@rsc-kit/core 0.9.0 → 0.11.0

package/dist/appAssets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appAssets.js","sourceRoot":"","sources":["../src/appAssets.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,aAAa;AACb,6CAA6C;AAC7C,uEAAuE;AACvE,0EAA0E;AAC1E,yDAAyD;AACzD,sDAAsD;AACtD,uDAAuD;AACvD,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,2EAA2E;AAC3E,yDAAyD;AACzD,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAE7E,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAkBjD,MAAM,KAAK,GAAG,sCAAsC,CAAA;AAEpD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAA;AAEjC,SAAS,QAAQ,CAAC,GAAW,EAAE,KAAgC;IAC7D,OAAO,WAAW,CAAC,GAAG,CAAC;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,UAAU,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACtF,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IACjC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAElD,OAAO;QACL,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI;QAClF,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/E,SAAS,EACP,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;QAC3F,SAAS,EACP,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;QAChG,OAAO,EACL,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;KAC/F,CAAA;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAErE,OAAO,SAAS,KAAK,KAAK;QACxB,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,MAAM;YAC3C,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,SAAS,KAAK,KAAK;gBACnB,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,SAAS,SAAS,EAAE,CAAA;AAC9B,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,QAAQ,CACtB,MAAiB,EACjB,MAAe;IAEf,MAAM,IAAI,GAA8D,EAAE,CAAA;IAE1E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC,CAAA;IACrG,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IAC9F,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC7F,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAE/E,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IACvG,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;QACpG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAA;IAC7F,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["// Files that describe the app, found by name rather than configured.\n//\n//   src/app/\n//     favicon.ico          <link rel=\"icon\">\n//     icon.png             <link rel=\"icon\">, and the manifest's icons\n//     icon-192.png         …as many as you like; sizes read from the name\n//     apple-icon.png       <link rel=\"apple-touch-icon\">\n//     opengraph-image.png  <meta property=\"og:image\">\n//     twitter-image.png    <meta name=\"twitter:image\">\n//\n// The same bargain as every other file in this directory: put it where it\n// belongs and it works, with nothing to register. Next established these names\n// and there is nothing to gain by inventing different ones — an app moving\n// between the two should not have to rename its favicon.\n//\n// They live in `app/` rather than `public/` on purpose. `public/` is \"serve\n// this verbatim\"; these are read as well as served — an icon's size decides\n// what goes in the manifest, and its presence decides what goes in the head.\n\nimport { existsSync, readdirSync } from 'node:fs'\n\n/** One found file, and where it will be served from. */\nexport interface AppAsset {\n  /** The file's name in the app directory. */\n  file: string\n  /** The url it is served at. */\n  href: string\n}\n\nexport interface AppAssets {\n  favicon: AppAsset | null\n  icons: AppAsset[]\n  appleIcon: AppAsset | null\n  openGraph: AppAsset | null\n  twitter: AppAsset | null\n}\n\nconst IMAGE = /\\.(png|svg|jpg|jpeg|webp|gif|avif)$/i\n\n/**\n * Where these are served from.\n *\n * Their own directory rather than the output root, so an app that happens to\n * have a `public/icon.png` as well is not silently overwritten by one of\n * these, in either direction. The exception is the favicon, which browsers ask\n * for at `/favicon.ico` whatever any markup says.