npm - @rshono/core - Versions diffs - 1.0.0-rc.2 → 1.0.0-rc.21 - Mend

@rshono/core 1.0.0-rc.2 → 1.0.0-rc.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (208) hide show

package/LICENSE +21 -0
package/README.md +348 -158
package/bin/rshono.mjs +3 -4
package/dist/builder/env-shadow-loader.cjs +123 -8
package/dist/builder/page-entry-loader.cjs +28 -1
package/dist/builder/page-files.d.ts +0 -1
package/dist/builder/page-files.js +7 -3
package/dist/builder/page-files.js.map +1 -1
package/dist/builder/public-env.d.ts +7 -1
package/dist/builder/public-env.js +7 -0
package/dist/builder/public-env.js.map +1 -1
package/dist/builder/react-versions.d.ts +12 -0
package/dist/builder/react-versions.js +74 -0
package/dist/builder/react-versions.js.map +1 -0
package/dist/builder/rspack-config.d.ts +13 -4
package/dist/builder/rspack-config.js +136 -53
package/dist/builder/rspack-config.js.map +1 -1
package/dist/builder/server-only-imports.d.ts +32 -0
package/dist/builder/server-only-imports.js +51 -0
package/dist/builder/server-only-imports.js.map +1 -0
package/dist/cli/build.d.ts +2 -3
package/dist/cli/build.js +51 -13
package/dist/cli/build.js.map +1 -1
package/dist/cli/dev.d.ts +2 -3
package/dist/cli/dev.js +149 -45
package/dist/cli/dev.js.map +1 -1
package/dist/cli/exit.d.ts +12 -0
package/dist/cli/exit.js +16 -0
package/dist/cli/exit.js.map +1 -0
package/dist/cli/index.d.ts +0 -1
package/dist/cli/index.js +91 -30
package/dist/cli/index.js.map +1 -1
package/dist/cli/start.d.ts +0 -1
package/dist/cli/start.js +15 -18
package/dist/cli/start.js.map +1 -1
package/dist/config.d.ts +72 -78
package/dist/config.js +17 -1
package/dist/config.js.map +1 -1
package/dist/deploy/aws-lambda/runtime.d.ts +4 -7
package/dist/deploy/aws-lambda/runtime.js +5 -8
package/dist/deploy/aws-lambda/runtime.js.map +1 -1
package/dist/deploy/build-marker.d.ts +9 -6
package/dist/deploy/build-marker.js +8 -4
package/dist/deploy/build-marker.js.map +1 -1
package/dist/deploy/cloudflare/build.d.ts +0 -1
package/dist/deploy/cloudflare/build.js +17 -13
package/dist/deploy/cloudflare/build.js.map +1 -1
package/dist/deploy/cloudflare/runtime.d.ts +2 -6
package/dist/deploy/cloudflare/runtime.js +73 -68
package/dist/deploy/cloudflare/runtime.js.map +1 -1
package/dist/deploy/contract.d.ts +57 -41
package/dist/deploy/contract.js.map +1 -1
package/dist/deploy/filesystem.d.ts +3 -6
package/dist/deploy/filesystem.js +23 -20
package/dist/deploy/filesystem.js.map +1 -1
package/dist/deploy/node/runtime.d.ts +5 -3
package/dist/deploy/node/runtime.js +23 -9
package/dist/deploy/node/runtime.js.map +1 -1
package/dist/deploy/presets.d.ts +34 -30
package/dist/deploy/presets.js +56 -44
package/dist/deploy/presets.js.map +1 -1
package/dist/deploy/public-paths.d.ts +42 -0
package/dist/deploy/public-paths.js +66 -0
package/dist/deploy/public-paths.js.map +1 -0
package/dist/deploy/vercel/build.d.ts +0 -1
package/dist/deploy/vercel/build.js +25 -16
package/dist/deploy/vercel/build.js.map +1 -1
package/dist/deploy/vercel/runtime.d.ts +10 -7
package/dist/deploy/vercel/runtime.js +48 -11
package/dist/deploy/vercel/runtime.js.map +1 -1
package/dist/index.d.ts +19 -17
package/dist/index.js +20 -10
package/dist/index.js.map +1 -1
package/dist/router.d.ts +212 -120
package/dist/router.js +3 -8
package/dist/router.js.map +1 -1
package/dist/runtime/boundaries.d.ts +62 -48
package/dist/runtime/boundaries.js +32 -34
package/dist/runtime/boundaries.js.map +1 -1
package/dist/runtime/client.d.ts +20 -11
package/dist/runtime/client.js +20 -10
package/dist/runtime/client.js.map +1 -1
package/dist/runtime/context.d.ts +304 -123
package/dist/runtime/context.js +377 -149
package/dist/runtime/context.js.map +1 -1
package/dist/runtime/control.d.ts +15 -1
package/dist/runtime/control.js +24 -0
package/dist/runtime/control.js.map +1 -1
package/dist/runtime/dev-protocol.d.ts +4 -9
package/dist/runtime/dev-protocol.js.map +1 -1
package/dist/runtime/empty-server-app.d.ts +0 -1
package/dist/runtime/entry.client.d.ts +4 -1
package/dist/runtime/entry.client.js +455 -313
package/dist/runtime/entry.client.js.map +1 -1
package/dist/runtime/entry.rsc.d.ts +15 -7
package/dist/runtime/entry.rsc.js +811 -252
package/dist/runtime/entry.rsc.js.map +1 -1
package/dist/runtime/entry.ssr.d.ts +27 -10
package/dist/runtime/entry.ssr.js +30 -48
package/dist/runtime/entry.ssr.js.map +1 -1
package/dist/runtime/failure-document.d.ts +11 -0
package/dist/runtime/failure-document.js +35 -0
package/dist/runtime/failure-document.js.map +1 -0
package/dist/runtime/flight-inject.d.ts +23 -0
package/dist/runtime/flight-inject.js +403 -0
package/dist/runtime/flight-inject.js.map +1 -0
package/dist/runtime/hot-update.d.ts +44 -0
package/dist/runtime/hot-update.js +44 -0
package/dist/runtime/hot-update.js.map +1 -0
package/dist/runtime/navigation.d.ts +46 -54
package/dist/runtime/navigation.js +22 -63
package/dist/runtime/navigation.js.map +1 -1
package/dist/runtime/request.d.ts +42 -8
package/dist/runtime/request.js +84 -7
package/dist/runtime/request.js.map +1 -1
package/dist/runtime/server.d.ts +20 -18
package/dist/runtime/server.js +22 -17
package/dist/runtime/server.js.map +1 -1
package/dist/runtime/validate-entries.d.ts +77 -0
package/dist/runtime/validate-entries.js +405 -0
package/dist/runtime/validate-entries.js.map +1 -0
