@rsc-kit/core 0.21.4 → 0.22.1

package/dist/vite.d.ts

@@ -388,6 +388,16 @@ export declare function toAlias(name: string): string;
  * was controlling so they load uncontrolled. Nothing else runs in development.
  */
 export declare const DEV_WORKER = "self.addEventListener('install', () => self.skipWaiting())\nself.addEventListener('activate', (event) => {\n  event.waitUntil((async () => {\n    const keys = await caches.keys()\n    await Promise.all(keys.filter((k) => k.startsWith('rsc-kit-')).map((k) => caches.delete(k)))\n    await self.clients.claim()\n    const pages = await self.clients.matchAll({ type: 'window' })\n    await self.registration.unregister()\n    for (const page of pages) page.navigate(page.url).catch(() => {})\n  })())\n})\n";
+/**
+ * A read of import.meta.env.PUBLIC_*, refused by name.
+ *
+ * PUBLIC_ was a client prefix beside VITE_ until 0.22. Dropped silently, a
+ * read of one would compile to undefined - in the browser, for a pixel id or
+ * an api url, with nothing said anywhere - so the build names each file that
+ * still reads one and the variable to rename, and stops. Server code reading
+ * process.env.PUBLIC_* is untouched: that is an ordinary server variable.
+ */
+export declare function publicPrefixReads(code: string): string[];
 export declare function serverRendererInRsc(): Plugin;
 /**
  * The project's typecheck, as part of the build.
@@ -419,4 +429,36 @@ export type TypecheckOutcome = {
  * is the message, because that is what the developer would have read.
  */
 export declare function typecheckProject(root: string): TypecheckOutcome;
+/**
+ * A Nitro runtime plugin, so a rollout stops a server cleanly.
+ *
+ * On SIGTERM - a rollout, docker stop - srvx stops taking connections and
+ * gives in-flight requests SERVER_SHUTDOWN_TIMEOUT seconds (5) to finish. It
+ * does not exit: the process ends only once nothing holds it open, and an app
+ * with a database pool or a queue client always has something, so it waited
+ * for its SIGKILL and lost the log lines written meanwhile. This waits out the
+ * same window, calls instrumentation.ts's shutdown() if the app has one -
+ * bounded, so a close that hangs cannot hold the pod - and exits.
+ *
+ * Unref'd throughout: an app with nothing open exits the moment srvx has
+ * drained, as it did before. Built servers only - not a Worker, which has no
+ * process to signal, and not the dev server or the build, where Ctrl+C should
+ * stop at once.
+ */
+export declare const SHUTDOWN_PLUGIN = "export default function rscKitShutdown() {\n  if (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') return\n  if (typeof process === 'undefined' || typeof process.once !== 'function') return\n\n  const unref = (timer) => (timer && typeof timer.unref === 'function' ? timer.unref() : timer)\n  let stopping = false\n\n  const stop = () => {\n    if (stopping) return\n    stopping = true\n\n    const drain = (Number(process.env.SERVER_SHUTDOWN_TIMEOUT) || 5) * 1000\n    const limit = (Number(process.env.RSC_SHUTDOWN_TIMEOUT) || 10) * 1000\n\n    unref(setTimeout(() => {\n      const hook = globalThis.__rscKitShutdown\n\n      Promise.race([\n        Promise.resolve().then(() => (typeof hook === 'function' ? hook() : undefined)),\n        new Promise((resolve) => unref(setTimeout(resolve, limit))),\n      ])\n        .catch((error) => console.error('[rsc-kit] instrumentation.ts shutdown() failed:', error))\n        .finally(() => process.exit(0))\n    }, drain + 250))\n  }\n\n  process.once('SIGTERM', stop)\n  process.once('SIGINT', stop)\n}\n";
+/**
+ * The PUBLIC_ variables an app still sets, and where each one is set.
+ *
+ * PUBLIC_ was a client prefix beside VITE_ until 0.22. An app that sets one
+ * expects it in the browser, and most read it through a validated env object
+ * rather than import.meta.env, so no source scan sees the read: in the
+ * browser the value was simply gone, and a required one threw from the
+ * validator on the first page that imported it. The variables themselves are
+ * the signal. Same files, same order and same directories as nodeEnvSetIn;
+ * a name only in the process environment is reported as such.
