@rangojs/router 0.0.0-experimental.8123bb7e → 0.0.0-experimental.82

package/dist/vite/plugins/cloudflare-protocol-loader-hook.mjs

@@ -0,0 +1,76 @@
+// Node ESM loader hook that resolves `cloudflare:*` imports to the same
+// stub ESM the Vite transform produces for rewritten specifiers.
+//
+// Why both? The Vite transform (cloudflare-protocol-stub.ts) catches
+// imports in modules that flow through Vite's plugin pipeline — covers
+// user source and any node_modules package Vite fetches and transforms.
+// But Vite/Rollup externalize certain packages (e.g. `partyserver`,
+// which has `import { DurableObject, env } from "cloudflare:workers"`
+// at its top level, and similar "workerd-native" libraries). Externalized
+// modules bypass the transform: Rollup hands their resolution to Node's
+// native ESM loader, which rejects URL-scheme specifiers. This loader
+// hook registers via `module.register()` from `createTempRscServer` and
+// intercepts `cloudflare:*` at Node's resolve layer — before the default
+// loader throws ERR_UNSUPPORTED_ESM_URL_SCHEME.
+//
+// Lifecycle: the hook runs in a dedicated worker thread (Node ESM loader
+// architecture) with its own globalThis. It cannot see the main thread's
+// `__rango_build_env__` bridge, so the `env` export here is always `{}`.
+// That's fine in practice — externalized libraries don't typically touch
+// `env` at module top level; they read it at request time in workerd
+// where the real module exists. Build-time prerender handlers in user
+// source DO read `env`, but they flow through the Vite transform (which
+// does bridge `env` from `getPlatformProxy()`), not through this loader.
+//
+// Keep STUBS in sync with cloudflare-protocol-stub.ts — both paths need
+// to hand out the same base classes.
+
+const CF_PREFIX = "cloudflare:";
+
+const STUBS = {
+  "cloudflare:workers": `
+export class DurableObject { constructor(_ctx, _env) {} }
+export class WorkerEntrypoint { constructor(_ctx, _env) {} }
+export class WorkflowEntrypoint { constructor(_ctx, _env) {} }
+export class RpcTarget {}
+export const env = {};
+export default {};
+`,
+  "cloudflare:email": `
+export class EmailMessage { constructor(_from, _to, _raw) {} }
+export default {};
+`,
+  "cloudflare:sockets": `
+export function connect() { return {}; }
+export default {};
+`,
+  "cloudflare:workflows": `
+export class NonRetryableError extends Error {
+  constructor(message, name) { super(message); this.name = name ?? "NonRetryableError"; }
+}
+export default {};
+`,
+};
+
