@rsc-kit/core 0.5.0 → 0.7.0

package/dist/vite.js

@@ -5,8 +5,8 @@
 // that global is called, and how a route declares dynamic props, are options —
 // nothing here knows or cares which backend is driving it.
 //
-//   import { rscRoutes } from '<package>/vite'
-//   export default defineConfig({ plugins: [rscRoutes(), react({ compiler: true })] })
+//   import { rscKit } from '<package>/vite'
+//   export default defineConfig({ plugins: [rscKit(), react({ compiler: true })] })
 //
 // The plugin discovers the app/ route tree, generates the three entries that
 // carry the route composition and the worker's render contract, and supplies
@@ -19,7 +19,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import rsc from '@vitejs/plugin-rsc';
 import { loadEnv } from 'vite';
 import { httpHostCalls } from './hostCalls.js';
-// Resolved once per rscRoutes() call. One build runs in one process, so these are
+// Resolved once per rscKit() call. One build runs in one process, so these are
 // module state rather than threaded through every helper.
 let projectRoot;
 let sourceDir;
@@ -27,7 +27,6 @@ let outDir;
 let appDir;
 let genDir;
 let publicAssetsDir;
-let assetsBaseUrl;
 let hotFile;
 let hostCallOptions;
 let packageDir;
@@ -36,7 +35,7 @@ let interceptManifestFile;
 let packageAlias;
 /** Dev-server origin; empty in a build. See devUrls.ts. */
 let devOrigin;
-/** 'server' or 'export' — see RscRoutesOptions.output. */
+/** 'server' or 'export' — see RscKitOptions.output. */
 let output;
 /** Where an exported site is written. */
 let exportPath;
@@ -47,11 +46,11 @@ let exportPath;
  */
 let staticPayloads;
 let routeConfig;
-/** Whether `vite build` freezes pages when it finishes — see RscRoutesOptions. */
+/** Whether `vite build` freezes pages when it finishes — see RscKitOptions. */
 let prerenderAfterBuild;
 /** True during `vite build --watch`, where re-rendering every route is noise. */
 let isWatch = false;
-/** Host functions to generate stubs for — see RscRoutesOptions.hostActions. */
+/** Host functions to generate stubs for — see RscKitOptions.hostActions. */
 let hostActions;
 /**
  * This file's directory.
@@ -148,10 +147,27 @@ function resolvePaths(options) {
     // Generated entries live under the (in-project) out dir so module resolution
     // can walk up to the project's node_modules (@vitejs/plugin-rsc, react, ...).
     genDir = join(outDir, '.gen');
-    // The CLIENT bundle is browser-facing and has to be web-served; the rsc/ssr
-    // bundles are SERVER code and stay under outDir, which must never be public.
-    publicAssetsDir = resolve(options.assetsDir || process.env.RSC_ASSETS_DIR || join(projectRoot, 'dist/client'));
-    assetsBaseUrl = options.assetsUrl || process.env.RSC_ASSETS_URL || '/';
+    // Not a migration guard — those are not worth carrying in a pre-release.
+    // This is the silent-failure guard the rest of this file is written to be.
+    //
+    // Nitro publishes the assets and serves them from its own root. A prefix set
+    // here would be emitted into the markup and answered by nobody: every asset
+    // 404s while every page still renders, so the app arrives unstyled, never
+    // hydrates, and logs nothing anywhere. Vite does not typecheck a config, so
+    // removing the option from the type is not enough to stop it.
+    //
+    // There is deliberately no check for `nitro`. It is gone from the type, and
+    // a config still passing `nitro: true` is asking for exactly what it gets.
+    const removed = ['assetsDir', 'assetsUrl'].filter((key) => options[key] !== undefined);
+    if (removed.length > 0) {
+        throw new Error(`[rsc-kit] ${removed.join(' and ')} ${removed.length === 1 ? 'is' : 'are'} no longer an option.\n\n` +
+            'Nitro publishes the browser assets to .output/public and serves them from its own\n' +
+            'root, so there is no prefix to set. That directory is the deployment — point nginx\n' +
+            'or a CDN at it if something other than the app should serve them.');
+    }
+    // Vite's own default. Nitro overrides it with .output/public, which is why
+    // there is nothing here to configure.
+    publicAssetsDir = resolve(join(projectRoot, 'dist/client'));
     hotFile = options.hotFile || process.env.RSC_HOT_FILE || '';
     hostCallOptions = options.hostCall;
     packageDir = resolve(options.packageDir || process.env.RSC_PACKAGE_DIR || thisDir());
@@ -177,7 +193,7 @@ function resolvePaths(options) {
     hostActions = options.hostActions ?? fileHostActions(projectRoot);
 }
 function log(...args) {
-    console.error('[rsc-routes]', ...args);
+    console.error('[rsc-kit]', ...args);
 }
 // ── The route manifest ───────────────────────────────────────────────────────
 /**
@@ -455,15 +471,42 @@ function reportAllDynamic() {
 
