vinext 1.3.0 → 1.4.0

package/dist/server/app-page-boundary-render.d.ts

@@ -6,7 +6,7 @@ import "../shims/navigation.js";
 import { AppPageParams } from "./app-page-boundary.js";
 import { AppPageFontPreload } from "./app-page-execution.js";
 import { AppPageMiddlewareContext } from "./app-page-response.js";
-import { ApplyAppPageFileBasedMetadata } from "./app-page-head.js";
+import { AppPageFallbackRouteHead, ApplyAppPageFileBasedMetadata } from "./app-page-head.js";
 import { AppPageRouteWiringRoute } from "./app-page-route-wiring.js";
 import { AppPageInterceptOptions } from "./app-page-element-builder.js";
 import { AppPageSsrHandler } from "./app-page-stream.js";
@@ -30,9 +30,17 @@ export type AppPageBoundaryRoute<TModule extends AppPageModule = AppPageModule>
   notFound?: TModule | null;
   notFounds?: readonly (TModule | null | undefined)[] | null;
   notFoundTreePosition?: number | null;
+  page?: TModule | null;
   params?: AppPageParams;
   pattern?: string;
   routeSegments?: readonly string[];
+  childrenSlot?: AppPageRouteWiringRoute<TModule>["childrenSlot"];
+  segmentForbiddens?: readonly (TModule | null | undefined)[] | null;
+  segmentForbiddenTreePositions?: readonly number[] | null;
+  segmentNotFounds?: readonly (TModule | null | undefined)[] | null;
+  segmentNotFoundTreePositions?: readonly number[] | null;
+  segmentUnauthorizeds?: readonly (TModule | null | undefined)[] | null;
+  segmentUnauthorizedTreePositions?: readonly number[] | null;
   slots?: AppPageRouteWiringRoute<TModule>["slots"];
   unauthorized?: TModule | null;
   unauthorizedTreePosition?: number | null;
@@ -88,12 +96,21 @@ type AppPageBoundaryRenderCommonOptions<TModule extends AppPageModule = AppPageM
 type RenderAppPageHttpAccessFallbackOptions<TModule extends AppPageModule = AppPageModule> = {
   boundaryComponent?: AppPageComponent | null;
   boundaryModule?: TModule | null;
+  /** Boundary whose metadata the head uses, when not the rendered boundary. */
+  headBoundaryModule?: TModule | null;
+  /** Layouts whose metadata the head uses, when more than render around the boundary. */
+  headLayoutModules?: readonly (TModule | null | undefined)[] | null;
   intercept?: AppPageInterceptOptions<TModule> | null;
   layoutModules?: readonly (TModule | null | undefined)[] | null;
   matchedParams: AppPageParams;
   rootForbiddenModule?: TModule | null;
   rootNotFoundModule?: TModule | null;
   rootUnauthorizedModule?: TModule | null;
+  /**
+   * The matched route's render threw the signal, so the document keeps the
+   * route's own head rather than the boundary convention's.
+   */
+  routeHead?: AppPageFallbackRouteHead | null;
   /** Normalized, basePath-free application pathname used for route matching. */
   routePathname?: string;
   route?: AppPageBoundaryRoute<TModule> | null;
@@ -116,4 +133,5 @@ type RenderAppPageErrorBoundaryOptions<TModule extends AppPageModule = AppPageMo
 } & AppPageBoundaryRenderCommonOptions<TModule>;
 export declare function renderAppPageHttpAccessFallback<TModule extends AppPageModule>(options: RenderAppPageHttpAccessFallbackOptions<TModule>): Promise<Response | null>;
 export declare function renderAppPageErrorBoundary<TModule extends AppPageModule>(options: RenderAppPageErrorBoundaryOptions<TModule>): Promise<Response | null>;
-//#endregion
+//#endregion
+export {};

package/dist/server/app-page-boundary-render.js

@@ -1,28 +1,61 @@
 import { stripBasePath } from "../utils/base-path.js";
 import { isNavigationSignalError } from "../utils/navigation-signal.js";
 import { NEVER_CACHE_CONTROL, applyCdnResponseHeaders } from "./cache-control.js";
+import { isRenderDynamicLatched, isStaticGenerationAccessError } from "../shims/internal/headers-state.js";
+import { copyLinkHeaderProvenance } from "./app-response-header-provenance.js";
+import { stripRscSuffix } from "./app-rsc-cache-busting.js";