+ */
+export declare function publicVariablesSet(mode: string, envDir?: string | false, environment?: Record<string, string | undefined>): {
+    name: string;
+    where: string;
+}[];
 export declare function rscKit(options?: RscKitOptions): PluginOption[];

package/dist/vite.js

@@ -2475,13 +2475,14 @@ function instrumentationFile() {
         const file = join(sourceDir, `instrumentation.${ext}`);
         if (!existsSync(file))
             continue;
-        // Both halves are optional: a file of imports is a bootstrap, a file
-        // with register() is a hook. The entry must only name `register` when it
+        // Every part is optional: a file of imports is a bootstrap, a file with
+        // register() or shutdown() has hooks. The entry must only name one when it
         // exists - a namespace import's missing member is a bundler warning on
         // every build (IMPORT_IS_UNDEFINED), which is the app being told off for
         // a file written exactly as documented.
-        const hasRegister = /export\s+(?:async\s+)?(?:function\s+register\b|const\s+register\b|let\s+register\b|\{[^}]*\bregister\b[^}]*\})/.test(readFileSync(file, "utf-8"));
-        return { file, hasRegister };
+        const source = readFileSync(file, "utf-8");
+        const exports = (name) => new RegExp(`export\\s+(?:async\\s+)?(?:function\\s+${name}\\b|const\\s+${name}\\b|let\\s+${name}\\b|\\{[^}]*\\b${name}\\b[^}]*\\})`).test(source);
+        return { file, hasRegister: exports("register"), hasShutdown: exports("shutdown") };
     }
     return null;
 }
@@ -2551,11 +2552,11 @@ ${
     // First, before any page: an import's side effects run in import order,
     // and a package configured here has to be configured before a page module
     // that reads it at evaluation time.
-    instrumentation?.hasRegister
+    instrumentation?.hasRegister || instrumentation?.hasShutdown
         ? `import * as __instrumentation from ${JSON.stringify(instrumentation.file)}`
         : instrumentation
-            ? `import ${JSON.stringify(instrumentation.file)}\nconst __instrumentation: { register?: () => unknown } = {}`
-            : "const __instrumentation: { register?: () => unknown } = {}"}
+            ? `import ${JSON.stringify(instrumentation.file)}\nconst __instrumentation: { register?: () => unknown; shutdown?: () => unknown } = {}`
+            : "const __instrumentation: { register?: () => unknown; shutdown?: () => unknown } = {}"}
 import { SegmentBoundary } from ${JSON.stringify(join(packageDir, "js/SegmentBoundary"))}
 import { LoadingBoundary } from ${JSON.stringify(join(packageDir, "js/LoadingBoundary"))}
 import { DocumentTitle } from ${JSON.stringify(join(packageDir, "js/DocumentTitle"))}
@@ -2998,6 +2999,15 @@ function instrumented(): Promise<void> {
 // start, start now.
 const isolateRuntime = typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers'
 
+// instrumentation.ts's shutdown(), for the server's shutdown plugin
+// (SHUTDOWN_PLUGIN in vite.ts), which calls it once in-flight requests have
+// drained and then exits. Handed over on globalThis rather than through a
+// request: every request reaches this module, and one carrying a header must
+// not be able to close the app's database pool.
+if (!isolateRuntime) {
+  ;(globalThis as { __rscKitShutdown?: () => unknown }).__rscKitShutdown = () => __instrumentation.shutdown?.()
+}
+
 if (__instrumentation.register && !isolateRuntime) {
   instrumented().catch((error) => {
     console.error('[rsc-kit] instrumentation.ts register() failed:', error)
@@ -5510,6 +5520,35 @@ self.addEventListener('activate', (event) => {
   })())
 })
 `;
+/**
+ * A read of import.meta.env.PUBLIC_*, refused by name.
