,CAAC,IAAI,CAAC,CAAA;gBAClB,CAAC,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;YAElD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;gBACvC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAEnB,KAAK,KAAK,CAAC,MAAM,CAAC,CAAA;YACpB,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,SAAS,SAAS,CAAC,IAAY,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAW;QAC/D,yEAAyE;QACzE,EAAE;QACF,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,0EAA0E;QAC1E,sEAAsE;QACtE,4CAA4C;QAC5C,EAAE;QACF,yEAAyE;QACzE,2CAA2C;QAC3C,IAAI,KAAK,EAAE,gBAAgB,EAAE,CAAC;YAC5B,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;QACzD,CAAC;QAED,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,IAAI,KAAK,EAAE,QAAQ,EAAE,CAAC;YACpB,QAAQ,CAAC,KAAK,CAAC,QAAiB,EAAE,KAAK,CAAC,cAAc,IAAI,GAAG,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,KAAK,EAAE,eAAe,EAAE,CAAC;YAC3B,MAAM,IAAI,yBAAyB,CAAC,KAAK,CAAC,KAAK,IAAI,kBAAkB,CAAC,CAAA;QACxE,CAAC;QAED,IAAI,KAAK,EAAE,YAAY,EAAE,CAAC;YACxB,MAAM,IAAI,wBAAwB,CAAC,KAAK,CAAC,KAAK,IAAI,8BAA8B,CAAC,CAAA;QACnF,CAAC;QAED,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;YAErF,qEAAqE;YACrE,uEAAuE;YACvE,+BAA+B;YAC/B,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,CAAC;gBAAC,OAA8C,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAA;YACtF,CAAC;YAED,MAAM,OAAO,CAAA;QACf,CAAC;QAED,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,MAAM,EAAE,CAAC,IAAI,EAAE;gBAC1D,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC3C,CAAA;QACH,CAAC;QAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,sCAAsC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC5F,CAAA;QACH,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;YAC7B,IAAI,YAAY;gBAAE,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;YAChD,uEAAuE;YACvE,sEAAsE;;gBACjE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,UAAU;oBAAE,UAAU,CAAC,MAA0B,CAAC,CAAA;QACpF,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,IAAI,IAAI,CAAA;IAC7B,CAAC;IAED,OAAO,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,GAAG,IAAe;QAC7D,MAAM,OAAO,GAAG,MAAM,gBAAgB,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAEjG,OAAO,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC,CAAA;AACH,CAAC","sourcesContent":["// Host calls over HTTP, so a host in any language can answer them.\n//\n// A server component writing `await rpc('Orders.recent')` needs the host\n// mid-render. The Laravel path answers on a second unix socket with its own\n// framing (PROTOCOL.md, \"The callback channel\"), which every non-JS host has\n// to reimplement before it can render a single page that fetches anything.\n// This is the same conversation over an ordinary POST.\n//\n// The transport is the only thing that changes. The engine still sees one\n// function, the deferred-release ordering in streaming.ts still applies, and a\n// reply may still carry `revalidate` — a Go host that answers this endpoint\n// gets the same semantics the socket has, without the framing.\n\nimport { headers as incomingHeaders } from './request.js'\nimport { revalidate } from './revalidate.js'\nimport type { RevalidateTarget } from './routes.js'\nimport { ActionValidationError } from './action.js'\nimport { redirect } from './redirect.js'\nimport { ServerAuthenticationError, ServerAuthorizationError } from './js/errors.js'\n\nexport interface HttpHostCallsOptions {\n  /**\n   * Where calls are POSTed. A loopback address or a unix socket url — see the\n   * note on `secret` for why this must not be a public one.\n   */\n  endpoint: string\n  /**\n   * Sent as `X-RSC-Host-Secret`, and required rather than optional.\n   *\n   * This endpoint runs functions by name on behalf of a render. PROTOCOL.md\n   * Part 3b draws the line at client-supplied input deciding what RUNS, and an\n   * unauthenticated callback endpoint is on the wrong side of it: anyone who\n   * can reach it can invoke any registered host function directly, with\n   * whatever arguments they like and none of the app's routing in front. A\n   * default of \"off\" would be the kind that ships.\n   */\n  secret: string\n  /**\n   * Request headers copied from the render's own request onto the call.\n   *\n   * This is what makes a host call run as the person browsing: the backend's\n   * session middleware reads its cookie and finds the same user. Nothing else\n   * is forwarded, because everything else is either meaningless to the backend\n   * or actively wrong — `content-length` and `content-type` describe this POST,\n   * not the page request.\n   */\n  forwardHeaders?: string[]\n  /** Defaults to 30s. A render blocked on a host that never answers is a hung request. */\n  timeoutMs?: number\n  /** Injectable for tests and for a runtime whose fetch is not global. */\n  fetch?: typeof fetch\n  /**\n   * What to do with whatever a reply reported as invalidated.\n   *\n   * Defaults to marking it on the engine, which is the only thing that makes\n   * `Revalidate(ctx, \"orders\")` on the host side mean anything: an action's\n   * answer carries the re-rendered region only if the target reached the\n   * revalidation scope before the action returned. Without it a host reports\n   * what it dirtied, nothing listens, and the browser is told nothing — the\n   * page simply shows stale data with no error anywhere.\n   */\n  onRevalidate?: (targets: string[]) => void\n  /**\n   * Send calls issued in the same tick as one POST. On by default; a host\n   * that does not understand the envelope is detected on the first batch and\n   * sent single calls from then on. `false` never batches.\n   */\n  batch?: boolean\n}\n\nconst DEFAULT_FORWARDED = ['cookie', 'authorization']\n\nexport interface HostCallReply {\n  result?: unknown\n  error?: string\n  revalidate?: string[]\n  /**\n   * Field name to messages, when the host refused the input.\n   *\n   * The same shape everything else here already uses: Laravel's own\n   * `$e->errors()`, the socket protocol's `validation_errors`, and what\n   * `issuesToErrors` turns a Standard Schema result into. Dot-joined for a\n   * nested field, the empty string for a message about the form rather than\n   * any one field.