@dokebi/template-inertia 0.4.4 → 0.4.6

package/AI.md

@@ -12,8 +12,8 @@ npm run build                                       # dist/ (browser) + dist/ssr
 
 > `npx dokebi` is the @dokebi/cli installed in the project (`dokebi init` adds it to devDependencies). The npm package `dokebi` is not this CLI, so never use `npx -y dokebi`. Without an installed CLI use `npx -y @dokebi/cli …`.
 
-- `export async function shared(request)` of `src/infra/inertia/shared.ts` is merged into every page's props (the call's props win).
-- Plugins add shared props through `dokebi-web:view-data` (D-0076 §5, for example `auth` of an auth plugin): they come first, then `shared` of the entry, then the scope's `shared` (@dokebi/app adds `app`, `sealed`), then the page props. Partial reloads filter them like other props. A plugin key `errors` or `flash`, or one key from two plugins, refuses the setup (`VIEW_DATA_CONFLICT`).
+- `export async function shared(request)` of `src/infra/inertia/shared.ts` is merged into every page's props (the call's props win): the visitor's own (the user, preferences). `export function publicShared(request)` (0.4.6, D-0195) holds what is the same for every visitor (the site's name, its menu); it also goes into the first HTML of public pages (§3.5). Any other export is `INVALID_ENTRY`.
+- Plugins add shared props through `dokebi-web:view-data` (D-0076 §5, for example `auth` of an auth plugin): they come first, then `publicShared` and `shared` of the entry, then the scope's `publicShared` (@dokebi/app adds `app`, `sealed`) and `shared`, then the page props. Partial reloads filter them like other props. A plugin key `errors` or `flash`, or one key from two plugins, refuses the setup (`VIEW_DATA_CONFLICT`). View data a plugin calls `public` (@dokebi/i18n's `locale` and `i18n`) is the same for every visitor; the rest (`auth`, `csrf`) is the visitor's own.
 - app.ts of an Inertia app: `inertia: { title, vite: { manifest: 'dist/.vite/manifest.json', entry: 'src/apps/<app>/views/app.js', base: '/build/' }, ssr?: { bundle: 'dist/ssr/<app>/ssr.js' } }`.
 - The project's `vite.config.ts` (written once by `app add --inertia`) has `plugins: [vue(), dokebiInertia()]` (§4.1). Keep `dokebiInertia()` in a config of your own.
 
@@ -53,7 +53,7 @@ route.post('/orders', async (request, reply, page) => {
 });
 ```
 
-- `render(request, reply, component, props?, { encryptHistory?, clearHistory? }?)`: GET/HEAD only. The fifth argument sets history handling for this response (otherwise the scope setting and the session signal). Return or await it in the handler. component is `/`-separated parts matching `[A-Za-z0-9][A-Za-z0-9_-]*`.
+- `render(request, reply, component, props?, { encryptHistory?, clearHistory?, public?, head? }?)`: GET/HEAD only. The fifth argument sets history handling for this response (otherwise the scope setting and the session signal), whether the page is public and its head tags (§3.5). Return or await it in the handler. component is `/`-separated parts matching `[A-Za-z0-9][A-Za-z0-9_-]*`. Unknown option keys are `INVALID_RENDER`.
 - props: JSON values, async lazy functions or the helpers of §3.1. A partial reload (`only`, `except`) evaluates only the selected ones; `errors` is always included. Non-JSON values (`undefined`, functions, symbols, `NaN`, `Infinity`) fail with `TypeError: Page props must be JSON serializable`, BigInt with `JSON.stringify`'s `TypeError`, cycles with a `TypeError` `Converting circular structure to JSON` (outside production at once, naming the prop that closes the cycle; an object used twice without a cycle is fine). Development and tests (`NODE_ENV` not `production`) check every value of the page; production checks only the top-level props and leaves the rest to `JSON.stringify` (D-0068; a 30 KB page went from 112 to 24 µs), so this mistake is caught during development.
 - Prop types in TypeScript: describe props with `type` aliases (`type Post = { id: number; title: string }`), not `interface`. An interface has no index signature, so TypeScript refuses it where `Json` is required (`npm run typecheck` fails with "Index signature for type 'string' is missing"); a `type` with the same fields is accepted (AI-M04).