   ${routes.length} dynamic — prerendering is off`);
 }
-async function prerenderAfterBundles() {
-    const bundle = join(outDir, 'dist/rsc/index.js');
-    if (!existsSync(bundle))
-        return;
+/**
+ * The rsc bundle the build just wrote, whatever it decided to call it.
+ *
+ * Two things were assumed here and both were wrong for somebody. The directory
+ * was assumed to be <outDir>/dist/rsc, which Nitro does not use — it builds the
+ * environment under node_modules/.nitro. And the file was assumed to be
+ * index.js, which Vite only emits for a package that declares `type: module`;
+ * everyone else got index.mjs. Either miss returned quietly, and a build that
+ * prerendered nothing printed exactly what a build with no pages to freeze
+ * prints.
+ */
+function resolveRscBundle(dir) {
+    for (const name of ['index.js', 'index.mjs']) {
+        const candidate = join(dir, name);
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
+async function prerenderAfterBundles(bundle, staticDir, assetsDir) {
+    // A missing bundle used to be a silent `return`, and under Nitro it was the
+    // normal case: the path was assumed to be <outDir>/dist/rsc/index.js, Nitro
+    // builds the rsc environment somewhere else entirely, and so every Nitro app
+    // — every scaffolded app, and Laravel — prerendered nothing at all. No
+    // classification printed, no route frozen, and every page renders per
+    // visitor. The caller resolves the path from the environment now, so this is
+    // back to being the impossible case it reads as.
+    if (!bundle) {
+        throw new Error('[rsc-kit] The build produced no rsc bundle to prerender from.\n' +
+            'Prerendering renders the app, so it needs the bundle the build just wrote. ' +
+            'Build with prerender: false to render every page on demand instead.');
+    }
     const [{ prerender, summary, legend }, { writeTo }] = await Promise.all([
         import('./prerender.js'),
         import('./files.js'),
     ]);
-    const staticDir = join(outDir, 'static');
     // Cleared first: a route that changes classification between builds
     // otherwise leaves its old shell on disk and the host goes on serving it.
     // Nothing warns — the page loads, with content from the previous build.
@@ -488,10 +531,52 @@ ${legend(results)}
 
