@rshono/core 1.0.0-rc.2 → 1.0.0-rc.21

package/dist/runtime/entry.rsc.js

@@ -1,115 +1,208 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Hono } from 'hono';
-import { bodyLimit } from 'hono/body-limit';
-// The JSX factory, by name: the page element is created with this directly rather than as
-// `<Page {...props} />`, because a spread would drop the non-enumerable `ctx` prop. See `pageProps`.
+import { HTTPException } from 'hono/http-exception';
+// Called directly rather than as `<Page {...props} />`: a spread would drop the non-enumerable `ctx`
+// prop. See `pageProps`.
 import { jsx } from 'react/jsx-runtime';
-// The bare specifier, not `/server.node`: the package ships a build per runtime behind export
-// conditions (`node`, `workerd`, `deno`, `edge-light`), and the RSC layer's `conditionNames` is what
-// picks one — so a non-Node deploy target gets its own build instead of Node's by hard-coded path.
+// The bare specifier, not `/server.node`: the RSC layer's `conditionNames` picks the build for the
+// deploy target being compiled for.
 import { createTemporaryReferenceSet, decodeAction, decodeFormState, decodeReply, loadServerAction, renderToReadableStream, } from 'react-server-dom-rspack/server';
-// Resolved by the '@rshono/deploy' alias to the selected preset's runtime module — the one place
-// this file knows anything about where it is running. See `deploy/contract.ts`.
+// Aliased at build time to the selected preset's runtime — the one place this file knows where it runs.
 import { runtime } from '@rshono/deploy';
 // @ts-expect-error — resolved by the '@rshono/routes' alias to the app's routes.ts
 import { routes as userRoutes } from '@rshono/routes';
 // @ts-expect-error — resolved by the '@rshono/server-app' alias (src/server.ts or the empty fallback)
 import * as serverAppModule from '@rshono/server-app';
 import { isPageRoute } from '../router.js';
-import { appendVary, etagMatches } from '../server/headers.js';
-import { getContext, publicUrl, readParams, reportServerError, runWithContext } from './context.js';
-import { isControlSignal, RedirectSignal } from './control.js';
+import { appendVary, etagMatches, varyWith } from '../server/headers.js';
+import { PRERENDER_NONCE_HEADER } from '../server/prerendered.js';
+import { beginPageRender, getRequestContext, publicUrl, readParams, reportServerError, runWithContext } from './context.js';
+import { cameFromPayload, isControlSignal, RedirectSignal } from './control.js';
 import { renderHTML } from './entry.ssr.js';
+import { failureDocument } from './failure-document.js';
 import { RouterProvider } from './navigation.js';
-import { acceptsRsc, isActionRequest, parseRenderRequest, wantsRsc } from './request.js';
-const serverApp = (serverAppModule.default ?? null);
-// Framework settings resolved from rshono.config.ts and compiled into the bundle at build time
-// (see builder/rspack-config.ts). These have no runtime env-var interface — env is for secrets.
-// Named after their ServerConfig fields, so what a setting does here is one grep from where it is
-// resolved. `isDev` among them: the build mode is decided by which command produced the bundle, not
-// by `process.env.NODE_ENV`, and not every runtime this deploys to has a `process` to read anyway.
-const CONFIG = __RSHONO_CONFIG__;
-const { isDev, renderTimeoutMs, cspEnabled, checkOrigin, maxBodyBytes, compress: compressEnabled } = CONFIG;
-/** Extra cross-origin hosts permitted to post server actions, beyond the app's own origin. */
-const allowedOrigins = new Set(CONFIG.allowedOrigins);
-/** How long a prerendered page may be reused before revalidating. Also what `public/` files get. */
+import { asksForRsc, isActionRequest, isBrowserFormPost, parseRenderRequest, requestWantsRsc, RSC_VARY_HEADER, wantsRsc } from './request.js';
+import { assertEndpointModule, assertPageModule, assertRouteModules, validateRoutesModule, validateServerApp } from './validate-entries.js';
+const serverApp = validateServerApp(serverAppModule);
+// Compiled into the bundle from rshono.config.ts by DefinePlugin; there is no runtime env-var interface.
+const { isDev } = __RSHONO_CONFIG__;
+/**
+ * How long a prerendered page may be reused before revalidating. Also what `public/` files get.
+ *
+ * Not a config field, deliberately: it is a per-response header, and `rshono.config.ts` is compiled into the
+ * bundle — a cache policy you cannot change without a rebuild is the wrong shape. An app that wants a longer
+ * `max-age`, or a `stale-while-revalidate`, sets it from middleware **after `await next()`**:
+ *
+ * ```ts
+ * server.use('/docs/*', async (c, next) => {
+ *   await next();
+ *   c.header('cache-control', 'public, max-age=86400, stale-while-revalidate=604800');
+ * });
+ * ```
+ *
+ * After, because the response below is built with `cache-control` in the bag it hands `c.body(...)`, and that
+ * replaces anything prepared before the handler ran. The `ETag` is untouched either way, so revalidation
+ * still costs a 304 rather than the page.
+ *
+ * `c.header()` rather than `c.res.headers.set(...)`, which is the same choice the response floor makes and
+ * for the same reason: it is the one that also works on a response the app did not build. See the floor.
+ */
 const SSG_CACHE_CONTROL = 'public, max-age=300';
 /**
- * The two content types a page can be served as. Both come back from the *same* URL depending on
- * the `Accept` header, which is what makes `Vary` non-optional here.
+ * What a page response gets when nothing else set one: without it a shared cache is free to store a logged-in
+ * user's page and hand it to someone else. `private, no-cache` forbids that without blocking bfcache, which
+ * `no-store` would.
  */
+const PAGE_CACHE_CONTROL = 'private, no-cache';
+/** The two content types a page can be served as, from the same URL — which is what makes `Vary` non-optional. */
 const PAGE_CONTENT_TYPE = /^(?:text\/html|text\/x-component)\b/;
-// The CSP is fixed per build apart from the nonce, so assemble everything but `script-src` once.
-const CSP_STATIC = Object.entries(CONFIG.cspDirectives)
-    .filter(([name]) => name !== 'script-src')
-    .map(([name, value]) => `${name} ${value}`)
-    .join('; ');
-const CSP_SCRIPT_SRC = CONFIG.cspDirectives['script-src'] ?? "'self'";
-// Called here rather than at the top of the deploy runtime's own module so the timing is unchanged:
-// `.env` is loaded once every import above has been evaluated, exactly as before.
 runtime.loadEnv();
-const routeConfig = userRoutes;
+// Checked rather than cast: these two modules are the app's, and a mistake in either used to surface as a
+// `TypeError` from somewhere else entirely — or, for a duplicated path, as nothing at all.
+const routeConfig = validateRoutesModule(userRoutes);
 export const routes = routeConfig.routes;
 /**
- * CSRF guard for server-action POSTs, layering the two signals a browser gives us.
- *
- * `Sec-Fetch-Site` is set by the browser and unforgeable by page script, so `same-origin` settles
- * the question on its own — and short-circuiting on it is what keeps the check from misfiring on a
- * legitimate request whose `Host` the proxy rewrote. Everything else falls back to comparing the
- * `Origin` host against our own (see {@link publicUrl} — deliberately *not* against a raw
- * `X-Forwarded-Host`, which the client controls unless `trustProxy` says a proxy owns it).
- *
- * A missing `Origin` is treated as same-origin: no-JS form posts from older browsers omit it, and
- * those same browsers send no `Sec-Fetch-Site` either, so there is nothing left to check. Hosts are
- * compared case-insensitively; the scheme is not compared, so this alone won't stop an
- * `http://` origin posting to the `https://` site (HSTS is the control for that).
+ * The result of an action that has already run, for the request whose *render* then failed.
+ *
+ * The action and the page it answers with are one response: an action returns its value through the payload
+ * of the page rendered after it. So when that render throws — a page module that will not load, most
+ * plausibly a chunk that went away mid-deploy — `onError` renders the `error` page in its place, and without
+ * this the reply carries no `returnValue` at all. The caller of an action that ran, and may well have
+ * written something, would be told only that a field was missing.
+ *
+ * Keyed on the Hono context the way `beginPageRender` keys its own marker, and weakly, so nothing outlives
+ * the request it belongs to.
  */
-function isSameOriginAction(c) {
-    if (!checkOrigin)
-        return true;
-    const secFetchSite = c.req.header('sec-fetch-site');
-    if (secFetchSite === 'same-origin')
-        return true;
-    const origin = c.req.header('origin');
-    const originHost = origin ? URL.parse(origin)?.host.toLowerCase() || null : null;
-    if (origin !== undefined && originHost === null)
-        return false; // an Origin we can't parse is untrusted.
-    const trusted = originHost !== null && (originHost === publicUrl(c).host.toLowerCase() || allowedOrigins.has(originHost));
-    if (secFetchSite && secFetchSite !== 'none') {
-        // The browser tells us (unforgeably) this didn't originate from our own site — only a
-        // trusted (allowlisted) Origin may proceed.
