@rshono/core 1.0.0-rc.6 → 1.0.0-rc.8

package/dist/runtime/entry.rsc.js

@@ -1,12 +1,12 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Hono } from 'hono';
-import { bodyLimit } from 'hono/body-limit';
+import { HTTPException } from 'hono/http-exception';
 // The JSX factory, by name: the page element is created with this directly rather than as
 // `<Page {...props} />`, because a spread would drop the non-enumerable `ctx` prop. See `pageProps`.
 import { jsx } from 'react/jsx-runtime';
 // The bare specifier, not `/server.node`: the package ships a build per runtime behind export
-// conditions (`node`, `workerd`, `deno`, `edge-light`), and the RSC layer's `conditionNames` is what
-// picks one — so a non-Node deploy target gets its own build instead of Node's by hard-coded path.
+// conditions, and the RSC layer's `conditionNames` picks one — so a non-Node deploy target gets its
+// own build rather than Node's by hard-coded path.
 import { createTemporaryReferenceSet, decodeAction, decodeFormState, decodeReply, loadServerAction, renderToReadableStream, } from 'react-server-dom-rspack/server';
 // Resolved by the '@rshono/deploy' alias to the selected preset's runtime module — the one place
 // this file knows anything about where it is running. See `deploy/contract.ts`.
@@ -17,21 +17,17 @@ import { routes as userRoutes } from '@rshono/routes';
 import * as serverAppModule from '@rshono/server-app';
 import { isPageRoute } from '../router.js';
 import { appendVary, etagMatches } from '../server/headers.js';
-import { getRequestContext, publicUrl, readParams, reportServerError, runWithContext } from './context.js';
+import { beginPageRender, getRequestContext, publicUrl, readParams, reportServerError, runWithContext } from './context.js';
 import { isControlSignal, RedirectSignal } from './control.js';
 import { renderHTML } from './entry.ssr.js';
 import { RouterProvider } from './navigation.js';
 import { acceptsRsc, isActionRequest, parseRenderRequest, requestWantsRsc, wantsRsc } from './request.js';
 const serverApp = (serverAppModule.default ?? null);
-// Framework settings resolved from rshono.config.ts and compiled into the bundle at build time
-// (see builder/rspack-config.ts). These have no runtime env-var interface — env is for secrets.
-// Named after their ServerConfig fields, so what a setting does here is one grep from where it is
-// resolved. `isDev` among them: the build mode is decided by which command produced the bundle, not
-// by `process.env.NODE_ENV`, and not every runtime this deploys to has a `process` to read anyway.
-const CONFIG = __RSHONO_CONFIG__;
-const { isDev, cspEnabled, checkOrigin, maxBodyBytes } = CONFIG;
-/** Extra cross-origin hosts permitted to post server actions, beyond the app's own origin. */
-const allowedOrigins = new Set(CONFIG.allowedOrigins);
+// Framework settings resolved from rshono.config.ts and compiled into the bundle at build time (see
+// builder/rspack-config.ts). There is no runtime env-var interface for these — env is for secrets.
+// `isDev` among them: the build mode is decided by which command produced the bundle, and not every
+// runtime this deploys to has a `process.env.NODE_ENV` to read.
+const { isDev } = __RSHONO_CONFIG__;
 /** How long a prerendered page may be reused before revalidating. Also what `public/` files get. */
 const SSG_CACHE_CONTROL = 'public, max-age=300';
 /**
@@ -39,50 +35,25 @@ const SSG_CACHE_CONTROL = 'public, max-age=300';
  * the `Accept` header, which is what makes `Vary` non-optional here.
  */
 const PAGE_CONTENT_TYPE = /^(?:text\/html|text\/x-component)\b/;
-// The CSP is fixed per build apart from the nonce, so assemble everything but `script-src` once.
-const CSP_STATIC = Object.entries(CONFIG.cspDirectives)
-    .filter(([name]) => name !== 'script-src')
-    .map(([name, value]) => `${name} ${value}`)
-    .join('; ');
-const CSP_SCRIPT_SRC = CONFIG.cspDirectives['script-src'] ?? "'self'";
 // Called here rather than at the top of the deploy runtime's own module so the timing is unchanged:
 // `.env` is loaded once every import above has been evaluated, exactly as before.
 runtime.loadEnv();
 const routeConfig = userRoutes;
 export const routes = routeConfig.routes;
 /**
- * CSRF guard for server-action POSTs, layering the two signals a browser gives us.
