@uniflowed/vite 0.0.0-alpha.9 → 0.1.0

package/driver.js

@@ -6,7 +6,12 @@
 // `uf start` spawn.
 //
 //   <host> driver.js dev     --root <dir> [--mode <m>] [--host <h>] [--port <n>] [--strict-port]
-//   <host> driver.js build   --root <dir> [--mode <m>] [--out-dir <dir>]
+//                            [--uf-env-file <file>]...
+//   <host> driver.js build   --root <dir> [--mode <m>] [--out-dir <dir>] [--target <target>]
+//                            [--prerender everything|possible|nothing]
+//                            [--static-build] [--because <sentence>]
+//   <host> driver.js library --root <dir> [--mode <m>] [--out-dir <dir>]
+//                            --entry <file>... --format <es|cjs>... [--external <name>]...
 //   <host> driver.js compile --root <dir> [--mode <m>] [--out-dir <dir>] --assets <file> --bundle <dir>
 //   <host> driver.js deploy  --root <dir> [--mode <m>] [--out-dir <dir>] --adapter <name> --work <dir> --output <dir>
 //   <host> driver.js preview --root <dir> [--mode <m>] [--out-dir <dir>] [--host <h>] [--port <n>]
@@ -19,6 +24,12 @@
 // environment — see `viteConfig` below and `crates/uf_config/src/env_files.rs`.
 // `start` has no Vite in it and therefore no mode.
 //
+// `--uf-env-file` names those files, one flag each, so `dev` can watch them and
+// say when one moved; nothing here reads their contents. The prefix is load
+// bearing: node claims `--env-file` for itself and honours it wherever it
+// appears on the command line, script arguments included, so a driver argument
+// by that name is an argument node eats and then exits 9 over.
+//
 // `uf` in Rust owns the terminal; this process owns Vite. They talk over
 // stdout, one JSON event per line (see `./internal/events.js`), and the driver
 // exits when its stdin closes so it cannot outlive the command that started
@@ -28,22 +39,50 @@
 // Rust side reads a config that may hold functions and plugin instances: the
 // one host that can evaluate the file evaluates it.
 
+import { randomUUID } from "node:crypto";
 import { createServer as createHttpServer } from "node:http";
-import { register } from "node:module";
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { builtinModules, register } from "node:module";
+import { esmExternalRequirePlugin } from "rolldown/plugins";
+import { installFlowHooks } from "@uniflowed/host/internal/sync-hooks.js";
+import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 
-import { emit, errorEvent, eventLogger, reportRenderError } from "./internal/events.js";
+import { COMPILE_ASSETS_ID, compileAssetsPlugin } from "./internal/compile-assets.js";
+import { servesRemoteImages } from "./internal/image-endpoint.js";
+import {
+  survivingImports,
+  unavailableOnWorkers,
+  workerBuiltinWarnings,
+} from "./internal/worker-builtins.js";
+import { emit, errorEvent, eventLogger } from "./internal/events.js";
 import { loadUfConfig, projectConfig } from "./internal/config.js";
-import { send, toRequest } from "./internal/http.js";
+import { send, toAddressRequest, toRequest } from "./internal/http.js";
+import { createOpenApiDocument } from "./internal/openapi.js";
 import { withProjectConfig } from "./merge.js";
-import { VIRTUAL, scanRoutes } from "./internal/routes.js";
+import { FLIGHT_VIRTUAL, RSC_ENVIRONMENT } from "./internal/flight.js";
+import { MODULE_GRAPH_FILE, createModuleGraphCollector } from "./internal/module-graph.js";
+import { VIRTUAL, resolveRouteTarget, routingRulesOf, scanRoutes } from "./internal/routes.js";
 import {
+  BUILD_ID_FILE,
+  DOCUMENT_ASSETS_FILE,
+  PARTIAL_PRERENDER_FILE,
+  REGENERATED_DIRECTORY,
+  REGENERATION_FILE,
+  answerRouting,
+  answersInFrontOfFiles,
   assetsFromManifest,
+  buildIdentity,
+  createPrerenderGate,
   createServeHandler,
+  deploymentIdFor,
+  documentAssetsFor,
+  forViteBase,
   loadBuild,
   nodeListener,
+  providerSpecifier,
+  readPartialPrerenders,
+  readRegeneration,
   withRequest,
 } from "./internal/serve.js";
 
@@ -52,6 +91,16 @@ function argument(name) {
   return at === -1 ? null : process.argv[at + 1];
 }
 
+/** Every value of a repeated argument, in the order they were given. */
+function argumentAll(name) {
+  const values = [];
+  for (let at = 0; at < process.argv.length; at += 1) {
+    if (process.argv[at] === name && process.argv[at + 1] != null)
+      values.push(process.argv[at + 1]);
+  }
+  return values;
+}
+
 function flag(name) {
   return process.argv.includes(name);
 }
@@ -66,11 +115,23 @@ process.env.UF_PROJECT_ROOT = root;
 // hooks for that; Bun is started with `--preload` on the same package's
 // preload instead, and has no `register`.
 //
+// Deno has no `register` either, and it gets its hooks *here* rather than from
+// a preload, for a reason that is about order. While a Deno `load` hook is
+// registered, `require()` of a native addon fails — and Vite requires one,
+// Rolldown's binding. The static imports above have already loaded Vite by
+// this line, binding included, so hooks installed now see only what is
+// imported after them: the config, and the `@uniflowed/*` modules this driver
+// reaches dynamically. They are the in-thread hooks a new enough Node takes
+// through `@uniflowed/host/register` too; see
+// `@uniflowed/host/internal/sync-hooks.js`.
+//
 // The hooks live in `@uniflowed/host` rather than here: they are how Flow runs
 // on a Capability JS Host, and nothing in them is Vite's. `uf test` reaches for
 // the same package, which is what stopped a test run from depending on a
 // bundler it never loads.
-if (typeof Bun === "undefined" && typeof Deno === "undefined") {
+if (typeof Deno !== "undefined") {
+  installFlowHooks(root);
+} else if (typeof Bun === "undefined") {
   register("@uniflowed/host/internal/node-hooks.js", import.meta.url, { data: { root } });
 }
 
@@ -78,7 +139,7 @@ process.stdin.on("end", () => process.exit(0));
 process.stdin.on("error", () => process.exit(0));
 process.stdin.resume();
 
-const commands = { dev, build, compile, deploy, preview, start, config: printConfig };
+const commands = { dev, build, library, compile, deploy, preview, start, config: printConfig };
 const run = commands[command];
 if (run == null) {
   emit("error", { message: `unknown driver command ${JSON.stringify(command)}` });
@@ -90,6 +151,33 @@ run().catch((error) => {
   process.exit(1);
 });
 
+/**
+ * What this build is called, for anything that outlives it.
+ *
+ * `UF_BUILD_ID` when it is set, and a fresh random name otherwise — which is
+ * `crates/uf_rsc`'s `BuildId::from_env_or_generate` exactly, reading the same
+ * variable, because it is the same question asked by a different half of the
+ * toolchain. Two artefacts that have to *be* one build say so with the
+ * variable; everything else gets a name no other build has.
+ *
+ * Minted once per build and written into the build, never per process. Four
+ * servers started from one artefact are one build and must share one cache;
+ * generating this where the server starts would give them four, which is worse
+ * than none at all — four copies of everything written into one directory and
+ * none of them read.
+ *
+ * Not a hash of the output. A content hash would be reproducible, which is
+ * appealing and wrong here: two builds with identical client bundles can have
+ * different server behaviour — a loader's body moves and no asset hash does —
+ * and a cache keyed by one would serve the old loader's documents. A name that
+ * changes whenever the build ran is the conservative direction to be wrong in.
+ */
+function mintBuildId() {
+  const named = process.env.UF_BUILD_ID;
+  if (typeof named === "string" && named.trim() !== "") return named.trim();
+  return randomUUID().replaceAll("-", "");
+}
+
 /** Load `uf.config.js`, reporting where it was found. */
 async function loadConfig() {
   const { config, file } = await loadUfConfig(root);
@@ -97,6 +185,15 @@ async function loadConfig() {
   return config;
 }
 
+/**
+ * `app.router.basePath` as the driver uses it: `""` at the root, `"/docs"`
+ * otherwise. Read where the build writes asset URLs and file names, because a
+ * prerendered document is written outside Vite's HTML transform.
+ */
+function basePathOf(config) {
+  return routingRulesOf(config.app?.router).basePath;
+}
+
 /** The Vite inline config a uf config describes. */
 async function viteConfig(config, mode) {
   const { default: uniflowed } = await import("./index.js");
@@ -107,6 +204,7 @@ async function viteConfig(config, mode) {
   const port = Number(argument("--port") ?? dev.port ?? 5173);
   const allowedHosts =
     Array.isArray(dev.allowedHosts) && dev.allowedHosts.length > 0 ? dev.allowedHosts : undefined;
+  const routeTarget = resolveRouteTarget(config, argument("--target"));
 
   // What uf generates from the semantics it owns: where the project is, which
   // plugins make Flow compile, and the few settings uf enforces rather than
@@ -135,9 +233,30 @@ async function viteConfig(config, mode) {
     configFile: false,
     envDir: false,
     mode,
+    // Vite's dependency cache, kept in the project whatever is above it.
+    // Vite's own default is the nearest `package.json`'s `node_modules/.vite`,
+    // and a uf project needs no `package.json`. One inside another repository
+    // pre-bundled into that repository's `node_modules`, in one directory
+    // shared with every other such project there and emptied by each dev
+    // server that started — which is how two `uf dev` servers came to answer
+    // each other's pre-bundled files with `504 Outdated Optimize Dep`
+    // (ubugeeei-prod/uf#1141).
+    //
+    // This directory rather than `.vite` or `.uf/cache/vite`, because it is
+    // where Vite already puts the cache for a project with its own
+    // `package.json`, so nothing moves for one: the URLs stay
+    // `/node_modules/.vite/deps/…`, and the files stay under `node_modules`,
+    // which git ignores, Vite's watcher skips and Vite's sourcemap ignore list
+    // treats as somebody else's code. `cacheDir` is shared config, so every
+    // environment's optimizer follows it — `deps`, `deps_ssr`, `deps_rsc` —
+    // and a project's own `vite.cacheDir` is merged over it like any option.
+    cacheDir: path.join(root, "node_modules", ".vite"),
+    // `app.router.basePath`: where Vite serves the modules in development, and
+    // what it puts in front of every asset URL a build writes.
+    base: basePathOf(config) === "" ? "/" : `${basePathOf(config)}/`,
     clearScreen: false,
     customLogger: eventLogger(argument("--log-level") ?? "info"),
-    plugins: [uniflowed({ root, config })],
+    plugins: [uniflowed({ root, config, target: routeTarget })],
     server: {
       host,
       port,
@@ -182,129 +301,43 @@ async function viteConfig(config, mode) {
  * Vite in middleware mode serves nothing on its own: with no `index.html` at
  * the project root it answers every navigation with "Cannot GET /", which is
  * what `uf dev` used to do for every project it started. A uf project has no
- * `index.html` — the document comes from a layout — so the server has to render
- * it, which is what this middleware does:
- *
- *   1. load the server entry through `ssrLoadModule`, so it is transformed the
- *      same way the browser's copy is and picks up edits without a restart;
- *   2. run the middleware guarding this path, which may answer instead;
- *   3. render the URL, pointing the client script at the dev entry rather than
- *      at a built asset;
- *   4. hand the HTML to `transformIndexHtml`, which is what injects the HMR
- *      client and lets any Vite plugin see the document.
- *
- * Step 4 is why `uf dev` collects the stream instead of piping it: Vite's HTML
- * hook takes a whole document and any plugin may rewrite any part of it, so
- * there is no first byte to send until it has run. `uf start` and `uf preview`
- * have no such hook and stream — see `internal/serve.js` — and it is worth
- * being clear that this is a property of the development server rather than of
- * the renderer. Streaming through the transform is ubugeeei-prod/uf#374.
- *
- * Anything Vite already serves — a module, a public file — never reaches this,
- * because the middleware runs after Vite's own.
+ * `index.html` — the document comes from a layout — so the server has to
+ * render it.
+ *
+ * That rendering is **not** here. It is one middleware, in `./index.js`'s
+ * `configureServer`, and this function installs none of its own. It used to
+ * install a second one, and two middlewares rendering the same request is how
+ * `uf dev` came to answer a route handler with a page and a redirect without
+ * its `Location`: `configureServer`'s post hook runs inside `createServer`,
+ * and anything added here runs after it returns, so of the two the plugin's
+ * was always the one that decided. See ubugeeei-prod/uf#349 and #338, and the
+ * comment above that middleware for what it now has to do.
+ *
+ * What is left here is the half that is genuinely the driver's: the Vite
+ * config, the socket, the event channel back to `uf`, and the two watchers
+ * below.
  */
 async function dev() {
   const { createServer } = await import("vite");
   const config = await loadConfig();
+  const routeTarget = resolveRouteTarget(config, argument("--target"));
   // The mode is uf's to decide, not this file's: `uf dev` resolves `--mode`,
   // the profile `uf env use` wrote and `env.active` before it starts anything,
   // and always passes the answer. The fallback is for a driver started by hand.
   const inline = await viteConfig(config, argument("--mode") ?? "development");
   const server = await createServer({ ...inline, appType: "custom" });
 