+ *
+ * PUBLIC_ was a client prefix beside VITE_ until 0.22. Dropped silently, a
+ * read of one would compile to undefined - in the browser, for a pixel id or
+ * an api url, with nothing said anywhere - so the build names each file that
+ * still reads one and the variable to rename, and stops. Server code reading
+ * process.env.PUBLIC_* is untouched: that is an ordinary server variable.
+ */
+export function publicPrefixReads(code) {
+    return [...new Set([...code.matchAll(/\bimport\.meta\.env\.(PUBLIC_[A-Za-z0-9_]+)/g)].map((m) => m[1]))];
+}
+function publicPrefixRefused() {
+    return {
+        name: "rsc-kit:public-prefix",
+        enforce: "pre",
+        transform(code, id) {
+            if (id.includes("/node_modules/") || !code.includes("import.meta.env.PUBLIC_"))
+                return;
+            const names = publicPrefixReads(code);
+            if (names.length === 0)
+                return;
+            this.error(`${id.split("?")[0]} reads ${names.map((n) => `import.meta.env.${n}`).join(", ")}. ` +
+                "Only VITE_ variables reach the browser now; rename " +
+                names.map((n) => `${n} to VITE_${n.slice("PUBLIC_".length)}`).join(", ") +
+                " in the code and in your .env files.");
+        },
+    };
+}
 /**
  * Named imports from a barrel package, unrolled on the server environments.
  *
@@ -5853,6 +5892,52 @@ export default function rscKitStartup() {
     })
 }
 `;
+/**
+ * A Nitro runtime plugin, so a rollout stops a server cleanly.
+ *
+ * On SIGTERM - a rollout, docker stop - srvx stops taking connections and
+ * gives in-flight requests SERVER_SHUTDOWN_TIMEOUT seconds (5) to finish. It
+ * does not exit: the process ends only once nothing holds it open, and an app
+ * with a database pool or a queue client always has something, so it waited
+ * for its SIGKILL and lost the log lines written meanwhile. This waits out the
+ * same window, calls instrumentation.ts's shutdown() if the app has one -
+ * bounded, so a close that hangs cannot hold the pod - and exits.
+ *
+ * Unref'd throughout: an app with nothing open exits the moment srvx has
+ * drained, as it did before. Built servers only - not a Worker, which has no
+ * process to signal, and not the dev server or the build, where Ctrl+C should
+ * stop at once.
+ */
+export const SHUTDOWN_PLUGIN = `export default function rscKitShutdown() {
+  if (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') return
+  if (typeof process === 'undefined' || typeof process.once !== 'function') return
+
+  const unref = (timer) => (timer && typeof timer.unref === 'function' ? timer.unref() : timer)
+  let stopping = false
+
+  const stop = () => {
+    if (stopping) return
+    stopping = true
+
+    const drain = (Number(process.env.SERVER_SHUTDOWN_TIMEOUT) || 5) * 1000
+    const limit = (Number(process.env.RSC_SHUTDOWN_TIMEOUT) || 10) * 1000
+
+    unref(setTimeout(() => {
+      const hook = globalThis.__rscKitShutdown
+
+      Promise.race([
+        Promise.resolve().then(() => (typeof hook === 'function' ? hook() : undefined)),
+        new Promise((resolve) => unref(setTimeout(resolve, limit))),
+      ])
+        .catch((error) => console.error('[rsc-kit] instrumentation.ts shutdown() failed:', error))
+        .finally(() => process.exit(0))
+    }, drain + 250))
+  }
+
+  process.once('SIGTERM', stop)
+  process.once('SIGINT', stop)
+}
+`;
 /**
  * Where NODE_ENV=development came from, and what to do about it.
  *
@@ -5881,6 +5966,45 @@ function nodeEnvSetIn(mode, envDir) {
         }
     return culprit;
 }
+/**
+ * The PUBLIC_ variables an app still sets, and where each one is set.
+ *
+ * PUBLIC_ was a client prefix beside VITE_ until 0.22. An app that sets one
+ * expects it in the browser, and most read it through a validated env object
+ * rather than import.meta.env, so no source scan sees the read: in the
+ * browser the value was simply gone, and a required one threw from the
+ * validator on the first page that imported it. The variables themselves are
+ * the signal. Same files, same order and same directories as nodeEnvSetIn;
+ * a name only in the process environment is reported as such.
