@rsc-kit/core 0.16.2 → 0.17.0

package/dist/vite.js

@@ -12,17 +12,23 @@
 // carry the route composition and the worker's render contract, and supplies
 // the structural config (entries, output dirs, base). @vitejs/plugin-rsc is
 // included here so it always runs before any react() layer the app adds.
-import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync, createReadStream, } from "node:fs";
 import { gzipSync } from "node:zlib";
 import { createHash } from "node:crypto";
 import { createRequire } from "node:module";
-import { dirname, join, relative, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import rsc, { getPluginApi } from "@vitejs/plugin-rsc";
 import { loadEnv } from "vite";
 import { REPORT_FILE, buildReport } from "./buildReport.js";
 import { MANIFEST_PATH, manifestWarning, webManifest } from "./webManifest.js";
-import { ASSET_BASE, appAssets, headTags } from "./appAssets.js";
+import { ASSET_BASE, allAppAssets, appAssets, headTags, typeOf, } from "./appAssets.js";
+import { reactCacheImports } from "./reactCache.js";
+import { clientEntries, clientScanPlugin, engineClientEntries, } from "./clientEntries.js";
+import { serverImportsOfClientPackages } from "./clientImports.js";
+import { METADATA_ROUTES, ROOT_FILES, rootFileType } from "./metadataRoutes.js";
+import { serverRendererMessage, SERVER_RENDERER, ssrProxyModule, UseSsrError, } from "./useSsr.js";
 import { httpHostCalls } from "./hostCalls.js";
 // Resolved once per rscKit() call. One build runs in one process, so these are
 // module state rather than threaded through every helper.
@@ -30,8 +36,13 @@ let projectRoot;
 let sourceDir;
 let inlineStylesheets = "auto";
 let resolvedConfig = null;
+/** Server files importing a client library, read off the rsc graph when it is built. */
+let clientLibraryImports = [];
 /** Modules a runtime provides and no bundle should try to carry. */
 const RUNTIME_BUILTINS = ["bun", /^bun:/];
+function arrayOf(value) {
+    return value == null ? [] : Array.isArray(value) ? value : [value];
+}
 /**
  * What a client chunk is called on disk.
  *
@@ -93,10 +104,9 @@ let routeConfig;
 let prerenderAfterBuild;
 /** True during `vite build --watch`, where re-rendering every route is noise. */
 let isWatch = false;
-/** Whether navigations are wrapped in React's ViewTransition — see options. */
-let viewTransitions = false;
 /** Whether a service worker is generated and registered — see options. */
 let offline = false;
+let typecheck = true;
 let webManifestOptions = null;
 let foundAssets = {
     favicon: null,
@@ -258,8 +268,8 @@ function resolvePaths(options) {
     // sets it, and so does a host that drives the build out of process and
     // prerenders itself afterwards with paths only it knows.
     prerenderAfterBuild = process.env.RSC_PRERENDER !== "0";
-    viewTransitions = options.viewTransitions === true;
     offline = options.offline === true;
+    typecheck = options.typecheck !== false;
     inlineStylesheets = options.inlineStylesheets ?? "auto";
     maxActionBody = options.maxActionBody;
     // One place, and it is the file. A plugin option as well would be the same
@@ -474,11 +484,13 @@ function routeManifest() {
         build: { output, exportPath, payloadName: staticPayloads },
         routes,
         intercepts,
-        apis: [...apiRoutes.values()].map(({ name, methods }) => ({
+        apis: [...apiRoutes.values()].map(({ name, methods, generated }) => ({
             name,
             segments: urlSegments(name),
             methods,
-            middleware: ancestors(name, "middleware"),
+            // A synthesised robots.txt or sitemap.xml runs no guard: it exists to be
+            // read by anyone, and a guard on the root would 401 the crawler.
