@rsc-kit/core 0.29.9 → 0.29.10

package/dist/bootPayloads.d.ts

@@ -0,0 +1,18 @@
+/** How long a payload waits for its browser. */
+export declare const BOOT_HOLD_MS = 10000;
+export interface HeldPayload {
+    payload: ReadableStream;
+    /** The headers the boot answer carries beside the payload: the layout chain, the depth. */
+    headers: Record<string, string>;
+    at: number;
+}
+/** A token no one can guess: 128 bits, url-safe. */
+export declare function bootToken(): string;
+/** Keep a render's payload for the boot fetch that follows its document. */
+export declare function holdBootPayload(token: string, payload: ReadableStream, headers: Record<string, string>, now?: number): void;
+/** The payload for a token, once. Null for a token not held, redeemed or expired. */
+export declare function takeBootPayload(token: string, now?: number): HeldPayload | null;
+/** How many are held, for tests. */
+export declare function heldBootPayloads(): number;
+/** Forget everything, for tests. */
+export declare function clearBootPayloads(): void;

package/dist/bootPayloads.js

@@ -0,0 +1,81 @@
+// One render per visit.
+//
+// Hydrating server components needs the serialised tree, not the HTML, and a
+// document does not carry its own payload - inlined, decode and hydration
+// become one long task (#231). So the client fetches it, and that fetch used
+// to render the whole page a second time: the same reads, the same queries,
+// a moment after the document's render had made exactly that payload and
+// thrown it away.
+//
+// Now the document's render keeps its payload here for the few seconds it
+// takes the browser to come back for it, under a token written into the
+// document that only that browser holds. The boot fetch redeems the token
+// and is answered with the payload the document was made from - which is
+// also the one it should hydrate against: two renders a moment apart could
+// disagree, and the one that made the HTML cannot.
+//
+// A token is redeemed once. A payload nobody comes back for - a route with
+// no runtime, a browser that left, a Worker isolate other than the one that
+// rendered - is cancelled when it expires, and the boot fetch that misses
+// renders as it always did. Missing costs a render; it never costs a wrong
+// answer.
+/** How long a payload waits for its browser. */
+export const BOOT_HOLD_MS = 10_000;
+/** At most this many held at once; the oldest is dropped first. */
+const MAX_HELD = 500;
+const held = new Map();
+/** A token no one can guess: 128 bits, url-safe. */
+export function bootToken() {
+    const bytes = new Uint8Array(16);
+    crypto.getRandomValues(bytes);
+    let out = "";
+    for (const b of bytes)
+        out += b.toString(16).padStart(2, "0");
+    return out;
+}
+/** Keep a render's payload for the boot fetch that follows its document. */
+export function holdBootPayload(token, payload, headers, now = Date.now()) {
+    sweep(now);
+    if (held.size >= MAX_HELD) {
+        const oldest = held.keys().next().value;
+        if (oldest !== undefined)
+            drop(oldest);
+    }
+    held.set(token, { payload, headers, at: now });
+}
+/** The payload for a token, once. Null for a token not held, redeemed or expired. */
+export function takeBootPayload(token, now = Date.now()) {
+    const found = held.get(token);
+    if (!found)
+        return null;
+    held.delete(token);
+    if (now - found.at >= BOOT_HOLD_MS) {
+        void found.payload.cancel().catch(() => { });
+        return null;
+    }
+    return found;
+}
+/** Let go of what nobody came back for. */
+function sweep(now) {
+    for (const [token, entry] of held) {
+        if (now - entry.at < BOOT_HOLD_MS)
+            break;
+        drop(token);
+    }
+}
+function drop(token) {
+    const entry = held.get(token);
+    held.delete(token);
+    if (entry)
+        void entry.payload.cancel().catch(() => { });
+}
+/** How many are held, for tests. */
+export function heldBootPayloads() {
+    return held.size;
+}
+/** Forget everything, for tests. */
+export function clearBootPayloads() {
+    for (const token of [...held.keys()])
+        drop(token);
+}
+//# sourceMappingURL=bootPayloads.js.map