+// Policy: unknown `cloudflare:*` specifiers resolve permissively to an
+// empty default export rather than throwing. Same reasoning as
+// cloudflare-protocol-stub.ts's FALLBACK_STUB — we prioritize
+// dependency-graph resilience over strict validation, because third-party
+// packages can pull `cloudflare:*` modules we haven't curated.
+const FALLBACK_STUB = `export default {};\n`;
+
+function dataUrlFor(specifier) {
+  const body = STUBS[specifier] ?? FALLBACK_STUB;
+  return "data:text/javascript;base64," + Buffer.from(body).toString("base64");
+}
+
+export async function resolve(specifier, context, nextResolve) {
+  if (specifier.startsWith(CF_PREFIX)) {
+    return {
+      shortCircuit: true,
+      url: dataUrlFor(specifier),
+      format: "module",
+    };
+  }
+  return nextResolve(specifier, context);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rangojs/router",
-  "version": "0.0.0-experimental.8123bb7e",
+  "version": "0.0.0-experimental.82",
   "description": "Django-inspired RSC router with composable URL patterns",
   "keywords": [
     "react",
@@ -133,7 +133,7 @@
     "tag": "experimental"
   },
   "scripts": {
-    "build": "pnpm dlx esbuild src/vite/index.ts --bundle --format=esm --outfile=dist/vite/index.js --platform=node --packages=external && pnpm dlx esbuild src/bin/rango.ts --bundle --format=esm --outfile=dist/bin/rango.js --platform=node --packages=external --banner:js='#!/usr/bin/env node' && chmod +x dist/bin/rango.js",
+    "build": "pnpm dlx esbuild src/vite/index.ts --bundle --format=esm --outfile=dist/vite/index.js --platform=node --packages=external && mkdir -p dist/vite/plugins && cp src/vite/plugins/cloudflare-protocol-loader-hook.mjs dist/vite/plugins/cloudflare-protocol-loader-hook.mjs && pnpm dlx esbuild src/bin/rango.ts --bundle --format=esm --outfile=dist/bin/rango.js --platform=node --packages=external --banner:js='#!/usr/bin/env node' && chmod +x dist/bin/rango.js",
     "prepublishOnly": "pnpm build",
     "typecheck": "tsc --noEmit",
     "test": "playwright test",
@@ -142,7 +142,7 @@
     "test:unit:watch": "vitest"
   },
   "dependencies": {
-    "@vitejs/plugin-rsc": "^0.5.14",
+    "@vitejs/plugin-rsc": "^0.5.23",
     "magic-string": "^0.30.17",
     "picomatch": "^4.0.3",
     "rsc-html-stream": "^0.0.7"
@@ -162,7 +162,7 @@
   },
   "peerDependencies": {
     "@cloudflare/vite-plugin": "^1.25.0",
-    "@vitejs/plugin-rsc": "^0.5.14",
+    "@vitejs/plugin-rsc": "^0.5.23",
     "react": "^18.0.0 || ^19.0.0",
     "vite": "^7.3.0"
   },