+            middleware: generated ? [] : ancestors(name, "middleware"),
         })),
     };
 }
@@ -956,13 +968,10 @@ export function declaredManifest(appDir) {
 function copyAppAssets(clientDir) {
     if (!existsSync(clientDir))
         return;
-    const all = [
-        ...(foundAssets.favicon ? [foundAssets.favicon] : []),
-        ...foundAssets.icons,
-        ...(foundAssets.appleIcon ? [foundAssets.appleIcon] : []),
-        ...(foundAssets.openGraph ? [foundAssets.openGraph] : []),
-        ...(foundAssets.twitter ? [foundAssets.twitter] : []),
-    ];
+    for (const file of rootFiles) {
+        copyFileSync(join(sourceDir, "app", file), join(clientDir, file));
+    }
+    const all = allAppAssets(foundAssets);
     if (all.length === 0)
         return;
     for (const asset of all) {
@@ -1264,6 +1273,30 @@ async function prerenderAfterBundles(bundle, staticDir, assetsDir, knownActions
         console.log("     Nothing checks who calls them. Fine for a public one; otherwise build it\n" +
             "     from an action client, so the check cannot be forgotten.");
     }
+    // Server files importing cache from React. Its cache() memoises on the
+    // dispatcher a render installs, so in a guard, an action, an api route or
+    // the SSR pass it calls straight through - no dedupe, no error, the helper
+    // runs twice. The difference is silent, which is why this line exists.
+    const reactCache = reactCacheImports(sourceDir);
+    if (reactCache.length > 0) {
+        console.log(`\n  \u26a0  ${reactCache.length} server ${reactCache.length === 1 ? "file imports" : "files import"} cache from 'react': ` +
+            reactCache.join(", "));
+        console.log("     React's cache() dedupes only inside a component render; in a guard, an action or\n" +
+            "     an api route it calls straight through. Import it from @rsc-kit/core/cache instead.");
+    }
+    // Server files importing a client library. Legal - a server component may
+    // render a client component from a package - but the shape that costs an
+    // afternoon is a file with no "use client" that only wraps them, so the
+    // library's internals run on the server. Said, with the packages and the
+    // importer, so the person reading can tell which it is.
+    if (clientLibraryImports.length > 0) {
+        console.log(`\n  \u2139  ${clientLibraryImports.length} server ${clientLibraryImports.length === 1 ? "file imports" : "files import"} a client library: ` +
+            clientLibraryImports
+                .map((c) => `${c.file} (${c.packages.join(", ")}${c.from ? `; imported by ${c.from}` : ""})`)
+                .join("; "));
+        console.log('     Legal for a server component. A file that only wraps client components wants "use client" -\n' +
+            "     as shadcn ships it - so the server stops at the boundary.");
+    }
     // Written from the rows that were just printed rather than recomputed: the
     // report and the terminal must not be able to disagree about what happened.
     writeFileSync(join(outDir, REPORT_FILE), buildReport(results.map((r) => ({
@@ -1280,7 +1313,7 @@ async function prerenderAfterBundles(bundle, staticDir, assetsDir, knownActions
         type: a.type,
         reason: a.reason,
         warning: a.warning ?? null,
-    })), audited));
+    })), audited, reactCache, clientLibraryImports));
     const note = notes(results);
     const counted = [...results, ...apis];
     console.log(`
@@ -1577,6 +1610,76 @@ const components = new Map();
  * a default component.
  */
 const apiRoutes = new Map();
+/** Files beside the root layout served at the root as they are: robots.txt, a hand-written sitemap.xml, humans.txt. */
+let rootFiles = [];
+const METADATA_ROUTE_ID = "virtual:rsc-kit/metadata-route/";
+/**
+ * robots.ts, sitemap.ts, llms.ts beside the root layout, each registered as
+ * an api route at the file it stands for. The module the entry imports is
+ * synthesised (metadataRoutesPlugin): the app's default export, formatted by
+ * the engine, with the root layout's metadataBase for relative urls.
+ *
+ * Api routes, so nothing else is new: the build stores the ones that read
+ * nothing per request and names the ones that do. Without middleware, on
+ * purpose - these exist to be read by anyone, and a guard on the root would
+ * otherwise 401 the crawler asking for robots.txt.
