@nextsparkjs/core 0.1.0-beta.193 → 0.1.0-beta.195

package/scripts/build/registry/host/__tests__/host-mode.test.mjs

@@ -17,7 +17,7 @@ const PREPARE_CLI = join(CORE_ROOT, 'scripts/build/registry/host/prepare-cli.mjs
 function project({ legacyApp = false } = {}) {
   const root = mkdtempSync(join(tmpdir(), 'nextspark-host-mode-'))
   write(root, 'nextspark.config.ts', 'export default { plugins: [] }\n')
-  write(root, 'package.json', JSON.stringify({ name: 'host-mode', dependencies: { next: '16.3.5' } }))
+  write(root, 'package.json', JSON.stringify({ name: 'host-mode', dependencies: { next: '16.3.6' } }))
   write(root, 'templates/pricing/page.tsx', PAGE('Pricing'))
   if (legacyApp) write(root, 'src/app/layout.tsx', 'export default function Layout({ children }) { return children }\n')
   return { root, cleanup: () => rmSync(root, { recursive: true, force: true }) }

package/scripts/build/registry/host/__tests__/host-plan.test.mjs

@@ -53,6 +53,16 @@ test('core < plugin < project: a higher layer replaces a lower one at the same r
   }
 })
 
+test('a project robots.ts replaces the robots route core ships (#214)', () => {
+  const { root, cleanup } = project({ 'templates/robots.ts': 'export default function robots() { return { rules: { userAgent: "*", disallow: "/" } } }\n' })
+  try {
+    const routes = resolveHostPlan({ coreRoutes: [core('robots.ts', 'robots')], plugins: [], project: { root } })
+    assert.deepEqual(summary(routes), ['robots.ts <- project:@/templates/robots (overrides core route @nextsparkjs/core/routes/robots)'])
+  } finally {
+    cleanup()
+  }
+})
+
 test('the extension does not decide the slot: templates/about/page.ts replaces core about/page.tsx', () => {
   const { root, cleanup } = project({ 'templates/about/page.ts': PAGE })
   try {
@@ -330,8 +340,8 @@ test('core\'s routes carry their protection level, so a composed layout can be t
   assert.equal(withCc.routes.find(route => route.target === 'layout.tsx').compose.specifier, '@nextsparkjs/core/routes/_internal/root-layout.ppr')
   assert.equal(withCc.routes.find(route => route.target === '(auth)/login/page.tsx').specifier, '@nextsparkjs/core/routes/(auth)/login/page.cc')
   assert.deepEqual(withCc.variantsApplied.sort(), [
-    '(auth)/layout.tsx', '(auth)/login/page.tsx', '(auth)/signup/page.tsx', '(public)/docs/[section]/[page]/page.tsx', '(public)/layout.tsx',
-    'dashboard/layout.tsx', 'devtools/layout.tsx', 'layout.tsx', 'superadmin/docs/[section]/[page]/page.tsx', 'superadmin/layout.tsx',
+    '(auth)/layout.tsx', '(auth)/login/page.tsx', '(auth)/signup/page.tsx', '(public)/docs/[section]/[page]/page.tsx', '(public)/layout.tsx', '(public)/page.tsx',
+    'dashboard/(main)/layout.tsx', 'dashboard/layout.tsx', 'devtools/layout.tsx', 'layout.tsx', 'superadmin/docs/[section]/[page]/page.tsx', 'superadmin/layout.tsx',
   ])
   // The layouts that load messages keep their wrapper (from the Cache Components module) and their protection level
   const ccLevel = target => withCc.routes.find(route => route.target === target)

package/scripts/build/registry/host/__tests__/host-project-composition.test.mjs

@@ -36,7 +36,7 @@ const LAYOUT = 'export default function Layout({ children }: { children: React.R
 function project(extra = {}) {
   const root = mkdtempSync(join(tmpdir(), 'nextspark-host-composition-'))
   write(root, 'nextspark.config.ts', "export default { plugins: [], billing: { webhookExtensions: { stripe: './lib/billing/stripe-webhook-extensions' } } }\n")
-  write(root, 'package.json', JSON.stringify({ name: 'composition', dependencies: { next: '16.3.5' } }))
+  write(root, 'package.json', JSON.stringify({ name: 'composition', dependencies: { next: '16.3.6' } }))
   write(root, 'config/theme.config.ts', "export const compositionThemeConfig = { name: 'composition' }\n")
   write(root, 'styles/globals.css', '@import "tailwindcss";\n')
   write(root, 'lib/billing/stripe-webhook-extensions.ts', 'export const stripeWebhookExtensions = {}\n')

