What makes you think that server-side JS could not call a private API with authentication? If it's a "front-end generator", we are talking about gerating stati

What makes you think that server-side JS could not call a private API with authentication? If it's a "front-end generator", we are talking about gerating static HTML, CSS, JS though. This means all "secrets" have to be embedded in client code, or the API calls have to be made at build time, with the static result embedded into the output. So I don't see your point really. If your point is talking to a database "directly", using only a database client and no remote intermediary, you can do this in Node as well. And presumably also in RSCs, since it's already possible in SSR. None of this is prescribed by React.