\n   */\n  validationErrors?: Record<string, string[]>\n  /** The caller has no session. Becomes the engine's own authentication error. */\n  unauthenticated?: boolean\n  /** The caller has a session and still may not. */\n  unauthorized?: boolean\n  /**\n   * Where the host says this request should go instead.\n   *\n   * Answered with a 200 and this field, never as a 3xx: fetch follows a\n   * redirect transparently, so a real one would send the host call itself to\n   * the destination and hand whatever came back to the render as the\n   * function's result.\n   */\n  redirect?: string\n  /** The status to redirect with. Defaults to 307, which preserves the method. */\n  redirectStatus?: number\n  /**\n   * The status a refusal should be answered with.\n   *\n   * A middleware that aborted meant what it aborted with — throttle answers\n   * 429, a signed-url check 403 — and collapsing those to 500 makes a\n   * rate-limited visitor indistinguishable from a broken server.\n   */\n  refusalStatus?: number\n}\n\n/**\n * A batch on the wire: several calls in one POST, answered in order.\n *\n * Calls issued in the same tick of a render - sibling components each\n * awaiting rpc() - travel together, so a page's parallel reads cost the host\n * one request rather than one each. A host that has never heard of the\n * envelope answers it as a malformed single call, and the calls are sent one\n * at a time from then on; nothing is lost but the saving.\n */\nexport interface HostCallBatch {\n  calls: { function: string; args: unknown[] }[]\n}\n\nexport interface HostCallBatchReply {\n  /** One per call, in order. Each carries the status that call would have had. */\n  replies: (HostCallReply & { status?: number })[]\n}\n\n/** How many calls one POST carries at most. */\nconst BATCH_LIMIT = 50\n\ntype Settled = { status: number; reply: HostCallReply | null; text: string }\n\ninterface Pending {\n  name: string\n  args: unknown[]\n  resolve: (settled: Settled) => void\n  reject: (error: unknown) => void\n}\n\ninterface Bucket {\n  headers: Record<string, string>\n  calls: Pending[]\n}\n\n// After the current I/O, before the next timer: what a render issued\n// synchronously - and across the microtasks between one component's awaits -\n// is in the bucket by then. setImmediate where the runtime has it, a zero\n// timer where it does not (a Worker).\nconst nextTick: (fn: () => void) => void =\n  typeof setImmediate === 'function' ? (fn) => setImmediate(fn) : (fn) => setTimeout(fn, 0)\n\n/**\n * The function to hand to `installHostFn`, or to `hostCalls` on the JS host.\n */\nexport function httpHostCalls(\n  options: HttpHostCallsOptions,\n): (name: string, ...args: unknown[]) => Promise<unknown> {\n  const {\n    endpoint,\n    secret,\n    forwardHeaders = DEFAULT_FORWARDED,\n    timeoutMs = 30_000,\n    fetch: fetchImpl,\n    onRevalidate,\n    batch = true,\n  } = options\n\n  if (!secret) {\n    throw new Error('httpHostCalls requires a secret — see the note on the option.')\n  }\n\n  const forwarded = forwardHeaders.map((name) => name.toLowerCase())\n\n  // Off for good the first time the host answers a batch as something else.\n  let batching = batch\n\n  // One bucket per set of forwarded headers: two visitors' renders in flight\n  // at once must not share a request, because the host reads the cookie off\n  // the request to know whose session a call runs under.\n  const buckets = new Map<string, Bucket>()\n\n  async function forwardedHeaders(): Promise<Record<string, string>> {\n    const headers: Record<string, string> = {\n      'content-type': 'application/json',\n      'x-rsc-host-secret': secret,\n    }\n\n    // Outside a render — a prerender pass, or a host calling one directly —\n    // there is no request to forward from, and that is not an error. The call\n    // simply carries no session, which is exactly what a build-time render\n    // should be doing.\n    //\n    // Only that one condition is swallowed. A blanket catch here is the wrong\n    // shape: anything else going wrong while reading the request would come\n    // out as a call with no session, which is not a failure the caller sees —\n    // it is the visitor silently becoming anonymous, and the page rendering as\n    // though they were logged out.\n    try {\n      const from = await incomingHeaders()\n\n      for (const key of forwarded) {\n        const value = from.get(key)\n        if (value !== null) headers[key] = value\n      }\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error)\n\n      if (!message.startsWith('No request in scope')) throw error\n    }\n\n    return headers\n  }\n\n  /** One POST. `label` names what is being sent, for the error messages. */\n  async function post(\n    body: unknown,\n    headers: Record<string, string>,\n    label: string,\n  ): Promise<{ status: number; text: string }> {\n    const doFetch = fetchImpl ?? globalThis.fetch\n\n    // AbortSignal.timeout is not on every runtime this engine targets, so the\n    // controller is written out rather than assumed.\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n\n    let response: Response\n\n    try {\n      response = await doFetch(endpoint, {\n        method: 'POST',\n        headers,\n        body: JSON.stringify(body),\n        signal: controller.signal,\n      })\n    } catch (error) {\n      if (controller.signal.aborted) {\n        throw new Error(`Host call ${label} timed out after ${timeoutMs}ms`)\n      }\n\n      throw new Error(\n        `Host call ${label} could not reach the host at ${endpoint}: ${\n          error instanceof Error ? error.message : String(error)\n        }`,\n      )\n    } finally {\n      clearTimeout(timer)\n    }\n\n    // Read the body before branching on status: a host that reports the error\n    // in JSON with a 500 is saying something more useful than \"500\", and\n    // throwing on the status alone discards it.\n    return { status: response.status, text: await response.text() }\n  }\n\n  function parse(text: string): HostCallReply | null {\n    try {\n      return text ? (JSON.parse(text) as HostCallReply) : null\n    } catch {\n      return null\n    }\n  }\n\n  async function single(name: string, args: unknown[], headers: Record<string, string>): Promise<Settled> {\n    const { status, text } = await post({ function: name, args }, headers, JSON.stringify(name))\n\n    return { status, reply: parse(text), text }\n  }\n\n  /**\n   * Send a bucket. One call goes as itself, so a host that speaks only the\n   * single shape - or a request that happened to be alone - sees nothing\n   * new on the wire.