package/scripts/build/registry/host/__tests__/host-project.test.mjs

@@ -16,7 +16,7 @@ const PREPARE_CLI = join(CORE_ROOT, 'scripts/build/registry/host/prepare-cli.mjs
 function project() {
   const root = mkdtempSync(join(tmpdir(), 'nextspark-host-project-'))
   write(root, 'nextspark.config.ts', 'export default { plugins: [] }\n')
-  write(root, 'package.json', JSON.stringify({ name: 'host-project', dependencies: { next: '16.3.5' } }))
+  write(root, 'package.json', JSON.stringify({ name: 'host-project', dependencies: { next: '16.3.6' } }))
   write(root, 'templates/pricing/page.tsx', PAGE('Pricing'))
   write(root, 'api/ping/route.ts', ROUTE)
   return { root, cleanup: () => rmSync(root, { recursive: true, force: true }) }
@@ -41,7 +41,7 @@ test('a real project: the registry build is staged and published with the host,
 
     const record = readGeneration(root)
     assert.equal(Object.keys(record.files).length, first.files.length)
-    assert.ok(record.versions.core && record.versions.next === '16.3.5')
+    assert.ok(record.versions.core && record.versions.next === '16.3.6')
     assert.ok(record.inputs.files['nextspark.config.ts'] && record.inputs.files['templates/pricing/page.tsx'])
     assert.deepEqual(await checkHost(config), { ok: true, problems: [] })
 

package/scripts/build/registry/host/__tests__/host-robustness.test.mjs

@@ -1,7 +1,7 @@
 import { test } from 'node:test'
 import assert from 'node:assert/strict'
 import { spawn } from 'node:child_process'
-import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { hostname, tmpdir } from 'node:os'
 import { join } from 'node:path'
 
@@ -139,6 +139,69 @@ test('crash mid-publish (SIGKILL): --check reports the host as not fresh, and th
   }
 })
 