package/skills/handler-use/SKILL.md

@@ -0,0 +1,362 @@
+---
+name: handler-use
+description: Attach default loaders, middleware, parallels, and other use items directly to handlers via handler.use, and compose them with explicit use() at mount sites
+argument-hint: "[handler]"
+---
+
+# Handler-Attached `.use`
+
+A handler function (or branded `Static`/`Prerender`/`Passthrough` definition) can carry its own defaults via a `.use` callback that returns an array of `use` items (loader, middleware, parallel, intercept, layout, loading, etc.). The mount-site DSL (`path()`, `layout()`, `parallel()`, `intercept()`) merges those defaults with any explicit `use()` callback supplied at the registration site.
+
+This lets handlers be **self-contained, reusable units** — a page brings its own loader, a layout brings its own middleware, a parallel slot brings its own data + skeleton — without forcing every caller to wire the same items at every mount site.
+
+Canonical implementation reference:
+[src/route-definition/resolve-handler-use.ts](../../src/route-definition/resolve-handler-use.ts)
+
+## Defining a handler with `.use`
+
+Attach `.use` to the function (or to the branded definition for `Static()`/`Prerender()`/`Passthrough()`):
+
+```typescript
+import {
+  loader,
+  middleware,
+  loading,
+  createLoader,
+  type Handler,
+} from "@rangojs/router";
+
+export const ProductLoader = createLoader(async (ctx) =>
+  fetchProduct(ctx.params.slug),
+);
+
+const ProductPage: Handler<"/product/:slug"> = async (ctx) => {
+  const product = await ctx.use(ProductLoader);
+  return <ProductView product={product} />;
+};
+
+ProductPage.use = () => [
+  loader(ProductLoader),
+  loading(<ProductSkeleton />),
+  middleware(async (ctx, next) => {
+    await next();
+    ctx.header("Cache-Control", "private, max-age=60");
+  }),
+];
+```
+
+Now `ProductPage` carries its loader, loading state, and response-header middleware regardless of where it is mounted.
+
+## Allowed items per mount site
+
+`handler.use()` is the same callback shape regardless of where the handler runs, but the runtime validates that the items it returns are valid for the mount site. Driven by `MOUNT_SITE_ALLOWED_TYPES` in [resolve-handler-use.ts](../../src/route-definition/resolve-handler-use.ts):
+
+| Mount site                                        | Allowed item types                                                                                                                             |
+| ------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
+| `path()` / `route()`                              | `layout`, `parallel`, `intercept`, `middleware`, `revalidate`, `loader`, `loading`, `errorBoundary`, `notFoundBoundary`, `cache`, `transition` |
+| `layout()`                                        | All of the above, plus `route`, `include`                                                                                                      |
+| `parallel()` (per slot)                           | `revalidate`, `loader`, `loading`, `errorBoundary`, `notFoundBoundary`, `transition`                                                           |
+| `intercept()`                                     | `middleware`, `revalidate`, `loader`, `loading`, `errorBoundary`, `notFoundBoundary`, `layout`, `route`, `when`, `transition`                  |
+| Response routes (`path.json()`, `path.text()`, …) | `middleware`, `cache`                                                                                                                          |
+
+If `handler.use()` returns a disallowed item for a mount site, registration throws:
+
+```
+handler.use() returned middleware() which is not valid inside parallel().
+Allowed types: revalidate, loader, loading, errorBoundary, notFoundBoundary, transition.
+```
+
+The narrowest contract is `parallel()` — slots cannot bring their own middleware or layout; only data, loading, error/notFound boundaries, revalidation, and transitions.
+
+## Composition with explicit `use()`
+
+Every mount site that takes a `use` callback merges in this order:
+
+1. **`handler.use()` items first** — the handler's defaults.
+2. **Explicit `use()` items second** — overrides specified at the mount site.
+
+Items of the same kind from the explicit `use()` follow the existing override rules of that item type. The most important ones for composition:
+
+- **`loading()`** — last definition wins, so explicit `loading()` replaces the handler's default.
+- **`parallel({ "@slot": … })`** — the last `parallel()` call wins per slot name. Other slots from earlier calls are preserved (see `skills/parallel`).
+- **`loader()`, `middleware()`, etc.** — accumulate; both the handler's and the explicit ones run.
+
+Skip the boilerplate: if neither `handler.use` nor explicit `use()` is provided, no merge happens.
+
+```typescript
+// Handler brings a loader + a (placeholder) loading; explicit use replaces loading.
+const SidebarSlot: Handler = async (ctx) => {
+  const data = await ctx.use(SidebarLoader);
+  return <Sidebar data={data} />;
+};
+SidebarSlot.use = () => [
+  loader(SidebarLoader),
+  loading(<DefaultSidebarSkeleton />),
+];
+
+parallel({ "@sidebar": SidebarSlot }, () => [
+  // Replaces the default skeleton; SidebarLoader from handler.use still runs.
+  loading(<SiteSpecificSidebarSkeleton />),
+]);
+```
+
+## Composable parallel slots (the main pay-off)
+
+The parallel slot site is where `handler.use` shines. A slot handler that owns its data/loading lets a layout declare **just** the slot names — every loader, skeleton, and revalidation contract travels with the slot itself.
+
+### Without `handler.use` (every caller wires it up)
+
+```typescript
+layout(<DashboardLayout />, () => [
+  parallel({ "@cart": CartSummary }, () => [
+    loader(CartLoader),
+    loading(<CartSkeleton />),
+    revalidate(revalidateCartData),
+  ]),
+  parallel({ "@notifs": NotificationPanel }, () => [
+    loader(NotificationsLoader),
+    loading(<NotifsSkeleton />),
+    revalidate(revalidateNotifs),
+  ]),
+  path("/dashboard", DashboardIndex, { name: "dashboard.index" }),
+]);
+```
+
+Every layout that wants `@cart` must repeat the same loader/loading/revalidate triplet.
+
+### With `handler.use` (slot owns its dependencies)
+
+```typescript
+const CartSummary: Handler = async (ctx) => {
+  const cart = await ctx.use(CartLoader);
+  return <CartSummaryView cart={cart} />;
+};
+CartSummary.use = () => [
+  loader(CartLoader),
+  loading(<CartSkeleton />),
+  revalidate(revalidateCartData),
+];
+
+const NotificationPanel: Handler = async (ctx) => {
+  const items = await ctx.use(NotificationsLoader);
+  return <NotificationsView items={items} />;
+};
+NotificationPanel.use = () => [
+  loader(NotificationsLoader),
+  loading(<NotifsSkeleton />),
+  revalidate(revalidateNotifs),
+];
+
+// Mount sites become declarative — no per-call data wiring.
+layout(<DashboardLayout />, () => [
+  parallel({ "@cart": CartSummary, "@notifs": NotificationPanel }),
+  path("/dashboard", DashboardIndex, { name: "dashboard.index" }),
+]);
+
+layout(<AccountLayout />, () => [
+  // Same slot, same defaults, zero re-wiring.
+  parallel({ "@cart": CartSummary }),
+  path("/account", AccountIndex, { name: "account.index" }),
+]);
+```
+
+Each slot handler is now a portable, self-contained unit. Different layouts can use the same slot without copying data plumbing.
+
+### Streaming behavior is per-slot
+
+A slot's `loading()` (whether from `handler.use` or explicit) makes that slot an independent streaming unit — its loader does not block the parent layout. Two slot handlers with their own loading skeletons stream independently.
+
+```typescript
+parallel({
+  "@cart": CartSummary, // handler.use loading() → streams independently
+  "@cartBadge": CartBadge, // no loading() anywhere → awaited before paint
+});
+```
+
+### Two scopes for explicit `use` at the mount site: shared (broadcast) and slot-local
+