 - The Vue side is type-checked too: `dokebi app add --inertia` makes `npm run typecheck` run `vue-tsc` after `tsc` (`node typecheck-vue.mjs -p tsconfig.vue.json`), which checks the `<script>` and the `<template>` of every `.vue` file. Write pages as `<script setup lang="ts">` with `defineProps<{ … }>()`; the shared props (`$page.props`, `usePage().props`) are typed in `src/infra/inertia/page.d.ts` (add a key there for what `src/infra/inertia/shared.ts` returns), and a prop only some pages get with `usePage<{ … }>()`. A Vite build is not a Vue type check.
@@ -176,6 +176,34 @@ A page whose entry script cannot be fetched (a `dokebi dev` restart, a deploy in
 - CSP: web's default policy allows both inline blocks (`'unsafe-inline'`). A policy without it needs their hashes in `style-src` and `script-src` — the debug records `Inertia error answers` and `Inertia scope created` carry `bootFallback.cspHashes` (fixed per root id and timeout) — or `bootFallback: { enabled: false }`.
 - A scope (`scope({ bootFallback })`, an app's inertia options) has its own; `false` there turns it off for that scope.
 
+### 3.5 Public pages and head tags (0.4.6, D-0195)
+
+A public page's first HTML is the same for every visitor — a crawler, a guest, a signed-in member — so a search engine reads it, a shared cache may keep it, and on a **seal host it is plain and server rendered** too (the other pages of that host stay sealed, §8).
+
+```ts snippet
+route.get('/notices/:id', async (request, reply, page) =>
+  page.inertia!.render(request, reply, 'Notice', { notice: await findNotice(request.params.id) }, {
+    public: { cacheControl: 'public, max-age=60' },      // or public: true (no-store stays)
+    head: {
+      title: notice.title,                                 // escaped; replaces the configured and the SSR title
+      description: notice.summary,
+      canonical: `https://gaonjs.dev/notices/${notice.id}`,
+      alternates: [{ hreflang: 'en', href: `https://gaonjs.dev/en/notices/${notice.id}` }, { hreflang: 'x-default', href: `https://gaonjs.dev/notices/${notice.id}` }],
+      meta: [{ property: 'og:title', content: notice.title }],
+    },
+  }),
+);
+```
+
+- **What the first HTML holds**: the render's props and the **public** shared props only — view data its plugin calls public (@dokebi/i18n `locale`, `i18n`), the entry's `publicShared`, the scope's `publicShared` (@dokebi/app `app`, `sealed`). The visitor's own — other view data (`auth` of @dokebi/auth, `csrf` of @dokebi/csrf), the entry's `shared`, the scope's `shared` — are left out and named in the deferred group **`dokebi-visitor`** (`VISITOR_GROUP`). The Inertia client fetches that group right after the page starts (a partial reload: a visit, sealed on a seal host). The flash and the history reset are not read; the next page gets them (the visitor fetch is a deferred fetch and leaves them too). A key both public and the visitor's counts as the visitor's.
+- **Write the layout for the moment before**: `'auth' in usePage().props` is false until the group arrives, on the server and while hydrating alike (same markup, no hydration warning). `<Deferred data="auth">` of `@inertiajs/vue3` does the same for a part of a page.
+- **Your props are yours**: only public data in the props of a public page. The framework keeps the shared props out; it cannot know what the handler put in.
+- **On a seal host** the first HTML is plain with `<meta name="dokebi-seal" content="host">` (`SEAL_HOST_META`) and server rendered when the scope has `ssr`. `sealInertia(http)` of `@dokebi/seal/http` sees the marker, leaves `data-page` as it is and seals every visit, form and `sealedFetch` after it; the `views/app.js` of `dokebi app add --inertia` calls it for `script[data-page][data-sealed="true"], meta[name="dokebi-seal"][content="host"]` (a project made before 0.4.6 changes that one line by hand). `encryptHistory` stays on there.
+- **Cache-Control**: `no-store` unless `public.cacheControl` (1–256 printable ASCII characters) is given; an answer that sets a cookie anyway (a handler that wrote the session) goes back to `no-store`. `Vary: X-Inertia` stays. Put the language in the URL (@dokebi/i18n `http.pathLocale`): a page whose language comes from Accept-Language or a cookie says `Vary: Accept-Language, Cookie`. The i18n prop of a public first HTML ignores the bundle cookie (every bundle is sent), so it does not vary by browser.