-        return trusted;
-    }
-    if (originHost === null)
-        return true;
-    return trusted;
+const actionResults = new WeakMap();
+/**
+ * Whether this process is `rshono build`'s prerender pass rather than a server answering requests.
+ *
+ * Set by `build.ts` before it imports the app bundle, which inlines its own copy of the module graph — so
+ * `process.env` is what crosses that boundary, the same channel `runtime/context.ts` and the `node` runtime
+ * already read. Unforgeable from outside: it is an environment variable of the build process, and a deployed
+ * server never has one.
+ */
+const prerendering = typeof process !== 'undefined' && !!process.env?.RSHONO_PRERENDER;
+/**
+ * The per-request CSP nonce, if the app asked for one.
+ *
+ * The framework never mints it: `secureHeaders()` does, when its policy contains the `NONCE`
+ * placeholder, and stores it here — so all the framework does is stamp the value into the render. It is
+ * readable from a route handler because `secureHeaders` resolves its directives before `next()`.
+ *
+ * Always `undefined` while prerendering, because a nonce is per request and a prerendered file is not. The
+ * pass renders through the app's full middleware, so `secureHeaders()` mints one at *build* time and it was
+ * stamped into the document that ships — frozen, and identical in every copy. Which of two bad things that
+ * caused depended on the app's policy: under a global nonce policy the file was never served (the request
+ * has a nonce of its own, so `mustRenderForNonce` renders it fresh) and the build reported prerendering
+ * pages the deployment would never read; under a policy scoped to some other path, `secureHeaders` never ran
+ * on this one, nothing forced a re-render, and the stale build-time nonce shipped — picked up by the client
+ * as `__webpack_nonce__`. Asking for the document without a nonce is what the flight variant already gets,
+ * and it settles both.
+ */
+function cspNonce(c) {
+    return prerendering ? undefined : c.get('secureHeadersNonce');
 }
-async function loadPageModule(load, label) {
-    const mod = await load();
-    const Page = mod.default;
-    if (typeof Page !== 'function') {
-        throw new Error(`[rshono] The page module for ${label} must default-export a server component.`);
-    }
-    if (!Page.entryJsFiles) {
-        throw new Error(`[rshono] The page component for ${label} is missing its client-asset info ('use server-entry'). ` +
-            "The directive is added automatically for inline `component: () => import('…')` thunks in routes.ts. " +
-            "If this page is wired up another way, put 'use server-entry' on the first line of the page module yourself — " +
-            "and make sure the page is a server component (a 'use client' page must be wrapped by a server component instead).");
-    }
-    return Page;
+/**
+ * The build-time half of `mustRenderForNonce`, as a header on the document the prerender pass asked for —
+ * {@link PRERENDER_NONCE_HEADER}, where the contract is written down.
+ *
+ * {@link cspNonce} masks the nonce so none is stamped into a file, but *whether one was minted* is exactly
+ * what decides that file's fate: a request for this path will mint its own, so the document is re-rendered
+ * per request and the copy on disk is never read. Read here rather than through `cspNonce` for that reason —
+ * this is the one place the unmasked value is the answer.
+ *
+ * Empty on a deployed server: `prerendering` is an environment variable of the build process.
+ */
+function prerenderNonceHeader(c) {
+    return prerendering && c.get('secureHeadersNonce') !== undefined ? { [PRERENDER_NONCE_HEADER]: '1' } : null;
+}
+/**
+ * Whether a `<form action={serverAction}>` post came from another site, and so must not be allowed to run one.
+ *
+ * This is not CSRF policy — that is `csrf()` from Hono, registered in `src/server.ts`, which runs ahead of
+ * every page route and covers far more than this. It is the framework declining to run *its own* action
+ * mechanism for a request that mechanism cannot legitimately produce, in the one place the two action shapes
+ * are not equally exposed:
+ *
+ * - A client-initiated action carries `x-rsc-action`, which is not a CORS-simple header. A cross-origin caller
+ *   needs a preflight it will not be given, so that shape cannot be forged from a browser at all.
+ * - A form post is one of the three `enctype` values a browser `<form>` can send, with no header of its own —
+ *   the content types that need no preflight. It is forgeable, and an app with no `src/server.ts` has nothing
+ *   standing in front of it. All three, not the two React writes: see {@link isBrowserFormPost}.
+ *
+ * Both halves are required, because either alone refuses something real:
+ *
+ * - `Sec-Fetch-Site` is the browser's own statement of provenance, unforgeable by page script, and every
+ *   browser that can post a form to a server action sends it. `cross-site` and `same-site` are the two labels
+ *   that mean "not from this origin" — `same-site` is what a *sibling subdomain* gets, which is a user-content
+ *   host, a stale CNAME or a subdomain takeover, so leaving it to `csrf()` meant an app without one could have
+ *   any `'use server'` export driven from next door. An absent header means a non-browser client, which cannot
+ *   be a CSRF victim. `same-origin` and `none` settle it on their own, and are what a genuine post carries
+ *   however many proxies rewrote `Host` on the way in.
+ * - An `Origin` that is the app's own contradicts either label — a browser calls a post from the app's own pages
+ *   `same-origin` — so the pair is a shape no browser produces, and refusing it would only catch a proxy or a
+ *   test client setting the label by hand while posting from the app itself. Nothing else clears the label:
+ *   an `Origin` of `null` (a sandboxed iframe, a `data:` URL, `Referrer-Policy: no-referrer`) and no `Origin`
+ *   at all are both refused. A browser attaches one to every non-GET request, so neither is a shape it
+ *   produces — but a security predicate that says "not proven foreign" rather than "proven local" fails open
+ *   the day something does produce it.
+ *
+ * `publicUrl(c)` rather than `c.req.url`, so it honours `trustProxy` and compares against the origin the
+ * browser actually used — which behind a proxy, `rshono dev`'s included, is not the one the server was reached
+ * on.
+ *
+ * **The cost is wider than "an action you meant to allow".** This runs on the request's shape alone, before
+ * the body is read, because knowing whether a given post carries an action means buffering an untrusted body
+ * to look for a `$ACTION_*` field. So a **page route cannot accept any cross-site form post at all**, whether
+ * or not an action is in it: a SAML ACS callback, OIDC `response_mode=form_post`, and most payment-gateway
+ * returns all arrive in exactly this shape and are all refused, `csrf()`'s allowlist included. Refusing
+ * before parsing is the right trade — the alternative is reading a body from anyone who asks — but it is a
+ * real limitation and the 403 and the README both say so. An `{ type: 'endpoint' }` route is the way to
+ * accept one: those call the app handler directly and never reach `renderPage`, so they never reach this.
+ */
+function refusesCrossSiteForm(c) {
+    const site = c.req.header('sec-fetch-site');
+    if (site !== 'cross-site' && site !== 'same-site')
+        return false;
+    return c.req.header('origin') !== publicUrl(c).origin;
 }
 /** A browser navigation or a crawler, as opposed to a fetch that would rather have plain text. */
 function acceptsHtml(c) {
     return c.req.header('accept')?.includes('text/html') ?? false;
 }
-/** A lazy once-cell: runs `load` at most once and caches the promise, but clears a rejection so a later call can retry. */
+/**
+ * Every plain-text answer the framework gives on a page route: the 404s, the refusals on the action path and
+ * the last-resort 500. One function, because the header bag is what gets forgotten — and the four call sites
+ * used to make three different choices about it, which left the next one to guess.
+ *
+ * Both headers are set here rather than left to the response floor, which only decorates page *content
+ * types* and so never sees a `text/plain` answer.
+ *
+ * - **`cache-control`** matters in one case and is consistency in the rest. A 404 is heuristically cacheable
+ *   under RFC 9111, so without this a shared cache may store the plain-text one — while the rendered HTML
+ *   404 beside it, the same answer to the same request from a client that asked for HTML, is correctly
+ *   private. The action refusals answer a POST, which no cache stores, and 400/403/500 are not in that list
+ *   either; saying it anyway costs a header and settles the question for good.
+ * - **`vary: RSC`** because a page URL has two representations, and every one of these is an answer to a
+ *   request that could have asked for either.
+ */
+function plainRefusal(c, message, status) {
+    return c.text(message, status, { vary: RSC_VARY_HEADER, 'cache-control': PAGE_CACHE_CONTROL });
+}
+/**
+ * The 404 for an app with no `notFound` page, and for a client that wanted neither HTML nor a flight payload.
+ */
+function plainNotFound(c) {
+    return plainRefusal(c, 'Not Found', 404);
+}
+/** A lazy once-cell: runs `load` at most once, but clears a rejection so a later call can retry. */
 function once(load) {
     let promise;
     return () => {
         if (!promise) {
             const pending = (promise = load());
             pending.catch(() => {
-                // Only clear if we're still holding the rejected promise (a later successful load may have already replaced it).
                 if (promise === pending)
                     promise = undefined;
             });
@@ -118,90 +211,126 @@ function once(load) {
     };
 }
 /**
- * Owns the render-deadline lifecycle in one place (the RAII / `defer` pattern — a
- * `using` declaration doesn't fit because the timer must outlive this call to keep
- * guarding the *stream*, not just the function scope). The timer is released on
- * exactly one of: the stream finishing ({@link RenderDeadline.guard}), an explicit
- * {@link RenderDeadline.clear} on an error path, or the signal aborting (client
- * disconnect, or the deadline firing itself). A manually-cleared timer instead of
- * `AbortSignal.timeout()` so a fast response doesn't leave one pending to fire later.
