@canmi/web 2026.1005.2 → 2026.1005.3

package/dist/disclose/src/build.d.ts

@@ -1,7 +1,7 @@
 import { Disclosure } from "./index.js";
 //#region disclose/src/build.d.ts
 /**
- * What an app is made of, read from its `package.json` at build time.
+ * What an app is made of, read from its `package.json` at build time: only what it lists itself.
  *
  * A version is the installed package's, read from its own `package.json` beside the app rather than
  * through its exports, which rarely offer it. See spec/web/disclose.md.

package/dist/disclose/src/build.js

@@ -2,23 +2,28 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 //#region disclose/src/build.ts
 /**
-* The packages whose version a Wappalyzer fingerprint reads, by the name an app installs them as.
-*
-* Only an app that lists one in its own `package.json` gets its version; the others are absent.
+* The packages whose version a component's own patch reads, by the name an app installs them as:
+* used on some pages only, so the component that uses one discloses it. See spec/web/disclose.md.
 */
 const VERSIONED = [
 	"@codemirror/view",
 	"@videojs/core",
-	"algoliasearch",
 	"d3-hierarchy"
 ];
+/** The globals a package used on every page is disclosed as, given its installed version. */
+const GLOBALS = {
+	algoliasearch: (version) => ({ "__algolia.algoliasearch.version": version }),
+	motion: () => ({ MotionIsMounted: true })
+};
+/** The address a package is named by in the page's data block, for a fingerprint that reads one. */
+const REFERENCES = { "@tanstack/svelte-query": "https://tanstack.com/query" };
 /** A dependency an app is deployed to Cloudflare Workers with. */
 const WORKERS = ["@sveltejs/adapter-cloudflare", "wrangler"];
 function readJson(path) {
 	return JSON.parse(readFileSync(path, "utf8"));
 }
 /**
-* What an app is made of, read from its `package.json` at build time.
+* What an app is made of, read from its `package.json` at build time: only what it lists itself.
 *
 * A version is the installed package's, read from its own `package.json` beside the app rather than
 * through its exports, which rarely offer it. See spec/web/disclose.md.
@@ -26,13 +31,15 @@ function readJson(path) {
 function disclosure(root) {
 	const manifest = readJson(join(root, "package.json"));
 	const names = /* @__PURE__ */ new Set([...Object.keys(manifest.dependencies ?? {}), ...Object.keys(manifest.devDependencies ?? {})]);
+	const installed = (name) => readJson(join(root, "node_modules", name, "package.json")).version;
 	const versions = {};
-	for (const name of VERSIONED) {
-		if (!names.has(name)) continue;
-		versions[name] = readJson(join(root, "node_modules", name, "package.json")).version;
-	}
+	for (const name of VERSIONED) if (names.has(name)) versions[name] = installed(name);
+	const globals = {};
+	for (const [name, entries] of Object.entries(GLOBALS)) if (names.has(name)) Object.assign(globals, entries(installed(name)));
 	return {
 		versions,
+		globals,
+		references: Object.entries(REFERENCES).filter(([name]) => names.has(name)).map(([, address]) => address),
 		...WORKERS.some((name) => names.has(name)) ? { runtime: "Cloudflare Workers" } : {}
 	};
 }

package/dist/disclose/src/index.d.ts

@@ -6,9 +6,21 @@
 export interface Disclosure {
   /** Installed versions, by package name, of the packages a fingerprint reads a version for. */
   readonly versions: Readonly<Record<string, string>>;
+  /** Globals for what every page uses, by dotted path, set by `discloseGlobals`. */
+  readonly globals: Readonly<Record<string, unknown>>;
+  /** Addresses named in the page's data block, written by `disclosureHead`. */
+  readonly references: readonly string[];
   /** Where the app runs, when a fingerprint names it: set for an app deployed to Workers. */
   readonly runtime?: 'Cloudflare Workers';
 }
+/**
+ * The head an app's root layout writes with `{@html}`: the `runtime` meta, and a data block naming
+ * `references`, which the browser never runs and a profiler reads as script text. Empty when there
+ * is nothing to say. See spec/web/disclose.md.
+ */
+export declare function disclosureHead(disclosure: Disclosure | undefined): string;
+/** Sets `globals` on `window`, from an app's root layout; nothing on the server. */
+export declare function discloseGlobals(disclosure: Disclosure | undefined): void;
 /**
  * What the page is built with, said where a profiler reads it: each dotted path set on `window`,
  * the objects on the way made as needed, nothing already there replaced, and an undefined value

package/dist/disclose/src/index.js

@@ -1,5 +1,24 @@
 //#region disclose/src/index.ts
 /**
+* The head an app's root layout writes with `{@html}`: the `runtime` meta, and a data block naming
+* `references`, which the browser never runs and a profiler reads as script text. Empty when there
+* is nothing to say. See spec/web/disclose.md.
+*/
+function disclosureHead(disclosure) {
+	if (!disclosure) return "";
+	const parts = [];
+	if (disclosure.runtime) parts.push(`<meta name="runtime" content="${disclosure.runtime}">`);
+	if (disclosure.references.length > 0) {
+		const data = JSON.stringify(disclosure.references).replaceAll("<", "\\u003c");
+		parts.push(`<script type="application/json" data-disclosure>${data}<\/script>`);
+	}
+	return parts.join("");
+}
+/** Sets `globals` on `window`, from an app's root layout; nothing on the server. */
+function discloseGlobals(disclosure) {
+	if (disclosure) disclose(disclosure.globals);
+}
+/**
 * What the page is built with, said where a profiler reads it: each dotted path set on `window`,
 * the objects on the way made as needed, nothing already there replaced, and an undefined value
 * skipped, so an entry the build did not find is simply absent. A patch for
@@ -22,4 +41,4 @@ function disclose(entries) {
 	}
 }
 //#endregion
-export { disclose };
+export { disclose, discloseGlobals, disclosureHead };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canmi/web",
-  "version": "2026.1005.2",
+  "version": "2026.1005.3",
   "description": "SvelteKit compat, referer and Sentry.",
   "keywords": [
     "browserslist",