Ids

Every server function has an id: the first 128 bits of sha256(path + "#" + export name) in base64url, 22 characters. path is the file's path relative to the project root with / separators, so the id is the same on every machine and in dev and build. It also means that renaming the file or the export changes the id, and so does moving a function-level "use server" function above another one in its file. fnId from @shadow-js/dusk/vite computes it.

The id is the only name in the URL. An id the server does not know, a malformed id and an id with extra path segments get a 404; the first two answer with identical bodies (the request id apart), and the lookup of an id is a table read that loads no module, so the endpoint does not reveal which ids exist by its answer or its time. (An id that exists answers 405 for the wrong method: ids are not secrets, they are in the client bundle of the functions it calls.) A batch item that names _batch, or an id of any length that is not 1 to 128 of A-Z a-z 0-9 - _, is a 404 envelope for that item; the others of the batch run. A browser that still runs the previous build after a deploy calls ids that the new server may no longer have; the stub receives the router's notFound() signal for them.