- *
- * One deadline covers the whole request — server action included, not just the render — so a
- * hung action can't pin a socket open indefinitely either.
+ * Passes `stream` through untouched, calling `done` however it ends — for the flight-only response
+ * path, which has no transform of its own to hang a completion hook off. `done` must be idempotent.
  */
-function createRenderDeadline(requestSignal, ms) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(new Error(`[rshono] request exceeded ${ms}ms`)), ms);
-    timer.unref?.();
-    const signal = AbortSignal.any([requestSignal, controller.signal]);
-    const clear = () => clearTimeout(timer);
-    signal.addEventListener('abort', clear, { once: true });
-    return {
-        signal,
-        clear,
-        guard: (stream) => stream.pipeThrough(new TransformStream({ flush: clear })),
-        race(work) {
-            if (signal.aborted)
-                return Promise.reject(signal.reason);
-            const { promise: aborted, reject } = Promise.withResolvers();
-            const onAbort = () => reject(signal.reason);
-            signal.addEventListener('abort', onAbort, { once: true });
-            // `Promise.race` subscribes to `work` either way, so abandoning it can't surface as an
-            // unhandled rejection. Detach on settle so a long-lived signal doesn't accumulate listeners.
-            return Promise.race([work, aborted]).finally(() => signal.removeEventListener('abort', onAbort));
+function releaseWhenDone(stream, done) {
+    return stream.pipeThrough(new TransformStream({
+        transform(chunk, controller) {
+            controller.enqueue(chunk);
         },
+        flush: done,
+        cancel: done,
+    }));
+}
+/**
+ * A macrotask boundary: `setImmediate` where there is one — the current turn's check phase rather than a
+ * timer — and `setTimeout` as the portable fallback, for a runtime without it. `flight-inject.ts` has the
+ * same two lines and the same reason; they are not shared because that module belongs to the SSR layer, and
+ * importing it here would give the RSC layer its own instance of it.
+ */
+const deferTask = typeof setImmediate === 'function'
+    ? setImmediate
+    : (run) => {
+        setTimeout(run, 0);
     };
+/**
+ * Dev-only: says that a control signal arrived too late to be one.
+ *
+ * The root fix is in app code, so authoring time is where this has to be said, and a docs paragraph is not
+ * where anyone reads it. `isDev` is the baked build flag, so a production server pays one boolean check on a
+ * path that has already gone wrong — and says nothing.
+ */
+function warnLateControlSignal(c, signal) {
+    const isRedirect = signal instanceof RedirectSignal;
+    console.warn(`[rshono] ${isRedirect ? `redirect(${JSON.stringify(signal.location)})` : 'notFound()'} was called from a boundary that ` +
+        `resolved after the page shell had already been sent (${c.req.method} ${c.req.path}), so it cannot become a real ` +
+        `${isRedirect ? '3xx' : '404'}: the response is committed as 200 text/html. A browser with JavaScript follows the ` +
+        `digest that rides the payload; one without stays on the Suspense fallback, and a crawler indexes the 200.${isRedirect
+            ? ''
+            : ' A JavaScript client asks for the page once more, in case the signal comes early enough that time to be a real 404 — and shows a plain "Page not found" panel when it does not, rather than reloading into the same response forever.'}` +
+        ' Decide before the render starts streaming — in Hono middleware, or in the page component body above the boundary.');
 }
 /**
  * Builds the props a page component is called with.
  *
- * `url` and `params` match `useNavigation()` field for field, so a read can move between a page and
- * a `'use client'` component unchanged. The `URL` is this page's own — `Ctx` parses its own — so a
- * page that mutates it cannot disturb anything else on the request.
- *
- * `ctx` is *defined* rather than assigned, and both parts of how carry their weight:
+ * `ctx` is *defined* rather than assigned, and both halves are load-bearing:
  *
- * - **A getter**, so nothing is built for the pages that never read it, and so a `render: 'static'`
- *   page that does read it gets {@link getContext}'s own "no per-request context while
- *   prerendering" error rather than a bare `undefined` — one explanation, in one place.
- * - **Non-enumerable**, so React's *development-only* serialization of a server component's props
- *   (the debug channel behind component stacks and the performance track) skips it. That walks own
- *   enumerable properties, and `ctx.raw` is the Hono {@link Context} — whose `env` holds the
- *   runtime's bindings. An enumerable `ctx` ships every one of them, secrets included, to the
- *   browser in dev, and grows a small page's flight payload by well over 10 kB. Production never
- *   serializes a server component's props at all, so this is the dev half of the same guarantee.
+ * - **A getter**, so nothing is built for the pages that never read it, and a `render: 'static'` page
+ *   that does gets {@link getRequestContext}'s prerendering error rather than a bare `undefined`.
+ * - **Non-enumerable**, so React's dev-only serialization of a server component's props skips it. That
+ *   walks own enumerable properties, and `ctx.hono.env` holds the runtime's bindings — an enumerable
+ *   `ctx` would ship every secret to the browser in dev.
  *
- * The cost is that the element has to be created by handing this object to `jsx()` *by reference*:
- * a `<Page {...props} />` spread copies enumerable properties only, and would drop `ctx` silently.
+ * The cost: the element is created by handing this object to `jsx()` by reference, since a
+ * `<Page {...props} />` spread would silently drop `ctx`.
  */
 function pageProps(c, errorInfo) {
     const props = { url: publicUrl(c), params: readParams(c), ...(errorInfo ? { error: errorInfo } : null) };
-    Object.defineProperty(props, 'ctx', { get: getContext, enumerable: false, configurable: true });
+    Object.defineProperty(props, 'ctx', { get: getRequestContext, enumerable: false, configurable: true });
     return props;
 }
 async function renderComponent(c, Page, opts) {
-    const deadline = opts.deadline ?? createRenderDeadline(c.req.raw.signal, renderTimeoutMs);
-    const signal = deadline.signal;
-    const nonce = cspEnabled && !opts.isRsc ? crypto.randomUUID() : undefined;
+    // React's renderers must never be handed `c.req.raw.signal`: they add an `abort` listener and only
+    // remove it if the abort fires, so on the happy path it stays on a request-lifetime signal and pins the
+    // whole rendered tree. The render gets its own controller and the request signal forwards into it —
+    // `release` detaches on the normal path. Not `AbortSignal.any()`, whose composite signals Node holds in
+    // a process-lifetime set until they abort.
+    const requestSignal = c.req.raw.signal;
+    const renderAbort = new AbortController();
+    const signal = renderAbort.signal;
+    const forwardAbort = () => renderAbort.abort(requestSignal.reason);
+    if (requestSignal.aborted)
+        renderAbort.abort(requestSignal.reason);
+    else
+        requestSignal.addEventListener('abort', forwardAbort, { once: true });
+    const release = () => requestSignal.removeEventListener('abort', forwardAbort);
+    // Documents only: the nonce goes on the bootstrap scripts and the `<meta>` React hydrates from, and a
+    // flight payload has neither — which is what keeps a prerendered one servable under a nonce-based CSP.
+    const nonce = opts.isRsc ? undefined : cspNonce(c);
     const props = pageProps(c, opts.errorInfo);
     const root = (_jsxs(_Fragment, { children: [nonce && _jsx("meta", { property: "csp-nonce", nonce: nonce }), Page.entryCssFiles?.map((href) => (_jsx("link", { rel: "stylesheet", href: href, precedence: "default" }, href))), _jsx(RouterProvider, { href: props.url.href, params: props.params, children: jsx(Page, props) })] }));
-    // `notFound` only when it is true, so the flight payload of an ordinary page doesn't carry the key.
+    // `notFound` only when true, so an ordinary page's payload doesn't carry the key.
     const rscPayload = { root, formState: opts.formState, returnValue: opts.returnValue, ...(opts.notFound ? { notFound: true } : null) };
+    // The last thing before the render: past here the response head is the framework's, so `ctx.setHeader()`
+    // starts throwing — while the action `renderPage` just ran, and the middleware around it, legitimately wrote.
+    beginPageRender(c);
     let controlSignal;
+    /** Set once `renderHTML` has returned, which is where the response head stops being changeable. */
+    let shellFlushed = false;
     const rscStream = renderToReadableStream(rscPayload, {
         temporaryReferences: opts.temporaryReferences,
         signal,
         onError(error) {
             if (isControlSignal(error)) {
                 controlSignal = error;
+                if (shellFlushed) {
+                    if (isDev)
+                        warnLateControlSignal(c, error);
+                    // Past the shell the status line, the headers and the first bytes are on the wire, so the digest
+                    // React writes into the payload is the only path left — and everything still rendering is for a
+                    // page the browser is about to navigate away from. Winding it down stops those boundaries, runs
+                    // `flight-inject`'s cancel/flush, and fires the `release()` above now rather than whenever the
+                    // doomed render happens to finish.
