@rsc-kit/core 0.18.1 → 0.19.0

package/dist/host.js

@@ -24,8 +24,9 @@ import { withRevalidation } from "./revalidate.js";
  */
 export { revalidate } from "./revalidate.js";
 import { currentNotFound, withRedirect } from "./redirect.js";
+import { compressed } from "./compress.js";
 import { withCache } from "./cache.js";
-import { withRequest, withResponseDraft } from "./request.js";
+import { takeAfterWork, withRequest, withResponseDraft } from "./request.js";
 /**
  * @internal For a host adapter that embeds the engine. An app imports this
  * from `@rsc-kit/core/redirect` - the one the guides teach, and the one an
@@ -68,6 +69,21 @@ function inScript(value) {
         .replace(/\u2028/g, "\\u2028")
         .replace(/\u2029/g, "\\u2029");
 }
+/**
+ * Whether the browser itself asked, for a document.
+ *
+ * Sec-Fetch-Mode is what every current browser sends and nothing else does;
+ * the Accept fallback is for the ones that do not, and for a test's Request.
+ * A payload request never counts, whatever it accepts.
+ */
+function isNavigation(request) {
+    if (request.headers.has(HEADER.rsc))
+        return false;
+    const mode = request.headers.get("sec-fetch-mode");
+    if (mode)
+        return mode === "navigate";
+    return (request.headers.get("accept") ?? "").includes("text/html");
+}
 function redirectResponse(to, isPayloadRequest) {
     if (isPayloadRequest) {
         return new Response(null, {
@@ -272,6 +288,7 @@ function matchPage(routes, url) {
 export function createRscHandler(options) {
     const { engine, assets, version } = options;
     const maxActionBody = options.maxActionBody ?? DEFAULT_MAX_ACTION_BODY;
+    const compress = options.compress ?? true;
     // Annotated rather than inferred: the narrowing below is lost inside the
     // closures that use it, and every one of them runs after the throw.
     const manifest = options.manifest ?? engine.manifest?.();
@@ -357,6 +374,52 @@ export function createRscHandler(options) {
     // everything below shares it: middleware, layouts, the page, and an action. A
     // guard that reads the session and a layout that reads it again are one
     // query, not two.
+    /**
+     * The fields of a form posted to a page, or null for anything else.
+     *
+     * A POST with a form body, from this origin, to a url that is a page and
+     * not the action endpoint, with an engine that can run what the form
+     * names. Read here so the decision is made once; the action reads the
+     * same fields from what is returned.
+     */
+    async function formPostOf(request, url) {
+        if (request.method !== "POST" || !engine.handleRscFormPost)
+            return null;
+        if (request.headers.has(HEADER.rsc))
+            return null;
+        const type = request.headers.get("content-type") ?? "";
+        if (!/^(?:application\/x-www-form-urlencoded|multipart\/form-data)/i.test(type))
+            return null;
+        if (!matchPage(routes, url))
+            return null;
+        if (!actionOriginAllowed(request, url))
+            return null;
+        try {
+            return await request.formData();
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * What a stored answer's compressed bytes are kept under.
+     *
+     * The build, the url, and the value of every request header the answer
+     * says it varies on - which is what tells the document for /login apart
+     * from the payload for /login. Keyed by the path alone, the payload
+     * request found the document's bytes waiting and hydration decoded HTML
+     * as Flight, silently, on every stored page in production.
+     */
+    function storedKey(request, response) {
+        const url = new URL(request.url);
+        const varies = (response.headers.get("Vary") ?? "")
+            .split(",")
+            .map((name) => name.trim().toLowerCase())
+            .filter((name) => name && name !== "*" && name !== "accept-encoding")
+            .sort()
+            .map((name) => `${name}=${request.headers.get(name) ?? ""}`);
+        return [version ?? "", url.pathname + url.search, ...varies].join("\n");
+    }
     return async function handle(request) {
         return await withRequest(request, () => withCache(() => 
         // Open for the whole request and sealed the moment an answer exists,
@@ -391,6 +454,26 @@ export function createRscHandler(options) {
             // off for a team whose policy strips every framework identifier.
             if (identify)
                 response.headers.set("X-Powered-By", "rsc-kit");
+            // Work after() queued, now that the answer exists. A Worker keeps
+            // the isolate alive only for what is handed to waitUntil - Nitro's
+            // Cloudflare preset puts the execution context on the request - so
+            // it goes there where it can; a process keeps a detached promise.