\n   */\n  async function flush(bucket: Bucket): Promise<void> {\n    const { headers, calls } = bucket\n\n    if (calls.length === 1) {\n      const [only] = calls\n\n      try {\n        only.resolve(await single(only.name, only.args, headers))\n      } catch (error) {\n        only.reject(error)\n      }\n\n      return\n    }\n\n    const label = `batch of ${calls.length} (${calls.map((c) => c.name).join(', ')})`\n    let status: number\n    let text: string\n\n    try {\n      ;({ status, text } = await post(\n        { calls: calls.map((c) => ({ function: c.name, args: c.args })) } satisfies HostCallBatch,\n        headers,\n        label,\n      ))\n    } catch (error) {\n      // The host could not be reached, or did not answer in time. Not\n      // re-sent one by one: the calls may have run, and an action run twice\n      // is worse than one reported as failed.\n      for (const call of calls) call.reject(error)\n\n      return\n    }\n\n    const parsed = parse(text) as Partial<HostCallBatchReply> | null\n    const replies = parsed?.replies\n\n    if (status < 400 && Array.isArray(replies) && replies.length === calls.length) {\n      calls.forEach((call, i) => {\n        const { status: own, ...reply } = replies[i]!\n\n        call.resolve({ status: own ?? 200, reply, text: JSON.stringify(reply) })\n      })\n\n      return\n    }\n\n    // Not a batch answer: a host that does not know the envelope refused it\n    // as one malformed call, before running anything. From here on, one at a\n    // time - and these, now.\n    batching = false\n\n    await Promise.all(\n      calls.map(async (call) => {\n        try {\n          call.resolve(await single(call.name, call.args, headers))\n        } catch (error) {\n          call.reject(error)\n        }\n      }),\n    )\n  }\n\n  function enqueue(name: string, args: unknown[], headers: Record<string, string>): Promise<Settled> {\n    return new Promise<Settled>((resolve, reject) => {\n      const key = JSON.stringify(headers)\n      let bucket = buckets.get(key)\n\n      if (!bucket) {\n        bucket = { headers, calls: [] }\n        buckets.set(key, bucket)\n\n        const mine = bucket\n\n        nextTick(() => {\n          if (buckets.get(key) === mine) buckets.delete(key)\n\n          void flush(mine)\n        })\n      }\n\n      bucket.calls.push({ name, args, resolve, reject })\n\n      if (bucket.calls.length >= BATCH_LIMIT) {\n        buckets.delete(key)\n\n        void flush(bucket)\n      }\n    })\n  }\n\n  /**\n   * What a reply means, in the caller's own async context.\n   *\n   * Deliberately not done where the response arrives: a batch is answered in\n   * a timer, outside every caller's request scope, and `redirect()` and\n   * `revalidate()` both write to that scope. Interpreting here, after the\n   * caller's await resumed, puts each reply back inside the render it belongs\n   * to.\n   */\n  function interpret(name: string, { status, reply, text }: Settled): unknown {\n    // Refusing the input is not the call failing — it is the call answering.\n    //\n    // Thrown rather than returned, so a handler stops where it is instead of\n    // carrying on with data the host rejected. createActionClient catches this\n    // on the way out and returns { validationErrors }, which is the shape\n    // useForm reads: React serialises a REJECTED server action opaquely, so a\n    // validation error that stays thrown reaches the browser as \"an error\n    // occurred\" with every field it named gone.\n    //\n    // Checked before `error`, so a host that sends both is read as a refusal\n    // rather than as a failure with no fields.\n    if (reply?.validationErrors) {\n      throw new ActionValidationError(reply.validationErrors)\n    }\n\n    // Raised as the engine's own redirect, so it travels the path every other\n    // redirect travels — a real 3xx above a Suspense boundary, the digest\n    // below one — rather than becoming an error the page has to interpret.\n    if (reply?.redirect) {\n      redirect(reply.redirect as never, reply.redirectStatus ?? 307)\n    }\n\n    if (reply?.unauthenticated) {\n      throw new ServerAuthenticationError(reply.error ?? 'Unauthenticated.')\n    }\n\n    if (reply?.unauthorized) {\n      throw new ServerAuthorizationError(reply.error ?? 'This action is unauthorized.')\n    }\n\n    if (reply?.error !== undefined) {\n      const failure = new Error(`Host call ${JSON.stringify(name)} failed: ${reply.error}`)\n\n      // Carried on the error rather than thrown as another class: the host\n      // chose a status and the only job here is not to lose it on the way to\n      // whoever writes the response.\n      if (reply.refusalStatus) {\n        ;(failure as Error & { refusalStatus?: number }).refusalStatus = reply.refusalStatus\n      }\n\n      throw failure\n    }\n\n    if (status >= 400) {\n      throw new Error(\n        `Host call ${JSON.stringify(name)} failed: ${status}`.trim() +\n          (text ? ` — ${text.slice(0, 200)}` : ''),\n      )\n    }\n\n    if (reply === null) {\n      throw new Error(\n        `Host call ${JSON.stringify(name)} returned a body that is not JSON: ${text.slice(0, 200)}`,\n      )\n    }\n\n    if (reply.revalidate?.length) {\n      if (onRevalidate) onRevalidate(reply.revalidate)\n      // Named by the host over the wire - Rsc::revalidate('orders') in PHP -\n      // so nothing here can check it; the renderer refuses an unknown name.\n      else for (const target of reply.revalidate) revalidate(target as RevalidateTarget)\n    }\n\n    return reply.result ?? null\n  }\n\n  return async function hostCall(name: string, ...args: unknown[]): Promise<unknown> {\n    const headers = await forwardedHeaders()\n    const settled = batching ? await enqueue(name, args, headers) : await single(name, args, headers)\n\n    return interpret(name, settled)\n  }\n}\n"]}