-  // In dev the browser loads the client entry from Vite, not from a manifest;
-  // its stylesheets arrive through that module rather than as <link> tags.
-  const assets = { scripts: [`/@id/${VIRTUAL.client}`], styles: [], preloads: [] };
-
-  server.middlewares.use(async (request, response, next) => {
-    const url = request.originalUrl ?? request.url ?? "/";
-    // Declared out here so the catch below can still settle: a request that
-    // failed is a request that happened, and a middleware that logged its
-    // arrival is owed its callback either way.
-    let lifecycle = null;
-    try {
-      const entry = await server.ssrLoadModule(VIRTUAL.server);
-      const asRequest = await toRequest(request, server.config);
-
-      // The request begins here and ends when the document has been written,
-      // which is what `after()` promises and what `uf preview`, `uf start` and
-      // a compiled binary all do too — a middleware that logs a response's
-      // status has to mean the same thing in development as in production.
-      // `entry.beginRequest` rather than an import: the storage that holds the
-      // request belongs to the application's own copy of `@uniflowed/server`.
-      // See `internal/serve.js` and ubugeeei-prod/uf#389.
-      lifecycle = entry.beginRequest(asRequest);
-      const answered = await lifecycle.run(async () => {
-        // Middleware first, above everything: it guards a subtree, so it has to
-        // run for a page, for a route handler, and for a path under it that
-        // matches neither. Running it inside the dispatcher and again inside the
-        // renderer would have left `/dashboard/typo` unguarded and run it twice
-        // for a path that is both.
-        const guarded = await entry.runMiddleware(asRequest);
-        if (guarded != null) {
-          await send(response, guarded);
-          return true;
-        }
-
-        // Route handlers next, and for every method: a handler is the only
-        // thing that answers a POST, and it may also answer a GET for a path
-        // that has no page.
-        const handled = await entry.dispatch(asRequest);
-        if (handled != null) {
-          await send(response, handled);
-          return true;
-        }
-
-        // Only a navigation reaches the renderer. A page cannot answer a POST,
-        // and letting one try would turn a missing handler into a rendered page
-        // with a 200 rather than a 404.
-        if (request.method !== "GET" && request.method !== "HEAD") {
-          return false;
-        }
-
-        const result = await entry.render(url, assets, {
-          // A boundary that threw after the shell went out. `result.error` cannot
-          // carry it — the caller already has the result by then — so the
-          // terminal hears about it here or not at all.
-          onError: (error) => reportRenderError(server, url, error),
-        });
-        if (result.error != null) reportRenderError(server, url, result.error);
-        const html = await server.transformIndexHtml(url, await result.text());
-        response.statusCode = result.status ?? 200;
-        response.setHeader("content-type", "text/html; charset=utf-8");
-        response.end(html);
-        return true;
-      });
-
-      if (!answered) {
-        // The one path where uf is not the one writing the response: a
-        // non-navigation nothing claimed goes back to Vite's chain. The guard
-        // has still run and may have deferred work, so `close` — the socket
-        // saying the response is over, however it ended — is the only honest
-        // signal left that the bytes are out.
-        response.once("close", lifecycle.settle);
-        next();
-        return;
-      }
-      await lifecycle.settle();
-    } catch (error) {
-      if (lifecycle != null) await lifecycle.settle();
-      // Map the stack back onto the Flow source before it reaches the overlay.
-      if (error instanceof Error) server.ssrFixStacktrace(error);
-      next(error);
-    }
-  });
-
   await server.listen();
   const urls = server.resolvedUrls ?? { local: [], network: [] };
   emit("listening", {
     local: urls.local,
     network: urls.network,
-    routes: scanRoutes(path.resolve(root, config.app?.router?.root ?? "app")).routes.map(
-      (route) => route.path,
-    ),
+    routes: scanRoutes(path.resolve(root, config.app?.router?.root ?? "app"), {
+      target: routeTarget,
+    }).routes.map((route) => route.path),
   });
   watchSources(server);
+  watchEnvFiles(server);
 
   const shutdown = async () => {
     await server.close();
@@ -351,6 +384,45 @@ function watchSources(server) {
   }
 }
 
+/**
+ * Restart the server when one of the `.env` files uf read changes.
+ *
+ * uf reads the `.env` cascade itself, in Rust, before this process starts —
+ * one parser, one precedence, one answer for every command (see `viteConfig`
+ * above and `crates/uf_config/src/env_files.rs`) — and `envDir: false` turns
+ * Vite's own file loading off so there cannot be two answers. The cost of that
+ * was that nothing watched them: a value edited while `uf dev` ran changed
+ * nothing until somebody restarted the command by hand, and the guide had to
+ * document it as a limitation. See ubugeeei-prod/uf#428.
+ *
+ * `uf` passes the files it would consult with `--uf-env-file`, one per file, in
+ * cascade order, whether or not each exists today — a `.env.local` *created*
+ * while the server runs changes the answer exactly as much as an edit to one
+ * that was already there, and watching only what was read would have missed
+ * it. They are added to Vite's watcher explicitly because they are in no
+ * module graph, which is the same reason the RSC manifest is added in
+ * `index.js`.
+ *
+ * What is emitted is "these values are stale", and the Rust side restarts this
+ * process with the files re-read. A restart rather than a hot update is the
+ * honest granularity: a prefixed value reaches the browser by substitution
+ * into the bundle, so a new value has to be substituted again, and every
+ * module that read one has to be re-evaluated. Vite's watcher is still the
+ * only watcher — a second one over the same tree, in Rust, would be a second
+ * answer to "did this file change".
+ */
+function watchEnvFiles(server) {
+  const files = argumentAll("--uf-env-file").map((file) => path.resolve(root, file));
+  if (files.length === 0) return;
+  const watched = new Set(files);
+  server.watcher.add(files);
+  for (const event of ["add", "change", "unlink"]) {
+    server.watcher.on(event, (file) => {
+      if (watched.has(path.resolve(file))) emit("env-changed", { file, change: event });
+    });
+  }
+}
+
 /**
  * The preview server: the build, as Vite serves it.
  *
@@ -370,22 +442,52 @@ function watchSources(server) {
  * The static middleware still runs first, and that is deliberate rather than
  * incidental; see `internal/serve.js` for why `uf start` orders itself the
  * same way.
+ *
+ * One request is the exception, and it is the only thing uf mounts in *front*
+ * of Vite here: a request carrying the draft cookie, which no front door may
+ * answer from a prerendered document. `createStaticHandler` applies that rule
+ * and cannot reach a request Vite's file middleware answered first, so under
+ * `uf preview` draft mode appeared to be off while it worked under `uf dev`
+ * and `uf start` — ubugeeei-prod/uf#620. `configurePreviewServer` is where a
+ * middleware goes ahead of Vite's own; the hook's *body* runs before they are
+ * installed and a function it returns runs after, which is why this is a body
+ * and the handler below is a `use` on the started server.
  */
 async function preview() {
   const { preview: startPreview } = await import("vite");
   const config = await loadConfig();
+  const routeTarget = resolveRouteTarget(config, argument("--target"));
   const inline = await viteConfig(config, argument("--mode") ?? "production");
-  const build = await loadBuild({
-    root,
-    outDir: inline.build.outDir,
-    serverDir: path.join(".uf", "build", "server"),
-  });
+  // A build that declared it emits no server has none to mount. `uf` refuses
+  // `uf start` for such a project and lets this one through, because a preview
+  // of files *is* the deployment: what a static host does with `dist/` is
+  // exactly what Vite's preview server does with it, and mounting a request
+  // handler behind it would make this preview right about a deployment that is
+  // not the one happening. See `uf_cli`'s `commands::serve`.
+  const staticBuild = flag("--static-build");
+  const build = staticBuild
+    ? null
+    : await loadBuild({
+        root,
+        outDir: inline.build.outDir,
+        serverDir: path.join(".uf", "build", "server"),
+      });
 
-  const server = await startPreview({ ...inline, appType: "custom" });
-  const handle = createServeHandler(build);
-  server.middlewares.use(async (request, response, next) => {
+  // One handler for both positions in the chain. A draft request meets it in
+  // front of Vite's file middleware and every other request meets it behind,
+  // and because it is the same handler the two give the same answer — which is
+  // the whole reason `uf preview` exists.
+  const handle =
+    build == null
+      ? null
+      : createServeHandler({
+          ...build,
+          cache: config.app?.rendering?.cache,
+          images: config.app?.builtins?.images,
+        });
+  const answer = (previewServer) => async (request, response, next) => {
     try {
-      const asRequest = await toRequest(request, server.config);
+      const asRequest = await toRequest(request, previewServer.config);
       // The same lifecycle `uf start` gets from `nodeListener`, spelled out
       // because this door is Vite's connect chain rather than a bare
       // `node:http` server: the whole request runs inside it, and it settles
@@ -398,14 +500,107 @@ async function preview() {
     } catch (error) {
       next(error);
     }
+  };
+
+  const mayAnswerFromPrerender = createPrerenderGate();
+  const draftFirst = {
+    name: "uf:draft-before-files",
+    configurePreviewServer(previewServer) {
+      // `app.router.headers` and `redirects`, first of all: a redirect answers
+      // before a file is looked for, and a header is pinned on the response so
+      // it survives the `writeHead` Vite's file middleware writes its own
+      // with. `uf start` and every adapter put the same two in front of their
+      // static half; the application's own answers get them from
+      // `createServeHandler` behind. See `internal/serve.js`'s `answerRouting`.
+      const routing = build?.entry?.routing;
+      if (answersInFrontOfFiles(routing)) {
+        previewServer.middlewares.use((request, response, next) => {
+          answerRouting(routing, toAddressRequest(request), response)
+            .then((answered) => {
+              if (answered) return;
+              // The bare base path is the root, which Vite only knows as
+              // `/docs/`; see `forViteBase`.
+              forViteBase(routing, request);
+              next();
+            })
+            .catch(next);
+        });
+      }
+      // A prerendered payload is a file whose extension Vite's static middleware
+      // knows no type for, and the router hands bytes to React only when they
+      // are answered as a payload — so a navigation on a preview would silently
+      // become a document load. Set here, in front of the file server, which
+      // keeps a type it did not choose.
+      previewServer.middlewares.use((request, response, next) => {
+        if ((request.url ?? "").split("?")[0].endsWith("/__uf.flight")) {
+          response.setHeader("content-type", "text/x-component");
+        }
+        if ((request.url ?? "").split("?")[0] === "/.well-known/apple-app-site-association") {
+          response.setHeader("content-type", "application/json; charset=utf-8");
+        }
+        next();
+      });
+      if (handle == null) return;
+      const run = answer(previewServer);
+      previewServer.middlewares.use((request, response, next) => {
+        // Not `await`ed by connect, which takes no promise: the gate is
+        // resolved inside and `next()` is called from there. A rejection is a
+        // `next(error)` for the same reason.
+        mayAnswerFromPrerender(request.headers.cookie ?? null)
+          .then((mayAnswer) => (mayAnswer ? next() : run(request, response, next)))
+          .catch(next);
+      });
+    },
+  };
+
+  const server = await startPreview({
+    ...inline,
+    appType: "custom",
+    plugins: [...(inline.plugins ?? []), draftFirst],
   });
+  if (handle != null) {
+    server.middlewares.use(answer(server));
+  }
+  // The rewrite rule a single-page deployment needs, in the one place uf can
+  // apply one. A `["csr"]` build writes `index.html` and nothing else that is a
+  // page, so a file server answers `/` and 404s every other URL — and this
+  // preview exists to be believed about the deployment. A host serving that
+  // build has to send unmatched paths to the shell, so a preview that did not
+  // would be right about a deployment nobody is doing.
+  //
+  // Behind the static middleware, which is what makes it a *fallback*: a real
+  // file still wins, so `/assets/client.js` is still the chunk and not the
+  // shell. And `Accept: text/html` only, so a `fetch` for a missing JSON file
+  // gets a 404 rather than a document — the failure mode of a fallback that
+  // answers everything is a parse error two layers away from the missing file.
+  if (flag("--spa-fallback")) {
+    const shell = path.resolve(root, inline.build.outDir, "index.html");
+    server.middlewares.use((request, response, next) => {
+      if (request.method !== "GET" && request.method !== "HEAD") return next();
+      if (!(request.headers.accept ?? "").includes("text/html")) return next();
+      if (!existsSync(shell)) return next();
+      response.statusCode = 200;
+      response.setHeader("content-type", "text/html; charset=utf-8");
+      response.end(request.method === "HEAD" ? undefined : readFileSync(shell));
+      return undefined;
+    });
+  }
 
   const urls = server.resolvedUrls ?? { local: [], network: [] };
   emit("listening", {
     local: urls.local,
     network: urls.network,
-    routes: build.entry.routes.map((route) => route.path),
-    handlers: build.entry.handlers.map((handler) => handler.path),
+    // From the filesystem when there is no bundle to ask, which is the same
+    // scan `dev` reports from. The count is what a reader checks the build
+    // against, so answering "0 routes" for a static site that has thirty would
+    // be the report being wrong about the thing it exists to report.
+    routes:
+      build == null
+        ? scanRoutes(path.resolve(root, config.app?.router?.root ?? "app"), {
+            target: routeTarget,
+          }).routes.map((route) => route.path)
+        : build.entry.routes.map((route) => route.path),
+    handlers: build == null ? [] : build.entry.handlers.map((handler) => handler.path),
   });
 
   const shutdown = async () => {
@@ -447,7 +642,16 @@ async function start() {
 
   const host = argument("--host") ?? process.env.HOST ?? "0.0.0.0";
   const port = Number(argument("--port") ?? process.env.PORT ?? 3000);
-  const server = createHttpServer(nodeListener(createServeHandler(build), build.entry));
+  const server = createHttpServer(
+    nodeListener(
+      createServeHandler({
+        ...build,
+        cache: config.app?.rendering?.cache,
+        images: config.app?.builtins?.images,
+      }),
+      build.entry,
+    ),
+  );
 
   await new Promise((resolve, reject) => {
     server.once("error", reject);
@@ -482,18 +686,76 @@ async function build() {
   const inline = await viteConfig(config, mode);
   const outDir = path.resolve(root, inline.build.outDir);
   const serverDir = path.join(root, ".uf", "build", "server");
+  // How much of the route table to prerender, and whether the server bundle
+  // survives the build. Both are `uf`'s answer rather than this file's: they
+  // come from two settings in `uf.config.js` that only mean something read
+  // together, and `uf_config`'s `RenderingPlan` is where they are. A driver
+  // started by hand gets the behaviour every uf build had before either
+  // setting was read.
+  const prerender = argument("--prerender") ?? "possible";
+  const staticBuild = flag("--static-build");
+  const because = argument("--because") ?? "this build prerenders every route";
+
+  // 0. The rsc graph, for an application React Server Components render: the
+  //    route table and every server component, resolved under `react-server`.
+  //    First, because it is what finds the client modules the next pass has
+  //    to build; `./internal/flight.js` has the order and the reason for it.
+  const flight = flightStateOf(inline);
+  // `uf build --analyze`: the graph every bundle below is built from, for uf
+  // to attribute to routes; see `./internal/module-graph.js`. A client module
+  // is an entry the browser loads because a server component names it, not on
+  // every page, so it is not one of the client bundle's shared entries.
+  const graph = flag("--analyze")
+    ? createModuleGraphCollector(root, {
+        isReference: (file) => flight?.clientModules.has(file) ?? false,
+      })
+    : null;
+  if (graph != null) {
+    inline.plugins = [...(inline.plugins ?? []), graph.plugin];
+  }
+  // What this build is called, minted before anything is bundled: the rsc
+  // graph bakes the public half into every payload it renders, and the
+  // documents below carry it in their head. See `deploymentIdFor`.
+  const buildId = mintBuildId();
+  const deployment = deploymentIdFor(buildId);
+  const rscDir = path.join(root, ".uf", "build", "rsc");
+  if (flight != null) {
+    flight.deployment = deployment;
+    emit("phase", { name: "rsc" });
+    await buildRscGraph(vite, inline, flight, { outDir: rscDir, conditions: null });
+  }
 