 import { createArtifactCompatibilityEnvelope } from "./artifact-compatibility.js";
 import { AppElementsWire } from "./app-elements-wire.js";
 import "./app-elements.js";
 import DefaultGlobalError from "../shims/default-global-error.js";
 import { ErrorBoundary, GlobalErrorBoundary, SerializedErrorBoundary } from "../shims/error-boundary.js";
+import { buildClientHookErrorMessage } from "../shims/client-hook-error.js";
 import { LayoutSegmentProvider } from "../shims/layout-segment-context.js";
 import { withUseCacheLayoutMarker } from "../shims/internal/app-page-props-cache-key.js";
 import { MetadataHead, ViewportHead } from "../shims/metadata.js";
-import { resolveAppPageBranchParams, resolveAppPageSegmentParams } from "./app-page-params.js";
-import { stripRscSuffix } from "./app-rsc-cache-busting.js";
 import { buildRscRedirectFlightStream } from "./app-rsc-redirect-flight.js";
 import { bufferAppPageBinaryStream, buildAppPageSpecialErrorResponse, resolveAppPageSpecialError } from "./app-page-execution.js";
-import { createAppPageLayoutEntries, createAppPageSourcePage } from "./app-page-route-wiring.js";
-import { createAppPageFontData, createAppPageRscErrorTracker, createAppPageSsrErrorHandler, renderAppPageHtmlResponse } from "./app-page-stream.js";
-import { buildClientHookErrorMessage } from "../shims/client-hook-error.js";
-import { resolveActiveParallelRouteHeadInputs, resolveAppPageHead } from "./app-page-head.js";
-import { resolveHttpAccessFallbackMetadata, resolveHttpAccessFallbackViewport } from "./app-page-http-access-fallback-metadata.js";
-import "./app-rsc-route-matching.js";
+import { createAppPageMetadataSearchParamsObserver } from "./app-page-search-params-observation.js";
+import { resolveAppPageBranchParams, resolveAppPageSegmentParams } from "./app-page-params.js";
+import { hasAppPageDynamicMetadata, prepareAppPageHead, resolveActiveParallelRouteHeadInputs, resolveAppPageHead, resolveInterceptLayoutsBesidePage, slotInterceptKeepsSourceHead } from "./app-page-head.js";
 import { renderAppPageBoundaryResponse, resolveAppPageErrorBoundary, resolveAppPageHttpAccessBoundaryModule, wrapAppPageBoundaryElement } from "./app-page-boundary.js";
+import { createRouteNotFoundHeadPlanOptions, recoverAppPageRouteHead, resolveHttpAccessFallbackMetadata, resolveHttpAccessFallbackViewport } from "./app-page-http-access-fallback-metadata.js";
+import "./app-rsc-route-matching.js";
+import { createAppPageLayoutEntries, createAppPageRouteBodyMetadata, createAppPageSourcePage } from "./app-page-route-wiring.js";
 import { resolveSlotParamOverrides } from "./app-page-element-builder.js";
-import { Fragment, createElement } from "react";
+import { createAppPageFontData, createAppPageRscErrorTracker, createAppPageSsrErrorHandler, renderAppPageHtmlResponse } from "./app-page-stream.js";
+import { Fragment, Suspense, createElement } from "react";
 //#region src/server/app-page-boundary-render.ts
+async function AppPageBoundaryStreamedMetadata(props) {
+	return createAppPageRouteBodyMetadata(await props.metadata, props.pathname, "body", props.trailingSlash, props.scriptNonce);
+}
+AppPageBoundaryStreamedMetadata.displayName = "Vinext.StreamingMetadata";
+/** Holds the response open until a head it doesn't render settles, as Next.js streams it. */
+async function AppPageBoundarySettledHead(props) {
+	await props.head;
+	return null;
+}
+AppPageBoundarySettledHead.displayName = "Vinext.ErrorShellMetadata";
+/**
+* Fail a fallback document once its body has streamed if a head it streamed
+* behind Suspense hit a `dynamic = "error"` access error. Inside a Suspense
+* boundary, React would only report it and finish the document, so the 404
+* could be served, and stored, where Next.js fails the render. An errored body
+* reaches the client truncated and is never written to the cache.