+`parallel()` accepts an explicit `use()` callback that **broadcasts** to every slot in the call ([dsl-helpers.ts](../../src/route-definition/dsl-helpers.ts)). That's the right behavior for the items the parallel allow-list permits and that accumulate (`loader`, `revalidate`, `errorBoundary`, `notFoundBoundary`, `transition`) — every slot gets them. (Note: `middleware` is not allowed inside `parallel()`; see the allowed-types table above.)
+
+For single-assignment items like `loading()`, broadcasting overwrites every slot's `handler.use` default. Pass a **slot descriptor** `{ handler, use }` instead: items in the descriptor's `use` apply only to that slot.
+
+```typescript
+parallel({
+  "@meta": MetaSlot,
+  "@sidebar": {
+    handler: SidebarSlot,
+    use: () => [loading(<SidebarSkeleton />)], // ← only @sidebar
+  },
+});
+```
+
+Per-slot merge order is **handler.use → shared use → slot-local use** (narrowest scope wins for last-write-wins items like `loading()`):
+
+```typescript
+parallel(
+  {
+    "@cart": {
+      handler: Cart,
+      use: () => [loading(<CartSkeleton />)], // wins for @cart
+    },
+    "@notifs": Notifs, // gets <BroadcastSkeleton />
+  },
+  () => [
+    loader(SharedAnalyticsLoader), // accumulates on every slot
+    loading(<BroadcastSkeleton />), // applies to slots without slot-local
+  ],
+);
+```
+
+Use the descriptor's `use` for `loading(false)` too — opting one slot out of streaming without affecting siblings:
+
+```typescript
+parallel(
+  {
+    "@cart": { handler: Cart, use: () => [loading(false)] }, // @cart awaits
+    "@notifs": Notifs, // @notifs still streams with broadcast skeleton
+  },
+  () => [loading(<BroadcastSkeleton />)],
+);
+```
+
+Rule of thumb: shared `use` is for items that legitimately apply to every slot. Slot-local `use` is for per-slot precision — especially `loading()` and `loading(false)`.
+
+### Replacing a whole slot from a parent's `handler.use`
+
+A handler can publish a default `parallel({...})` set via its `.use`, and the mount site can replace any individual slot by re-declaring it. Last `parallel()` per slot name wins (see `skills/parallel` § Slot Override Semantics).
+
+```typescript
+const ProductPage: Handler<"/product/:slug"> = (ctx) => (
+  <article>
+    <ProductHero slug={ctx.params.slug} />
+    <ParallelOutlet name="@related" />
+    <ParallelOutlet name="@reviews" />
+  </article>
+);
+ProductPage.use = () => [
+  parallel({
+    "@related": DefaultRelatedProducts,
+    "@reviews": DefaultReviews,
+  }),
+];
+
+path("/product/:slug", ProductPage, { name: "product" }, () => [
+  // Override @related only; @reviews keeps the default from handler.use.
+  parallel({ "@related": SiteSpecificRelated }),
+]);
+```
+
+## Other mount sites
+
+### Pages (`path()`)
+
+Page handlers can carry middleware, loaders, error boundaries, parallel slots, etc. — anything from the `path` row of the table above.
+
+```typescript
+const CheckoutPage: Handler<"/checkout"> = async (ctx) => { /* … */ };
+CheckoutPage.use = () => [
+  middleware(requireAuth),
+  loader(CartLoader),
+  errorBoundary(<CheckoutError />),
+  notFoundBoundary(<CheckoutNotFound />),
+];
+```
+
+### Layouts (`layout()`)
+
+Layout handlers can carry middleware that runs for every child route, plus default parallels, includes, etc.
+
+```typescript
+const AdminLayout: Handler = (ctx) => {
+  const user = ctx.get(CurrentUser);
+  return <Admin user={user} />;
+};
+AdminLayout.use = () => [
+  middleware(requireAdmin),
+  parallel({ "@adminNotifs": AdminNotifsSlot }),
+];
+```
+
+### Intercepts (`intercept()`)
+
+Intercept handlers can carry their own middleware chain, loaders, and even nested layouts/routes for the modal shell.
+
+```typescript
+const QuickViewModal: Handler = async (ctx) => {
+  const product = await ctx.use(ProductLoader);
+  return <QuickView product={product} />;
+};
+QuickViewModal.use = () => [
+  loader(ProductLoader),
+  loading(<QuickViewSkeleton />),
+  layout(<ModalChrome />),
+];
+```
+
+## `loading()` is a single-assignment item — scope it correctly
+
+Most `use` items accumulate when merged: `handler.use` `middleware()` runs _and_ explicit `middleware()` runs; both `loader()` registrations apply. `loading()` is different — it mutates `entry.loading` directly, last call wins ([dsl-helpers.ts `loadingFn`](../../src/route-definition/dsl-helpers.ts)).