package/dist/bootPayloads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootPayloads.js","sourceRoot":"","sources":["../src/bootPayloads.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,kBAAkB;AAClB,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,mDAAmD;AACnD,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,UAAU;AAEV,gDAAgD;AAChD,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAEnC,mEAAmE;AACnE,MAAM,QAAQ,GAAG,GAAG,CAAC;AASrB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;AAE5C,oDAAoD;AACpD,MAAM,UAAU,SAAS;IACvB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAEjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAE9B,IAAI,GAAG,GAAG,EAAE,CAAC;IAEb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAE9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,OAAuB,EACvB,OAA+B,EAC/B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,KAAK,CAAC,GAAG,CAAC,CAAC;IAEX,IAAI,IAAI,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAExC,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnB,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE,IAAI,YAAY,EAAE,CAAC;QACnC,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAE5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2CAA2C;AAC3C,SAAS,KAAK,CAAC,GAAW;IACxB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE,GAAG,YAAY;YAAE,MAAM;QAEzC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnB,IAAI,KAAK;QAAE,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,iBAAiB;IAC/B,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAAE,IAAI,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC","sourcesContent":["// One render per visit.\n//\n// Hydrating server components needs the serialised tree, not the HTML, and a\n// document does not carry its own payload - inlined, decode and hydration\n// become one long task (#231). So the client fetches it, and that fetch used\n// to render the whole page a second time: the same reads, the same queries,\n// a moment after the document's render had made exactly that payload and\n// thrown it away.\n//\n// Now the document's render keeps its payload here for the few seconds it\n// takes the browser to come back for it, under a token written into the\n// document that only that browser holds. The boot fetch redeems the token\n// and is answered with the payload the document was made from - which is\n// also the one it should hydrate against: two renders a moment apart could\n// disagree, and the one that made the HTML cannot.\n//\n// A token is redeemed once. A payload nobody comes back for - a route with\n// no runtime, a browser that left, a Worker isolate other than the one that\n// rendered - is cancelled when it expires, and the boot fetch that misses\n// renders as it always did. Missing costs a render; it never costs a wrong\n// answer.\n\n/** How long a payload waits for its browser. */\nexport const BOOT_HOLD_MS = 10_000;\n\n/** At most this many held at once; the oldest is dropped first. */\nconst MAX_HELD = 500;\n\nexport interface HeldPayload {\n  payload: ReadableStream;\n  /** The headers the boot answer carries beside the payload: the layout chain, the depth. */\n  headers: Record<string, string>;\n  at: number;\n}\n\nconst held = new Map<string, HeldPayload>();\n\n/** A token no one can guess: 128 bits, url-safe. */\nexport function bootToken(): string {\n  const bytes = new Uint8Array(16);\n\n  crypto.getRandomValues(bytes);\n\n  let out = \"\";\n\n  for (const b of bytes) out += b.toString(16).padStart(2, \"0\");\n\n  return out;\n}\n\n/** Keep a render's payload for the boot fetch that follows its document. */\nexport function holdBootPayload(\n  token: string,\n  payload: ReadableStream,\n  headers: Record<string, string>,\n  now = Date.now(),\n): void {\n  sweep(now);\n\n  if (held.size >= MAX_HELD) {\n    const oldest = held.keys().next().value;\n\n    if (oldest !== undefined) drop(oldest);\n  }\n\n  held.set(token, { payload, headers, at: now });\n}\n\n/** The payload for a token, once. Null for a token not held, redeemed or expired. */\nexport function takeBootPayload(token: string, now = Date.now()): HeldPayload | null {\n  const found = held.get(token);\n\n  if (!found) return null;\n\n  held.delete(token);\n\n  if (now - found.at >= BOOT_HOLD_MS) {\n    void found.payload.cancel().catch(() => {});\n\n    return null;\n  }\n\n  return found;\n}\n\n/** Let go of what nobody came back for. */\nfunction sweep(now: number): void {\n  for (const [token, entry] of held) {\n    if (now - entry.at < BOOT_HOLD_MS) break;\n\n    drop(token);\n  }\n}\n\nfunction drop(token: string): void {\n  const entry = held.get(token);\n\n  held.delete(token);\n\n  if (entry) void entry.payload.cancel().catch(() => {});\n}\n\n/** How many are held, for tests. */\nexport function heldBootPayloads(): number {\n  return held.size;\n}\n\n/** Forget everything, for tests. */\nexport function clearBootPayloads(): void {\n  for (const token of [...held.keys()]) drop(token);\n}\n"]}

