@rsc-kit/core 0.29.8 → 0.29.10

package/dist/bootPayloads.d.ts

@@ -0,0 +1,18 @@
+/** How long a payload waits for its browser. */
+export declare const BOOT_HOLD_MS = 10000;
+export interface HeldPayload {
+    payload: ReadableStream;
+    /** The headers the boot answer carries beside the payload: the layout chain, the depth. */
+    headers: Record<string, string>;
+    at: number;
+}
+/** A token no one can guess: 128 bits, url-safe. */
+export declare function bootToken(): string;
+/** Keep a render's payload for the boot fetch that follows its document. */
+export declare function holdBootPayload(token: string, payload: ReadableStream, headers: Record<string, string>, now?: number): void;
+/** The payload for a token, once. Null for a token not held, redeemed or expired. */
+export declare function takeBootPayload(token: string, now?: number): HeldPayload | null;
+/** How many are held, for tests. */
+export declare function heldBootPayloads(): number;
+/** Forget everything, for tests. */
+export declare function clearBootPayloads(): void;

package/dist/bootPayloads.js

@@ -0,0 +1,81 @@
+// One render per visit.
+//
+// Hydrating server components needs the serialised tree, not the HTML, and a
+// document does not carry its own payload - inlined, decode and hydration
+// become one long task (#231). So the client fetches it, and that fetch used
+// to render the whole page a second time: the same reads, the same queries,
+// a moment after the document's render had made exactly that payload and
+// thrown it away.
+//
+// Now the document's render keeps its payload here for the few seconds it
+// takes the browser to come back for it, under a token written into the
+// document that only that browser holds. The boot fetch redeems the token
+// and is answered with the payload the document was made from - which is
+// also the one it should hydrate against: two renders a moment apart could
+// disagree, and the one that made the HTML cannot.
+//
+// A token is redeemed once. A payload nobody comes back for - a route with
+// no runtime, a browser that left, a Worker isolate other than the one that
+// rendered - is cancelled when it expires, and the boot fetch that misses
+// renders as it always did. Missing costs a render; it never costs a wrong
+// answer.
+/** How long a payload waits for its browser. */
+export const BOOT_HOLD_MS = 10_000;
+/** At most this many held at once; the oldest is dropped first. */
+const MAX_HELD = 500;
+const held = new Map();
+/** A token no one can guess: 128 bits, url-safe. */
+export function bootToken() {
+    const bytes = new Uint8Array(16);
+    crypto.getRandomValues(bytes);
+    let out = "";
+    for (const b of bytes)
+        out += b.toString(16).padStart(2, "0");
+    return out;
+}
+/** Keep a render's payload for the boot fetch that follows its document. */
+export function holdBootPayload(token, payload, headers, now = Date.now()) {
+    sweep(now);
+    if (held.size >= MAX_HELD) {
+        const oldest = held.keys().next().value;
+        if (oldest !== undefined)
+            drop(oldest);
+    }
+    held.set(token, { payload, headers, at: now });
+}
+/** The payload for a token, once. Null for a token not held, redeemed or expired. */
+export function takeBootPayload(token, now = Date.now()) {
+    const found = held.get(token);
+    if (!found)
+        return null;
+    held.delete(token);
+    if (now - found.at >= BOOT_HOLD_MS) {
+        void found.payload.cancel().catch(() => { });
+        return null;
+    }
+    return found;
+}
+/** Let go of what nobody came back for. */
+function sweep(now) {
+    for (const [token, entry] of held) {
+        if (now - entry.at < BOOT_HOLD_MS)
+            break;
+        drop(token);
+    }
+}
+function drop(token) {
+    const entry = held.get(token);
+    held.delete(token);
+    if (entry)
+        void entry.payload.cancel().catch(() => { });
+}
+/** How many are held, for tests. */
+export function heldBootPayloads() {
+    return held.size;
+}
+/** Forget everything, for tests. */
+export function clearBootPayloads() {
+    for (const token of [...held.keys()])
+        drop(token);
+}
+//# sourceMappingURL=bootPayloads.js.map