package/dist/server/headers.d.ts +41 -15
package/dist/server/headers.js +53 -24
package/dist/server/headers.js.map +1 -1
package/dist/server/load-config.d.ts +4 -5
package/dist/server/load-config.js +22 -14
package/dist/server/load-config.js.map +1 -1
package/dist/server/load-env.d.ts +0 -1
package/dist/server/prerendered.d.ts +88 -34
package/dist/server/prerendered.js +184 -24
package/dist/server/prerendered.js.map +1 -1
package/dist/server/server-config.d.ts +35 -50
package/dist/server/server-config.js +27 -74
package/dist/server/server-config.js.map +1 -1
package/dist/server/shutdown.d.ts +5 -4
package/dist/server/shutdown.js +5 -3
package/dist/server/shutdown.js.map +1 -1
package/dist/server/ssg.d.ts +9 -7
package/dist/server/ssg.js +209 -65
package/dist/server/ssg.js.map +1 -1
package/dist/server/static.d.ts +0 -1
package/dist/server/static.js +7 -1
package/dist/server/static.js.map +1 -1
package/package.json +21 -23
package/dist/builder/page-files.d.ts.map +0 -1
package/dist/builder/public-env.d.ts.map +0 -1
package/dist/builder/rspack-config.d.ts.map +0 -1
package/dist/cli/build.d.ts.map +0 -1
package/dist/cli/dev.d.ts.map +0 -1
package/dist/cli/index.d.ts.map +0 -1
package/dist/cli/start.d.ts.map +0 -1
package/dist/config.d.ts.map +0 -1
package/dist/deploy/aws-lambda/runtime.d.ts.map +0 -1
package/dist/deploy/build-marker.d.ts.map +0 -1
package/dist/deploy/bun/runtime.d.ts +0 -11
package/dist/deploy/bun/runtime.d.ts.map +0 -1
package/dist/deploy/bun/runtime.js +0 -22
package/dist/deploy/bun/runtime.js.map +0 -1
package/dist/deploy/cloudflare/build.d.ts.map +0 -1
package/dist/deploy/cloudflare/runtime.d.ts.map +0 -1
package/dist/deploy/contract.d.ts.map +0 -1
package/dist/deploy/deno/runtime.d.ts +0 -11
package/dist/deploy/deno/runtime.d.ts.map +0 -1
package/dist/deploy/deno/runtime.js +0 -16
package/dist/deploy/deno/runtime.js.map +0 -1
package/dist/deploy/filesystem.d.ts.map +0 -1
package/dist/deploy/listen.d.ts +0 -20
package/dist/deploy/listen.d.ts.map +0 -1
package/dist/deploy/listen.js +0 -24
package/dist/deploy/listen.js.map +0 -1
package/dist/deploy/netlify/build.d.ts +0 -8
package/dist/deploy/netlify/build.d.ts.map +0 -1
package/dist/deploy/netlify/build.js +0 -52
package/dist/deploy/netlify/build.js.map +0 -1
package/dist/deploy/netlify/runtime.d.ts +0 -13
package/dist/deploy/netlify/runtime.d.ts.map +0 -1
package/dist/deploy/netlify/runtime.js +0 -24
package/dist/deploy/netlify/runtime.js.map +0 -1
package/dist/deploy/node/runtime.d.ts.map +0 -1
package/dist/deploy/presets.d.ts.map +0 -1
package/dist/deploy/vercel/build.d.ts.map +0 -1
package/dist/deploy/vercel/runtime.d.ts.map +0 -1
package/dist/index.d.ts.map +0 -1
package/dist/router.d.ts.map +0 -1
package/dist/runtime/boundaries.d.ts.map +0 -1
package/dist/runtime/client.d.ts.map +0 -1
package/dist/runtime/context.d.ts.map +0 -1
package/dist/runtime/control.d.ts.map +0 -1
package/dist/runtime/dev-protocol.d.ts.map +0 -1
package/dist/runtime/empty-server-app.d.ts.map +0 -1
package/dist/runtime/entry.client.d.ts.map +0 -1
package/dist/runtime/entry.rsc.d.ts.map +0 -1
package/dist/runtime/entry.ssr.d.ts.map +0 -1
package/dist/runtime/navigation.d.ts.map +0 -1
package/dist/runtime/request.d.ts.map +0 -1
package/dist/runtime/server.d.ts.map +0 -1
package/dist/server/compress.d.ts +0 -15
package/dist/server/compress.d.ts.map +0 -1
package/dist/server/compress.js +0 -76
package/dist/server/compress.js.map +0 -1
package/dist/server/headers.d.ts.map +0 -1
package/dist/server/load-config.d.ts.map +0 -1
package/dist/server/load-env.d.ts.map +0 -1
package/dist/server/prerendered.d.ts.map +0 -1
package/dist/server/server-config.d.ts.map +0 -1
package/dist/server/shutdown.d.ts.map +0 -1
package/dist/server/ssg.d.ts.map +0 -1
package/dist/server/static.d.ts.map +0 -1

package/dist/runtime/entry.client.js CHANGED Viewed

@@ -2,15 +2,45 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import React from 'react';
 import { hydrateRoot } from 'react-dom/client';
 import { createFromFetch, createFromReadableStream, createTemporaryReferenceSet, encodeReply, setServerCallback, } from 'react-server-dom-rspack/client.browser';
-import { rscStream } from 'rsc-html-stream/client';
 import { isControlDigest, parseRedirectDigest } from './control.js';
+// Dev-only: its one caller sits behind `import.meta.webpackHot`, which a production build compiles to
+// `false` — so this module is dropped there.
+import { walkHotUpdates } from './hot-update.js';
 import { RouterContext } from './navigation.js';
 import { createRscRequest } from './request.js';
 const isDev = process.env.NODE_ENV === 'development';
+/** The flight payload the document carried, read back out of `__FLIGHT_DATA` — see `flight-inject.ts`. */
+function readFlightPayload() {
+    const encoder = new TextEncoder();
+    // Assigned synchronously by `start`, which `new ReadableStream` runs before it returns.
+    let controller;
+    const stream = new ReadableStream({
+        start: (c) => void (controller = c),
+    });
+    const enqueue = (chunk) => controller.enqueue(typeof chunk === 'string' ? encoder.encode(chunk) : chunk);
+    // Payload scripts interleave with the document: the ones that already ran are in the array, the rest
+    // arrive through `push`.