   // 1. The client: everything the browser loads, with a manifest so the
-  //    server render knows which script and stylesheet tags to write.
+  //    server render knows which script and stylesheet tags to write. Under
+  //    React Server Components that is the entry and one entry per client
+  //    module, each keeping its export names, because a payload asks for a
+  //    chunk by its URL and for a component by its export.
   emit("phase", { name: "client" });
+  const references = flight == null ? [] : [...flight.clientModules].sort();
+  const input = { client: VIRTUAL.client };
+  references.forEach((file, index) => {
+    input[`client-reference-${index}`] = file;
+  });
   await vite.build({
     ...inline,
     build: {
       ...inline.build,
-      rollupOptions: { input: { client: VIRTUAL.client } },
+      rollupOptions:
+        flight == null ? { input } : { input, preserveEntrySignatures: "exports-only" },
     },
   });
   const manifest = readManifest(outDir);
+  if (flight != null) {
+    recordClientChunks(flight, manifest, references, rscDir, basePathOf(config));
+    // What the summary's "pages in the client bundle" reads. None: a browser
+    // that hydrates a payload imports no page, whichever route it is on.
+    emit("rsc-split", {
+      pages: 0,
+      routes: scanRoutes(path.resolve(root, config.app?.router?.root ?? "app"), {
+        target: resolveRouteTarget(config, argument("--target")),
+      }).routes.length,
+    });
+  }
 
   // 2. The server entry, bundled for the host, outside `dist/` so it is never
   //    deployed by accident.
@@ -513,12 +775,66 @@ async function build() {
       },
     },
   });
-
-  // 3. Every static route, rendered to an HTML document.
+  // What this build is, beside the bundle it is about. One line, written by
+  // every build and read by nothing unless a project turned a durable cache on
+  // — at which point it is the thing that stops a deploy answering the new
+  // build's URLs with the previous build's documents. See
+  // `packages/server/internal/cache-key.js`, which argues the whole of it, and
+  // `internal/serve.js`'s `buildIdentity`, which is what reads this.
+  writeFileSync(path.join(serverDir, BUILD_ID_FILE), `${buildId}\n`);
+
+  // Every bundle is built by here, and the prerender below builds none.
+  graph?.write(path.join(root, ".uf", "build", "meta", MODULE_GRAPH_FILE));
+
+  // 3. Which routes this build renders when, and every route it renders now.
+  //
+  //    The decision comes from `uf.config.js` and is made in Rust — see
+  //    `uf_config`'s `RenderingPlan` — because `app.rendering.modes` and
+  //    `build.staticBuild` are two settings that have to be read together. It
+  //    arrives here as one word, and this is where it meets the route table.
   emit("phase", { name: "prerender" });
   const server = await import(pathToFileURL(path.join(serverDir, "server.js")).href);
-  const assets = assetsFromManifest(manifest);
-  const pages = await staticPaths(server.routes);
+  const assets = {
+    ...(flight == null
+      ? assetsFromManifest(manifest, basePathOf(config))
+      : flightAssets(manifest, references, rscDir, outDir, basePathOf(config))),
+    // Which build these URLs are. Every document names it, a browser sends it
+    // back, and a server on another build refuses rather than answering with
+    // ids and chunks the page does not have. See `deploymentIdFor`.
+    deployment,
+  };
+  // Recorded beside the server bundle, because whatever serves this build
+  // later cannot recompute them from the client manifest alone; see
+  // `documentAssetsFor`.
+  writeFileSync(path.join(serverDir, DOCUMENT_ASSETS_FILE), `${JSON.stringify(assets, null, 2)}\n`);
+  const openapi = await createOpenApiDocument(server.handlers);
+  const openapiFile = path.join(root, ".uf", "build", "meta", "openapi.json");
+  mkdirSync(path.dirname(openapiFile), { recursive: true });
+  writeFileSync(openapiFile, `${JSON.stringify(openapi, null, 2)}\n`);
+  const plan = await renderingPlan(server, prerender);
+  emit("rendering", {
+    prerender,
+    prerendered: plan.urls.length,
+    perRequest: plan.perRequest.map((route) => route.path),
+  });
+  // A build that has to prerender everything, and a route it cannot: the
+  // refusal ubugeeei-prod/uf#336 and ubugeeei-prod/uf#385 are both about.
+  // Before the loop below, so no document is written for a build that is not
+  // going to be one, and with the whole list rather than the first item — a
+  // project that has just narrowed `rendering.modes` wants to see every route
+  // the narrowing costs it, not one per rebuild.
+  if (prerender === "everything" && plan.perRequest.length > 0) {
+    const listed = plan.perRequest.map((entry) => `  ${entry.path} — ${entry.why}`).join("\n");
+    emit("error", {
+      message:
+        `${plan.perRequest.length} ${plural(plan.perRequest.length, "route")} in this project ` +
+        `can only be answered by a server, and ${because}\n${listed}\n\n` +
+        "Give each page a `generateStaticParams` and take out the handlers and middleware, or " +
+        'allow `"ssr"` in `app.rendering.modes` and deploy a server.',
+    });
+    process.exit(1);
+  }
+  const pages = plan.urls;
 
   // A route that throws fails *that route*, and the rest of the build still
   // happens. This loop had no `try`: the first page to throw rejected out of
@@ -541,28 +857,120 @@ async function build() {
     failures.push(url);
     emit("page-failed", { url, ...errorEvent(error) });
   };
+  //
+  // Each prerender runs inside a fill that stores nothing, so what a page states
+  // with `cacheLife`, `cacheTag` and `noStore` is something this loop can read
+  // rather than a call that throws for want of a scope.
+  //
+  // A page is written for regeneration when `uf` passed `--regenerate` — `isr`
+  // allowed in `app.rendering.modes`, `rendering.cache.route` on, and a server
+  // deployed to regenerate it — and the page stated a lifetime, called no
+  // `noStore`, and answered 200. Its document goes under
+  // `REGENERATED_DIRECTORY` rather than at its own URL, so no static half
+  // answers the page: the server does, starting from this document, until the
+  // lifetime has passed. What it stated goes into `REGENERATION_FILE` beside the
+  // server bundle. Every other page is the document it has always been.
+  //
+  // A tag without a lifetime is not enough, for the route cache's own reason:
+  // an entry with no end is one another process could serve from its memory
+  // for ever after `revalidateTag` took it out of the shared store.
+  //
+  // A page is written as a static shell when `uf` passed `--partial` — `ppr`
+  // allowed in `app.rendering.modes` and a server deployed to fill it — and the
+  // page read `cookies()`, `headers()` or `draftMode()` inside a `<Suspense>`
+  // boundary. The prerender then answers with a `shell` instead of a document:
+  // the markup React could render without a request, and React's record of the
+  // holes. Nothing is written under `dist/` for it, neither a document nor a
+  // payload, because a shell on its own is a page whose holes never fill and
+  // the browser hydrates from the request's payload. The shell goes into
+  // `PARTIAL_PRERENDER_FILE` beside the server bundle, and every server that
+  // serves this build answers the page from there. A page that read the
+  // request outside every boundary still fails, naming what it read.
+  const { collectCacheDeclarations } = await import("@uniflowed/server/cache");
+  const regenerate = flag("--regenerate");
+  const partialPrerender = flag("--partial");
+  const regenerated = {};
+  const partial = {};
   for (const url of pages) {
-    let result;
+    let declared;
+    const renderedAt = Date.now();
     try {
-      result = await server.prerender(url, assets);
+      declared = await collectCacheDeclarations(() =>
+        server.prerender(url, assets, partialPrerender ? { partial: true } : undefined),
+      );
     } catch (error) {
       failed(url, error);
       continue;
     }
+    const result = declared.value;
     if (result.error != null) {
       failed(url, result.error);
       continue;
     }
-    const file = htmlPathFor(outDir, url);
+    if (result.shell != null) {
+      partial[url] = result.shell;
+      emit("page", {
+        url,
+        file: path.relative(root, path.join(serverDir, PARTIAL_PRERENDER_FILE)),
+        status: result.status,
+        bytes: Buffer.byteLength(result.shell.html),
+        regenerates: false,
+        partial: true,
+      });
+      continue;
+    }
+    const lifetime = declared.lifetime;
+    const regenerates =
+      regenerate && result.status === 200 && declared.denied == null && lifetime != null;
+    // The trailing-slash policy decides a served page's file name; a page the
+    // build regenerates keeps the one layout the regeneration reads.
+    const file = regenerates
+      ? htmlPathFor(path.join(outDir, REGENERATED_DIRECTORY), url)
+      : htmlPathFor(outDir, url, routingRulesOf(config.app?.router).trailingSlash);
     mkdirSync(path.dirname(file), { recursive: true });
     writeFileSync(file, result.html);
+    // The payload the document was rendered from, beside it: what a browser
+    // navigating to this route fetches, from whatever serves the files. Beside
+    // the document wherever the document went, so a page written for
+    // regeneration leaves no file at its route's own payload URL answering with
+    // the build's copy for ever; the server answers that URL instead.
+    if (result.payload != null) {
+      // Beside the route's directory whatever the document is called:
+      // `guide/index.html` and `guide.html` both put it at `guide/__uf.flight`.
+      const payloadDirectory =
+        path.basename(file) === "index.html" ? path.dirname(file) : file.slice(0, -".html".length);
+      mkdirSync(payloadDirectory, { recursive: true });
+      writeFileSync(path.join(payloadDirectory, "__uf.flight"), result.payload);
+    }
+    if (regenerates) {
+      regenerated[url] = {
+        document: regeneratedDocumentUrl(url),
+        renderedAt,
+        revalidate: lifetime.revalidate,
+        expire: lifetime.expire ?? null,
+        tags: declared.tags,
+      };
+    }
     emit("page", {
       url,
       file: path.relative(root, file),
       status: result.status,
       bytes: Buffer.byteLength(result.html),
+      regenerates,
     });
   }
+  if (Object.keys(regenerated).length > 0) {
+    writeFileSync(
+      path.join(serverDir, REGENERATION_FILE),
+      `${JSON.stringify({ pages: regenerated }, null, 2)}\n`,
+    );
+  }
+  if (Object.keys(partial).length > 0) {
+    writeFileSync(
+      path.join(serverDir, PARTIAL_PRERENDER_FILE),
+      `${JSON.stringify({ pages: partial })}\n`,
+    );
+  }
   // One `404.html`, from the boundary at the router root: a static host serves
   // a single error document for the whole site, so the nested boundaries a
   // project declares are the server's and the client's to render, not
@@ -570,7 +978,7 @@ async function build() {
   //
   // The condition is "there is a root boundary", not "there is any boundary",
   // because `/__uf_not_found__` is a path at the root: a project whose only
-  // `_uf.not-found.js` is in `app/guide/` would otherwise get a `404.html`
+  // `$not-found.js` is in `app/guide/` would otherwise get a `404.html`
   // rendered from the framework's bare default, which is worse than the file
   // it used to write, which was none.
   //
@@ -582,7 +990,50 @@ async function build() {
   // host would then serve uf's error page to every visitor who mistyped a URL,
   // and nothing between the throw and the deploy would have mentioned it.
   let attempted = pages.length;
-  if (server.notFound.some((boundary) => boundary.path === "/")) {
+  // The single-page build's whole output, written here because it is the one
+  // document this build has and the loop above had no route to write it for.
+  //
+  // Twice, to two names, and the second is the load-bearing one. `index.html`
+  // is what a host serves for `/`; `404.html` is what a static host serves for
+  // every path it has no file for, which under this plan is *every other URL
+  // in the application*. Without it a deployment of `dist/` answers `/` and
+  // 404s `/orders` — a build with a hole in it, found from a 404, which is the
+  // failure ubugeeei-prod/uf#336 is about wearing a different hat.
+  //
+  // It is still the host's rewrite rule that makes this correct, and the two
+  // files are what uf can do without one: a host with a proper SPA fallback
+  // serves `index.html` and never looks at `404.html`, and a host with only an
+  // error document (Pages, Netlify, an S3 bucket) serves `404.html` and gets
+  // the same bytes with a 404 status — which is the right status for a URL
+  // this application does not have, and the not-found boundary is what the
+  // browser then renders into it.
+  if (prerender === "shell") {
+    const html = server.shellDocument(assets);
+    for (const [file, url, status] of [
+      ["index.html", "/", 200],
+      ["404.html", "/404", 404],
+    ]) {
+      const target = path.join(outDir, file);
+      writeFileSync(target, html);
+      attempted += 1;
+      emit("page", {
+        url,
+        file: path.relative(root, target),
+        status,
+        bytes: Buffer.byteLength(html),
+      });
+    }
+  }
+  // Not for a build that prerenders nothing. `404.html` is a file a static
+  // host serves for every path it has no file for, and a project whose
+  // `rendering.modes` allows only `ssr` has no such host: its not-found
+  // boundary is rendered per request, by the server, with the right status.
+  //
+  // Nor for a shell build, which has just written its own: the boundary this
+  // would render is one the *browser* renders in that plan, and a document
+  // holding the framework's 404 markup would be served in place of the shell
+  // for every URL the host could not match.
+  else if (prerender !== "nothing" && server.notFound.some((boundary) => boundary.path === "/")) {
     attempted += 1;
     // `/404` rather than `/__uf_not_found__`: the internal path is how the
     // router is asked, and the file the reader is looking for is `404.html`.
@@ -629,10 +1080,161 @@ async function build() {
     process.exit(1);
   }
 
