@rshono/core 1.0.0-rc.0 → 1.0.0-rc.10

package/dist/runtime/entry.rsc.js

@@ -1,12 +1,12 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Hono } from 'hono';
-import { bodyLimit } from 'hono/body-limit';
+import { HTTPException } from 'hono/http-exception';
 // The JSX factory, by name: the page element is created with this directly rather than as
 // `<Page {...props} />`, because a spread would drop the non-enumerable `ctx` prop. See `pageProps`.
 import { jsx } from 'react/jsx-runtime';
 // The bare specifier, not `/server.node`: the package ships a build per runtime behind export
-// conditions (`node`, `workerd`, `deno`, `edge-light`), and the RSC layer's `conditionNames` is what
-// picks one — so a non-Node deploy target gets its own build instead of Node's by hard-coded path.
+// conditions, and the RSC layer's `conditionNames` picks one — so a non-Node deploy target gets its
+// own build rather than Node's by hard-coded path.
 import { createTemporaryReferenceSet, decodeAction, decodeFormState, decodeReply, loadServerAction, renderToReadableStream, } from 'react-server-dom-rspack/server';
 // Resolved by the '@rshono/deploy' alias to the selected preset's runtime module — the one place
 // this file knows anything about where it is running. See `deploy/contract.ts`.
@@ -17,21 +17,17 @@ import { routes as userRoutes } from '@rshono/routes';
 import * as serverAppModule from '@rshono/server-app';
 import { isPageRoute } from '../router.js';
 import { appendVary, etagMatches } from '../server/headers.js';
-import { getContext, publicUrl, readParams, reportServerError, runWithContext } from './context.js';
+import { beginPageRender, getRequestContext, publicUrl, readParams, reportServerError, runWithContext } from './context.js';
 import { isControlSignal, RedirectSignal } from './control.js';
 import { renderHTML } from './entry.ssr.js';
 import { RouterProvider } from './navigation.js';
-import { acceptsRsc, isActionRequest, parseRenderRequest, wantsRsc } from './request.js';
+import { acceptsRsc, isActionRequest, parseRenderRequest, requestWantsRsc, wantsRsc } from './request.js';
 const serverApp = (serverAppModule.default ?? null);
-// Framework settings resolved from rshono.config.ts and compiled into the bundle at build time
-// (see builder/rspack-config.ts). These have no runtime env-var interface — env is for secrets.
-// Named after their ServerConfig fields, so what a setting does here is one grep from where it is
-// resolved. `isDev` among them: the build mode is decided by which command produced the bundle, not
-// by `process.env.NODE_ENV`, and not every runtime this deploys to has a `process` to read anyway.
-const CONFIG = __RSHONO_CONFIG__;
-const { isDev, renderTimeoutMs, cspEnabled, checkOrigin, maxBodyBytes, compress: compressEnabled } = CONFIG;
-/** Extra cross-origin hosts permitted to post server actions, beyond the app's own origin. */
-const allowedOrigins = new Set(CONFIG.allowedOrigins);
+// Framework settings resolved from rshono.config.ts and compiled into the bundle at build time (see
+// builder/rspack-config.ts). There is no runtime env-var interface for these — env is for secrets.
+// `isDev` among them: the build mode is decided by which command produced the bundle, and not every
+// runtime this deploys to has a `process.env.NODE_ENV` to read.
+const { isDev } = __RSHONO_CONFIG__;
 /** How long a prerendered page may be reused before revalidating. Also what `public/` files get. */
 const SSG_CACHE_CONTROL = 'public, max-age=300';
 /**
@@ -39,50 +35,25 @@ const SSG_CACHE_CONTROL = 'public, max-age=300';
  * the `Accept` header, which is what makes `Vary` non-optional here.
  */
 const PAGE_CONTENT_TYPE = /^(?:text\/html|text\/x-component)\b/;
-// The CSP is fixed per build apart from the nonce, so assemble everything but `script-src` once.
-const CSP_STATIC = Object.entries(CONFIG.cspDirectives)
-    .filter(([name]) => name !== 'script-src')
-    .map(([name, value]) => `${name} ${value}`)
-    .join('; ');
-const CSP_SCRIPT_SRC = CONFIG.cspDirectives['script-src'] ?? "'self'";
 // Called here rather than at the top of the deploy runtime's own module so the timing is unchanged:
 // `.env` is loaded once every import above has been evaluated, exactly as before.
 runtime.loadEnv();
 const routeConfig = userRoutes;
 export const routes = routeConfig.routes;
 /**
- * CSRF guard for server-action POSTs, layering the two signals a browser gives us.