+ */
+function registerMetadataRoutes(appDir) {
+    rootFiles = existsSync(appDir)
+        ? readdirSync(appDir)
+            .filter((name) => ROOT_FILES.test(name))
+            .sort()
+        : [];
+    for (const kind of Object.keys(METADATA_ROUTES)) {
+        const source = ["ts", "tsx", "js", "mjs"]
+            .map((ext) => join(appDir, `${kind}.${ext}`))
+            .find((file) => existsSync(file));
+        if (!source)
+            continue;
+        const { file } = METADATA_ROUTES[kind];
+        if (rootFiles.includes(file)) {
+            throw new Error(`[rsc-kit] app/${basename(source)} and app/${file} both answer /${file}. Keep one: the function, or the file as written.`);
+        }
+        const name = `app/${file}/route`;
+        if (apiRoutes.has(name)) {
+            throw new Error(`[rsc-kit] app/${basename(source)} and app/${file}/route.ts both answer /${file}. Keep one.`);
+        }
+        apiRoutes.set(name, {
+            name,
+            absPath: METADATA_ROUTE_ID + kind,
+            methods: ["GET"],
+            generated: { kind, file: source },
+        });
+    }
+}
+/** The module behind a synthesised metadata route. */
+function metadataRoutesPlugin() {
+    return {
+        name: "rsc-kit:metadata-routes",
+        resolveId(id) {
+            if (id.startsWith(METADATA_ROUTE_ID))
+                return "\0" + id;
+        },
+        load(id) {
+            if (!id.startsWith("\0" + METADATA_ROUTE_ID))
+                return;
+            const kind = id.slice(("\0" + METADATA_ROUTE_ID).length);
+            const route = [...apiRoutes.values()].find((r) => r.generated?.kind === kind);
+            if (!route?.generated)
+                return;
+            const rootLayout = components.get("app/layout")?.absPath ?? null;
+            return [
+                `import produce from ${JSON.stringify(route.generated.file)}`,
+                rootLayout
+                    ? `import * as __root from ${JSON.stringify(rootLayout)}`
+                    : "const __root = {}",
+                `import { metadataResponse } from ${JSON.stringify(join(packageDir, "metadataRoutes"))}`,
+                `export const GET = () => metadataResponse(${JSON.stringify(kind)}, produce, __root.metadata?.metadataBase ?? null)`,
+                "",
+            ].join("\n");
+        },
+    };
+}
 function register(absPath) {
     const name = componentName(absPath);
     const existing = components.get(name);
@@ -1913,6 +2016,9 @@ import { prerenderedBeside } from ${JSON.stringify(join(packageDir, "files"))}
 import { renderToReadableStream, decodeReply, loadServerAction } from '@vitejs/plugin-rsc/rsc'
 import { isQuery, queryCacheControl, isQueryValidationError } from ${JSON.stringify(join(packageDir, "query"))}
 import { isActionValidationError, isClientBuilt } from ${JSON.stringify(join(packageDir, "action"))}
+import { noteFallback as noteCaughtRead } from ${JSON.stringify(join(packageDir, "request"))}
+import { isOutdatedOptimizedDep, outdatedDepResponse } from ${JSON.stringify(join(packageDir, "devReload"))}
+import { sharedDepth } from ${JSON.stringify(join(packageDir, "routing"))}
 import { Suspense, createElement, Fragment } from 'react'
 import { AsyncLocalStorage } from 'node:async_hooks'
 ${imports.join("\n")}
@@ -2555,6 +2661,38 @@ async function renderTree(
     }
     if (md.description != null) head.push(createElement('meta', { key: '__d', name: 'description', content: String(md.description) }))
 
+    // robots is a string, or the object Next takes: index and follow as
+    // their no- forms, the flags by name, the limits as name:value. googleBot
+    // is the same shape for the googlebot tag. The object used to fall
+    // through to the catch-all below as "[object Object]" - which no crawler
+    // reads, on the one page that asked not to be indexed.
+    const robotsContent = (value: unknown): string => {
+      if (typeof value !== 'object' || value === null) return String(value)
+
+      const r = value as Record<string, unknown>
+      const parts: string[] = []
+
+      if (r.index != null) parts.push(r.index ? 'index' : 'noindex')
+      if (r.follow != null) parts.push(r.follow ? 'follow' : 'nofollow')
+      for (const flag of ['noarchive', 'nosnippet', 'noimageindex', 'nocache', 'notranslate', 'indexifembedded', 'nositelinkssearchbox']) {
+        if (r[flag]) parts.push(flag)
+      }
+      if (r.unavailable_after != null) parts.push('unavailable_after: ' + String(r.unavailable_after))
+      for (const limit of ['max-video-preview', 'max-image-preview', 'max-snippet']) {
+        if (r[limit] != null) parts.push(limit + ':' + String(r[limit]))
+      }
+
+      return parts.join(', ')
+    }
+
+    if (md.robots != null) {
+      head.push(createElement('meta', { key: '__r', name: 'robots', content: robotsContent(md.robots) }))
+
+      const bot = typeof md.robots === 'object' ? (md.robots as { googleBot?: unknown }).googleBot : null
+
+      if (bot != null) head.push(createElement('meta', { key: '__rg', name: 'googlebot', content: robotsContent(bot) }))
+    }
+
     // og: and its relatives are PROPERTY, not name. Facebook's scraper - and
     // Slack's, and LinkedIn's - reads only property=, so every og tag this
     // used to emit with name= was invisible to the thing it existed for.