+  // `build.staticBuild` is "prerender everything and emit no server bundle",
+  // and this is the second half of it. The bundle is still *built*: the
+  // prerender renders through it, so a build with no server bundle at any
+  // point would be a build with no documents either. What the declaration is
+  // about is what is left behind — so it goes once the last document is
+  // written, and `uf start`, `uf preview` and every server adapter then find
+  // nothing to serve, which is the honest outcome for a project that said it
+  // deploys files.
+  if (staticBuild) rmSync(serverDir, { recursive: true, force: true });
+
   emit("done", { outDir: path.relative(root, outDir), pages: pages.length });
   process.exit(0);
 }
 
+/**
+ * The library build, for a project whose `app.router.enabled` is false.
+ *
+ * `build` above is an application build and has no other mode: it links
+ * `virtual:uf/client`, which imports the router and the project's `app.js`.
+ * A library has neither, so `uf build` in a project `uf create lib`
+ * scaffolded failed at the first pass with `Could not resolve '<root>/app.js'`
+ * — a file a library does not have and never had. See ubugeeei-prod/uf#268.
+ *
+ * This is the fourth thing the driver does, beside `dev`, `build` and
+ * `compile`, and it is one pass per format over one input list. Which of the
+ * two builds runs is **not decided here**: `uf` resolves it from the config
+ * (`uf_config`'s `LibraryPlan`) and spawns this subcommand, the same way
+ * `--prerender` arrives as one word rather than as two settings for this file
+ * to read together.
+ *
+ * # The three ways it differs from the application build
+ *
+ *   * **Every dependency stays an import.** `--external` names them, and
+ *     `uf` computes the list from the project's own manifest —
+ *     `dependencies`, `peerDependencies`, `optionalDependencies` — so a
+ *     library ships its own modules and nobody else's. That is the opposite
+ *     of the application build, which inlines what it can because an
+ *     application is the end of the line and a library is not: a bundled copy
+ *     of React inside a library is a second React in every application that
+ *     installs it.
+ *   * **One output per entry, named after the entry.** `index.js` becomes
+ *     `dist/index.js`; `internal/parse.js` becomes `dist/internal/parse.js`.
+ *     The path rather than the basename, so two entries cannot collide at the
+ *     moment one would overwrite the other.
+ *   * **No manifest, no prerender, no server bundle.** There is no document to
+ *     write and no route table to write it from.
+ *
+ * Vite's own `build.lib` does the work. uf owns *that* a library is a
+ * different build and what goes into it; how this builder performs one is the
+ * builder's, which is the same line `build` draws around `rollupOptions`.
+ */
+async function library() {
+  const vite = await import("vite");
+  const config = await loadConfig();
+  const inline = await viteConfig(config, argument("--mode") ?? "production");
+  const outDir = path.resolve(root, inline.build.outDir);
+  const entries = argumentAll("--entry");
+  const formats = argumentAll("--format");
+  const external = argumentAll("--external");
+  if (entries.length === 0) {
+    throw new Error("uf: `driver.js library` needs at least one --entry");
+  }
+  if (formats.length === 0) {
+    throw new Error("uf: `driver.js library` needs at least one --format");
+  }
+
+  // Keyed by the entry's path without its extension, which is what Vite's lib
+  // mode turns into the output file name.
+  const input = {};
+  for (const entry of entries) {
+    input[entryName(entry)] = path.resolve(root, entry);
+  }
+
+  const isExternal = externalTest(external);
+  // One pass per format rather than one build with several outputs: Vite's
+  // lib mode writes a whole `outDir` per format, and the second pass must not
+  // empty what the first wrote. So `emptyOutDir` is true exactly once, on the
+  // first, which is also what makes a build that dropped an entry leave no
+  // stale copy of it behind.
+  let first = true;
+  for (const format of formats) {
+    emit("phase", { name: `library (${format})` });
+    await vite.build({
+      ...inline,
+      build: {
+        ...inline.build,
+        // Vite's `manifest` maps source modules to hashed browser assets. A
+        // library has neither — its file names are its API — and writing one
+        // would put a `.vite/` directory into a published tarball.
+        manifest: false,
+        outDir,
+        emptyOutDir: first,
+        lib: {
+          entry: input,
+          formats: [format],
+          fileName: (_format, name) => `${name}.${format === "cjs" ? "cjs" : "js"}`,
+        },
+        rollupOptions: { external: isExternal },
+      },
+    });
+    first = false;
+  }
+
+  emit("done", { outDir: path.relative(root, outDir), pages: 0 });
+  process.exit(0);
+}
+
+/**
+ * The output name for one entry: its path, without the extension.
+ *
+ * Not the basename. `index.js` and `internal/index.js` are two entries a
+ * library can reasonably have, and under a basename they are one file written
+ * twice — the second silently winning, which is a published package whose
+ * subpath export is somebody else's module.
+ */
+function entryName(entry) {
+  const normalised = entry.replace(/\\/g, "/").replace(/^\.\//, "");
+  const dot = normalised.lastIndexOf(".");
+  const slash = normalised.lastIndexOf("/");
+  return dot > slash ? normalised.slice(0, dot) : normalised;
+}
+
+/**
+ * Whether an import is somebody else's module.
+ *
+ * Three checks, and only the one over `names` is a policy uf decided. `names`
+ * is what `uf` read out of the project's manifest and passed as `--external`,
+ * and a subpath of one of those names — `@scope/pkg/deep` for `@scope/pkg` —
+ * is the same package. The other two are the host's built-in modules, and they
+ * are a fact rather than a decision: `node:fs` has no bytes to inline.
+ *
+ * A bare relative or absolute id is never external, which is the rule that
+ * makes this a library build at all: what the author wrote is bundled, and
+ * what they installed is imported.
+ */
+function externalTest(names) {
+  const declared = new Set(names);
+  // The host's built-in module names, unprefixed. `node:`-prefixed ids are
+  // caught by the first check whatever the host is; this set is for the bare
+  // spellings — `fs`, `path`, `stream` — which a dependency written before the
+  // prefix existed still uses. Read from the running host rather than written
+  // down, because the list grows and a stale copy of it here would be a
+  // bundled `node:worker_threads` that cannot be bundled.
+  const builtins = new Set(builtinModules ?? []);
+  return (id) => {
+    if (id.startsWith("node:")) return true;
+    if (builtins.has(id)) return true;
+    if (declared.has(id)) return true;
+    for (const name of declared) {
+      if (id.startsWith(`${name}/`)) return true;
+    }
+    return false;
+  };
+}
+
 /**
  * Link the whole application into one JavaScript file, for `uf build --compile`.
  *
@@ -690,21 +1292,42 @@ async function compile() {
   }
   const assets = path.resolve(root, assetsArgument);
   const bundleDir = path.resolve(root, bundleArgument);
+  // The compiled binary answers from `@uniflowed/server/standalone`, which has
+  // no `/__uf/image` — and it would still carry pages whose `Image` writes the
+  // endpoint's URLs. Refused by name rather than compiled into a binary whose
+  // remote images are all 404s. See docs/app/guide/assets.
+  if (servesRemoteImages(config.app?.builtins?.images)) {
+    throw new Error(
+      "uf: app.builtins.images.remotePatterns lists remote hosts, and a `--compile` binary " +
+        "has no /__uf/image to answer them: it carries neither the `uf` encoder nor a place " +
+        "to name one. Serve the build with `uf start` or an `--adapter`, or remove the remote " +
+        "patterns. See docs/app/guide/assets.",
+    );
+  }
 
   emit("phase", { name: "standalone" });
 
   // The entry is written to disk rather than served as another virtual module:
-  // it is generated per build (it names this build's asset file), and a real
+  // it is generated per build (it bakes in this build's document), and a real
   // file is the version a person can open when a compiled binary misbehaves.
   const entry = path.join(bundleDir, "entry.js");
   mkdirSync(bundleDir, { recursive: true });
-  const specifier = `./${path.relative(bundleDir, assets)}`;
-  writeFileSync(entry, entrySource(specifier, assetsFromManifest(readManifest(outDir))));
+  writeFileSync(
+    entry,
+    entrySource(
+      path.relative(root, assets),
+      await documentAssetsFor(path.join(root, ".uf", "build", "server"), readManifest(outDir)),
+    ),
+  );
+
+  // The rsc graph `uf build` built, and the client chunks its references name.
+  const flight = flightStateOf(inline);
+  if (flight != null) loadFlightBuild(flight, path.join(root, ".uf", "build", "rsc"));
 
   await vite.build({
     ...inline,
     customLogger: eventLogger("warn"),
-    plugins: [...inline.plugins, nativeAddonGuard()],
+    plugins: [...inline.plugins, nativeAddonGuard(), compileAssetsPlugin(assets)],
     ssr: { ...(inline.ssr ?? {}), noExternal: true },
     build: {
       ...inline.build,
@@ -737,46 +1360,182 @@ async function compile() {
  * of what an adapter is, and keeping the differences in one object is what
  * stops a second one from quietly becoming a second application.
  *
- * `bun`, `deno` and `static` are deliberately absent; `uf_config`'s
+ * `static` is deliberately absent; `uf_config`'s
  * `DeployAdapter::is_implemented` is the other half of that fact and
- * `docs/app/reference/cli/_uf.page.mdx` says why for each of them.
+ * `docs/app/reference/cli/$page.mdx` says why.
+ *
+ * `regenerationStore` is where a target keeps the pages a build regenerates
+ * when `rendering.cache.store` names nothing: a disk for a process with one,
+ * Workers KV for a Worker, and `null` for a Lambda, which keeps nothing between
+ * invocations and is refused by name instead. A regenerated page kept only in
+ * memory would go back to the build's copy on every restart, which is a page
+ * that travels back in time. See [`deploy`].
+ *
+ * `streams: false` marks the one target whose responses are buffered whole.
+ * A page the build prerendered partially is worth nothing there — its shell is
+ * the part that was meant to arrive first — so such a build is refused by name
+ * rather than deployed as a page that waits for its slowest hole.
  */
 const ADAPTERS = {
   node: {
-    entries: (document) => ({
-      handler: handlerEntrySource(document),
-      server: nodeEntrySource("./handler.js"),
+    entries: (document, cache, build, schedules, regeneration, images, partial) => ({
+      handler: handlerEntrySource(
+        document,
+        cache,
+        NODE_CAPABILITIES,
+        build,
+        regeneration,
+        images,
+        partial,
+      ),
+      server: nodeEntrySource("./handler.js", schedules),
+    }),
+    regenerationStore: "filesystem",
+  },
+  // The same two files as `node`, with `@uniflowed/server/bun` in place of
+  // `@uniflowed/server/node`. That module is `./internal/static.js` for every
+  // decision and `Bun.file` for the bytes, which is where the measured win is
+  // — see ubugeeei-prod/uf#391 and the header of `packages/server/bun.js`.
+  //
+  // No `conditions` of its own, unlike `edge`. Bun honours a `bun` export
+  // condition and this deliberately does not ask for it: the measured win is
+  // `Bun.serve` and `Bun.file` and not resolution, so asking would trade a
+  // `handler.js` that is byte-for-byte `node`'s — which is what
+  // `every_adapter_answers_exactly_what_the_node_adapter_answers` checks, and
+  // what makes an adapter one file rather than one application — for whichever
+  // build a dependency happens to ship behind that condition, tested by
+  // nobody here. `edge` pays that price because it must: there is no
+  // `node:stream` in a Worker.
+  bun: {
+    entries: (document, cache, build, schedules, regeneration, images, partial) => ({
+      handler: handlerEntrySource(
+        document,
+        cache,
+        BUN_CAPABILITIES,
+        build,
+        regeneration,
+        images,
+        partial,
+      ),
+      server: bunEntrySource("./handler.js", schedules),
     }),
+    regenerationStore: "filesystem",
+  },
+  deno: {
+    entries: (document, cache, build, schedules, regeneration, images, partial) => ({
+      handler: handlerEntrySource(
+        document,
+        cache,
+        DENO_CAPABILITIES,
+        build,
+        regeneration,
+        images,
+        partial,
+      ),
+      server: denoEntrySource("./handler.js", schedules),
+    }),
+    regenerationStore: "filesystem",
   },
   // The same two files. What `--adapter container` adds is a `Dockerfile` and
   // a `.dockerignore`, and both are plain text that `uf` writes beside this
   // output rather than anything the bundler produces — see `uf_cli`'s
   // `commands::deploy`.
   container: {
-    entries: (document) => ({
-      handler: handlerEntrySource(document),
-      server: nodeEntrySource("./handler.js"),
+    entries: (document, cache, build, schedules, regeneration, images, partial) => ({
+      handler: handlerEntrySource(
+        document,
+        cache,
+        NODE_CAPABILITIES,
+        build,
+        regeneration,
+        images,
+        partial,
+      ),
+      server: nodeEntrySource("./handler.js", schedules),
     }),
+    regenerationStore: "filesystem",
   },
   edge: {
-    entries: (document) => ({
-      handler: handlerEntrySource(document),
-      worker: workerEntrySource("./handler.js"),
+    entries: (document, cache, build, schedules, regeneration, images, partial) => ({
+      handler: handlerEntrySource(
+        document,
+        cache,
+        EDGE_CAPABILITIES,
+        build,
+        regeneration,
+        images,
+        partial,
+      ),
+      worker: workerEntrySource("./handler.js", schedules),
     }),
+    // Workers KV, through the same module seam a project's own provider goes
+    // through. `packages/server/cache-kv.js` argues KV over the Cache API: the
+    // seam has to find every entry under a tag, and the Cache API cannot list
+    // what it holds.
+    regenerationStore: "@uniflowed/server/cache/kv",
     // `workerd` first, so React resolves to the build that has
     // `renderToReadableStream` and no `node:stream`. `browser` and `module`
     // after it are Vite's own SSR defaults, kept so a dependency with no
     // worker condition still resolves the way it does for every other target.
     conditions: ["workerd", "worker", "edge-light", "browser", "module", "import", "default"],
+    // A Worker has no filesystem, so uf's built-in durable provider cannot run
+    // here. Refused by name at the build rather than linked into a bundle that
+    // fails on its first `node:fs` import — the deployment rule is that a
+    // target which cannot provide a durable store says so, and this is the one
+    // target that cannot.
+    filesystem: false,
+    // And the Node built-ins it has only as stubs, which the link reports by
+    // module and importer. See `./internal/worker-builtins.js`.
+    workerBuiltins: true,
   },
   serverless: {
-    entries: (document) => ({
-      handler: handlerEntrySource(document),
+    entries: (document, cache, build, _schedules, regeneration, images, partial) => ({
+      handler: handlerEntrySource(
+        document,
+        cache,
+        SERVERLESS_CAPABILITIES,
+        build,
+        regeneration,
+        images,
+        partial,
+      ),
       lambda: lambdaEntrySource("./handler.js"),
     }),
+    // A Lambda's memory lasts one instance and its disk is that instance's
+    // `/tmp`, so neither is somewhere a regenerated page survives. A build that
+    // regenerates pages has to name a provider module; see [`deploy`].
+    regenerationStore: null,
+    // And `@uniflowed/server/lambda` buffers every response into the one
+    // result an invocation returns, so a page's static shell would reach the
+    // browser with its holes, not before them. A build that prerendered a page
+    // partially is refused by name; see [`deploy`].
+    streams: false,
   },
 };
 