+*/
+function failOnLateAccessError(response, accessErrors) {
+	if (accessErrors.length === 0 || !response.body) return response;
+	const body = response.body.pipeThrough(new TransformStream({ async flush() {
+		for (const accessError of await Promise.all(accessErrors)) if (accessError) throw accessError;
+	} }));
+	const wrapped = new Response(body, {
+		headers: response.headers,
+		status: response.status,
+		statusText: response.statusText
+	});
+	copyLinkHeaderProvenance(response.headers, wrapped.headers);
+	return wrapped;
+}
 const DEFAULT_GLOBAL_ERROR_COMPONENT = DefaultGlobalError;
 function getDefaultExport(module) {
 	return module?.default ?? null;
@@ -35,6 +68,8 @@ function resolveHttpAccessBoundaryTreePosition(route, boundaryModule, statusCode
 	if (boundaryModule === routeBoundary && statusCode === 403) return route.forbiddenTreePosition ?? null;
 	if (boundaryModule === routeBoundary && statusCode === 401) return route.unauthorizedTreePosition ?? null;
 	for (let index = (layoutBoundaries?.length ?? 0) - 1; index >= 0; index--) if (layoutBoundaries?.[index] === boundaryModule) return route.layoutTreePositions?.[index] ?? null;
+	const segmentIndex = (statusCode === 403 ? route.segmentForbiddens : statusCode === 401 ? route.segmentUnauthorizeds : route.segmentNotFounds)?.lastIndexOf(boundaryModule) ?? -1;
+	if (segmentIndex !== -1) return (statusCode === 403 ? route.segmentForbiddenTreePositions : statusCode === 401 ? route.segmentUnauthorizedTreePositions : route.segmentNotFoundTreePositions)?.[segmentIndex] ?? null;
 	return null;
 }
 function wrapRenderedBoundaryElement(options) {
@@ -224,17 +259,23 @@ async function renderAppPageHttpAccessFallback(options) {
 	const layoutModules = options.layoutModules ?? options.route?.layouts ?? options.rootLayouts;
 	const pathname = new URL(options.requestUrl).pathname;
 	const routePathname = options.routePathname ?? stripRscSuffix(stripBasePath(pathname, options.basePath ?? ""));
-	const routeSegments = resolveHttpAccessFallbackHeadRouteSegments(options.route, layoutModules);
+	const headBoundaryModule = options.headBoundaryModule ?? boundaryModule;
+	const headLayoutModules = options.headLayoutModules ?? layoutModules;
+	const routeSegments = resolveHttpAccessFallbackHeadRouteSegments(options.route, headLayoutModules);
 	const fallbackRouteSegments = routeSegments ?? [];
 	let head;
+	let streamedRouteMetadata = null;
+	let streamedConventionHead = null;
+	const lateAccessErrors = [];
 	try {
 		if ([
 			401,
 			403,
 			404
 		].includes(options.statusCode)) {
-			const boundaryTreePosition = resolveHttpAccessBoundaryTreePosition(options.route, boundaryModule, options.statusCode);
-			const boundaryParams = boundaryTreePosition == null ? {} : resolveAppPageSegmentParams(fallbackRouteSegments, boundaryTreePosition, options.matchedParams);
+			const boundaryTreePosition = resolveHttpAccessBoundaryTreePosition(options.route, headBoundaryModule, options.statusCode);
+			const boundaryRouteSegments = (options.route?.routeSegments ?? fallbackRouteSegments).slice(0, boundaryTreePosition ?? 0);
+			const boundaryParams = boundaryTreePosition == null ? {} : resolveAppPageSegmentParams(boundaryRouteSegments, boundaryTreePosition, options.matchedParams);
 			const intercept = options.intercept;
 			const isSiblingIntercept = intercept?.interceptSlotKey === "__vinext_page_intercept" && intercept.interceptPage != null;
 			const effectiveParams = isSiblingIntercept ? intercept.interceptParams ?? options.matchedParams : options.matchedParams;
@@ -256,52 +297,181 @@ async function renderAppPageHttpAccessFallback(options) {
 				slotParams,
 				slots: options.route?.slots ?? null
 			});
-			const primaryParallelBranch = isSiblingIntercept ? {
+			const resolvePrimaryParallelBranch = (segments) => isSiblingIntercept ? {
 				head: {
 					layoutModules: intercept?.interceptLayouts ?? [],
-					layoutParams: (intercept?.interceptLayoutSegments ?? []).map((segments) => resolveAppPageBranchParams(intercept?.interceptBranchSegments ?? segments, segments.length, effectiveParams, segments)),
+					layoutParams: (intercept?.interceptLayoutSegments ?? []).map((layoutSegments) => resolveAppPageBranchParams(intercept?.interceptBranchSegments ?? layoutSegments, layoutSegments.length, effectiveParams, layoutSegments)),
+					layoutsBesidePage: resolveInterceptLayoutsBesidePage(intercept?.interceptLayoutSegments, intercept?.interceptBranchSegments),
 					pageModule: intercept?.interceptPage ?? null,
 					params: effectiveParams,
-					routeSegments: intercept?.interceptSourcePageSegments ?? fallbackRouteSegments
+					routeSegments: intercept?.interceptSourcePageSegments ?? segments
 				},
 				...intercept?.interceptNotFound ? {
 					notFoundModule: intercept.interceptNotFound,