@@ -2659,7 +2797,7 @@ async function renderTree(
     // meta tags rather than a meta tag by that name. A key at the top level
     // still renders - the type no longer invites one, but an app written
     // against the old shape must not silently lose its tags.
-    const structured = new Set(['title', 'description', 'metadataBase', 'openGraph', 'twitter', 'icons', 'other'])
+    const structured = new Set(['title', 'description', 'robots', 'metadataBase', 'openGraph', 'twitter', 'icons', 'other'])
     const named = Object.entries(md).filter(([k]) => !structured.has(k))
     const extra = Object.entries((md.other ?? {}) as Record<string, unknown>)
 
@@ -3512,12 +3650,22 @@ export async function handleRscPprShell(
   // page, stored, with the build reporting success.
   let renderFailure: string | undefined
 
-  const noteFailure = (e: unknown): string | undefined => {
+  const noteFailure = (e: unknown, info?: { componentStack?: string }): string | undefined => {
     const digest = redirectDigest(e)
 
     // A redirect is a classification here, not a failure.
     if (digest) return digest
 
+    // A read the server could not answer, caught at a boundary: the fallback
+    // there is what gets stored. Noted with its component so the build can
+    // say so on the route's line; the digest goes into the document for the
+    // browser to recognise.
+    if ((e as { digest?: string } | null)?.digest === 'rsc-kit:search-params-fallback') {
+      const where = /at ([A-Z][\\w$]*)/.exec(info?.componentStack ?? '')?.[1]
+      noteCaughtRead('useSearchParams()' + (where ? ' in ' + where : ''))
+      return 'rsc-kit:search-params-fallback'
+    }
+
     // Every probe ends by aborting, so React reports that abort. Asked of the
     // signal rather than matched against the message: a string test would be a
     // guess about wording, and would quietly stop working when React changed it.
@@ -3630,6 +3778,18 @@ ${fallbackOrigin ? FALLBACK_CONSTS.replace("__ORIGIN__", JSON.stringify(fallback
 let devHandler: ((request: Request) => Promise<Response | null>) | null = null
 
 export default async function handler(request: Request): Promise<Response> {
+  try {
+    return await serve(request)
+  } catch (error) {
+    // Vite re-optimised a server pre-bundle under this render. The condition
+    // is over already; the page is asked to load again.
+    if (import.meta.env.DEV && isOutdatedOptimizedDep(error)) return outdatedDepResponse(request)
+
+    throw error
+  }
+}
+
+async function serve(request: Request): Promise<Response> {
   installHostCallsOnce()
 
   devHandler ??= createRscHandler({
@@ -3653,7 +3813,7 @@ export default async function handler(request: Request): Promise<Response> {
 ${NITRO_HANDLER_OPTIONS}${NITRO_PRERENDERED}    maxActionBody: ${maxActionBody === undefined ? "undefined" : String(maxActionBody)},
   })
 
-${fallbackOrigin ? FALLBACK_BODY : "  return (await devHandler(request)) ?? (await notFound())\n"}}
+${fallbackOrigin ? FALLBACK_BODY : "  return (await devHandler(request)) ?? (await notFound(request))\n"}}
 
 /**
  * The page for a url nothing answers.
@@ -3664,9 +3824,42 @@ ${fallbackOrigin ? FALLBACK_BODY : "  return (await devHandler(request)) ?? (awa
  *
  * Without a not-found.tsx this is the string it always was.
  */
-async function notFound(): Promise<Response> {
+async function notFound(request: Request): Promise<Response> {
   ${notFoundComponent
         ? `
+  // A navigation, not a document: answer with the not-found tree as a
+  // payload, at the depth the client already holds, so the router renders
+  // it in place - the layout stays, the url changes, nothing reloads. The
+  // status is still 404; a payload is a payload whatever it says.
+  if (request.headers.get('X-RSC')) {
+    try {
+      const chain = ${JSON.stringify(notFoundLayouts)}
+      const from = sharedDepth(request.headers.get('X-RSC-Segments'), chain)
+      const { rscPayload } = await handleRscPayload(
+        ${JSON.stringify(notFoundComponent)},
+        {},
+        ${JSON.stringify(notFoundLayouts.map((component) => ({ component, props: {} })))},
+        [],
+        {},
+        from,
+        '/404',
+      )
+
+      return new Response(rscPayload, {
+        status: 404,
+        headers: {
+          'Content-Type': 'text/x-component; charset=utf-8',
+          'X-RSC-Segment-Depth': String(from),
+          'X-RSC-Layouts': chain.join(','),
+          'Cache-Control': 'no-store',
+          Vary: 'X-RSC',
+        },
+      })
+    } catch {
+      // Fall through to the document answer below.