+ * The per-request CSP nonce, if the app asked for one.
  *
- * `Sec-Fetch-Site` is set by the browser and unforgeable by page script, so `same-origin` settles
- * the question on its own — and short-circuiting on it is what keeps the check from misfiring on a
- * legitimate request whose `Host` the proxy rewrote. Everything else falls back to comparing the
- * `Origin` host against our own (see {@link publicUrl} — deliberately *not* against a raw
- * `X-Forwarded-Host`, which the client controls unless `trustProxy` says a proxy owns it).
+ * The framework does not mint this. `secureHeaders()` from `hono/secure-headers` does, when its
+ * policy contains the `NONCE` placeholder, and it stores it here — so an app opts into a
+ * nonce-based CSP by registering that middleware in `src/server.ts` and the framework's only job is
+ * to stamp the value into the render.
  *
- * A missing `Origin` is treated as same-origin: no-JS form posts from older browsers omit it, and
- * those same browsers send no `Sec-Fetch-Site` either, so there is nothing left to check. Hosts are
- * compared case-insensitively; the scheme is not compared, so this alone won't stop an
- * `http://` origin posting to the `https://` site (HSTS is the control for that).
+ * Readable from a route handler because `secureHeaders` resolves its directives *before* calling
+ * `next()`; the header itself is written on the way back out. Absent when the app registered no CSP,
+ * or one with no nonce in it — a fixed policy needs nothing from the render.
  */
-function isSameOriginAction(c) {
-    if (!checkOrigin)
-        return true;
-    const secFetchSite = c.req.header('sec-fetch-site');
-    if (secFetchSite === 'same-origin')
-        return true;
-    const origin = c.req.header('origin');
-    const originHost = origin ? URL.parse(origin)?.host.toLowerCase() || null : null;
-    if (origin !== undefined && originHost === null)
-        return false; // an Origin we can't parse is untrusted.
-    const trusted = originHost !== null && (originHost === publicUrl(c).host.toLowerCase() || allowedOrigins.has(originHost));
-    if (secFetchSite && secFetchSite !== 'none') {
-        // The browser tells us (unforgeably) this didn't originate from our own site — only a
-        // trusted (allowlisted) Origin may proceed.
-        return trusted;
-    }
-    if (originHost === null)
-        return true;
-    return trusted;
+function cspNonce(c) {
+    return c.get('secureHeadersNonce');
 }
 async function loadPageModule(load, label) {
     const mod = await load();
@@ -102,6 +73,14 @@ async function loadPageModule(load, label) {
 function acceptsHtml(c) {
     return c.req.header('accept')?.includes('text/html') ?? false;
 }
+/**
+ * The 404 for an app with no `notFound` page, and for a client that wanted neither HTML nor a flight
+ * payload. Shared for the `Vary`: this is still one of the answers a page URL gives depending on
+ * `Accept`, and a cache not told so can hand a plain-text 404 to a browser asking for a document.
+ */
+function plainNotFound(c) {
+    return c.text('Not Found', 404, { vary: 'Accept' });
+}
 /** A lazy once-cell: runs `load` at most once and caches the promise, but clears a rejection so a later call can retry. */
 function once(load) {
     let promise;
@@ -118,75 +97,81 @@ function once(load) {
     };
 }
 /**
- * Owns the render-deadline lifecycle in one place (the RAII / `defer` pattern — a
- * `using` declaration doesn't fit because the timer must outlive this call to keep
- * guarding the *stream*, not just the function scope). The timer is released on
- * exactly one of: the stream finishing ({@link RenderDeadline.guard}), an explicit
- * {@link RenderDeadline.clear} on an error path, or the signal aborting (client
- * disconnect, or the deadline firing itself). A manually-cleared timer instead of
- * `AbortSignal.timeout()` so a fast response doesn't leave one pending to fire later.
+ * Passes `stream` through untouched, calling `done` once it ends — however it ends.
  *
- * One deadline covers the whole request — server action included, not just the render — so a
- * hung action can't pin a socket open indefinitely either.