-					notFoundModuleRouteSegments: (intercept.interceptNotFoundBranchSegments ?? intercept.interceptSourcePageSegments ?? fallbackRouteSegments).slice(0, intercept.interceptNotFoundTreePosition ?? 0),
-					notFoundParams: resolveAppPageBranchParams(intercept.interceptNotFoundBranchSegments ?? intercept.interceptBranchSegments ?? fallbackRouteSegments, intercept.interceptNotFoundTreePosition ?? 0, effectiveParams)
+					notFoundModuleRouteSegments: (intercept.interceptNotFoundBranchSegments ?? intercept.interceptSourcePageSegments ?? segments).slice(0, intercept.interceptNotFoundTreePosition ?? 0),
+					notFoundParams: resolveAppPageBranchParams(intercept.interceptNotFoundBranchSegments ?? intercept.interceptBranchSegments ?? segments, intercept.interceptNotFoundTreePosition ?? 0, effectiveParams)
 				} : {},
-				ownerTreePosition: fallbackRouteSegments.length
+				ownerTreePosition: segments.length
 			} : null;
+			const primaryParallelBranch = resolvePrimaryParallelBranch(fallbackRouteSegments);
 			const fallbackHeadOptions = {
-				boundaryModule,
+				boundaryModule: headBoundaryModule,
 				boundaryParams,
-				boundaryRouteSegments: fallbackRouteSegments.slice(0, boundaryTreePosition ?? 0),
+				boundaryRouteSegments,
 				branchNotFoundConventions: options.statusCode === 404,
 				errorConvention: options.statusCode === 403 ? "forbidden" : options.statusCode === 401 ? "unauthorized" : "not-found",
-				layoutModules,
-				layoutTreePositions: resolveHttpAccessFallbackHeadLayoutTreePositions(options.route, layoutModules),
+				layoutModules: headLayoutModules,
+				layoutTreePositions: resolveHttpAccessFallbackHeadLayoutTreePositions(options.route, headLayoutModules),
 				parallelBranches,
 				params: options.matchedParams,
 				primaryParallelBranch,
 				routeSegments
 			};
-			const [metadata, viewport] = await Promise.all([resolveHttpAccessFallbackMetadata({
-				applyFileBasedMetadata: options.applyFileBasedMetadata,
-				basePath: options.basePath ?? "",
-				...fallbackHeadOptions,
-				metadataRoutes: options.metadataRoutes,
-				routePath: options.route?.pattern ?? pathname
-			}), resolveHttpAccessFallbackViewport(fallbackHeadOptions)]);
-			head = {
-				metadata,
-				viewport
+			const startConventionHead = ({ errorShell = false } = {}) => {
+				const settle = (branch) => errorShell ? branch.catch((error) => {
+					if (isStaticGenerationAccessError(error)) throw error;
+					return null;
+				}) : branch;
+				const metadata = settle(resolveHttpAccessFallbackMetadata({
+					applyFileBasedMetadata: options.applyFileBasedMetadata,
+					basePath: options.basePath ?? "",
+					...fallbackHeadOptions,
+					metadataRoutes: options.metadataRoutes,
+					routePath: options.route?.pattern ?? pathname
+				}));
+				const viewport = settle(resolveHttpAccessFallbackViewport(fallbackHeadOptions));
+				metadata.catch(() => null);
+				viewport.catch(() => null);
+				return {
+					metadata,
+					viewport
+				};
 			};
+			const resolveConventionHead = async (settings) => {
+				const conventionHead = startConventionHead(settings);
+				const [metadata, viewport] = await Promise.all([conventionHead.metadata, conventionHead.viewport]);
+				return {
+					metadata,
+					viewport
+				};
+			};
+			const route = options.route;
+			const routeHead = options.routeHead;
+			if (routeHead && route) {
+				const prepareRouteHead = () => {
+					if (routeHead.prepared) return routeHead.prepared;
+					const fullRouteSegments = route.routeSegments ?? [];
+					const routePrimaryParallelBranch = resolvePrimaryParallelBranch(fullRouteSegments);
+					const sourceParallelBranches = resolveActiveParallelRouteHeadInputs({
+						layoutTreePositions: route.layoutTreePositions,
+						params: options.matchedParams,
+						routeSegments: fullRouteSegments,
+						slotParams,
+						slots: route.slots ?? null
+					});
+					const interceptSlotKey = intercept?.interceptPage != null && !isSiblingIntercept ? intercept.interceptSlotKey ?? null : null;
+					const routeParallelBranches = interceptSlotKey === null || slotInterceptKeepsSourceHead({
+						interceptSlotKey,
+						route,
+						sourceParallelRoutes: sourceParallelBranches
+					}) ? sourceParallelBranches : resolveActiveParallelRouteHeadInputs({
+						interceptBranchSegments: intercept?.interceptBranchSegments ?? null,
+						interceptLayouts: intercept?.interceptLayouts ?? null,
+						interceptLayoutSegments: intercept?.interceptLayoutSegments ?? null,
+						interceptNotFoundBranchSegments: intercept?.interceptNotFoundBranchSegments ?? null,
+						interceptNotFound: intercept?.interceptNotFound ?? null,
+						interceptNotFoundTreePosition: intercept?.interceptNotFoundTreePosition ?? null,
+						interceptPage: intercept?.interceptPage ?? null,
+						interceptParams: intercept?.interceptParams ?? null,