+    }
+  }
+
   try {
     const { htmlStream } = await handleRscHtmlStream(
       ${JSON.stringify(notFoundComponent)},
@@ -3695,11 +3888,15 @@ async function notFound(): Promise<Response> {
 }
 function generateEntrySsr() {
     const devUrls = join(packageDir, "devUrls");
+    const request = join(packageDir, "request");
+    const fallbackReport = join(packageDir, "js/fallbackReport");
     return `// GENERATED by rscKit() — do not edit.
 import { createFromReadableStream } from '@vitejs/plugin-rsc/ssr'
 import { renderToReadableStream, resume } from 'react-dom/server.edge'
 import { prerender } from 'react-dom/static.edge'
 import { rewriteViteDevUrlStream } from ${JSON.stringify(devUrls)}
+import { noteFallback } from ${JSON.stringify(request)}
+import { cancelledByConsumer, caughtByLoading } from ${JSON.stringify(fallbackReport)}
 
 // Set only by the dev server. @vitejs/plugin-rsc emits its bootstrap and CSS
 // links root-relative in dev, which would send the browser to the host for
@@ -3727,7 +3924,35 @@ export async function handleSsr(
   const html = await renderToReadableStream(root as any, {
     bootstrapScriptContent,
     nonce,
-    onError: onError ?? ((error: unknown) => { console.error('[rsc-kit:ssr]', error) }),
+    // The query-string fallback is the designed path for a stored page, and
+    // its digest is what lets the client tell it from a fault on hydration;
+    // returned here so React writes it into the document.
+    onError: onError ?? ((error: unknown, info?: { componentStack?: string }) => {
+      // The consumer cancelled - a browser that left mid-stream, a prefetch
+      // abandoned. React reports it as an error; the page had none.
+      if (cancelledByConsumer(error)) return
+      const digest = (error as { digest?: string } | null)?.digest
+      if (digest === 'rsc-kit:search-params-fallback') {
+        // The component is the first frame of React's stack. Noted on the
+        // request so the build attaches it to the route; printed as one line,
+        // not a stack, so the dev server says which boundary the build wants.
+        const where = /at ([A-Z][\\w$]*)/.exec(info?.componentStack ?? '')?.[1]
+        noteFallback('useSearchParams()' + (where ? ' in ' + where : ''))
+        // Under a boundary the developer wrote, nothing to say. With nothing
+        // closer than a loading.tsx, one line: the whole segment is the
+        // fallback until the query arrives.
+        if (caughtByLoading(info?.componentStack)) {
+          console.error(
+            '[rsc-kit] ' + (where ? where + ': ' : '') +
+            'useSearchParams() was read on the server with nothing closer than a loading.tsx, so the whole ' +
+            'segment shows that fallback until the query arrives. A <Suspense> around the component that reads ' +
+            'keeps the rest of the page painted.',
+          )
+        }
+        return digest
+      }
+      console.error('[rsc-kit:ssr]', error)
+    }),
   })
 
   return DEV_ORIGIN ? rewriteViteDevUrlStream(html, DEV_ORIGIN) : html
@@ -3763,8 +3988,14 @@ export async function handleSsrPrerender(
     bootstrapScriptContent,
     nonce: options.nonce,
     signal: options.signal,
-    // Aborting is how this ends, so React's report of it is not news.
-    onError: () => {},
+    // Aborting is how this ends, so React's report of it is not news. A read
+    // caught at a boundary is: the build attaches it to the route.
+    onError: (error: unknown, info?: { componentStack?: string }) => {
+      if ((error as { digest?: string } | null)?.digest !== 'rsc-kit:search-params-fallback') return
+      const where = /at ([A-Z][\\w$]*)/.exec(info?.componentStack ?? '')?.[1]
+      noteFallback('useSearchParams()' + (where ? ' in ' + where : ''))
+      return 'rsc-kit:search-params-fallback'
+    },
   })
 
   return {
@@ -4056,6 +4287,197 @@ function extendableClientReferences() {
         },
     };
 }
+/**
+ * The worker the dev server serves at /sw.js: it removes the one a production
+ * run left on this origin, and the caches with it, then reloads each page it
+ * was controlling so they load uncontrolled. Nothing else runs in development.