package/dist/hostRouting.d.ts

@@ -0,0 +1,53 @@
+/**
+ * A host as a route segment.
+ *
+ * A request's host is matched the way Next matches one after a middleware
+ * rewrite: prepended to the path. The difference is that the build can see
+ * it. `admin.example.com/users` matches `app/admin/users/page.tsx`, the
+ * same file `example.com/admin/users` reaches by path; `acme.example.com/`
+ * matches `app/[domain]/page.tsx` with `domain = "acme"`; a custom domain,
+ * `acme.com/`, matches the same file with `domain = "acme.com"`.
+ *
+ * What is prepended:
+ *   - nothing, for the site's own hosts (metadataBase, `www.` of it, and any
+ *     `hosts` named in rscKit()) - the apex keeps path routing, so an app
+ *     adds tenants without moving a file;
+ *   - the subdomain, for a host under an own one: `admin.example.com` ->
+ *     `admin`, `a.b.example.com` -> `a.b`;
+ *   - the whole host otherwise: `acme.com` -> `acme.com`.
+ *
+ * Off entirely when the build knows no own host: every request is then the
+ * site's own, and nothing here changes a path.
+ *
+ * Pure, and the same function in the browser: a link to `/settings` on
+ * `acme.example.com` is matched as `/acme/settings` on both sides, so the
+ * payload the client asks for is the one the server would render.
+ */
+/** The host without a port, lower-cased; the form every comparison uses. */
+export declare function bareHost(host: string | null | undefined): string;
+/**
+ * The segment a host contributes, or null for the site's own host.
+ * `own` is the build's list, already bare and lower-case.
+ */
+export declare function hostSegment(host: string | null | undefined, own: readonly string[]): string | null;
+/** The pathname to match, with the host's segment in front when it has one. */
+export declare function hostPath(host: string | null | undefined, pathname: string, own: readonly string[]): string;
+/**
+ * The site's own hosts, from what the build was told. `www.` of each is
+ * included, so `www.example.com` is never a tenant called `www`.
+ */
+export declare function ownHosts(metadataBase: string | URL | null | undefined, hosts?: readonly string[]): string[];
+/**
+ * Whether a host's segment is one some route can begin with: a host segment
+ * ([domain] at the top of app/), or a static directory of that name. Without
+ * one, the host is treated as the site's own - so an app that declares a
+ * metadataBase and has no tenant tree routes every host by path, and a
+ * proxy that forwards to the app by an internal name is not turned into a
+ * tenant called "internal".
+ */
+export declare function routableHost(segment: string, routes: readonly {
+    segments: readonly {
+        type: string;
+        value: string;
+    }[];
+}[]): boolean;