+ */
+export function publicVariablesSet(mode, envDir, environment = process.env) {
+    const files = [".env", ".env.local", `.env.${mode}`, `.env.${mode}.local`];
+    const found = new Map();
+    const dirs = [...new Set([projectRoot, envDir || projectRoot])].filter((dir) => !!dir);
+    for (const dir of dirs)
+        for (const file of files) {
+            const path = join(dir, file);
+            if (!existsSync(path))
+                continue;
+            readFileSync(path, "utf-8").split("\n").forEach((line, at) => {
+                const name = /^\s*(?:export\s+)?(PUBLIC_[A-Za-z0-9_]+)\s*=/.exec(line)?.[1];
+                if (name)
+                    found.set(name, `${path}:${at + 1}`);
+            });
+        }
+    for (const name of Object.keys(environment)) {
+        if (name.startsWith("PUBLIC_") && !found.has(name))
+            found.set(name, "the environment");
+    }
+    return [...found].map(([name, where]) => ({ name, where }));
+}
+function refusePublicVariables(set) {
+    return ("[rsc-kit] Only VITE_ variables reach the browser; PUBLIC_ stopped being a client prefix in 0.22. " +
+        "These are still set, and would be undefined in the browser:\n\n" +
+        set.map(({ name, where }) => `  ${name} (${where}) -> VITE_${name.slice("PUBLIC_".length)}`).join("\n") +
+        "\n\nRename each where it is set and where it is read - an env schema's clientPrefix and client " +
+        "keys included.");
+}
 function refuseDevelopmentBuild(config) {
     const culprit = nodeEnvSetIn(config.mode, config.envDir);
     return ("[rsc-kit] vite build is running as a development build, and the output cannot work: " +
@@ -6020,6 +6144,12 @@ export function rscKit(options = {}) {
                             "\nexport default () => {};\n";
                     nitro.options.plugins = ["#rsc-kit/polyfills", ...(nitro.options.plugins ?? [])];
                 }
+                // Every built server, instrumentation.ts or not: the hang it prevents
+                // is any open connection, wherever the app opened it.
+                if (!nitro.options.dev) {
+                    nitro.options.virtual["#rsc-kit/shutdown"] = SHUTDOWN_PLUGIN;
+                    nitro.options.plugins = [...(nitro.options.plugins ?? []), "#rsc-kit/shutdown"];
+                }
                 if (!instrumentationFile())
                     return;
                 nitro.options.virtual["#rsc-kit/startup"] = STARTUP_PLUGIN;
@@ -6225,11 +6355,11 @@ export function rscKit(options = {}) {
                     // saying so at the end of each docker build is not a finding.
                     rollupOptions: { checks: { pluginTimings: false } },
                 },
-                // What reaches the browser. Vite's own VITE_ prefix, and PUBLIC_ - the
-                // scaffold's spelling, and Next's minus its brand - so a variable
-                // named for a port reads through import.meta.env without a config
-                // line. A config that set its own prefixes keeps them; Vite merges.
-                envPrefix: ["VITE_", "PUBLIC_"],
+                // What reaches the browser: Vite's own VITE_ prefix, and only that.
+                // PUBLIC_ was accepted beside it until 0.22; a read of one is now
+                // refused by name (publicPrefixRefused) rather than left undefined.
+                // A config that set its own prefixes keeps them; Vite merges.
+                envPrefix: ["VITE_"],
                 environments: {
                     // Server bundles — stay under the (non-public) out dir. `bun` and
                     // `bun:*` are the runtime's own modules, like `node:*`: nothing to
@@ -6327,159 +6457,167 @@ export function rscKit(options = {}) {
          * and restarting on every keystroke would throw away the module graph for
          * nothing.
          */
-        configureServer(server) {
-            // The icons and share images live in app/, which nothing serves; the
-            // build copies them beside the client output. There is no output while
-            // developing, so the same hrefs the head tags carry are answered from
-            // app/ here - and the web manifest with them - or the tab has no icon
-            // and the console a 404 for a file that is right there.