+/**
+ * How each target says what it can do: the module, and the name to call.
+ *
+ * A pair of strings rather than a value, because this is the module that
+ * *writes* `handler.js` and never imports what it writes: the capabilities
+ * belong to the deployed application's copy of `@uniflowed/server`, not to the
+ * driver's. It is the same reason `beginRequest` is re-exported from the
+ * generated file rather than reached for here — see `handlerEntrySource`.
+ *
+ * Nothing is passed for `websocket` or `queue`, and that is not an oversight:
+ * uf defines both and implements neither, so a generated file that invented
+ * one would be inventing an upgrade for a runtime it cannot see. What the call
+ * does supply is the target's name and its two facts, which is what turns "an
+ * upgrade is not available" into "the serverless host cannot hold a socket
+ * open" and what lets `@uniflowed/server/lambda` refuse a queue that would be
+ * dropped.
+ */
+const NODE_CAPABILITIES = { module: "@uniflowed/server/node", name: "nodeCapabilities" };
+const BUN_CAPABILITIES = { module: "@uniflowed/server/bun", name: "bunCapabilities" };
+const DENO_CAPABILITIES = { module: "@uniflowed/server/deno", name: "denoCapabilities" };
+const EDGE_CAPABILITIES = { module: "@uniflowed/server/edge", name: "edgeCapabilities" };
+const SERVERLESS_CAPABILITIES = { module: "@uniflowed/server/lambda", name: "lambdaCapabilities" };
+
 /**
  * Link the application into a directory that can be copied, for
  * `uf build --adapter`.
@@ -819,6 +1578,16 @@ const ADAPTERS = {
  * copying every file in it is bulk work over the whole build, which belongs in
  * Rust rather than in the host process — the same division `--compile` makes
  * with its embedded assets.
+ *
+ * # `--adapter static` never reaches this function
+ *
+ * It is the one implemented target with no application to link: a static host
+ * returns files, and `uf build` has already written them. So `uf` copies the
+ * output directory itself and never spawns this driver for it, which is why
+ * [`ADAPTERS`] has six rows and not seven. What that target does instead of
+ * linking is refuse a project whose route handlers, middleware, unprerendered
+ * routes or server actions a static host cannot answer — in Rust, because the
+ * facts it needs are the route table and what the prerender reported.
  */
 async function deploy() {
   const vite = await import("vite");
@@ -831,6 +1600,12 @@ async function deploy() {
   if (adapter == null || workArgument == null || outputArgument == null) {
     throw new Error("uf: `driver.js deploy` needs --adapter, --work and --output");
   }
+  // What the project declared, read by `uf`'s own walk of the route handlers
+  // and handed over rather than found again here — one reading of a module,
+  // and the same list `wrangler.json`'s `triggers.crons` is written from.
+  // Absent on an older `uf` spawning a newer driver, which is a build with no
+  // schedules rather than an error. See ubugeeei-prod/uf#531.
+  const schedules = JSON.parse(argument("--schedules") ?? "[]");
   // The Rust side has already refused every adapter it has no implementation
   // for, by name and with the issue that tracks it. This is the second half of
   // that fact rather than a duplicate of it: the driver may be spawned by a
@@ -855,14 +1630,97 @@ async function deploy() {
   // file is the version a person can open when a deployed directory
   // misbehaves.
   mkdirSync(work, { recursive: true });
-  const document = assetsFromManifest(readManifest(outDir));
-  const entries = shape.entries(document);
+  const document = await documentAssetsFor(
+    path.join(root, ".uf", "build", "server"),
+    readManifest(outDir),
+  );
+  // Whatever `build` above minted, so a durable cache in the deployed artefact
+  // is keyed by the build that produced it and not by the moment it was
+  // packaged. Read rather than minted again for exactly that reason: a second
+  // `randomUUID()` here would key the adapter's copy differently from the one
+  // `uf start` serves out of `.uf/build/`, which is two caches for one build.
+  const buildId = await buildIdentity(root, path.join(".uf", "build", "server"));
+  const declaredCache = config.app?.rendering?.cache;
+  if (shape.filesystem === false && declaredCache?.store === "filesystem") {
+    throw new Error(
+      `uf: rendering.cache.store is "filesystem" and \`--adapter ${adapter}\` has no ` +
+        "filesystem. Name a module exporting `createCacheProvider` instead — a KV " +
+        "namespace or a Redis behind the same seam — or leave the store in memory. See " +
+        "docs/app/guide/cache.",
+    );
+  }
+  // The pages this build regenerates, and where this target keeps what it
+  // regenerates when the project named no store: the adapter's
+  // `regenerationStore`. A target with nowhere refuses by name and lists the
+  // pages, rather than deploying pages that every cold start takes back to the
+  // build's copy.
+  const regeneration = await readRegeneration(path.join(root, ".uf", "build", "server"));
+  let cacheConfig = declaredCache;
+  if (regeneration != null && declaredCache?.store == null) {
+    if (shape.regenerationStore == null) {
+      const pages = Object.keys(regeneration.pages);
+      throw new Error(
+        `uf: this build regenerates ${pages.length} ${plural(pages.length, "page")} ` +
+          `(${pages.join(", ")}), and \`--adapter ${adapter}\` has nowhere of its own to keep ` +
+          "a regenerated page: an instance's memory and its /tmp both go with the instance. " +
+          "Name a module exporting `createCacheProvider` in rendering.cache.store, or leave " +
+          "`isr` out of app.rendering.modes to prerender those pages as documents that do not " +
+          "change. See docs/app/guide/rendering.",
+      );
+    }
+    cacheConfig = { ...declaredCache, store: shape.regenerationStore };
+  }
+  // The pages this build prerendered partially. Their static shells are baked
+  // into `handler.js`, and a target that cannot send a shell before its holes
+  // refuses them by name: a partial prerender answered by a buffered response
+  // is a page that waits for its slowest hole, which is exactly the page it
+  // was prerendered not to be.
+  const partial = await readPartialPrerenders(path.join(root, ".uf", "build", "server"));
+  if (partial != null && shape.streams === false) {
+    const pages = Object.keys(partial.pages);
+    throw new Error(
+      `uf: this build prerendered ${pages.length} ${plural(pages.length, "page")} partially ` +
+        `(${pages.join(", ")}), and \`--adapter ${adapter}\` buffers every response, so the ` +
+        "static shell would arrive with its holes rather than before them. Deploy with an " +
+        "adapter that streams — node, bun, deno, container or edge — or export " +
+        '`dynamic = "force-dynamic"` from those pages to render each of them whole per ' +
+        "request. See docs/app/guide/rendering.",
+    );
+  }
+  const images = await imageEndpointFor(adapter, config.app?.builtins?.images);
+  const entries = shape.entries(
+    document,
+    cacheConfig,
+    buildId,
+    schedules,
+    regeneration,
+    images,
+    partial,
+  );
   const input = {};
   for (const name of Object.keys(entries)) {
     writeFileSync(path.join(work, `${name}.js`), entries[name]);
     input[name] = path.join(work, `${name}.js`);
   }
 