   ${summary(results)}`);
     if (failed > 0) {
-        throw new Error(`[rsc-routes] ${failed} route${failed === 1 ? '' : 's'} failed to render.\n` +
+        throw new Error(`[rsc-kit] ${failed} route${failed === 1 ? '' : 's'} failed to render.\n` +
             'Prerendering runs your app: whatever those pages need at render time has to be\n' +
             'reachable from the build. Fix them, or build with prerender: false and render on demand.');
     }
+    if (output === 'export')
+        await exportAfterPrerender(results, staticDir, assetsDir);
+}
+/**
+ * Turn the frozen output into a directory a static host can serve.
+ *
+ * Part of the build rather than a script the app writes, for the same reason
+ * prerendering is: it needs the results the build already has, and the engine
+ * bundle they came from is somewhere only the build knows. That path used to be
+ * stable enough to hard-code in an example — `build/dist/rsc/index.js` — and it
+ * is not any more, because Nitro builds the rsc environment under
+ * node_modules. A script asking for it would be a script that breaks.
+ *
+ * RSC_EXPORT_FORCE writes the site anyway and reports what it left out, which
+ * is how an app is moved towards being exportable. Without it a route that
+ * could not be frozen fails the build, because a shell on a static host is a
+ * page that loads and then stays empty forever.
+ */
+async function exportAfterPrerender(results, staticDir, assetsDir) {
+    const [{ exportSite, NotExportable }, { writeTo, prerenderedFrom, copyAssets }] = await Promise.all([
+        import('./export.js'),
+        import('./files.js'),
+    ]);
+    try {
+        const { pages, refused } = await exportSite({
+            results,
+            read: prerenderedFrom(staticDir),
+            write: writeTo(exportPath),
+            manifest: routeManifest(),
+            assets: copyAssets(join(assetsDir, 'assets'), exportPath, '/assets/'),
+            force: process.env.RSC_EXPORT_FORCE === '1',
+        });
+        console.log(`\n  Exported ${pages} page${pages === 1 ? '' : 's'} to ${relative(projectRoot, exportPath)}`);
+        if (refused.length > 0) {
+            console.log(`  Left out ${refused.length}: ${refused.map((r) => r.url).join(', ')}`);
+        }
+    }
+    catch (error) {
+        if (!(error instanceof NotExportable))
+            throw error;
+        throw new Error(`[rsc-kit] ${error.message}`);
+    }
 }
 /** `/posts/[slug]` — the pattern, in the shape the app writes its links in. */
 function patternOf(segments) {
@@ -664,6 +749,160 @@ function hasStaticParams(absPath) {
     return /export\s+((async\s+)?function\s+generateStaticParams|const\s+generateStaticParams)/.test(src);
 }
 // ── Codegen ──────────────────────────────────────────────────────────────────
+/**
+ * The dev fall-through, emitted only when there is a backend to hand a url to.
+ *
+ * A JavaScript host has no backend — it IS the backend — so its entry should
+ * not carry this code, its constants, or the branch that tests them. Nothing
+ * generated is cheaper than something generated that returns early, and it
+ * keeps every backend-shaped idea out of a runtime that has no backend.
+ */
+const FALLBACK_CONSTS = `const FALLBACK_ORIGIN = __ORIGIN__
+const FALLBACK_MARKER = 'x-rsc-renderer-fallback'
+const PROXIED_MARKER = 'x-rsc-proxied-by-backend'
+`;
+const FALLBACK_BODY = `  const answer = await devHandler(request)
+
+  if (answer) return answer
+
+  // Nothing here owns this url. In development the backend usually does — a
+  // Blade page, /login, a webhook, an uploaded file under /storage — so the
+  // request is handed on rather than refused, and this origin is the whole
+  // application instead of the RSC half of it.
+  //
+  // FALLBACK_MARKER is what stops this looping. The backend's own fallback
+  // forwards what it cannot route BACK to this server, so without a marker a
+  // url neither side owns would bounce between them until something gave out.
+  // Seeing it, the backend answers 404 itself.
+  // Came from the backend's own proxy, so it has already been through that
+  // route table and the answer there was no. Sending it back asks the same
+  // question a second time.
+  if (!FALLBACK_ORIGIN || request.headers.has(PROXIED_MARKER)) {
+    return new Response('Not found', { status: 404 })
+  }
+
+  // Built from the origin rather than by assigning onto a copy of this url.
+  // The URL host setter keeps whatever port is already there when the value it
+  // is given has none, so a portless backend — every Herd or Valet site —
+  // would inherit the dev server's own port and this server would call itself.
+  const here = new URL(request.url)
+  const target = new URL(here.pathname + here.search, FALLBACK_ORIGIN)
+
+  const headers = new Headers(request.headers)
+
+  // Never forwarded: a vhost server routes on it, so telling Herd the host is
+  // localhost:5173 means it has no such site and answers 404. fetch sets it
+  // from the target instead.
+  headers.delete('host')
+  headers.set(FALLBACK_MARKER, '1')
+
+  // What the browser actually asked for. Without these the backend generates
+  // absolute urls — url(), route(), redirects, form actions — against its own
+  // origin rather than this one, and a redirect walks the browser off this
+  // server onto the backend.
+  //
+  // They only take effect if the backend trusts this proxy: Laravel needs the
+  // renderer's address in trustProxies. Sent regardless, because a header an
+  // untrusting backend ignores costs nothing, and the alternative is that
+  // there is no way to get it right at all.
+  headers.set('x-forwarded-host', here.host)
+  headers.set('x-forwarded-proto', here.protocol.replace(':', ''))
+
+  const hasBody = request.method !== 'GET' && request.method !== 'HEAD'
+
+  try {
+    return await fetch(target, {