-            server.middlewares.use((req, res, next) => {
-                const url = (req.url ?? "").split("?")[0];
-                // A worker registered by a production run on this origin - `bun run
-                // start` on the port the dev server uses next - outlives that run and
-                // answers the dev server's documents from its cache: a stored page is
-                // cache-first, so a refresh brings back yesterday's document with
-                // yesterday's module hashes, and a 504 for each. The browser fetches
-                // /sw.js again on every navigation to look for an update; in
-                // development that fetch gets a worker whose only job is to remove
-                // itself, its caches, and reload the pages it controlled.
-                // robots.txt, a hand-written sitemap.xml, humans.txt: beside the root
-                // layout, served at the root. The build copies them beside the client
-                // output; here they are read from app/.
-                if (url.startsWith("/") && rootFiles.includes(url.slice(1))) {
-                    res.setHeader("Content-Type", rootFileType(url.slice(1)));
-                    res.end(readFileSync(join(sourceDir, "app", url.slice(1))));
-                    return;
-                }
-                if (url === "/sw.js") {
-                    res.setHeader("Content-Type", "text/javascript");
-                    res.setHeader("Cache-Control", "no-store");
-                    res.end(DEV_WORKER);
-                    return;
-                }
-                if (webManifestOptions && url === MANIFEST_PATH) {
-                    res.setHeader("Content-Type", "application/manifest+json");
-                    res.end(webManifest(webManifestOptions));
-                    return;
-                }
-                const asset = allAppAssets(foundAssets).find((a) => a.href === url);
-                const file = asset ? join(sourceDir, "app", asset.file) : null;
-                if (!asset || !file || !existsSync(file))
-                    return next();
-                res.setHeader("Content-Type", typeOf(asset.file));
-                createReadStream(file).pipe(res);
-            });
-            // rpc() has to reach the backend while the dev server is serving.
-            //
-            // A built deployment installs this itself: the server running
-            // createRscHandler passes `hostCalls`. Nothing does that here, and with
-            // no host installed every rpc() is refused — so a page whose data comes
-            // from the backend renders its shell and then blanks, which reads as a
-            // hydration bug rather than a missing wire.
-            server.httpServer?.once("listening", async () => {
-                const env = server.environments?.rsc;
-                if (!env?.runner)
-                    return;
-                // The app's own .env, unprefixed. A Laravel app already has both of
-                // these, which is what makes this need no configuring: APP_URL is the
-                // backend and RSC_HOST_CALL_SECRET is the secret it checks.
-                const fromEnv = loadEnv(server.config.mode, projectRoot, "");
-                const secret = hostCallOptions?.secret ?? fromEnv.RSC_HOST_CALL_SECRET;
-                const origin = hostCallOptions?.endpoint ?? fromEnv.RSC_BACKEND ?? fromEnv.APP_URL;
-                if (!secret || !origin)
-                    return;
-                const path = hostCallOptions?.path ??
-                    fromEnv.RSC_HOST_CALL_PATH ??
-                    "/__rsc/host-call";
-                const endpoint = origin.replace(/\/$/, "") + path;
-                try {
-                    const entry = await env.runner.import(join(genDir, "entry.rsc.tsx"));
-                    const install = entry.installHostFn;
-                    install?.(httpHostCalls({ endpoint, secret }));
-                }
-                catch (error) {
-                    // Reported rather than thrown: the dev server is still useful for
-                    // every page that needs no data, and a failure here would otherwise
-                    // look like the server refusing to start.
-                    server.config.logger.warn(`[rsc-kit] could not wire host calls to ${endpoint}: ` +
-                        (error instanceof Error ? error.message : String(error)));
-                }
-            });
-            // Written once the server is listening, because only then is the port
-            // known. Removed on shutdown so a backend can tell a dev server that is
-            // gone from one that is merely slow to answer.