+                    //
+                    // One macrotask later rather than from inside `onError`, where React is still handling the error
+                    // that produced the digest — the row carrying it is the only recovery the client has, and an abort
+                    // that re-entered React there could cut the render off before it is written. Measured to survive
+                    // either way on react-server-dom-rspack 0.1.0; deferred anyway, because that ordering is an
+                    // internal the `^19.1.0` peer range does not promise, and the cost is one macrotask on a render
+                    // that is already doomed. The reason is the signal itself, so every boundary the abort errors
+                    // carries the digest rather than a bare AbortError the client would paint as a fault.
+                    if (!signal.aborted)
+                        deferTask(() => renderAbort.abort(error));
+                }
                 return error.digest;
             }
             if (!signal.aborted)
-                reportServerError(error, { source: 'render', request: c.req.raw, message: '[rshono] render error:' });
+                reportServerError(error, { source: 'render', hono: c, message: '[rshono] render error:' });
         },
     });
     if (opts.isRsc) {
-        return c.body(deadline.guard(rscStream), (opts.status ?? 200), {
+        return c.body(releaseWhenDone(rscStream, release), (opts.status ?? 200), {
             'content-type': 'text/x-component;charset=utf-8',
         });
     }
@@ -212,77 +341,266 @@ async function renderComponent(c, Page, opts) {
             formState: opts.formState,
             signal,
             nonce,
-            onShellError: (error) => reportServerError(error, { source: 'ssr', request: c.req.raw, message: '[rshono] SSR shell error:' }),
-            onError: (error) => reportServerError(error, { source: 'ssr', request: c.req.raw, message: '[rshono] SSR error:' }),
+            onDone: release,
+            onShellError: (error) => reportServerError(error, { source: 'ssr', hono: c, message: '[rshono] SSR shell error:' }),
+            onError: (error) => reportServerError(error, { source: 'ssr', hono: c, message: '[rshono] SSR error:' }),
         });
     }
     catch (error) {
-        deadline.clear();
+        // The render is abandoned, so stop it: a boundary still resolving is work for a response that will never
+        // be sent, and it holds the tee's SSR branch open behind it. The `signal.aborted` guard in `onError`
+        // above is what keeps the resulting cancellations from being reported as render errors of their own.
+        renderAbort.abort(error);
+        release();
         if (controlSignal)
             throw controlSignal;
         throw error;
     }
+    // `renderHTML` returns at *shell ready*, so from here the response is the one that ships. Set before the
+    // check below rather than after it, so nothing lands in the window between the two: a signal that arrives
+    // in it is handled there *and* schedules an abort, and aborting an aborted controller is a no-op.
+    shellFlushed = true;
     if (controlSignal) {
-        deadline.clear();
+        // The shell resolved, so this response is live: React is being pumped into the payload-injecting
+        // transform, and a `redirect()` that surfaced from a boundary settling just before the shell was ready
+        // lands here. Nothing will read that stream now — the signal becomes a redirect instead — so it is stopped
+        // rather than left to render to completion for a response that was replaced.
+        //
+        // Both calls, because they stop different halves. `abort` reaches the two renders through the signal they
+        // were handed; cancelling the response readable propagates back through the transform to release the teed
+        // flight branch it holds a reader on, which `abort` alone does not.
+        renderAbort.abort();
+        void ssrResult.stream.cancel().catch(() => {
+            // Already errored or locked — there is nothing left to release either way.
+        });
+        release();
         throw controlSignal;
     }
-    const headers = { 'content-type': 'text/html;charset=utf-8' };
-    if (nonce) {
-        // The nonce is always appended to whatever `script-src` resolved to, so overriding the
-        // directive in `cspDirectives` can widen the policy but can't accidentally drop the nonce.
-        // Dev additionally needs 'unsafe-eval' for react-refresh.
-        const scriptSrc = `script-src ${CSP_SCRIPT_SRC} 'nonce-${nonce}'${isDev ? " 'unsafe-eval'" : ''}`;
-        headers['content-security-policy'] = CSP_STATIC ? `${CSP_STATIC}; ${scriptSrc}` : scriptSrc;
+    return c.body(ssrResult.stream, (opts.status ?? 200), {
+        'content-type': 'text/html;charset=utf-8',
+        ...prerenderNonceHeader(c),
+    });
+}
+/**
+ * The answer to an action request whose body could not be read or decoded — a malformed request, the same
+ * class of thing as the unknown-action-id 400 beside it, and answered the same way.
+ *
+ * Deliberately silent. Action ids are public — they are bare string literals in the client chunks — so
+ * anyone can post a valid id with a body that will not decode, and while that reached `reportServerError` it
+ * was an unauthenticated way to page whoever owns the error tracker, once per request. Nothing here is the
+ * server being wrong, so there is nothing to report; the status is the whole message.
+ *
+ * The text says no more than that on purpose: which of `text()`, `formData()`, `decodeReply` or
+ * `decodeAction` gave up is React's or undici's internal shape, and repeating it back would describe the
+ * framework's decoding to a caller who cannot act on it.
+ */
+function malformedAction(c) {
+    return plainRefusal(c, 'Bad Request: malformed server action request', 400);
+}
+/** The field name React gives the action id of a form with no `useActionState`. See {@link formActionId}. */
+const ACTION_ID_FIELD = '$ACTION_ID_';
+/**
+ * The action id a `<form action={serverAction}>` post names in a field *name*, or `null` for the shape that
+ * does not.
+ *
+ * Two shapes reach `decodeAction`, and only one puts the id somewhere readable. A form with no
+ * `useActionState` posts a bare `$ACTION_ID_<id>` field, whose name is what `decodeAction` itself matches on
+ * — so reading it here is not a second decoder of React's form format. `useActionState`'s shape puts the id
+ * *inside* an encoded `$ACTION_<n>:0` value instead, and reading that would be exactly the drift
+ * `decodeFormState`'s guard below is about: two decoders disagreeing about a wire format neither owns.
+ */
+function formActionId(formData) {
+    for (const key of formData.keys()) {
+        if (key.startsWith(ACTION_ID_FIELD))
+            return key.slice(ACTION_ID_FIELD.length);
+    }
+    return null;
+}
+/**
+ * The first action the server bundle holds itself, as the id to ask `loadServerAction` about when a form
+ * post names none this can see.
+ *
+ * Entries declaring `chunks` are skipped for {@link checkServerActions}'s reason: `loadServerAction` is a
+ * bare `__webpack_require__`, so a module that has not been loaded yet throws for a reason that says nothing
+ * about the deployment — and a probe that answers "broken" for a healthy app is the one failure direction
+ * this must not have.
+ */
+const probeActionId = (() => {
+    for (const [id, entry] of Object.entries(__rspack_rsc_manifest__.serverManifest)) {
+        if ((entry.chunks?.length ?? 0) === 0)
+            return id;
+    }
+    return undefined;
+})();
+/**
+ * Whether the app's `'use server'` module is what `decodeAction` could not load, rather than the caller's
+ * body being what it could not decode.
+ *
+ * Asked by loading an action for real, because nothing on the error says which of the two it was: React
+ * reports a missing module and an undecodable field through the same channel, and the message is its own
+ * internal shape either way. `loadServerAction` is `__webpack_require__` plus a `typeof === 'function'`
+ * check, so a second call after the first succeeded is a cache hit.
+ *
+ * The id it asks about is the one the body names where the body names one, and otherwise any of the app's —
+ * which is the same question, because Rspack concatenates the whole `'use server'` graph into a single
+ * server module (see {@link checkServerActions} and the G1 note): if one action cannot be loaded at run
+ * time, none of them can.
+ *
+ * **Both ways of being wrong land on the old behaviour, deliberately.** No manifest to probe, or a probe
+ * that succeeds while the id the caller actually named is broken — which needs `useActionState`'s shape
+ * *and* a per-entry manifest corruption rather than a module that will not evaluate — answers `false`, and
+ * the 400 stands exactly as it did. What must never happen is the other direction: a malformed body
+ * answering 500 and paging whoever owns the error tracker, which is what {@link malformedAction} exists to
+ * prevent. A probe that throws is the deployment being broken for every caller, so a 500 is then right for
+ * this one too.
+ */
+function cannotLoadServerActions(formData) {
+    const named = formActionId(formData);
+    const id = named !== null && Object.hasOwn(__rspack_rsc_manifest__.serverManifest, named) ? named : probeActionId;
+    if (id === undefined)
+        return false;
+    try {
+        loadServerAction(id);
+        return false;
+    }
+    catch {
+        return true;
     }
-    return c.body(deadline.guard(ssrResult.stream), (ssrResult.status ?? opts.status ?? 200), headers);
 }
 async function renderPage(c, loadPage) {
     const request = c.req.raw;
+    // Ahead of the classification below, and keyed on the request's *shape* rather than on it: every `enctype`
+    // a browser form can post is refused, not only the two React writes. `text/plain` is the third, and keying
+    // this off `parseRenderRequest` left it classified `document` and let through — the one enctype the
+    // framework never decodes was also the one it never refused, while the README promised that a page route
+    // refuses every cross-site form post. See {@link isBrowserFormPost} and `refusesCrossSiteForm`.