+test('what a killed writer leaves (temporary files, a staging directory) is swept by the next prepare instead of blocking it or piling up', async () => {
+  const host = tempHost({ 'templates/about/page.tsx': PAGE('About') })
+  try {
+    const config = hostConfig(host.root)
+    await prepareHost(config, { mode: 'production' })
+    const leftovers = [
+      'src/app/(public)/.page.tsx.4242.0a1b2c3d.nextspark-tmp',
+      '.nextspark/registries/.example.ts.4242.0a1b2c3d.nextspark-tmp',
+      '.nextspark/contracts/index.ts.nextspark-tmp',
+      '.nextspark/staging-AbC123/registries/example.ts',
+    ]
+    const kept = ['.nextspark/my-notes.txt', '.nextspark/staging-notes/keep.txt']
+    for (const path of [...leftovers, ...kept]) write(host.hostRoot, path, 'x\n')
+
+    // A temporary file in src/app used to read as "a file NextSpark did not generate": prepare refused to run
+    const published = await prepareHost(config, { mode: 'production' })
+    assert.deepEqual(published.written, [])
+    for (const path of leftovers) assert.equal(existsSync(join(host.hostRoot, path)), false, `${path} is swept`)
+    assert.equal(existsSync(join(host.hostRoot, '.nextspark/staging-AbC123')), false)
+    // Only the writers' own names go: anything else is the user's
+    for (const path of kept) assert.equal(existsSync(join(host.hostRoot, path)), true, `${path} stays`)
+    write(host.hostRoot, 'src/app/(public)/page.tsx.nextspark-tmp', 'x\n')
+    await assert.rejects(() => prepareHost(config, { mode: 'production' }), error => error instanceof PrepareError && codes(error).includes(GENERATION_DIAGNOSTICS.FOREIGN))
+    assert.equal(existsSync(join(host.hostRoot, 'src/app/(public)/page.tsx.nextspark-tmp')), true)
+  } finally {
+    host.cleanup()
+  }
+})
+
+test('a scratch registry file a killed writer left is swept and the next prepare completes', async () => {
+  const host = tempHost({ 'templates/about/page.tsx': PAGE('About') })
+  try {
+    const config = hostConfig(host.root, { registries: manyRegistries(20, 'old') })
+    await prepareHost(config, { mode: 'production' })
+    const scratch = '.nextspark/registries/.r00003.ts.4242.0a1b2c3d.nextspark-tmp'
+    write(host.hostRoot, scratch, 'half written')
+    const fresh = hostConfig(host.root, { registries: manyRegistries(20, 'new') })
+    await prepareHost(fresh, { mode: 'production' })
+    assert.equal(existsSync(join(host.hostRoot, scratch)), false)
+    assert.deepEqual(await checkHost(fresh), { ok: true, problems: [] })
+  } finally {
+    host.cleanup()
+  }
+})
+
+test('the sweep never enters backups or migrate-rollback, and an unreadable directory under .nextspark does not crash prepare', async () => {
+  const host = tempHost({ 'templates/about/page.tsx': PAGE('About') })
+  const locked = join(host.hostRoot, '.nextspark/unreadable')
+  try {
+    const config = hostConfig(host.root)
+    await prepareHost(config, { mode: 'production' })
+    const kept = ['.nextspark/backups/20260101/src/app/.page.tsx.1.0a1b2c3d.nextspark-tmp', '.nextspark/backups/20260101/x.nextspark-tmp', '.nextspark/migrate-rollback/y.nextspark-tmp']
+    for (const path of kept) write(host.hostRoot, path, 'x\n')
+    write(host.hostRoot, '.nextspark/unreadable/z.nextspark-tmp', 'x\n')
+    if (process.getuid?.() !== 0) chmodSync(locked, 0)
+    await prepareHost(config, { mode: 'production' })
+    for (const path of kept) assert.equal(existsSync(join(host.hostRoot, path)), true, `${path} stays`)
+  } finally {
+    try { chmodSync(locked, 0o755) } catch {}
+    host.cleanup()
+  }
+})
+
 test('registries: a file in place of a generated registry is adopted only when a NextSpark registry build wrote it', async () => {
   const cases = [
     ['byte-identical', REGISTRY, 'adopted'],
@@ -251,7 +314,7 @@ test('an npm-installed core ships only dist/: the manifest, variants and route m
 test('the project config is read again for every generation: enabling a plugin in nextspark.config.ts adds its routes', async () => {
   const root = mkdtempSync(join(tmpdir(), 'nextspark-config-reload-'))
   try {
-    write(root, 'package.json', JSON.stringify({ name: 'reload', dependencies: { next: '16.3.5' } }))
+    write(root, 'package.json', JSON.stringify({ name: 'reload', dependencies: { next: '16.3.6' } }))
     write(root, 'nextspark.config.ts', 'export default { plugins: [] }\n')
     write(root, 'plugins/search/plugin.config.ts', 'export const searchPluginConfig = {}\n')
     write(root, 'plugins/search/templates/search/page.tsx', PAGE('Search'))

package/scripts/build/registry/host/entity-routes.mjs

@@ -54,6 +54,9 @@ export const ENTITY_MODULES = Object.freeze({
   detail: `${CORE_ROUTES_SPECIFIER}_internal/entity-detail-route`,
   create: `${CORE_ROUTES_SPECIFIER}_internal/entity-create-route`,
   edit: `${CORE_ROUTES_SPECIFIER}_internal/entity-edit-route`,
+  // The detail and edit pages of a host with `cacheComponents` on: the same routes behind a Suspense boundary (they await `params`).
+  detailCc: `${CORE_ROUTES_SPECIFIER}_internal/entity-detail-route.cc`,
+  editCc: `${CORE_ROUTES_SPECIFIER}_internal/entity-edit-route.cc`,
   publicItem: `${CORE_ROUTES_SPECIFIER}_internal/public-item-route`,
   // The item pages of a host with `cacheComponents` on: same factories, `'use cache'` reads instead of `revalidate`.
   publicItemCc: `${CORE_ROUTES_SPECIFIER}_internal/public-item-route.cc`,
@@ -207,7 +210,10 @@ export function planEntityRoutes({ entities, facts, coreRoutes, resolveFile, cac
   const revalidates = cacheComponents !== true && !modes.includes('cc')
   // A host that builds in Cache Components mode only gets the cached item source; one that builds both (the
   // conformance fixture) or does not know keeps the module that works in either.
-  const publicItemModule = cacheComponents === true && modes.length === 0 && modules.publicItemCc ? modules.publicItemCc : modules.publicItem
+  const ccOnly = cacheComponents === true && modes.length === 0
+  const publicItemModule = ccOnly && modules.publicItemCc ? modules.publicItemCc : modules.publicItem
+  const detailModule = ccOnly && modules.detailCc ? modules.detailCc : modules.detail
+  const editModule = ccOnly && modules.editCc ? modules.editCc : modules.edit
 