+						interceptSlotKey,
+						interceptSourcePageSegments: intercept?.interceptSourcePageSegments ?? null,
+						layoutTreePositions: route.layoutTreePositions,
+						params: options.matchedParams,
+						routeSegments: fullRouteSegments,
+						slotParams,
+						slots: route.slots ?? null
+					});
+					const routeLayoutModules = route.layouts ?? options.rootLayouts;
+					const headOptions = {
+						applyFileBasedMetadata: options.applyFileBasedMetadata,
+						basePath: options.basePath ?? "",
+						layoutModules: routeLayoutModules,
+						layoutTreePositions: route.layoutTreePositions,
+						metadataRoutes: options.metadataRoutes,
+						pageModule: isSiblingIntercept ? null : route.page ?? null,
+						parallelRoutes: [...routePrimaryParallelBranch ? [routePrimaryParallelBranch.head] : [], ...routeParallelBranches.map((branch) => branch.head)],
+						params: effectiveParams,
+						routePath: route.pattern ?? pathname,
+						routeSegments: route.routeSegments ?? null,
+						searchParams: routeHead.searchParams,
+						searchParamsObserver: createAppPageMetadataSearchParamsObserver(routeHead.observeSearchParams)
+					};
+					return {
+						...recoverAppPageRouteHead(prepareAppPageHead(headOptions), {
+							applyFileBasedMetadata: options.applyFileBasedMetadata,
+							basePath: options.basePath ?? "",
+							metadataRoutes: options.metadataRoutes,
+							resolvePlanOptions: () => createRouteNotFoundHeadPlanOptions({
+								parallelBranches: routeParallelBranches,
+								params: effectiveParams,
+								primaryParallelBranch: routePrimaryParallelBranch,
+								rootNotFoundModule: options.rootNotFoundModule,
+								route: {
+									...route,
+									layouts: routeLayoutModules
+								}
+							}),
+							routePath: route.pattern ?? pathname
+						}),
+						metadataPlacement: routeHead.streamMetadata && hasAppPageDynamicMetadata(headOptions) ? "body" : "head"
+					};
+				};
+				const routeHeadResult = prepareRouteHead();
+				const throwIfAccessError = async () => {
+					const accessError = await routeHeadResult.accessError;
+					if (accessError) throw accessError;
+				};
+				const conventionHeadBranches = options.isRscRequest ? null : startConventionHead({ errorShell: true });
+				const isHtmlLimitedBot = options.serveStreamingMetadata === false;
+				let conventionHead = null;
+				if (conventionHeadBranches && isHtmlLimitedBot) {
+					const [metadata, viewport] = await Promise.all([conventionHeadBranches.metadata, conventionHeadBranches.viewport]);
+					conventionHead = {
+						metadata,
+						viewport
+					};
+				} else if (conventionHeadBranches) {
+					await conventionHeadBranches.viewport;
+					streamedConventionHead = conventionHeadBranches.metadata.catch(() => null);
+					lateAccessErrors.push(conventionHeadBranches.metadata.then(() => null, (error) => isStaticGenerationAccessError(error) ? error : null));
+				}
+				if (!options.isRscRequest && routeHeadResult.metadataPlacement === "body") {
+					streamedRouteMetadata = routeHeadResult.metadata;
+					lateAccessErrors.push(routeHeadResult.accessError);
+					head = {
+						metadata: null,
+						viewport: await routeHeadResult.viewport
+					};
+				} else {
+					const [metadata, viewport] = await Promise.all([
+						routeHeadResult.metadata,
+						routeHeadResult.viewport,
+						throwIfAccessError()
+					]);
+					head = {
+						metadata,
+						viewport
+					};
+				}
+				if (conventionHead && !streamedRouteMetadata && isHtmlLimitedBot && (!options.isCacheCandidate || isRenderDynamicLatched())) head = conventionHead;
+			} else head = await resolveConventionHead();
 		} else head = await resolveAppPageHead({
 			applyFileBasedMetadata: options.applyFileBasedMetadata,
 			basePath: options.basePath ?? "",
-			layoutModules,
-			layoutTreePositions: resolveHttpAccessFallbackHeadLayoutTreePositions(options.route, layoutModules),
+			layoutModules: headLayoutModules,
+			layoutTreePositions: resolveHttpAccessFallbackHeadLayoutTreePositions(options.route, headLayoutModules),
 			metadataRoutes: options.metadataRoutes,
-			pageModule: boundaryModule,
+			pageModule: headBoundaryModule,
 			params: options.matchedParams,
 			routePath: options.route?.pattern ?? pathname,
 			routeSegments
@@ -323,16 +493,30 @@ async function renderAppPageHttpAccessFallback(options) {
 	if (metadata) headElements.push(createElement(MetadataHead, {
 		key: "metadata",
 		metadata,
-		pathname,
+		pathname: routePathname,
 		trailingSlash: options.trailingSlash
 	}));
-	headElements.push(createElement(ViewportHead, {
+	if (viewport) headElements.push(createElement(ViewportHead, {
 		key: "viewport",
 		viewport
 	}));
+	const bodyElements = [];
+	if (streamedRouteMetadata) bodyElements.push(createElement("div", {
+		hidden: true,