+- **`head`** (any page, sealed or not, server rendered or not; the first HTML only — visits keep Vue's `<Head>`): `title`, `description`, `canonical`, `robots`, `alternates` (`{ hreflang, href }`, a language tag or `x-default`), `meta` (`{ name, content }` or `{ property, content }`); URLs are http(s) or local absolute paths; at most 64 alternates and 64 meta; everything is escaped. The tags carry no `data-inertia`, so Inertia's head manager leaves them. `INVALID_RENDER` for anything else. Types: `InertiaHead`, `InertiaHeadAlternate`, `InertiaHeadMeta`.
+- Debug log `Inertia public page` (`component`, `sealedHost`, `serverRendered`, `visitor` keys, `cacheControl`); `Inertia public page sets a cookie: not cacheable`.
+- Example: `examples/80-sealed-public-ssr` (real Chromium).
+
 ## 4. Serving build files
 
 With `vite`, the manifest (at most `viteManifestMaxBytes`, 4 MiB) is read once in setup, and the files reachable from the entry (static and dynamic chunks, CSS, assets) are served at the exact path `<base><file>` (`cache-control: public, max-age=31536000, immutable`). Each file is read on its first request and kept in memory (files above `assetCacheMaxBytes`, 4 MiB, are streamed per request), so rebuild with new hashed names and restart instead of changing a served file in place. A missing manifest fails the start (`Vite manifest not found: … Build the views first (npm run build).`), and so does a missing entry.
@@ -188,7 +216,7 @@ The seal client (`@dokebi/seal/http`) keeps its seal (the bridge, the clock offs
 
 - `vite build` (client): the import stays an import of `/dokebi/seal/http.mjs` (an absolute external). The bundle carries no copy, and no import map is needed.
 - dev server (`dokebi dev`): Vite would prefix an absolute import with `base`, so the import goes to `<base>@dokebi-served/seal/http.mjs` (`DEV_MODULE_PREFIX`), which the plugin answers before Vite with `export * from "/dokebi/seal/http.mjs"`: the browser still loads the served file, once.
-- server rendering (SSR builds, development SSR): untouched; Node resolves the package as usual (sealed pages are never server rendered, §8).
+- server rendering (SSR builds, development SSR): untouched; Node resolves the package as usual (only public pages of a seal host are server rendered, and they are plain, §3.5).
 - Vite's dependency optimizer (dev only): the plugin adds `dokebi-inertia:served-deps` to `optimizeDeps.rolldownOptions.plugins`, which keeps the served names and `@dokebi-served` ids external there. The scan pre-bundles the app's other dependencies as usual, and a pre-bundled dependency that imports `@dokebi/seal/http` uses the served module too. No `optimizeDeps` setting of your own is needed for it.
 
 So a Vue page writes a plain static import, and the dynamic import of the generated bootstrap uses the same name:
@@ -247,7 +275,7 @@ const answer = await sealedFetch('/posts/preview', { method: 'POST', body: { tit
 
 ## 6. Scopes
 
-`await api.scope({ title?, rootId?, version?, scripts?, styles?, vite?, ssr?, shared?, sealed?, app?, encryptHistory?, errorPage? })` → a renderer with those settings (`InertiaScopeOptions`). Unset values come from the plugin options; `shared` is merged after the plugin's shared props. @dokebi/app calls it per app (`app` is the app's name, used only in log records: 1–64 printable ASCII characters, otherwise `INVALID_SCOPE`). Every renderer also has `answerError(response)` (D-0074, §3.3): the validation redirect or the error page for a dokebi-web error answer, false when it wrote nothing; the plugin registers the root renderer's as a web error responder, and @dokebi/app calls the app's.