package/dist/hostRouting.js

@@ -0,0 +1,100 @@
+/**
+ * A host as a route segment.
+ *
+ * A request's host is matched the way Next matches one after a middleware
+ * rewrite: prepended to the path. The difference is that the build can see
+ * it. `admin.example.com/users` matches `app/admin/users/page.tsx`, the
+ * same file `example.com/admin/users` reaches by path; `acme.example.com/`
+ * matches `app/[domain]/page.tsx` with `domain = "acme"`; a custom domain,
+ * `acme.com/`, matches the same file with `domain = "acme.com"`.
+ *
+ * What is prepended:
+ *   - nothing, for the site's own hosts (metadataBase, `www.` of it, and any
+ *     `hosts` named in rscKit()) - the apex keeps path routing, so an app
+ *     adds tenants without moving a file;
+ *   - the subdomain, for a host under an own one: `admin.example.com` ->
+ *     `admin`, `a.b.example.com` -> `a.b`;
+ *   - the whole host otherwise: `acme.com` -> `acme.com`.
+ *
+ * Off entirely when the build knows no own host: every request is then the
+ * site's own, and nothing here changes a path.
+ *
+ * Pure, and the same function in the browser: a link to `/settings` on
+ * `acme.example.com` is matched as `/acme/settings` on both sides, so the
+ * payload the client asks for is the one the server would render.
+ */
+/** The host without a port, lower-cased; the form every comparison uses. */
+export function bareHost(host) {
+    return (host ?? "").split(":")[0].toLowerCase();
+}
+/**
+ * The segment a host contributes, or null for the site's own host.
+ * `own` is the build's list, already bare and lower-case.
+ */
+export function hostSegment(host, own) {
+    const bare = bareHost(host);
+    if (!bare || own.length === 0)
+        return null;
+    if (own.includes(bare))
+        return null;
+    if (bare === "localhost" || /^[\d.]+$/.test(bare) || bare.startsWith("["))
+        return null;
+    for (const site of own) {
+        if (bare.endsWith("." + site)) {
+            const sub = bare.slice(0, -(site.length + 1));
+            return sub === "www" ? null : sub;
+        }
+    }
+    return bare;
+}
+/** The pathname to match, with the host's segment in front when it has one. */
+export function hostPath(host, pathname, own) {
+    const segment = hostSegment(host, own);
+    if (segment === null)
+        return pathname;
+    const rest = pathname === "/" ? "" : pathname;
+    return "/" + segment + rest;
+}
+/**
+ * The site's own hosts, from what the build was told. `www.` of each is
+ * included, so `www.example.com` is never a tenant called `www`.
+ */
+export function ownHosts(metadataBase, hosts = []) {
+    const out = new Set();
+    if (metadataBase) {
+        try {
+            out.add(bareHost(new URL(String(metadataBase)).host));
+        }
+        catch {
+            // Not a url the build could read; the option is checked elsewhere.
+        }
+    }
+    for (const host of hosts)
+        out.add(bareHost(host));
+    for (const host of [...out]) {
+        if (!host.startsWith("www."))
+            out.add("www." + host);
+    }
+    return [...out].filter(Boolean).sort();
+}
+/**
+ * Whether a host's segment is one some route can begin with: a host segment
+ * ([domain] at the top of app/), or a static directory of that name. Without
+ * one, the host is treated as the site's own - so an app that declares a
+ * metadataBase and has no tenant tree routes every host by path, and a
+ * proxy that forwards to the app by an internal name is not turned into a
+ * tenant called "internal".
+ */
+export function routableHost(segment, routes) {
+    for (const route of routes) {
+        const first = route.segments[0];
+        if (!first)
+            continue;
+        if (first.type === "host")
+            return true;
+        if (first.type === "static" && first.value === segment)
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=hostRouting.js.map

package/dist/hostRouting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostRouting.js","sourceRoot":"","sources":["../src/hostRouting.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,IAA+B;IACtD,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,IAA+B,EAC/B,GAAsB;IAEtB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE5B,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,IAAI,KAAK,WAAW,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACvE,OAAO,IAAI,CAAC;IAEd,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;YAE9C,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,QAAQ,CACtB,IAA+B,EAC/B,QAAgB,EAChB,GAAsB;IAEtB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEvC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAEtC,MAAM,IAAI,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IAE9C,OAAO,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CACtB,YAA6C,EAC7C,KAAK,GAAsB,EAAE;IAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9B,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAElD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,MAA2E;IAE3E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAEhC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;IACtE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["/**\n * A host as a route segment.\n *\n * A request's host is matched the way Next matches one after a middleware\n * rewrite: prepended to the path. The difference is that the build can see\n * it. `admin.example.com/users` matches `app/admin/users/page.tsx`, the\n * same file `example.com/admin/users` reaches by path; `acme.example.com/`\n * matches `app/[domain]/page.tsx` with `domain = \"acme\"`; a custom domain,\n * `acme.com/`, matches the same file with `domain = \"acme.com\"`.\n *\n * What is prepended:\n *   - nothing, for the site's own hosts (metadataBase, `www.` of it, and any\n *     `hosts` named in rscKit()) - the apex keeps path routing, so an app\n *     adds tenants without moving a file;\n *   - the subdomain, for a host under an own one: `admin.example.com` ->\n *     `admin`, `a.b.example.com` -> `a.b`;\n *   - the whole host otherwise: `acme.com` -> `acme.com`.\n *\n * Off entirely when the build knows no own host: every request is then the\n * site's own, and nothing here changes a path.\n *\n * Pure, and the same function in the browser: a link to `/settings` on\n * `acme.example.com` is matched as `/acme/settings` on both sides, so the\n * payload the client asks for is the one the server would render.\n */\n\n/** The host without a port, lower-cased; the form every comparison uses. */\nexport function bareHost(host: string | null | undefined): string {\n  return (host ?? \"\").split(\":\")[0].toLowerCase();\n}\n\n/**\n * The segment a host contributes, or null for the site's own host.\n * `own` is the build's list, already bare and lower-case.\n */\nexport function hostSegment(\n  host: string | null | undefined,\n  own: readonly string[],\n): string | null {\n  const bare = bareHost(host);\n\n  if (!bare || own.length === 0) return null;\n  if (own.includes(bare)) return null;\n  if (bare === \"localhost\" || /^[\\d.]+$/.test(bare) || bare.startsWith(\"[\"))\n    return null;\n\n  for (const site of own) {\n    if (bare.endsWith(\".\" + site)) {\n      const sub = bare.slice(0, -(site.length + 1));\n\n      return sub === \"www\" ? null : sub;\n    }\n  }\n\n  return bare;\n}\n\n/** The pathname to match, with the host's segment in front when it has one. */\nexport function hostPath(\n  host: string | null | undefined,\n  pathname: string,\n  own: readonly string[],\n): string {\n  const segment = hostSegment(host, own);\n\n  if (segment === null) return pathname;\n\n  const rest = pathname === \"/\" ? \"\" : pathname;\n\n  return \"/\" + segment + rest;\n}\n\n/**\n * The site's own hosts, from what the build was told. `www.` of each is\n * included, so `www.example.com` is never a tenant called `www`.\n */\nexport function ownHosts(\n  metadataBase: string | URL | null | undefined,\n  hosts: readonly string[] = [],\n): string[] {\n  const out = new Set<string>();\n\n  if (metadataBase) {\n    try {\n      out.add(bareHost(new URL(String(metadataBase)).host));\n    } catch {\n      // Not a url the build could read; the option is checked elsewhere.\n    }\n  }\n\n  for (const host of hosts) out.add(bareHost(host));\n\n  for (const host of [...out]) {\n    if (!host.startsWith(\"www.\")) out.add(\"www.\" + host);\n  }\n\n  return [...out].filter(Boolean).sort();\n}\n\n/**\n * Whether a host's segment is one some route can begin with: a host segment\n * ([domain] at the top of app/), or a static directory of that name. Without\n * one, the host is treated as the site's own - so an app that declares a\n * metadataBase and has no tenant tree routes every host by path, and a\n * proxy that forwards to the app by an internal name is not turned into a\n * tenant called \"internal\".\n */\nexport function routableHost(\n  segment: string,\n  routes: readonly { segments: readonly { type: string; value: string }[] }[],\n): boolean {\n  for (const route of routes) {\n    const first = route.segments[0];\n\n    if (!first) continue;\n    if (first.type === \"host\") return true;\n    if (first.type === \"static\" && first.value === segment) return true;\n  }\n\n  return false;\n}\n"]}