+ * Used on the flight-only response path, which has no transform of its own to hang a completion hook
+ * off (the document path has {@link injectFlightPayload}). `done` must be idempotent: a cancelled
+ * response can reach both `cancel` and the abort forwarder.
  */
-function createRenderDeadline(requestSignal, ms) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(new Error(`[rshono] request exceeded ${ms}ms`)), ms);
-    timer.unref?.();
-    const signal = AbortSignal.any([requestSignal, controller.signal]);
-    const clear = () => clearTimeout(timer);
-    signal.addEventListener('abort', clear, { once: true });
-    return {
-        signal,
-        clear,
-        guard: (stream) => stream.pipeThrough(new TransformStream({ flush: clear })),
-        race(work) {
-            if (signal.aborted)
-                return Promise.reject(signal.reason);
-            const { promise: aborted, reject } = Promise.withResolvers();
-            const onAbort = () => reject(signal.reason);
-            signal.addEventListener('abort', onAbort, { once: true });
-            // `Promise.race` subscribes to `work` either way, so abandoning it can't surface as an
-            // unhandled rejection. Detach on settle so a long-lived signal doesn't accumulate listeners.
-            return Promise.race([work, aborted]).finally(() => signal.removeEventListener('abort', onAbort));
+function releaseWhenDone(stream, done) {
+    return stream.pipeThrough(new TransformStream({
+        transform(chunk, controller) {
+            controller.enqueue(chunk);
         },
-    };
+        flush: done,
+        cancel: done,
+    }));
 }
 /**
  * Builds the props a page component is called with.
  *
- * `url` and `params` match `useNavigation()` field for field, so a read can move between a page and
- * a `'use client'` component unchanged. The `URL` is this page's own — `Ctx` parses its own — so a
- * page that mutates it cannot disturb anything else on the request.
+ * `url` and `params` match `useNavigation()` field for field, so a read can move between a page and a
+ * `'use client'` component unchanged. The `URL` is this page's own, so mutating it cannot disturb
+ * anything else on the request.
  *
- * `ctx` is *defined* rather than assigned, and both parts of how carry their weight:
+ * `ctx` is *defined* rather than assigned, and both halves of how carry their weight:
  *
  * - **A getter**, so nothing is built for the pages that never read it, and so a `render: 'static'`
- *   page that does read it gets {@link getContext}'s own "no per-request context while
- *   prerendering" error rather than a bare `undefined` — one explanation, in one place.
+ *   page that does read it gets {@link getRequestContext}'s "no per-request context while
+ *   prerendering" error rather than a bare `undefined`.
  * - **Non-enumerable**, so React's *development-only* serialization of a server component's props
  *   (the debug channel behind component stacks and the performance track) skips it. That walks own
- *   enumerable properties, and `ctx.raw` is the Hono {@link Context} — whose `env` holds the
- *   runtime's bindings. An enumerable `ctx` ships every one of them, secrets included, to the
- *   browser in dev, and grows a small page's flight payload by well over 10 kB. Production never
- *   serializes a server component's props at all, so this is the dev half of the same guarantee.
+ *   enumerable properties, and `ctx.hono` is the Hono {@link Context} — whose `env` holds the
+ *   runtime's bindings. An enumerable `ctx` would ship every one of them, secrets included, to the
+ *   browser in dev, and add well over 10 kB to a small page's flight payload.
  *
- * The cost is that the element has to be created by handing this object to `jsx()` *by reference*:
- * a `<Page {...props} />` spread copies enumerable properties only, and would drop `ctx` silently.
+ * The cost is that the element has to be created by handing this object to `jsx()` *by reference*: a
+ * `<Page {...props} />` spread copies enumerable properties only, and would drop `ctx` silently.
  */
 function pageProps(c, errorInfo) {
     const props = { url: publicUrl(c), params: readParams(c), ...(errorInfo ? { error: errorInfo } : null) };
-    Object.defineProperty(props, 'ctx', { get: getContext, enumerable: false, configurable: true });
+    Object.defineProperty(props, 'ctx', { get: getRequestContext, enumerable: false, configurable: true });
     return props;
 }
 async function renderComponent(c, Page, opts) {
-    const deadline = opts.deadline ?? createRenderDeadline(c.req.raw.signal, renderTimeoutMs);
-    const signal = deadline.signal;
-    const nonce = cspEnabled && !opts.isRsc ? crypto.randomUUID() : undefined;
+    // A client going away aborts the render — but React's renderers must never be handed
+    // `c.req.raw.signal` to watch for it. Both add an `abort` listener and only remove it if the abort
+    // fires, so on the happy path that listener stays on a request-lifetime signal and through it pins
+    // the flight request, the Fizz request and the whole rendered tree (~169 kB per `/ssr` request,
+    // never reclaimed by a major GC).