+`await api.scope({ title?, rootId?, version?, scripts?, styles?, vite?, ssr?, shared?, publicShared?, sealed?, app?, encryptHistory?, errorPage? })` → a renderer with those settings (`InertiaScopeOptions`). Unset values come from the plugin options; `publicShared` and `shared` are merged after the plugin's shared props (`publicShared` also into public first pages, §3.5). The engine contributed to web says `publicPages: true` (D-0195), which @dokebi/app checks before it passes `publicShared`. @dokebi/app calls it per app (`app` is the app's name, used only in log records: 1–64 printable ASCII characters, otherwise `INVALID_SCOPE`). Every renderer also has `answerError(response)` (D-0074, §3.3): the validation redirect or the error page for a dokebi-web error answer, false when it wrote nothing; the plugin registers the root renderer's as a web error responder, and @dokebi/app calls the app's.
 
 ## 6a. View engine contribution and errors (D-0063)
 
@@ -269,12 +297,11 @@ const answer = await sealedFetch('/posts/preview', { method: 'POST', body: { tit
 | `VITE_MANIFEST_INVALID` | `InertiaError` | not a file, larger than `viteManifestMaxBytes` (4 MiB), not a JSON object (the parse error is the `cause`), or `vite.entry` is not in the manifest |
 | `VITE_DEV_MISSING` | `InertiaError` | `DOKEBI_VITE_DEV=1` but the project has no vite |
 | `VITE_DEV_UNAVAILABLE` | `InertiaError` | The Vite host of `dokebi dev` (`DOKEBI_VITE_DEV_URL`) cannot be reached or refuses the key, the URL is not loopback, or the key is missing |
-| `SEAL_SSR_CONFLICT` | `InertiaError` | SSR in a seal-host scope or for a sealed request (D-0062) |
 | `METHOD_NOT_ALLOWED` | `InertiaError` | `render` for a request that is not GET or HEAD |
 | `CLOSED` | `InertiaError` | `render` after the app stopped |
-| `INVALID_ENTRY` | `InertiaUsageError` | the entry exports something other than the `shared` function |
-| `INVALID_SCOPE` | `InertiaUsageError` | bad `scope()` settings (`app`, `sealed`, `shared`, `vite`, `ssr`, asset URLs) |
-| `INVALID_RENDER` | `InertiaUsageError` | bad component name or render options |
+| `INVALID_ENTRY` | `InertiaUsageError` | the entry exports something other than the `shared` and `publicShared` functions |
+| `INVALID_SCOPE` | `InertiaUsageError` | bad `scope()` settings (`app`, `sealed`, `shared`, `publicShared`, `vite`, `ssr`, asset URLs) |
+| `INVALID_RENDER` | `InertiaUsageError` | bad component name or render options (`public`, `head`, unknown keys, §3.5) |
 | `INVALID_PROPS` | `InertiaUsageError` | `Page props must be JSON serializable` |
 | `INVALID_URL` | `InertiaUsageError` | a redirect or asset that is not a local absolute URL; a location that is neither that nor an http(s) URL |
 | `INVALID_PROP_HELPER` | `InertiaUsageError` | bad arguments to `defer`, `merge` or `once` |
@@ -294,7 +321,7 @@ const answer = await sealedFetch('/posts/preview', { method: 'POST', body: { tit
 - For requests to a seal host (@dokebi/app `domains.<host>.seal: true`) the first HTML's `data-page` is one sealed frame (`data-sealed="true"`, `E:<ts>:<b64>`), and dokebi-web seals visit (JSON) responses. The decision is dokebi-web's `sealOf(request)`. The browser opens it in the generated `views/app.js` entry (reusable browser helpers belong in `views/runtime/`) with `await sealInertia(http)` (`@dokebi/seal/http`; the CLI template imports it dynamically only when `data-sealed` is set, and `dokebiInertia()` maps it to the served `/dokebi/seal/http.mjs`, §4.1) before `createInertiaApp`.
 - **Never read `data-page` at the top of a page module**: pages and modules loaded through `import.meta.glob(..., { eager: true })` run before `sealInertia`, so they would parse the still-sealed text as JSON and the app stops. Read it through `usePage()` or when connecting.
 - Testing from Node: `SealedClient` of `@dokebi/seal/testing` opens the sealed first page (`navigate`) and sends Inertia visits as `sealInertia(http)` does (`inertia(path, { method, data })`: `X-Inertia`, the version, `X-XSRF-TOKEN`, the data sealed, the page opened); use one client per simulated user for concurrent HTTP tests (seal AI.md §5.5).