package/dist/js/DefaultRouteError.d.ts

@@ -0,0 +1,3 @@
+import { type ReactNode } from "react";
+import type { RouteErrorProps } from "./RouteErrorBoundary";
+export declare function DefaultRouteError({ error, reset, }: RouteErrorProps): ReactNode;

package/dist/js/DefaultRouteError.js

@@ -0,0 +1,61 @@
+"use client";
+// What a page that throws shows when no error.tsx covers it.
+//
+// Without this, nothing did: the Flight row failed, the browser rethrew on
+// hydration with no boundary to catch it, and React unmounted the document -
+// a black page with the cause nowhere near it. Next shows its overlay in
+// development and a plain "something went wrong" in production; this is
+// that, as a page, and the layouts above it stay on screen.
+//
+// In development the message and stack, because the developer is the one
+// looking. In production React has already replaced the message with a
+// digest, and the digest is what this shows: the line to search the server
+// log for.
+import { createElement } from "react";
+const DEV = typeof import.meta !== "undefined" &&
+    import.meta.env?.DEV === true;
+const mono = "ui-monospace,SFMono-Regular,Menlo,monospace";
+const box = {
+    maxWidth: "60rem",
+    margin: "3rem auto",
+    padding: "1.5rem",
+    font: "14px/1.5 " + mono,
+    color: "#fecaca",
+    background: "#1f0b0b",
+    border: "1px solid #7f1d1d",
+    borderRadius: 8,
+};
+const heading = {
+    margin: "0 0 .75rem",
+    fontSize: 16,
+    fontWeight: 600,
+    color: "#fff",
+};
+const pre = {
+    whiteSpace: "pre-wrap",
+    wordBreak: "break-word",
+    margin: ".75rem 0 0",
+    color: "#fecaca",
+};
+const hint = { margin: ".75rem 0 0", color: "#fca5a5" };
+const button = {
+    marginTop: "1rem",
+    padding: ".4rem .8rem",
+    border: "1px solid #fca5a5",
+    borderRadius: 6,
+    background: "transparent",
+    color: "#fff",
+    cursor: "pointer",
+    font: "inherit",
+};
+export function DefaultRouteError({ error, reset, }) {
+    const name = error.name && error.name !== "Error" ? error.name + ": " : "";
+    return createElement("main", { role: "alert", style: box, "data-rsc-kit-error": "" }, createElement("h1", { style: heading }, DEV ? "This page threw while rendering" : "Something went wrong"), DEV
+        ? createElement("pre", { style: pre }, error.stack || name + error.message)
+        : createElement("p", { style: { margin: 0 } }, "The error was logged on the server" +
+            (error.digest ? " as " + error.digest : "") +
+            "."), DEV
+        ? createElement("p", { style: hint }, "Add an error.tsx beside the page to show something of your own here.")
+        : null, createElement("button", { type: "button", style: button, onClick: reset }, "Try again"));
+}
+//# sourceMappingURL=DefaultRouteError.js.map