+		key: "streamed-metadata"
+	}, createElement(Suspense, { fallback: null }, createElement(AppPageBoundaryStreamedMetadata, {
+		metadata: streamedRouteMetadata,
+		pathname: routePathname,
+		scriptNonce: options.scriptNonce,
+		trailingSlash: options.trailingSlash
+	}))));
+	if (streamedConventionHead) bodyElements.push(createElement("div", {
+		hidden: true,
+		key: "error-shell-metadata"
+	}, createElement(Suspense, { fallback: null }, createElement(AppPageBoundarySettledHead, { head: streamedConventionHead }))));
 	const skipLayoutWrapping = options.skipLayoutWrapping ?? false;
 	const element = wrapRenderedBoundaryElement({
-		element: createElement(Fragment, null, ...headElements, createElement(boundaryComponent)),
+		element: createElement(Fragment, null, ...headElements, createElement(boundaryComponent), ...bodyElements),
 		globalErrorModule: options.globalErrorModule,
 		includeGlobalErrorBoundary: true,
 		isRscRequest: options.isRscRequest,
@@ -344,7 +528,7 @@ async function renderAppPageHttpAccessFallback(options) {
 		routeSegments: options.route?.routeSegments,
 		skipLayoutWrapping
 	});
-	return renderAppPageBoundaryElementResponse({
+	return failOnLateAccessError(await renderAppPageBoundaryElementResponse({
 		...options,
 		element,
 		handleSpecialErrors: true,
@@ -354,7 +538,7 @@ async function renderAppPageHttpAccessFallback(options) {
 		route: skipLayoutWrapping ? null : options.route,
 		routePattern: options.route?.pattern,
 		status: options.statusCode
-	});
+	}), lateAccessErrors);
 }
 async function renderAppPageErrorBoundary(options) {
 	const errorBoundary = resolveAppPageErrorBoundary({

package/dist/server/app-page-boundary.d.ts

@@ -29,6 +29,13 @@ type ResolveAppPageParentHttpAccessBoundaryModuleOptions<TModule> = {
   routeUnauthorizedModules?: readonly (TModule | null | undefined)[] | null;
   statusCode: number;
 };
+type ResolveAppPageLayoutHttpAccessBoundaryOptions<TModule> = {
+  /** Segment boundaries for the status, root first, aligned with the positions. */
+  boundaryModules: readonly (TModule | null | undefined)[];
+  boundaryTreePositions: readonly number[];
+  /** Tree position of the layout that threw. */
+  layoutTreePosition: number;
+};
 type ResolveAppPageErrorBoundaryOptions<TModule, TComponent> = {
   getDefaultExport: (module: TModule | null | undefined) => TComponent | null | undefined;
   globalErrorModule?: TModule | null;
@@ -74,11 +81,32 @@ type RenderAppPageBoundaryResponseOptions<TElement> = {
 };
 export declare function resolveAppPageHttpAccessBoundaryComponent<TModule, TComponent>(options: ResolveAppPageHttpAccessBoundaryComponentOptions<TModule, TComponent>): TComponent | null;
 export declare function resolveAppPageHttpAccessBoundaryModule<TModule>(options: ResolveAppPageHttpAccessBoundaryModuleOptions<TModule>): TModule | null;
-export declare function resolveAppPageParentHttpAccessBoundaryModule<TModule>(options: ResolveAppPageParentHttpAccessBoundaryModuleOptions<TModule>): TModule | null;
 /**
- * Like {@link resolveAppPageParentHttpAccessBoundaryModule}, but also returns
- * the layout index that owns the resolved boundary so callers can slice the
- * layouts array to skip rendering layouts below the boundary owner.
+ * The boundary that catches `notFound()` / `forbidden()` / `unauthorized()`
+ * thrown by a layout: the deepest segment boundary above the layout's own
+ * segment. A segment's boundary wraps its children inside its layout, so the
+ * layout's own boundary, and any below it, cannot catch the layout's error.
+ * Returns `null` when no segment above the layout has one (issue #4045).
+ */
+export declare function resolveAppPageLayoutHttpAccessBoundary<TModule>(options: ResolveAppPageLayoutHttpAccessBoundaryOptions<TModule>): {
+  module: TModule;
+  treePosition: number;
+} | null;
+/**
+ * Tree position at which the root segment's boundary catches a layout's error.
+ * Next.js gives a first-layer route group the root segment's boundary (the
+ * custom file or the built-in page) when the group has none of its
+ * own, so the boundary renders inside the group's layout, which is often the
+ * root layout. Without `app/layout`, the root layout sits deeper (for example
+ * `app/[lang]/layout`), and the boundary renders inside it so the page keeps
+ * its `<html>` and `<body>`. A boundary file above that root layout renders
+ * there too.
+ */
+export declare function resolveAppPageRootHttpAccessBoundaryTreePosition(routeSegments: readonly string[], layoutTreePositions: readonly number[], layoutTreePosition: number | undefined): number;
+/**
+ * Resolves the nearest layout-aligned boundary before `layoutIndex`, falling
+ * back to the root module, and returns the layout index that owns it so
+ * callers can slice the layouts array to skip layouts below the boundary owner.