-- It cannot be combined with SSR: `scope({ sealed: true, ssr })` fails the start with `SEAL_SSR_CONFLICT` (dokebi-app passes `sealed` for apps on seal domains), and a sealed request to an SSR scope fails that request with `SEAL_SSR_CONFLICT`.
+- With SSR (0.4.6, D-0195): a sealed request is server rendered only for the first HTML of a **public page** (§3.5), which is plain and holds no visitor's value. Every other page of a seal host keeps the sealed first HTML and is never server rendered; `scope({ sealed: true, ssr })` starts (debug `Inertia scope created` says `ssrOnSealedHosts: 'public pages'`). Before 0.4.6 that combination failed with `SEAL_SSR_CONFLICT`, which no longer exists.
 - Pages with `encryptHistory` on (default `'sealed'`) are stored encrypted in the browser history (only in secure contexts: HTTPS and `*.localhost`). `clearHistory` is set on the page when @dokebi/session 0.2's `historyReset()` is true (`destroy` or `regenerate` in this request); for a request that renders no page (a login POST → 303) it is carried to the **next page** with the cookie `dokebi.history-reset` (10 minutes). After logout, "back" cannot show the old props and fetches them from the server again.
 
 References: `examples/48-inertia-i18n` (real Chromium: Korean and English pages from one catalog, CSR and SSR, visits that carry only new messages, language switch without a reload; D-0126: 85 bundles kept between page loads, a reload from the store, cleared storage, a changed and a garbage cookie, ko→en→ko), `tests/i18n.test.ts`, `tests/i18n-store.test.ts` and `tests/i18n-page.test.ts` (the runtime, the store and recovery before mounting, parity with the server translator, SSR through @inertiajs/vue3 with bundles the HTML left out), `examples/24-template-inertia` (real Chrome: CSR, SSR, cluster, measurements), `examples/26-scaffold` (build and server render of a CLI-generated SSR app, its Error page), `examples/25-playground` (the guestbook form: `only`, `form.errors`), `tests/flash.test.ts` (session flash), `tests/errors.test.ts` (validation redirect, error page), `tests/vite-plugin.test.ts` (the Vite plugin: dev host, client and SSR builds), `examples/28-recipes` (a CLI-generated sealed app in real Chromium: a Vue page's static `sealedFetch` import seals its body and opens the answer), D-0027, D-0031, D-0039, D-0045, D-0052, D-0055, D-0062, D-0074.

package/README.md

@@ -92,9 +92,13 @@ With `DOKEBI_VITE_DEV=1` (set by `dokebi dev`) the project's Vite starts in midd
 
 The dev server serves only what the browser loads (D-0129): the views folders of the apps, the folders of the browser entries, `node_modules` and the files those modules import. `dokebi.yaml`, `.env`, `.dokebi/`, keys, compose files and the server code (`src/` outside `views/`, `tests/`, `scripts/`) answer 403 by every spelling (`?raw`, `/@fs/`, encoded, other letter cases, symlinks), and a remote host such as a `devHosts` tunnel gets a short 403 without paths. `dokebiInertia()` enforces this and the Vite host of `dokebi dev` adds it to a config without the plugin; the app may add to `server.fs.allow` and `deny` (or `dokebiInertia({ allow, deny })`) but never remove the framework's entries. Details: AI.md §5.2.
 
+## Public pages (0.4.6, D-0195)
+
+`render(request, reply, component, props, { public: true, head })` marks a page whose first HTML is the same for every visitor: it carries the render's props and the public shared props (view data a plugin calls public, such as @dokebi/i18n's, and `publicShared` of the entry and the scope), while the visitor's own (`auth`, `csrf`, the entry's `shared`) are named in the deferred group `dokebi-visitor` and fetched by the client right after it starts. On a seal host that HTML is plain and server rendered (with `<meta name="dokebi-seal" content="host">`, which tells `sealInertia` to seal everything after it), so crawlers read the page. `public: { cacheControl }` lets a shared cache keep it (an answer that sets a cookie stays `no-store`). `head` writes escaped title, description, canonical, robots, `hreflang` alternates and meta tags into the first HTML of any page, sealed ones included. Details: AI.md §3.5; example `examples/80-sealed-public-ssr`.