+  // An application React Server Components render bundles the rsc graph into
+  // its server, and a target with export conditions of its own needs that graph
+  // resolved under them as well: React's Flight server has a Node build and a
+  // worker build, exactly as its HTML renderer does.
+  const flight = flightStateOf(inline);
+  if (flight != null) {
+    loadFlightBuild(flight, path.join(root, ".uf", "build", "rsc"));
+    // The id `build` recorded, and not a new one: a Worker's payloads have to
+    // name the same build its documents do.
+    flight.deployment = document.deployment ?? null;
+    if (shape.conditions != null) {
+      await buildRscGraph(vite, inline, flight, {
+        outDir: path.join(work, "rsc"),
+        conditions: shape.conditions,
+      });
+    }
+  }
+
   const ssr = { ...(inline.ssr ?? {}), noExternal: true };
   if (shape.conditions != null) {
     // Which build of a dependency this target gets, and it is the difference
@@ -877,7 +1735,29 @@ async function deploy() {
   await vite.build({
     ...inline,
     customLogger: eventLogger("warn"),
-    plugins: [...inline.plugins, nativeAddonGuard()],
+    plugins: [
+      ...inline.plugins,
+      nativeAddonGuard(),
+      ...(shape.workerBuiltins === true
+        ? [
+            workerBuiltinGuard(),
+            esmExternalRequirePlugin({ external: [...builtinModules, /^node:/] }),
+          ]
+        : []),
+    ],
+    // Fixed, because this bundle inlines every dependency and so both of each
+    // React package's builds, and a runtime lookup of `NODE_ENV` in a worker
+    // finds nothing and picks the development one. React's Flight client's
+    // development build constructs a `WeakRef` for every response, which
+    // workerd does not have: every document the edge artefact rendered was a
+    // `ReferenceError`. The production build has none, and is the one a
+    // deployment means.
+    define: {
+      ...(inline.define ?? {}),
+      "process.env.NODE_ENV": JSON.stringify(
+        inline.mode === "development" ? "development" : "production",
+      ),
+    },
     ssr,
     build: {
       ...inline.build,
@@ -894,6 +1774,10 @@ async function deploy() {
       emptyOutDir: false,
       rollupOptions: {
         input,
+        // Workers provide the selected built-ins, but cannot use Node's
+        // createRequire(import.meta.url) runtime helper. External requires
+        // above become ESM imports; the remaining helpers are platform neutral.
+        ...(shape.workerBuiltins === true ? { platform: "neutral" } : {}),
         output: {
           entryFileNames: "[name].js",
           // Route modules are lazy `import()`s, so the server bundle splits
@@ -929,24 +1813,299 @@ async function deploy() {
  * out — `server.js` below does exactly that through
  * `@uniflowed/server/node`, and a worker hands `settle` to `ctx.waitUntil`.
  * It comes from the bundle rather than from the host's own
- * `@uniflowed/server`, because the request lives in an `AsyncLocalStorage`
- * belonging to a module instance and the instance the application reads is the
- * one inlined here. See ubugeeei-prod/uf#389.
+ * `@uniflowed/server`, because the request store is shared only by copies of
+ * one release of that package and the release the application reads is the one
+ * inlined here. See ubugeeei-prod/uf#389.
  *
  * The document's script and stylesheet URLs are baked in here because they
  * come from the client manifest, which exists at this moment and not in the
  * directory that gets copied.
+ *
+ * `cache` is `rendering.cache` from `uf.config.js`, and this is where two of
+ * its four switches stop being a field in a JSON file: a build that turned
+ * `route` or `fetch` on constructs a store here and hands it to the handler,
+ * and a build that turned neither on writes the file it always wrote, byte for
+ * byte. The store is constructed in the *generated* module rather than reached
+ * for inside `@uniflowed/server` for the same reason `beginRequest` is
+ * re-exported above — a module-level singleton belongs to whichever copy of the
+ * package a bundler happened to give it, and the copy that matters is the one
+ * the application resolved. See ubugeeei-prod/uf#277 and #389.
+ *
+ * # And where a durable store is named
+ *
+ * `rendering.cache.store` is the fifth key, and it is the one that turns the
+ * store into a shared one: `"filesystem"` links uf's built-in provider, and
+ * anything else is a module specifier the project wrote, imported here by name
+ * so the bundler links it like any other dependency of the application. Neither
+ * appears at all when the key is absent, which is what a default project keeps.
+ *
+ * `build` is baked in beside it, and it is the reason this can be an `import`
+ * at all rather than something read at boot: the build id is a fact about the
+ * artefact being written, known here and nowhere later. `internal/serve.js`'s
+ * `buildIdentity` is where it came from and
+ * `packages/server/internal/cache-key.js` is why it exists.
  */
-function handlerEntrySource(document) {
+function handlerEntrySource(document, cache, capabilities, build, regeneration, images, partial) {
+  const route = cache?.route === true;
+  const fetchCache = cache?.fetch === true;
+  const dataCache = cache?.data === true;
+  // Nothing at all when both switches are off, so a default project's
+  // `handler.js` is the file it has always been. A cache that appears in
+  // generated output nobody asked for is the second half of the complaint
+  // #277 makes about the first half.
+  const store = route || fetchCache || dataCache;
+  const durable = store ? durableStoreSource(root, cache, build) : null;
+  const options = [
+    "app",
+    `document: ${JSON.stringify(document)}`,
+    ...(store ? ["cache"] : []),
+    "capabilities",
+    // The pages this build regenerates, baked in beside the document and for
+    // the same reason: the manifest exists on the machine doing the build, and
+    // the deployed directory has only what this file carries.
+    ...(store && regeneration != null ? [`regeneration: ${JSON.stringify(regeneration)}`] : []),
+    ...(images == null ? [] : ["images"]),
+    // The static shells of the pages it prerendered partially, for the same
+    // reason. Absent for a build with none, so its `handler.js` is unchanged.
+    ...(partial != null ? [`partial: ${JSON.stringify(partial)}`] : []),
+  ].join(", ");
+  // The image endpoint keeps its variants over the same durable provider when
+  // there is one, so it needs the store constructor even for a build whose
+  // route cache is off; `imageEndpointSource` argues the rest.
+  const imageDurable =
+    images == null || store ? null : durableStoreSource(root, cache, build, { required: false });
+  const linkedDurable = durable ?? imageDurable;
+  const cacheImport =
+    store || imageDurable != null
+      ? 'import { createCacheStore } from "@uniflowed/server/cache";\n'
+      : "";
+  const providerImport = linkedDurable == null ? "" : `${linkedDurable.import}\n`;
+  const imageSource = images == null ? null : imageEndpointSource(images, linkedDurable, build);
+  const from = JSON.stringify(capabilities.module);
+  const capabilityImport = `import { ${capabilities.name} } from ${from};`;
   return `// Generated by \`uf build --adapter\`. Not checked in, not edited.
 import { createFetchHandler } from "@uniflowed/server/fetch";
-import * as app from ${JSON.stringify(VIRTUAL.server)};
-
-export const fetch = createFetchHandler({ app, document: ${JSON.stringify(document)} });
+${cacheImport}${providerImport}${capabilityImport}
+${imageSource == null ? "" : imageSource.imports}import * as app from ${JSON.stringify(VIRTUAL.server)};
+
+${
+  store
+    ? `// \`rendering.cache\` from uf.config.js. ${
+        durable == null
+          ? `One store per process: it is
+// emptied by a restart and is not shared with any other instance of this
+// application.`
+          : `Entries are kept by ${durable.what},
+// under this build's identity, so a restart finds them where it left them and
+// every process of this deployment reads one store — and \`revalidateTag\` in
+// any of them takes an entry out of the store all of them fill from.`
+      } See ubugeeei-prod/uf#277.
+const cache = { store: createCacheStore(${
+        durable == null ? "" : `{ provider: ${durable.provider}, build: ${JSON.stringify(build)} }`
+      }), route: ${String(route)}, fetch: ${String(fetchCache)}, data: ${String(dataCache)} };
+
+`
+    : ""
+}// What this target can do, and it is not the same for all six: whether a
+// response body reaches the client as it is produced, and whether the process
+// is still there once it has. A route handler that streams events or takes a
+// socket asks through this rather than finding out in production. Nothing is
+// passed for the upgrade or the queue — uf defines both and implements
+// neither. See \`@uniflowed/server/socket\` and \`@uniflowed/server/queue\`.
+const capabilities = ${capabilities.name}();
+${imageSource == null ? "" : `\n${imageSource.declaration}`}
+export const fetch = createFetchHandler({ ${options} });
 export const beginRequest = app.beginRequest;
+// \`app.router\`'s redirects and headers, for the entry beside this file to put
+// in front of its static half. Rewrites are \`fetch\`'s own.
+export const routing = app.routing;
+
+export default { fetch, beginRequest, routing };
+`;
+}
+
+/**
+ * The import and the expression that give a generated handler a durable store.
+ *
+ * `null` for `"memory"` and for a project that said nothing, which is every
+ * project until one asks: persistence is a second opt-in on top of `route` and
+ * `fetch`, not something a build decides on a project's behalf.
+ *
+ * The directory is baked in as written rather than resolved here, and that is
+ * deliberate. This function runs on the machine doing the build; the path has
+ * to mean something on the machine doing the *serving*, which may be a
+ * container with one writable mount or a Lambda with only `/tmp`. A relative
+ * one is resolved against the working directory at boot, by the provider, where
+ * the answer is a fact rather than a guess.
+ *
+ * The specifier is resolved against the project for the same reason
+ * `internal/serve.js`'s `providerSpecifier` does it: `"./cache/redis.js"` in
+ * `uf.config.js` is relative to the project, and this file is written into
+ * `.uf/deploy/work/`, where that path means nothing. Absolute is safe here
+ * because the bundler inlines the module rather than emitting the specifier.
+ *
+ * @param {string} root
+ * @param {{store?: string, storeDir?: string}} cache
+ * @param {string | null} build
+ */
+function durableStoreSource(root, cache, build, { required = true } = {}) {
+  const named = cache?.store ?? "memory";
+  if (named === "memory") return null;
+  if (build == null) {
+    // Only the image endpoint asks without requiring one: its variants are a
+    // cache of somebody else's images rather than of this build's documents,
+    // and memory is a correct, colder, answer for them.
+    if (!required) return null;
+    throw new Error(
+      `uf: rendering.cache.store is ${JSON.stringify(named)}, which keeps entries between ` +
+        "restarts, and this build has no identity to key them by. Run `uf build` so one is " +
+        "written, or set UF_BUILD_ID. Without one the deployment would answer this build's " +
+        "URLs with the previous build's documents.",
+    );
+  }
+  const directory = JSON.stringify(cache?.storeDir ?? path.join(".uf", "cache", "route"));
+  if (named === "filesystem") {
+    return {
+      import: 'import { createFilesystemCache } from "@uniflowed/server/cache/filesystem";',
+      provider: `createFilesystemCache({ directory: ${directory} })`,
+      what: "uf's filesystem provider",
+    };
+  }
+  const from = JSON.stringify(providerSpecifier(root, named));
+  return {
+    import: `import { createCacheProvider } from ${from};`,
+    provider: `createCacheProvider({ build: ${JSON.stringify(build)}, directory: ${directory} })`,
+    what: `${named}'s provider`,
+  };
+}
+
+/**
+ * What `--adapter` links for `/__uf/image`, or `null` for a project with no
+ * remote images.
+ *
+ * A deployed directory has no `uf` in it, so the encoder `uf start` uses is
+ * not there to link, and each target gets the one it has:
+ *
+ * * **`edge`**: Cloudflare's Images binding, through
+ *   `@uniflowed/server/image/edge` — the platform's own image service, handed
+ *   bytes uf fetched and checked rather than a URL it would fetch itself.
+ *   `uf` declares the binding in `wrangler.json` when it finds this linked.
+ * * **Every other target**: the module `app.builtins.images.transformer`
+ *   names, exporting `createImageTransformer`. `node`, `bun`, `deno`,
+ *   `container` and `serverless` have no image service to delegate to, and a
+ *   project that deploys to one names the encoder it has — `sharp`, a WASM
+ *   codec, a call to a service it runs — behind the same seam `uf` sits behind.
+ *
+ * A target with neither is refused here, by name, rather than linked with an
+ * endpoint that fetches every image and then fails to encode it.
+ *
+ * @param {string} adapter
+ * @param {object | undefined} images `app.builtins.images`
+ */
+async function imageEndpointFor(adapter, images) {
+  if (!servesRemoteImages(images)) return null;
+  const defaults = await import("@uniflowed/server/image");
+  const settings = {
+    remotePatterns: images.remotePatterns,
+    widths: images.widths ?? defaults.DEFAULT_WIDTHS,
+    quality: images.quality ?? defaults.DEFAULT_QUALITY,
+    qualities: images.qualities ?? [],
+  };
+  if (adapter === "edge") {
+    return { kind: "edge", settings };
+  }
+  const named = images.transformer;
+  if (typeof named !== "string" || named === "") {
+    throw new Error(
+      `uf: app.builtins.images.remotePatterns lists remote hosts, and \`--adapter ${adapter}\` ` +
+        "has no image encoder to link: uf encodes with the `uf` binary under `uf start` and " +
+        "`uf preview`, and a deployed directory does not carry it. Name a module exporting " +
+        "`createImageTransformer` in app.builtins.images.transformer, deploy with " +
+        "`--adapter edge` to use Cloudflare's image binding, or remove the remote patterns. " +
+        "See docs/app/guide/assets.",
+    );
+  }
+  return {
+    kind: "module",
+    settings,
+    specifier: providerSpecifier(root, named),
+    // Never on a deployment: a switch for a test that serves its own images.
+    allowPrivateAddresses: images.dangerouslyAllowPrivateAddresses === true,
+  };
+}
 
-export default { fetch, beginRequest };
+/**
+ * The lines `handler.js` needs for the endpoint [`imageEndpointFor`] chose.
+ *
+ * `durable` is the provider the route cache links, when it links one, so the
+ * variants live where the project already said entries survive a restart; a
+ * Worker with none keeps them in the isolate's memory.
+ *
+ * @param {{kind: "edge" | "module", settings: object, specifier?: string, allowPrivateAddresses?: boolean}} images
+ * @param {{provider: string} | null} durable
+ * @param {string | null} build
+ */
+function imageEndpointSource(images, durable, build) {
+  const imports =
+    images.kind === "edge"
+      ? 'import { createImageEndpoint, MAX_MEMORY_VARIANTS } from "@uniflowed/server/image";\n' +
+        'import { cloudflareImageTransform, edgeImageFetch } from "@uniflowed/server/image/edge";\n'
+      : 'import { createImageEndpoint, MAX_MEMORY_VARIANTS } from "@uniflowed/server/image";\n' +
+        'import { nodeImageFetch } from "@uniflowed/server/image/node";\n' +
+        `import { createImageTransformer } from ${JSON.stringify(images.specifier)};\n`;
+  const fetch =
+    images.kind === "edge"
+      ? "edgeImageFetch()"
+      : `nodeImageFetch(${images.allowPrivateAddresses ? "{ allowPrivateAddresses: true }" : ""})`;
+  const transform =
+    images.kind === "edge" ? "cloudflareImageTransform()" : "createImageTransformer()";
+  const store =
+    durable == null
+      ? ""
+      : `\n  store: createCacheStore({ provider: ${durable.provider}, build: ${JSON.stringify(
+          build,
+        )}, maxEntries: MAX_MEMORY_VARIANTS }),`;
+  const declaration = `// \`/__uf/image\`, for the remote hosts app.builtins.images.remotePatterns
+// lists. See \`@uniflowed/server/image\` and ubugeeei-prod/uf#958.
+const images = createImageEndpoint({
+  ...${JSON.stringify(images.settings)},
+  fetch: ${fetch},
+  transform: ${transform},${store}
+});
 `;
+  return { imports, declaration };
+}
+
+/**
+ * The lines a process entry needs to run what the project declared.
+ *
+ * Shared by `nodeEntrySource` and `bunEntrySource` because the two differ in
+ * which module they take `serve` from and in nothing else — and a schedule
+ * that behaved differently between them would be the drift the whole seam
+ * exists to prevent. Empty strings when a project declared none, so the entry
+ * a default project gets is the file it has always been.
+ */
+function scheduleLines(module, schedules) {
+  const declared = schedules ?? [];
+  if (declared.length === 0) {
+    return { imports: "", declarations: "", option: "" };
+  }
+  const built = declared
+    .map(
+      (schedule) =>
+        `  routeSchedule({ handle: fetch, beginRequest, path: ${JSON.stringify(
+          schedule.path,
+        )}, cron: ${JSON.stringify(schedule.cron)} }),`,
+    )
+    .join("\n");
+  return {
+    imports: `import { routeSchedule } from ${JSON.stringify(module)};\n`,
+    // A schedule runs the route by asking the application for it, so a
+    // scheduled run and a request for the same path are one code path. See
+    // ubugeeei-prod/uf#531.
+    declarations: `\nconst schedules = [\n${built}\n];\n`,
+    option: ", schedules",
+  };
 }
 
 /**
@@ -958,18 +2117,19 @@ export default { fetch, beginRequest };
  * request answered by `uf start` go through one implementation, not two that
  * agree today.
  */
-function nodeEntrySource(handlerSpecifier) {
+function nodeEntrySource(handlerSpecifier, schedules) {
+  const cron = scheduleLines("@uniflowed/server/schedule", schedules);
   return `// Generated by \`uf build --adapter node\`. Not checked in, not edited.
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { serve } from "@uniflowed/server/node";
-
+${cron.imports}
 // \`beginRequest\` comes from the handler beside this file rather than from
 // \`@uniflowed/server/node\` above, because the request has to be established in
 // the storage the *application* reads, which is the copy bundled into
 // \`handler.js\`. See ubugeeei-prod/uf#389.
-import { beginRequest, fetch } from ${JSON.stringify(handlerSpecifier)};
+import { beginRequest, fetch, routing } from ${JSON.stringify(handlerSpecifier)};
 