+    const data = (self.__FLIGHT_DATA ??= []);
+    for (const chunk of data)
+        enqueue(chunk);
+    data.push = enqueue;
+    // The last payload script lands before parsing finishes, so that is what closes the stream.
+    if (document.readyState === 'loading') {
+        document.addEventListener('DOMContentLoaded', () => controller.close(), { once: true });
+    }
+    else {
+        controller.close();
+    }
+    return stream;
+}
+/** Created at module evaluation, not inside `main()`, so no chunk can be pushed before it is watching. */
+const flightStream = readFlightPayload();
 /**
- * Guarantees somewhere to attach the fatal overlay. React's root container is the whole `document`,
- * so by the time an uncaught error has torn the tree down, `<body>` — or even `<html>` — may be gone.
+ * The part of the location a payload is rendered for — the document, without the fragment, which the server
+ * never sees. Two URLs that differ only by `#hash` describe the same payload.
  */
+const documentUrl = () => location.pathname + location.search;
+/** Guarantees somewhere to attach the fatal overlay: the root container is `document`, so a teardown can take `<body>` with it. */
 function overlayHost() {
     if (!document.documentElement)
         document.appendChild(document.createElement('html'));
@@ -19,32 +49,40 @@ function overlayHost() {
     return document.body;
 }
 /**
- * Replaces the white screen of death with something readable.
- *
- * Because the root container is `document`, an uncaught render error leaves a genuinely blank page
- * with the reason only in the console — so this paints the reason over it instead. In development
- * that's the full stack; in production it's a generic notice plus a reload button, since the tree is
- * unrecoverable and reloading is the only way forward.
+ * Paints a full-viewport panel over whatever is on screen, and returns the box for the caller to fill.
  *
- * Written with DOM calls rather than React (the renderer is what just failed) and `textContent`
- * rather than `innerHTML` (an error message is untrusted input).
+ * DOM calls rather than React (one caller runs because the renderer just failed), and `textContent` rather
+ * than `innerHTML` (an error message is untrusted input). Queued on a macrotask: React's teardown runs after
+ * the callback that reaches here returns, and would remove a node appended inline.
  */
-function showFatal(error, componentStack) {
-    // Queued rather than run inline: React's teardown happens after this callback returns, and would
-    // remove a node appended synchronously along with the rest of the tree.
+function paintOverlay(fill) {
     setTimeout(() => {
         const host = overlayHost();
         host.querySelector('[data-rshono-fatal]')?.remove();
         const box = document.createElement('div');
         box.setAttribute('data-rshono-fatal', '');
-        box.setAttribute('role', 'alert'); // the page is gone; announce it rather than leaving silence
+        box.setAttribute('role', 'alert');
         box.style.cssText =
             'position:fixed;inset:0;z-index:2147483647;overflow:auto;padding:1.5rem;background:#18181b;color:#f4f4f5;' +
                 'font:14px/1.6 ui-monospace,SFMono-Regular,Menlo,monospace;text-align:left';
-        const title = document.createElement('div');
-        title.textContent = isDev ? 'Unhandled error' : 'Something went wrong';
-        title.style.cssText = 'font-size:1.0625rem;font-weight:700;color:#f87171;margin:0 0 0.75rem';
-        box.appendChild(title);
+        fill(box);
+        host.appendChild(box);
+    }, 0);
+}
+/** The overlay's heading. */
+function overlayTitle(text) {
+    const title = document.createElement('div');
+    title.textContent = text;
+    title.style.cssText = 'font-size:1.0625rem;font-weight:700;color:#f87171;margin:0 0 0.75rem';
+    return title;
+}
+/**
+ * Paints the reason for an uncaught render error over the blank page it leaves behind — the full stack in
+ * dev, a generic notice and a reload button in production.
+ */
+function showFatal(error, componentStack) {
+    paintOverlay((box) => {
+        box.appendChild(overlayTitle(isDev ? 'Unhandled error' : 'Something went wrong'));
         if (isDev) {
             const detail = document.createElement('pre');
             detail.style.cssText = 'margin:0;white-space:pre-wrap;word-break:break-word';
@@ -63,165 +101,380 @@ function showFatal(error, componentStack) {
         reload.textContent = 'Reload page';
         reload.style.cssText =
             'margin-top:1.25rem;padding:0.5rem 1rem;font:inherit;color:#18181b;background:#f4f4f5;border:0;border-radius:4px;cursor:pointer';
-        reload.addEventListener('click', () => window.location.reload());
+        reload.addEventListener('click', () => loadOutsideRouter(() => window.location.reload()));
         box.appendChild(reload);
-        host.appendChild(box);
-    }, 0);
+    });
+}
+/**
+ * The end of the line for a `notFound()` that arrived too late to be a 404 and did not survive a reload.
+ *
+ * No reload button, unlike {@link showFatal}: the reload has already been spent, and the second identical
+ * response is what brought us here. "Page not found" is what the server was trying to say, so it is what the
+ * visitor is told; the reason it could not say it properly is a message for whoever wrote the page, and dev is
+ * where they are.
+ */
+function showLateNotFound() {
+    paintOverlay((box) => {
+        box.appendChild(overlayTitle('Page not found'));
+        const message = document.createElement('p');
+        message.textContent = isDev
+            ? 'notFound() was raised from a boundary that resolved after the page shell had been sent, so the response ' +
+                'could not be a 404 — and reloading rendered the same page again. Decide before the render starts ' +
+                'streaming: in Hono middleware, or in the page component body above the boundary.'
+            : 'This page is not available.';
+        message.style.cssText = 'margin:0;color:#d4d4d8';
+        box.appendChild(message);
+    });
+}
+/** What every flight response is typed as. The charset and any other parameters follow it. */
+const FLIGHT_CONTENT_TYPE = 'text/x-component';
+/**
+ * Fetches a payload, refusing a response that is not one.
+ *
+ * The status cannot be the gate: a payload legitimately arrives as a 404 from the `notFound` page and as a
+ * 500 from an action that threw, and both carry a real payload the caller has to see. The content type is.
+ *
+ * What this catches is the response that is not a payload at all — a `bodyLimit()` 413, a proxy's error page,
+ * a 502 mid-deploy. Handed to the flight parser those all surface as `Error: Connection closed.`, with the
+ * status and the body nowhere in sight; here they become an error that says what arrived.
+ */
+async function payloadResponse(request) {
+    const response = await fetch(request);
+    const contentType = response.headers.get('content-type');
+    if (contentType?.startsWith(FLIGHT_CONTENT_TYPE))
+        return response;
+    // Read for the message: a plain-text refusal says what it refused only in its body, and HTTP/2 has no
+    // `statusText` at all. Bounded, because this is an error path and the body is not ours to trust.
