@rsc-kit/core 0.30.28 → 0.30.29

package/dist/host.js

@@ -433,6 +433,8 @@ export function createRscHandler(options) {
     // own. Resolved on the first request: the engine reads it from a build
     // product it only has at runtime.
     let version = engine.buildId ? undefined : options.version;
+    // The PPR contract's build, read once - see pprBuild.
+    let pprBuildRead = null;
     const maxActionBody = options.maxActionBody ?? DEFAULT_MAX_ACTION_BODY;
     const compress = options.compress ?? true;
     // Annotated rather than inferred: the narrowing below is lost inside the
@@ -1255,14 +1257,14 @@ export function createRscHandler(options) {
                     "Content-Type": HTML_TYPE,
                     // Rendered for whoever asked. Never cacheable.
                     "Cache-Control": PER_CLIENT,
-                    ...(version ? { [PPR.build]: version } : {}),
+                    ...(pprBuildRead ? { [PPR.build]: pprBuildRead } : {}),
                 }),
             });
         });
     }
     /**
      * The PPR contract's two endpoints, for a platform's edge. They exist only
-     * for a caller holding the release's PPR_TOKEN: unset, missing or wrong,
+     * for a caller holding the PPR_TOKEN the platform set: unset, missing or wrong,
      * everything under /_ppr/ is a 404, as if there were nothing here - so an
      * app is safe wherever it runs, and only the platform can ask.
      *
@@ -1289,7 +1291,10 @@ export function createRscHandler(options) {
     async function pprContractAnswer(request, url) {
         const missing = new Response("Not found", { status: 404 });
         const read = options.prerendered;
-        if (!read || !version || !holdsSecret(request, PPR.token, PPR.tokenEnv))
+        if (!read || !holdsSecret(request, PPR.token, PPR.tokenEnv))
+            return missing;
+        const build = await pprBuild(read);
+        if (!build)
             return missing;
         if (url.pathname === PPR.shellPath && (request.method === "GET" || request.method === "HEAD")) {
             const pathname = contractPathname(url.searchParams.get("path"), url);
@@ -1298,14 +1303,14 @@ export function createRscHandler(options) {
             const shell = await shellAt(pathname, read);
             if (shell instanceof Response)
                 return shell;
-            return new Response(request.method === "HEAD" ? null : JSON.stringify({ v: 1, build: version, html: shell, state: "" }), {
+            return new Response(request.method === "HEAD" ? null : JSON.stringify({ v: 1, build, html: shell, state: "" }), {
                 headers: {
                     "Content-Type": "application/json",
                     // Fixed for the build, so no ETag. And never stored on the way:
                     // it was answered only for the token, and a cache between the
                     // edge and here would hand it to callers without one.
                     "Cache-Control": "private, no-store",
-                    [PPR.build]: version,
+                    [PPR.build]: build,
                 },
             });
         }
@@ -1319,6 +1324,15 @@ export function createRscHandler(options) {
         }
         return missing;
     }
+    /**
+     * The build the marker names, which the build wrote beside the shells - not
+     * the client's id this host sends a browser, which a server-only change
+     * keeps. See pprBuildId.
+     */
+    async function pprBuild(read) {
+        pprBuildRead ??= (await read("_ppr.build"))?.trim() || null;
+        return pprBuildRead;
+    }
     /**
      * A contract path - absolute and decoded once - as the pathname this host
      * matches, or null for one that would not survive the trip unchanged: a