-            if (hotFile) {
-                const remove = () => {
-                    try {
-                        if (existsSync(hotFile))
-                            rmSync(hotFile);
+        // Ahead of every other plugin's configureServer, so this middleware is
+        // first in the stack. Nitro's dev handler is registered by its own plugin,
+        // which an app lists before this one, and it answers every request that
+        // does not look like an asset itself - /manifest.webmanifest and
+        // /robots.txt went to the app's router and came back 404, or 500 from a
+        // page that could not render for that url, and this never saw them.
+        // Swapping the plugins in the app's config is not a fix: Nitro then loads
+        // .env too late for the app's first request.
+        configureServer: { order: "pre", handler(server) {
+                // The icons and share images live in app/, which nothing serves; the
+                // build copies them beside the client output. There is no output while
+                // developing, so the same hrefs the head tags carry are answered from
+                // app/ here - and the web manifest with them - or the tab has no icon
+                // and the console a 404 for a file that is right there.
+                server.middlewares.use((req, res, next) => {
+                    const url = (req.url ?? "").split("?")[0];
+                    // A worker registered by a production run on this origin - `bun run
+                    // start` on the port the dev server uses next - outlives that run and
+                    // answers the dev server's documents from its cache: a stored page is
+                    // cache-first, so a refresh brings back yesterday's document with
+                    // yesterday's module hashes, and a 504 for each. The browser fetches
+                    // /sw.js again on every navigation to look for an update; in
+                    // development that fetch gets a worker whose only job is to remove
+                    // itself, its caches, and reload the pages it controlled.
+                    // robots.txt, a hand-written sitemap.xml, humans.txt: beside the root
+                    // layout, served at the root. The build copies them beside the client
+                    // output; here they are read from app/.
+                    if (url.startsWith("/") && rootFiles.includes(url.slice(1))) {
+                        res.setHeader("Content-Type", rootFileType(url.slice(1)));
+                        res.end(readFileSync(join(sourceDir, "app", url.slice(1))));
+                        return;
                     }
-                    catch { }
-                };
-                server.httpServer?.once("listening", () => {
-                    // The url Vite resolved, not one built from the port. A dev server
-                    // whose port is already taken on IPv4 binds IPv6 only and keeps the
-                    // number — so http://127.0.0.1:<port> is a reachable-looking address
-                    // that nothing answers, and the backend reports the renderer as down
-                    // while it is plainly running.
-                    const resolved = server.resolvedUrls?.local?.[0];
-                    const address = server.httpServer?.address();
-                    const url = resolved ??
-                        (typeof address === "object" && address
-                            ? `http://${address.family === "IPv6" ? `[${address.address}]` : address.address}:${address.port}`
-                            : null);
-                    if (!url)
+                    if (url === "/sw.js") {
+                        res.setHeader("Content-Type", "text/javascript");
+                        res.setHeader("Cache-Control", "no-store");
+                        res.end(DEV_WORKER);
                         return;
-                    mkdirSync(dirname(hotFile), { recursive: true });
-                    writeFileSync(hotFile, url.replace(/\/$/, ""));
+                    }
+                    if (webManifestOptions && url === MANIFEST_PATH) {
+                        res.setHeader("Content-Type", "application/manifest+json");
+                        res.end(webManifest(webManifestOptions));
+                        return;
+                    }
+                    const asset = allAppAssets(foundAssets).find((a) => a.href === url);
+                    const file = asset ? join(sourceDir, "app", asset.file) : null;
+                    if (!asset || !file || !existsSync(file))
+                        return next();
+                    res.setHeader("Content-Type", typeOf(asset.file));
+                    createReadStream(file).pipe(res);
                 });
-                for (const signal of ["SIGINT", "SIGTERM", "exit"]) {
-                    process.once(signal, remove);
+                // rpc() has to reach the backend while the dev server is serving.
+                //
+                // A built deployment installs this itself: the server running
+                // createRscHandler passes `hostCalls`. Nothing does that here, and with
+                // no host installed every rpc() is refused — so a page whose data comes
+                // from the backend renders its shell and then blanks, which reads as a
+                // hydration bug rather than a missing wire.