 // Resolved from this file and not from the working directory: a process
 // manager, a container entrypoint and a person in a shell each start a server
@@ -977,18 +2137,160 @@ import { beginRequest, fetch } from ${JSON.stringify(handlerSpecifier)};
 // assets when it was started from inside itself would be a deployment with a
 // trap in it.
 const staticDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "static");
-
+${cron.declarations}
 // Not \`await serve(...)\` at the top level. uf parses that now
 // (ubugeeei-prod/uf#204) and this entry is a module, so it would work; \`.catch\`
 // is the better spelling regardless — a server that cannot take its port should
 // say so and exit non-zero, rather than die as an unhandled rejection.
-serve({ handle: fetch, staticDir, beginRequest }).catch((error) => {
+serve({ handle: fetch, staticDir, beginRequest, routing${cron.option} }).catch((error) => {
+  process.stderr.write(\`uf: \${error?.message ?? String(error)}\\n\`);
+  process.exit(1);
+});
+`;
+}
+
+/**
+ * The oldest Bun that can run what this adapter writes.
+ *
+ * Kept equal to `uf_runtime`'s `BUN_MINIMUM` by
+ * `the_bun_entry_refuses_a_bun_older_than_the_declared_minimum`, which reads
+ * the number out of the artefact rather than out of this file — two places
+ * holding one version is exactly the shape that lets them disagree.
+ *
+ * Why there is a floor at all: React's published server build contains a
+ * labelled statement in `else` position — `else a: if (…)`, in every
+ * `react-dom-server*.production.js` including the `bun` one — and Bun's engine
+ * rejects it with `Cannot find scope for the label 'a'` before this release.
+ * Bun 1.3.13 rejects the built `handler.js`; 1.3.14 imports it and serves it.
+ * It is ordinary ES that Node runs, uf does not emit it, and the `bun` export
+ * condition does not avoid it, so there is nothing for uf to lower. See
+ * ubugeeei-prod/uf#1048.
+ */
+const MINIMUM_BUN = "1.3.14";
+
+/**
+ * The source of `server.js`: the Bun socket around that handler.
+ *
+ * `nodeEntrySource`'s twin, and identical but for the module it imports
+ * `serve` from — `@uniflowed/server/bun` exports the same signature on
+ * purpose, so that the two adapters are one contract and a project moving
+ * between them changes a flag and nothing else.
+ *
+ * # Why the handler is imported dynamically
+ *
+ * The one place this is *not* `nodeEntrySource`'s twin. A static
+ * `import … from "./handler.js"` is linked before a single statement of this
+ * file runs, so a version check written above it would never execute: Bun
+ * would fail parsing `handler.js` and the sentence explaining why would never
+ * be reached. `await import()` puts the check first, which is the same move
+ * `denoEntrySource` makes to get its globals in before the handler is
+ * evaluated.
+ */
+function bunEntrySource(handlerSpecifier, schedules) {
+  const cron = scheduleLines("@uniflowed/server/schedule", schedules);
+  return `// Generated by \`uf build --adapter bun\`. Not checked in, not edited.
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { serve } from "@uniflowed/server/bun";
+${cron.imports}
+// The Bun this build needs. React's server build carries a labelled statement
+// in \`else\` position that Bun's engine rejects before this release, so an
+// older Bun cannot parse \`handler.js\` at all — see ubugeeei-prod/uf#1048.
+//
+// This runs *before* the handler is imported, and that ordering is the whole
+// point: a static import would be linked first and the parse would fail with
+// Bun's message rather than this one.
+const MINIMUM_BUN = ${JSON.stringify(MINIMUM_BUN)};
+
+function ufBunIsOlderThanMinimum(version) {
+  const actual = String(version).split(".");
+  const floor = MINIMUM_BUN.split(".");
+  for (let index = 0; index < floor.length; index += 1) {
+    const mine = Number.parseInt(actual[index], 10);
+    const want = Number.parseInt(floor[index], 10);
+    if (!Number.isFinite(mine)) return true;
+    if (mine !== want) return mine < want;
+  }
+  return false;
+}
+
+if (typeof Bun !== "undefined" && ufBunIsOlderThanMinimum(Bun.version)) {
+  process.stderr.write(
+    \`uf: this build needs Bun \${MINIMUM_BUN} or newer, and this is Bun \${Bun.version}. \` +
+      "React's server build uses a labelled statement Bun rejects before " +
+      \`\${MINIMUM_BUN}, so \\\`handler.js\\\` beside this file cannot be parsed here. \` +
+      "Upgrade with \`bun upgrade\`, or build with \`--adapter node\` and run it on Node.\\n",
+  );
+  process.exit(1);
+}
+
+// \`beginRequest\` comes from the handler beside this file rather than from
+// \`@uniflowed/server/bun\` above, because the request has to be established in
+// the storage the *application* reads, which is the copy bundled into
+// \`handler.js\`. See ubugeeei-prod/uf#389.
+const { beginRequest, fetch, routing } = await import(${JSON.stringify(handlerSpecifier)});
+
+// Resolved from this file and not from the working directory: a process
+// manager, a container entrypoint and a person in a shell each start a server
+// from wherever they happen to be, and a directory that only served its own
+// assets when it was started from inside itself would be a deployment with a
+// trap in it.
+const staticDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "static");
+${cron.declarations}
+serve({ handle: fetch, staticDir, beginRequest, routing${cron.option} }).catch((error) => {
   process.stderr.write(\`uf: \${error?.message ?? String(error)}\\n\`);
   process.exit(1);
 });
 `;
 }
 
+/**
+ * The source of `server.js`: the Deno socket around that handler.
+ *
+ * The same generated contract as Node and Bun, with `@uniflowed/server/deno`
+ * owning the host-specific pieces. The static directory is resolved with
+ * `import.meta.url` alone so the entry carries no `node:` imports.
+ */
+function denoEntrySource(handlerSpecifier, schedules) {
+  const cron = scheduleLines("@uniflowed/server/schedule", schedules);
+  return `// Generated by \`uf build --adapter deno\`. Not checked in, not edited.
+import { serve } from "@uniflowed/server/deno";
+${cron.imports}
+// \`beginRequest\` comes from the handler beside this file rather than from
+// \`@uniflowed/server/deno\` above, because the request has to be established in
+// the storage the *application* reads, which is the copy bundled into
+// \`handler.js\`. See ubugeeei-prod/uf#389.
+//
+// Deno has no Node globals, but dependency bundles may still carry a CommonJS
+// production branch that expects a few of them. Establish the small environment
+// shape before \`handler.js\` is evaluated, which requires a dynamic import here
+// rather than a static one.
+globalThis.process ??= { env: {} };
+globalThis.process.env ??= {};
+globalThis.process.env.NODE_ENV ??= "production";
+globalThis.Buffer ??= {
+  byteLength(value) {
+    return new TextEncoder().encode(String(value)).byteLength;
+  },
+};
+globalThis.setImmediate ??= (callback, ...args) => setTimeout(callback, 0, ...args);
+globalThis.clearImmediate ??= (handle) => clearTimeout(handle);
+const { beginRequest, fetch, routing } = await import(${JSON.stringify(handlerSpecifier)});
+
+// Resolved from this file and not from the working directory: a process
+// manager and a person in a shell each start a server from wherever they
+// happen to be, and a directory that only served its own assets when it was
+// started from inside itself would be a deployment with a trap in it.
+const staticDir = decodeURIComponent(new URL("./static", import.meta.url).pathname);
+${cron.declarations}
+serve({ handle: fetch, staticDir, beginRequest, routing${cron.option} }).catch((error) => {
+  console.error(\`uf: \${error?.message ?? String(error)}\`);
+  Deno.exit(1);
+});
+`;
+}
+
 /**
  * The source of `worker.js`: the Cloudflare Workers entry around that handler.
  *
@@ -1001,13 +2303,47 @@ serve({ handle: fetch, staticDir, beginRequest }).catch((error) => {
  * `nodeEntrySource` gives: the request has to be established in the storage the
  * *application* reads. See ubugeeei-prod/uf#389.
  */
-function workerEntrySource(handlerSpecifier) {
+function workerEntrySource(handlerSpecifier, schedules) {
+  const declared = schedules ?? [];
+  // Nothing at all when the project declared none, so a `worker.js` without
+  // schedules is the file it has always been — and `wrangler.json` carries no
+  // `triggers` for it either, so there is nothing to call the export that
+  // would not be there.
+  if (declared.length === 0) {
+    return `// Generated by \`uf build --adapter edge\`. Not checked in, not edited.
+import { createWorkerFetch, installWorkerLogger } from "@uniflowed/server/edge";
+
+import { beginRequest, fetch as handle, routing } from ${JSON.stringify(handlerSpecifier)};
+
+// After the imports, so a logger the application installed while it loaded is
+// the one that stays; see \`installWorkerLogger\`.
+installWorkerLogger();
+
+export default { fetch: createWorkerFetch({ handle, beginRequest, routing }) };
+`;
+  }
+
+  // The expression Cloudflare fires, mapped to the route that answers it.
+  // `event.cron` arrives spelled exactly as `wrangler.json` spells it, and
+  // `uf` writes both from one list, so the two cannot disagree.
+  const routes = Object.fromEntries(declared.map((schedule) => [schedule.cron, schedule.path]));
   return `// Generated by \`uf build --adapter edge\`. Not checked in, not edited.
-import { createWorkerFetch } from "@uniflowed/server/edge";
+import { createWorkerFetch, createWorkerScheduled, installWorkerLogger } from "@uniflowed/server/edge";
 
-import { beginRequest, fetch as handle } from ${JSON.stringify(handlerSpecifier)};
+import { beginRequest, fetch as handle, routing } from ${JSON.stringify(handlerSpecifier)};
 
-export default { fetch: createWorkerFetch({ handle, beginRequest }) };
+// After the imports, so a logger the application installed while it loaded is
+// the one that stays; see \`installWorkerLogger\`.
+installWorkerLogger();
+
+// \`triggers.crons\` in the wrangler.json beside this file names these same
+// expressions. See ubugeeei-prod/uf#531.
+const routes = ${JSON.stringify(routes, null, 2)};
+
+export default {
+  fetch: createWorkerFetch({ handle, beginRequest, routing }),
+  scheduled: createWorkerScheduled({ handle, beginRequest, routes }),
+};
 `;
 }
 
@@ -1031,7 +2367,7 @@ import { fileURLToPath } from "node:url";
 
 import { createLambdaHandler } from "@uniflowed/server/lambda";
 
-import { beginRequest, fetch as handle } from ${JSON.stringify(handlerSpecifier)};
+import { beginRequest, fetch as handle, routing } from ${JSON.stringify(handlerSpecifier)};
 
 // Resolved from this file and not from the working directory: Lambda sets the
 // working directory to the task root today and is under no obligation to keep
@@ -1039,7 +2375,7 @@ import { beginRequest, fetch as handle } from ${JSON.stringify(handlerSpecifier)
 // deployment with a trap in it.
 const staticDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "static");
 
-export const handler = createLambdaHandler({ handle, beginRequest, staticDir });
+export const handler = createLambdaHandler({ handle, beginRequest, staticDir, routing });
 `;
 }
 
@@ -1050,8 +2386,14 @@ export const handler = createLambdaHandler({ handle, beginRequest, staticDir });
  * bytes of `dist/`. The document's script and stylesheet URLs are baked in
  * here because they come from the client manifest, which exists at this moment
  * and not inside the binary.
+ *
+ * `assetsFile` is the generated payload's path, and it appears in a comment
+ * rather than in the import: the module enters the graph under a virtual id so
+ * that uf's Flow transform never meets eight megabytes of base64. The reason
+ * that matters is `./internal/compile-assets.js`; naming the file here is what
+ * keeps a reader of the generated entry able to find the bytes it carries.
  */
-function entrySource(assetsSpecifier, document) {
+function entrySource(assetsFile, document) {
   // Not `await serve(...)` at the top level. uf parses that now
   // (ubugeeei-prod/uf#204) and this entry is a module, so it would work;
   // `.catch` is the better spelling regardless: a binary that cannot take its
@@ -1059,7 +2401,11 @@ function entrySource(assetsSpecifier, document) {
   // unhandled rejection.
   return `// Generated by \`uf build --compile\`. Not checked in, not edited.
 import { serve } from "@uniflowed/server/standalone";
-import { assets } from ${JSON.stringify(assetsSpecifier)};
+// Every file \`uf build\` wrote, base64 in one string. It is on disk at
+// ${assetsFile}, and it is imported under a virtual id so that uf's
+// Flow transform is never asked to parse it — see \`@uniflowed/vite\`'s
+// \`internal/compile-assets.js\` for why that matters.
+import { assets } from ${JSON.stringify(COMPILE_ASSETS_ID)};
 import * as app from ${JSON.stringify(VIRTUAL.server)};
 
 serve({ app, assets, document: ${JSON.stringify(document)} }).catch((error) => {
@@ -1105,6 +2451,38 @@ function nativeAddonGuard() {
   };
 }
 
+/**
+ * Say which Node built-ins the Worker being linked reaches and does not have.
+ *
+ * `--adapter edge` only. Every import the bundler resolves passes through here,
+ * and one naming a module `./internal/worker-builtins.js` measured as a stub at
+ * the compatibility date uf writes is kept with the file that imported it. Only
+ * the ones still in the output are reported — see `survivingImports` for the
+ * fixture that showed why — and as warnings rather than a refusal, for the
+ * reason that module gives: a deployment at a newer date may have the module,
+ * and uf cannot see that deployment. What it can do is say, before anything is
+ * uploaded, which request is going to answer 500 and why.
+ */
+function workerBuiltinGuard() {
+  const reached = [];
+  return {
+    name: "uf:worker-builtins",
+    enforce: "pre",
+    resolveId(source, importer) {
+      if (importer != null && unavailableOnWorkers(source) != null) {
+        reached.push({ specifier: source, importer });
+      }
+      return null;
+    },
+    generateBundle(_options, bundle) {
+      const chunks = Object.values(bundle).filter((output) => output.type === "chunk");
+      for (const warning of workerBuiltinWarnings(survivingImports(reached, chunks), root)) {
+        this.warn(warning);
+      }
+    },
+  };
+}
+
 /** `word`, pluralised for `count`. */
 function plural(count, word) {
   return count === 1 ? word : `${word}s`;
@@ -1116,6 +2494,138 @@ async function printConfig() {
   process.exit(0);
 }
 