+ */
+export const DEV_WORKER = `self.addEventListener('install', () => self.skipWaiting())
+self.addEventListener('activate', (event) => {
+  event.waitUntil((async () => {
+    const keys = await caches.keys()
+    await Promise.all(keys.filter((k) => k.startsWith('rsc-kit-')).map((k) => caches.delete(k)))
+    await self.clients.claim()
+    const pages = await self.clients.matchAll({ type: 'window' })
+    await self.registration.unregister()
+    for (const page of pages) page.navigate(page.url).catch(() => {})
+  })())
+})
+`;
+/**
+ * "use ssr" modules, rewritten for the server-components environment into
+ * proxies that call the real module in the ssr environment. See useSsr.ts.
+ *
+ * Before every other transform, so the cross-environment import this emits
+ * is still ahead of plugin-rsc's handling of it - and so the module's own
+ * imports, react-dom/server among them, are never resolved here at all.
+ */
+function useSsrModules() {
+    return {
+        name: "rsc-kit:use-ssr",
+        enforce: "pre",
+        applyToEnvironment: (environment) => environment.name === "rsc",
+        transform(code, id) {
+            if (!code.includes("use ssr"))
+                return;
+            try {
+                const proxy = ssrProxyModule(code, id);
+                return proxy === null ? undefined : { code: proxy, map: null };
+            }
+            catch (error) {
+                if (error instanceof UseSsrError)
+                    this.error(error.message);
+                throw error;
+            }
+        },
+    };
+}
+/**
+ * react-dom/server, imported where server components render, becomes a
+ * module that throws the fix instead of React's refusal - naming the app
+ * file that imported it (through @react-email/render, say) and the
+ * directive that moves it. The build says the same once, as a warning.
+ */
+const RENDERER_STUB = "\0rsc-kit:react-dom-server?from=";
+function serverRendererInRsc() {
+    const warned = new Set();
+    const appImporter = (ctx, importer) => {
+        let current = importer;
+        for (let hop = 0; current && hop < 12; hop++) {
+            if (!current.includes("/node_modules/"))
+                return relative(process.cwd(), current.split("?")[0]);
+            const next = ctx.environment.mode === "build"
+                ? ctx.getModuleInfo(current)?.importers[0]
+                : (ctx.environment.moduleGraph
+                    ?.getModuleById(current)
+                    ?.importers.values()
+                    .next().value?.id ?? undefined);
+            if (!next)
+                break;
+            current = next;
+        }
+        return importer ? relative(process.cwd(), importer.split("?")[0]) : null;
+    };
+    return {
+        name: "rsc-kit:server-renderer",
+        applyToEnvironment: (environment) => environment.name === "rsc",
+        resolveId(source, importer) {
+            if (!SERVER_RENDERER.test(source))
+                return;
+            return RENDERER_STUB + encodeURIComponent(importer ?? "");
+        },
+        load(id) {
+            if (!id.startsWith(RENDERER_STUB))
+                return;
+            const importer = decodeURIComponent(id.slice(RENDERER_STUB.length)) || null;
+            const message = serverRendererMessage(appImporter(this, importer));
+            if (this.environment.mode === "build" && !warned.has(message)) {
+                warned.add(message);
+                this.warn(message);
+            }
+            return `throw new Error(${JSON.stringify(message)});\n`;
+        },
+    };
+}
+/**
+ * `tsc --noEmit` on the project's own tsconfig, the way `check` runs it.
+ *
+ * Through package.json rather than a subpath: TypeScript's exports map does
+ * not expose bin/tsc, and the bin field is where the name lives. Its output
+ * is the message, because that is what the developer would have read.
+ */
+export function typecheckProject(root) {
+    const tsconfig = join(root, "tsconfig.json");
+    if (!existsSync(tsconfig))
+        return { ran: false, because: "no tsconfig" };
+    let tsc;
+    try {
+        const fromApp = createRequire(join(root, "package.json"));
+        const manifest = fromApp.resolve("typescript/package.json");
+        const bin = fromApp(manifest)
+            .bin;
+        const relative = typeof bin === "string" ? bin : bin?.tsc;
+        if (!relative)
+            return { ran: false, because: "no typescript" };
+        tsc = join(dirname(manifest), relative);
+    }
+    catch {
+        return { ran: false, because: "no typescript" };
+    }
+    const started = Date.now();
+    const script = /\.[cm]?js$/.test(tsc) || !/\.\w+$/.test(tsc);
+    const result = spawnSync(script ? process.execPath : tsc, 
+    // Plain lines, not coloured ones: they go into a build error, and the
+    // test that reads them is a reader too.