+            const pending = takeAfterWork();
+            if (pending) {
+                const context = request.context;
+                if (typeof context?.waitUntil === "function")
+                    context.waitUntil(pending);
+            }
+            // Last, over the finished answer, headers and all. A stored answer
+            // is the same bytes for everyone and is compressed once, keyed by
+            // the build and the url it was stored for.
+            if (compress) {
+                const answer = await compressed(request, response, servedFrom.get(response) === "stored" ? storedKey(request, response) : undefined);
+                const from = servedFrom.get(response);
+                if (answer !== response && from)
+                    servedFrom.set(answer, from);
+                return answer;
+            }
             return response;
         })));
     };
@@ -453,7 +536,23 @@ export function createRscHandler(options) {
             const stored = await frozenApi(request, url, api);
             if (stored)
                 return stored;
-            return await engine.handleApiRoute(api.route.name, request, api.params, allowFor(api.route));
+            // A redirect() thrown from the handler is the route's answer, not a
+            // fault: a real Location, because whoever asked is meant to go there
+            // - a browser that followed a link to this route, or a fetch of an
+            // export that lives on a signed url. notFound() is its 404.
+            return await withRedirect(async (taken) => {
+                try {
+                    return await engine.handleApiRoute(api.route.name, request, api.params, allowFor(api.route));
+                }
+                catch (error) {
+                    const redirected = taken();
+                    if (redirected)
+                        return redirectResponse(redirected, false);
+                    if (currentNotFound())
+                        return new Response("Not found", { status: 404 });
+                    throw error;
+                }
+            });
         }
         if (request.method === "GET" && url.pathname === HEADER.queryPath) {
             // Same check as an action, for a smaller reason: a cross-origin page
@@ -475,7 +574,14 @@ export function createRscHandler(options) {
             url.pathname === HEADER.pprResumePath) {
             return await servePprResume(request, url, options.prerendered);
         }
-        if (request.method !== "GET" && request.method !== "HEAD")
+        // A form submitted before the page had a runtime: the browser posts it
+        // to the page's own url, as React wrote it, with the action's id among
+        // the fields. The action runs and the page renders with the result -
+        // what the guide promises for a form that had to work without
+        // javascript. Same-origin, as an action is; anything else that is not
+        // a read is not this host's.
+        const formPost = await formPostOf(request, url);
+        if (!formPost && request.method !== "GET" && request.method !== "HEAD")
             return null;
         // One named region of this page, asked for without mutating anything to
         // earn it. What an action invalidated does not come through here — that
@@ -498,7 +604,7 @@ export function createRscHandler(options) {
         // document puts the entire page inside that region, and answering an
         // interception with it replaces the page the modal was opening over.
         const match = matchPage(routes, url);
-        if (options.prerendered) {
+        if (options.prerendered && !formPost) {
             // A guarded route can still be frozen: whether the content is the same
             // for everyone, and whether this caller may see it, are different
             // questions. The build answers the first; this answers the second, and
@@ -534,11 +640,13 @@ export function createRscHandler(options) {
                 // still available. Nothing is buffered to make that true.
                 let htmlStream;
                 try {
-                    ({ htmlStream } = await engine.handleRscHtmlStream(match.route.component, props, layouts, match.route.loadings, match.route.slots, {}, undefined, url.pathname, 
-                    // A route that ships no runtime gets no bootstrap and no segment
-                    // boundary — the boundary is itself a client component, so leaving
-                    // it in means no page could ever be JS-free.
-                    true));
+                    ({ htmlStream } = formPost
+                        ? await engine.handleRscFormPost(match.route.component, props, layouts, match.route.loadings, match.route.slots, {}, undefined, url.pathname, true, formPost)
+                        : await engine.handleRscHtmlStream(match.route.component, props, layouts, match.route.loadings, match.route.slots, {}, undefined, url.pathname, 
+                        // A route that ships no runtime gets no bootstrap and no segment
+                        // boundary — the boundary is itself a client component, so leaving
+                        // it in means no page could ever be JS-free.
+                        true));
                 }
                 catch (error) {
                     // A rejected shell is how a redirect above every boundary arrives:
@@ -585,9 +693,13 @@ export function createRscHandler(options) {
                         "Content-Type": HTML_TYPE,
                         [HEADER.layouts]: chain.join(","),
                         Vary: VARY_ON_RSC,
-                        "Cache-Control": match.route.middleware?.length
-                            ? PER_CLIENT
-                            : REVALIDATE,
+                        // The answer to a post is the result of something that happened
+                        // once; nothing may keep it.