\n */\nexport const ASSET_BASE = '/_app'\n\nfunction assetsIn(dir: string, match: (name: string) => boolean): AppAsset[] {\n  return readdirSync(dir)\n    .filter(match)\n    .sort()\n    .map((file) => ({ file, href: `${ASSET_BASE}/${file}` }))\n}\n\n/** What the app declared by putting a file where it could be found. */\nexport function appAssets(appDir: string): AppAssets {\n  if (!existsSync(appDir)) {\n    return { favicon: null, icons: [], appleIcon: null, openGraph: null, twitter: null }\n  }\n\n  const names = readdirSync(appDir)\n  const has = (name: string) => names.includes(name)\n\n  return {\n    // Served where a browser looks for it regardless of markup: a request for\n    // /favicon.ico goes out whether or not a link tag exists, and answering it\n    // from somewhere else means answering a 404 to the request that matters.\n    favicon: has('favicon.ico') ? { file: 'favicon.ico', href: '/favicon.ico' } : null,\n    icons: assetsIn(appDir, (name) => /^icon[-\\w]*/.test(name) && IMAGE.test(name)),\n    appleIcon:\n      assetsIn(appDir, (name) => /^apple-icon[-\\w]*/.test(name) && IMAGE.test(name))[0] ?? null,\n    openGraph:\n      assetsIn(appDir, (name) => /^opengraph-image[-\\w]*/.test(name) && IMAGE.test(name))[0] ?? null,\n    twitter:\n      assetsIn(appDir, (name) => /^twitter-image[-\\w]*/.test(name) && IMAGE.test(name))[0] ?? null,\n  }\n}\n\nfunction typeOf(file: string): string {\n  const extension = file.slice(file.lastIndexOf('.') + 1).toLowerCase()\n\n  return extension === 'svg'\n    ? 'image/svg+xml'\n    : extension === 'jpg' || extension === 'jpeg'\n      ? 'image/jpeg'\n      : extension === 'ico'\n        ? 'image/x-icon'\n        : `image/${extension}`\n}\n\n/** The head tags these produce, as plain data the generated entry turns into elements. */\nexport function headTags(\n  assets: AppAssets,\n  origin?: string,\n): { tag: 'link' | 'meta'; props: Record<string, string> }[] {\n  const tags: { tag: 'link' | 'meta'; props: Record<string, string> }[] = []\n\n  if (assets.favicon) {\n    tags.push({ tag: 'link', props: { rel: 'icon', href: assets.favicon.href, type: 'image/x-icon' } })\n  }\n\n  for (const icon of assets.icons) {\n    tags.push({ tag: 'link', props: { rel: 'icon', href: icon.href, type: typeOf(icon.file) } })\n  }\n\n  if (assets.appleIcon) {\n    tags.push({ tag: 'link', props: { rel: 'apple-touch-icon', href: assets.appleIcon.href } })\n  }\n\n  // Absolute when the app said where it lives. The og spec asks for an absolute\n  // url and several crawlers still mean it — a relative one is read by some and\n  // ignored by others, which is the worst of both. Relative is what is left\n  // when nothing said, and is better than omitting the tag.\n  const absolute = (href: string) => (origin ? new URL(href, origin).href : href)\n\n  if (assets.openGraph) {\n    tags.push({ tag: 'meta', props: { property: 'og:image', content: absolute(assets.openGraph.href) } })\n  }\n\n  if (assets.twitter) {\n    tags.push({ tag: 'meta', props: { name: 'twitter:image', content: absolute(assets.twitter.href) } })\n    tags.push({ tag: 'meta', props: { name: 'twitter:card', content: 'summary_large_image' } })\n  }\n\n  return tags\n}\n"]}

package/dist/buildReport.d.ts

@@ -0,0 +1,43 @@
+/** One route, as the build left it. */
+export interface ReportedRoute {
+    url: string;
+    component: string;
+    /** frozen | shell | blocked | dynamic | error — see PrerenderResult. */
+    type: string;
+    /** Why it is not frozen, in the words the build printed. */
+    reason: string | null;
+    /** Something true and worth knowing that is not a failure. */
+    warning: string | null;
+    /** Gzipped bytes of javascript this url makes the browser download. */
+    clientJs: number | null;
+}
+export interface ReportedApiRoute {
+    url: string;
+    name: string;
+    type: string;
+    reason: string | null;
+}
+export interface BuildReport {
+    version: 1;
+    /** Routes that render, in the order the build reported them. */
+    routes: ReportedRoute[];
+    /** route.ts endpoints. */
+    apis: ReportedApiRoute[];
+    totals: {
+        static: number;
+        partial: number;
+        dynamic: number;
+        failed: number;
+    };
+}
+/** The name the report is written under, inside the build's own directory. */
+export declare const REPORT_FILE = "build-report.json";
+export declare function buildReport(routes: ReportedRoute[], apis: ReportedApiRoute[]): string;
+/**
+ * The routes worth asking about, most interesting first.
