@rshono/core 1.0.0-rc.12 → 1.0.0-rc.14

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Lasse Tange
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -15,10 +15,12 @@ One required file (`src/routes.ts`), one optional file (`src/server.ts`), and yo
 streaming SSR with RSC hydration, server actions with progressive enhancement, soft navigation, build-time
 prerendering, and hard env/secret safety.
 
-> **Alpha.** The framework has an end-to-end suite of its own (see [Testing](#testing)), but it is built on
-> Rspack's experimental RSC support (`rspack.experiments.rsc`) and `react-server-dom-rspack`, which is still
-> `0.0.x`. Those two move underneath us, so `@rspack/core` and `react-server-dom-rspack` are pinned to exact
-> versions and a release of rshono is what moves them.
+> **Release candidate.** The framework itself is covered end to end (see [Testing](#testing)) and its API is
+> settled. What is not settled underneath it: Rspack's RSC support is an experimental API
+> (`rspack.experiments.rsc`) and `react-server-dom-rspack` is still `0.0.x`. Both are pinned to exact
+> versions — in the manifests and in workspace overrides — and a release of rshono is what moves them, so an
+> upstream change reaches you as a tested release rather than as a broken install. That is the whole of the
+> caveat, and it is the reason to read the [changelog](../../CHANGELOG.md) before upgrading.
 
 **Full documentation: [rshono.com/docs](https://www.rshono.com/docs).**
 
@@ -221,7 +223,7 @@ that runs this, the environment is what sets them. [Configuration docs](https://
 
 The defaults, in short: untrusted proxy headers, `nosniff` / `Referrer-Policy` / `X-Frame-Options` on
 every response (a floor your own `secureHeaders()` overrides),
-`private, no-cache` plus `Vary: Accept` on dynamic pages, `public, max-age=300` and a weak `ETag` on
+`private, no-cache` plus `Vary: RSC` on dynamic pages, `public, max-age=300` and a weak `ETag` on
 prerendered ones, and errors redacted in production — with one `onServerError()` funnel for reporting them
 and three fallbacks (a fatal client overlay, a visible 500 document, a reported bootstrap failure) so a
 failure is never a blank screen.
@@ -263,7 +265,19 @@ Every target streams, which is the bar a new one has to clear.
   on Vercel, `streamifyResponse` plus a `RESPONSE_STREAM` Function URL on Lambda. Getting those right is what
   the presets are for.
 - **Prerendered pages are never CDN-served**: one URL answers with a document or a flight payload depending on
-  `Accept`, and a path-keyed CDN cannot choose. `/_static` and `public/` do go straight to the CDN.
+  the `RSC` request header, and a path-keyed CDN cannot choose. `/_static` and `public/` do go straight to the
+  CDN.
+- **The serverless targets bundle your dependencies**; `node` bundles only the ones a `'use client'` component
+  pulls in. A function is an uploaded directory with no `node_modules` to resolve against, so `vercel`,
+  `aws-lambda` and `cloudflare` compile everything in. The cost is that a native addon — or a package that
+  reads its own files off disk — fails the build on those targets rather than the deploy; reach for the
+  `rspack` hook, or deploy to `node`.
+
+  On `node` a server component's dependencies stay external and resolve from `node_modules`, but anything
+  reachable from a `'use client'` component is compiled in on every target. It has to be: the `PUBLIC_`-only
+  `process.env` view is applied by a loader, and a loader cannot run on a module the bundle only imports by
+  name — an external third-party client component would be SSR'd against the real environment. Nothing is
+  given up, since the same module is in the browser bundle and so was always required to be bundleable.
 
 [Deployment docs](https://www.rshono.com/docs/deployment), including Cloudflare bindings and the AWS setup.
 