package/dist/headers.d.ts

@@ -10,6 +10,11 @@ export declare const HEADER: {
     readonly segmentDepth: 'X-RSC-Segment-Depth';
     /** The chain to send back next time. */
     readonly layouts: 'X-RSC-Layouts';
+    /**
+     * On the boot fetch: the token the document carried, redeeming the payload
+     * its own render kept. See bootPayloads.ts.
+     */
+    readonly boot: 'X-RSC-Boot';
     /** Identifies the build, so a client can notice it is talking to an old one. */
     readonly version: 'X-RSC-Version';
     /** The slot an intercepted navigation is targeting. */

package/dist/headers.js

@@ -19,6 +19,11 @@ export const HEADER = {
     segmentDepth: 'X-RSC-Segment-Depth',
     /** The chain to send back next time. */
     layouts: 'X-RSC-Layouts',
+    /**
+     * On the boot fetch: the token the document carried, redeeming the payload
+     * its own render kept. See bootPayloads.ts.
+     */
+    boot: 'X-RSC-Boot',
     /** Identifies the build, so a client can notice it is talking to an old one. */
     version: 'X-RSC-Version',
     /** The slot an intercepted navigation is targeting. */

package/dist/headers.js.map

@@ -1 +1 @@
-{"version":3,"file":"headers.js","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,0EAA0E;AAC1E,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,gCAAgC;AAChC,EAAE;AACF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB;;;OAGG;IACH,GAAG,EAAE,OAAO;IAEZ,iFAAiF;IACjF,QAAQ,EAAE,gBAAgB;IAE1B,kEAAkE;IAClE,YAAY,EAAE,qBAAqB;IAEnC,wCAAwC;IACxC,OAAO,EAAE,eAAe;IAExB,gFAAgF;IAChF,OAAO,EAAE,eAAe;IAExB,uDAAuD;IACvD,SAAS,EAAE,iBAAiB;IAE5B,gDAAgD;IAChD,OAAO,EAAE,eAAe;IAExB,uEAAuE;IACvE,UAAU,EAAE,kBAAkB;IAE9B,0CAA0C;IAC1C,MAAM,EAAE,cAAc;IAEtB;;;;;;;OAOG;IACH,QAAQ,EAAE,gBAAgB;IAE1B;;;;;;OAMG;IACH,WAAW,EAAE,oBAAoB;IAEjC;;;;;OAKG;IACH,UAAU,EAAE,cAAc;IAC1B;;;;;;;;;OASG;IACH;;;;;;;OAOG;IACH,KAAK,EAAE,aAAa;IAEpB,SAAS,EAAE,aAAa;IACxB,mEAAmE;IACnE,YAAY,EAAE,iBAAiB;IAC/B,uDAAuD;IACvD,aAAa,EAAE,kBAAkB;IACjC;;;;OAIG;IACH,SAAS,EAAE,eAAe;IAC1B,+EAA+E;IAC/E,WAAW,EAAE,eAAe;IAC5B,8FAA8F;IAC9F,UAAU,EAAE,cAAc;CAClB,CAAA;AAEV,sBAAsB;AACtB,MAAM,CAAC,MAAM,WAAW,GAAG,iCAAiC,CAAA;AAE5D,2BAA2B;AAC3B,MAAM,CAAC,MAAM,SAAS,GAAG,0BAA0B,CAAA;AAEnD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM,CAAC,GAAG;IACV,MAAM,CAAC,QAAQ;IACf,MAAM,CAAC,UAAU;IACjB,MAAM,CAAC,SAAS;IAChB,MAAM,CAAC,OAAO;CACf,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,mBAAmB,CAAA;AAE7C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,oCAAoC,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,qCAAqC,CAAA","sourcesContent":["// The wire protocol, as names rather than string literals.\n//\n// A host writing these out by hand is how they drift. Two of them are not\n// negotiable at all — the client sends them or asks for them at fixed\n// addresses, and a host that spells one differently fails silently: the\n// request falls through, the decoder never runs, and a button does nothing\n// with no error on either side.\n//\n// PROTOCOL.md describes what each one means. This is the same list, importable.\n\nexport const HEADER = {\n  /**\n   * Present on a request for a Flight payload rather than the document. One\n   * url serves both, which is why every answer must Vary on it.\n   */\n  rsc: 'X-RSC',\n\n  /** The layout chain the client has mounted, outermost first, comma-separated. */\n  segments: 'X-RSC-Segments',\n\n  /** The boundary the answer replaces. 0 means a whole document. */\n  segmentDepth: 'X-RSC-Segment-Depth',\n\n  /** The chain to send back next time. */\n  layouts: 'X-RSC-Layouts',\n\n  /** Identifies the build, so a client can notice it is talking to an old one. */\n  version: 'X-RSC-Version',\n\n  /** The slot an intercepted navigation is targeting. */\n  intercept: 'X-RSC-Intercept',\n\n  /** Where the navigation or action came from. */\n  referer: 'X-RSC-Referer',\n\n  /** One named region of the current page to render and return alone. */\n  revalidate: 'X-RSC-Revalidate',\n\n  /** The server reference being invoked. */\n  action: 'X-RSC-Action',\n\n  /**\n   * Go here instead.