+ *
+ * "Interesting" is not a judgement about the app — it is the order someone
+ * looking for a problem reads in. A failure first, then a page that could not
+ * be stored at all, then one that ships a shell, then the ones that are fine.
+ */
+export declare function byInterest(routes: ReportedRoute[]): ReportedRoute[];

package/dist/buildReport.js

@@ -0,0 +1,40 @@
+// What the build decided, written down.
+//
+// The classification exists already — it is printed as the build runs, and
+// then it is gone. That is fine for a person watching a terminal and useless
+// for anything that wants to ask afterwards: a CI step asserting nothing
+// regressed, an editor, an agent being asked why a page is slow.
+//
+// So the same facts go to a file. Not a new computation and not a second
+// source of truth — the report is written from the results the build already
+// produced, in the same pass that prints them.
+/** The name the report is written under, inside the build's own directory. */
+export const REPORT_FILE = 'build-report.json';
+export function buildReport(routes, apis) {
+    const count = (...types) => routes.filter((r) => types.includes(r.type)).length +
+        apis.filter((a) => types.includes(a.type)).length;
+    const report = {
+        version: 1,
+        routes,
+        apis,
+        totals: {
+            static: count('frozen'),
+            partial: count('shell'),
+            dynamic: count('blocked', 'dynamic'),
+            failed: count('error'),
+        },
+    };
+    return JSON.stringify(report, null, 2) + '\n';
+}
+/**
+ * The routes worth asking about, most interesting first.
+ *
+ * "Interesting" is not a judgement about the app — it is the order someone
+ * looking for a problem reads in. A failure first, then a page that could not
+ * be stored at all, then one that ships a shell, then the ones that are fine.
+ */
+export function byInterest(routes) {
+    const rank = { error: 0, blocked: 1, shell: 2, dynamic: 3, frozen: 4 };
+    return [...routes].sort((a, b) => (rank[a.type] ?? 9) - (rank[b.type] ?? 9) || a.url.localeCompare(b.url));
+}
+//# sourceMappingURL=buildReport.js.map

package/dist/buildReport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildReport.js","sourceRoot":"","sources":["../src/buildReport.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,yEAAyE;AACzE,iEAAiE;AACjE,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,+CAA+C;AAqC/C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,WAAW,GAAG,mBAAmB,CAAA;AAE9C,MAAM,UAAU,WAAW,CACzB,MAAuB,EACvB,IAAwB;IAExB,MAAM,KAAK,GAAG,CAAC,GAAG,KAAe,EAAE,EAAE,CACnC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QACnD,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;IAEnD,MAAM,MAAM,GAAgB;QAC1B,OAAO,EAAE,CAAC;QACV,MAAM;QACN,IAAI;QACJ,MAAM,EAAE;YACN,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;YACvB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;YACvB,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC;YACpC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC;SACvB;KACF,CAAA;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,MAAuB;IAChD,MAAM,IAAI,GAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;IAE9F,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAClF,CAAA;AACH,CAAC","sourcesContent":["// What the build decided, written down.\n//\n// The classification exists already — it is printed as the build runs, and\n// then it is gone. That is fine for a person watching a terminal and useless\n// for anything that wants to ask afterwards: a CI step asserting nothing\n// regressed, an editor, an agent being asked why a page is slow.\n//\n// So the same facts go to a file. Not a new computation and not a second\n// source of truth — the report is written from the results the build already\n// produced, in the same pass that prints them.