+    //
+    // So the render gets a controller of its own and the request signal only forwards into it: the
+    // forwarder is `once`, so an abort removes it, and `release` removes it on the normal path. Not
+    // `AbortSignal.any()` — a signal it produced is *composite*, and Node holds every composite signal
+    // carrying an `abort` listener in a process-lifetime set until it aborts or loses its last listener.
+    const requestSignal = c.req.raw.signal;
+    const renderAbort = new AbortController();
+    const signal = renderAbort.signal;
+    const forwardAbort = () => renderAbort.abort(requestSignal.reason);
+    if (requestSignal.aborted)
+        renderAbort.abort(requestSignal.reason);
+    else
+        requestSignal.addEventListener('abort', forwardAbort, { once: true });
+    /** Detaches the forwarder once the response has been written, so nothing survives the request. */
+    const release = () => requestSignal.removeEventListener('abort', forwardAbort);
+    // Documents only: the nonce goes on the bootstrap scripts and the `<meta>` React hydrates from,
+    // and a flight payload has neither. Leaving it off there is also what keeps a prerendered flight
+    // payload servable from disk under a nonce-based CSP.
+    const nonce = opts.isRsc ? undefined : cspNonce(c);
     const props = pageProps(c, opts.errorInfo);
     const root = (_jsxs(_Fragment, { children: [nonce && _jsx("meta", { property: "csp-nonce", nonce: nonce }), Page.entryCssFiles?.map((href) => (_jsx("link", { rel: "stylesheet", href: href, precedence: "default" }, href))), _jsx(RouterProvider, { href: props.url.href, params: props.params, children: jsx(Page, props) })] }));
     // `notFound` only when it is true, so the flight payload of an ordinary page doesn't carry the key.
     const rscPayload = { root, formState: opts.formState, returnValue: opts.returnValue, ...(opts.notFound ? { notFound: true } : null) };
+    // Past this line the response head belongs to the framework, so `ctx.setHeader()` and
+    // `ctx.cookies.set()` start throwing rather than writing somewhere nothing will read. It has to be
+    // the last thing before the render: a server action ran earlier in `renderPage` and legitimately
+    // writes to the response, and so does any middleware that wrapped this handler.
+    beginPageRender(c);
     let controlSignal;
     const rscStream = renderToReadableStream(rscPayload, {
         temporaryReferences: opts.temporaryReferences,
@@ -201,7 +186,7 @@ async function renderComponent(c, Page, opts) {
         },
     });
     if (opts.isRsc) {
-        return c.body(deadline.guard(rscStream), (opts.status ?? 200), {
+        return c.body(releaseWhenDone(rscStream, release), (opts.status ?? 200), {
             'content-type': 'text/x-component;charset=utf-8',
         });
     }
@@ -212,51 +197,38 @@ async function renderComponent(c, Page, opts) {
             formState: opts.formState,
             signal,
             nonce,
+            onDone: release,
             onShellError: (error) => reportServerError(error, { source: 'ssr', request: c.req.raw, message: '[rshono] SSR shell error:' }),
             onError: (error) => reportServerError(error, { source: 'ssr', request: c.req.raw, message: '[rshono] SSR error:' }),
         });
     }
     catch (error) {
-        deadline.clear();
+        release();
         if (controlSignal)
             throw controlSignal;
         throw error;
     }
     if (controlSignal) {
-        deadline.clear();
+        release();
         throw controlSignal;
     }
-    const headers = { 'content-type': 'text/html;charset=utf-8' };
-    if (nonce) {
-        // The nonce is always appended to whatever `script-src` resolved to, so overriding the
-        // directive in `cspDirectives` can widen the policy but can't accidentally drop the nonce.
-        // Dev additionally needs 'unsafe-eval' for react-refresh.