\n   *\n   * Used for a redirect the client has to perform itself: a failed action, and\n   * a navigation whose render redirected. Never a 3xx for those — `fetch`\n   * follows one transparently, so the client would get the destination's HTML\n   * where it expected a Flight payload and decode it as one.\n   */\n  redirect: 'X-RSC-Redirect',\n\n  /**\n   * The body's real type.\n   *\n   * The body itself goes out as application/octet-stream so a host that parses\n   * multipart cannot consume it before the action does — reading Content-Type\n   * instead leaves an upload undecodable.\n   */\n  contentType: 'X-RSC-Content-Type',\n\n  /**\n   * Where the browser posts server actions.\n   *\n   * Not a convention this can choose: the client runtime posts here\n   * unconditionally.\n   */\n  actionPath: '/_rsc/action',\n  /**\n   * Where the browser reads queries.\n   *\n   * A GET, and that is the whole point of it being a separate address: a POST\n   * is cacheable by nothing, so a read routed through the action endpoint can\n   * never be kept by an HTTP cache, a CDN or a service worker. Only functions\n   * declared with `query()` are reachable here — the endpoint checks the mark\n   * before invoking anything, because otherwise this address would run any\n   * registered action over GET.\n   */\n  /**\n   * Sent on every read, and required by the query endpoint.\n   *\n   * A GET with no unusual header is a simple request, so any page could\n   * trigger one with an <img> and the visitor's cookies would ride along.\n   * This header is not CORS-safelisted, so the browser preflights it — the\n   * same thing that makes a POST carrying X-RSC-Action safe.\n   */\n  query: 'X-RSC-Query',\n\n  queryPath: '/_rsc/query',\n  /** Build-time shell for a PPR route, for an edge cache to hold. */\n  pprShellPath: '/_rsc/ppr-shell',\n  /** Finish a shell an edge cache is already serving. */\n  pprResumePath: '/_rsc/ppr-resume',\n  /**\n   * On a refresh a change triggered: which names moved, to which versions\n   * (`stock@5,orders@2`). A shared section renders once per such change, and\n   * every tab asking with the same one gets that render.\n   */\n  changedBy: 'X-RSC-Changed',\n  /** The stream a tab hears on when a name its page refreshes on has changed. */\n  changesPath: '/_rsc/changes',\n  /** Whether this renderer can serve: up, and its backend answering. GET only, never cached. */\n  healthPath: '/_rsc/health',\n} as const\n\n/** Flight payload. */\nexport const FLIGHT_TYPE = 'text/x-component; charset=utf-8'\n\n/** A rendered document. */\nexport const HTML_TYPE = 'text/html; charset=utf-8'\n\n/**\n * Every request header that changes what a response body contains.\n *\n * One url answers with a whole document, a partial payload, a named region or\n * an interceptor depending on these — so a cache keyed on the url alone, or on\n * `X-RSC` alone, will hand one client another's answer. They are materially\n * different bodies, not variations in presentation.\n */\nexport const VARY_ON_RSC = [\n  HEADER.rsc,\n  HEADER.segments,\n  HEADER.revalidate,\n  HEADER.intercept,\n  HEADER.referer,\n].join(', ')\n\n/**\n * What a response says about being stored, when it must not be.\n *\n * `Vary` alone is not enough on the platform this targets. Cloudflare ignores\n * `Vary` for everything except `Accept-Encoding`, and this package ships a\n * Workers story as a headline feature — so one url answering with a document,\n * a Flight payload, a segment and an interceptor, keyed only on the url, hands\n * one visitor another's body. Anything narrowed by a request header, and\n * anything behind a guard, says outright that it is not to be stored.\n */\nexport const PER_CLIENT = 'private, no-store'\n\n/**\n * And what a frozen, unguarded page says.\n *\n * Explicit rather than absent: with no directive at all, whether an\n * intermediary stores it comes down to that intermediary's heuristics, which\n * is not a decision this package should be leaving to chance in either\n * direction.\n */\nexport const REVALIDATE = 'public, max-age=0, must-revalidate'\n\n/**\n * And what a page rendered for one request says.\n *\n * It may have read the visitor's cookies, and nothing in the headers - which\n * leave before the render has finished - can know whether it did. So a shared\n * cache may not keep it; the visitor's own browser may, and must ask again.\n */\nexport const PER_REQUEST = 'private, max-age=0, must-revalidate'\n"]}