+                server.httpServer?.once("listening", async () => {
+                    const env = server.environments?.rsc;
+                    if (!env?.runner)
+                        return;
+                    // The app's own .env, unprefixed. A Laravel app already has both of
+                    // these, which is what makes this need no configuring: APP_URL is the
+                    // backend and RSC_HOST_CALL_SECRET is the secret it checks.
+                    const fromEnv = loadEnv(server.config.mode, projectRoot, "");
+                    const secret = hostCallOptions?.secret ?? fromEnv.RSC_HOST_CALL_SECRET;
+                    const origin = hostCallOptions?.endpoint ?? fromEnv.RSC_BACKEND ?? fromEnv.APP_URL;
+                    if (!secret || !origin)
+                        return;
+                    const path = hostCallOptions?.path ??
+                        fromEnv.RSC_HOST_CALL_PATH ??
+                        "/__rsc/host-call";
+                    const endpoint = origin.replace(/\/$/, "") + path;
+                    try {
+                        const entry = await env.runner.import(join(genDir, "entry.rsc.tsx"));
+                        const install = entry.installHostFn;
+                        install?.(httpHostCalls({ endpoint, secret }));
+                    }
+                    catch (error) {
+                        // Reported rather than thrown: the dev server is still useful for
+                        // every page that needs no data, and a failure here would otherwise
+                        // look like the server refusing to start.
+                        server.config.logger.warn(`[rsc-kit] could not wire host calls to ${endpoint}: ` +
+                            (error instanceof Error ? error.message : String(error)));
+                    }
+                });
+                // Written once the server is listening, because only then is the port
+                // known. Removed on shutdown so a backend can tell a dev server that is
+                // gone from one that is merely slow to answer.
+                if (hotFile) {
+                    const remove = () => {
+                        try {
+                            if (existsSync(hotFile))
+                                rmSync(hotFile);
+                        }
+                        catch { }
+                    };
+                    server.httpServer?.once("listening", () => {
+                        // The url Vite resolved, not one built from the port. A dev server
+                        // whose port is already taken on IPv4 binds IPv6 only and keeps the
+                        // number — so http://127.0.0.1:<port> is a reachable-looking address
+                        // that nothing answers, and the backend reports the renderer as down
+                        // while it is plainly running.
+                        const resolved = server.resolvedUrls?.local?.[0];
+                        const address = server.httpServer?.address();
+                        const url = resolved ??
+                            (typeof address === "object" && address
+                                ? `http://${address.family === "IPv6" ? `[${address.address}]` : address.address}:${address.port}`
+                                : null);
+                        if (!url)
+                            return;
+                        mkdirSync(dirname(hotFile), { recursive: true });
+                        writeFileSync(hotFile, url.replace(/\/$/, ""));
+                    });
+                    for (const signal of ["SIGINT", "SIGTERM", "exit"]) {
+                        process.once(signal, remove);
+                    }
+                    server.httpServer?.once("close", remove);
                 }
-                server.httpServer?.once("close", remove);
-            }
-            const shapes = new Set(ROUTE_FILES.map((name) => name));
-            const affectsRouting = (file) => {
-                if (!file.startsWith(sourceDir))
-                    return false;
-                const base = file.split("/").pop() ?? "";
-                const stem = base.replace(/\.(tsx|jsx|ts|js)$/, "");
-                // The host's route-config file, whatever it named it. Hardcoding one
-                // here would put a backend's convention back into a plugin that is
-                // published without any — generic-host.test.ts fails if it reappears.
-                return ((base !== stem && shapes.has(stem)) ||
-                    SECTION_FILE.test(base) ||
-                    (routeConfig !== null && base === routeConfig.file));
-            };
-            const restart = (file) => {
-                if (!affectsRouting(file))
-                    return;
-                server.config.logger.info(`[rsc-kit] route tree changed (${file.slice(sourceDir.length + 1)}) — restarting`);
-                void server.restart();
-            };
-            // Watched explicitly: the Vite root is the *out* directory, so the app's
-            // source tree is outside it and nothing would report a file appearing.