package/dist/bootPayloads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootPayloads.js","sourceRoot":"","sources":["../src/bootPayloads.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,kBAAkB;AAClB,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,mDAAmD;AACnD,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,UAAU;AAEV,gDAAgD;AAChD,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAEnC,mEAAmE;AACnE,MAAM,QAAQ,GAAG,GAAG,CAAC;AASrB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;AAE5C,oDAAoD;AACpD,MAAM,UAAU,SAAS;IACvB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAEjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAE9B,IAAI,GAAG,GAAG,EAAE,CAAC;IAEb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAE9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,OAAuB,EACvB,OAA+B,EAC/B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,KAAK,CAAC,GAAG,CAAC,CAAC;IAEX,IAAI,IAAI,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAExC,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnB,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE,IAAI,YAAY,EAAE,CAAC;QACnC,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAE5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2CAA2C;AAC3C,SAAS,KAAK,CAAC,GAAW;IACxB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE,GAAG,YAAY;YAAE,MAAM;QAEzC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnB,IAAI,KAAK;QAAE,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,iBAAiB;IAC/B,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAAE,IAAI,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC","sourcesContent":["// One render per visit.\n//\n// Hydrating server components needs the serialised tree, not the HTML, and a\n// document does not carry its own payload - inlined, decode and hydration\n// become one long task (#231). So the client fetches it, and that fetch used\n// to render the whole page a second time: the same reads, the same queries,\n// a moment after the document's render had made exactly that payload and\n// thrown it away.\n//\n// Now the document's render keeps its payload here for the few seconds it\n// takes the browser to come back for it, under a token written into the\n// document that only that browser holds. The boot fetch redeems the token\n// and is answered with the payload the document was made from - which is\n// also the one it should hydrate against: two renders a moment apart could\n// disagree, and the one that made the HTML cannot.\n//\n// A token is redeemed once. A payload nobody comes back for - a route with\n// no runtime, a browser that left, a Worker isolate other than the one that\n// rendered - is cancelled when it expires, and the boot fetch that misses\n// renders as it always did. Missing costs a render; it never costs a wrong\n// answer.\n\n/** How long a payload waits for its browser. */\nexport const BOOT_HOLD_MS = 10_000;\n\n/** At most this many held at once; the oldest is dropped first. */\nconst MAX_HELD = 500;\n\nexport interface HeldPayload {\n  payload: ReadableStream;\n  /** The headers the boot answer carries beside the payload: the layout chain, the depth. */\n  headers: Record<string, string>;\n  at: number;\n}\n\nconst held = new Map<string, HeldPayload>();\n\n/** A token no one can guess: 128 bits, url-safe. */\nexport function bootToken(): string {\n  const bytes = new Uint8Array(16);\n\n  crypto.getRandomValues(bytes);\n\n  let out = \"\";\n\n  for (const b of bytes) out += b.toString(16).padStart(2, \"0\");\n\n  return out;\n}\n\n/** Keep a render's payload for the boot fetch that follows its document. */\nexport function holdBootPayload(\n  token: string,\n  payload: ReadableStream,\n  headers: Record<string, string>,\n  now = Date.now(),\n): void {\n  sweep(now);\n\n  if (held.size >= MAX_HELD) {\n    const oldest = held.keys().next().value;\n\n    if (oldest !== undefined) drop(oldest);\n  }\n\n  held.set(token, { payload, headers, at: now });\n}\n\n/** The payload for a token, once. Null for a token not held, redeemed or expired. */\nexport function takeBootPayload(token: string, now = Date.now()): HeldPayload | null {\n  const found = held.get(token);\n\n  if (!found) return null;\n\n  held.delete(token);\n\n  if (now - found.at >= BOOT_HOLD_MS) {\n    void found.payload.cancel().catch(() => {});\n\n    return null;\n  }\n\n  return found;\n}\n\n/** Let go of what nobody came back for. */\nfunction sweep(now: number): void {\n  for (const [token, entry] of held) {\n    if (now - entry.at < BOOT_HOLD_MS) break;\n\n    drop(token);\n  }\n}\n\nfunction drop(token: string): void {\n  const entry = held.get(token);\n\n  held.delete(token);\n\n  if (entry) void entry.payload.cancel().catch(() => {});\n}\n\n/** How many are held, for tests. */\nexport function heldBootPayloads(): number {\n  return held.size;\n}\n\n/** Forget everything, for tests. */\nexport function clearBootPayloads(): void {\n  for (const token of [...held.keys()]) drop(token);\n}\n"]}

package/dist/crawler.d.ts

@@ -0,0 +1,2 @@
+/** Whether this user agent is answered with the finished document. */
+export declare function isCrawler(userAgent: string | null | undefined): boolean;

package/dist/crawler.js

@@ -0,0 +1,62 @@
+// Who is answered with the finished document.
+//
+// A person is sent the shell the moment it exists and everything else as it
+// streams: the page paints at once, the title and the slow regions arrive
+// when they are ready. The status line leaves with the shell, so a notFound()
+// or a redirect() decided later than that is delivered in the body - which a
+// person's browser acts on and a search engine's indexer does not. It keeps
+// a 200, a soft 404.
+//
+// A crawler is not waiting to see anything. It is answered once the whole
+// render is done: a notFound() anywhere is a real 404, a redirect anywhere a
+// real 3xx, and the generated metadata is in <head> where a link preview's
+// scraper reads it and nowhere else. The cost - the slowest read on the page
+// before the first byte - is paid only by something that is not a person.
+//
+// Matched by name, from the user agents the engines and preview scrapers
+// publish. A crawler missing from the list is served as a person is, which
+// is correct HTML with a noindex tag where the page was missing; one that
+// should be here is a line to add.
+const CRAWLERS = new RegExp([
+    // Search engines.
+    'Googlebot',
+    'Google-InspectionTool',
+    'Storebot-Google',
+    'AdsBot-Google',
+    'Mediapartners-Google',
+    'bingbot',
+    'BingPreview',
+    'Slurp',
+    'DuckDuckBot',
+    'Baiduspider',
+    'YandexBot',
+    'YandexMobileBot',
+    'Sogou',
+    'Applebot',
+    'PetalBot',
+    'SeznamBot',
+    'Yeti',
+    'ia_archiver',
+    // Link previews: a share card is the page's metadata, read once.
+    'facebookexternalhit',
+    'facebookcatalog',
+    'meta-externalagent',
+    'Twitterbot',
+    'LinkedInBot',
+    'Slackbot',
+    'Discordbot',
+    'TelegramBot',
+    'WhatsApp',
+    'redditbot',
+    'Pinterestbot',
+    'SkypeUriPreview',
+    'vkShare',
+    'Embedly',
+    'bitlybot',
+    'Iframely',
+].join('|'), 'i');
+/** Whether this user agent is answered with the finished document. */
+export function isCrawler(userAgent) {
+    return typeof userAgent === 'string' && CRAWLERS.test(userAgent);
+}
+//# sourceMappingURL=crawler.js.map