  *
  * `layoutIndex` is the per-layout index where the boundary lives, or `null` if
  * the resolved boundary is the root module (which conceptually sits above all
@@ -98,4 +126,5 @@ export declare function resolveAppPageParentHttpAccessBoundary<TModule>(options:
 export declare function resolveAppPageErrorBoundary<TModule, TComponent>(options: ResolveAppPageErrorBoundaryOptions<TModule, TComponent>): ResolveAppPageErrorBoundaryResult<TComponent>;
 export declare function wrapAppPageBoundaryElement<TElement, TLayoutModule, TLayoutComponent, TChildSegments, TGlobalErrorComponent>(options: WrapAppPageBoundaryElementOptions<TElement, TLayoutModule, TLayoutComponent, TChildSegments, TGlobalErrorComponent>): TElement;
 export declare function renderAppPageBoundaryResponse<TElement>(options: RenderAppPageBoundaryResponseOptions<TElement>): Promise<Response>;
-//#endregion
+//#endregion
+export {};

package/dist/server/app-page-boundary.js

@@ -1,9 +1,10 @@
 import { VINEXT_RSC_VARY_HEADER } from "./app-rsc-vary.js";
 import { runWithFetchDedupe } from "../shims/fetch-cache.js";
-import { resolveAppPageSegmentParams } from "./app-page-params.js";
-import { VINEXT_RSC_CONTENT_TYPE, applyRscCompatibilityIdHeader, applyRscDeploymentIdHeader } from "./app-rsc-cache-busting.js";
 import { mergeMiddlewareResponseHeaders } from "./middleware-response-headers.js";
+import { VINEXT_RSC_CONTENT_TYPE, applyRscCompatibilityIdHeader, applyRscDeploymentIdHeader } from "./app-rsc-cache-busting.js";
+import { isAppPageRouteGroupSegment } from "./app-page-segment-state.js";
 import { applyEdgeRuntimeHeader } from "./app-page-response.js";
+import { resolveAppPageSegmentParams } from "./app-page-params.js";
 //#region src/server/app-page-boundary.ts
 function resolveAppPageHttpAccessBoundaryComponent(options) {
 	return options.getDefaultExport(resolveAppPageHttpAccessBoundaryModule({
@@ -23,13 +24,45 @@ function resolveAppPageHttpAccessBoundaryModule(options) {
 	else boundaryModule = options.routeNotFoundModule ?? options.rootNotFoundModule;
 	return boundaryModule ?? null;
 }
-function resolveAppPageParentHttpAccessBoundaryModule(options) {
-	return resolveAppPageParentHttpAccessBoundary(options).module;
+/**
+* The boundary that catches `notFound()` / `forbidden()` / `unauthorized()`
+* thrown by a layout: the deepest segment boundary above the layout's own
+* segment. A segment's boundary wraps its children inside its layout, so the
+* layout's own boundary, and any below it, cannot catch the layout's error.
+* Returns `null` when no segment above the layout has one (issue #4045).
+*/
+function resolveAppPageLayoutHttpAccessBoundary(options) {
+	for (let index = options.boundaryTreePositions.length - 1; index >= 0; index--) {
+		const treePosition = options.boundaryTreePositions[index];
+		const module = options.boundaryModules[index];
+		if (module && treePosition < options.layoutTreePosition) return {
+			module,
+			treePosition
+		};
+	}
+	return null;
+}
+/**
+* Tree position at which the root segment's boundary catches a layout's error.
+* Next.js gives a first-layer route group the root segment's boundary (the
+* custom file or the built-in page) when the group has none of its
+* own, so the boundary renders inside the group's layout, which is often the
+* root layout. Without `app/layout`, the root layout sits deeper (for example
+* `app/[lang]/layout`), and the boundary renders inside it so the page keeps
+* its `<html>` and `<body>`. A boundary file above that root layout renders
+* there too.
+*/
+function resolveAppPageRootHttpAccessBoundaryTreePosition(routeSegments, layoutTreePositions, layoutTreePosition) {
+	if (layoutTreePosition === void 0) return 0;
+	const firstSegment = routeSegments[0];
+	const groupTreePosition = layoutTreePosition > 1 && firstSegment !== void 0 && isAppPageRouteGroupSegment(firstSegment) ? 1 : 0;
+	const rootLayoutTreePosition = layoutTreePositions[0] ?? 0;
+	return rootLayoutTreePosition < layoutTreePosition ? Math.max(groupTreePosition, rootLayoutTreePosition) : groupTreePosition;
 }
 /**
-* Like {@link resolveAppPageParentHttpAccessBoundaryModule}, but also returns
-* the layout index that owns the resolved boundary so callers can slice the
-* layouts array to skip rendering layouts below the boundary owner.