@@ -274,6 +288,11 @@ Every target streams, which is the bar a new one has to clear.
   `react-server-dom-rspack` requires).
 - No response compression, no base path (`siteUrl` is a bare origin), and wildcard, optional and regex
   params cannot be prerendered.
+- **No link prefetching**, by choice: a link is one fetch at click time and nothing before it. Speculative
+  fetching on hover spends every visitor's bandwidth to help some of them — so a navigation here costs a
+  round trip that Next.js and TanStack Start have usually already paid.
+- No incremental static regeneration: `render: 'static'` is decided at build time, and a static page changes
+  when you rebuild.
 - Scroll restoration is the browser's (`history.scrollRestoration = 'auto'`).
 - The dev proxy doesn't forward WebSocket upgrades to a custom sub-app; production is unaffected.
 - Dev source maps embed the original source of `'use server'` modules (dev binds 127.0.0.1 only, and
@@ -313,5 +332,7 @@ Two coordinated Rspack compilers, using native RSC support (`rspack.experiments.
 In dev the CLI watches both bundles, runs the server bundle in a worker thread (restarted per rebuild,
 requests gated on readiness so nothing drops), and fronts everything on one port with static serving and an
 SSE channel: client edits hot-apply via react-refresh, server component edits re-fetch the payload in place,
-and browser state survives both. In production `dist/server/main.mjs` is self-contained — React, Hono and the
-framework are bundled in; your other dependencies resolve from `node_modules`.
+and browser state survives both. In production `dist/server/main.mjs` has React, Hono and the framework
+bundled in. On `node` your server-side dependencies still resolve from `node_modules` beside it; on the
+serverless targets they are bundled too, because nothing installs them there. Whatever a `'use client'`
+component reaches is bundled on every target, which is what lets the env shadow cover it.

package/bin/rshono.mjs

@@ -1,10 +1,9 @@
 #!/usr/bin/env node
-// Thin launcher for the compiled CLI. Everything it does has to happen *before* the CLI module
-// graph loads, which is why the import below is dynamic rather than a static one at the top.
+// Thin launcher for the compiled CLI. Everything here has to happen before the CLI module graph loads, which is
+// why the import at the bottom is dynamic.
 const args = process.argv.slice(2);
 
-// `build` and `start` are the production commands, so they default NODE_ENV accordingly — the
-// value is read during config resolution and baked into the bundle, so it has to be set this early.
+// The production commands default NODE_ENV, which is read during config resolution and baked into the bundle.
 if ((args[0] === 'build' || args[0] === 'start') && !process.env.NODE_ENV) {
   process.env.NODE_ENV = 'production';
 }

package/dist/builder/env-shadow-loader.cjs

@@ -1,14 +1,33 @@
 'use strict';
-const DIRECTIVE_PROLOGUE = /^(?:\s|\/\/[^\n]*(?:\n|$)|\/\*[\s\S]*?\*\/)*(?:(['"])use [a-z -]+\1\s*;?)?/;
+
+/** Whitespace and comments — what may sit before or between directives without ending the prologue. */
+const TRIVIA = '(?:\\s|//[^\\n]*(?:\\n|$)|/\\*[\\s\\S]*?\\*/)*';
+/** One directive: `'use strict'`, `"use client"`, `'use server'`. The backreference keeps the quotes matched. */
+const DIRECTIVE = '([\'"])use [a-z -]+\\1\\s*;?';
+
+/**
+ * The whole directive prologue, so the prelude below is inserted *after* every directive rather than after the
+ * first one.
+ *
+ * The repetition is load-bearing. A module with two directives — `"use strict"` beside `'use client'`, which is
+ * ordinary output from a published component library, in either order — would otherwise take the prelude
+ * *between* them, and a directive preceded by a statement is just an expression: whichever came second would
+ * silently stop being a directive. That was survivable while this loader only saw the app's own hand-written
+ * source, where `'use client'` comes first and alone; it stopped being survivable when the rule widened to
+ * cover `node_modules` (see the SSR-layer rule in `rspack-config.ts`).
+ *
+ * Each repetition has to consume a whole directive, so the nested quantifiers cannot loop on an empty match.
+ */
+const DIRECTIVE_PROLOGUE = new RegExp(`^${TRIVIA}(?:${DIRECTIVE}${TRIVIA})*`);
 