+ * The per-request CSP nonce, if the app asked for one.
  *
- * `Sec-Fetch-Site` is set by the browser and unforgeable by page script, so `same-origin` settles
- * the question on its own — and short-circuiting on it is what keeps the check from misfiring on a
- * legitimate request whose `Host` the proxy rewrote. Everything else falls back to comparing the
- * `Origin` host against our own (see {@link publicUrl} — deliberately *not* against a raw
- * `X-Forwarded-Host`, which the client controls unless `trustProxy` says a proxy owns it).
+ * The framework does not mint this. `secureHeaders()` from `hono/secure-headers` does, when its
+ * policy contains the `NONCE` placeholder, and it stores it here — so an app opts into a
+ * nonce-based CSP by registering that middleware in `src/server.ts` and the framework's only job is
+ * to stamp the value into the render.
  *
- * A missing `Origin` is treated as same-origin: no-JS form posts from older browsers omit it, and
- * those same browsers send no `Sec-Fetch-Site` either, so there is nothing left to check. Hosts are
- * compared case-insensitively; the scheme is not compared, so this alone won't stop an
- * `http://` origin posting to the `https://` site (HSTS is the control for that).
+ * Readable from a route handler because `secureHeaders` resolves its directives *before* calling
+ * `next()`; the header itself is written on the way back out. Absent when the app registered no CSP,
+ * or one with no nonce in it — a fixed policy needs nothing from the render.
  */
-function isSameOriginAction(c) {
-    if (!checkOrigin)
-        return true;
-    const secFetchSite = c.req.header('sec-fetch-site');
-    if (secFetchSite === 'same-origin')
-        return true;
-    const origin = c.req.header('origin');
-    const originHost = origin ? URL.parse(origin)?.host.toLowerCase() || null : null;
-    if (origin !== undefined && originHost === null)
-        return false; // an Origin we can't parse is untrusted.
-    const trusted = originHost !== null && (originHost === publicUrl(c).host.toLowerCase() || allowedOrigins.has(originHost));
-    if (secFetchSite && secFetchSite !== 'none') {
-        // The browser tells us (unforgeably) this didn't originate from our own site — only a
-        // trusted (allowlisted) Origin may proceed.
-        return trusted;
-    }
-    if (originHost === null)
-        return true;
-    return trusted;
+function cspNonce(c) {
+    return c.get('secureHeadersNonce');
 }
 async function loadPageModule(load, label) {
     const mod = await load();
@@ -102,6 +73,14 @@ async function loadPageModule(load, label) {
 function acceptsHtml(c) {
     return c.req.header('accept')?.includes('text/html') ?? false;
 }
+/**
+ * The 404 for an app with no `notFound` page, and for a client that wanted neither HTML nor a flight
+ * payload. Shared for the `Vary`: this is still one of the answers a page URL gives depending on
+ * `Accept`, and a cache not told so can hand a plain-text 404 to a browser asking for a document.
+ */
+function plainNotFound(c) {
+    return c.text('Not Found', 404, { vary: 'Accept' });
+}
 /** A lazy once-cell: runs `load` at most once and caches the promise, but clears a rejection so a later call can retry. */
 function once(load) {
     let promise;
@@ -133,50 +112,26 @@ function releaseWhenDone(stream, done) {
         cancel: done,
     }));
 }
-/**
- * There is no render deadline here any more.
- *
- * A `renderTimeout` setting used to wrap every request in an `AbortController` with a timer, covering
- * the server action as well as the flight and SSR passes. Every host this deploys to enforces its own
- * request timeout — Workers, Vercel and Lambda all do — so the only shape that needed one was a Node
- * process facing the internet directly, and there a proxy is both the conventional and the more capable
- * place for it. The README shows the middleware for a Node deploy that wants one in-process.
- *
- * What the deadline *also* did was carry the client-disconnect signal into the two React renderers, and
- * that is kept — but not by handing them `c.req.raw.signal`. Both React renderers add an `abort`
- * listener to whatever signal they are given and only remove it if the abort fires, so a listener left on
- * a request-lifetime signal pins the flight request, the Fizz request and the whole rendered tree. That
- * is not theoretical: handing them the request signal directly cost ~169 kB per `/ssr` request, never
- * reclaimed by a major GC, and took GC from 5.8% to 12.9% of wall time under load.