\n\n/** One route, as the build left it. */\nexport interface ReportedRoute {\n  url: string\n  component: string\n  /** frozen | shell | blocked | dynamic | error — see PrerenderResult. */\n  type: string\n  /** Why it is not frozen, in the words the build printed. */\n  reason: string | null\n  /** Something true and worth knowing that is not a failure. */\n  warning: string | null\n  /** Gzipped bytes of javascript this url makes the browser download. */\n  clientJs: number | null\n}\n\nexport interface ReportedApiRoute {\n  url: string\n  name: string\n  type: string\n  reason: string | null\n}\n\nexport interface BuildReport {\n  version: 1\n  /** Routes that render, in the order the build reported them. */\n  routes: ReportedRoute[]\n  /** route.ts endpoints. */\n  apis: ReportedApiRoute[]\n  totals: {\n    static: number\n    partial: number\n    dynamic: number\n    failed: number\n  }\n}\n\n/** The name the report is written under, inside the build's own directory. */\nexport const REPORT_FILE = 'build-report.json'\n\nexport function buildReport(\n  routes: ReportedRoute[],\n  apis: ReportedApiRoute[],\n): string {\n  const count = (...types: string[]) =>\n    routes.filter((r) => types.includes(r.type)).length +\n    apis.filter((a) => types.includes(a.type)).length\n\n  const report: BuildReport = {\n    version: 1,\n    routes,\n    apis,\n    totals: {\n      static: count('frozen'),\n      partial: count('shell'),\n      dynamic: count('blocked', 'dynamic'),\n      failed: count('error'),\n    },\n  }\n\n  return JSON.stringify(report, null, 2) + '\\n'\n}\n\n/**\n * The routes worth asking about, most interesting first.\n *\n * \"Interesting\" is not a judgement about the app — it is the order someone\n * looking for a problem reads in. A failure first, then a page that could not\n * be stored at all, then one that ships a shell, then the ones that are fine.\n */\nexport function byInterest(routes: ReportedRoute[]): ReportedRoute[] {\n  const rank: Record<string, number> = { error: 0, blocked: 1, shell: 2, dynamic: 3, frozen: 4 }\n\n  return [...routes].sort(\n    (a, b) => (rank[a.type] ?? 9) - (rank[b.type] ?? 9) || a.url.localeCompare(b.url),\n  )\n}\n"]}

package/dist/host.d.ts

@@ -59,7 +59,19 @@ export interface RscEngine {
     handleQuery?(id: string, args: string, report?: (error: unknown) => string): Promise<{
         stream: ReadableStream;
         cacheControl: string;
+    } | {
+        status: number;
+        message: string;
+        errors?: Record<string, string[]>;
     } | null>;
+    /**
+     * Answer a `route.ts` — an api endpoint rather than a page.
+     *
+     * Optional so a host can be pointed at a bundle built before these existed;
+     * without it the url falls through to page routing, which is what that
+     * bundle would have done anyway.
+     */
+    handleApiRoute?(name: string, request: Request, params: Record<string, string>, allow: string): Promise<Response>;
 }
 export interface RscHostOptions {
     /** The built server bundle — `import * as engine from './build/rsc/index.js'`. */

package/dist/host.js

@@ -13,11 +13,12 @@
 //
 //   const rsc = createRscHandler({ engine, manifest, assets })
 //   Bun.serve({ fetch: (req) => rsc(req).then((r) => r ?? new Response('', { status: 404 })) })
-import { matchIntercept, matchRoute, retentionKey, sharedDepth } from './routing.js';
+import { allowFor, matchApiRoute, matchIntercept, matchRoute, retentionKey, sharedDepth } from './routing.js';
 import { pathKey, patternKey } from './prerender.js';
+import { apiKey } from './apiPrerender.js';
 import { withRevalidation } from './revalidate.js';
 export { revalidate } from './revalidate.js';
-import { withRedirect } from './redirect.js';
+import { currentNotFound, withRedirect } from './redirect.js';
 import { withCache } from './cache.js';
 import { withRequest, withResponseDraft } from './request.js';
 export { redirect } from './redirect.js';
@@ -315,6 +316,22 @@ export function createRscHandler(options) {
             }
             return await handleAction(request, url);
         }
+        // Api routes first. A url is one or the other, and a page that shares a
+        // path with a route.ts would otherwise win by accident of ordering.