package/dist/crawler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crawler.js","sourceRoot":"","sources":["../src/crawler.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,8EAA8E;AAC9E,6EAA6E;AAC7E,4EAA4E;AAC5E,qBAAqB;AACrB,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,0EAA0E;AAC1E,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,0EAA0E;AAC1E,mCAAmC;AAEnC,MAAM,QAAQ,GAAG,IAAI,MAAM,CACzB;IACE,kBAAkB;IAClB,WAAW;IACX,uBAAuB;IACvB,iBAAiB;IACjB,eAAe;IACf,sBAAsB;IACtB,SAAS;IACT,aAAa;IACb,OAAO;IACP,aAAa;IACb,aAAa;IACb,WAAW;IACX,iBAAiB;IACjB,OAAO;IACP,UAAU;IACV,UAAU;IACV,WAAW;IACX,MAAM;IACN,aAAa;IACb,iEAAiE;IACjE,qBAAqB;IACrB,iBAAiB;IACjB,oBAAoB;IACpB,YAAY;IACZ,aAAa;IACb,UAAU;IACV,YAAY;IACZ,aAAa;IACb,UAAU;IACV,WAAW;IACX,cAAc;IACd,iBAAiB;IACjB,SAAS;IACT,SAAS;IACT,UAAU;IACV,UAAU;CACX,CAAC,IAAI,CAAC,GAAG,CAAC,EACX,GAAG,CACJ,CAAA;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,SAAoC;IAC5D,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAClE,CAAC","sourcesContent":["// Who is answered with the finished document.\n//\n// A person is sent the shell the moment it exists and everything else as it\n// streams: the page paints at once, the title and the slow regions arrive\n// when they are ready. The status line leaves with the shell, so a notFound()\n// or a redirect() decided later than that is delivered in the body - which a\n// person's browser acts on and a search engine's indexer does not. It keeps\n// a 200, a soft 404.\n//\n// A crawler is not waiting to see anything. It is answered once the whole\n// render is done: a notFound() anywhere is a real 404, a redirect anywhere a\n// real 3xx, and the generated metadata is in <head> where a link preview's\n// scraper reads it and nowhere else. The cost - the slowest read on the page\n// before the first byte - is paid only by something that is not a person.\n//\n// Matched by name, from the user agents the engines and preview scrapers\n// publish. A crawler missing from the list is served as a person is, which\n// is correct HTML with a noindex tag where the page was missing; one that\n// should be here is a line to add.\n\nconst CRAWLERS = new RegExp(\n  [\n    // Search engines.\n    'Googlebot',\n    'Google-InspectionTool',\n    'Storebot-Google',\n    'AdsBot-Google',\n    'Mediapartners-Google',\n    'bingbot',\n    'BingPreview',\n    'Slurp',\n    'DuckDuckBot',\n    'Baiduspider',\n    'YandexBot',\n    'YandexMobileBot',\n    'Sogou',\n    'Applebot',\n    'PetalBot',\n    'SeznamBot',\n    'Yeti',\n    'ia_archiver',\n    // Link previews: a share card is the page's metadata, read once.\n    'facebookexternalhit',\n    'facebookcatalog',\n    'meta-externalagent',\n    'Twitterbot',\n    'LinkedInBot',\n    'Slackbot',\n    'Discordbot',\n    'TelegramBot',\n    'WhatsApp',\n    'redditbot',\n    'Pinterestbot',\n    'SkypeUriPreview',\n    'vkShare',\n    'Embedly',\n    'bitlybot',\n    'Iframely',\n  ].join('|'),\n  'i',\n)\n\n/** Whether this user agent is answered with the finished document. */\nexport function isCrawler(userAgent: string | null | undefined): boolean {\n  return typeof userAgent === 'string' && CRAWLERS.test(userAgent)\n}\n"]}

package/dist/headers.d.ts

@@ -10,6 +10,11 @@ export declare const HEADER: {
     readonly segmentDepth: 'X-RSC-Segment-Depth';
     /** The chain to send back next time. */
     readonly layouts: 'X-RSC-Layouts';
+    /**
+     * On the boot fetch: the token the document carried, redeeming the payload
+     * its own render kept. See bootPayloads.ts.
+     */
+    readonly boot: 'X-RSC-Boot';
     /** Identifies the build, so a client can notice it is talking to an old one. */
     readonly version: 'X-RSC-Version';
     /** The slot an intercepted navigation is targeting. */

package/dist/headers.js

@@ -19,6 +19,11 @@ export const HEADER = {
     segmentDepth: 'X-RSC-Segment-Depth',
     /** The chain to send back next time. */
     layouts: 'X-RSC-Layouts',
+    /**
+     * On the boot fetch: the token the document carried, redeeming the payload
+     * its own render kept. See bootPayloads.ts.
+     */
+    boot: 'X-RSC-Boot',
     /** Identifies the build, so a client can notice it is talking to an old one. */
     version: 'X-RSC-Version',
     /** The slot an intercepted navigation is targeting. */