   const coreFacade = (kind, target, specifier) => ({
     kind,
@@ -275,8 +281,8 @@ export function planEntityRoutes({ entities, facts, coreRoutes, resolveFile, cac
         coreFacade('loading', `${base}/loading.tsx`, modules.loading),
         composed('page', `${base}/page.tsx`, 'createEntityListRoute', modules.list, [config, arg.template()], { acceptsTemplate: true, reexport: [{ names: ['metadata'], specifier: modules.listMetadata }] }),
         composed('page', `${base}/create/page.tsx`, 'createEntityCreateRoute', modules.create, [config, arg.template()], { acceptsTemplate: true }),
-        composed('page', `${base}/[id]/page.tsx`, 'createEntityDetailRoute', modules.detail, [config, arg.literal(children), arg.template()], { acceptsTemplate: true, reexport: [{ names: ['metadata'], specifier: modules.detailMetadata }] }),
-        composed('page', `${base}/[id]/edit/page.tsx`, 'createEntityEditRoute', modules.edit, [config, arg.template()], { acceptsTemplate: true })
+        composed('page', `${base}/[id]/page.tsx`, 'createEntityDetailRoute', detailModule, [config, arg.literal(children), arg.template()], { acceptsTemplate: true, reexport: [{ names: ['metadata'], specifier: modules.detailMetadata }] }),
+        composed('page', `${base}/[id]/edit/page.tsx`, 'createEntityEditRoute', editModule, [config, arg.template()], { acceptsTemplate: true })
       )
     }
 

package/scripts/build/registry/host/facade-emitter.mjs

@@ -284,8 +284,8 @@ export function resolveNextPackage(projectRoot = process.cwd()) {
 /**
  * Whether `version` is a Next.js the table applies to: the table's `next` is the verified
  * baseline, and core pins `next` to `~<baseline>`, so any stable patch of the same minor at or
- * above the baseline is accepted (16.3.5, 16.3.9, 16.3.5+build.1), while other minors/majors, lower
- * patches and prereleases (16.3.6-canary.0) are refused.
+ * above the baseline is accepted (16.3.6, 16.3.9, 16.3.6+build.1), while other minors/majors, lower
+ * patches and prereleases (16.3.7-canary.0) are refused.
  */
 export function isSupportedNextVersion(version, baseline = ROUTE_EXPORT_TABLE.next) {
   // Stable versions only; build metadata (`+build.1`) is allowed, as npm's `~` range allows it.

package/scripts/build/registry/host/generation.mjs

@@ -438,6 +438,60 @@ export function acquireLock(hostRoot, { staleAfterMs = DEFAULT_STALE_LOCK_MS, at
   throw lockedError(path)
 }
 