+    const body = await response.text().then((text) => text.trim().slice(0, 200), () => '');
+    const status = `${response.status}${response.statusText ? ` ${response.statusText}` : ''}`;
+    throw new Error(`[rshono] the server answered ${status} (${contentType ?? 'no content type'}) instead of a payload${body ? `: ${body}` : ''}`);
+}
+/**
+ * Asks a URL for its flight payload. Deliberately uncached — a payload can never be staler than the click
+ * that wanted it, and the browser's own HTTP cache is what makes a repeat visit cheap.
+ */
+function requestPayload(href, signal) {
+    return createFromFetch(payloadResponse(createRscRequest(new URL(href, location.href).href, undefined, signal)));
+}
+/**
+ * Whether the browser hands us its navigations. Gated on `sourceElement` rather than on `navigation` itself:
+ * Chrome shipped the event in 102 and that property only in 135, and without it a `data-native` link cannot
+ * be told from any other — so the older window would soft-navigate the very links that asked not to be.
+ *
+ * Where this is false there is no interception at all and every navigation is a real browser load, which a
+ * server-rendered app answers correctly on its own. Only the soft part is missing.
+ *
+ * Both globals are tested, and neither is touched before: this runs at module scope, where a ReferenceError
+ * would take the whole client runtime down with it rather than degrading anything.
+ */
+const canSoftNavigate = typeof navigation !== 'undefined' && typeof NavigateEvent !== 'undefined' && 'sourceElement' in NavigateEvent.prototype;
+/**
+ * Drops a navigation's result promises. Both reject when a navigation is superseded or cancelled — routine
+ * here, since a second click is meant to abandon the first — and unhandled they would be reported as faults.
+ */
+function settle(result) {
+    const ignore = () => { };
+    void result.committed?.catch(ignore);
+    void result.finished?.catch(ignore);
+}
+/** Set by {@link loadOutsideRouter}, read and cleared by the `navigate` listener. */
+let bypassRouter = false;
+/**
+ * Performs a navigation the router below must **not** intercept, and returns having asked for it.
+ *
+ * `location.reload()` and `location.assign()` fire a `navigate` event like any other navigation, and
+ * `listenNavigation` intercepts a `reload` on purpose — that is what `router.refresh()` is. Every caller here
+ * is reaching for a *new document* precisely because the current one cannot be repaired: the React root a
+ * soft load would render into is the thing that just failed, or is about to be torn down. Intercepted, the
+ * escape hatch becomes a payload fetch that lands nowhere — which is how a late `notFound()` left the tab on
+ * its Suspense fallback with no second document ever arriving, and how a late `redirect()` moved the address
+ * bar to a page it then failed to render.
+ *
+ * One-shot: the listener clears the flag on the next event it sees. If that event never comes — a navigation
+ * the browser refuses — the cost is that the *next* navigation is a full load rather than a soft one, on a
+ * document that was on its way out anyway.
+ */
+function loadOutsideRouter(navigate) {
+    bypassRouter = true;
+    navigate();
+}
+// The imperative actions behind `useNavigation().router`. Each one only *asks*: the browser turns it into a
+// `navigate` event, which is where `listenNavigation` answers it — so a `router.push` and a link click reach
+// the same code by the same route, and inherit the same fetch, scroll and `pending` flag.
+function push(href) {
+    if (canSoftNavigate)
+        settle(navigation.navigate(href, { history: 'push' }));
+    else
+        window.location.assign(href);
 }
-// In-memory flight-payload cache keyed by same-origin path+search. `data-prefetch`
-// links warm it on hover/focus; a navigation to a warmed URL resolves instantly and
-// clears the entry (a prefetch is used at most once, so re-visits always re-fetch).
-const payloadCache = new Map();
-// Bounded so a long session over a link-dense app can't grow it without limit. Insertion-ordered,
-// so the first key is the least recently warmed.
-const MAX_WARMED_PAYLOADS = 8;
-function cacheKey(href) {
-    const url = new URL(href, location.href);
-    if (url.origin !== location.origin)
-        return null;
-    return url.pathname + url.search;
+function replace(href) {
+    if (canSoftNavigate)
+        settle(navigation.navigate(href, { history: 'replace' }));
+    else
+        window.location.replace(href);
 }
-function requestPayload(href) {
-    return createFromFetch(fetch(createRscRequest(new URL(href, location.href).href)));
+// A traversal is the browser's to perform either way — `navigation` only hands it back as an interceptable
+// event first. Nothing to go back to is a rejection there and a no-op here; both amount to the same thing.
+function back() {
+    if (canSoftNavigate)
+        settle(navigation.back());
+    else
+        window.history.back();
 }
-function warmPayload(href) {
-    const key = cacheKey(href);
-    if (!key || key === cacheKey(location.href) || payloadCache.has(key))
+function forward() {
+    if (canSoftNavigate)
+        settle(navigation.forward());
+    else
+        window.history.forward();
+}
+// A refresh keeps the URL, and is still a navigation: it arrives as `navigationType: 'reload'`, which is what
+// tells the listener to leave scroll and focus where the user left them.
+function refresh() {
+    if (canSoftNavigate)
+        settle(navigation.reload());
+    else
+        window.location.reload();
+}
+/** How long the recovery reload is given to replace this document before the panel is painted instead. */
+const RELOAD_GRACE_MS = 2000;
+/** The `sessionStorage` key bounding the recovery reload for one URL. Spent here, released in {@link main}. */
+const lateNotFoundKey = () => `rshono:late-not-found:${documentUrl()}`;
+/**
+ * Spends the one reload a late `notFound()` gets, or paints if it has already been spent for this URL.
+ *
+ * `redirect()` is terminal on the client — there is somewhere to navigate to — and `notFound()` is not: the
+ * response is already committed as a 200, so the only recovery left is asking for the page again and hoping
+ * the signal comes early enough this time to be a real 404. That works where the lateness was incidental, a
+ * boundary that happened to resolve after the shell on a slow request. Where it is structural — a page that
+ * always signals from a late boundary — the reload gets a byte-identical response and reloads again, and the
+ * tab spins until the visitor leaves. In production nothing is logged, because the warning that explains this
+ * is `isDev`-only.
+ *
+ * So it is bounded: one reload per URL per tab, then {@link showLateNotFound}. `sessionStorage` because the
+ * value has to outlive the document it is written in and must not outlive the tab, and keyed by URL so a
+ * second page's late signal still gets its own attempt.