package/dist/headers.js.map

@@ -1 +1 @@
-{"version":3,"file":"headers.js","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,0EAA0E;AAC1E,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,gCAAgC;AAChC,EAAE;AACF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB;;;OAGG;IACH,GAAG,EAAE,OAAO;IAEZ,iFAAiF;IACjF,QAAQ,EAAE,gBAAgB;IAE1B,kEAAkE;IAClE,YAAY,EAAE,qBAAqB;IAEnC,wCAAwC;IACxC,OAAO,EAAE,eAAe;IAExB,gFAAgF;IAChF,OAAO,EAAE,eAAe;IAExB,uDAAuD;IACvD,SAAS,EAAE,iBAAiB;IAE5B,gDAAgD;IAChD,OAAO,EAAE,eAAe;IAExB,uEAAuE;IACvE,UAAU,EAAE,kBAAkB;IAE9B,0CAA0C;IAC1C,MAAM,EAAE,cAAc;IAEtB;;;;;;;OAOG;IACH,QAAQ,EAAE,gBAAgB;IAE1B;;;;;;OAMG;IACH,WAAW,EAAE,oBAAoB;IAEjC;;;;;OAKG;IACH,UAAU,EAAE,cAAc;IAC1B;;;;;;;;;OASG;IACH;;;;;;;OAOG;IACH,KAAK,EAAE,aAAa;IAEpB,SAAS,EAAE,aAAa;IACxB,mEAAmE;IACnE,YAAY,EAAE,iBAAiB;IAC/B,uDAAuD;IACvD,aAAa,EAAE,kBAAkB;IACjC;;;;OAIG;IACH,SAAS,EAAE,eAAe;IAC1B,+EAA+E;IAC/E,WAAW,EAAE,eAAe;IAC5B,8FAA8F;IAC9F,UAAU,EAAE,cAAc;CAClB,CAAA;AAEV,sBAAsB;AACtB,MAAM,CAAC,MAAM,WAAW,GAAG,iCAAiC,CAAA;AAE5D,2BAA2B;AAC3B,MAAM,CAAC,MAAM,SAAS,GAAG,0BAA0B,CAAA;AAEnD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM,CAAC,GAAG;IACV,MAAM,CAAC,QAAQ;IACf,MAAM,CAAC,UAAU;IACjB,MAAM,CAAC,SAAS;IAChB,MAAM,CAAC,OAAO;CACf,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,mBAAmB,CAAA;AAE7C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,oCAAoC,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,qCAAqC,CAAA","sourcesContent":["// The wire protocol, as names rather than string literals.\n//\n// A host writing these out by hand is how they drift. Two of them are not\n// negotiable at all — the client sends them or asks for them at fixed\n// addresses, and a host that spells one differently fails silently: the\n// request falls through, the decoder never runs, and a button does nothing\n// with no error on either side.\n//\n// PROTOCOL.md describes what each one means. This is the same list, importable.\n\nexport const HEADER = {\n  /**\n   * Present on a request for a Flight payload rather than the document. One\n   * url serves both, which is why every answer must Vary on it.\n   */\n  rsc: 'X-RSC',\n\n  /** The layout chain the client has mounted, outermost first, comma-separated. */\n  segments: 'X-RSC-Segments',\n\n  /** The boundary the answer replaces. 0 means a whole document. */\n  segmentDepth: 'X-RSC-Segment-Depth',\n\n  /** The chain to send back next time. */\n  layouts: 'X-RSC-Layouts',\n\n  /** Identifies the build, so a client can notice it is talking to an old one. */\n  version: 'X-RSC-Version',\n\n  /** The slot an intercepted navigation is targeting. */\n  intercept: 'X-RSC-Intercept',\n\n  /** Where the navigation or action came from. */\n  referer: 'X-RSC-Referer',\n\n  /** One named region of the current page to render and return alone. */\n  revalidate: 'X-RSC-Revalidate',\n\n  /** The server reference being invoked. */\n  action: 'X-RSC-Action',\n\n  /**\n   * Go here instead.\n   *\n   * Used for a redirect the client has to perform itself: a failed action, and\n   * a navigation whose render redirected. Never a 3xx for those — `fetch`\n   * follows one transparently, so the client would get the destination's HTML\n   * where it expected a Flight payload and decode it as one.\n   */\n  redirect: 'X-RSC-Redirect',\n\n  /**\n   * The body's real type.\n   *\n   * The body itself goes out as application/octet-stream so a host that parses\n   * multipart cannot consume it before the action does — reading Content-Type\n   * instead leaves an upload undecodable.\n   */\n  contentType: 'X-RSC-Content-Type',\n\n  /**\n   * Where the browser posts server actions.\n   *\n   * Not a convention this can choose: the client runtime posts here\n   * unconditionally.\n   */\n  actionPath: '/_rsc/action',\n  /**\n   * Where the browser reads queries.\n   *\n   * A GET, and that is the whole point of it being a separate address: a POST\n   * is cacheable by nothing, so a read routed through the action endpoint can\n   * never be kept by an HTTP cache, a CDN or a service worker. Only functions\n   * declared with `query()` are reachable here — the endpoint checks the mark\n   * before invoking anything, because otherwise this address would run any\n   * registered action over GET.\n   */\n  /**\n   * Sent on every read, and required by the query endpoint.\n   *\n   * A GET with no unusual header is a simple request, so any page could\n   * trigger one with an <img> and the visitor's cookies would ride along.\n   * This header is not CORS-safelisted, so the browser preflights it — the\n   * same thing that makes a POST carrying X-RSC-Action safe.\n   */\n  query: 'X-RSC-Query',\n\n  queryPath: '/_rsc/query',\n  /** Build-time shell for a PPR route, for an edge cache to hold. */\n  pprShellPath: '/_rsc/ppr-shell',\n  /** Finish a shell an edge cache is already serving. */\n  pprResumePath: '/_rsc/ppr-resume',\n  /**\n   * On a refresh a change triggered: which names moved, to which versions\n   * (`stock@5,orders@2`). A shared section renders once per such change, and\n   * every tab asking with the same one gets that render.\n   */\n  changedBy: 'X-RSC-Changed',\n  /** The stream a tab hears on when a name its page refreshes on has changed. */\n  changesPath: '/_rsc/changes',\n  /** Whether this renderer can serve: up, and its backend answering. GET only, never cached. */\n  healthPath: '/_rsc/health',\n} as const\n\n/** Flight payload. */\nexport const FLIGHT_TYPE = 'text/x-component; charset=utf-8'\n\n/** A rendered document. */\nexport const HTML_TYPE = 'text/html; charset=utf-8'\n\n/**\n * Every request header that changes what a response body contains.\n *\n * One url answers with a whole document, a partial payload, a named region or\n * an interceptor depending on these — so a cache keyed on the url alone, or on\n * `X-RSC` alone, will hand one client another's answer. They are materially\n * different bodies, not variations in presentation.\n */\nexport const VARY_ON_RSC = [\n  HEADER.rsc,\n  HEADER.segments,\n  HEADER.revalidate,\n  HEADER.intercept,\n  HEADER.referer,\n].join(', ')\n\n/**\n * What a response says about being stored, when it must not be.\n *\n * `Vary` alone is not enough on the platform this targets. Cloudflare ignores\n * `Vary` for everything except `Accept-Encoding`, and this package ships a\n * Workers story as a headline feature — so one url answering with a document,\n * a Flight payload, a segment and an interceptor, keyed only on the url, hands\n * one visitor another's body. Anything narrowed by a request header, and\n * anything behind a guard, says outright that it is not to be stored.\n */\nexport const PER_CLIENT = 'private, no-store'\n\n/**\n * And what a frozen, unguarded page says.\n *\n * Explicit rather than absent: with no directive at all, whether an\n * intermediary stores it comes down to that intermediary's heuristics, which\n * is not a decision this package should be leaving to chance in either\n * direction.\n */\nexport const REVALIDATE = 'public, max-age=0, must-revalidate'\n\n/**\n * And what a page rendered for one request says.\n *\n * It may have read the visitor's cookies, and nothing in the headers - which\n * leave before the render has finished - can know whether it did. So a shared\n * cache may not keep it; the visitor's own browser may, and must ask again.\n */\nexport const PER_REQUEST = 'private, max-age=0, must-revalidate'\n"]}