 /**
  * Shadows `process.env` with the PUBLIC_-only view inside SSR-layer modules, so a secret read from a
- * `'use client'` component renders empty on the server instead of leaking into the HTML stream (and
- * SSR output keeps agreeing with hydration, which sees the same view via DefinePlugin).
+ * `'use client'` component renders empty on the server rather than leaking into the HTML stream — and SSR
+ * keeps agreeing with hydration, which sees the same view via DefinePlugin.
  *
- * This is a security control, so it fails the build rather than passing source through when it can't
- * confirm which layer a module is in — `_module` is a private Rspack field, and silently no-op'ing
- * if a future version renames it would drop the guarantee with nothing to notice it.
+ * A security control, so it fails the build rather than passing source through when it cannot confirm a
+ * module's layer: `_module` is a private Rspack field, and a silent no-op if it were renamed would drop the
+ * guarantee with nothing to notice.
  */
 module.exports = function envShadowLoader(source) {
   if (!source.includes('process.env')) return source;

package/dist/builder/page-files.js

@@ -1,14 +1,14 @@
 /**
- * Finds the page modules named by inline `component: () => import('…')` thunks in `routes.ts`, so the
- * server compiler can put `page-entry-loader.cjs` in front of exactly those files and inject their
- * `'use server-entry'` directive. A page wired up any other way declares the directive itself.
+ * Finds the page modules named by inline `component: () => import('…')` thunks in `routes.ts`, so the server
+ * compiler can put `page-entry-loader.cjs` in front of exactly those files. A page wired up any other way
+ * declares its `'use server-entry'` directive itself.
  */
 import { readFileSync, statSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 const COMPONENT_THUNK = /component:\s*(?:async\s*)?\(\s*\)\s*=>\s*import\(\s*(['"])([^'"]+)\1\s*\)/g;
 const EXTENSIONS = ['.tsx', '.ts', '.jsx', '.js'];
-// Index candidates go through `join` rather than `base + '/index…'`: these paths are compared against
-// Rspack's own resource paths, and a hardcoded `/` stores one no Windows resource will ever equal.
+// `join` rather than `base + '/index…'`: these are compared against Rspack's own resource paths, which on
+// Windows carry backslashes.
 function resolveCandidates(base) {
     return [...EXTENSIONS.map((ext) => base + ext), ...EXTENSIONS.map((ext) => join(base, `index${ext}`)), base];
 }