+
+For pages, layouts, and intercepts that's straightforward: explicit `loading()` at the mount site replaces any `loading()` from `handler.use`. The merge order is `handler.use → explicit`, so the explicit one is the last writer and wins.
+
+For parallel slots, the shared `parallel(..., () => [...])` callback is **broadcast** to every slot in the call. A single `loading()` placed there lands on every slot, overwriting each slot's `handler.use` default. To scope `loading()` to one slot, use the **slot descriptor** form:
+
+```typescript
+const Cart: Handler = async (ctx) => { /* … */ };
+Cart.use = () => [loader(CartLoader), loading(<CartSkeleton />)];
+
+const Notifs: Handler = async (ctx) => { /* … */ };
+Notifs.use = () => [loader(NotifsLoader), loading(<NotifsSkeleton />)];
+
+// ✅ @cart gets a custom skeleton; @notifs keeps its handler.use default.
+parallel({
+  "@cart": {
+    handler: Cart,
+    use: () => [loading(<CustomCartSkeleton />)],
+  },
+  "@notifs": Notifs,
+});
+
+// ✅ Opt one slot out of streaming while siblings still stream the broadcast.
+parallel(
+  {
+    "@cart": { handler: Cart, use: () => [loading(false)] },
+    "@notifs": Notifs,
+  },
+  () => [loading(<BroadcastSkeleton />)],
+);
+```
+
+Per-slot merge order is **handler.use → shared use → slot-local use**. Slot-local is the narrowest scope, so it wins for last-write-wins items like `loading()`. Items that accumulate within the parallel allow-list (`loader`, `revalidate`, `errorBoundary`, `notFoundBoundary`, `transition`) compose across all three layers regardless.
+
+Other things to keep in mind about `loading()`:
+
+- Any `loading()` (regardless of source) makes the segment a streaming unit. A handler that includes `loading()` in its `.use` opts every mount site into streaming by default. To opt back out, pass `loading(false)` at the mount site (`loading: false` handling in [match-middleware/segment-resolution.ts](../../src/router/match-middleware/segment-resolution.ts)) — use the slot descriptor form for parallel slots so the opt-out doesn't broadcast.
+
+Rule of thumb: only put `loading()` in `handler.use` if you genuinely want every mount site to stream by default. Use the slot descriptor's `use` for any per-slot intent at a `parallel()` call.
+
+## Edge cases & gotchas
+
+- **ReactNode handlers cannot have `.use`.** A bare JSX element passed as a handler (e.g., `path("/about", <About />)`) has no function to attach properties to. Pass a function or branded definition instead.
+- **Branded handlers** — `Static()`, `Prerender()`, and `Passthrough()` are positional constructors (not object-arg). Construct first, then attach `.use` to the returned definition:
+
+  ```typescript
+  const ProductPage = Prerender(async (ctx) => {
+    const product = await fetchProduct(ctx.params.slug);
+    return <ProductView product={product} />;
+  });
+  ProductPage.use = () => [loader(ProductLoader)];
+  ```
+
+- **Items can be flat or nested arrays.** `handler.use()` results are flattened with `.flat(3)` before validation, so factory helpers that return arrays inline work the same as in regular `use()` callbacks.
+- **Validation runs at registration / first match**, not at handler definition. A handler doesn't know its mount site at definition time — the same handler used in a `path()` and an `intercept()` is validated against each mount's allowed-types set when registered.
+- **No silent shadowing.** If a disallowed item slips through (e.g., a layout factory returning `cache()` from a slot's `handler.use`), the runtime throws with the offending type and mount site named.
+
+## Cross-references
+
+- `skills/route` — `path()` mount site basics
+- `skills/layout` — `layout()` mount site basics
+- `skills/parallel` — parallel slot semantics, slot override rules, streaming behavior
+- `skills/intercept` — intercept mount site basics
+- `skills/loader` — defining `createLoader` and reading via `ctx.use()`
+- `skills/middleware` — middleware semantics and ordering