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,0EAA0E;AAC1E,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,gCAAgC;AAChC,EAAE;AACF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB;;;OAGG;IACH,GAAG,EAAE,OAAO;IAEZ,iFAAiF;IACjF,QAAQ,EAAE,gBAAgB;IAE1B,kEAAkE;IAClE,YAAY,EAAE,qBAAqB;IAEnC,wCAAwC;IACxC,OAAO,EAAE,eAAe;IAExB;;;OAGG;IACH,IAAI,EAAE,YAAY;IAElB,gFAAgF;IAChF,OAAO,EAAE,eAAe;IAExB,uDAAuD;IACvD,SAAS,EAAE,iBAAiB;IAE5B,gDAAgD;IAChD,OAAO,EAAE,eAAe;IAExB,uEAAuE;IACvE,UAAU,EAAE,kBAAkB;IAE9B,0CAA0C;IAC1C,MAAM,EAAE,cAAc;IAEtB;;;;;;;OAOG;IACH,QAAQ,EAAE,gBAAgB;IAE1B;;;;;;OAMG;IACH,WAAW,EAAE,oBAAoB;IAEjC;;;;;OAKG;IACH,UAAU,EAAE,cAAc;IAC1B;;;;;;;;;OASG;IACH;;;;;;;OAOG;IACH,KAAK,EAAE,aAAa;IAEpB,SAAS,EAAE,aAAa;IACxB,mEAAmE;IACnE,YAAY,EAAE,iBAAiB;IAC/B,uDAAuD;IACvD,aAAa,EAAE,kBAAkB;IACjC;;;;OAIG;IACH,SAAS,EAAE,eAAe;IAC1B,+EAA+E;IAC/E,WAAW,EAAE,eAAe;IAC5B,8FAA8F;IAC9F,UAAU,EAAE,cAAc;CAClB,CAAA;AAEV,sBAAsB;AACtB,MAAM,CAAC,MAAM,WAAW,GAAG,iCAAiC,CAAA;AAE5D,2BAA2B;AAC3B,MAAM,CAAC,MAAM,SAAS,GAAG,0BAA0B,CAAA;AAEnD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM,CAAC,GAAG;IACV,MAAM,CAAC,QAAQ;IACf,MAAM,CAAC,UAAU;IACjB,MAAM,CAAC,SAAS;IAChB,MAAM,CAAC,OAAO;CACf,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,mBAAmB,CAAA;AAE7C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,oCAAoC,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,qCAAqC,CAAA","sourcesContent":["// The wire protocol, as names rather than string literals.\n//\n// A host writing these out by hand is how they drift. Two of them are not\n// negotiable at all — the client sends them or asks for them at fixed\n// addresses, and a host that spells one differently fails silently: the\n// request falls through, the decoder never runs, and a button does nothing\n// with no error on either side.\n//\n// PROTOCOL.md describes what each one means. This is the same list, importable.\n\nexport const HEADER = {\n  /**\n   * Present on a request for a Flight payload rather than the document. One\n   * url serves both, which is why every answer must Vary on it.\n   */\n  rsc: 'X-RSC',\n\n  /** The layout chain the client has mounted, outermost first, comma-separated. */\n  segments: 'X-RSC-Segments',\n\n  /** The boundary the answer replaces. 0 means a whole document. */\n  segmentDepth: 'X-RSC-Segment-Depth',\n\n  /** The chain to send back next time. */\n  layouts: 'X-RSC-Layouts',\n\n  /**\n   * On the boot fetch: the token the document carried, redeeming the payload\n   * its own render kept. See bootPayloads.ts.\n   */\n  boot: 'X-RSC-Boot',\n\n  /** Identifies the build, so a client can notice it is talking to an old one. */\n  version: 'X-RSC-Version',\n\n  /** The slot an intercepted navigation is targeting. */\n  intercept: 'X-RSC-Intercept',\n\n  /** Where the navigation or action came from. */\n  referer: 'X-RSC-Referer',\n\n  /** One named region of the current page to render and return alone. */\n  revalidate: 'X-RSC-Revalidate',\n\n  /** The server reference being invoked. */\n  action: 'X-RSC-Action',\n\n  /**\n   * Go here instead.\n   *\n   * Used for a redirect the client has to perform itself: a failed action, and\n   * a navigation whose render redirected. Never a 3xx for those — `fetch`\n   * follows one transparently, so the client would get the destination's HTML\n   * where it expected a Flight payload and decode it as one.\n   */\n  redirect: 'X-RSC-Redirect',\n\n  /**\n   * The body's real type.\n   *\n   * The body itself goes out as application/octet-stream so a host that parses\n   * multipart cannot consume it before the action does — reading Content-Type\n   * instead leaves an upload undecodable.\n   */\n  contentType: 'X-RSC-Content-Type',\n\n  /**\n   * Where the browser posts server actions.\n   *\n   * Not a convention this can choose: the client runtime posts here\n   * unconditionally.\n   */\n  actionPath: '/_rsc/action',\n  /**\n   * Where the browser reads queries.\n   *\n   * A GET, and that is the whole point of it being a separate address: a POST\n   * is cacheable by nothing, so a read routed through the action endpoint can\n   * never be kept by an HTTP cache, a CDN or a service worker. Only functions\n   * declared with `query()` are reachable here — the endpoint checks the mark\n   * before invoking anything, because otherwise this address would run any\n   * registered action over GET.\n   */\n  /**\n   * Sent on every read, and required by the query endpoint.\n   *\n   * A GET with no unusual header is a simple request, so any page could\n   * trigger one with an <img> and the visitor's cookies would ride along.\n   * This header is not CORS-safelisted, so the browser preflights it — the\n   * same thing that makes a POST carrying X-RSC-Action safe.\n   */\n  query: 'X-RSC-Query',\n\n  queryPath: '/_rsc/query',\n  /** Build-time shell for a PPR route, for an edge cache to hold. */\n  pprShellPath: '/_rsc/ppr-shell',\n  /** Finish a shell an edge cache is already serving. */\n  pprResumePath: '/_rsc/ppr-resume',\n  /**\n   * On a refresh a change triggered: which names moved, to which versions\n   * (`stock@5,orders@2`). A shared section renders once per such change, and\n   * every tab asking with the same one gets that render.\n   */\n  changedBy: 'X-RSC-Changed',\n  /** The stream a tab hears on when a name its page refreshes on has changed. */\n  changesPath: '/_rsc/changes',\n  /** Whether this renderer can serve: up, and its backend answering. GET only, never cached. */\n  healthPath: '/_rsc/health',\n} as const\n\n/** Flight payload. */\nexport const FLIGHT_TYPE = 'text/x-component; charset=utf-8'\n\n/** A rendered document. */\nexport const HTML_TYPE = 'text/html; charset=utf-8'\n\n/**\n * Every request header that changes what a response body contains.\n *\n * One url answers with a whole document, a partial payload, a named region or\n * an interceptor depending on these — so a cache keyed on the url alone, or on\n * `X-RSC` alone, will hand one client another's answer. They are materially\n * different bodies, not variations in presentation.\n */\nexport const VARY_ON_RSC = [\n  HEADER.rsc,\n  HEADER.segments,\n  HEADER.revalidate,\n  HEADER.intercept,\n  HEADER.referer,\n].join(', ')\n\n/**\n * What a response says about being stored, when it must not be.\n *\n * `Vary` alone is not enough on the platform this targets. Cloudflare ignores\n * `Vary` for everything except `Accept-Encoding`, and this package ships a\n * Workers story as a headline feature — so one url answering with a document,\n * a Flight payload, a segment and an interceptor, keyed only on the url, hands\n * one visitor another's body. Anything narrowed by a request header, and\n * anything behind a guard, says outright that it is not to be stored.\n */\nexport const PER_CLIENT = 'private, no-store'\n\n/**\n * And what a frozen, unguarded page says.\n *\n * Explicit rather than absent: with no directive at all, whether an\n * intermediary stores it comes down to that intermediary's heuristics, which\n * is not a decision this package should be leaving to chance in either\n * direction.\n */\nexport const REVALIDATE = 'public, max-age=0, must-revalidate'\n\n/**\n * And what a page rendered for one request says.\n *\n * It may have read the visitor's cookies, and nothing in the headers - which\n * leave before the render has finished - can know whether it did. So a shared\n * cache may not keep it; the visitor's own browser may, and must ask again.\n */\nexport const PER_REQUEST = 'private, max-age=0, must-revalidate'\n"]}