+    if (isBrowserFormPost(request) && refusesCrossSiteForm(c)) {
+        // Named for what was actually refused. The check runs before the body is read — it has to, since knowing
+        // whether a post carries an action means buffering an untrusted body — so "to a server action" claimed
+        // something this code cannot know, and said it to a caller whose post very often has no action in it.
+        return plainRefusal(c, "Forbidden: cross-site form post to a page route — a page route cannot accept one, because a form post to a page is how a server action is called. Use an { type: 'endpoint' } route.", 403);
+    }
     const renderRequest = parseRenderRequest(request);
-    // Created before the action runs so the deadline covers the whole request, then handed to
-    // `renderComponent` so the render doesn't get a fresh budget of its own.
-    const deadline = createRenderDeadline(request.signal, renderTimeoutMs);
     let returnValue;
     let formState;
     let temporaryReferences;
     let actionStatus;
     if (isActionRequest(renderRequest)) {
-        if (!isSameOriginAction(c)) {
-            deadline.clear();
-            return c.text('Forbidden: cross-origin server action rejected', 403);
-        }
         if (renderRequest.kind === 'rsc-action') {
-            // Checked before the body is decoded, so an unknown id costs nothing to reject — and
-            // `loadServerAction` would otherwise fault on the missing manifest entry, turning a bad
-            // request into an unhandled 500. `hasOwn` so `__proto__` doesn't resolve to a manifest entry.
+            // Before the body is decoded, so an unknown id costs nothing to reject. `hasOwn` so `__proto__`
+            // does not resolve to a manifest entry.
             if (!Object.hasOwn(__rspack_rsc_manifest__.serverManifest, renderRequest.actionId)) {
-                deadline.clear();
-                return c.text('Bad Request: unknown server action', 400);
+                return plainRefusal(c, 'Bad Request: unknown server action', 400);
+            }
+            let args;
+            try {
+                const contentType = request.headers.get('content-type');
+                const body = contentType?.startsWith('multipart/form-data') ? await request.formData() : await request.text();
+                temporaryReferences = createTemporaryReferenceSet();
+                args = await decodeReply(body, { temporaryReferences });
+            }
+            catch {
+                return malformedAction(c);
+            }
+            // Outside that guard, deliberately. Everything inside it reads or decodes the *body*, which is the
+            // caller's to get wrong; loading the action is not. The id is one `hasOwn` above proved the manifest
+            // holds, so no client can steer this — what is left is the bundle being incomplete: a chunk
+            // `__webpack_require__` cannot find after a partial deploy, or a module that throws as it evaluates.
+            // A 400 there would tell the one caller in that guard who is *not* at fault that they are, and tell
+            // the operator who needs paging nothing at all.
+            let action;
+            try {
+                action = loadServerAction(renderRequest.actionId);
+            }
+            catch (error) {
+                // Attributed to the action rather than left to the top-level handler's `source: 'request'`: the
+                // request was fine, the deployment is not. Then re-thrown, so the app's `error` page answers 500 —
+                // `reportServerError` de-duplicates, so `onError` reporting it again is a no-op.
+                reportServerError(error, { source: 'action', hono: c, message: '[rshono] server action could not be loaded:' });
+                throw error;
             }
-            const contentType = request.headers.get('content-type');
-            const body = contentType?.startsWith('multipart/form-data') ? await request.formData() : await request.text();
-            temporaryReferences = createTemporaryReferenceSet();
-            const args = await decodeReply(body, { temporaryReferences });
-            const action = loadServerAction(renderRequest.actionId);
             try {
-                returnValue = { ok: true, value: await deadline.race(action.apply(null, args)) };
+                returnValue = { ok: true, value: await action(...args) };
             }
             catch (error) {
                 if (isControlSignal(error))
                     throw error;
-                // React sends a thrown action error to the client as an opaque marker in production — no
-                // message, no digest — so without this the failure would be invisible on both ends.
-                reportServerError(error, { source: 'action', request, message: '[rshono] server action error:' });
+                // In production React sends a thrown action error to the client as an opaque marker, so this is
+                // the only place the real one is visible.
+                reportServerError(error, { source: 'action', hono: c, message: '[rshono] server action error:' });
                 returnValue = { ok: false, error };
                 actionStatus = 500;
             }
+            // The action is done and its result is the caller's, whatever becomes of the render below. See
+            // {@link actionResults}.
+            actionResults.set(c, returnValue);
         }
         else {
-            const formData = await request.formData();
-            const decodedAction = await decodeAction(formData, __rspack_rsc_manifest__.serverManifest);
+            // A `<form action={serverAction}>` post, which is the path that runs before hydration and with
+            // JavaScript off. Unlike the client-initiated one it carries no custom header, so it is also the only
+            // action shape a browser can be made to send from another site — refused above, on the shape of the
+            // request rather than on this classification: see `refusesCrossSiteForm`.
+            let formData;
+            try {
+                formData = await request.formData();
+            }
+            catch {
+                return malformedAction(c);
+            }
+            let decodedAction;
+            try {
+                decodedAction = await decodeAction(formData);
+            }
+            catch (error) {
+                // Split from the read above, for the reason F3 split the client-initiated path: `decodeAction` is
+                // two things at once. It reads the caller's body *and* — through `loadServerReference` —
+                // `__webpack_require__`s the module the action lives in, so the 400 that is right about a body is
+                // wrong whenever the deployment is what failed. Which of the two it was is nowhere on the error, so
+                // it is asked directly. See {@link cannotLoadServerActions}.
+                if (cannotLoadServerActions(formData)) {
+                    // The original error, not the probe's: this one is the fault the request actually met. Attributed
+                    // and re-thrown exactly as the `rsc-action` branch does, so the app's `error` page answers 500 and
+                    // the operator is paged instead of the caller being blamed.
+                    reportServerError(error, { source: 'action', hono: c, message: '[rshono] server action could not be loaded:' });
+                    throw error;
+                }
+                return malformedAction(c);
+            }
             if (decodedAction) {
-                const result = await deadline.race(decodedAction());
-                formState = (await decodeFormState(result, formData, __rspack_rsc_manifest__.serverManifest)) ?? undefined;
+                let result;
+                try {
+                    result = await decodedAction();
+                }
+                catch (error) {
+                    if (isControlSignal(error))
+                        throw error;
+                    // Reported here so a no-JS form post is attributed to the action that threw, exactly as the
+                    // client-initiated path is — the top-level handler would call it a `request`. Then re-thrown,
+                    // because this path has no client boundary and no `useActionState` to hand the error to, so the
+                    // app's `error` page is the honest answer. `reportServerError` de-duplicates, so the re-throw
+                    // reaching `onError` does not report it a second time.
+                    reportServerError(error, { source: 'action', hono: c, message: '[rshono] server action error:' });
+                    throw error;
+                }
+                try {
+                    formState = (await decodeFormState(result, formData)) ?? undefined;
+                }
+                catch (error) {
+                    // The action has already run, and may well have written something, so this cannot be refused the
+                    // way an undecodable body *before* it is — the guard above answers 400 precisely because nothing
+                    // has happened yet. What failed here is rebuilding the `useActionState` key from the body's
+                    // `$ACTION_REF_` metadata, and a body React wrote always carries it: this is reachable only from a
+                    // hand-made one, which pairs a `$ACTION_ID_` React took for the call with `$ACTION_REF_`/
+                    // `$ACTION_KEY` fields it did not write. So the page is rendered with no form state, which is
+                    // exactly what a form without `useActionState` gets.
+                    //
+                    // Silent for the same reason `malformedAction` is: action ids are public, so anyone can post one,
+                    // and reporting from here would put an unauthenticated caller back in touch with whoever owns the
+                    // error tracker — for a request that has already had its effects. In dev it is worth a line, since
+                    // there the likely cause is a React or bundler version whose form fields this does not understand.
+                    if (isDev)
+                        console.warn('[rshono] a form post carried form-state fields that could not be decoded; rendering without them:', error);
+                }
             }
         }
     }
@@ -293,102 +611,212 @@ async function renderPage(c, loadPage) {
         formState,
         returnValue,
         temporaryReferences,
-        deadline,
     });
 }
+/**
+ * A thrown value as an `Error`, because that is what Hono's dispatcher requires before it will hand one to
+ * `app.onError`.
