@rsc-kit/mcp 0.28.0 → 0.29.0

package/guides/testing.md

@@ -177,6 +177,29 @@ above. For the round trip itself, and for anything that depends on hydration —
 `useField` re-rendering, a navigation, an optimistic update reverting — use
 Playwright against `vite preview`, which serves the real build.
 
+## What a page watches
+
+`watched()` renders a page and says what each region refreshes on - `page`
+for the page's own `refreshOn`, a section's name for each section's - without
+reading the signed names out of the payload:
+
+```ts
+expect(await app.watched('/teams/acme')).toEqual({ page: ['team:acme'], apps: ['team:acme:apps'] })
+```
+
+With a Go or Laravel backend stood in by `host`, `testChanges()` answers the
+version questions the way the backend would, and its `changed` says a name
+moved - what the backend's webhook would do:
+
+```ts
+import { createTestApp, testChanges } from '@rsc-kit/core/testing'
+
+const names = testChanges()
+const app = await createTestApp({ host: { ...names.host, 'Repos.list': () => repos } })
+
+names.changed('team:1:repos')
+```
+
 ## What to test where
 
 | what | how |
@@ -186,5 +209,6 @@ Playwright against `vite preview`, which serves the real build.
 | an api route | call `GET`/`POST` with a `Request` |
 | anything that reads cookies or headers | `withRequest()` |
 | routing, guards, stored pages, status codes | `createTestApp().fetch()` |
+| what a page refreshes on | `createTestApp().watched()` |
 | a client component | React + a DOM |
 | an action over the wire, hydration, navigation | Playwright |

package/guides/where-it-runs.md

@@ -44,6 +44,14 @@ change:
 nitro({ preset: 'vercel', serveStatic: 'inline' })
 ```
 
+## Streams on serverless platforms
+
+`events()` routes and `refreshOn` hold a connection open. On Workers and
+serverless functions each isolate or instance watches for its own tabs, a
+platform's request limits cut streams (they reconnect and catch up), and
+versions must live in a shared store. [On Workers and serverless](/guides/live-data#on-workers-and-serverless)
+has the details.
+
 ## Running it
 
 ```bash

package/guides/your-own-backend.md

@@ -66,6 +66,15 @@ run *as the visitor*: your session middleware reads the cookie and finds the
 same person the page is being rendered for. During a build there is no
 visitor and the headers are absent.
 
+**Arguments that do not fit the function are a failure, not a refusal.**
+Too few, or a value your language cannot decode into the parameter's type:
+answer 500 with `error`, as Go and Laravel do. The renderer's calls are typed
+from your own manifest, so a mismatch is a bug in a caller - most often a
+manifest older than the code - and a 500 is what makes it show up in your
+logs. Extra arguments may be ignored. Values that decode but break your
+rules - an email that is not one - are the input being invalid: a 422 with
+`validationErrors`, below.
+
 **Check the secret first, in constant time, and refuse before dispatch.** This
 endpoint runs functions by name with none of your routing in front of it;
 `hash_equals('', '')` is true in PHP and its equivalents elsewhere, so an
@@ -89,7 +98,7 @@ message to tell an invalid form from a broken server:
 | the input is invalid | 422 | `validationErrors: { "email": ["…"], "address.city": ["…"] }`, `error` |
 | there is no session | 401 | `unauthenticated: true`, `error` |
 | there is one, and still no | 403 | `unauthorized: true`, `error` |
-| go somewhere else | **200** | `redirect: "/login"`, optionally `redirectStatus` (default 307) |
+| go somewhere else | **200** | `redirect: "/login"`, and `redirectStatus` when you mean something other than 307 |
 | refused, with its own status | that status | `error`, `refusalStatus: 429` (any 4xx or 5xx: a 503 while a dependency is down) |
 | the function failed | 500 | `error`, and in development `debug` |
 
@@ -100,7 +109,7 @@ and under `""` for a message about the form itself. `unauthenticated` and
 `ServerAuthorizationError`, so a page answers 401 or 403 the way it would
 have if a JavaScript guard had thrown them. `redirect` travels the path every
 other redirect travels — a real 3xx above a Suspense boundary, a digest below
-one. `revalidate` names [sections](/guides/sections) or `page`, and the answer
+one. `revalidate` names [sections](/guides/live-data) or `page`, and the answer
 to the action carries the re-rendered region with it rather than the browser
 being told to ask again.
 