+      method: request.method,
+      headers,
+      body: hasBody ? request.body : undefined,
+      // A redirect is the backend's answer and belongs to the browser.
+      // Following it here would return the destination's body under this url.
+      redirect: 'manual',
+      ...(hasBody ? { duplex: 'half' } : {}),
+    } as RequestInit)
+  } catch (error) {
+    return new Response(
+      // The cause, not just the wrapper: fetch reports every network failure
+      // as the same 'TypeError: fetch failed', and the refused address
+      // underneath it is the whole of the diagnosis.
+      'The backend at ' + FALLBACK_ORIGIN + ' is not answering: ' +
+        String((error as { cause?: unknown }).cause ?? error),
+      { status: 502 },
+    )
+  }
+`;
+/**
+ * Wire host calls when Nitro is the server.
+ *
+ * Every other arrangement installs this from outside: the dev server does it in
+ * configureServer, and a generated server.ts passes hostCalls to
+ * createRscHandler. Under Nitro there is no such file — this module IS the
+ * server — so an rpc() page renders its loading fallback forever and the
+ * backend never hears from it. Silent, which is the worst kind.
+ *
+ * Read at request time rather than at build time: the endpoint belongs to the
+ * deployment, and baking it in would mean rebuilding to change where the
+ * backend is.
+ */
+/**
+ * What a generated server.ts passes, for the arrangement that has no server.ts.
+ *
+ * props: a page reading `params` gets its url params from the engine, and the
+ * query string is merged in here — `params.q` should mean the same thing
+ * whether it arrived in the path or after the ?. Only the Laravel template
+ * passed this before, so the other hosts quietly did not have it.
+ *
+ * version: the client compares it on every navigation and falls back to a full
+ * load when it changes. Without one, a browser keeps talking to a deployment
+ * that is gone — worst behind a CDN, where the shell it holds may already be
+ * older than the payloads it asks for.
+ */
+/**
+ * Where frozen pages live inside `.output/server`, written by the build and
+ * found by the generated entry. One constant because the two halves are in
+ * different processes — a name written down twice is a name that drifts, and
+ * the failure is silent: the server finds no directory, decides nothing was
+ * frozen, and renders every page live exactly as it did before.
+ */
+const NITRO_STATIC_DIR = 'rsc-static';
+/**
+ * Serve what the build froze.
+ *
+ * `import.meta.env.PROD` rather than an unconditional reader: in development
+ * there is no build output to serve, and a stale one would be worse than none.
+ * Vite replaces it with a literal, so the dev bundle keeps no reference to it.
+ */
+const NITRO_PRERENDERED = `    prerendered: import.meta.env.PROD
+      ? prerenderedBeside(import.meta.url, ${JSON.stringify(NITRO_STATIC_DIR)})
+      : undefined,
+`;
+const NITRO_HANDLER_OPTIONS = `    props: (match, request) => ({
+      ...match.params,
+      ...Object.fromEntries(new URL(request.url).searchParams),
+    }),
+    version: process.env.RSC_BUILD_VERSION,
+`;
+const NITRO_HOST_CALLS = `
+let hostInstalled = false
+
+function installHostCallsOnce(): void {
+  if (hostInstalled) return
+  hostInstalled = true
+
+  const origin = process.env.RSC_BACKEND ?? process.env.APP_URL
+  const secret = process.env.RSC_HOST_CALL_SECRET
+
+  // Both, or neither: a secret without a backend has nowhere to go, and a
+  // backend without one is refused at the door. See the dev server, which
+  // gates on exactly the same pair.
+  if (!origin || !secret) return
+
+  const path = process.env.RSC_HOST_CALL_PATH ?? '/__rsc/host-call'
+
+  installHostFn(httpHostCalls({ endpoint: origin.replace(/\\/$/, '') + path, secret }))
+}
+
+`;
 function generateEntryRsc(fallbackOrigin = '') {
     const imports = [];
     const mapEntries = [];
@@ -691,7 +930,7 @@ function generateEntryRsc(fallbackOrigin = '') {
     // The engine's own modules are named without an extension: this plugin runs
     // from src/ in its own repo and from dist/ once published, and Vite resolves
     // either. Naming .tsx here builds fine from source and fails after publish.
-    return `// GENERATED by rscRoutes() — do not edit.
+    return `// GENERATED by rscKit() — do not edit.
 import { SegmentBoundary } from ${JSON.stringify(join(packageDir, "js/SegmentBoundary"))}
 import { DocumentTitle } from ${JSON.stringify(join(packageDir, "js/DocumentTitle"))}
 import { SlotBoundary } from ${JSON.stringify(join(packageDir, "js/SlotBoundary"))}
@@ -700,6 +939,8 @@ import { PathnameProvider } from ${JSON.stringify(join(packageDir, "js/PathnameP
 import { searchParams as requestSearchParams } from ${JSON.stringify(join(packageDir, "request"))}
 import { redirectDigest } from ${JSON.stringify(join(packageDir, "redirectDigest"))}
 import { createRscHandler } from ${JSON.stringify(join(packageDir, "host"))}
+import { httpHostCalls } from ${JSON.stringify(join(packageDir, 'hostCalls'))}
+import { prerenderedBeside } from ${JSON.stringify(join(packageDir, 'files'))}
 import { renderToReadableStream, decodeReply, loadServerAction } from '@vitejs/plugin-rsc/rsc'
 import { Suspense, createElement, Fragment } from 'react'
 import { AsyncLocalStorage } from 'node:async_hooks'
@@ -783,8 +1024,8 @@ export function installHostFn(fn: HostFn) {
  * a time and silently wrong for two: the second overwrites the first's saved
  * value, and both pages then call whichever closure assigned last, so
  * usedDynamicApis is recorded against the wrong page and routes are
- * misclassified. Benign for a pure-JS host, which installs none; wrong for
- * Laravel, which does.
+ * misclassified. Benign for a host that installs none; wrong for any host
+ * that does.
  */
 const probeHost = new AsyncLocalStorage<(...args: unknown[]) => Promise<unknown>>()
 