- *
- * The deadline's own `AbortController` was, accidentally, what had kept that collectable — its signal
- * died with the render. So {@link renderComponent} keeps a per-render controller and forwards the request
- * signal into it, releasing the forwarder when the response ends. Never through `AbortSignal.any([...])`,
- * which reads better and leaks worse: a signal it produced is *composite*, and Node holds every composite
- * signal carrying an `abort` listener in a process-lifetime set (`gcPersistentSignals`) until it either
- * aborts or loses its last listener.
- */
 /**
  * Builds the props a page component is called with.
  *
- * `url` and `params` match `useNavigation()` field for field, so a read can move between a page and
- * a `'use client'` component unchanged. The `URL` is this page's own — `RequestContext` parses its own — so a
- * page that mutates it cannot disturb anything else on the request.
+ * `url` and `params` match `useNavigation()` field for field, so a read can move between a page and a
+ * `'use client'` component unchanged. The `URL` is this page's own, so mutating it cannot disturb
+ * anything else on the request.
  *
- * `ctx` is *defined* rather than assigned, and both parts of how carry their weight:
+ * `ctx` is *defined* rather than assigned, and both halves of how carry their weight:
  *
  * - **A getter**, so nothing is built for the pages that never read it, and so a `render: 'static'`
- *   page that does read it gets {@link getRequestContext}'s own "no per-request context while
- *   prerendering" error rather than a bare `undefined` — one explanation, in one place.
+ *   page that does read it gets {@link getRequestContext}'s "no per-request context while
+ *   prerendering" error rather than a bare `undefined`.
  * - **Non-enumerable**, so React's *development-only* serialization of a server component's props
  *   (the debug channel behind component stacks and the performance track) skips it. That walks own
- *   enumerable properties, and `ctx.raw` is the Hono {@link Context} — whose `env` holds the
- *   runtime's bindings. An enumerable `ctx` ships every one of them, secrets included, to the
- *   browser in dev, and grows a small page's flight payload by well over 10 kB. Production never
- *   serializes a server component's props at all, so this is the dev half of the same guarantee.
+ *   enumerable properties, and `ctx.hono` is the Hono {@link Context} — whose `env` holds the
+ *   runtime's bindings. An enumerable `ctx` would ship every one of them, secrets included, to the
+ *   browser in dev, and add well over 10 kB to a small page's flight payload.
  *
- * The cost is that the element has to be created by handing this object to `jsx()` *by reference*:
- * a `<Page {...props} />` spread copies enumerable properties only, and would drop `ctx` silently.
+ * The cost is that the element has to be created by handing this object to `jsx()` *by reference*: a
+ * `<Page {...props} />` spread copies enumerable properties only, and would drop `ctx` silently.
  */
 function pageProps(c, errorInfo) {
     const props = { url: publicUrl(c), params: readParams(c), ...(errorInfo ? { error: errorInfo } : null) };
@@ -184,18 +139,16 @@ function pageProps(c, errorInfo) {
     return props;
 }
 async function renderComponent(c, Page, opts) {
-    // The client going away is the one thing that still aborts a render — but React's renderers must not
-    // be handed `c.req.raw.signal` to watch for it. Both of them add an `abort` listener and only remove
-    // it if the abort fires, so on the happy path the listener stays on a signal that lives as long as the
-    // request object, and through it pins the flight request, the Fizz request and the whole rendered
-    // tree. Measured at ~169 kB per `/ssr` request, never reclaimed by a major GC.
+    // A client going away aborts the render — but React's renderers must never be handed
+    // `c.req.raw.signal` to watch for it. Both add an `abort` listener and only remove it if the abort
+    // fires, so on the happy path that listener stays on a request-lifetime signal and through it pins
+    // the flight request, the Fizz request and the whole rendered tree (~169 kB per `/ssr` request,
+    // never reclaimed by a major GC).
     //
-    // So the render gets a controller of its own and the request signal only forwards into it. The
-    // forwarding listener is `once`, so an abort removes it, and {@link release} removes it on the normal
-    // path — which is what keeps the request from retaining the render. Deliberately not
-    // `AbortSignal.any()`: a signal it produced is *composite*, and Node holds every composite signal
-    // carrying an `abort` listener in a process-lifetime set until it aborts or loses its last listener,
-    // which is a worse leak than the one being fixed here.