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,0EAA0E;AAC1E,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,gCAAgC;AAChC,EAAE;AACF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB;;;OAGG;IACH,GAAG,EAAE,OAAO;IAEZ,iFAAiF;IACjF,QAAQ,EAAE,gBAAgB;IAE1B,kEAAkE;IAClE,YAAY,EAAE,qBAAqB;IAEnC,wCAAwC;IACxC,OAAO,EAAE,eAAe;IAExB;;;OAGG;IACH,IAAI,EAAE,YAAY;IAElB,gFAAgF;IAChF,OAAO,EAAE,eAAe;IAExB,uDAAuD;IACvD,SAAS,EAAE,iBAAiB;IAE5B,gDAAgD;IAChD,OAAO,EAAE,eAAe;IAExB,uEAAuE;IACvE,UAAU,EAAE,kBAAkB;IAE9B,0CAA0C;IAC1C,MAAM,EAAE,cAAc;IAEtB;;;;;;;OAOG;IACH,QAAQ,EAAE,gBAAgB;IAE1B;;;;;;OAMG;IACH,WAAW,EAAE,oBAAoB;IAEjC;;;;;OAKG;IACH,UAAU,EAAE,cAAc;IAC1B;;;;;;;;;OASG;IACH;;;;;;;OAOG;IACH,KAAK,EAAE,aAAa;IAEpB,SAAS,EAAE,aAAa;IACxB,mEAAmE;IACnE,YAAY,EAAE,iBAAiB;IAC/B,uDAAuD;IACvD,aAAa,EAAE,kBAAkB;IACjC;;;;OAIG;IACH,SAAS,EAAE,eAAe;IAC1B,+EAA+E;IAC/E,WAAW,EAAE,eAAe;IAC5B,8FAA8F;IAC9F,UAAU,EAAE,cAAc;CAClB,CAAA;AAEV,sBAAsB;AACtB,MAAM,CAAC,MAAM,WAAW,GAAG,iCAAiC,CAAA;AAE5D,2BAA2B;AAC3B,MAAM,CAAC,MAAM,SAAS,GAAG,0BAA0B,CAAA;AAEnD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM,CAAC,GAAG;IACV,MAAM,CAAC,QAAQ;IACf,MAAM,CAAC,UAAU;IACjB,MAAM,CAAC,SAAS;IAChB,MAAM,CAAC,OAAO;CACf,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,mBAAmB,CAAA;AAE7C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,oCAAoC,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,qCAAqC,CAAA","sourcesContent":["// The wire protocol, as names rather than string literals.\n//\n// A host writing these out by hand is how they drift. Two of them are not\n// negotiable at all — the client sends them or asks for them at fixed\n// addresses, and a host that spells one differently fails silently: the\n// request falls through, the decoder never runs, and a button does nothing\n// with no error on either side.\n//\n// PROTOCOL.md describes what each one means. This is the same list, importable.\n\nexport const HEADER = {\n  /**\n   * Present on a request for a Flight payload rather than the document. One\n   * url serves both, which is why every answer must Vary on it.\n   */\n  rsc: 'X-RSC',\n\n  /** The layout chain the client has mounted, outermost first, comma-separated. */\n  segments: 'X-RSC-Segments',\n\n  /** The boundary the answer replaces. 0 means a whole document. */\n  segmentDepth: 'X-RSC-Segment-Depth',\n\n  /** The chain to send back next time. */\n  layouts: 'X-RSC-Layouts',\n\n  /**\n   * On the boot fetch: the token the document carried, redeeming the payload\n   * its own render kept. See bootPayloads.ts.\n   */\n  boot: 'X-RSC-Boot',\n\n  /** Identifies the build, so a client can notice it is talking to an old one. */\n  version: 'X-RSC-Version',\n\n  /** The slot an intercepted navigation is targeting. */\n  intercept: 'X-RSC-Intercept',\n\n  /** Where the navigation or action came from. */\n  referer: 'X-RSC-Referer',\n\n  /** One named region of the current page to render and return alone. */\n  revalidate: 'X-RSC-Revalidate',\n\n  /** The server reference being invoked. */\n  action: 'X-RSC-Action',\n\n  /**\n   * Go here instead.\n   *\n   * Used for a redirect the client has to perform itself: a failed action, and\n   * a navigation whose render redirected. Never a 3xx for those — `fetch`\n   * follows one transparently, so the client would get the destination's HTML\n   * where it expected a Flight payload and decode it as one.\n   */\n  redirect: 'X-RSC-Redirect',\n\n  /**\n   * The body's real type.