package/dist/host.d.ts

@@ -36,6 +36,14 @@ export interface RscEngine {
         props: Record<string, unknown>;
     }[], loadings?: string[], parallelSlots?: Record<string, string>, slotOverrides?: Record<string, unknown>, nonce?: string, pageKey?: string, bootstrap?: boolean): Promise<{
         htmlStream: ReadableStream;
+        /**
+         * The same render as a Flight payload, and the token the document
+         * carries for it. The host holds the one under the other for the boot
+         * fetch - see bootPayloads.ts. An engine built before this answers
+         * without them, and every boot renders, as it used to.
+         */
+        rscPayload?: ReadableStream;
+        bootToken?: string;
     }>;
     /**
      * A form posted to the page's own url before the page had a runtime to
@@ -77,21 +85,14 @@ export interface RscEngine {
          * filled here - see `unresumable` below.
          */
         replayed?: () => boolean;
+        /** The render as a payload, for the boot fetch; see handleRscHtmlStream. */
+        rscPayload?: ReadableStream;
     }>;
     handleRscRevalidate?(target: string, page: unknown, 
     /** Set on a refresh a change triggered: a shared section renders once per key. */
     share?: string): Promise<{
         rscPayload: string;
     }>;
-    /**
-     * The page's metadata for these params, merged with its layouts'. Used to
-     * put the real title into a shell stored for a whole pattern, whose build
-     * could not know the url.
-     */
-    resolveMetadata?(component: string, props?: Record<string, unknown>, layouts?: {
-        component: string;
-        props: Record<string, unknown>;
-    }[]): Promise<Record<string, unknown> | null>;
     /**
      * Run a route's middleware without rendering anything.
      *