+ *
+ * `compose` routes a rejection to the error handler only when it is `instanceof Error`, and **re-throws
+ * anything else** — which rejects `app.fetch` and leaves the answer to whatever is hosting it. Under
+ * `@hono/node-server` that is a bodiless 500 raised outside the app: no `error` page, nothing on stderr, no
+ * `onServerError` report, and not even the response floor's `x-content-type-options` / `referrer-policy` /
+ * `x-frame-options`, since nothing below it ever unwinds. So `throw 'a plain string'` from an endpoint used
+ * to answer strictly worse than `throw new Error('…')` beside it, and `RouteConfig.error` promises the page
+ * for a throw from "an endpoint, a server action, or middleware" — all three reachable this way.
+ *
+ * The test is `instanceof Error` and nothing wider, deliberately: it has to be the *same* test `compose`
+ * makes, so that what this converts is exactly what Hono would have re-thrown. A duck-typed check would
+ * convert a cross-realm `Error` the dispatcher was about to handle, and leave one it was not.
+ *
+ * Converting only a non-`Error` is also what keeps the rest of the error path intact: both control signals
+ * extend `Error`, `cameFromPayload` reads a `digest` off the thrown object, and `reportServerError`
+ * de-duplicates on its identity — a wrapper around any of those would break all three.
+ *
+ * The value goes on `cause` rather than into the message alone. It is the only thing that carries what the
+ * app actually threw, an error tracker walks it, and the wrapper's own `stack` starts *here*, in the
+ * framework, so it says nothing about where the throw came from.
+ */
+function asError(value) {
+    if (value instanceof Error)
+        return value;
+    let described;
+    try {
+        // Quoted for a string, so an empty one is still visible; anything else prints however it prints. A
+        // `toString` that throws in its turn leaves only the type to say, and this must not fail in a catch.
+        described = typeof value === 'string' ? JSON.stringify(value) : String(value);
+    }
+    catch {
+        described = typeof value;
+    }
+    return new Error(`[rshono] a non-Error value was thrown: ${described}`, { cause: value });
+}
 function buildApp() {
     const app = new Hono();
-    // Outermost, so it wraps the finished response — headers and all — on the way out. A platform that
-    // compresses for us (or cannot stream a compressor) offers none, and the setting has nothing to do.
-    if (compressEnabled && runtime.compress)
-        app.use(runtime.compress);
-    // Cheap, unconditional headers that only matter when something else has gone wrong: stop
-    // content-type sniffing, keep the full URL (paths, query) out of cross-origin referrers, and
-    // refuse to be framed by another origin (clickjacking). `frame-ancestors` in the opt-in CSP is
-    // stricter and takes precedence where both apply; this is the floor for everyone else.
-    // Set after `next()` so a route or middleware that sets its own value wins.
+    // A floor, not a policy: an app wanting the full set registers `secureHeaders()` in src/server.ts, and
+    // because this is registered first it unwinds last, so the "only if unset" checks stand aside for it.
+    // Owned by the framework so that an app with no src/server.ts at all still gets it.
     app.use(async (c, next) => {
         await next();
         const headers = c.res.headers;
+        /**
+         * The headers this response still needs, collected before any of them is written — because the writing
+         * is the part that cannot go through `headers.set(…)`.
+         *
+         * A handler is free to return a `Response` it did not build. `Response.redirect(…)` and every result of
+         * `fetch()` carry an **immutable** header bag, and handing one straight back is ordinary Hono — proxying
+         * an upstream is the commonest thing a Worker does. `.set()` on one throws `TypeError: immutable`, which
+         * is what this floor used to answer such a handler with: the throw reached `onError`, the app's 500 page
+         * went out in place of the redirect, and the app's error tracker got `immutable` and a minified frame
+         * naming nothing anyone could act on.
+         *
+         * Invisible on the targets anyone develops against, which is the whole hazard: `@hono/node-server`
+         * installs a mutable `Response` shim as a global, so `node` and `vercel` — dev, `rshono start` and every
+         * suite that drives them — cannot see the bug that `cloudflare` and `aws-lambda` will. The framework
+         * already knew the mechanism: it is written on `serveAsset` in `cloudflare/runtime.ts`, which repairs the
+         * framework's *own* asset responses by hand.
+         *
+         * `c.header()` is the repair, and Hono's own — it rebuilds a finalized response as
+         * `new Response(res.body, res)` before writing. It does that on *every* call, so collecting is what keeps
+         * it to one rebuild: the first write goes through `c.header()` and the rest to the bag it hands back
+         * (measured at 1.2 µs against 4.9 µs for five separate calls), and a response that already carries all of
+         * these is not rebuilt at all.
+         */
+        const writes = [];
         if (!headers.has('x-content-type-options'))
-            headers.set('x-content-type-options', 'nosniff');
+            writes.push(['x-content-type-options', 'nosniff']);
         if (!headers.has('referrer-policy'))
-            headers.set('referrer-policy', 'strict-origin-when-cross-origin');
+            writes.push(['referrer-policy', 'strict-origin-when-cross-origin']);
         if (!headers.has('x-frame-options'))
-            headers.set('x-frame-options', 'SAMEORIGIN');
-        // Page responses only, from here down. Two things are true of them and of nothing else served
-        // here: one URL answers with either an HTML document or a flight payload depending on `Accept`,
-        // and the default page is request-specific (cookies, session, headers).
-        if (!PAGE_CONTENT_TYPE.test(headers.get('content-type') ?? ''))
-            return;
-        appendVary(headers, 'Accept');
-        // Without this a page carries no cache directives at all, and a shared cache — a CDN, a
-        // corporate proxy — is free to store a logged-in user's page and hand it to someone else.
-        // `private` forbids exactly that; `no-cache` makes the browser revalidate its own copy rather
-        // than re-showing a stale personalised page. Neither blocks bfcache, which `no-store` would.
-        // A prerendered page, or anything a route set deliberately, already has its own value.
-        if (!headers.has('cache-control'))
-            headers.set('cache-control', 'private, no-cache');
+            writes.push(['x-frame-options', 'SAMEORIGIN']);
+        // React Refresh compiles updates with `eval`, so a dev build cannot run under a production CSP.
+        // Widened here so one policy in src/server.ts serves both.
+        if (isDev) {
+            const csp = headers.get('content-security-policy');
+            if (csp?.includes('script-src ')) {
+                writes.push(['content-security-policy', csp.replace('script-src ', "script-src 'unsafe-eval' ")]);
+            }
+        }
+        // Page responses only.
+        if (PAGE_CONTENT_TYPE.test(headers.get('content-type') ?? '')) {
+            const vary = varyWith(headers.get('vary'), RSC_VARY_HEADER);
+            if (vary !== null)
+                writes.push(['vary', vary]);
+            if (!headers.has('cache-control'))
+                writes.push(['cache-control', PAGE_CACHE_CONTROL]);
+        }
+        let writable;
+        for (const [name, value] of writes) {
+            if (writable)
+                writable.set(name, value);
+            else {
+                c.header(name, value);
+                writable = c.res.headers;
+            }
+        }
     });
-    // A memory-exhaustion guard for *every* route — pages and actions, `{ type: 'endpoint' }` routes
-    // and the src/server.ts sub-app alike — since anything that buffers a body (`.json()`,
-    // `.formData()`) is exposed, not just server actions. Rejects an over-cap `Content-Length` up
-    // front and otherwise counts the stream, so a chunked or under-reported body is still cut off.
-    if (maxBodyBytes > 0) {
-        app.use(bodyLimit({ maxSize: maxBodyBytes, onError: (c) => c.text('Payload Too Large', 413) }));
-    }
-    runtime.mountStaticAssets(app);
-    // Mounted ahead of the page routes so the sub-app's middleware (auth, logging, trailing-slash)
-    // wraps page requests too. The flip side: a *terminal* handler in src/server.ts at the same path
-    // as a page route wins over the page.
+    // The backstop for {@link asError}, and *second* for a reason: the middleware that throws is the one whose
+    // own half after `await next()` is skipped, so converting in the floor above would buy `onError` at the
+    // cost of the headers that floor exists to set. Here the conversion happens below it, `compose` hands the
+    // `Error` to `onError` at this level, and the floor unwinds over the response that comes back.
+    //
+    // Second also means *above the app's own middleware*, which is what the two conversions further down make
+    // up for: an endpoint or a page route converts at its own handler, so a middleware's post-`next()` half
+    // still runs, exactly as it does for a thrown `Error`. What is left over is a *middleware* that throws a
+    // non-`Error` itself — then everything registered outside it is skipped, and nothing short of a change in
+    // `compose` could do otherwise.