\n   *\n   * The body itself goes out as application/octet-stream so a host that parses\n   * multipart cannot consume it before the action does — reading Content-Type\n   * instead leaves an upload undecodable.\n   */\n  contentType: 'X-RSC-Content-Type',\n\n  /**\n   * Where the browser posts server actions.\n   *\n   * Not a convention this can choose: the client runtime posts here\n   * unconditionally.\n   */\n  actionPath: '/_rsc/action',\n  /**\n   * Where the browser reads queries.\n   *\n   * A GET, and that is the whole point of it being a separate address: a POST\n   * is cacheable by nothing, so a read routed through the action endpoint can\n   * never be kept by an HTTP cache, a CDN or a service worker. Only functions\n   * declared with `query()` are reachable here — the endpoint checks the mark\n   * before invoking anything, because otherwise this address would run any\n   * registered action over GET.\n   */\n  /**\n   * Sent on every read, and required by the query endpoint.\n   *\n   * A GET with no unusual header is a simple request, so any page could\n   * trigger one with an <img> and the visitor's cookies would ride along.\n   * This header is not CORS-safelisted, so the browser preflights it — the\n   * same thing that makes a POST carrying X-RSC-Action safe.\n   */\n  query: 'X-RSC-Query',\n\n  queryPath: '/_rsc/query',\n  /** Build-time shell for a PPR route, for an edge cache to hold. */\n  pprShellPath: '/_rsc/ppr-shell',\n  /** Finish a shell an edge cache is already serving. */\n  pprResumePath: '/_rsc/ppr-resume',\n  /**\n   * On a refresh a change triggered: which names moved, to which versions\n   * (`stock@5,orders@2`). A shared section renders once per such change, and\n   * every tab asking with the same one gets that render.\n   */\n  changedBy: 'X-RSC-Changed',\n  /** The stream a tab hears on when a name its page refreshes on has changed. */\n  changesPath: '/_rsc/changes',\n  /** Whether this renderer can serve: up, and its backend answering. GET only, never cached. */\n  healthPath: '/_rsc/health',\n} as const\n\n/** Flight payload. */\nexport const FLIGHT_TYPE = 'text/x-component; charset=utf-8'\n\n/** A rendered document. */\nexport const HTML_TYPE = 'text/html; charset=utf-8'\n\n/**\n * Every request header that changes what a response body contains.\n *\n * One url answers with a whole document, a partial payload, a named region or\n * an interceptor depending on these — so a cache keyed on the url alone, or on\n * `X-RSC` alone, will hand one client another's answer. They are materially\n * different bodies, not variations in presentation.\n */\nexport const VARY_ON_RSC = [\n  HEADER.rsc,\n  HEADER.segments,\n  HEADER.revalidate,\n  HEADER.intercept,\n  HEADER.referer,\n].join(', ')\n\n/**\n * What a response says about being stored, when it must not be.\n *\n * `Vary` alone is not enough on the platform this targets. Cloudflare ignores\n * `Vary` for everything except `Accept-Encoding`, and this package ships a\n * Workers story as a headline feature — so one url answering with a document,\n * a Flight payload, a segment and an interceptor, keyed only on the url, hands\n * one visitor another's body. Anything narrowed by a request header, and\n * anything behind a guard, says outright that it is not to be stored.\n */\nexport const PER_CLIENT = 'private, no-store'\n\n/**\n * And what a frozen, unguarded page says.\n *\n * Explicit rather than absent: with no directive at all, whether an\n * intermediary stores it comes down to that intermediary's heuristics, which\n * is not a decision this package should be leaving to chance in either\n * direction.\n */\nexport const REVALIDATE = 'public, max-age=0, must-revalidate'\n\n/**\n * And what a page rendered for one request says.\n *\n * It may have read the visitor's cookies, and nothing in the headers - which\n * leave before the render has finished - can know whether it did. So a shared\n * cache may not keep it; the visitor's own browser may, and must ask again.\n */\nexport const PER_REQUEST = 'private, max-age=0, must-revalidate'\n"]}