+
 ## Seal hosts and history (D-0062, 0.2.0)
 
-[D-0062](https://git.nyx-zone.com/dokebi/framework/-/blob/main/docs/decisions/D-0062-http-seal.md). The first HTML of a sealed request (dokebi-web `sealOf`) carries only `<script data-page="app" type="application/json" data-sealed="true">E:…</script>` (the title is the configured one), and dokebi-web seals visit JSON. The browser opens it with `sealInertia(http)` of `@dokebi/seal/http`. Combined with SSR it is `SEAL_SSR_CONFLICT`.
+[D-0062](https://git.nyx-zone.com/dokebi/framework/-/blob/main/docs/decisions/D-0062-http-seal.md). The first HTML of a sealed request (dokebi-web `sealOf`) carries only `<script data-page="app" type="application/json" data-sealed="true">E:…</script>` (the title is the configured one), and dokebi-web seals visit JSON. The browser opens it with `sealInertia(http)` of `@dokebi/seal/http`. With SSR, only a public page's first HTML is server rendered there (0.4.6, below); the others stay sealed.
 
 The seal client keeps its seal in module state, so the bootstrap and every `sealedFetch` must be one module instance: the one the app serves (`/dokebi/seal/http.mjs`, from @dokebi/seal). The Vite plugin `dokebiInertia()` of `@dokebi/template-inertia/vite` (in the generated `vite.config.ts`) makes every `import … from '@dokebi/seal/http'` (and `@dokebi/seal/forms`) of the app's browser code load that served file: the client build keeps it as an import of `/dokebi/seal/http.mjs` (no bundled copy, no import map), the dev server answers `<base>@dokebi-served/seal/http.mjs` with `export * from "/dokebi/seal/http.mjs"`, Vite's dependency optimizer keeps them external (so pre-bundling of the other dependencies works), and server rendering is untouched. A Vue page then simply writes `import { sealedFetch } from '@dokebi/seal/http'`.
 

package/dist/boot-fallback.js

@@ -80,11 +80,14 @@ const escapeHtml = (value) => value
 function textsFor(settings, language) {
     const tag = (language ?? '').toLowerCase();
     const primary = tag.split('-')[0] ?? '';
-    const builtIn = BUILT_IN[primary] ?? BUILT_IN.en;
+    // Own keys only: Content-Language is any text the app set (`constructor`, `__proto__` named
+    // Object.prototype members and left the texts undefined: the page answered 500).
+    const own = (table, key) => Object.hasOwn(table, key) ? table[key] : undefined;
+    const builtIn = own(BUILT_IN, primary) ?? BUILT_IN.en;
     return {
         ...builtIn,
-        ...settings.messages[primary],
-        ...settings.messages[tag],
+        ...own(settings.messages, primary),
+        ...own(settings.messages, tag),
     };
 }
 /**

package/dist/errors.d.ts

@@ -1,6 +1,6 @@
 import { DokebiError, type DokebiErrorOptions } from '@dokebi/core';
 /** Codes of `InertiaError` (failures of setup, files and the page flow). */
-export type InertiaErrorCode = 'SSR_BUNDLE_MISSING' | 'SSR_BUNDLE_INVALID' | 'SSR_ENTRY_MISSING' | 'SSR_TIMEOUT' | 'VITE_MANIFEST_MISSING' | 'VITE_MANIFEST_INVALID' | 'VITE_DEV_MISSING' | 'VITE_DEV_UNAVAILABLE' | 'SEAL_SSR_CONFLICT' | 'METHOD_NOT_ALLOWED' | 'CLOSED';
+export type InertiaErrorCode = 'SSR_BUNDLE_MISSING' | 'SSR_BUNDLE_INVALID' | 'SSR_ENTRY_MISSING' | 'SSR_TIMEOUT' | 'VITE_MANIFEST_MISSING' | 'VITE_MANIFEST_INVALID' | 'VITE_DEV_MISSING' | 'VITE_DEV_UNAVAILABLE' | 'METHOD_NOT_ALLOWED' | 'CLOSED';
 /** Codes of `InertiaUsageError` (a wrong argument: a TypeError, as before 0.4.0). */
 export type InertiaUsageErrorCode = 'INVALID_ENTRY' | 'INVALID_SCOPE' | 'INVALID_RENDER' | 'INVALID_PROPS' | 'INVALID_URL' | 'INVALID_PROP_HELPER' | 'SSR_INVALID_RESULT' | 'INVALID_PRUNE';
 /** Failures of @dokebi/template-inertia; compare `code`, not the class. */

package/dist/errors.js

@@ -9,12 +9,11 @@ const FIX = {
     VITE_MANIFEST_INVALID: 'Point vite.manifest at .vite/manifest.json of a Vite build (at most viteManifestMaxBytes, 4 MiB by default) and vite.entry at one of its entries.',
     VITE_DEV_MISSING: 'npm install --save-dev vite (DOKEBI_VITE_DEV=1 serves the views through it).',