+/**
+ * The React Server Components state `@uniflowed/vite` shares with this driver,
+ * or `null` for an application rendered from its modules.
+ *
+ * Read off the plugin rather than decided again here: `rendersFlight` in
+ * `./internal/flight.js` decides from the same `uf.config.js`, and a second
+ * reading of it would be the one that drifts.
+ */
+function flightStateOf(inline) {
+  const plugins = (inline.plugins ?? []).flat(Number.POSITIVE_INFINITY);
+  return plugins.find((plugin) => plugin?.name === "uf:flow")?.api?.flight ?? null;
+}
+
+/** What a later command needs of the rsc build, written beside its output. */
+const FLIGHT_BUILD_FILE = "uf-flight.json";
+
+/**
+ * Build the rsc graph into `outDir`.
+ *
+ * `conditions` are a deploy target's own, added to `react-server`; `null` is
+ * the Node server `uf build` writes. Vite's builder rather than `vite.build`,
+ * because the rsc graph is an environment of its own and `vite.build` builds
+ * the two Vite always has.
+ */
+async function buildRscGraph(vite, inline, state, { outDir, conditions }) {
+  const environment = {
+    build: {
+      outDir,
+      emptyOutDir: true,
+      rollupOptions: {
+        input: { index: FLIGHT_VIRTUAL.entry },
+        output: { entryFileNames: "[name].js", format: "es" },
+      },
+    },
+  };
+  if (conditions != null) {
+    environment.resolve = {
+      conditions: ["react-server", ...conditions],
+      externalConditions: ["react-server", ...conditions],
+    };
+  }
+  const builder = await vite.createBuilder({
+    ...inline,
+    customLogger: eventLogger("warn"),
+    environments: { [RSC_ENVIRONMENT]: environment },
+  });
+  await builder.build(builder.environments[RSC_ENVIRONMENT]);
+  state.rscOutput = path.join(outDir, "index.js");
+}
+
+/**
+ * Record the chunk each client module was built into, and write it down.
+ *
+ * Written down because `uf build --adapter` and `uf build --compile` bundle
+ * the server again in a process of their own, and a reference in the rsc
+ * output names its module by path, which only this build's manifest turns
+ * into a URL.
+ */
+function recordClientChunks(state, manifest, references, rscDir, base = "") {
+  for (const file of references) {
+    const key = path.relative(root, file).split(path.sep).join("/");
+    const chunk = manifest[key];
+    if (chunk == null) {
+      throw new Error(
+        `uf: the client build wrote no chunk for ${key}, which a server component renders as a ` +
+          "client component",
+      );
+    }
+    state.chunkUrls.set(file, `${base}/${chunk.file}`);
+  }
+  writeFileSync(
+    path.join(rscDir, FLIGHT_BUILD_FILE),
+    `${JSON.stringify({ chunkUrls: [...state.chunkUrls] }, null, 2)}\n`,
+  );
+}
+
+/** What `recordClientChunks` wrote, for a command that runs after `uf build`. */
+function loadFlightBuild(state, rscDir) {
+  const file = path.join(rscDir, FLIGHT_BUILD_FILE);
+  if (!existsSync(file)) {
+    throw new Error(
+      `uf: ${path.relative(root, file)} is missing, so there is no rsc graph to render routes ` +
+        "with; run `uf build` first",
+    );
+  }
+  state.chunkUrls = new Map(JSON.parse(readFileSync(file, "utf8")).chunkUrls);
+  state.rscOutput = path.join(rscDir, "index.js");
+}
+
+/**
+ * The tags a document React Server Components render needs.
+ *
+ * `assetsFromManifest`'s, with stylesheets from three places in the order they
+ * cascade: the rsc graph's first — every layout's and every server component's
+ * — then the client entry's, then each client module's own, which the client
+ * build emits beside that module's chunk and no import from the entry reaches.
+ *
+ * The rsc build's emitted files are copied under `dist/` so those URLs resolve,
+ * and only its assets: a server bundle's JavaScript is never a deployable file.
+ */
+function flightAssets(manifest, references, rscDir, outDir, base = "") {
+  const assets = assetsFromManifest(manifest, base);
+  const styles = new Set();
+  const rscManifest = path.join(rscDir, ".vite", "manifest.json");
+  if (existsSync(rscManifest)) {
+    const rscStyles = assetsFromManifest(
+      JSON.parse(readFileSync(rscManifest, "utf8")),
+      base,
+    ).styles;
+    for (const href of rscStyles) styles.add(href);
+  }
+  const rscAssets = path.join(rscDir, "assets");
+  if (existsSync(rscAssets)) {
+    cpSync(rscAssets, path.join(outDir, "assets"), {
+      recursive: true,
+      filter: (from) => !/\.(?:[cm]?js|map)$/.test(from),
+    });
+  }
+  for (const href of assets.styles) styles.add(href);
+  const seen = new Set();
+  const visit = (key) => {
+    if (seen.has(key)) return;
+    seen.add(key);
+    const chunk = manifest[key];
+    if (chunk == null) return;
+    for (const css of chunk.css ?? []) styles.add(`${base}/${css}`);
+    for (const imported of chunk.imports ?? []) visit(imported);
+  };
+  for (const file of references) visit(path.relative(root, file).split(path.sep).join("/"));
+  return { ...assets, styles: [...styles] };
+}
+
 function readManifest(outDir) {
   const file = path.join(outDir, ".vite", "manifest.json");
   if (!existsSync(file)) throw new Error(`uf: the client build wrote no manifest at ${file}`);
@@ -1123,24 +2633,151 @@ function readManifest(outDir) {
 }
 
 /**
- * The URLs to prerender: every route without parameters, plus every set of
- * parameters a page's `generateStaticParams` returns.
+ * What this build renders now, and what it leaves for a server.
+ *
+ * The rendering decision, per route, and it has three answers rather than the
+ * two `staticPaths` used to have:
+ *
+ *   * **prerender it** — a route with no parameters, or a route whose page
+ *     exports `generateStaticParams`, once per set of parameters it returns;
+ *   * **leave it to the server** — a route with parameters and no
+ *     `generateStaticParams`, or a page that has said `export const dynamic =
+ *     "force-dynamic"`;
+ *   * **refuse** — which is not decided here. This function reports what it
+ *     found and the caller, which knows whether the project allows a server,
+ *     is the one that turns "there is a route here a static host cannot
+ *     answer" into an error.
+ *
+ * `dynamic` is the spelling ubugeeei-prod/uf#336 asked for: a route with *no*
+ * parameters whose content depends on the request had no way to say so, and
+ * `generateStaticParams` cannot say it — there are no parameters to generate.
+ * It is Next.js's name for the same declaration, because a person arriving
+ * from `app/` should not have to learn a second word for a decision they have
+ * already made once.
+ *
+ * Two of Next's four values are missing and are not silently accepted:
+ * `"force-static"` and `"error"` are refused by name, because each is a
+ * *constraint* on a page that uf does not yet check, and accepting one would
+ * be reading a declaration and ignoring it — the failure the two issues behind
+ * this function are about.
+ *
+ * Handlers and middleware are in the same list, and they belong there: this is
+ * the list of things that need a process, and a `$route.js` needs one more
+ * obviously than any page does. They carry no per-route render — the build has
+ * never written a file for either — so they appear only when the answer might
+ * be a refusal.
+ *
+ * @param {{routes: Route[], handlers: Handler[], middleware: Middleware[]}} server
+ * @param {"everything" | "possible" | "nothing"} prerender
  */
-async function staticPaths(routes) {
+async function renderingPlan(server, prerender) {
   const urls = [];
-  for (const route of routes) {
+  const perRequest = [];
+
+  // One document, and it is no route's, so there is no route to ask anything
+  // about. `perRequest` is empty rather than "every route": nothing here is
+  // left for a server — the browser answers all of it — and listing routes
+  // under a heading that means "these need a process" would be a build
+  // describing itself wrongly to `uf`, which prints that list.
+  if (prerender === "shell") {
+    return { urls: [], perRequest: [] };
+  }
+
+  // Nothing is prerendered and nothing is refused, so no page module is
+  // loaded: a project that renders everything per request should not pay for
+  // a `generateStaticParams` this build will not call.
+  if (prerender === "nothing") {
+    return {
+      urls,
+      perRequest: server.routes.map((route) => ({
+        path: route.path,
+        why: "this build prerenders nothing",
+      })),
+    };
+  }
+
+  for (const route of server.routes) {
+    // Every page module, and not only the parameterised ones: `dynamic` is a
+    // declaration any page can make. A module that cannot be imported at all
+    // is a failure of *that route*, so a route with no parameters goes into
+    // the prerender anyway and the loop below reports it the way it has always
+    // reported a page that throws — named, with the rest of the build still
+    // happening. A parameterised one still rejects out of the build, which is
+    // what it did before there was anything else to load a page module for.
+    let module;
+    try {
+      module = await route.page();
+    } catch (error) {
+      if (route.params.length > 0) throw error;
+      urls.push(route.path);
+      continue;
+    }
+    const declared = module.dynamic ?? "auto";
+    if (declared !== "auto" && declared !== "force-dynamic") {
+      throw new Error(
+        `uf: ${route.file} exports \`dynamic = ${JSON.stringify(declared)}\`, and uf reads ` +
+          '`"auto"` and `"force-dynamic"`. `"force-static"` and `"error"` are Next.js values ' +
+          "for constraints uf does not check yet, and accepting one would be reading a " +
+          "declaration and ignoring it.",
+      );
+    }
+    if (declared === "force-dynamic") {
+      perRequest.push({
+        path: route.path,
+        why: 'its page exports `dynamic = "force-dynamic"`',
+      });
+      continue;
+    }
     if (route.params.length === 0) {
       urls.push(route.path);
       continue;
     }
-    const module = await route.page();
     const generate = module.generateStaticParams;
-    if (typeof generate !== "function") continue;
+    if (typeof generate !== "function") {
+      perRequest.push({
+        path: route.path,
+        why: "it has parameters and its page exports no `generateStaticParams`",
+      });
+      continue;
+    }
     for (const params of await generate()) {
       urls.push(fillParams(route.path, params));
     }
   }
-  return urls;
+
+  for (const handler of server.handlers ?? []) {
+    perRequest.push({
+      path: handler.path,
+      why: "it is a route handler, and a handler answers a request rather than producing a file",
+    });
+  }
+  for (const entry of server.middleware ?? []) {
+    // A middleware is reported by the path it guards rather than by the route
+    // it guards, which is why it cannot be folded into the loop above: it runs
+    // for a page, for a handler, and for a path under it that is neither, so
+    // "which route is this" has no single answer.
+    perRequest.push({
+      path: `${entry.path === "/" ? "" : entry.path}/*`,
+      why: "a middleware guards it, and a middleware runs once per request",
+    });
+  }
+  // And `app.router`'s three lists, by the source each rule matches: a file
+  // can be neither a redirect nor a rewrite, and a header a file is served
+  // with is the host's to add rather than the file's.
+  for (const [key, what] of [
+    ["redirects", "a redirect"],
+    ["rewrites", "a rewrite"],
+    ["headers", "a response header"],
+  ]) {
+    for (const rule of server.routing?.[key] ?? []) {
+      perRequest.push({
+        path: rule.source,
+        why: `\`app.router.${key}\` names it, and ${what} is answered when a request arrives`,
+      });
+    }
+  }
+
+  return { urls, perRequest };
 }
 
 function fillParams(routePath, params) {
@@ -1160,9 +2797,36 @@ function fillParams(routePath, params) {
     .join("/");
 }
 
-function htmlPathFor(outDir, url) {
-  const pathname = url.split("?")[0].replace(/^\/+/, "");
-  return pathname === ""
-    ? path.join(outDir, "index.html")
+/**
+ * The file a prerendered page is written to.
+ *
+ * `guide/index.html`, which every static host serves at `/guide/` and most at
+ * `/guide`, unless `app.router.trailingSlash` is `"never"` — then `guide.html`,
+ * which the same hosts serve at `/guide` without a redirect to the slash.
+ * Next.js's static export makes the same choice from the same setting.
+ */
+function htmlPathFor(outDir, url, trailingSlash = "ignore") {
+  const pathname = url.split("?")[0].replace(/^\/+/, "").replace(/\/+$/, "");
+  if (pathname === "") return path.join(outDir, "index.html");
+  return trailingSlash === "never"
+    ? path.join(outDir, `${pathname}.html`)
     : path.join(outDir, pathname, "index.html");
 }
+
+/**
+ * The URL path at which a static half answers the document `htmlPathFor`
+ * wrote for `url` under `REGENERATED_DIRECTORY`.
+ *
+ * Ending in a slash, so every host answers it with that directory's
+ * `index.html` in the same way: a Node static half tries `index.html` for such
+ * a path, and a Worker's assets binding serves it without the redirect it
+ * answers `…/index.html` with.
+ */
+function regeneratedDocumentUrl(url) {
+  const pathname = url.split("?")[0].replace(/^\/+/, "").replace(/\/+$/, "");
+  const encoded = pathname
+    .split("/")
+    .map((segment) => encodeURIComponent(segment))
+    .join("/");
+  return pathname === "" ? `/${REGENERATED_DIRECTORY}/` : `/${REGENERATED_DIRECTORY}/${encoded}/`;
+}