package/dist/host.d.ts

@@ -36,6 +36,14 @@ export interface RscEngine {
         props: Record<string, unknown>;
     }[], loadings?: string[], parallelSlots?: Record<string, string>, slotOverrides?: Record<string, unknown>, nonce?: string, pageKey?: string, bootstrap?: boolean): Promise<{
         htmlStream: ReadableStream;
+        /**
+         * The same render as a Flight payload, and the token the document
+         * carries for it. The host holds the one under the other for the boot
+         * fetch - see bootPayloads.ts. An engine built before this answers
+         * without them, and every boot renders, as it used to.
+         */
+        rscPayload?: ReadableStream;
+        bootToken?: string;
     }>;
     /**
      * A form posted to the page's own url before the page had a runtime to
@@ -77,6 +85,8 @@ export interface RscEngine {
          * filled here - see `unresumable` below.
          */
         replayed?: () => boolean;
+        /** The render as a payload, for the boot fetch; see handleRscHtmlStream. */
+        rscPayload?: ReadableStream;
     }>;
     handleRscRevalidate?(target: string, page: unknown, 
     /** Set on a refresh a change triggered: a shared section renders once per key. */

package/dist/host.js

@@ -48,6 +48,7 @@ export function pageSaidNotFound(request) {
 }
 export { revalidate } from "./revalidate.js";
 import { isCrawler } from "./crawler.js";
+import { bootToken, holdBootPayload, takeBootPayload } from "./bootPayloads.js";
 import { currentNotFound, withRedirect } from "./redirect.js";
 import { compressed } from "./compress.js";
 import { withCache } from "./cache.js";
@@ -487,6 +488,16 @@ export function createRscHandler(options) {
     const identify = Boolean(manifest.build?.identify);
     /** How a response was answered, for X-RSC-Kit: a file the build wrote, or a shell of one. */
     const servedFrom = new WeakMap();
+    /** Whether a stored shell carries a script - a runtime that will boot. Read once per shell. */
+    const bootsByKey = new Map();
+    function shellBoots(key, shell) {
+        let boots = bootsByKey.get(key);
+        if (boots === undefined) {
+            boots = shell.includes("<script");
+            bootsByKey.set(key, boots);
+        }
+        return boots;
+    }
     /** What a stored document's head names, read once per file, for the Link header. */
     const hinted = new WeakMap();
     /**
@@ -865,14 +876,25 @@ export function createRscHandler(options) {
                 // boundary rejects here — before a byte is written, with a status line
                 // still available. Nothing is buffered to make that true.
                 let htmlStream;
+                // The render's payload and the token the document carries for it.
+                // Held for the boot fetch when the document goes out as a 200;
+                // let go on every other exit, or the tee buffers it for nothing.
+                let rscPayload;
+                let token;
+                const letGo = () => void rscPayload?.cancel().catch(() => { });
                 try {
-                    ({ htmlStream } = formPost
+                    const rendered = formPost
                         ? await engine.handleRscFormPost(match.route.component, props, layouts, match.route.loadings, match.route.slots, {}, undefined, url.pathname, true, formPost)
                         : await engine.handleRscHtmlStream(match.route.component, props, layouts, match.route.loadings, match.route.slots, {}, undefined, url.pathname, 
                         // A route that ships no runtime gets no bootstrap and no segment
                         // boundary — the boundary is itself a client component, so leaving
                         // it in means no page could ever be JS-free.
-                        true));
+                        true);
+                    htmlStream = rendered.htmlStream;
+                    // Not after a post: the answer to one is the result of something
+                    // that happened once, and a payload of it is not a page to keep.
+                    if (!formPost)
+                        ({ rscPayload, bootToken: token } = rendered);
                 }
                 catch (error) {
                     // A rejected shell is how a redirect above every boundary arrives:
@@ -906,14 +928,27 @@ export function createRscHandler(options) {
                     throw error;
                 }
                 const early = taken();
-                if (early)
+                if (early) {
+                    letGo();
                     return redirectResponse(early, false);
+                }
                 // Above every boundary, so the shell resolving means the page did not
                 // refuse itself. Deeper than that and the shell is already on the wire