+    // So the render gets a controller of its own and the request signal only forwards into it: the
+    // forwarder is `once`, so an abort removes it, and `release` removes it on the normal path. Not
+    // `AbortSignal.any()` — a signal it produced is *composite*, and Node holds every composite signal
+    // carrying an `abort` listener in a process-lifetime set until it aborts or loses its last listener.
     const requestSignal = c.req.raw.signal;
     const renderAbort = new AbortController();
     const signal = renderAbort.signal;
@@ -206,11 +159,19 @@ async function renderComponent(c, Page, opts) {
         requestSignal.addEventListener('abort', forwardAbort, { once: true });
     /** Detaches the forwarder once the response has been written, so nothing survives the request. */
     const release = () => requestSignal.removeEventListener('abort', forwardAbort);
-    const nonce = cspEnabled && !opts.isRsc ? crypto.randomUUID() : undefined;
+    // Documents only: the nonce goes on the bootstrap scripts and the `<meta>` React hydrates from,
+    // and a flight payload has neither. Leaving it off there is also what keeps a prerendered flight
+    // payload servable from disk under a nonce-based CSP.
+    const nonce = opts.isRsc ? undefined : cspNonce(c);
     const props = pageProps(c, opts.errorInfo);
     const root = (_jsxs(_Fragment, { children: [nonce && _jsx("meta", { property: "csp-nonce", nonce: nonce }), Page.entryCssFiles?.map((href) => (_jsx("link", { rel: "stylesheet", href: href, precedence: "default" }, href))), _jsx(RouterProvider, { href: props.url.href, params: props.params, children: jsx(Page, props) })] }));
     // `notFound` only when it is true, so the flight payload of an ordinary page doesn't carry the key.
     const rscPayload = { root, formState: opts.formState, returnValue: opts.returnValue, ...(opts.notFound ? { notFound: true } : null) };
+    // Past this line the response head belongs to the framework, so `ctx.setHeader()` and
+    // `ctx.cookies.set()` start throwing rather than writing somewhere nothing will read. It has to be
+    // the last thing before the render: a server action ran earlier in `renderPage` and legitimately
+    // writes to the response, and so does any middleware that wrapped this handler.
+    beginPageRender(c);
     let controlSignal;
     const rscStream = renderToReadableStream(rscPayload, {
         temporaryReferences: opts.temporaryReferences,
@@ -251,15 +212,9 @@ async function renderComponent(c, Page, opts) {
         release();
         throw controlSignal;
     }
-    const headers = { 'content-type': 'text/html;charset=utf-8' };
-    if (nonce) {
-        // The nonce is always appended to whatever `script-src` resolved to, so overriding the
-        // directive in `cspDirectives` can widen the policy but can't accidentally drop the nonce.
-        // Dev additionally needs 'unsafe-eval' for react-refresh.
-        const scriptSrc = `script-src ${CSP_SCRIPT_SRC} 'nonce-${nonce}'${isDev ? " 'unsafe-eval'" : ''}`;
-        headers['content-security-policy'] = CSP_STATIC ? `${CSP_STATIC}; ${scriptSrc}` : scriptSrc;
-    }
-    return c.body(ssrResult.stream, (ssrResult.status ?? opts.status ?? 200), headers);
+    return c.body(ssrResult.stream, (ssrResult.status ?? opts.status ?? 200), {
+        'content-type': 'text/html;charset=utf-8',
+    });
 }
 async function renderPage(c, loadPage) {
     const request = c.req.raw;
@@ -269,9 +224,6 @@ async function renderPage(c, loadPage) {
     let temporaryReferences;
     let actionStatus;
     if (isActionRequest(renderRequest)) {
-        if (!isSameOriginAction(c)) {
-            return c.text('Forbidden: cross-origin server action rejected', 403);
-        }
         if (renderRequest.kind === 'rsc-action') {
             // Checked before the body is decoded, so an unknown id costs nothing to reject — and
             // `loadServerAction` would otherwise fault on the missing manifest entry, turning a bad
@@ -317,11 +269,13 @@ async function renderPage(c, loadPage) {
 }
 function buildApp() {
     const app = new Hono();
-    // Cheap, unconditional headers that only matter when something else has gone wrong: stop
-    // content-type sniffing, keep the full URL (paths, query) out of cross-origin referrers, and
-    // refuse to be framed by another origin (clickjacking). `frame-ancestors` in the opt-in CSP is
-    // stricter and takes precedence where both apply; this is the floor for everyone else.