package/dist/host.js

@@ -47,12 +47,13 @@ export function pageSaidNotFound(request) {
     return notFoundRequests.has(request);
 }
 export { revalidate } from "./revalidate.js";
+import { isCrawler } from "./crawler.js";
+import { bootToken, holdBootPayload, takeBootPayload } from "./bootPayloads.js";
 import { currentNotFound, withRedirect } from "./redirect.js";
 import { compressed } from "./compress.js";
 import { withCache } from "./cache.js";
 import { takeAfterWork, withRequest, withResponseDraft } from "./request.js";
 import { criticalAssetsOf, linkHeader, mergeAssets } from "./earlyHints.js";
-import { withHead } from "./shellHead.js";
 /**
  * @internal For a host adapter that embeds the engine. An app imports this
  * from `@rsc-kit/core/redirect` - the one the guides teach, and the one an
@@ -123,6 +124,16 @@ function redirectResponse(to, isPayloadRequest) {
         headers: { Location: to.location, Vary: VARY_ON_RSC },
     });
 }
+/**
+ * What a page that said notFound() after its status line had gone out ends
+ * with: 200 is spent, so the document asks not to be indexed instead - a
+ * not-found page that a search engine keeps as a real one is a soft 404.
+ * The tag, then a script that moves it into <head>, where a crawler that
+ * runs the page reads it; a crawler that does not run it is answered with
+ * the whole document and a real 404 - see `forCrawler`.
+ */
+const LATE_NOINDEX = '<meta name="robots" content="noindex">' +
+    "<script>document.head.appendChild(document.currentScript.previousSibling)</script>";
 /**
  * Append the redirect a render asked for after its shell had already gone out.
  *
@@ -134,7 +145,7 @@ function redirectResponse(to, isPayloadRequest) {
  * Read on flush, because that is when the render has finished and a redirect
  * from inside a Suspense boundary is finally known.
  */
-function appendLateRedirect(stream, taken) {
+function appendLateRedirect(stream, taken, missing = () => false) {
     // An engine that answered with a finished body rather than a stream has no
     // late window at all: the render was over before this was called, so the
     // caller's own check already saw everything there was to see.
@@ -158,6 +169,9 @@ function appendLateRedirect(stream, taken) {
             if (to) {
                 controller.enqueue(encoder.encode(`<script>location.replace(${inScript(to.location)})</script>`));
             }
+            else if (missing()) {
+                controller.enqueue(encoder.encode(LATE_NOINDEX));
+            }
             controller.close();
         },
         cancel(reason) {
@@ -474,6 +488,16 @@ export function createRscHandler(options) {
     const identify = Boolean(manifest.build?.identify);
     /** How a response was answered, for X-RSC-Kit: a file the build wrote, or a shell of one. */
     const servedFrom = new WeakMap();
+    /** Whether a stored shell carries a script - a runtime that will boot. Read once per shell. */
+    const bootsByKey = new Map();
+    function shellBoots(key, shell) {
+        let boots = bootsByKey.get(key);
+        if (boots === undefined) {
+            boots = shell.includes("<script");
+            bootsByKey.set(key, boots);
+        }
+        return boots;
+    }
     /** What a stored document's head names, read once per file, for the Link header. */
     const hinted = new WeakMap();
     /**
@@ -846,20 +870,31 @@ export function createRscHandler(options) {
         if (request.headers.get(HEADER.rsc) === null) {
             // Scoped to this render, so two requests redirecting at once cannot read
             // each other's destination.
-            return await withRedirect(async (taken) => {
+            return await withRedirect(async (taken, missing) => {
                 // Awaited, and that await is the whole design: React resolves this
                 // when the SHELL is ready, so a redirect thrown above every Suspense
                 // boundary rejects here — before a byte is written, with a status line
                 // still available. Nothing is buffered to make that true.
                 let htmlStream;
+                // The render's payload and the token the document carries for it.
+                // Held for the boot fetch when the document goes out as a 200;
+                // let go on every other exit, or the tee buffers it for nothing.
+                let rscPayload;
+                let token;
+                const letGo = () => void rscPayload?.cancel().catch(() => { });
                 try {
-                    ({ htmlStream } = formPost
+                    const rendered = formPost
                         ? await engine.handleRscFormPost(match.route.component, props, layouts, match.route.loadings, match.route.slots, {}, undefined, url.pathname, true, formPost)
                         : await engine.handleRscHtmlStream(match.route.component, props, layouts, match.route.loadings, match.route.slots, {}, undefined, url.pathname, 
                         // A route that ships no runtime gets no bootstrap and no segment
                         // boundary — the boundary is itself a client component, so leaving
                         // it in means no page could ever be JS-free.
-                        true));
+                        true);
+                    htmlStream = rendered.htmlStream;
+                    // Not after a post: the answer to one is the result of something
+                    // that happened once, and a payload of it is not a page to keep.
+                    if (!formPost)
+                        ({ rscPayload, bootToken: token } = rendered);
                 }
                 catch (error) {
                     // A rejected shell is how a redirect above every boundary arrives:
@@ -893,15 +928,28 @@ export function createRscHandler(options) {
                     throw error;
                 }
                 const early = taken();
-                if (early)
+                if (early) {
+                    letGo();
                     return redirectResponse(early, false);
+                }
                 // Above every boundary, so the shell resolving means the page did not
                 // refuse itself. Deeper than that and the shell is already on the wire
                 // — the digest carries it to the boundary instead, and the status
                 // stays 200 because the status line has gone.
-                if (currentNotFound())
+                if (currentNotFound()) {
+                    letGo();
                     return saidNotFound(request);
-                return new Response(appendLateRedirect(htmlStream, taken), {
+                }
+                if (rscPayload && token) {
+                    holdBootPayload(token, rscPayload, {
+                        [HEADER.segmentDepth]: "0",
+                        [HEADER.layouts]: chain.join(","),
+                    });
+                }
+                else {
+                    letGo();
+                }
+                return new Response(appendLateRedirect(htmlStream, taken, missing), {
                     headers: withVersion({
                         "Content-Type": HTML_TYPE,
                         [HEADER.layouts]: chain.join(","),
@@ -919,6 +967,27 @@ export function createRscHandler(options) {
                 });
             });
         }
+        // The boot fetch, redeeming the payload its own document's render kept:
+        // answered from it, nothing rendered, the guard already passed by the
+        // render that made it a moment ago for this same browser. A token not