+ */
+function reloadOnceForLateNotFound() {
+    const key = lateNotFoundKey();
+    let spent;
+    try {
+        spent = sessionStorage.getItem(key) !== null;
+        if (!spent)
+            sessionStorage.setItem(key, '1');
+    }
+    catch {
+        // Storage can throw outright where site data is blocked, and a page that cannot count its reloads has
+        // to pick a side. It picks the terminating one: a message on a page that might have recovered is a
+        // worse outcome than a reload loop only by a lot less.
+        spent = true;
+    }
+    if (spent) {
+        showLateNotFound();
         return;
-    const promise = requestPayload(href);
-    payloadCache.set(key, promise);
-    // One entry in means at most one out, and the first key is the oldest.
-    if (payloadCache.size > MAX_WARMED_PAYLOADS)
-        payloadCache.delete(payloadCache.keys().next().value);
-    // Don't cache failures, and swallow the rejection until (or unless) a nav awaits it.
-    promise.catch(() => {
-        if (payloadCache.get(key) === promise)
-            payloadCache.delete(key);
+    }
+    loadOutsideRouter(() => window.location.reload());
+    // The reload wins this race whenever it happens at all: the document goes away and takes the timer with
+    // it. What this covers is a reload that does not happen — swallowed by an interceptor, refused by the
+    // browser, held by a `beforeunload` — which used to leave the visitor on a Suspense fallback with nothing
+    // coming and nothing said. The panel is the honest answer in that case too.
+    setTimeout(() => {
+        if (!document.querySelector('[data-rshono-fatal]'))
+            showLateNotFound();
+    }, RELOAD_GRACE_MS);
+}
+/**
+ * Turns a control-signal digest — how `redirect()` / `notFound()` reach the browser — into a real
+ * navigation. Returns false for anything else, so callers fall through to their own handling.
+ *
+ * `hard` forces a full document load, for signals that surfaced *through React*: it unmounts the root on
+ * an uncaught error, leaving no live tree to soft-navigate with.
+ */
+function handleControlDigest(error, { hard = false } = {}) {
+    const digest = error?.digest;
+    if (!isControlDigest(digest))
+        return false;
+    const redirect = parseRedirectDigest(digest);
+    if (!redirect) {
+        reloadOnceForLateNotFound();
+    }
+    else if (hard) {
+        loadOutsideRouter(() => window.location.assign(new URL(redirect.location, window.location.href).href));
+    }
+    else {
+        push(redirect.location);
+    }
+    return true;
+}
+/**
+ * Puts a payload on screen, resolving once React has committed it. Replaced by `BrowserRoot`'s own on mount;
+ * the default covers the window before hydration, where `setServerCallback` is already registered but there
+ * is no root to update — a reload is the honest answer, and nothing after it needs to run.
+ */
+let setPayload = () => {
+    window.location.reload();
+    return new Promise(() => { });
+};
+/** Runs work inside the nav transition so `useNavigation().pending` stays true across the round-trip. */
+let startNav = (run) => {
+    void run();
+};
+/**
+ * Fetches the payload for `url` and puts it on screen.
+ *
+ * Resolves once React has **committed** it rather than when the fetch lands: an intercepted navigation
+ * scrolls and moves focus when this promise settles, and a `#hash` target does not exist until the new tree
+ * does. Rejects only on a genuine failure — being superseded is not one, and resolves quietly, because the
+ * navigation that replaced this one owns the screen from then on.
+ */
+function loadPayload(url, signal) {
+    // Deliberately not awaited inside the transition: the scope ends once the payload is handed to React, and
+    // React holds `pending` until the update it scheduled commits. Awaiting the commit *inside* the scope would
+    // work too, but only because React happens not to gate a commit on its async scope settling — an internal
+    // this has no reason to depend on across the whole `^19.1.0` peer range.
+    let committed;
+    const run = async () => {
+        const payload = await requestPayload(url, signal);
+        // The browser aborts a navigation the moment a newer one starts. Checked again after the await because
+        // the fetch may already have resolved by then, and applying it would repaint a page the user has left.
+        if (signal?.aborted)
+            return;
+        if (payload.redirect) {
+            push(payload.redirect);
+            return;
+        }
+        committed = setPayload(payload);
+    };
+    // `startTransition` runs the work but hands nothing back, so the promise carrying a failure is caught here
+    // instead. Assigned synchronously: React invokes the callback before `startNav` returns.
+    let work;
+    startNav(() => (work = run()));
+    return work.then(
+    // Undefined whenever nothing was applied — an abort, or a redirect — and there is then nothing to wait for.
+    () => committed, (error) => {
+        // Checked before the error is read: an abort is this navigation being replaced, and the one that
+        // replaced it owns the outcome.
+        if (signal?.aborted || handleControlDigest(error))
+            return;
+        throw error;
     });
 }
-function takePayload(href) {
-    const key = cacheKey(href);
-    if (key) {
-        const cached = payloadCache.get(key);
-        if (cached) {
-            payloadCache.delete(key);
-            return cached;
+/**
+ * Navigations the browser can hand over but shouldn't:
+ *
+ * - a fragment jump, which is same-document already and needs no payload — the browser's own jump is the one
+ *   that honours `scroll-padding-top`, and re-rendering would pull the target out from under it;
+ * - a download, which is not a navigation of this page at all;
+ * - a `POST` form, which is a submission and the server's to answer (a `GET` form carries its fields in the
+ *   URL, has no `formData`, and soft-navigates like any other link);
+ * - a link marked `data-native`, the documented opt-out.
+ */
+function leaveToBrowser(event) {
+    return event.hashChange || event.downloadRequest !== null || event.formData !== null || event.sourceElement?.hasAttribute('data-native') === true;
+}
+/**
+ * The whole router, in one listener.
+ *
+ * Every navigation the page can make arrives as a `navigate` event — a link click, a `GET` form, a
+ * `history.pushState`, the back button, `navigation.reload()` — already filtered by the browser: it does not
+ * fire for a middle-click, a modified click or a new tab, and reports `canIntercept: false` for anything
+ * cross-origin, or for a traversal that leaves the app. Those need no handling here; they are left alone, and
+ * the browser performs them as it always would.
+ */
+function listenNavigation() {
+    if (!canSoftNavigate)
+        return () => { };
+    const onNavigate = (event) => {
+        // Cleared as it is consumed, whatever this event turns out to be: the flag names one navigation, and the
+        // one it named is the one that just arrived.