-        const scriptSrc = `script-src ${CSP_SCRIPT_SRC} 'nonce-${nonce}'${isDev ? " 'unsafe-eval'" : ''}`;
-        headers['content-security-policy'] = CSP_STATIC ? `${CSP_STATIC}; ${scriptSrc}` : scriptSrc;
-    }
-    return c.body(deadline.guard(ssrResult.stream), (ssrResult.status ?? opts.status ?? 200), headers);
+    return c.body(ssrResult.stream, (ssrResult.status ?? opts.status ?? 200), {
+        'content-type': 'text/html;charset=utf-8',
+    });
 }
 async function renderPage(c, loadPage) {
     const request = c.req.raw;
     const renderRequest = parseRenderRequest(request);
-    // Created before the action runs so the deadline covers the whole request, then handed to
-    // `renderComponent` so the render doesn't get a fresh budget of its own.
-    const deadline = createRenderDeadline(request.signal, renderTimeoutMs);
     let returnValue;
     let formState;
     let temporaryReferences;
     let actionStatus;
     if (isActionRequest(renderRequest)) {
-        if (!isSameOriginAction(c)) {
-            deadline.clear();
-            return c.text('Forbidden: cross-origin server action rejected', 403);
-        }
         if (renderRequest.kind === 'rsc-action') {
             // Checked before the body is decoded, so an unknown id costs nothing to reject — and
             // `loadServerAction` would otherwise fault on the missing manifest entry, turning a bad
             // request into an unhandled 500. `hasOwn` so `__proto__` doesn't resolve to a manifest entry.
             if (!Object.hasOwn(__rspack_rsc_manifest__.serverManifest, renderRequest.actionId)) {
-                deadline.clear();
                 return c.text('Bad Request: unknown server action', 400);
             }
             const contentType = request.headers.get('content-type');
@@ -265,7 +237,7 @@ async function renderPage(c, loadPage) {
             const args = await decodeReply(body, { temporaryReferences });
             const action = loadServerAction(renderRequest.actionId);
             try {
-                returnValue = { ok: true, value: await deadline.race(action.apply(null, args)) };
+                returnValue = { ok: true, value: await action.apply(null, args) };
             }
             catch (error) {
                 if (isControlSignal(error))
@@ -281,7 +253,7 @@ async function renderPage(c, loadPage) {
             const formData = await request.formData();
             const decodedAction = await decodeAction(formData, __rspack_rsc_manifest__.serverManifest);
             if (decodedAction) {
-                const result = await deadline.race(decodedAction());
+                const result = await decodedAction();
                 formState = (await decodeFormState(result, formData, __rspack_rsc_manifest__.serverManifest)) ?? undefined;
             }
         }
@@ -293,20 +265,17 @@ async function renderPage(c, loadPage) {
         formState,
         returnValue,
         temporaryReferences,
-        deadline,
     });
 }
 function buildApp() {
     const app = new Hono();
-    // Outermost, so it wraps the finished response — headers and all — on the way out. A platform that
-    // compresses for us (or cannot stream a compressor) offers none, and the setting has nothing to do.
-    if (compressEnabled && runtime.compress)
-        app.use(runtime.compress);
-    // Cheap, unconditional headers that only matter when something else has gone wrong: stop
-    // content-type sniffing, keep the full URL (paths, query) out of cross-origin referrers, and
-    // refuse to be framed by another origin (clickjacking). `frame-ancestors` in the opt-in CSP is
-    // stricter and takes precedence where both apply; this is the floor for everyone else.
-    // Set after `next()` so a route or middleware that sets its own value wins.
+    // Baseline security headers: stop content-type sniffing, keep the full URL out of cross-origin
+    // referrers, and refuse to be framed by another origin. A floor, not a policy — an app that wants
+    // the full set registers `secureHeaders()` from `hono/secure-headers` in src/server.ts, and
+    // because this is registered first it unwinds *last* and the "only if unset" checks stand aside
+    // for whatever that set. Kept in the framework rather than left to the app because it is
+    // registered ahead of `mountStaticAssets`, which is a terminal handler the sub-app never sees:
+    // without this, `/_static/*` would carry no security headers at all.
     app.use(async (c, next) => {
         await next();
         const headers = c.res.headers;
@@ -316,31 +285,33 @@ function buildApp() {
             headers.set('referrer-policy', 'strict-origin-when-cross-origin');
         if (!headers.has('x-frame-options'))
             headers.set('x-frame-options', 'SAMEORIGIN');
-        // Page responses only, from here down. Two things are true of them and of nothing else served
-        // here: one URL answers with either an HTML document or a flight payload depending on `Accept`,
-        // and the default page is request-specific (cookies, session, headers).