package/dist/js/DefaultRouteError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DefaultRouteError.js","sourceRoot":"","sources":["../../src/js/DefaultRouteError.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,6DAA6D;AAC7D,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,yEAAyE;AACzE,wEAAwE;AACxE,4DAA4D;AAC5D,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,2EAA2E;AAC3E,WAAW;AAEX,OAAO,EAAE,aAAa,EAAkB,MAAM,OAAO,CAAC;AAGtD,MAAM,GAAG,GACP,OAAO,OAAO,IAAI,KAAK,WAAW;IACjC,OAAO,IAAoC,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;AAEjE,MAAM,IAAI,GAAG,6CAA6C,CAAC;AAC3D,MAAM,GAAG,GAAG;IACV,QAAQ,EAAE,OAAO;IACjB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,QAAQ;IACjB,IAAI,EAAE,WAAW,GAAG,IAAI;IACxB,KAAK,EAAE,SAAS;IAChB,UAAU,EAAE,SAAS;IACrB,MAAM,EAAE,mBAAmB;IAC3B,YAAY,EAAE,CAAC;CAChB,CAAC;AACF,MAAM,OAAO,GAAG;IACd,MAAM,EAAE,YAAY;IACpB,QAAQ,EAAE,EAAE;IACZ,UAAU,EAAE,GAAG;IACf,KAAK,EAAE,MAAM;CACd,CAAC;AACF,MAAM,GAAG,GAAG;IACV,UAAU,EAAE,UAAmB;IAC/B,SAAS,EAAE,YAAqB;IAChC,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,SAAS;CACjB,CAAC;AACF,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACxD,MAAM,MAAM,GAAG;IACb,SAAS,EAAE,MAAM;IACjB,OAAO,EAAE,aAAa;IACtB,MAAM,EAAE,mBAAmB;IAC3B,YAAY,EAAE,CAAC;IACf,UAAU,EAAE,aAAa;IACzB,KAAK,EAAE,MAAM;IACb,MAAM,EAAE,SAAS;IACjB,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,EAChC,KAAK,EACL,KAAK,GACW;IAChB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3E,OAAO,aAAa,CAClB,MAAM,EACN,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE,EAAE,EACvD,aAAa,CACX,IAAI,EACJ,EAAE,KAAK,EAAE,OAAO,EAAE,EAClB,GAAG,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,sBAAsB,CACjE,EACD,GAAG;QACD,CAAC,CAAC,aAAa,CACX,KAAK,EACL,EAAE,KAAK,EAAE,GAAG,EAAE,EACd,KAAK,CAAC,KAAK,IAAI,IAAI,GAAG,KAAK,CAAC,OAAO,CACpC;QACH,CAAC,CAAC,aAAa,CACX,GAAG,EACH,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EACxB,oCAAoC;YAClC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CACN,EACL,GAAG;QACD,CAAC,CAAC,aAAa,CACX,GAAG,EACH,EAAE,KAAK,EAAE,IAAI,EAAE,EACf,sEAAsE,CACvE;QACH,CAAC,CAAC,IAAI,EACR,aAAa,CACX,QAAQ,EACR,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,EACjD,WAAW,CACZ,CACF,CAAC;AACJ,CAAC","sourcesContent":["\"use client\";\n\n// What a page that throws shows when no error.tsx covers it.\n//\n// Without this, nothing did: the Flight row failed, the browser rethrew on\n// hydration with no boundary to catch it, and React unmounted the document -\n// a black page with the cause nowhere near it. Next shows its overlay in\n// development and a plain \"something went wrong\" in production; this is\n// that, as a page, and the layouts above it stay on screen.\n//\n// In development the message and stack, because the developer is the one\n// looking. In production React has already replaced the message with a\n// digest, and the digest is what this shows: the line to search the server\n// log for.\n\nimport { createElement, type ReactNode } from \"react\";\nimport type { RouteErrorProps } from \"./RouteErrorBoundary\";\n\nconst DEV =\n  typeof import.meta !== \"undefined\" &&\n  (import.meta as { env?: { DEV?: boolean } }).env?.DEV === true;\n\nconst mono = \"ui-monospace,SFMono-Regular,Menlo,monospace\";\nconst box = {\n  maxWidth: \"60rem\",\n  margin: \"3rem auto\",\n  padding: \"1.5rem\",\n  font: \"14px/1.5 \" + mono,\n  color: \"#fecaca\",\n  background: \"#1f0b0b\",\n  border: \"1px solid #7f1d1d\",\n  borderRadius: 8,\n};\nconst heading = {\n  margin: \"0 0 .75rem\",\n  fontSize: 16,\n  fontWeight: 600,\n  color: \"#fff\",\n};\nconst pre = {\n  whiteSpace: \"pre-wrap\" as const,\n  wordBreak: \"break-word\" as const,\n  margin: \".75rem 0 0\",\n  color: \"#fecaca\",\n};\nconst hint = { margin: \".75rem 0 0\", color: \"#fca5a5\" };\nconst button = {\n  marginTop: \"1rem\",\n  padding: \".4rem .8rem\",\n  border: \"1px solid #fca5a5\",\n  borderRadius: 6,\n  background: \"transparent\",\n  color: \"#fff\",\n  cursor: \"pointer\",\n  font: \"inherit\",\n};\n\nexport function DefaultRouteError({\n  error,\n  reset,\n}: RouteErrorProps): ReactNode {\n  const name = error.name && error.name !== \"Error\" ? error.name + \": \" : \"\";\n\n  return createElement(\n    \"main\",\n    { role: \"alert\", style: box, \"data-rsc-kit-error\": \"\" },\n    createElement(\n      \"h1\",\n      { style: heading },\n      DEV ? \"This page threw while rendering\" : \"Something went wrong\",\n    ),\n    DEV\n      ? createElement(\n          \"pre\",\n          { style: pre },\n          error.stack || name + error.message,\n        )\n      : createElement(\n          \"p\",\n          { style: { margin: 0 } },\n          \"The error was logged on the server\" +\n            (error.digest ? \" as \" + error.digest : \"\") +\n            \".\",\n        ),\n    DEV\n      ? createElement(\n          \"p\",\n          { style: hint },\n          \"Add an error.tsx beside the page to show something of your own here.\",\n        )\n      : null,\n    createElement(\n      \"button\",\n      { type: \"button\", style: button, onClick: reset },\n      \"Try again\",\n    ),\n  );\n}\n"]}