-    // Set after `next()` so a route or middleware that sets its own value wins.
+    // Baseline security headers: stop content-type sniffing, keep the full URL out of cross-origin
+    // referrers, and refuse to be framed by another origin. A floor, not a policy — an app that wants
+    // the full set registers `secureHeaders()` from `hono/secure-headers` in src/server.ts, and
+    // because this is registered first it unwinds *last* and the "only if unset" checks stand aside
+    // for whatever that set. Kept in the framework rather than left to the app because it is
+    // registered ahead of `mountStaticAssets`, which is a terminal handler the sub-app never sees:
+    // without this, `/_static/*` would carry no security headers at all.
     app.use(async (c, next) => {
         await next();
         const headers = c.res.headers;
@@ -331,31 +285,33 @@ function buildApp() {
             headers.set('referrer-policy', 'strict-origin-when-cross-origin');
         if (!headers.has('x-frame-options'))
             headers.set('x-frame-options', 'SAMEORIGIN');
-        // Page responses only, from here down. Two things are true of them and of nothing else served
-        // here: one URL answers with either an HTML document or a flight payload depending on `Accept`,
-        // and the default page is request-specific (cookies, session, headers).
+        // React Refresh compiles updates with `eval`, so a dev build cannot run under any CSP an app
+        // would sensibly write for production. Widened here rather than asked of the app, so one policy
+        // in src/server.ts serves both and nobody debugs a blocked HMR socket. Only ever in dev, and
+        // only when the app has a `script-src` to widen.
+        if (isDev) {
+            const csp = headers.get('content-security-policy');
+            if (csp?.includes('script-src ')) {
+                headers.set('content-security-policy', csp.replace('script-src ', "script-src 'unsafe-eval' "));
+            }
+        }
+        // Page responses only, from here down: one URL answers with either an HTML document or a flight
+        // payload depending on `Accept`, and the default page is request-specific.
         if (!PAGE_CONTENT_TYPE.test(headers.get('content-type') ?? ''))
             return;
         appendVary(headers, 'Accept');
-        // Without this a page carries no cache directives at all, and a shared cache — a CDN, a
-        // corporate proxy — is free to store a logged-in user's page and hand it to someone else.
-        // `private` forbids exactly that; `no-cache` makes the browser revalidate its own copy rather
-        // than re-showing a stale personalised page. Neither blocks bfcache, which `no-store` would.
-        // A prerendered page, or anything a route set deliberately, already has its own value.
+        // Without this a page carries no cache directives at all, and a shared cache — a CDN, a corporate
+        // proxy — is free to store a logged-in user's page and hand it to someone else. `private` forbids
+        // that; `no-cache` makes the browser revalidate rather than re-show a stale personalised page.
+        // Neither blocks bfcache, which `no-store` would. A prerendered page already has its own value.
         if (!headers.has('cache-control'))
             headers.set('cache-control', 'private, no-cache');
     });
-    // A memory-exhaustion guard for *every* route — pages and actions, `{ type: 'endpoint' }` routes
-    // and the src/server.ts sub-app alike — since anything that buffers a body (`.json()`,
-    // `.formData()`) is exposed, not just server actions. Rejects an over-cap `Content-Length` up
-    // front and otherwise counts the stream, so a chunked or under-reported body is still cut off.
-    if (maxBodyBytes > 0) {
-        app.use(bodyLimit({ maxSize: maxBodyBytes, onError: (c) => c.text('Payload Too Large', 413) }));
-    }
     runtime.mountStaticAssets(app);
-    // Mounted ahead of the page routes so the sub-app's middleware (auth, logging, trailing-slash)
-    // wraps page requests too. The flip side: a *terminal* handler in src/server.ts at the same path
-    // as a page route wins over the page.