+* Resolves the nearest layout-aligned boundary before `layoutIndex`, falling
+* back to the root module, and returns the layout index that owns it so
+* callers can slice the layouts array to skip layouts below the boundary owner.
 *
 * `layoutIndex` is the per-layout index where the boundary lives, or `null` if
 * the resolved boundary is the root module (which conceptually sits above all
@@ -119,4 +152,4 @@ async function renderAppPageBoundaryResponse(options) {
 	return options.createHtmlResponse(rscStream, options.status);
 }
 //#endregion
-export { renderAppPageBoundaryResponse, resolveAppPageErrorBoundary, resolveAppPageHttpAccessBoundaryComponent, resolveAppPageHttpAccessBoundaryModule, resolveAppPageParentHttpAccessBoundary, resolveAppPageParentHttpAccessBoundaryModule, wrapAppPageBoundaryElement };
+export { renderAppPageBoundaryResponse, resolveAppPageErrorBoundary, resolveAppPageHttpAccessBoundaryComponent, resolveAppPageHttpAccessBoundaryModule, resolveAppPageLayoutHttpAccessBoundary, resolveAppPageParentHttpAccessBoundary, resolveAppPageRootHttpAccessBoundaryTreePosition, wrapAppPageBoundaryElement };

package/dist/server/app-page-cache-finalizer.d.ts

@@ -2,6 +2,7 @@ import { RenderObservation } from "./cache-proof.js";
 import { AppRscRenderMode } from "./app-rsc-render-mode.js";
 import { AppPageRenderObservationState } from "./app-page-render-observation.js";
 import { AppPageCacheSetter } from "./isr-cache.js";
+import { CdnAppPageDocument } from "../shims/cdn-cache.js";
 import { AppPageRscRenderStatus } from "./app-page-rsc-render-status.js";
 //#region src/server/app-page-cache-finalizer.d.ts
 type AppPageDebugLogger = (event: string, detail: string) => void;
@@ -30,6 +31,8 @@ type FinalizeAppPageCacheabilityEvaluationOptions = {
   /** An RSC render's status, from its document's shell. */
   resolveRscRenderStatus?: () => Promise<AppPageRscRenderStatus>;
   revalidateSeconds: number | null;
+  /** Hands the CDN adapter the page's document to store beside the response. */
+  captureAdmittedDocument?: (document: CdnAppPageDocument | null) => void;
 };
 type FinalizeAppPageHtmlCacheResponseOptions = {
   bypassInterceptionContextCache?: boolean;
@@ -66,15 +69,20 @@ type FinalizeAppPageHtmlCacheResponseOptions = {
 };
 type ScheduleAppPageRscCacheWriteOptions = {
   bypassInterceptionContextCache?: boolean;
+  /** Hands the CDN adapter the page's document to store beside the response. */
+  captureAdmittedDocument?: (document: CdnAppPageDocument | null) => void;
   capturedRscDataPromise: Promise<ArrayBuffer> | null;
   cleanPathname: string;
   consumeDynamicUsage: () => boolean;
   consumeRenderObservationState?: () => AppPageRenderObservationState;
+  /** Observes the document the render's status resolution rendered, if any. */
+  createHtmlRenderObservation?: BuildAppPageCacheRenderObservation;
   createRscRenderObservation: BuildAppPageCacheRenderObservation;
   dynamicUsedDuringBuild: boolean;
   getPageTags: () => string[];
   getRequestCacheLife?: () => AppPageRequestCacheLife | null;
   isrDebug?: AppPageDebugLogger;
+  isrHtmlKey?: (pathname: string) => string;
   isrRscKey: AppPageRscCacheKeyBuilder;
   isrSet: AppPageCacheSetter;
   interceptionContext?: string | null;
@@ -82,7 +90,10 @@ type ScheduleAppPageRscCacheWriteOptions = {
   mountedSlotsHeader?: string | null;
   omitPendingDynamicCacheState?: boolean;
   renderMode?: AppRscRenderMode;
-  /** The render's status, from its document's shell. Without it the render is a 200. */
+  /**
+   * The render's status, from its document's shell, and the page's document
+   * when it rendered one to store. Without it the render is a 200.
+   */
   resolveRscRenderStatus?: () => Promise<AppPageRscRenderStatus>;
   preserveClientResponseHeaders?: boolean;
   expireSeconds?: number;
@@ -98,4 +109,5 @@ export declare function finalizeAppPageCacheabilityEvaluationResponse(response:
 export declare function finalizeAppPageHtmlCacheResponse(response: Response, options: FinalizeAppPageHtmlCacheResponseOptions): Response;
 export declare function finalizeAppPageRscCacheResponse(response: Response, options: ScheduleAppPageRscCacheWriteOptions): Response;
 export declare function scheduleAppPageRscCacheWrite(options: ScheduleAppPageRscCacheWriteOptions): boolean;
-//#endregion
+//#endregion
+export {};