     VITE_DEV_UNAVAILABLE: 'Run the app with dokebi dev, which starts one Vite dev host and sets DOKEBI_VITE_DEV_URL and DOKEBI_VITE_DEV_KEY; or unset both to start Vite in this process.',
-    SEAL_SSR_CONFLICT: 'Set inertia.ssr: false for the app of a seal host, or remove seal: true from its domains (D-0062).',
     METHOD_NOT_ALLOWED: 'Render pages for GET/HEAD; redirect after POST/PUT/PATCH/DELETE (303).',
     CLOSED: 'Render only while the application runs.',
-    INVALID_ENTRY: 'The Inertia entry (src/infra/inertia/shared.ts) exports only shared: (request) => props.',
-    INVALID_SCOPE: 'Give scope() document settings (title, rootId, version, scripts, styles or vite, ssr, encryptHistory), shared as a function and sealed as a boolean; vite replaces version, scripts and styles.',
-    INVALID_RENDER: 'render(request, reply, component, props?, { encryptHistory?, clearHistory? }): component is names of letters, digits, _ or - joined by /.',
+    INVALID_ENTRY: 'The Inertia entry (src/infra/inertia/shared.ts) exports only shared: (request) => props and publicShared: (request) => props.',
+    INVALID_SCOPE: 'Give scope() document settings (title, rootId, version, scripts, styles or vite, ssr, encryptHistory), shared and publicShared as functions and sealed as a boolean; vite replaces version, scripts and styles.',
+    INVALID_RENDER: 'render(request, reply, component, props?, { encryptHistory?, clearHistory?, public?, head? }): component is names of letters, digits, _ or - joined by /; public is true or { cacheControl }; head holds title, description, canonical, robots, alternates and meta as documented (AI.md §3.5).',
     INVALID_PROPS: 'Page props must be JSON values: no undefined, functions, symbols, NaN or Infinity (use null, or leave the prop out).',
     INVALID_URL: 'Use a local absolute URL such as /posts/1 (not //host, no backslash or spaces).',
     INVALID_PROP_HELPER: 'defer(fn, { group? }), merge(value, { deep?, matchOn? }), once(value, { key? }): a JSON value or a function, with the documented options.',

package/dist/head.d.ts

@@ -0,0 +1,37 @@
+/** A `<link rel="alternate" hreflang>` of the page (the same page in another language). */
+export interface InertiaHeadAlternate {
+    /** A language tag (`ko`, `en-US`) or `x-default`. */
+    readonly hreflang: string;
+    /** An absolute http(s) URL, or a local absolute path. */
+    readonly href: string;
+}
+/** A `<meta>` by `name` (`twitter:card`) or by `property` (Open Graph `og:title`). */
+export type InertiaHeadMeta = {
+    readonly name: string;
+    readonly content: string;
+} | {
+    readonly property: string;
+    readonly content: string;
+};
+/** The head tags of the first HTML (`render(…, { head })`). */
+export interface InertiaHead {
+    /** The document title; replaces the configured title and a `<title>` of the SSR bundle. */
+    readonly title?: string;
+    /** `<meta name="description">`. */
+    readonly description?: string;
+    /** `<link rel="canonical">`: an absolute http(s) URL or a local absolute path. */
+    readonly canonical?: string;
+    /** `<meta name="robots">` (`noindex, nofollow`). */
+    readonly robots?: string;
+    /** `<link rel="alternate" hreflang>`, at most 64. */
+    readonly alternates?: readonly InertiaHeadAlternate[];
+    /** More `<meta>` tags (Open Graph, Twitter cards), at most 64. */
+    readonly meta?: readonly InertiaHeadMeta[];
+}
+/** The checked head: its title (when given) and the other tags, escaped. */
+export interface HeadMarkup {
+    readonly title?: string;
+    readonly tags: string;
+}
+/** Checks `head` and writes its tags; throws INVALID_RENDER for anything else. */
+export declare function headMarkup(input: unknown): HeadMarkup;

package/dist/head.js

@@ -0,0 +1,80 @@
+// D-0195: the head of a page's first HTML, given by the route (`render(…, { head })`): what a
+// crawler or a link preview reads before any script runs — on a sealed page too, whose props
+// leave sealed. Structured on purpose: every value is text or a URL, escaped here, so a title
+// from the database never becomes markup.