+        // React Refresh compiles updates with `eval`, so a dev build cannot run under any CSP an app
+        // would sensibly write for production. Widened here rather than asked of the app, so one policy
+        // in src/server.ts serves both and nobody debugs a blocked HMR socket. Only ever in dev, and
+        // only when the app has a `script-src` to widen.
+        if (isDev) {
+            const csp = headers.get('content-security-policy');
+            if (csp?.includes('script-src ')) {
+                headers.set('content-security-policy', csp.replace('script-src ', "script-src 'unsafe-eval' "));
+            }
+        }
+        // Page responses only, from here down: one URL answers with either an HTML document or a flight
+        // payload depending on `Accept`, and the default page is request-specific.
         if (!PAGE_CONTENT_TYPE.test(headers.get('content-type') ?? ''))
             return;
         appendVary(headers, 'Accept');
-        // Without this a page carries no cache directives at all, and a shared cache — a CDN, a
-        // corporate proxy — is free to store a logged-in user's page and hand it to someone else.
-        // `private` forbids exactly that; `no-cache` makes the browser revalidate its own copy rather
-        // than re-showing a stale personalised page. Neither blocks bfcache, which `no-store` would.
-        // A prerendered page, or anything a route set deliberately, already has its own value.
+        // Without this a page carries no cache directives at all, and a shared cache — a CDN, a corporate
+        // proxy — is free to store a logged-in user's page and hand it to someone else. `private` forbids
+        // that; `no-cache` makes the browser revalidate rather than re-show a stale personalised page.
+        // Neither blocks bfcache, which `no-store` would. A prerendered page already has its own value.
         if (!headers.has('cache-control'))
             headers.set('cache-control', 'private, no-cache');
     });
-    // A memory-exhaustion guard for *every* route — pages and actions, `{ type: 'endpoint' }` routes
-    // and the src/server.ts sub-app alike — since anything that buffers a body (`.json()`,
-    // `.formData()`) is exposed, not just server actions. Rejects an over-cap `Content-Length` up
-    // front and otherwise counts the stream, so a chunked or under-reported body is still cut off.
-    if (maxBodyBytes > 0) {
-        app.use(bodyLimit({ maxSize: maxBodyBytes, onError: (c) => c.text('Payload Too Large', 413) }));
-    }
     runtime.mountStaticAssets(app);
-    // Mounted ahead of the page routes so the sub-app's middleware (auth, logging, trailing-slash)
-    // wraps page requests too. The flip side: a *terminal* handler in src/server.ts at the same path
-    // as a page route wins over the page.
+    // Mounted ahead of the page routes so the sub-app's middleware (auth, logging, trailing-slash,
+    // and the security middleware the framework no longer owns — `csrf()`, `bodyLimit()`,
+    // `secureHeaders()`) wraps page requests too. The flip side: a *terminal* handler in
+    // src/server.ts at the same path as a page route wins over the page.
     if (serverApp) {
         app.route('/', serverApp);
     }
@@ -348,10 +319,12 @@ function buildApp() {
     const loadNotFoundPage = routeConfig.notFound ? memoizePage(routeConfig.notFound, 'the notFound page') : null;
     /** Turns a thrown `redirect()` / `notFound()` into the response it stands for. */
     const respondToControlSignal = async (c, signal) => {
-        const isRsc = wantsRsc(parseRenderRequest(c.req.raw));
+        const isRsc = requestWantsRsc(c.req.raw);
         if (signal instanceof RedirectSignal) {
             if (isRsc) {
-                return c.body(renderToReadableStream({ root: null, redirect: signal.location }, { signal: c.req.raw.signal }), 200, {
+                // No `signal`, deliberately — see `renderComponent`. This payload is two fields and no
+                // component tree, so there is nothing worth aborting and nothing worth a listener.