package/dist/builder/page-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"page-files.js","sourceRoot":"","sources":["../../src/builder/page-files.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,MAAM,eAAe,GAAG,4EAA4E,CAAC;AAErG,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAElD,sGAAsG;AACtG,mGAAmG;AACnG,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,MAAc,EAAE,IAAiB;IACjF,IAAI,CAAC,KAAK,EAAE,CAAC;IACb,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAwB,CAAC;QAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;aAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACpB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * Finds the page modules named by inline `component: () => import('…')` thunks in `routes.ts`, so the\n * server compiler can put `page-entry-loader.cjs` in front of exactly those files and inject their\n * `'use server-entry'` directive. A page wired up any other way declares the directive itself.\n */\nimport { readFileSync, statSync } from 'node:fs';\nimport { dirname, join, resolve } from 'node:path';\n\nconst COMPONENT_THUNK = /component:\\s*(?:async\\s*)?\\(\\s*\\)\\s*=>\\s*import\\(\\s*(['\"])([^'\"]+)\\1\\s*\\)/g;\n\nconst EXTENSIONS = ['.tsx', '.ts', '.jsx', '.js'];\n\n// Index candidates go through `join` rather than `base + '/index…'`: these paths are compared against\n// Rspack's own resource paths, and a hardcoded `/` stores one no Windows resource will ever equal.\nfunction resolveCandidates(base: string): string[] {\n  return [...EXTENSIONS.map((ext) => base + ext), ...EXTENSIONS.map((ext) => join(base, `index${ext}`)), base];\n}\n\nfunction isFile(path: string): boolean {\n  try {\n    return statSync(path).isFile();\n  } catch {\n    return false;\n  }\n}\n\nexport function scanPageFiles(routesFile: string, srcDir: string, into: Set<string>): void {\n  into.clear();\n  let source: string;\n  try {\n    source = readFileSync(routesFile, 'utf8');\n  } catch {\n    return;\n  }\n  for (const match of source.matchAll(COMPONENT_THUNK)) {\n    const spec = match[2];\n    let base: string | undefined;\n    if (spec.startsWith('.')) base = resolve(dirname(routesFile), spec);\n    else if (spec.startsWith('@/')) base = resolve(srcDir, spec.slice(2));\n    if (!base) continue;\n    for (const candidate of resolveCandidates(base)) {\n      if (isFile(candidate)) {\n        into.add(candidate);\n        break;\n      }\n    }\n  }\n}\n"]}
+{"version":3,"file":"page-files.js","sourceRoot":"","sources":["../../src/builder/page-files.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,MAAM,eAAe,GAAG,4EAA4E,CAAC;AAErG,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAElD,0GAA0G;AAC1G,6BAA6B;AAC7B,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,MAAc,EAAE,IAAiB;IACjF,IAAI,CAAC,KAAK,EAAE,CAAC;IACb,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAwB,CAAC;QAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;aAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACpB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * Finds the page modules named by inline `component: () => import('…')` thunks in `routes.ts`, so the server\n * compiler can put `page-entry-loader.cjs` in front of exactly those files. A page wired up any other way\n * declares its `'use server-entry'` directive itself.\n */\nimport { readFileSync, statSync } from 'node:fs';\nimport { dirname, join, resolve } from 'node:path';\n\nconst COMPONENT_THUNK = /component:\\s*(?:async\\s*)?\\(\\s*\\)\\s*=>\\s*import\\(\\s*(['\"])([^'\"]+)\\1\\s*\\)/g;\n\nconst EXTENSIONS = ['.tsx', '.ts', '.jsx', '.js'];\n\n// `join` rather than `base + '/index…'`: these are compared against Rspack's own resource paths, which on\n// Windows carry backslashes.\nfunction resolveCandidates(base: string): string[] {\n  return [...EXTENSIONS.map((ext) => base + ext), ...EXTENSIONS.map((ext) => join(base, `index${ext}`)), base];\n}\n\nfunction isFile(path: string): boolean {\n  try {\n    return statSync(path).isFile();\n  } catch {\n    return false;\n  }\n}\n\nexport function scanPageFiles(routesFile: string, srcDir: string, into: Set<string>): void {\n  into.clear();\n  let source: string;\n  try {\n    source = readFileSync(routesFile, 'utf8');\n  } catch {\n    return;\n  }\n  for (const match of source.matchAll(COMPONENT_THUNK)) {\n    const spec = match[2];\n    let base: string | undefined;\n    if (spec.startsWith('.')) base = resolve(dirname(routesFile), spec);\n    else if (spec.startsWith('@/')) base = resolve(srcDir, spec.slice(2));\n    if (!base) continue;\n    for (const candidate of resolveCandidates(base)) {\n      if (isFile(candidate)) {\n        into.add(candidate);\n        break;\n      }\n    }\n  }\n}\n"]}