+    [...(script ? [tsc] : []), "--noEmit", "--pretty", "false", "-p", tsconfig], { cwd: root, encoding: "utf-8", maxBuffer: 64 * 1024 * 1024 });
+    if (result.status === 0)
+        return { ran: true, ok: true, seconds: (Date.now() - started) / 1000 };
+    return {
+        ran: true,
+        ok: false,
+        output: `${result.stdout ?? ""}${result.stderr ?? ""}`.trim(),
+    };
+}
+/**
+ * The project's typecheck, as part of the build.
+ *
+ * Runs once, in the first environment to start, after the route types have
+ * been written by the config hook - so a link to a route that does not exist
+ * is an error here and not a 404 found after deploying. Skipped where the
+ * project is not doing this checking at all: no tsconfig.json, or no
+ * typescript to run.
+ */
+function typecheckPlugin() {
+    let ran = false;
+    return {
+        name: "rsc-kit:typecheck",
+        apply: "build",
+        buildStart() {
+            if (ran || !typecheck || isWatch)
+                return;
+            ran = true;
+            const outcome = typecheckProject(projectRoot);
+            if (!outcome.ran)
+                return;
+            if (outcome.ok) {
+                log(`typecheck: ok (${outcome.seconds.toFixed(1)}s)`);
+                return;
+            }
+            throw new Error("[rsc-kit] The typecheck failed, so the build stops here.\n\n" +
+                outcome.output +
+                "\n\nrscKit({ typecheck: false }) builds without it.");
+        },
+    };
+}
+/**
+ * Which server files import a client library, read off the rsc environment's
+ * module graph once it is built. plugin-rsc classifies the client packages
+ * (every package with react among its peers) and excludes them from the
+ * server optimizers; that list is the one used here, minus this package -
+ * a server component importing Link is the norm - and plugin-rsc's own.
+ */
+function clientImportsAudit() {
+    return {
+        name: "rsc-kit:client-imports",
+        apply: "build",
+        applyToEnvironment: (environment) => environment.name === "rsc",
+        buildEnd() {
+            const excluded = resolvedConfig?.environments?.rsc?.optimizeDeps?.exclude ?? [];
+            const clientPackages = excluded.filter((name) => !name.startsWith("@vitejs/plugin-rsc"));
+            if (clientPackages.length === 0)
+                return;
+            clientLibraryImports = serverImportsOfClientPackages({
+                moduleIds: () => this.getModuleIds(),
+                importedIds: (id) => this.getModuleInfo(id)?.importedIds ?? [],
+                importers: (id) => this.getModuleInfo(id)?.importers ?? [],
+            }, {
+                sourceDir,
+                clientPackages,
+                ignore: [PACKAGE_NAME, "server-only", "client-only"],
+            });
+        },
+    };
+}
 export function rscKit(options = {}) {
     resolvePaths(options);
     const routesPlugin = {
@@ -4064,8 +4486,13 @@ export function rscKit(options = {}) {
             if (!existsSync(appDir)) {
                 throw new Error(`[rsc-kit] No app directory at ${appDir} — nothing to build.`);
             }
+            // Both maps, not one: the config hook runs again when the config
+            // changes under a dev server, and a route.ts or a synthesised
+            // robots.txt left over from the previous run read as a duplicate.
             components.clear();
+            apiRoutes.clear();
             discover(appDir);
+            registerMetadataRoutes(appDir);
             // Silent when it worked. The names were printed on every dev start and
             // every build — thirty of them for a middling app, above the output that
             // actually says something, and the build's classification table lists
@@ -4154,9 +4581,6 @@ export function rscKit(options = {}) {
                  */
                 define: {
                     "process.env.NODE_ENV": JSON.stringify(env.mode === "development" ? "development" : "production"),
-                    // A constant, so the boundary and its import fall out of the bundle
-                    // entirely when this is off rather than shipping a branch nobody takes.