+        if (bypassRouter) {
+            bypassRouter = false;
+            return;
         }
-    }
-    return requestPayload(href);
+        if (!event.canIntercept || leaveToBrowser(event))
+            return;
+        // A push or a traversal lands on a new page, so the browser resets the scroll offset — or restores the
+        // one it remembers — and moves focus, which is what makes a soft navigation announce itself to a screen
+        // reader. A replace or a refresh stays where it is, so neither should move. Both wait on the handler,
+        // which is the point of resolving it at commit rather than at fetch.
+        const inPlace = event.navigationType === 'replace' || event.navigationType === 'reload';
+        event.intercept({
+            scroll: inPlace ? 'manual' : 'after-transition',
+            focusReset: inPlace ? 'manual' : 'after-transition',
+            // The URL commits before the handler runs, so a failure leaves the address bar describing a page the
+            // document is not showing. A real load is the only way back to agreement.
+            handler: () => loadPayload(event.destination.url, event.signal).catch(() => loadOutsideRouter(() => window.location.reload())),
+        });
+    };
+    navigation.addEventListener('navigate', onNavigate);
+    return () => navigation.removeEventListener('navigate', onNavigate);
 }
 async function main() {
+    // The assertion is load-bearing under the compiler that builds this: TypeScript 7 declares `nonce` on
+    // HTMLElement, 6 declares it on Element. ESLint runs the older lib — where the narrowing is redundant —
+    // so it reports an assertion that `tsc` requires. Believe `typecheck`, not the rule.
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
     const cspMeta = document.querySelector('meta[property="csp-nonce"]');
     if (cspMeta?.nonce)
         __webpack_nonce__ = cspMeta.nonce;
-    // Both are replaced by BrowserRoot's own on mount. The defaults matter: `setServerCallback` is
-    // registered before hydration, so an action or refresh firing in that window would otherwise call
-    // an unassigned binding. Until there's a root to update, a full reload is the honest fallback.
-    let setPayload = () => {
-        window.location.reload();
-    };
-    // Runs work inside the nav transition so useNavigation().pending stays true across the round-trip.
-    let startNav = (run) => {
-        void run();
-    };
-    const initialPayload = await createFromReadableStream(rscStream);
-    function push(href) {
-        const target = new URL(href, window.location.href);
-        if (target.origin !== window.location.origin) {
-            window.location.assign(target.href);
-            return;
-        }
-        window.history.pushState(null, '', target.href);
-    }
-    function replace(href) {
-        const target = new URL(href, window.location.href);
-        if (target.origin !== window.location.origin) {
-            window.location.replace(target.href);
-            return;
-        }
-        window.history.replaceState(null, '', target.href);
-    }
-    const back = () => window.history.back();
-    const forward = () => window.history.forward();
-    // A refresh keeps the URL, so it can't ride the history patch like push/replace — it drives the flight re-fetch directly (bypassing any warmed cache to get fresh data).
-    const refresh = () => startNav(async () => {
+    const initialPayload = await createFromReadableStream(flightStream);
+    // The recovery reload landed: this document *is* the `notFound` page, so the signal that could only be a
+    // digest on the `RSC: 1` request became a real 404 on the document request. The one-reload bound was spent
+    // on a recovery that worked and has to be released — otherwise the *next* soft navigation to this URL sees a
+    // spent key and paints {@link showLateNotFound} over a page the app can still render.
+    //
+    // This is the discriminator the bound was missing. A structurally late `notFound()` commits its 200 before
+    // it signals, so its reloaded document is the page itself and carries no `notFound`: the key survives and
+    // that loop stays bounded at one reload, which is the whole reason the bound exists.
+    if (initialPayload.notFound) {
         try {
-            await fetchRscPayload(true);
+            sessionStorage.removeItem(lateNotFoundKey());
         }
         catch {
-            window.location.reload();
-        }
-    });
-    /**
-     * Turns a control-signal digest — how `redirect()` / `notFound()` reach the browser — into a real
-     * navigation. Returns false for anything else, so callers can fall through to their own handling.
-     *
-     * `hard` forces a full document load, for signals that surfaced *through React* (a nested
-     * component's redirect, reported via the root error handlers). React unmounts the root on an
-     * uncaught error, so there is no live tree left to soft-navigate with. A signal caught earlier —
-     * a top-level payload rejection — still swaps the payload in place.
-     */
-    function handleControlDigest(error, { hard = false } = {}) {
-        const digest = error?.digest;
-        if (!isControlDigest(digest))
-            return false;
-        const redirect = parseRedirectDigest(digest);
-        if (!redirect) {
-            window.location.reload();
-        }
-        else if (hard) {
-            window.location.assign(new URL(redirect.location, window.location.href).href);
-        }
-        else {
-            push(redirect.location);
-        }
-        return true;
-    }
-    async function fetchRscPayload(force = false) {
-        let payload;
-        try {
-            payload = await (force ? requestPayload(window.location.href) : takePayload(window.location.href));
+            // Blocked site data. `reloadOnceForLateNotFound` already treats that as the terminating case.
         }
-        catch (error) {
-            if (handleControlDigest(error))
-                return;
-            throw error;
-        }
-        if (payload.redirect)
-            return push(payload.redirect);
-        setPayload(payload);
     }
     function BrowserRoot() {
         const [payload, setPayloadState] = React.useState(initialPayload);
         const [pending, startTransition] = React.useTransition();
+        // The resolver the payload on screen still owes — see {@link loadPayload}.
+        const pendingCommit = React.useRef(null);
         React.useEffect(() => {
-            setPayload = (v) => setPayloadState(v);
+            setPayload = (next) => new Promise((resolve) => {
+                // A payload replaced before it ever painted still has a navigation waiting on it. React commits
+                // only the newest, so the effect below never runs for the one it skipped: release it here.
+                pendingCommit.current?.();
+                pendingCommit.current = resolve;
+                setPayloadState(next);
+            });
             startNav = (run) => startTransition(run);
         }, [startTransition]);
-        React.useEffect(() => listenNavigation((restoreScroll) => startNav(async () => {
-            try {
-                await fetchRscPayload();
-                restoreScroll();
-            }
-            catch {
-                window.location.reload();
-            }
-        }), warmPayload), []);
+        /**
+         * Releases the navigation waiting on this payload, which is what lets the browser scroll and move focus
+         * now that their target exists. A layout effect, so the pre-scroll position is never painted.
+         */
+        React.useLayoutEffect(() => {
+            const commit = pendingCommit.current;
+            pendingCommit.current = null;
+            commit?.();
+        }, [payload]);
+        React.useEffect(() => listenNavigation(), []);
         const router = React.useMemo(() => ({ push, replace, back, forward, refresh, pending }), [pending]);
         return _jsx(RouterContext.Provider, { value: router, children: payload.root });
     }
     setServerCallback(async (id, args) => {
         const temporaryReferences = createTemporaryReferenceSet();
+        // The document the action is being called from. Every action response carries a fresh payload for that
+        // page, so if a navigation has moved on by the time it arrives the payload describes a page the user has
+        // left — the return value is still theirs, but painting it is not. Compared without the fragment, which
+        // the server never saw.