package/dist/builder/public-env.d.ts

@@ -1,8 +1,9 @@
 /**
- * The `process.env` view compiled into the browser bundle: `NODE_ENV` plus the `PUBLIC_`-prefixed
- * variables. Everything else stays server-only — a stray read of it in client code becomes
- * `undefined` rather than shipping the value. Also what `env-shadow-loader.cjs` shadows SSR-layer
- * modules with, so the server renders the same thing the browser hydrates.
+ * The `process.env` view compiled into the browser bundle: `NODE_ENV` plus the `PUBLIC_`-prefixed variables.
+ * A stray read of anything else in client code becomes `undefined` rather than shipping the value.
+ *
+ * Also what `env-shadow-loader.cjs` shadows SSR-layer modules with, so the server renders what the browser
+ * hydrates.
  */
 export declare function publicEnv(isDev: boolean): Record<string, string>;
 //# sourceMappingURL=public-env.d.ts.map

package/dist/builder/public-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-env.d.ts","sourceRoot":"","sources":["../../src/builder/public-env.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGhE"}
+{"version":3,"file":"public-env.d.ts","sourceRoot":"","sources":["../../src/builder/public-env.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGhE"}

package/dist/builder/public-env.js

@@ -1,8 +1,9 @@
 /**
- * The `process.env` view compiled into the browser bundle: `NODE_ENV` plus the `PUBLIC_`-prefixed
- * variables. Everything else stays server-only — a stray read of it in client code becomes
- * `undefined` rather than shipping the value. Also what `env-shadow-loader.cjs` shadows SSR-layer
- * modules with, so the server renders the same thing the browser hydrates.
+ * The `process.env` view compiled into the browser bundle: `NODE_ENV` plus the `PUBLIC_`-prefixed variables.
+ * A stray read of anything else in client code becomes `undefined` rather than shipping the value.
+ *
+ * Also what `env-shadow-loader.cjs` shadows SSR-layer modules with, so the server renders what the browser
+ * hydrates.
  */
 export function publicEnv(isDev) {
     const entries = Object.entries(process.env).filter((entry) => entry[0].startsWith('PUBLIC_') && entry[1] !== undefined);

package/dist/builder/public-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"public-env.js","sourceRoot":"","sources":["../../src/builder/public-env.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACnJ,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAC5F,CAAC","sourcesContent":["/**\n * The `process.env` view compiled into the browser bundle: `NODE_ENV` plus the `PUBLIC_`-prefixed\n * variables. Everything else stays server-only — a stray read of it in client code becomes\n * `undefined` rather than shipping the value. Also what `env-shadow-loader.cjs` shadows SSR-layer\n * modules with, so the server renders the same thing the browser hydrates.\n */\nexport function publicEnv(isDev: boolean): Record<string, string> {\n  const entries = Object.entries(process.env).filter((entry): entry is [string, string] => entry[0].startsWith('PUBLIC_') && entry[1] !== undefined);\n  return { NODE_ENV: isDev ? 'development' : 'production', ...Object.fromEntries(entries) };\n}\n"]}
+{"version":3,"file":"public-env.js","sourceRoot":"","sources":["../../src/builder/public-env.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACnJ,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAC5F,CAAC","sourcesContent":["/**\n * The `process.env` view compiled into the browser bundle: `NODE_ENV` plus the `PUBLIC_`-prefixed variables.\n * A stray read of anything else in client code becomes `undefined` rather than shipping the value.\n *\n * Also what `env-shadow-loader.cjs` shadows SSR-layer modules with, so the server renders what the browser\n * hydrates.\n */\nexport function publicEnv(isDev: boolean): Record<string, string> {\n  const entries = Object.entries(process.env).filter((entry): entry is [string, string] => entry[0].startsWith('PUBLIC_') && entry[1] !== undefined);\n  return { NODE_ENV: isDev ? 'development' : 'production', ...Object.fromEntries(entries) };\n}\n"]}