+                return c.body(renderToReadableStream({ root: null, redirect: signal.location }), 200, {
                     'content-type': 'text/x-component;charset=utf-8',
                 });
             }
@@ -360,8 +333,7 @@ function buildApp() {
         if (loadNotFoundPage) {
             return renderComponent(c, await loadNotFoundPage(), { status: 404, isRsc, notFound: true });
         }
-        // Plain text, but still one of the two answers this URL gives depending on `Accept`.
-        return c.text('Not Found', 404, { vary: 'Accept' });
+        return plainNotFound(c);
     };
     for (const route of routes) {
         if (isPageRoute(route)) {
@@ -372,18 +344,22 @@ function buildApp() {
                 try {
                     if (servesPrerendered && c.req.method === 'GET') {
                         const isRsc = acceptsRsc(c.req.raw);
-                        // Both representations are prerendered, so a soft navigation is served from the build too
-                        // rather than re-rendering a page that was already built. The exception is the HTML
-                        // under `csp`, which has to be rendered per request to carry its nonce — the flight
-                        // payload never carries one, so it stays servable either way.
-                        if (!(cspEnabled && !isRsc)) {
+                        // A prerendered file is one fixed set of bytes, so it cannot carry a per-request nonce:
+                        // where the app's CSP has one, the *document* has to be rendered per request. The flight
+                        // payload never carries a nonce, so it stays servable from the build either way.
+                        //
+                        // Decided per request rather than per build, which is what moving the CSP to
+                        // `secureHeaders()` buys: an app whose policy carries no `NONCE` keeps its prerendered
+                        // documents, where the old build-time `csp: true` flag gave every one of them up.
+                        const mustRenderForNonce = !isRsc && cspNonce(c) !== undefined;
+                        if (!mustRenderForNonce) {
                             const page = await runtime.readPrerendered(c, isRsc ? 'flight' : 'html');
                             // A prerendered page is request-independent by construction, so it is safe to cache
-                            // publicly; the short max-age matches what `public/` files get. The ETag turns the
+                            // publicly; the short max-age matches what `public/` files get, and the ETag turns the
                             // revalidation that follows into a 304 rather than the page all over again.
                             //
                             // Answered outside `runWithContext`: no app code runs on this path, so there is no
-                            // `getContext()` to serve and no reason to pay for the AsyncLocalStorage scope.
+                            // `getRequestContext()` to serve and no reason to pay for the AsyncLocalStorage scope.
                             if (page !== null) {
                                 const headers = {
                                     'cache-control': SSG_CACHE_CONTROL,
@@ -422,18 +398,28 @@ function buildApp() {
     }
     runtime.mountPublicFallback(app);
     app.notFound(async (c) => {
-        const isRsc = wantsRsc(parseRenderRequest(c.req.raw));
+        const isRsc = requestWantsRsc(c.req.raw);
         if (loadNotFoundPage && (isRsc || acceptsHtml(c))) {
             return runWithContext(c, async () => renderComponent(c, await loadNotFoundPage(), { status: 404, isRsc }));
         }
-        return c.text('Not Found', 404, { vary: 'Accept' });
+        return plainNotFound(c);
     });
     const loadErrorPage = routeConfig.error ? memoizePage(routeConfig.error, 'the error page') : null;
     app.onError(async (error, c) => {
         if (isControlSignal(error))
             return runWithContext(c, () => respondToControlSignal(c, error));
+        // Registering an `onError` at all replaces Hono's default handler, which is what would otherwise
+        // turn an `HTTPException` into the response it carries. Without this every middleware that
+        // rejects a request by throwing one — `csrf()` with a 403, `bodyLimit()` with a 413, an app's own
+        // `throw new HTTPException(401)` — would surface as a 500 error page instead of its own status.
+        // Rebuilt through `c` rather than returned as-is, exactly as Hono's own default does, so headers
+        // already prepared on the context (`c.header(…)` from middleware that ran first) survive.
+        if (error instanceof HTTPException) {
+            const res = error.getResponse();
+            return c.newResponse(res.body, res);
+        }
         reportServerError(error, { source: 'request', request: c.req.raw, message: '[rshono] request error:' });
-        const isRsc = wantsRsc(parseRenderRequest(c.req.raw));
+        const isRsc = requestWantsRsc(c.req.raw);
         if (loadErrorPage && (isRsc || acceptsHtml(c))) {
             const errorInfo = isDev
                 ? {