@@ -970,7 +1211,7 @@ function buildElement(
 
 // Resolve route metadata into React elements. React 19 hoists <title>/<meta>
 // rendered anywhere in the tree into <head> — so the "vite way" for metadata is
-// to render it as elements, no PHP-side <head> string injection.
+// to render it as elements, rather than a backend injecting a <head> string.
 async function renderTree(
   component: string,
   props: Record<string, unknown>,
@@ -1202,7 +1443,7 @@ function flightOnError(error: unknown): string | undefined {
 
   if (digest) return digest
 
-  console.error('[rsc-routes]', error)
+  console.error('[rsc-kit]', error)
 
   return undefined
 }
@@ -1622,13 +1863,13 @@ export async function handleRscPayload(
 
 // PPR shell + classification (worker: rsc-ppr-shell — build-time).
 //
-// php() is replaced by a probe that records the call and never resolves, so
+// rpc() is replaced by a probe that records the call and never resolves, so
 // every subtree depending on per-request data stays suspended while everything
 // static renders normally. Whatever React has flushed when the deadline passes
 // IS the shell: layouts, static markup, and Suspense fallbacks.
 //
 // The two flags this returns are what the prerender pipeline classifies on:
-//   usedDynamicApis — the page touched php(), so it cannot be frozen whole
+//   usedDynamicApis — the page touched rpc(), so it cannot be frozen whole
 //   timedOut        — the render never finished, i.e. it is still waiting on
 //                     data, so only the shell is safe to cache
 // A page that sets neither is genuinely static and can be prerendered fully.
@@ -1660,13 +1901,14 @@ export async function handleRscPprShell(
   // once at build time.
   //
   // A host that opened a callback socket for the build says true, and then the
-  // call is made and its answer stored. That is the only way a Laravel page can
-  // be static at all, since a host call is the only route its data has — and
+  // call is made and its answer stored. That is the only way a page whose data
+  // lives in the host can be static at all, since a host call is its only route
+  // to that data — and
   // connection() is how such a page opts back out.
   //
   // Asked of the caller rather than read from whatever host happens to be
   // installed, because those are different statements: a test that installed
-  // one is not a build that can reach PHP.
+  // one is not a build that can reach the host.
   canReachHost = false,
 ): Promise<{ shellHtml: string; clientChunks: unknown; timedOut: boolean; usedDynamicApis: boolean; error?: string }> {
   // Deliberately no middleware here. The probe is asking whether the content is
@@ -1717,7 +1959,7 @@ export async function handleRscPprShell(
     if (controller.signal.aborted) return undefined
 
     renderFailure ??= e instanceof Error ? e.message : String(e)
-    console.error('[rsc-routes]', e)
+    console.error('[rsc-kit]', e)
 
     return undefined
   }
@@ -1810,17 +2052,21 @@ export async function handleRscPprShell(
  * step and no NODE_ENV to match — this is React's development build because
  * Vite is running in development.
  *
- * Assets and prerendered pages are deliberately absent. Vite serves its own
- * assets in dev, and a frozen page is a build artifact: serving one here would
- * hand back the last build's HTML for a file just edited.
+ * Assets are deliberately absent: Vite serves its own.
+ *
+ * Frozen pages are absent *in development* — a frozen page is a build
+ * artifact, and serving one here would hand back the last build's HTML for a
+ * file just edited. Under Nitro this same file is also the production entry,
+ * and reading that reason as applying to both is what left every built Nitro
+ * server rendering live pages it had already frozen. The gate is the mode, not
+ * the file.
  */
-const FALLBACK_ORIGIN = ${JSON.stringify(fallbackOrigin)}
-const FALLBACK_MARKER = 'x-rsc-renderer-fallback'
-const PROXIED_MARKER = 'x-rsc-proxied-by-backend'
-
+${fallbackOrigin ? FALLBACK_CONSTS.replace('__ORIGIN__', JSON.stringify(fallbackOrigin)) : ''}${NITRO_HOST_CALLS}
 let devHandler: ((request: Request) => Promise<Response | null>) | null = null
 
 export default async function handler(request: Request): Promise<Response> {
+  installHostCallsOnce()
+
   devHandler ??= createRscHandler({
     engine: {
       manifest,
@@ -1837,83 +2083,14 @@ export default async function handler(request: Request): Promise<Response> {
       resolveMetadata,
       runRouteMiddleware,
     } as never,
-  })
-
-  const answer = await devHandler(request)
+${NITRO_HANDLER_OPTIONS}${NITRO_PRERENDERED}  })
 