package/skills/hooks/SKILL.md

@@ -593,6 +593,12 @@ function ProductPage() {
   return <h1>Product {params.productId}</h1>;
 }
 
+// Annotate the expected shape via a generic
+function ProductPageTyped() {
+  const { productId } = useParams<{ productId: string }>();
+  return <h1>Product {productId}</h1>;
+}
+
 // With selector for performance (re-renders only when selected value changes)
 function ProductId() {
   const productId = useParams((p) => p.productId);
@@ -600,7 +606,7 @@ function ProductId() {
 }
 ```
 
-Returns merged params from all matched route segments. Updates on navigation commit (not during pending navigation).
+Returns merged params from all matched route segments as a `Readonly<T>` map. Updates on navigation commit (not during pending navigation).
 
 ### usePathname()
 
@@ -685,20 +691,20 @@ See `/links` for full URL generation guide including server-side `ctx.reverse`.
 
 ## Hook Summary
 
-| Hook                 | Purpose                           | Returns                                         |
-| -------------------- | --------------------------------- | ----------------------------------------------- |
-| `useParams()`        | Route params                      | `Record<string, string>` or selected value      |
-| `usePathname()`      | Current pathname                  | `string`                                        |
-| `useSearchParams()`  | URL search params                 | `ReadonlyURLSearchParams`                       |
-| `useHref()`          | Mount-aware href                  | `(path) => string`                              |
-| `useMount()`         | Current include() mount path      | `string`                                        |
-| `useNavigation()`    | Reactive navigation state         | state, location, isStreaming                    |
-| `useRouter()`        | Stable router actions             | push, replace, refresh, prefetch, back, forward |
-| `useSegments()`      | URL path & segment IDs            | path, segmentIds, location                      |
-| `useLinkStatus()`    | Link pending state                | { pending }                                     |
-| `useLoader()`        | Loader data (strict)              | data, isLoading, error                          |
-| `useFetchLoader()`   | Loader with on-demand fetch       | data, load, isLoading                           |
-| `useHandle()`        | Accumulated handle data           | T (handle type)                                 |
-| `useAction()`        | Server action state               | state, error, result                            |
-| `useLocationState()` | History state (persists or flash) | T \| undefined                                  |
-| `useClientCache()`   | Cache control                     | { clear }                                       |
+| Hook                 | Purpose                           | Returns                                                            |
+| -------------------- | --------------------------------- | ------------------------------------------------------------------ |
+| `useParams()`        | Route params                      | `Readonly<T>` (default `Record<string, string>`) or selected value |
+| `usePathname()`      | Current pathname                  | `string`                                                           |
+| `useSearchParams()`  | URL search params                 | `ReadonlyURLSearchParams`                                          |
+| `useHref()`          | Mount-aware href                  | `(path) => string`                                                 |
+| `useMount()`         | Current include() mount path      | `string`                                                           |
+| `useNavigation()`    | Reactive navigation state         | state, location, isStreaming                                       |
+| `useRouter()`        | Stable router actions             | push, replace, refresh, prefetch, back, forward                    |
+| `useSegments()`      | URL path & segment IDs            | path, segmentIds, location                                         |
+| `useLinkStatus()`    | Link pending state                | { pending }                                                        |
+| `useLoader()`        | Loader data (strict)              | data, isLoading, error                                             |
+| `useFetchLoader()`   | Loader with on-demand fetch       | data, load, isLoading                                              |
+| `useHandle()`        | Accumulated handle data           | T (handle type)                                                    |
+| `useAction()`        | Server action state               | state, error, result                                               |
+| `useLocationState()` | History state (persists or flash) | T \| undefined                                                     |
+| `useClientCache()`   | Cache control                     | { clear }                                                          |

package/skills/intercept/SKILL.md

@@ -311,3 +311,23 @@ export const shopPatterns = urls(({
   ]),
 ]);
 ```
+
+## Handler-attached `.use`
+
+Intercept handlers can carry their own middleware, loaders, loading state, error/notFound boundaries, and even nested `layout`/`route`/`when` defaults via `.use` — useful for self-contained modal components that travel with their own data and chrome.
+
+```typescript
+const QuickViewModal: Handler = async (ctx) => {
+  const product = await ctx.use(ProductLoader);
+  return <QuickView product={product} />;
+};
+QuickViewModal.use = () => [
+  loader(ProductLoader),
+  loading(<QuickViewSkeleton />),
+  layout(<ModalChrome />),
+];
+
+intercept("@modal", "product", QuickViewModal);
+```
+
+Explicit `use()` at the mount site merges with `handler.use` (handler defaults first, explicit second). See [skills/handler-use](../handler-use/SKILL.md) for merge order and the per-mount-site allowed-types table.