+        const api = matchApiRoute(routes, url.pathname);
+        if (api && engine.handleApiRoute) {
+            // The guards above it run first, exactly as they would for a page in the
+            // same directory. A route.ts is colocated with the pages it belongs
+            // with, so adding one under a guarded path must not open a way around
+            // the guard.
+            const refused = await refuseApiUnlessAllowed(request, api);
+            if (refused)
+                return refused;
+            const stored = await frozenApi(request, url, api);
+            if (stored)
+                return stored;
+            return await engine.handleApiRoute(api.route.name, request, api.params, allowFor(api.route));
+        }
         if (request.method === 'GET' && url.pathname === HEADER.queryPath) {
             // Same check as an action, for a smaller reason: a cross-origin page
             // cannot read this answer — CORS sees to that — but it can still cause
@@ -407,6 +424,14 @@ export function createRscHandler(options) {
                     const refused = taken();
                     if (refused)
                         return redirectResponse(refused, false);
+                    // The page said this url names nothing. Null rather than a rendered
+                    // 404: null is already how this host says "not mine", and the caller
+                    // in front answers it with not-found.tsx and the right status. One
+                    // path, so a page that calls notFound() and a url that matched no
+                    // route are indistinguishable to whoever is asking — which is the
+                    // point of a 404.
+                    if (currentNotFound())
+                        return null;
                     // A guard refusing is not a failed render. Without this a visitor
                     // who may not see the page gets a 500, which reads as the
                     // application being broken rather than them being turned away —
@@ -420,6 +445,12 @@ export function createRscHandler(options) {
                 const early = taken();
                 if (early)
                     return redirectResponse(early, false);
+                // Above every boundary, so the shell resolving means the page did not
+                // refuse itself. Deeper than that and the shell is already on the wire
+                // — the digest carries it to the boundary instead, and the status
+                // stays 200 because the status line has gone.
+                if (currentNotFound())
+                    return null;
                 return new Response(appendLateRedirect(htmlStream, taken), {
                     headers: withVersion({
                         'Content-Type': HTML_TYPE,
@@ -447,6 +478,10 @@ export function createRscHandler(options) {
                 const refused = taken();
                 if (refused)
                     return redirectResponse(refused, true);
+                // Same answer the document path gives, so a client navigating to a
+                // url and a browser loading it fresh agree about whether it exists.
+                if (currentNotFound())
+                    return null;
                 // A payload request is guarded exactly as the document is. Narrowing
                 // a request must never narrow what is checked.
                 const status = refusalStatus(error);
@@ -493,6 +528,58 @@ export function createRscHandler(options) {
      * not cacheable by a shared cache at all, so handing one to an edge that
      * exists to cache things is an invitation to a mistake nobody would see.
      */
+    /**
+     * The answer the build stored for this route, if it stored one.
+     *
+     * Three conditions, each closing a way the stored answer could be wrong:
+     *
+     * GET or HEAD, because a stored answer to a POST is a stored answer to
+     * something that was meant to happen once.
+     *
+     * No query string. The build answered the bare url, and a route that reads
+     * the query would answer differently for every one — so rather than trying
+     * to detect that during the probe, anything carrying a query goes to the
+     * route itself. A stored answer is for the url it was stored for.
+     *
+     * No middleware. A guarded route answers differently depending on who is
+     * asking, which is the point of the guard; one stored answer served to
+     * everyone is how a guard is quietly removed. The build refuses to store one
+     * for the same reason, so this is the second of two locks on the same door.
+     */
+    async function frozenApi(request, url, api) {
+        if (!options.prerendered)
+            return null;
+        if (request.method !== 'GET' && request.method !== 'HEAD')
+            return null;
+        if (api.route.middleware.length > 0)
+            return null;
+        const stored = await options.prerendered(apiKey(url.pathname));
+        if (stored === null)
+            return null;
+        let frozen;
+        try {
+            frozen = JSON.parse(stored);
+        }
+        catch {
+            // A file this host wrote and cannot read back is a bug, not a request
+            // to answer badly. Falling through runs the route, which is correct.