-  if (answer) return answer
-
-  // Nothing here owns this url. In development the backend usually does — a
-  // Blade page, /login, a webhook, an uploaded file under /storage — so the
-  // request is handed on rather than refused, and this origin is the whole
-  // application instead of the RSC half of it.
-  //
-  // FALLBACK_MARKER is what stops this looping. The backend's own fallback
-  // forwards what it cannot route BACK to this server, so without a marker a
-  // url neither side owns would bounce between them until something gave out.
-  // Seeing it, the backend answers 404 itself.
-  // Came from the backend's own proxy, so it has already been through that
-  // route table and the answer there was no. Sending it back asks the same
-  // question a second time.
-  if (!FALLBACK_ORIGIN || request.headers.has(PROXIED_MARKER)) {
-    return new Response('Not found', { status: 404 })
-  }
-
-  // Built from the origin rather than by assigning onto a copy of this url.
-  // The URL host setter keeps whatever port is already there when the value it
-  // is given has none, so a portless backend — every Herd or Valet site —
-  // would inherit the dev server's own port and this server would call itself.
-  const here = new URL(request.url)
-  const target = new URL(here.pathname + here.search, FALLBACK_ORIGIN)
-
-  const headers = new Headers(request.headers)
-
-  // Never forwarded: a vhost server routes on it, so telling Herd the host is
-  // localhost:5173 means it has no such site and answers 404. fetch sets it
-  // from the target instead.
-  headers.delete('host')
-  headers.set(FALLBACK_MARKER, '1')
-
-  // What the browser actually asked for. Without these the backend generates
-  // absolute urls — url(), route(), redirects, form actions — against its own
-  // origin rather than this one, and a redirect walks the browser off this
-  // server onto the backend.
-  //
-  // They only take effect if the backend trusts this proxy: Laravel needs the
-  // renderer's address in trustProxies. Sent regardless, because a header an
-  // untrusting backend ignores costs nothing, and the alternative is that
-  // there is no way to get it right at all.
-  headers.set('x-forwarded-host', here.host)
-  headers.set('x-forwarded-proto', here.protocol.replace(':', ''))
-
-  const hasBody = request.method !== 'GET' && request.method !== 'HEAD'
-
-  try {
-    return await fetch(target, {
-      method: request.method,
-      headers,
-      body: hasBody ? request.body : undefined,
-      // A redirect is the backend's answer and belongs to the browser.
-      // Following it here would return the destination's body under this url.
-      redirect: 'manual',
-      ...(hasBody ? { duplex: 'half' } : {}),
-    } as RequestInit)
-  } catch (error) {
-    return new Response(
-      // The cause, not just the wrapper: fetch reports every network failure
-      // as the same 'TypeError: fetch failed', and the refused address
-      // underneath it is the whole of the diagnosis.
-      'The backend at ' + FALLBACK_ORIGIN + ' is not answering: ' +
-        String((error as { cause?: unknown }).cause ?? error),
-      { status: 502 },
-    )
-  }
-}
+${fallbackOrigin ? FALLBACK_BODY : "  return (await devHandler(request)) ?? new Response('Not found', { status: 404 })\n"}}
 `;
 }
 function generateEntrySsr() {
     const devUrls = join(packageDir, 'devUrls');
-    return `// GENERATED by rscRoutes() — do not edit.
+    return `// GENERATED by rscKit() — do not edit.
 import { createFromReadableStream } from '@vitejs/plugin-rsc/ssr'
 import { renderToReadableStream, resume } from 'react-dom/server.edge'
 import { prerender } from 'react-dom/static.edge'
@@ -1945,7 +2122,7 @@ export async function handleSsr(
   const html = await renderToReadableStream(root as any, {
     bootstrapScriptContent,
     nonce,
-    onError: onError ?? ((error: unknown) => { console.error('[rsc-routes:ssr]', error) }),
+    onError: onError ?? ((error: unknown) => { console.error('[rsc-kit:ssr]', error) }),
   })
 
   return DEV_ORIGIN ? rewriteViteDevUrlStream(html, DEV_ORIGIN) : html
@@ -2010,13 +2187,34 @@ export async function handleSsrResume(
 
   const html = await resume(root as any, postponed as any, {
     nonce,
-    onError: (error: unknown) => { console.error('[rsc-routes:resume]', error) },
+    onError: (error: unknown) => { console.error('[rsc-kit:resume]', error) },
   })
 
   return DEV_ORIGIN ? rewriteViteDevUrlStream(html, DEV_ORIGIN) : html
 }
-`;
+${SSR_SERVICE}`;
+}
+/**
+ * What Nitro calls this environment through.
+ *
+ * Nitro addresses each Vite environment as a service and calls fetch on it —
+ * `mod = _mod.default || _mod; mod.fetch(req)` — so an entry that exports only
+ * named functions is a 500 on every request. The named ones stay: the rsc
+ * entry still reaches them through loadModule. This only adds the door Nitro
+ * knocks on, and the request goes straight back to the rsc entry, which is the
+ * one that owns rendering.
+ */
+const SSR_SERVICE = `
+export default {
+  fetch: async (request: Request): Promise<Response> => {
+    const rsc = await import.meta.viteRsc.loadModule<{
+      default: (request: Request) => Promise<Response>
+    }>('rsc', 'index')
+
+    return rsc.default(request)
+  },
 }
+`;
 function generateEntryBrowser() {
     const clientBootstrap = join(packageDir, 'js/createViteRscApp');
     // Only for an exported build, and only what the client needs to work out how
@@ -2029,7 +2227,7 @@ function generateEntryBrowser() {
         ? routeManifest().routes.map((route) => ({ segments: route.segments, layouts: route.layouts }))
         : null;
     const refreshModule = join(packageDir, 'js/navigate');
-    return `// GENERATED by rscRoutes() — do not edit.
+    return `// GENERATED by rscKit() — do not edit.
 import { createViteRscApp } from ${JSON.stringify(clientBootstrap)}
 import { refresh } from ${JSON.stringify(refreshModule)}
 