@@ -108,7 +117,10 @@ Two things that are easy to get wrong:
 
 **A redirect is a 200.** An HTTP client follows a 3xx transparently, so a real
 one here would send the host call itself to the destination and hand whatever
-it found back to the render as the function's result.
+it found back to the render as the function's result. The redirect's own
+status goes in `redirectStatus`; without it the renderer uses 307, which keeps
+the method. Send it whenever your framework says something else - Laravel's
+redirects are 302, so the Laravel package always sends it.
 
 **Refusing is not failing.** A form filled in wrongly is the ordinary case, and
 `validationErrors` is checked before `error` — a reply carrying both is read as
@@ -169,11 +181,19 @@ whole-batch form every call in it waits for the slowest.
 
 Either way, run every call and answer every one — a refusal in the second is
 that call's answer, not a reason to leave the third out. Each call's
-`revalidate` stays with that call. A backend that has not implemented
-batches at all loses nothing but the saving: the renderer reads its "no
-function name" answer as "no batches here" and sends single calls from then
-on. Batches never mix visitors; every call in one carried the same forwarded
-headers.
+`revalidate` stays with that call. Batches never mix visitors; every call in
+one carried the same forwarded headers.
+
+**At most 50 calls.** The renderer never sends more in one batch; a page with
+more is split. Refusing a larger one - 413, before running anything - is a
+safe limit, and Laravel's.
+
+**Batches are not optional.** The renderer always sends calls from the same
+tick together, and an answer that is neither form - whatever its status -
+fails every call in the batch with what your backend said. None is sent
+again one by one: they may have run, and an action run twice is worse than
+one reported as failed. The conformance suite checks batches, so a backend
+that passes it takes them.
 
 ## Route middleware
 
@@ -222,7 +242,9 @@ an action. Every open tab showing it refreshes, with nothing polling. Two
 things to provide:
 
 **A way to say a name changed**, callable from anywhere in your backend. It
-moves the name's version: a number, kept somewhere every instance of your
+moves the name's version to the larger of one past where it was and the
+current time in milliseconds - so a version never comes round again, and an
+old name can be deleted at any time - kept somewhere every instance of your
 backend shares - a cache, a table - since a webhook lands on whichever
 instance the balancer picked. A name never changed is at 0.
 
@@ -236,7 +258,11 @@ how long it would wait:
 Answer `{ "result": { "versions": { ... } } }` with every name in `since`
 whose version differs now, and nothing else - an empty object when none
 does. If you can, hold the call up to `wait` milliseconds for one to move
-and answer the moment it does: that is what makes the refresh immediate. If
+and answer the moment it does: that is what makes the refresh immediate.
+The renderer asks with 5 seconds; hold no longer than `wait`, and never past
+30 seconds, where the renderer gives up on any call. A name you have never
+seen is at 0, compared like any other: held while the asker also holds 0,
+answered the moment it is changed. If
 you cannot - PHP-FPM, a worker that must answer and go - answer at once; the
 renderer asks again on its interval, a couple of seconds apart. Both are
 conformant, and the page is the same.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rsc-kit/mcp",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "description": "An MCP server over what an rsc-kit build decided: the routes, why each one is static or not, and what it costs the browser.",
   "type": "module",
   "license": "MIT",
@@ -34,6 +34,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
+    "create-rsc-kit": "^0.29.0",
     "zod": "^3.25"
   },
   "devDependencies": {