+    // Mounted ahead of the page routes so the sub-app's middleware (auth, logging, trailing-slash,
+    // and the security middleware the framework no longer owns — `csrf()`, `bodyLimit()`,
+    // `secureHeaders()`) wraps page requests too. The flip side: a *terminal* handler in
+    // src/server.ts at the same path as a page route wins over the page.
     if (serverApp) {
         app.route('/', serverApp);
     }
@@ -366,7 +322,9 @@ function buildApp() {
         const isRsc = requestWantsRsc(c.req.raw);
         if (signal instanceof RedirectSignal) {
             if (isRsc) {
-                return c.body(renderToReadableStream({ root: null, redirect: signal.location }, { signal: c.req.raw.signal }), 200, {
+                // No `signal`, deliberately — see `renderComponent`. This payload is two fields and no
+                // component tree, so there is nothing worth aborting and nothing worth a listener.
+                return c.body(renderToReadableStream({ root: null, redirect: signal.location }), 200, {
                     'content-type': 'text/x-component;charset=utf-8',
                 });
             }
@@ -375,8 +333,7 @@ function buildApp() {
         if (loadNotFoundPage) {
             return renderComponent(c, await loadNotFoundPage(), { status: 404, isRsc, notFound: true });
         }
-        // Plain text, but still one of the two answers this URL gives depending on `Accept`.
-        return c.text('Not Found', 404, { vary: 'Accept' });
+        return plainNotFound(c);
     };
     for (const route of routes) {
         if (isPageRoute(route)) {
@@ -388,15 +345,17 @@ function buildApp() {
                     if (servesPrerendered && c.req.method === 'GET') {
                         const isRsc = acceptsRsc(c.req.raw);
                         // A prerendered file is one fixed set of bytes, so it cannot carry a per-request nonce:
-                        // under `csp` the *document* has to be rendered per request. The flight payload never
-                        // carries a nonce, so it stays servable from the build either way.
-                        const mustRenderForNonce = cspEnabled && !isRsc;
-                        // Otherwise both representations come from the build, so a soft navigation is served from
-                        // it too rather than re-rendering a page that was already built.
+                        // where the app's CSP has one, the *document* has to be rendered per request. The flight
+                        // payload never carries a nonce, so it stays servable from the build either way.
+                        //
+                        // Decided per request rather than per build, which is what moving the CSP to
+                        // `secureHeaders()` buys: an app whose policy carries no `NONCE` keeps its prerendered
+                        // documents, where the old build-time `csp: true` flag gave every one of them up.
+                        const mustRenderForNonce = !isRsc && cspNonce(c) !== undefined;
                         if (!mustRenderForNonce) {
                             const page = await runtime.readPrerendered(c, isRsc ? 'flight' : 'html');
                             // A prerendered page is request-independent by construction, so it is safe to cache
-                            // publicly; the short max-age matches what `public/` files get. The ETag turns the
+                            // publicly; the short max-age matches what `public/` files get, and the ETag turns the
                             // revalidation that follows into a 304 rather than the page all over again.
                             //
                             // Answered outside `runWithContext`: no app code runs on this path, so there is no
@@ -443,12 +402,22 @@ function buildApp() {
         if (loadNotFoundPage && (isRsc || acceptsHtml(c))) {
             return runWithContext(c, async () => renderComponent(c, await loadNotFoundPage(), { status: 404, isRsc }));
         }
-        return c.text('Not Found', 404, { vary: 'Accept' });
+        return plainNotFound(c);
     });
     const loadErrorPage = routeConfig.error ? memoizePage(routeConfig.error, 'the error page') : null;
     app.onError(async (error, c) => {
         if (isControlSignal(error))
             return runWithContext(c, () => respondToControlSignal(c, error));
+        // Registering an `onError` at all replaces Hono's default handler, which is what would otherwise
+        // turn an `HTTPException` into the response it carries. Without this every middleware that
+        // rejects a request by throwing one — `csrf()` with a 403, `bodyLimit()` with a 413, an app's own
+        // `throw new HTTPException(401)` — would surface as a 500 error page instead of its own status.
+        // Rebuilt through `c` rather than returned as-is, exactly as Hono's own default does, so headers
+        // already prepared on the context (`c.header(…)` from middleware that ran first) survive.
+        if (error instanceof HTTPException) {
+            const res = error.getResponse();
+            return c.newResponse(res.body, res);
+        }
         reportServerError(error, { source: 'request', request: c.req.raw, message: '[rshono] request error:' });
         const isRsc = requestWantsRsc(c.req.raw);
         if (loadErrorPage && (isRsc || acceptsHtml(c))) {