package/dist/builder/react-versions.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Fails the build when `react` and `react-dom` resolve to different versions, and warns when they are not the
+ * version this release was tested with.
+ *
+ * The mismatch is an error because it never works. A different minor is only a warning: upstream declares
+ * `^19.1.0` and may well be right, and refusing to build would make rshono the reason an app cannot take a
+ * React release — a worse failure than the one it would prevent.
+ *
+ * @param rootDir - The project root, so resolution follows the *app's* `node_modules` rather than the
+ *   framework's.
+ */
+export declare function checkReactVersions(rootDir: string): void;
+//# sourceMappingURL=react-versions.d.ts.map

package/dist/builder/react-versions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react-versions.d.ts","sourceRoot":"","sources":["../../src/builder/react-versions.ts"],"names":[],"mappings":"AA6CA;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAyBxD"}

package/dist/builder/react-versions.js

@@ -0,0 +1,74 @@
+/**
+ * The one dependency check the framework makes on an app: that `react` and `react-dom` are the same build.
+ *
+ * React Server Components couple the two across bundles — `react-server-dom-rspack` reaches into
+ * `ReactSharedInternals` and emits a flight payload the *matching* `react-dom` has to parse — so a split
+ * resolution is not version skew to be tolerated. It is a crash inside minified React at render time, with
+ * nothing in the message pointing at the cause.
+ *
+ * The monorepo prevents it with `overrides` in `pnpm-workspace.yaml` and `packages/create` pins both exactly
+ * for the same reason, because a generated app has no overrides to rely on. Neither helps an app that grew
+ * past its scaffold, which is why the check lives here — on the one path every `dev` and `build` takes.
+ */
+import { createRequire } from 'node:module';
+import { join } from 'node:path';
+/**
+ * The React this release was tested against, read off the framework's own manifest rather than restated as a
+ * constant — the pin and the check cannot drift apart that way. `undefined` if it cannot be read, which only
+ * turns the advisory warning off.
+ */
+function testedReactVersion() {
+    try {
+        const manifest = createRequire(import.meta.url)('../../package.json');
+        return manifest.devDependencies?.react;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The version of an installed package as the *app* resolves it, or `undefined` if it has none. */
+function installedVersion(require, name) {
+    try {
+        return require(`${name}/package.json`).version;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** `19.2.8` → `19.2`, for comparing minors without pulling in a semver parser. */
+function minor(version) {
+    return version.split('.', 2).join('.');
+}
+/**
+ * Fails the build when `react` and `react-dom` resolve to different versions, and warns when they are not the
+ * version this release was tested with.
+ *
+ * The mismatch is an error because it never works. A different minor is only a warning: upstream declares
+ * `^19.1.0` and may well be right, and refusing to build would make rshono the reason an app cannot take a
+ * React release — a worse failure than the one it would prevent.
+ *
+ * @param rootDir - The project root, so resolution follows the *app's* `node_modules` rather than the
+ *   framework's.
+ */
+export function checkReactVersions(rootDir) {
+    // Resolved from the project's manifest, so a pnpm layout answers with what the app actually gets.
+    const require = createRequire(join(rootDir, 'package.json'));
+    const react = installedVersion(require, 'react');
+    const reactDom = installedVersion(require, 'react-dom');
+    // Missing altogether is the resolver's to report, against the import that needed it and with the path.
+    if (!react || !reactDom)
+        return;
+    if (react !== reactDom) {
+        throw new Error(`[rshono] react ${react} and react-dom ${reactDom} resolve to different versions.\n` +
+            '  React Server Components couple them: the RSC runtime emits a payload the matching react-dom parses, ' +
+            'so a split resolution fails inside React while rendering rather than here.\n' +
+            '  Install both at the same version. If a transitive dependency is what split them, pin them — ' +
+            '`overrides` in npm, `pnpm.overrides` in pnpm, `resolutions` in yarn.');
+    }
+    const tested = testedReactVersion();
+    if (tested && minor(tested) !== minor(react)) {
+        console.warn(`  ⚠ react ${react} is not the ${minor(tested)}.x this rshono was tested against. The RSC runtime is pinned\n` +
+            '    to an exact version and reaches into React internals, so a different minor can fail at render time.');
+    }
+}
+//# sourceMappingURL=react-versions.js.map