+    app.use(async (c, next) => {
+        try {
+            await next();
+        }
+        catch (error) {
+            throw asError(error);
+        }
+    });
+    // First, so the app's own middleware (`csrf()`, `bodyLimit()`, auth, logging) wraps everything registered
+    // below: the page routes, and the asset handlers too. Assets used to be mounted ahead of this, which left
+    // `/_static/*` answered by a terminal handler nothing of the app's ever saw — no `secureHeaders()`, and so
+    // no HSTS on exactly the requests a downgrade attack lands on. The flip side is the same one it always had,
+    // one path wider: a *terminal* handler in src/server.ts shadows a page at the same path, and unscoped
+    // middleware now also runs for `/_static`, which is a reserved prefix an app should not be matching on
+    // purpose anyway.
     if (serverApp) {
         app.route('/', serverApp);
     }
-    const memoizePage = (page, label) => once(() => loadPageModule(page.component, label));
+    runtime.mountStaticAssets(app);
+    const memoizePage = (page, label) => once(async () => assertPageModule(await page.component(), label));
     const loadNotFoundPage = routeConfig.notFound ? memoizePage(routeConfig.notFound, 'the notFound page') : null;
     /** Turns a thrown `redirect()` / `notFound()` into the response it stands for. */
     const respondToControlSignal = async (c, signal) => {
-        const isRsc = wantsRsc(parseRenderRequest(c.req.raw));
+        const isRsc = requestWantsRsc(c.req.raw);
         if (signal instanceof RedirectSignal) {
             if (isRsc) {
-                return c.body(renderToReadableStream({ root: null, redirect: signal.location }, { signal: c.req.raw.signal }), 200, {
+                // No `signal`: two fields and no component tree, so there is nothing worth aborting.
+                return c.body(renderToReadableStream({ root: null, redirect: signal.location }), 200, {
                     'content-type': 'text/x-component;charset=utf-8',
                 });
             }
-            return c.redirect(signal.location, signal.status);
+            // Both page defaults by hand: `c.redirect` builds a bodiless response with no content type, so the
+            // middleware that would apply them skips it on `PAGE_CONTENT_TYPE`. They are not decoration here —
+            // `301` and `308` are cacheable with no explicit `Cache-Control` at all, so a session-gated permanent
+            // redirect could otherwise be stored by a shared cache and replayed to another visitor, and without
+            // `Vary` this document redirect could answer an `RSC: 1` fetch that needs the payload above.
+            //
+            // Written straight to the bag, unlike the floor: `c.redirect` builds this response here and now, so it
+            // is Hono's own and mutable. `Response.redirect()` — the one an *app* would reach for — is not.
+            const redirected = c.redirect(signal.location, signal.status);
+            appendVary(redirected.headers, RSC_VARY_HEADER);
+            if (!redirected.headers.has('cache-control'))
+                redirected.headers.set('cache-control', PAGE_CACHE_CONTROL);
+            return redirected;
         }
         if (loadNotFoundPage) {
-            return renderComponent(c, await loadNotFoundPage(), { status: 404, isRsc, notFound: true });
+            try {
+                return await renderComponent(c, await loadNotFoundPage(), { status: 404, isRsc, notFound: true });
+            }
+            catch (error) {
+                // The `notFound` page is already the answer to a request that went wrong, so a failure here has
+                // nowhere to escalate to: this runs from `onError` as well as from the page handler, and Hono calls
+                // `onError` inside its own catch — a throw from there rejects `app.fetch`, which
+                // `@hono/node-server` turns into a bodiless 500 with nothing in the log. So it is answered here, the
+                // way a failing `error` page is answered below.
+                //
+                // A `redirect()` from the page is the exception: nothing is committed yet, the branch above cannot
+                // fail, and this is what the same page does when `app.notFound` renders it — so it is honoured, and
+                // recurses exactly once.
+                if (error instanceof RedirectSignal)
+                    return respondToControlSignal(c, error);
+                reportServerError(error, { source: 'render', hono: c, message: '[rshono] the notFound page failed to render:' });
+            }
         }
-        // Plain text, but still one of the two answers this URL gives depending on `Accept`.
-        return c.text('Not Found', 404, { vary: 'Accept' });
+        return plainNotFound(c);
     };
     for (const route of routes) {
         if (isPageRoute(route)) {
-            // Both are fixed for the life of the process, so resolve them once here instead of per request.
+            // Both fixed for the life of the process, so resolved once rather than per request.
             const servesPrerendered = !isDev && route.render === 'static';
-            const loadPage = once(() => loadPageModule(route.component, `"${route.path}"`));
-            const handler = async (c) => {
+            const loadPage = once(async () => assertPageModule(await route.component(), `"${route.path}"`));
+            /** Everything the route answers, before a HEAD has its body taken off it. */
+            const respond = async (c) => {
                 try {
-                    if (servesPrerendered && c.req.method === 'GET') {
-                        const isRsc = acceptsRsc(c.req.raw);
-                        // Both representations are prerendered, so a soft navigation is served from the build too
-                        // rather than re-rendering a page that was already built. The exception is the HTML
-                        // under `csp`, which has to be rendered per request to carry its nonce — the flight
-                        // payload never carries one, so it stays servable either way.
-                        if (!(cspEnabled && !isRsc)) {
+                    // A HEAD takes the GET path, prerendered bytes included: the headers it promises are the ones a
+                    // GET would send, `etag` and `content-length` among them.
+                    if (servesPrerendered && (c.req.method === 'GET' || c.req.method === 'HEAD')) {
+                        const isRsc = asksForRsc(c.req.raw);
+                        // One fixed set of bytes cannot carry a per-request nonce, so a document has to be rendered
+                        // where the app's CSP has one. Decided per request, so an app whose policy carries no `NONCE`
+                        // keeps its prerendered documents. A flight payload never carries a nonce either way.
+                        const mustRenderForNonce = !isRsc && cspNonce(c) !== undefined;
+                        if (!mustRenderForNonce) {
                             const page = await runtime.readPrerendered(c, isRsc ? 'flight' : 'html');
-                            // A prerendered page is request-independent by construction, so it is safe to cache
-                            // publicly; the short max-age matches what `public/` files get. The ETag turns the
-                            // revalidation that follows into a 304 rather than the page all over again.
-                            //
-                            // Answered outside `runWithContext`: no app code runs on this path, so there is no
-                            // `getContext()` to serve and no reason to pay for the AsyncLocalStorage scope.
+                            // Request-independent by construction, so it is safe to cache publicly; the ETag turns the
+                            // revalidation that follows into a 304. Answered outside `runWithContext` — no app code runs
+                            // on this path, so there is no `getRequestContext()` to serve.
                             if (page !== null) {
                                 const headers = {
                                     'cache-control': SSG_CACHE_CONTROL,
                                     etag: page.etag,
-                                    vary: 'Accept',
+                                    vary: RSC_VARY_HEADER,
                                     'content-type': isRsc ? 'text/x-component;charset=utf-8' : 'text/html;charset=utf-8',
                                 };
                                 if (etagMatches(c.req.header('if-none-match'), page.etag))
@@ -402,38 +830,84 @@ function buildApp() {
                 catch (error) {
                     if (isControlSignal(error))
                         return runWithContext(c, () => respondToControlSignal(c, error));
-                    throw error;
+                    // Converted here rather than left to the backstop above the app's middleware, so a page or an
+                    // action that throws a non-`Error` reaches `onError` from this route's own dispatch level — which
+                    // is where a thrown `Error` reaches it, and so the only place from which a middleware's
+                    // post-`next()` half runs. See {@link asError}.
+                    throw asError(error);
+                }
+            };
+            const handler = async (c) => {
+                const response = await respond(c);
+                // Hono dispatches a HEAD to the GET route and then rebuilds the response as `new Response(null, res)`,
+                // which drops the body without reading it — so for a rendered page nothing ever consumes the stream:
+                // `flight-inject`'s `cancel` never runs, and neither does the `release()` that detaches the abort
+                // forwarder from the request signal. Cancelling here is what ends the render nobody asked to read.
+                if (c.req.method === 'HEAD' && response.body !== null) {
+                    void response.body.cancel().catch(() => {
+                        // Already errored or locked, and there is nothing left to release either way.
+                    });
+                    return new Response(null, response);
                 }
+                return response;
             };
             app.on(['GET', 'POST'], route.path, handler);
         }
         else {
-            const loadEndpoint = once(() => route.server());
+            // Checked on the way out of the thunk rather than at the call site, so `once`'s cache holds a handler
+            // that has already been proven to be one — and a rejection clears, so the message repeats per request.
+            const loadEndpoint = once(async () => assertEndpointModule(await route.server(), `"${route.path}"`));
             const handler = async (c, next) => {
-                const { handler: endpointHandler } = await loadEndpoint();
-                return endpointHandler(c, next);
+                const endpointHandler = await loadEndpoint();
+                try {
+                    // Awaited rather than returned, so a rejection is this frame's to catch: the same conversion the
+                    // page route makes, for the same reason. See {@link asError}.
+                    // Hono's `Handler` leaves its return parameter defaulted to `any`, so this hands back exactly what
+                    // the app's own handler is declared to return — there is nothing narrower to assert here.
+                    // eslint-disable-next-line @typescript-eslint/no-unsafe-return
+                    return await endpointHandler(c, next);
+                }
+                catch (error) {
+                    throw asError(error);
+                }
             };
-            const method = route.method ?? 'all';
-            if (method === 'all')
+            // De-duplicated, because `app.on(['GET', 'GET'], …)` registers the path twice. Validation refuses
+            // `'all'` inside a list, so a list that reaches here is concrete methods only.