+// ---------------------------------------------------------------------------
+// What a killed writer leaves behind
+// ---------------------------------------------------------------------------
+
+// The names of the scratch files and directories the writers create: `writeAtomically` (below),
+// the contracts publisher (`<file>.nextspark-tmp`) and the registry build's staging directory
+// (`fs.mkdtempSync('.nextspark/staging-')`).
+const TEMPORARY_FILE = /^\..+\.\d+\.[0-9a-f]{8}\.nextspark-tmp$/
+const CONTRACTS_TEMPORARY_FILE = /\.nextspark-tmp$/
+const STAGING_DIR = /^staging-[A-Za-z0-9]{6}$/
+
+/**
+ * Remove what a writer that was killed (SIGKILL, power loss) between creating a scratch file and
+ * renaming it leaves behind: its temporary files under `src/app` and `.nextspark`, and a registry
+ * build's staging directory. Call it with the lock held, when no live writer can own one of them.
+ * Without it a temporary file in `src/app` is a file "NextSpark did not generate", so the next
+ * prepare refuses to run until someone deletes it by hand, and the others stay forever.
+ * Only names the writers use are touched, never through a symlink; returns the paths removed.
+ */
+export function sweepInterruptedWrites(hostRoot, { app = true } = {}) {
+  const fs = projectFiles(hostRoot)
+  const removed = []
+  const entries = dir => {
+    try {
+      return lstatOrNull(join(hostRoot, dir))?.isDirectory() ? readdirSync(join(hostRoot, dir), { withFileTypes: true }) : []
+    } catch {
+      return [] // an unreadable directory is skipped: the build reports it
+    }
+  }
+  const visit = (dir, isTemporary, recursive) => {
+    for (const entry of entries(dir)) {
+      const path = `${dir}/${entry.name}`
+      if (entry.isDirectory()) {
+        if (recursive) visit(path, isTemporary, true)
+      } else if (entry.isFile() && isTemporary.test(entry.name)) {
+        fs.unlinkSync(join(hostRoot, path))
+        removed.push(path)
+      }
+    }
+  }
+  // Only the places the writers use; never `.nextspark/backups` or `.nextspark/migrate-rollback`.
+  // src/app belongs to the host only when it generates it (prepareContractsOnly leaves it alone).
+  if (app) visit(APP_DIR, TEMPORARY_FILE, true)
+  visit('.nextspark', TEMPORARY_FILE, false)
+  visit(REGISTRIES_DIR, TEMPORARY_FILE, true)
+  visit('.nextspark/contracts', CONTRACTS_TEMPORARY_FILE, true)
+  for (const entry of entries('.nextspark')) {
+    if (!entry.isDirectory() || !STAGING_DIR.test(entry.name)) continue
+    fs.rmSync(join(hostRoot, '.nextspark', entry.name), { recursive: true, force: true })
+    removed.push(`.nextspark/${entry.name}`)
+  }
+  return removed
+}
+
 // ---------------------------------------------------------------------------
 // Publication
 // ---------------------------------------------------------------------------

package/scripts/build/registry/host/next-route-exports.json

@@ -1,7 +1,7 @@
 {
   "$comment": "Route file kinds x exports x emitted facade form, for the generated host (#203). Source of truth for host/facade-emitter.mjs; README.md renders it. Verified against the installed Next.js source listed in verifiedAgainst and by the probe builds recorded in README.md. Re-verify and bump `next` when upgrading Next.js: host/__tests__/facade-emitter.test.mjs fails when the installed version differs.",
-  "next": "16.3.5",
-  "supportedNext": "~16.3.5 (same major.minor, stable patch >= the verified baseline in \"next\"; enforced by isSupportedNextVersion)",
+  "next": "16.3.6",
+  "supportedNext": "~16.3.6 (same major.minor, stable patch >= the verified baseline in \"next\"; enforced by isSupportedNextVersion)",
   "verifiedAgainst": [
     "next/dist/build/segment-config/app/app-segment-config.js (AppSegmentConfigSchemaKeys, parseAppSegmentConfig)",
     "next/dist/build/analysis/get-page-static-info.js (checkExports, getAppPageStaticInfo)",

package/scripts/build/registry/host/prepare.mjs

@@ -58,6 +58,7 @@ import {
   preflight,
   publishGeneration,
   readGeneration,
+  sweepInterruptedWrites,
   validateFiles,
   writeOwnedFile,
 } from './generation.mjs'
@@ -209,6 +210,7 @@ export async function predictHost(config, { devStatus = false } = {}) {
 export async function prepareHost(config, { mode = 'development', devStatus = false, cache, staleAfterMs, reportFailure = false, changed = [] } = {}) {
   const release = acquireLock(config.hostRoot, { staleAfterMs })
   try {
+    sweepInterruptedWrites(config.hostRoot)
     return await generateAndPublish(config, { mode, devStatus, cache })
   } catch (error) {
     // `nextspark dev`: the failure goes to the browser under the same lock, so no other writer's
@@ -283,6 +285,7 @@ export async function prepareContractsOnly(config, { staleAfterMs } = {}) {
   if (!config.contracts) throw new PrepareError([{ code: 'NS_CONTRACTS_UNAVAILABLE', message: 'this project has no contracts step' }])
   const release = acquireLock(config.hostRoot, { staleAfterMs })
   try {
+    sweepInterruptedWrites(config.hostRoot, { app: false })
     const contracts = await planContractsStep(config)
     return publishContractsStep(config, contracts)
   } catch (error) {