-                    __RSC_VIEW_TRANSITIONS__: JSON.stringify(viewTransitions),
                     __RSC_OFFLINE__: JSON.stringify(offline),
                 },
                 /*
@@ -4181,6 +4605,36 @@ export function rscKit(options = {}) {
                  */
                 optimizeDeps: {
                     exclude: [PACKAGE_NAME, ...(_config.optimizeDeps?.exclude ?? [])],
+                    // Every "use client" file, so the browser's dependencies are all
+                    // found at startup. The client entry reaches only the engine and
+                    // React; the app's client components arrive through payloads, page
+                    // by page, and a dependency first seen on the third page visited
+                    // re-optimised every pre-bundle under a running page - two Reacts,
+                    // a blank document, then Vite's own reload. See clientEntries.
+                    // Naming entries replaces the input, so the browser entry is named
+                    // too, or the engine and React would be the ones left out.
+                    entries: [
+                        ...(Array.isArray(_config.optimizeDeps?.entries)
+                            ? _config.optimizeDeps.entries
+                            : _config.optimizeDeps?.entries
+                                ? [_config.optimizeDeps.entries]
+                                : []),
+                        // Entries are globs: a route group's parentheses, or a bracket
+                        // in a dynamic segment, would otherwise read as pattern syntax
+                        // and match nothing - and the scanner would crawl nothing, quietly.
+                        ...[
+                            join(genDir, "entry.browser.tsx"),
+                            ...engineClientEntries(),
+                            ...clientEntries(sourceDir),
+                        ].map((file) => file.replace(/[()[\]{}*?!+@]/g, "\\$&")),
+                    ],
+                    rolldownOptions: {
+                        ...(_config.optimizeDeps?.rolldownOptions ?? {}),
+                        plugins: [
+                            clientScanPlugin(),
+                            ...arrayOf(_config.optimizeDeps?.rolldownOptions?.plugins),
+                        ],
+                    },
                 },
                 // Public URL for browser-facing client assets, and a BUILD concern
                 // only: it says where the built files will be served from.
@@ -4266,6 +4720,47 @@ export function rscKit(options = {}) {
          * nothing.
          */
         configureServer(server) {
+            // The icons and share images live in app/, which nothing serves; the
+            // build copies them beside the client output. There is no output while
+            // developing, so the same hrefs the head tags carry are answered from
+            // app/ here - and the web manifest with them - or the tab has no icon
+            // and the console a 404 for a file that is right there.
+            server.middlewares.use((req, res, next) => {
+                const url = (req.url ?? "").split("?")[0];
+                // A worker registered by a production run on this origin - `bun run
+                // start` on the port the dev server uses next - outlives that run and
+                // answers the dev server's documents from its cache: a stored page is
+                // cache-first, so a refresh brings back yesterday's document with
+                // yesterday's module hashes, and a 504 for each. The browser fetches
+                // /sw.js again on every navigation to look for an update; in
+                // development that fetch gets a worker whose only job is to remove
+                // itself, its caches, and reload the pages it controlled.
+                // robots.txt, a hand-written sitemap.xml, humans.txt: beside the root
+                // layout, served at the root. The build copies them beside the client
+                // output; here they are read from app/.
+                if (url.startsWith("/") && rootFiles.includes(url.slice(1))) {
+                    res.setHeader("Content-Type", rootFileType(url.slice(1)));
+                    res.end(readFileSync(join(sourceDir, "app", url.slice(1))));
+                    return;
+                }
+                if (url === "/sw.js") {
+                    res.setHeader("Content-Type", "text/javascript");
+                    res.setHeader("Cache-Control", "no-store");
+                    res.end(DEV_WORKER);
+                    return;
+                }
+                if (webManifestOptions && url === MANIFEST_PATH) {
+                    res.setHeader("Content-Type", "application/manifest+json");
+                    res.end(webManifest(webManifestOptions));
+                    return;
+                }
+                const asset = allAppAssets(foundAssets).find((a) => a.href === url);
+                const file = asset ? join(sourceDir, "app", asset.file) : null;
+                if (!asset || !file || !existsSync(file))
+                    return next();
+                res.setHeader("Content-Type", typeOf(asset.file));
+                createReadStream(file).pipe(res);
+            });
             // rpc() has to reach the backend while the dev server is serving.
             //
             // A built deployment installs this itself: the server running
@@ -4481,7 +4976,12 @@ export function rscKit(options = {}) {
             clientChunks: (meta) => meta.normalizedId,
             ...actionEncryptionKey(),
         }),
+        useSsrModules(),
+        serverRendererInRsc(),
+        metadataRoutesPlugin(),
         extendableClientReferences(),
+        typecheckPlugin(),
+        clientImportsAudit(),
         routesPlugin,
     ];
 }