-            server.watcher.add(sourceDir);
-            server.watcher.on("add", restart);
-            server.watcher.on("unlink", restart);
-            // The host actions are read once, in config(), from the file the
-            // backend writes; the "use server" stubs are generated from it. A
-            // backend that writes a new action - `make:rsc-action` under a running
-            // dev server - rewrites the file, and until the server started again
-            // the stub was not there to import. Any event: the file appears on a
-            // first action, changes on the next, and goes when the last is removed.
-            const hostActionsPath = join(projectRoot, HOST_ACTIONS_FILE);
-            const hostActionsChanged = (file) => {
-                if (file !== hostActionsPath)
-                    return;
-                server.config.logger.info(`[rsc-kit] ${HOST_ACTIONS_FILE} changed — restarting`);
-                void server.restart();
-            };
-            server.watcher.add(hostActionsPath);
-            server.watcher.on("add", hostActionsChanged);
-            server.watcher.on("change", hostActionsChanged);
-            server.watcher.on("unlink", hostActionsChanged);
-        },
+                const shapes = new Set(ROUTE_FILES.map((name) => name));
+                const affectsRouting = (file) => {
+                    if (!file.startsWith(sourceDir))
+                        return false;
+                    const base = file.split("/").pop() ?? "";
+                    const stem = base.replace(/\.(tsx|jsx|ts|js)$/, "");
+                    // The host's route-config file, whatever it named it. Hardcoding one
+                    // here would put a backend's convention back into a plugin that is
+                    // published without any — generic-host.test.ts fails if it reappears.
+                    return ((base !== stem && shapes.has(stem)) ||
+                        SECTION_FILE.test(base) ||
+                        (routeConfig !== null && base === routeConfig.file));
+                };
+                const restart = (file) => {
+                    if (!affectsRouting(file))
+                        return;
+                    server.config.logger.info(`[rsc-kit] route tree changed (${file.slice(sourceDir.length + 1)}) — restarting`);
+                    void server.restart();
+                };
+                // Watched explicitly: the Vite root is the *out* directory, so the app's
+                // source tree is outside it and nothing would report a file appearing.
+                server.watcher.add(sourceDir);
+                server.watcher.on("add", restart);
+                server.watcher.on("unlink", restart);
+                // The host actions are read once, in config(), from the file the
+                // backend writes; the "use server" stubs are generated from it. A
+                // backend that writes a new action - `make:rsc-action` under a running
+                // dev server - rewrites the file, and until the server started again
+                // the stub was not there to import. Any event: the file appears on a
+                // first action, changes on the next, and goes when the last is removed.
+                const hostActionsPath = join(projectRoot, HOST_ACTIONS_FILE);
+                const hostActionsChanged = (file) => {
+                    if (file !== hostActionsPath)
+                        return;
+                    server.config.logger.info(`[rsc-kit] ${HOST_ACTIONS_FILE} changed — restarting`);
+                    void server.restart();
+                };
+                server.watcher.add(hostActionsPath);
+                server.watcher.on("add", hostActionsChanged);
+                server.watcher.on("change", hostActionsChanged);
+                server.watcher.on("unlink", hostActionsChanged);
+            } },
         /**
          * Freeze what can be frozen, once every bundle exists.
          *
@@ -6578,6 +6716,12 @@ export function rscKit(options = {}) {
             if (config.command === "build" && !config.isProduction) {
                 throw new Error(refuseDevelopmentBuild(config));
             }
+            // Named before anything is bundled, in development and in a build: a
+            // PUBLIC_ variable is one the app expects in the browser, and it would
+            // arrive there as undefined. See publicVariablesSet.
+            const publicSet = publicVariablesSet(config.mode, config.envDir);
+            if (publicSet.length > 0)
+                throw new Error(refusePublicVariables(publicSet));
             isWatch = config.build?.watch != null;
             resolvedConfig = config;
             const nitroMain = config.plugins.find((p) => p.name === "nitro:main");
@@ -6627,6 +6771,7 @@ export function rscKit(options = {}) {
             clientChunks: (meta) => meta.normalizedId,
             ...actionEncryptionKey(),
         }),
+        publicPrefixRefused(),
         barrelImportsPlugin(),
         useSsrModules(),
         serverRendererInRsc(),