package/dist/js/LoadingBoundary.d.ts

@@ -0,0 +1,5 @@
+import { type ReactNode } from "react";
+export declare function LoadingBoundary({ fallback, children, }: {
+    fallback: ReactNode;
+    children: ReactNode;
+}): import("react").JSX.Element;

package/dist/js/LoadingBoundary.js

@@ -0,0 +1,19 @@
+"use client";
+import { jsx as _jsx } from "react/jsx-runtime";
+// The engine's own Suspense: the one a loading.tsx becomes.
+//
+// A component, and a named one, for the report and nothing else. When a read
+// is caught at a boundary during a server render, the component stack says
+// whose boundary it was - and the stack is the only thing that does. It
+// used to be inferred from what stood two frames outside the nearest
+// Suspense, which held for a first render and broke on a PPR resume: React
+// leaves server components out of that stack, so a <Suspense> the developer
+// wrote as the first thing in a page sat directly under the engine's
+// segment boundary and was reported as a loading.tsx catching the whole
+// segment - a warning nobody could make go away, on every request. Now the
+// engine's boundary is the one rendered by LoadingBoundary, and only that.
+import { Suspense } from "react";
+export function LoadingBoundary({ fallback, children, }) {
+    return _jsx(Suspense, { fallback: fallback, children: children });
+}
+//# sourceMappingURL=LoadingBoundary.js.map

package/dist/js/LoadingBoundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoadingBoundary.js","sourceRoot":"","sources":["../../src/js/LoadingBoundary.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,4DAA4D;AAC5D,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,wEAAwE;AACxE,qEAAqE;AACrE,2EAA2E;AAC3E,4EAA4E;AAC5E,qEAAqE;AACrE,wEAAwE;AACxE,2EAA2E;AAC3E,2EAA2E;AAC3E,OAAO,EAAE,QAAQ,EAAkB,MAAM,OAAO,CAAC;AAEjD,MAAM,UAAU,eAAe,CAAC,EAC9B,QAAQ,EACR,QAAQ,GAIT;IACC,OAAO,KAAC,QAAQ,IAAC,QAAQ,EAAE,QAAQ,YAAG,QAAQ,GAAY,CAAC;AAC7D,CAAC","sourcesContent":["\"use client\";\n\n// The engine's own Suspense: the one a loading.tsx becomes.\n//\n// A component, and a named one, for the report and nothing else. When a read\n// is caught at a boundary during a server render, the component stack says\n// whose boundary it was - and the stack is the only thing that does. It\n// used to be inferred from what stood two frames outside the nearest\n// Suspense, which held for a first render and broke on a PPR resume: React\n// leaves server components out of that stack, so a <Suspense> the developer\n// wrote as the first thing in a page sat directly under the engine's\n// segment boundary and was reported as a loading.tsx catching the whole\n// segment - a warning nobody could make go away, on every request. Now the\n// engine's boundary is the one rendered by LoadingBoundary, and only that.\nimport { Suspense, type ReactNode } from \"react\";\n\nexport function LoadingBoundary({\n  fallback,\n  children,\n}: {\n  fallback: ReactNode;\n  children: ReactNode;\n}) {\n  return <Suspense fallback={fallback}>{children}</Suspense>;\n}\n"]}

package/dist/js/fallbackReport.js

@@ -9,12 +9,16 @@
  * arrives, and a boundary closer to the read would keep the rest painted.
  *
  * The component stack says which: frames run from the component outward,
- * and the engine's segment boundaries render through SegmentBoundary or
- * SlotBoundary, so the frame just outside the nearest Suspense tells whose
- * it is. Only development has the stack; production reports nothing here,
- * and the build's own note or warning on the route is the record.
+ * and the engine renders the boundary a loading.tsx becomes through a
+ * component named for it, so the frame just outside the nearest Suspense
+ * is LoadingBoundary exactly when the boundary is the engine's. Only that
+ * frame, and only that name: the check used to accept SegmentBoundary two
+ * frames out, which held for a first render and misfired on a PPR resume,
+ * where React leaves server components out of the stack and a developer's
+ * own <Suspense> at the top of a page sat directly under the segment
+ * boundary - a warning on every request that nothing could make go away.
  */
-const ENGINE_BOUNDARY = /^\s*at (SegmentBoundary|SlotBoundary)\b/;
+const ENGINE_BOUNDARY = /^\s*at LoadingBoundary\b/;
 export function caughtByLoading(componentStack) {
     const frames = (componentStack ?? "")
         .split("\n")
@@ -22,9 +26,7 @@ export function caughtByLoading(componentStack) {
     const at = frames.findIndex((line) => /^\s*at Suspense\b/.test(line));
     if (at === -1)
         return false;
-    return frames
-        .slice(at + 1, at + 3)
-        .some((line) => ENGINE_BOUNDARY.test(line));
+    return ENGINE_BOUNDARY.test(frames[at + 1] ?? "");
 }
 /**
  * Whether a render error is the consumer cancelling, not the app failing.