+            return null;
+        }
+        // The build said whether this route's answer depends on the query. A route
+        // that never awaited searchParams gives the same answer whatever is on the
+        // end of the url — which matters more than it sounds, because every
+        // ?utm_source= and ?fbclid= would otherwise miss the stored answer.
+        //
+        // Defaulting to varying when the field is absent: a file written by an
+        // older build did not record this, and serving it for every query would be
+        // guessing on the unsafe side.
+        if (url.search && frozen.varies !== false)
+            return null;
+        return new Response(request.method === 'HEAD' ? null : frozen.body, {
+            status: frozen.status,
+            headers: withVersion(Object.fromEntries(frozen.headers)),
+        });
+    }
     async function servePprShell(request, url, read) {
         if (request.method !== 'GET' && request.method !== 'HEAD')
             return null;
@@ -868,6 +955,56 @@ export function createRscHandler(options) {
             }),
         });
     }
+    /**
+     * Run an api route's middleware, and answer instead of it if one refuses.
+     *
+     * Separate from the page version because the answer is different. A caller
+     * that is not a browser gets a status rather than a redirect to a login page
+     * it cannot render — a fetch would follow the 302 and hand back the login
+     * HTML as though it were the api's answer.
+     */
+    async function refuseApiUnlessAllowed(request, api) {
+        if (!(api.route.middleware?.length ?? 0))
+            return null;
+        // A route that declares middleware and an engine that cannot run it is not
+        // "no middleware" — it is a check that silently does not happen.
+        if (!engine.runRouteMiddleware) {
+            return new Response('This route declares middleware, and the engine cannot run it. ' +
+                'Rebuild the app against the current @rsc-kit/core.', { status: 500 });
+        }
+        return await withRedirect(async (taken) => {
+            try {
+                await engine.runRouteMiddleware(api.route.name, api.params);
+            }
+            catch (error) {
+                // A redirect is a refusal here. Where it was going is told rather than
+                // followed, so a client can decide for itself.
+                const redirected = taken();
+                if (redirected) {
+                    return new Response('Unauthorized', {
+                        status: 401,
+                        headers: { 'X-RSC-Redirect': redirected.location },
+                    });
+                }
+                // A visitor who may not use this endpoint has not caused a server
+                // error, and answering 500 makes a guarded route indistinguishable
+                // from a broken one. Null means the middleware threw something that is
+                // not a refusal, which is a real fault and says so.
+                const status = refusalStatus(error);
+                if (status === null)
+                    throw error;
+                return new Response(status === 401 ? 'Unauthorized' : 'Forbidden', { status });
+            }
+            const redirected = taken();
+            if (redirected) {
+                return new Response('Unauthorized', {
+                    status: 401,
+                    headers: { 'X-RSC-Redirect': redirected.location },
+                });
+            }
+            return null;
+        });
+    }
     async function handleQuery(request, url) {
         if (!engine.handleQuery)
             return null;
@@ -894,6 +1031,15 @@ export function createRscHandler(options) {
         // Unknown id and registered-but-not-a-query are the same answer on purpose.
         if (!answered)
             return new Response('No such query', { status: 404 });
+        // The read refused. Answered as a status with the message in the body, so
+        // the fetcher rejects with something a person can read — a failure rendered
+        // into a 200 would reach the browser as React's opaque error instead.
+        if (!('stream' in answered)) {
+            return new Response(JSON.stringify({ message: answered.message, errors: answered.errors }), {
+                status: answered.status,
+                headers: withVersion({ 'Content-Type': 'application/json', 'Cache-Control': PER_CLIENT }),
+            });
+        }
         return new Response(answered.stream, {
             headers: withVersion({
                 'Content-Type': FLIGHT_TYPE,