package/skills/layout/SKILL.md

@@ -308,3 +308,25 @@ export const shopPatterns = urls(({ path, layout, parallel, loader, revalidate }
   ]),
 ]);
 ```
+
+## Handler-attached `.use`
+
+Layout handlers can carry their own middleware, default parallels, and includes via `.use` so a layout becomes a self-contained unit reusable across mount sites.
+
+```typescript
+const AdminLayout: Handler = (ctx) => {
+  const user = ctx.get(CurrentUser);
+  return <Admin user={user} />;
+};
+AdminLayout.use = () => [
+  middleware(requireAdmin),
+  parallel({ "@adminNotifs": AdminNotifsSlot }),
+];
+
+// Mount site declares structure only; defaults travel with the layout.
+layout(AdminLayout, () => [
+  path("/admin", AdminIndex, { name: "admin.index" }),
+]);
+```
+
+Allowed item types in a layout's `.use` mirror the layout `use()` callback (the broadest set). Explicit `use()` at the mount site merges with `handler.use` (handler defaults first, explicit second). See [skills/handler-use](../handler-use/SKILL.md) for merge order and per-mount-site allowed types.

package/skills/links/SKILL.md

@@ -139,7 +139,9 @@ function GlobalNav() {
 }
 ```
 
-`href()` is an identity function at runtime but provides compile-time validation via `ValidPaths` type. Paths are validated against registered route patterns using `PatternToPath`.
+`href()` provides compile-time validation via `ValidPaths` type. Paths are validated against registered route patterns using `PatternToPath`.
+
+`href()` is a raw path helper — it is **not** basename-aware. It returns the path as-is (or with the include mount prefix via `useHref()`). For basename-aware navigation, use `Link`, `useRouter().push()`, or `reverse()`, which auto-prefix root-relative paths with the router's basename.
 
 ## Client: useHref()
 

package/skills/middleware/SKILL.md

@@ -26,6 +26,8 @@ const router = createRouter<AppEnv>({})
   .routes(urlpatterns);
 ```
 
+When the router has a `basename`, pattern-scoped `.use()` patterns are automatically prefixed. For example, with `basename: "/app"`, `.use("/admin/*", mw)` matches `/app/admin/*`.
+
 ### Route middleware (`middleware()` in `urls()`)
 
 Registered inside `urls()` callback. Wraps **rendering only** -- it does NOT wrap server action execution. Actions run before route middleware, so when route middleware executes during post-action revalidation, it can observe state that the action set (cookies, context variables, headers).
@@ -135,17 +137,46 @@ export const urlpatterns = urls(({ path, layout, middleware }) => [
 ## Middleware with Multiple Handlers
 
 ```typescript
-// Spread multiple middleware from a single export
+// Group multiple middleware in an array
 export const shopMiddleware = [loggerMiddleware, mockAuthMiddleware];
 
-// In routes
+// In routes — pass the array directly
 layout(<ShopLayout />, () => [
-  middleware(...shopMiddleware),
+  middleware(shopMiddleware),
 
   path("/shop", ShopIndex, { name: "shop" }),
 ])
 ```
 
+## Wrapping Middleware (Scoped to Children)
+
+Use the wrapping form to scope middleware to a subset of routes without
+introducing a visible layout:
+
+```typescript
+urls(({ path, middleware }) => [
+  // authMw only applies to /admin and /admin/settings
+  middleware(authMw, () => [
+    path("/admin", AdminPage, { name: "admin" }),
+    path("/admin/settings", SettingsPage, { name: "settings" }),
+  ]),
+
+  // Public route — no authMw
+  path("/", HomePage, { name: "home" }),
+]);
+```
+
+Multiple middleware with wrapping:
+
+```typescript
+middleware([authMw, loggingMw], () => [
+  path("/admin", AdminPage, { name: "admin" }),
+]);
+```
+
+This creates a transparent layout (`<Outlet />`) that carries the middleware.
+The middleware does not affect sibling routes outside the callback.
+
 ## Middleware Context
 
 ```typescript