package/dist/builder/react-versions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"react-versions.js","sourceRoot":"","sources":["../../src/builder/react-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;GAIG;AACH,SAAS,kBAAkB;IACzB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAEnE,CAAC;QACF,OAAO,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,SAAS,gBAAgB,CAAC,OAAuB,EAAE,IAAY;IAC7D,IAAI,CAAC;QACH,OAAQ,OAAO,CAAC,GAAG,IAAI,eAAe,CAA0B,CAAC,OAAO,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,kGAAkG;IAClG,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxD,uGAAuG;IACvG,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEhC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,kBAAkB,KAAK,kBAAkB,QAAQ,mCAAmC;YAClF,wGAAwG;YACxG,8EAA8E;YAC9E,gGAAgG;YAChG,sEAAsE,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,IAAI,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CACV,aAAa,KAAK,eAAe,KAAK,CAAC,MAAM,CAAC,gEAAgE;YAC5G,yGAAyG,CAC5G,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["/**\n * The one dependency check the framework makes on an app: that `react` and `react-dom` are the same build.\n *\n * React Server Components couple the two across bundles — `react-server-dom-rspack` reaches into\n * `ReactSharedInternals` and emits a flight payload the *matching* `react-dom` has to parse — so a split\n * resolution is not version skew to be tolerated. It is a crash inside minified React at render time, with\n * nothing in the message pointing at the cause.\n *\n * The monorepo prevents it with `overrides` in `pnpm-workspace.yaml` and `packages/create` pins both exactly\n * for the same reason, because a generated app has no overrides to rely on. Neither helps an app that grew\n * past its scaffold, which is why the check lives here — on the one path every `dev` and `build` takes.\n */\nimport { createRequire } from 'node:module';\nimport { join } from 'node:path';\n\n/**\n * The React this release was tested against, read off the framework's own manifest rather than restated as a\n * constant — the pin and the check cannot drift apart that way. `undefined` if it cannot be read, which only\n * turns the advisory warning off.\n */\nfunction testedReactVersion(): string | undefined {\n  try {\n    const manifest = createRequire(import.meta.url)('../../package.json') as {\n      devDependencies?: Record<string, string>;\n    };\n    return manifest.devDependencies?.react;\n  } catch {\n    return undefined;\n  }\n}\n\n/** The version of an installed package as the *app* resolves it, or `undefined` if it has none. */\nfunction installedVersion(require: NodeJS.Require, name: string): string | undefined {\n  try {\n    return (require(`${name}/package.json`) as { version?: string }).version;\n  } catch {\n    return undefined;\n  }\n}\n\n/** `19.2.8` → `19.2`, for comparing minors without pulling in a semver parser. */\nfunction minor(version: string): string {\n  return version.split('.', 2).join('.');\n}\n\n/**\n * Fails the build when `react` and `react-dom` resolve to different versions, and warns when they are not the\n * version this release was tested with.\n *\n * The mismatch is an error because it never works. A different minor is only a warning: upstream declares\n * `^19.1.0` and may well be right, and refusing to build would make rshono the reason an app cannot take a\n * React release — a worse failure than the one it would prevent.\n *\n * @param rootDir - The project root, so resolution follows the *app's* `node_modules` rather than the\n *   framework's.\n */\nexport function checkReactVersions(rootDir: string): void {\n  // Resolved from the project's manifest, so a pnpm layout answers with what the app actually gets.\n  const require = createRequire(join(rootDir, 'package.json'));\n  const react = installedVersion(require, 'react');\n  const reactDom = installedVersion(require, 'react-dom');\n  // Missing altogether is the resolver's to report, against the import that needed it and with the path.\n  if (!react || !reactDom) return;\n\n  if (react !== reactDom) {\n    throw new Error(\n      `[rshono] react ${react} and react-dom ${reactDom} resolve to different versions.\\n` +\n        '  React Server Components couple them: the RSC runtime emits a payload the matching react-dom parses, ' +\n        'so a split resolution fails inside React while rendering rather than here.\\n' +\n        '  Install both at the same version. If a transitive dependency is what split them, pin them — ' +\n        '`overrides` in npm, `pnpm.overrides` in pnpm, `resolutions` in yarn.',\n    );\n  }\n\n  const tested = testedReactVersion();\n  if (tested && minor(tested) !== minor(react)) {\n    console.warn(\n      `  ⚠ react ${react} is not the ${minor(tested)}.x this rshono was tested against. The RSC runtime is pinned\\n` +\n        '    to an exact version and reaches into React internals, so a different minor can fail at render time.',\n    );\n  }\n}\n"]}