+        // held - expired, another isolate, an older document - falls through to
+        // the render every boot used to be. See bootPayloads.ts.
+        const redeeming = request.headers.get(HEADER.boot);
+        if (redeeming !== null && request.headers.get(HEADER.segments) === null) {
+            const kept = takeBootPayload(redeeming);
+            if (kept) {
+                const answer = new Response(kept.payload, {
+                    headers: withVersion({
+                        "Content-Type": FLIGHT_TYPE,
+                        ...kept.headers,
+                        Vary: VARY_ON_RSC,
+                        "Cache-Control": PER_CLIENT,
+                    }),
+                });
+                servedFrom.set(answer, "held");
+                return answer;
+            }
+        }
         const from = sharedDepth(request.headers.get(HEADER.segments), chain);
         // A boot - X-RSC and no segments - of a document served from a pattern
         // shell: the shell was rendered for no url, and the client hydrates
@@ -1276,6 +1345,11 @@ export function createRscHandler(options) {
                     "whole instead. Rebuild the prerendered output with the server bundle - a cached .output is the usual cause.");
                 return null;
             }
+            // A crawler is answered with the finished page, rendered now: a shell
+            // has gone out with its 200 before its holes know whether the page
+            // exists. See crawler.ts.
+            if (isCrawler(request.headers.get("user-agent")))
+                return null;
             // A shell with no state cannot be finished by anyone. It was frozen with
             // its fallbacks showing and there is no record of what came next, so
             // serving it would be serving a page that stays on its loading state for
@@ -1294,33 +1368,57 @@ export function createRscHandler(options) {
             const forShape = shellKey === key
                 ? route.params
                 : Object.fromEntries(Object.keys(route.params).map((name) => [name, PARAM_PLACEHOLDER]));
-            const { htmlStream, replayed } = await engine.handleRscResume(route.route.component, forShape, 
-            // Empty props, because that is what the build passed. Resuming replays
-            // the tree against the slots the shell left, and React matches those by
-            // key — so an argument that differs from the frozen render at all is a
-            // tree that "doesn't match", and every boundary falls back to the
-            // client instead of being filled here.
-            route.route.layouts.map((component) => ({ component, props: {} })), route.route.loadings, route.route.slots, {}, JSON.parse(state), undefined, 
-            // A shell found under the route's pattern was frozen for no particular
-            // url, so it was rendered with no page key. Handing one over now would
-            // key the tree differently from the one being resumed.
-            shellKey === key ? url.pathname : "", 
-            // But the url itself, for the hooks: the holes are rendered for it.
-            url.pathname, route.params);
-            // A shell stored for the pattern was built without a url, so its title
-            // is the layouts' - the page's generateMetadata reads the params and
-            // was left out. This request has the params.
-            const served = shellKey === key || !engine.resolveMetadata
-                ? shell
-                : withHead(shell, await engine
-                    .resolveMetadata(route.route.component, route.params, route.route.layouts.map((component) => ({ component, props: {} })))
-                    .catch(() => null));
+            // In a render scope, so a notFound() in a hole is recorded for the
+            // stream's end - see LATE_NOINDEX.
+            let missing = () => false;
+            const resume = engine.handleRscResume;
+            const { htmlStream, replayed, rscPayload } = await withRedirect((_, said) => {
+                missing = said;
+                return resume(route.route.component, forShape, 
+                // Empty props, because that is what the build passed. Resuming replays
+                // the tree against the slots the shell left, and React matches those by
+                // key — so an argument that differs from the frozen render at all is a
+                // tree that "doesn't match", and every boundary falls back to the
+                // client instead of being filled here.
+                route.route.layouts.map((component) => ({ component, props: {} })), route.route.loadings, route.route.slots, {}, JSON.parse(state), undefined, 
+                // A shell found under the route's pattern was frozen for no particular
+                // url, so it was rendered with no page key. Handing one over now would
+                // key the tree differently from the one being resumed.
+                shellKey === key ? url.pathname : "", 
+                // But the url itself, for the hooks: the holes are rendered for it.
+                url.pathname, route.params);
+            });
+            // A shell stored for the pattern has no title of the page's: its
+            // generateMetadata streamed under its own boundary, the probe left that
+            // a hole, and the resume fills it with the real one. Nothing is looked
+            // up before the shell leaves.
+            //
+            // The render's payload, kept for the boot fetch under a token written
+            // right after the shell - the shell is a build artifact, so the token
+            // cannot be in it. Only a shell that carries a script boots a runtime
+            // that will come back for one. A pattern shell's resume renders with
+            // no page key, so React can line its slots up; the client files the
+            // page under the url it is at when the payload carries none - see
+            // SegmentBoundary. See bootPayloads.ts.
+            const token = rscPayload && shellBoots(shellKey, shell) ? bootToken() : null;
+            if (token) {
+                holdBootPayload(token, rscPayload, {
+                    [HEADER.segmentDepth]: "0",
+                    [HEADER.layouts]: layoutChain(route.route.layouts, route.params).join(","),
+                });
+            }
+            else {
+                void rscPayload?.cancel().catch(() => { });
+            }
             // The shell first, then whatever the resume writes. React's own script
             // travels with the resumed segments and moves them into place, so this is
             // a plain concatenation and the holes land without hydration.
             const body = new ReadableStream({
                 async start(controller) {
-                    controller.enqueue(new TextEncoder().encode(served));
+                    controller.enqueue(new TextEncoder().encode(shell));
+                    if (token) {
+                        controller.enqueue(new TextEncoder().encode("<script>self.__rsc_boot=" + JSON.stringify(token) + "</script>"));
+                    }
                     const reader = htmlStream.getReader();
                     try {
                         while (true) {
@@ -1329,6 +1427,8 @@ export function createRscHandler(options) {
                                 break;
                             controller.enqueue(value);
                         }
+                        if (missing())
+                            controller.enqueue(new TextEncoder().encode(LATE_NOINDEX));
                     }
                     finally {
                         controller.close();