+        const calledFrom = documentUrl();
         const request = createRscRequest(window.location.href, {
             id,
             body: await encodeReply(args, { temporaryReferences }),
         });
-        // The action is about to mutate who-knows-what, so anything warmed up to now is pre-mutation
-        // data. Cleared before the round-trip so it happens even if the action throws.
-        payloadCache.clear();
         let payload;
         try {
-            payload = await createFromFetch(fetch(request), { temporaryReferences });
+            payload = await createFromFetch(payloadResponse(request), { temporaryReferences });
         }
         catch (error) {
             if (handleControlDigest(error))
@@ -232,220 +485,109 @@ async function main() {
             push(payload.redirect);
             return undefined;
         }
-        React.startTransition(() => setPayload(payload));
+        if (documentUrl() === calledFrom)
+            React.startTransition(() => void setPayload(payload));
         if (payload.notFound)
             return undefined;
         const result = payload.returnValue;
+        if (!result) {
+            // A payload that is not this action's own reply: the server rendered a page in its place. An action
+            // that had already run has its result carried across (see `actionResults` in entry.rsc.tsx), and the
+            // ways a *caller* can get a request wrong are refused ahead of any render — an unknown id or an
+            // undecodable body is a `text/plain` 400, which `payloadResponse` turns into an error of its own
+            // before this.
+            //
+            // What is left is the server failing before the action ran, which is answered with the `error` page —
+            // a flight payload, so it arrives here rather than at `payloadResponse`, with no `returnValue` in it.
+            // A module the deployment no longer holds is the reachable case: `loadServerAction` throws, the
+            // framework reports it and 500s, and this is what the caller has to go on. Hence the message: the
+            // failure is on the server and its log is where the error is. Below that it is still the defensive
+            // floor for a payload shaped by another deployment or replaced by a proxy — reading `.ok` off it used
+            // to hand the caller `Cannot read properties of undefined`.
+            throw new Error('[rshono] the server action produced no result — the request failed around it and the server answered with a page instead. Its log has the error.');
+        }
         if (!result.ok)
             throw result.error;
         return result.value;
     });
-    // A `redirect()` / `notFound()` from a component *below* the page root can only reach us through
-    // React: it rides the flight payload as an error at that component's position, and boundaries
-    // re-throw it (see boundaries.tsx) so it lands here rather than rendering an error fallback.
+    // A `redirect()` / `notFound()` from a component below the page root reaches us through React: it rides the
+    // flight payload as an error, and boundaries re-throw it so it lands here rather than in a fallback.
     //
-    // Anything that isn't a control signal falls back to what React would have done on its own —
-    // console for a caught error, `reportError` (i.e. window.onerror, so error-reporting tools still
-    // see it) for an uncaught one. Overriding these hooks means opting out of that default, so it has
-    // to be put back by hand.
+    // Installing these hooks opts out of React's own defaults, so everything that isn't a control signal has to
+    // be put back by hand — `reportError` rather than a bare log, so error-reporting tools still see it.
     hydrateRoot(document, _jsx(BrowserRoot, {}), {
         formState: initialPayload.formState,
         onCaughtError: (error, errorInfo) => {
             if (handleControlDigest(error, { hard: true }))
                 return;
-            // A boundary handled this and the tree is intact, so no overlay: whatever fallback the app
-            // chose is the right thing to have on screen.
+            // A boundary handled it and the tree is intact, so no overlay over the app's own fallback.
             console.error(error, errorInfo.componentStack ?? '');
         },
         onUncaughtError: (error, errorInfo) => {
             if (handleControlDigest(error, { hard: true }))
                 return;
-            // Nothing caught it, so React tears the root down — and the root is `document`. This is the
-            // white screen; paint the reason over it.
+            // Nothing caught it, so React tears the root down — and the root is `document`.
             globalThis.reportError(error);
             showFatal(error, errorInfo.componentStack);
         },
     });
     if (import.meta.webpackHot) {
-        // Server code may have changed, so drop any warmed payloads and re-fetch fresh.
-        initDevRefresh(() => {
-            payloadCache.clear();
-            return fetchRscPayload(true);
-        });
+        initDevRefresh();
     }
 }
-/** Hover/focus dwell time before a `data-prefetch` link warms its payload. */
-const PREFETCH_DELAY_MS = 120;
-// An `<a>` we intercept for soft navigation: same-origin, same tab, not a download,
-// and not explicitly opted out with `data-native` (which forces a full browser navigation).
-function isRouterLink(link) {
-    return (!!link.href &&
-        (!link.target || link.target === '_self') &&
-        link.origin === location.origin &&
-        !link.hasAttribute('download') &&
-        !link.hasAttribute('data-native'));
-}
-function listenNavigation(onNavigation, prefetch) {
-    // Scroll restoration. We tag each history entry with a stable numeric key in its
-    // `history.state` and remember scrollY per key, so back/forward restores the exact
-    // position while push scrolls to the top. `manual` hands restoration to us.