                 // — the digest carries it to the boundary instead, and the status
                 // stays 200 because the status line has gone.
-                if (currentNotFound())
+                if (currentNotFound()) {
+                    letGo();
                     return saidNotFound(request);
+                }
+                if (rscPayload && token) {
+                    holdBootPayload(token, rscPayload, {
+                        [HEADER.segmentDepth]: "0",
+                        [HEADER.layouts]: chain.join(","),
+                    });
+                }
+                else {
+                    letGo();
+                }
                 return new Response(appendLateRedirect(htmlStream, taken, missing), {
                     headers: withVersion({
                         "Content-Type": HTML_TYPE,
@@ -932,6 +967,27 @@ export function createRscHandler(options) {
                 });
             });
         }
+        // The boot fetch, redeeming the payload its own document's render kept:
+        // answered from it, nothing rendered, the guard already passed by the
+        // render that made it a moment ago for this same browser. A token not
+        // held - expired, another isolate, an older document - falls through to
+        // the render every boot used to be. See bootPayloads.ts.
+        const redeeming = request.headers.get(HEADER.boot);
+        if (redeeming !== null && request.headers.get(HEADER.segments) === null) {
+            const kept = takeBootPayload(redeeming);
+            if (kept) {
+                const answer = new Response(kept.payload, {
+                    headers: withVersion({
+                        "Content-Type": FLIGHT_TYPE,
+                        ...kept.headers,
+                        Vary: VARY_ON_RSC,
+                        "Cache-Control": PER_CLIENT,
+                    }),
+                });
+                servedFrom.set(answer, "held");
+                return answer;
+            }
+        }
         const from = sharedDepth(request.headers.get(HEADER.segments), chain);
         // A boot - X-RSC and no segments - of a document served from a pattern
         // shell: the shell was rendered for no url, and the client hydrates
@@ -1316,7 +1372,7 @@ export function createRscHandler(options) {
             // stream's end - see LATE_NOINDEX.
             let missing = () => false;
             const resume = engine.handleRscResume;
-            const { htmlStream, replayed } = await withRedirect((_, said) => {
+            const { htmlStream, replayed, rscPayload } = await withRedirect((_, said) => {
                 missing = said;
                 return resume(route.route.component, forShape, 
                 // Empty props, because that is what the build passed. Resuming replays
@@ -1337,12 +1393,32 @@ export function createRscHandler(options) {
             // a hole, and the resume fills it with the real one. Nothing is looked
             // up before the shell leaves.
             //
+            // The render's payload, kept for the boot fetch under a token written
+            // right after the shell - the shell is a build artifact, so the token
+            // cannot be in it. Only a shell that carries a script boots a runtime
+            // that will come back for one. A pattern shell's resume renders with
+            // no page key, so React can line its slots up; the client files the
+            // page under the url it is at when the payload carries none - see
+            // SegmentBoundary. See bootPayloads.ts.
+            const token = rscPayload && shellBoots(shellKey, shell) ? bootToken() : null;
+            if (token) {
+                holdBootPayload(token, rscPayload, {
+                    [HEADER.segmentDepth]: "0",
+                    [HEADER.layouts]: layoutChain(route.route.layouts, route.params).join(","),
+                });
+            }
+            else {
+                void rscPayload?.cancel().catch(() => { });
+            }
             // The shell first, then whatever the resume writes. React's own script
             // travels with the resumed segments and moves them into place, so this is
             // a plain concatenation and the holes land without hydration.
             const body = new ReadableStream({
                 async start(controller) {
                     controller.enqueue(new TextEncoder().encode(shell));
+                    if (token) {
+                        controller.enqueue(new TextEncoder().encode("<script>self.__rsc_boot=" + JSON.stringify(token) + "</script>"));
+                    }
                     const reader = htmlStream.getReader();
                     try {
                         while (true) {