package/scripts/build/registry/host/static-imports.mjs

@@ -80,11 +80,15 @@ export const CORE_COMPOSITION_WRAPPERS = Object.freeze({
   [`${INTERNAL}devtools-layout.cc`]: ['withDevtoolsGuard'],
   // Every page and layout under /superadmin and /devtools (the manifest's `access`).
   [`${INTERNAL}area-access`]: ['withSuperadminAccess', 'withDevtoolsAccess', 'withSuperadminMetadata', 'withDevtoolsMetadata', 'withSuperadminRouteAccess', 'withDevtoolsRouteAccess'],
+  // The same, for a Cache Components host (each segment checks inside its own Suspense boundary).
+  [`${INTERNAL}area-access.cc`]: ['withSuperadminAccess', 'withDevtoolsAccess', 'withSuperadminMetadata', 'withDevtoolsMetadata', 'withSuperadminRouteAccess', 'withDevtoolsRouteAccess'],
   [`${INTERNAL}entity-layout-route`]: ['createEntityLayoutRoute'],
   [`${INTERNAL}entity-list-route`]: ['createEntityListRoute'],
   [`${INTERNAL}entity-detail-route`]: ['createEntityDetailRoute'],
   [`${INTERNAL}entity-create-route`]: ['createEntityCreateRoute'],
   [`${INTERNAL}entity-edit-route`]: ['createEntityEditRoute'],
+  [`${INTERNAL}entity-detail-route.cc`]: ['createEntityDetailRoute'],
+  [`${INTERNAL}entity-edit-route.cc`]: ['createEntityEditRoute'],
   [`${INTERNAL}public-item-route`]: ['createPublicItemRoute', 'createPublicItemMetadata'],
   [`${INTERNAL}public-item-route.cc`]: ['createPublicItemRoute', 'createPublicItemMetadata'],
   [`${INTERNAL}public-archive-route`]: ['createPublicArchiveRoute', 'createPublicArchiveMetadata'],

package/scripts/build/routes-manifest.mjs

@@ -66,6 +66,8 @@ export const VARIANT_FILES = Object.freeze({
     'superadmin/layout.cc.tsx': 'superadmin/layout.tsx',
     'devtools/layout.cc.tsx': 'devtools/layout.tsx',
     'dashboard/layout.cc.tsx': 'dashboard/layout.tsx',
+    'dashboard/(main)/layout.cc.tsx': 'dashboard/(main)/layout.tsx',
+    '(public)/page.cc.tsx': '(public)/page.tsx',
     '(auth)/login/page.cc.tsx': '(auth)/login/page.tsx',
     '(auth)/signup/page.cc.tsx': '(auth)/signup/page.tsx',
     '(public)/docs/[section]/[page]/page.cc.tsx': '(public)/docs/[section]/[page]/page.tsx',
@@ -105,6 +107,15 @@ export const VARIANT_COMPOSE = Object.freeze({
   'devtools/layout.cc.tsx': { wrapper: 'withDevtoolsGuard', specifier: `${ROUTES_SUBPATH}/_internal/devtools-layout.cc` },
 })
 
+/**
+ * The per-segment access check of a variant, when it differs from its base route's: in Cache Components mode every
+ * page and layout under an area checks the role inside its own Suspense boundary (area-access.cc).
+ */
+export const VARIANT_ACCESS = Object.freeze({
+  'superadmin/layout.cc.tsx': { ...ACCESS_ROUTES['superadmin/layout.tsx'], specifier: `${ROUTES_SUBPATH}/_internal/area-access.cc` },
+  'devtools/layout.cc.tsx': { ...ACCESS_ROUTES['devtools/layout.tsx'], specifier: `${ROUTES_SUBPATH}/_internal/area-access.cc` },
+})
+
 /**
  * Files that live next to a route without being one: the API explorer's presets, read as text by the
  * registry build (registry/discovery/api-presets.mjs), and its docs.md.
@@ -168,7 +179,8 @@ export function buildRoutesManifest(routesDir = ROUTES_DIR) {
       const replaced = manifest.find(entry => entry.target === target)
       if (!replaced) throw new Error(`Variant ${file} (${mode}) replaces ${target}, which is not a core route`)
       const compose = VARIANT_COMPOSE[file] ?? replaced.compose
-      return { kind: replaced.kind, target, specifier: specifierForRouteFile(file), ...(compose ? { compose } : {}), ...(replaced.access ? { access: replaced.access } : {}) }
+      const access = VARIANT_ACCESS[file] ?? replaced.access
+      return { kind: replaced.kind, target, specifier: specifierForRouteFile(file), ...(compose ? { compose } : {}), ...(access ? { access } : {}) }
     })
   }
   return { manifest, variants }