-    const scrollByKey = new Map();
-    let seq = 0;
-    const prevRestoration = window.history.scrollRestoration;
-    try {
-        window.history.scrollRestoration = 'manual';
-    }
-    catch { }
-    const keyOf = () => {
-        const state = window.history.state;
-        return state && typeof state.__rshonoScroll === 'number' ? state.__rshonoScroll : null;
-    };
-    const tag = (state, key) => ({ ...state, __rshonoScroll: key });
-    if (keyOf() === null) {
-        window.history.replaceState(tag(window.history.state, seq++), '');
-    }
-    let scrollRaf = 0;
-    const onScroll = () => {
-        if (scrollRaf)
-            return;
-        scrollRaf = requestAnimationFrame(() => {
-            scrollRaf = 0;
-            const key = keyOf();
-            if (key !== null)
-                scrollByKey.set(key, window.scrollY);
-        });
-    };
-    window.addEventListener('scroll', onScroll, { passive: true });
-    const restoreScrollFor = (type) => () => {
-        if (type === 'replace')
-            return;
-        const key = keyOf();
-        requestAnimationFrame(() => {
-            const y = type === 'pop' && key !== null ? (scrollByKey.get(key) ?? 0) : 0;
-            window.scrollTo(0, y);
-        });
-    };
-    const notify = (type) => onNavigation(restoreScrollFor(type));
-    const onPopState = () => notify('pop');
-    window.addEventListener('popstate', onPopState);
-    const oldPushState = window.history.pushState;
-    window.history.pushState = function (state, unused, url) {
-        const res = oldPushState.call(this, tag(state, seq++), unused, url);
-        notify('push');
-        return res;
-    };
-    const oldReplaceState = window.history.replaceState;
-    window.history.replaceState = function (state, unused, url) {
-        const res = oldReplaceState.call(this, tag(state, keyOf() ?? seq++), unused, url);
-        notify('replace');
-        return res;
-    };
-    function onClick(e) {
-        const link = e.target.closest('a');
-        if (link &&
-            link instanceof HTMLAnchorElement &&
-            isRouterLink(link) &&
-            e.button === 0 &&
-            !e.metaKey &&
-            !e.ctrlKey &&
-            !e.altKey &&
-            !e.shiftKey &&
-            !e.defaultPrevented) {
-            if (link.hash && link.pathname === location.pathname && link.search === location.search)
-                return;
-            e.preventDefault();
-            history.pushState(null, '', link.href);
-        }
-    }
-    document.addEventListener('click', onClick);
-    // A prefetch is a full server render, so it waits out a short dwell time on one shared timer:
-    // sweeping the cursor across a list of prefetch links costs one request (for the link the pointer
-    // settled on), not one per link.
-    let prefetchTimer;
-    function onPrefetch(e) {
-        const target = e.target;
-        if (!(target instanceof Element))
-            return;
-        const link = target.closest('a[data-prefetch]');
-        if (!(link instanceof HTMLAnchorElement) || !isRouterLink(link))
-            return;
-        const { href } = link;
-        clearTimeout(prefetchTimer);
-        prefetchTimer = setTimeout(() => prefetch(href), PREFETCH_DELAY_MS);
-    }
-    document.addEventListener('pointerover', onPrefetch);
-    document.addEventListener('focusin', onPrefetch);
-    return () => {
-        clearTimeout(prefetchTimer);
-        document.removeEventListener('click', onClick);
-        document.removeEventListener('pointerover', onPrefetch);
-        document.removeEventListener('focusin', onPrefetch);
-        window.removeEventListener('popstate', onPopState);
-        window.removeEventListener('scroll', onScroll);
-        window.history.pushState = oldPushState;
-        window.history.replaceState = oldReplaceState;
-        try {
-            window.history.scrollRestoration = prevRestoration;
-        }
-        catch { }
-    };
-}
 /**
- * Dev-only refresh client (stripped from prod bundles: the whole call is
- * guarded by import.meta.webpackHot). Listens to the CLI's SSE endpoint:
+ * Dev-only refresh client, listening to the CLI's SSE endpoint:
  *
- *   client-built  → hot-apply the waiting updates (react-refresh keeps
- *                   component state); any failure falls back to reload.
- *   rsc-update    → server component code changed: re-fetch the flight
- *                   payload for the current URL, state preserved.
- *   hello         → sent on (re)connect with the latest build hash; a
- *                   mismatch means events were missed — resync.
+ *   client-built  → hot-apply the waiting updates; anything the page can't be patched up to reloads.
+ *   rsc-update    → server component code changed: re-fetch the flight payload, state preserved.
+ *   hello         → sent on (re)connect with the latest build hash; a mismatch means a missed event.
  */
-function initDevRefresh(fetchRscPayload) {
+function initDevRefresh() {
+    const hot = import.meta.webpackHot;
     let connectedOnce = false;
-    async function applyClientUpdate(hash) {
-        const hot = import.meta.webpackHot;
-        if (hash === __webpack_hash__)
-            return;
-        if (hot.status() !== 'idle') {
-            window.location.reload();
-            return;
-        }
-        try {
-            await hot.check(true);
-            if (hash !== __webpack_hash__)
-                await applyClientUpdate(hash);
-        }
-        catch (error) {
-            console.warn('[rshono] hot update failed, reloading:', error);
-            window.location.reload();
-        }
+    /** The newest build the dev server has announced — what {@link applyClientUpdate} walks towards. */
+    let targetHash;
+    function reload(reason, error) {
+        console.warn(`[rshono] ${reason} — reloading`, ...(error === undefined ? [] : [error]));
+        loadOutsideRouter(() => window.location.reload());
     }
-    const source = new EventSource('/_rshono/hmr');
-    source.onmessage = async (event) => {
-        const message = JSON.parse(event.data);
+    async function applyClientUpdate() {
+        const giveUp = await walkHotUpdates(hot, () => __webpack_hash__, () => targetHash);
+        if (giveUp)
+            reload(giveUp.reason, giveUp.error);
+    }
+    async function handle(message) {
         switch (message.type) {
             case 'hello':
+                targetHash = message.hash ?? targetHash;
                 if (connectedOnce) {
-                    if (message.hash && message.hash !== __webpack_hash__)
-                        await applyClientUpdate(message.hash);
-                    await fetchRscPayload().catch(() => window.location.reload());
+                    await applyClientUpdate();
+                    await loadPayload(window.location.href).catch(() => loadOutsideRouter(() => window.location.reload()));
                 }
                 connectedOnce = true;
                 break;
             case 'client-built':
-                if (message.hash)
-                    await applyClientUpdate(message.hash);
+                targetHash = message.hash;
+                await applyClientUpdate();
                 break;
             case 'rsc-update':
                 console.log('[rshono] server components updated');
-                await fetchRscPayload().catch(() => window.location.reload());
+                await loadPayload(window.location.href).catch(() => loadOutsideRouter(() => window.location.reload()));
                 break;
         }
+    }
+    const source = new EventSource('/_rshono/hmr');
+    // Chained rather than handled as they arrive: `hot.check` may only run from `idle`, and a burst of saves
+    // puts several frames on the wire inside the time one takes. Queueing drops nothing, because `targetHash`
+    // is shared — whichever handler runs next walks to the newest build.
+    let queue = Promise.resolve();
+    source.onmessage = (event) => {
+        const message = JSON.parse(event.data);
+        queue = queue.then(() => handle(message)).catch((error) => reload('the dev client failed', error));
     };
 }
-// Bootstrap failures (a truncated or malformed initial flight payload, most likely) would otherwise
-// be an unhandled rejection: nothing hydrates, nothing is reported, and the page just sits there.
+// A bootstrap failure — a truncated initial payload, most likely — would otherwise be an unhandled
+// rejection: nothing hydrates, nothing is reported, and the page just sits there.
 main().catch((error) => {
     console.error('[rshono] the client runtime failed to start:', error);
     showFatal(error);