@@ -2176,20 +2374,20 @@ function validateLoadingBoundaries() {
 // ── Plugin ───────────────────────────────────────────────────────────────────
 /** Names of plugins that transform JSX and must run after rsc() has split it. */
 const JSX_PLUGIN_PATTERN = /react|babel|oxc/i;
-export function rscRoutes(options = {}) {
+export function rscKit(options = {}) {
     resolvePaths(options);
     const routesPlugin = {
-        name: 'rsc-routes',
+        name: 'rsc-kit',
         config(_config, env) {
             if (!existsSync(appDir)) {
-                throw new Error(`[rsc-routes] No app directory at ${appDir} — nothing to build.`);
+                throw new Error(`[rsc-kit] No app directory at ${appDir} — nothing to build.`);
             }
             components.clear();
             discover(appDir);
             log(`Discovered ${components.size} route components:`, [...components.keys()].join(', '));
             const loadingErrors = validateLoadingBoundaries();
             if (loadingErrors.length) {
-                throw new Error('[rsc-routes] A page that blocks before it can paint needs a loading.tsx boundary.\n\n' +
+                throw new Error('[rsc-kit] A page that blocks before it can paint needs a loading.tsx boundary.\n\n' +
                     loadingErrors.join('\n') +
                     '\n\nAdd loading.tsx in the page directory (or a parent), or move the slow work\n' +
                     'into a child component wrapped in its own <Suspense> so the page can paint.');
@@ -2206,13 +2404,20 @@ export function rscRoutes(options = {}) {
             // cannot end up pointing at different backends. Development only: a
             // build's server.ts decides this for itself.
             const backendEnv = loadEnv(env.mode, projectRoot, '');
-            const fallbackOrigin = options.devFallback === false
-                ? ''
-                : (options.devFallback ??
-                    hostCallOptions?.endpoint ??
-                    backendEnv.RSC_BACKEND ??
-                    backendEnv.APP_URL ??
-                    '');
+            // Only a backend this server could actually call. The shared secret is
+            // what makes one a backend rather than a url that happens to be in the
+            // environment — APP_URL is not a Laravel-only name, and a JavaScript
+            // host that sets it for its own reasons must not find its 404s being
+            // posted to it. Host calls gate on exactly the same pair, so the two
+            // cannot end up disagreeing about whether a backend is there.
+            //
+            // Naming devFallback explicitly opts in regardless: someone who wrote
+            // the address down means it.
+            const backendSecret = hostCallOptions?.secret ?? backendEnv.RSC_HOST_CALL_SECRET;
+            const detected = backendSecret
+                ? (hostCallOptions?.endpoint ?? backendEnv.RSC_BACKEND ?? backendEnv.APP_URL ?? '')
+                : '';
+            const fallbackOrigin = options.devFallback === false ? '' : (options.devFallback ?? detected);
             writeFileSync(join(genDir, 'entry.rsc.tsx'), generateEntryRsc(fallbackOrigin));
             writeFileSync(join(genDir, 'entry.ssr.tsx'), generateEntrySsr());
             writeFileSync(join(genDir, 'entry.browser.tsx'), generateEntryBrowser());
@@ -2273,7 +2478,7 @@ export function rscRoutes(options = {}) {
                 // "The server is configured with a public base URL", which reads as a
                 // routing bug rather than as this line. In dev the pages are the root;
                 // the assets come from the same origin either way.
-                base: env.command === 'build' ? assetsBaseUrl : '/',
+                base: '/',
                 root: outDir,
                 // Force single instances of React/RSC runtime — critical when the
                 // package is symlinked (local dev / monorepo), else "use client"
@@ -2350,7 +2555,7 @@ export function rscRoutes(options = {}) {
                     // Reported rather than thrown: the dev server is still useful for
                     // every page that needs no data, and a failure here would otherwise
                     // look like the server refusing to start.
-                    server.config.logger.warn(`[rsc-routes] could not wire host calls to ${endpoint}: ` +
+                    server.config.logger.warn(`[rsc-kit] could not wire host calls to ${endpoint}: ` +
                         (error instanceof Error ? error.message : String(error)));
                 }
             });
@@ -2403,7 +2608,7 @@ export function rscRoutes(options = {}) {
             const restart = (file) => {
                 if (!affectsRouting(file))
                     return;
-                server.config.logger.info(`[rsc-routes] route tree changed (${file.slice(sourceDir.length + 1)}) — restarting`);