+                        "Cache-Control": formPost
+                            ? "no-store"
+                            : match.route.middleware?.length
+                                ? PER_CLIENT
+                                : REVALIDATE,
                     }),
                 });
             });
@@ -918,13 +1030,19 @@ export function createRscHandler(options) {
         const payload = variant ?? (await read(`${key}.flight`));
         if (payload === null)
             return null;
+        // As cacheable as the document it boots: the same build-time bytes for
+        // everyone, unless a guard above the route decides who may have them.
+        // Marked no-store, the service worker refused to keep it, and a
+        // precached page rendered offline and never hydrated - the markup was
+        // there and the payload it boots from was not.
+        const guarded = matchPage(routes, url)?.route.middleware?.length ?? 0;
         return new Response(payload, {
             headers: withVersion({
                 "Content-Type": FLIGHT_TYPE,
                 [HEADER.segmentDepth]: String(variant ? shared : 0),
                 [HEADER.layouts]: chain.join(","),
                 Vary: VARY_ON_RSC,
-                "Cache-Control": PER_CLIENT,
+                "Cache-Control": guarded ? PER_CLIENT : REVALIDATE,
             }),
         });
     }
@@ -1117,12 +1235,8 @@ export function createRscHandler(options) {
                 // A redirect is a refusal here. Where it was going is told rather than
                 // followed, so a client can decide for itself.
                 const redirected = taken();
-                if (redirected) {
-                    return new Response("Unauthorized", {
-                        status: 401,
-                        headers: { "X-RSC-Redirect": redirected.location },
-                    });
-                }
+                if (redirected)
+                    return apiRedirect(request, redirected);
                 // A visitor who may not use this endpoint has not caused a server
                 // error, and answering 500 makes a guarded route indistinguishable
                 // from a broken one. Null means the middleware threw something that is
@@ -1135,15 +1249,29 @@ export function createRscHandler(options) {
                 });
             }
             const redirected = taken();
-            if (redirected) {
-                return new Response("Unauthorized", {
-                    status: 401,
-                    headers: { "X-RSC-Redirect": redirected.location },
-                });
-            }
+            if (redirected)
+                return apiRedirect(request, redirected);
             return null;
         });
     }
+    /**
+     * A guard's redirect on a route.ts, answered for whoever asked.
+     *
+     * A browser that navigated here - followed a link to the route, typed the
+     * url - is sent on with a real Location; a 401 would show it "Unauthorized"
+     * over a page it cannot see. Code that fetched the route is told instead:
+     * fetch follows a Location on its own and would hand back the login page's
+     * html as the endpoint's answer, so it gets the 401 with the destination in
+     * a header, and decides for itself.
+     */
+    function apiRedirect(request, to) {
+        if (isNavigation(request))
+            return redirectResponse(to, false);
+        return new Response("Unauthorized", {
+            status: 401,
+            headers: { "X-RSC-Redirect": to.location },
+        });
+    }
     async function handleQuery(request, url) {
         if (!engine.handleQuery)
             return null;
@@ -1216,12 +1344,28 @@ export function createRscHandler(options) {
             : undefined;
         // Scoped to this action: revalidate() called anywhere inside it, at any
         // depth, marks here and nowhere else — two requests can be in flight and
-        // marking is per-request state.
-        const { stream } = await withRevalidation((taken) => engine.handleAction(actionId, body, contentType, page, taken));
-        return new Response(stream, {
-            headers: withVersion({
-                "Content-Type": "text/x-component; charset=utf-8",
-            }),
+        // marking is per-request state. And redirect(): the guide says "throw
+        // from the action and the client follows it", and the client does
+        // follow an X-RSC-Redirect on an action's response — but the signal the
+        // throw raises was never caught here, so every login that redirected
+        // after signing in was a 500. Caught, it is the instruction the client
+        // already knows how to read.
+        return await withRedirect(async (redirected) => {
+            let stream;
+            try {
+                ({ stream } = await withRevalidation((taken) => engine.handleAction(actionId, body, contentType, page, taken)));
+            }
+            catch (error) {
+                const to = redirected();
+                if (to)
+                    return redirectResponse(to, true);
+                throw error;
+            }
+            return new Response(stream, {
+                headers: withVersion({
+                    "Content-Type": "text/x-component; charset=utf-8",
+                }),
+            });
         });
     }
 }