+            const methods = [...new Set([route.method ?? 'all'].flat())];
+            if (methods.includes('all'))
                 app.all(route.path, handler);
-            else
-                app.on(method.toUpperCase(), route.path, handler);
+            else {
+                app.on(methods.map((method) => method.toUpperCase()), route.path, handler);
+            }
         }
     }
     runtime.mountPublicFallback(app);
     app.notFound(async (c) => {
-        const isRsc = wantsRsc(parseRenderRequest(c.req.raw));
+        const isRsc = requestWantsRsc(c.req.raw);
         if (loadNotFoundPage && (isRsc || acceptsHtml(c))) {
-            return runWithContext(c, async () => renderComponent(c, await loadNotFoundPage(), { status: 404, isRsc }));
+            // `notFound: true` here as well as on the signal path: the two produce the same page for the same
+            // status, and a payload that says so from one route and not the other is a wire contract with a hole
+            // in it. The client reads it to tell "this is the 404 page" from "this is the page you asked for".
+            return runWithContext(c, async () => renderComponent(c, await loadNotFoundPage(), { status: 404, isRsc, notFound: true }));
         }
-        return c.text('Not Found', 404, { vary: 'Accept' });
+        return plainNotFound(c);
     });
     const loadErrorPage = routeConfig.error ? memoizePage(routeConfig.error, 'the error page') : null;
     app.onError(async (error, c) => {
         if (isControlSignal(error))
             return runWithContext(c, () => respondToControlSignal(c, error));
-        reportServerError(error, { source: 'request', request: c.req.raw, message: '[rshono] request error:' });
-        const isRsc = wantsRsc(parseRenderRequest(c.req.raw));
+        // Registering an `onError` replaces Hono's default handler, which is what turns an `HTTPException`
+        // into the response it carries — without this, `csrf()`'s 403 and `bodyLimit()`'s 413 would both
+        // surface as a 500 error page. Rebuilt through `c`, as Hono's default does, so headers middleware
+        // already prepared survive.
+        if (error instanceof HTTPException) {
+            const res = error.getResponse();
+            return c.newResponse(res.body, res);
+        }
+        // Not a shell failure re-thrown from `renderComponent`: {@link cameFromPayload} says why.
+        if (!cameFromPayload(error))
+            reportServerError(error, { source: 'request', hono: c, message: '[rshono] request error:' });
+        const isRsc = requestWantsRsc(c.req.raw);
         if (loadErrorPage && (isRsc || acceptsHtml(c))) {
             const errorInfo = isDev
                 ? {
@@ -442,25 +916,110 @@ function buildApp() {
                 }
                 : { message: 'Internal Server Error' };
             try {
-                return await runWithContext(c, async () => renderComponent(c, await loadErrorPage(), { status: 500, isRsc, errorInfo }));
+                return await runWithContext(c, async () => renderComponent(c, await loadErrorPage(), { status: 500, isRsc, errorInfo, returnValue: actionResults.get(c) }));
             }
             catch (renderError) {
-                reportServerError(renderError, { source: 'request', request: c.req.raw, message: '[rshono] the error page failed to render:' });
+                // A `redirect()` is not a render failure, and this is the one catch on that path that used to treat
+                // it as one — a 500 and a misleading line in the app's error tracker, where the `notFound` page's
+                // identical branch answers the redirect. Nothing is committed yet and the branch that answers it
+                // cannot fail, which is the same reasoning as there.
+                //
+                // `notFound()` is deliberately **not** honoured here: it would render the `notFound` page from
+                // inside the error path, which can fail in its turn and has nowhere left to escalate to. It stays
+                // reported.
+                if (renderError instanceof RedirectSignal)
+                    return respondToControlSignal(c, renderError);
+                // Not as a render failure, for a signal — that message describes a bug in the page, and this is the
+                // framework declining to act. An author who wrote `notFound()` in their `error` page and read "the
+                // error page failed to render: NotFoundSignal" would go looking for the wrong thing.
+                const message = isControlSignal(renderError)
+                    ? '[rshono] notFound() from the error page is not honoured — it would render the notFound page from inside the error path. The framework 500 answers instead:'
+                    : '[rshono] the error page failed to render:';
+                // An `error` page whose *own* render threw arrives here as a payload stand-in, its real fault
+                // already reported as `render` by the render that produced it. So the line still goes to stderr —
+                // with two `render` reports on one request it is what says which of them was the error page — but
+                // it is not a second report of one fault. {@link cameFromPayload}.
+                if (cameFromPayload(renderError))
+                    console.error(message, renderError);
+                else
+                    reportServerError(renderError, { source: 'request', hono: c, message });
             }
         }
+        // A client that asked for HTML gets a document, even here: this is the last resort for an app with no
+        // `error` page, and for one whose `error` page threw in its turn, and a browser handed `text/plain` in
+        // either case shows a bare line of text where the app used to show a page. Everything else — a flight
+        // fetch, curl, a probe — gets the plain line, which is what it asked for.
+        if (!isRsc && acceptsHtml(c)) {
+            return c.html(failureDocument(error), 500, { vary: RSC_VARY_HEADER, 'cache-control': PAGE_CACHE_CONTROL });
+        }
         const detail = isDev ? `\n\n${error instanceof Error ? (error.stack ?? error.message) : String(error)}` : '';
-        return c.text(`Internal Server Error${detail}`, 500, { vary: 'Accept' });
+        return plainRefusal(c, `Internal Server Error${detail}`, 500);
     });
     return app;
 }
+/**
+ * Loads the app's server actions, so a `'use server'` module that cannot be evaluated is a line in the build
+ * log rather than a 500 on the first action anyone calls.
+ *
+ * Nothing on the server imports these modules until an action is called: a `'use client'` component that
+ * calls one gets a `createServerReference` stub, so the only thing holding them is the manifest. That makes
+ * an action module the one part of an app a build never touched — and the failure it hides is not one route,
+ * it is every action that module holds, which in practice is all of them (Rspack compiles the app's whole
+ * `'use server'` graph into a single server module).
+ *
+ * One id per *module*, because that is the granularity of the failure that matters — and evaluating a module
+ * that throws once per action id would repeat whatever it did before throwing. The rest of that module's ids
+ * are then cache hits, so they are checked too: `loadServerAction` also refuses an export that is not a
+ * function, and that is per id.
+ *
+ * Entries declaring `chunks` are skipped. `loadServerAction` is a bare `__webpack_require__`, so a module
+ * that has not been loaded yet would throw here for a reason that says nothing about the app — and every
+ * action this framework has produced sits in the server bundle itself, with no chunks to load.
+ *
+ * A warning, not a failure, for the same reason {@link assertRouteModules} warns: a module can legitimately
+ * decline to evaluate in a build — one that reads a secret out of the environment, say — and a build is not
+ * where that gets decided.
+ */
+function checkServerActions() {
+    const entries = Object.entries(__rspack_rsc_manifest__.serverManifest).filter(([, entry]) => (entry.chunks?.length ?? 0) === 0);
+    /** Action ids by the module that holds them, in manifest order. */
+    const byModule = new Map();
+    for (const [actionId, entry] of entries)
+        byModule.set(entry.id, [...(byModule.get(entry.id) ?? []), actionId]);
+    for (const actionIds of byModule.values()) {
+        for (const actionId of actionIds) {
+            try {
+                loadServerAction(actionId);
+            }
+            catch (error) {
+                const reason = error instanceof Error ? error.message : String(error);
+                console.warn(`  ⚠ the module holding ${actionIds.length} of the app's ${entries.length} server action(s) could not be loaded at build time — ${reason}\n` +
+                    `    Calling one of those actions loads that module first, so if it fails the same way at run time, each of them answers 500.`);
+                break;
+            }
+        }
+    }
+}
+/**
+ * Everything about the app a build can check without serving a request: every route's own module — page and
+ * endpoint alike, `notFound` and `error` included — and then the server actions, which no route reaches.
+ *
+ * Called by `rshono build` once this bundle is imported for the prerender pass, so a route that could never
+ * serve a request fails the build rather than answering 500 in production. Exported from here rather than
+ * driven from the CLI because both halves read module-scope state — `routeConfig`, and the manifest the RSC
+ * plugin injects — neither of which leaves this bundle.
+ */
+export const checkAppModules = async () => {
+    await assertRouteModules(routeConfig);
+    checkServerActions();
+};
 export const app = buildApp();
 /**
- * The app, handed to whatever is hosting it.
+ * The app, handed to whatever is hosting it: this binds a port and exports nothing where rshono owns the
+ * process, and *is* the export the platform looks for where the host owns it — so one entry serves both.
  *
- * On a platform where rshono owns the process this binds a port and the default export is nothing;
- * where the host owns it, this *is* the export the platform looks for — so the same entry serves
- * both without a per-platform entry file. `app` and `routes` stay named exports either way, because
- * `rshono build` imports them to prerender `render: 'static'` routes.
+ * `app` and `routes` stay named exports either way, because `rshono build` imports them to prerender
+ * `render: 'static'` routes.
  */
 export default runtime.serveApp(app);
 //# sourceMappingURL=entry.rsc.js.map