package/dist/builder/rspack-config.d.ts

@@ -2,18 +2,12 @@ import { type RspackOptions } from '@rspack/core';
 import type { RshonoConfig } from '../config.js';
 import type { DeployPreset } from '../deploy/presets.js';
 /**
- * The directory a command writes its bundles to, relative to the project root — one per command,
- * never shared.
+ * The directory a command writes its bundles to, relative to the project root — one per command, never
+ * shared: a `rshono build` alongside a running `rshono dev` would `clean` away the route chunks that
+ * server imports lazily, and Rspack's watch-mode emit never re-emits a file it believes it wrote.
  *
- * `rshono build` run while `rshono dev` is up would otherwise write over the dev server's own
- * output: the build's `clean` empties `<out>/server`, and the route chunks it deletes are exactly
- * the ones the running server worker imports *lazily, at request time*. Every route the worker had
- * not already loaded then fails with `ERR_MODULE_NOT_FOUND`, and no later edit repairs it, because
- * Rspack's watch-mode emit compares against what it believes it already wrote rather than against
- * the disk — so it never re-emits the deleted files. The dev server 500s until it is restarted.
- *
- * Both names are a single level under the root, which {@link ../deploy/filesystem.ts} relies on: it
- * derives the project root from where the bundle ended up, `<out>/server/main.mjs` → `../..`.
+ * Both names are a single level under the root, which `deploy/filesystem.ts` relies on to derive the
+ * project root from where the bundle ended up.
  */
 export declare const BUILD_OUT_DIR = "dist";
 export declare const DEV_OUT_DIR = ".rshono";

package/dist/builder/rspack-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rspack-config.d.ts","sourceRoot":"","sources":["../../src/builder/rspack-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,aAAa,EAAoB,MAAM,cAAc,CAAC;AAK3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAYzD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa,SAAS,CAAC;AACpC,eAAO,MAAM,WAAW,YAAY,CAAC;AAgFrC,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,2IAA2I;IAC3I,MAAM,EAAE,YAAY,CAAC;IACrB,4GAA4G;IAC5G,MAAM,EAAE,YAAY,CAAC;IACrB,wBAAwB,CAAC,EAAE,MAAM,IAAI,CAAC;CACvC;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,mBAAmB,GAAG,CAAC,aAAa,EAAE,aAAa,CAAC,CAgN1F"}
+{"version":3,"file":"rspack-config.d.ts","sourceRoot":"","sources":["../../src/builder/rspack-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,aAAa,EAAoB,MAAM,cAAc,CAAC;AAK3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAYzD;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,SAAS,CAAC;AACpC,eAAO,MAAM,WAAW,YAAY,CAAC;AAqErC,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,2IAA2I;IAC3I,MAAM,EAAE,YAAY,CAAC;IACrB,4GAA4G;IAC5G,MAAM,EAAE,YAAY,CAAC;IACrB,wBAAwB,CAAC,EAAE,MAAM,IAAI,CAAC;CACvC;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,mBAAmB,GAAG,CAAC,aAAa,EAAE,aAAa,CAAC,CAsP1F"}