+                server.config.logger.info(`[rsc-kit] route tree changed (${file.slice(sourceDir.length + 1)}) — restarting`);
                 void server.restart();
             };
             // Watched explicitly: the Vite root is the *out* directory, so the app's
@@ -2428,7 +2633,7 @@ export function rscRoutes(options = {}) {
          * Skipped in watch mode. A rebuild on every keystroke that also re-renders
          * every route is not a feedback loop anyone wants.
          */
-        async buildApp() {
+        async buildApp(builder) {
             if (isWatch)
                 return;
             // Say what the build did, even when it stored nothing.
@@ -2442,7 +2647,25 @@ export function rscRoutes(options = {}) {
                 reportAllDynamic();
                 return;
             }
-            await prerenderAfterBundles();
+            // Asked of the build rather than assumed from `outDir`. The two layouts
+            // differ — <outDir>/dist/rsc on its own, node_modules/.nitro/… under
+            // Nitro — and hard-coding the first is what silently skipped the second.
+            // Both environments emit `index.js`, so this is one path, not a branch.
+            const rscOut = builder?.environments?.rsc?.config?.build?.outDir ?? join(outDir, 'dist/rsc');
+            const bundle = resolveRscBundle(rscOut);
+            // Where the frozen pages go, which is not the same question.
+            //
+            // On its own the plugin owns the output and server.ts reads <outDir>/static
+            // from the repository. Under Nitro the deployment is `.output/` and
+            // nothing outside it is copied to the server — so pages written anywhere
+            // else exist on the build machine and nowhere after that. They go beside
+            // the server bundle instead, and buildApp runs before Nitro assembles, so
+            // they are in place by the time it does.
+            const clientOut = builder?.environments?.client?.config?.build?.outDir;
+            const staticDir = clientOut
+                ? join(dirname(clientOut), 'server', NITRO_STATIC_DIR)
+                : join(outDir, NITRO_STATIC_DIR);
+            await prerenderAfterBundles(bundle, staticDir, clientOut ?? publicAssetsDir);
         },
         configResolved(config) {
             isWatch = config.build?.watch != null;
@@ -2453,18 +2676,21 @@ export function rscRoutes(options = {}) {
             const rscAt = names.findIndex((n) => n === 'rsc' || n.startsWith('rsc:'));
             const jsxAt = names.findIndex((n) => JSX_PLUGIN_PATTERN.test(n));
             if (rscAt !== -1 && jsxAt !== -1 && jsxAt < rscAt) {
-                throw new Error(`[rsc-routes] Plugin "${names[jsxAt]}" is resolved ahead of rsc(), so it would ` +
+                throw new Error(`[rsc-kit] Plugin "${names[jsxAt]}" is resolved ahead of rsc(), so it would ` +
                     'transform JSX before the client/server split.\n' +
-                    'Put rscRoutes() first in your plugins array. If it already is, that plugin ' +
+                    'Put rscKit() first in your plugins array. If it already is, that plugin ' +
                     "sets enforce: 'pre' and needs to be moved after rsc() explicitly.");
             }
         },
     };
     // rsc() ships as several plugins, and it has to lead. A promise is a legal
     // member of a Vite plugins array and is flattened in place, so this keeps
-    // rscRoutes() one entry in the app's config while still resolving the
+    // rscKit() one entry in the app's config while still resolving the
     // plugin at call time — see appPluginRsc for why that matters.
-    return [appPluginRsc(), routesPlugin];
+    // With Nitro, the server handler is Nitro's — it takes the rsc entry's
+    // default export and builds the server around it. Leaving plugin-rsc's own
+    // handler in place means two things claiming the same role.
+    return [appPluginRsc({ serverHandler: false }), routesPlugin];
 }
 /**
  * @vitejs/plugin-rsc, resolved from the app rather than from here.
@@ -2483,18 +2709,18 @@ export function rscRoutes(options = {}) {
  * Resolving from the project root gets the app's copy, whose own `vite` import
  * then resolves to the app's Vite as well — one pair, and the check passes.
  */
-async function appPluginRsc() {
+async function appPluginRsc(options = {}) {
     try {
         // Resolved against a file *in* the root, since a directory specifier
         // resolves relative to its parent.
         const fromApp = createRequire(join(projectRoot, 'package.json'));
         const entry = fromApp.resolve('@vitejs/plugin-rsc');
         const mod = (await import(pathToFileURL(entry).href));
-        return (mod.default ?? rsc)();
+        return (mod.default ?? rsc)(options);
     }
     catch {
         // The app does not have its own; one copy, and the bundled import is it.
-        return rsc();
+        return rsc(options);
     }
 }
 //# sourceMappingURL=vite.js.map