+import { InertiaUsageError } from './errors.js';
+const TEXT_MAX = 4096;
+const TITLE_MAX = 1024;
+const URL_MAX = 2048;
+const LIST_MAX = 64;
+const LANGUAGE = /^(?:x-default|[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*)$/;
+const META_NAME = /^[A-Za-z][A-Za-z0-9:._-]{0,127}$/;
+const KEYS = ['title', 'description', 'canonical', 'robots', 'alternates', 'meta'];
+const escapeHtml = (value) => value.replace(/[&<>"']/g, (char) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[char] ?? char);
+const refuse = (message) => {
+    throw new InertiaUsageError('INVALID_RENDER', message);
+};
+function text(value, field, max) {
+    if (typeof value !== 'string' || value.length > max)
+        refuse(`head.${field} must be a string of at most ${max} characters`);
+    return value;
+}
+/** An absolute http(s) URL or a local absolute path, without spaces or control characters. */
+function url(value, field) {
+    const given = text(value, field, URL_MAX);
+    const local = given.startsWith('/') && !given.startsWith('//') && !given.includes('\\');
+    const absolute = !local && URL.canParse(given) && /^https?:$/.test(new URL(given).protocol);
+    if ((!local && !absolute) || [...given].some((char) => char.charCodeAt(0) <= 32))
+        refuse(`head.${field} must be an http(s) URL or a local absolute path`);
+    return given;
+}
+function list(value, field) {
+    if (!Array.isArray(value) || value.length > LIST_MAX)
+        refuse(`head.${field} must be an array of at most ${LIST_MAX} entries`);
+    return value;
+}
+function record(value, field) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        refuse(`head.${field} must be an object`);
+    return value;
+}
+/** Checks `head` and writes its tags; throws INVALID_RENDER for anything else. */
+export function headMarkup(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        refuse('head must be an object');
+    const head = input;
+    for (const key of Object.keys(head))
+        if (!KEYS.includes(key))
+            refuse(`head.${key} is not a head field (${KEYS.join(', ')})`);
+    const tags = [];
+    const title = head.title === undefined ? undefined : text(head.title, 'title', TITLE_MAX);
+    if (head.description !== undefined)
+        tags.push(`<meta name="description" content="${escapeHtml(text(head.description, 'description', TEXT_MAX))}">`);
+    if (head.robots !== undefined)
+        tags.push(`<meta name="robots" content="${escapeHtml(text(head.robots, 'robots', 256))}">`);
+    if (head.canonical !== undefined)
+        tags.push(`<link rel="canonical" href="${escapeHtml(url(head.canonical, 'canonical'))}">`);
+    if (head.alternates !== undefined)
+        list(head.alternates, 'alternates').forEach((entry, index) => {
+            const alternate = record(entry, `alternates[${index}]`);
+            if (Object.keys(alternate).some((key) => key !== 'hreflang' && key !== 'href'))
+                refuse(`head.alternates[${index}] has only hreflang and href`);
+            const language = text(alternate.hreflang, `alternates[${index}].hreflang`, 64);
+            if (!LANGUAGE.test(language))
+                refuse(`head.alternates[${index}].hreflang must be a language tag or x-default`);
+            tags.push(`<link rel="alternate" hreflang="${escapeHtml(language)}" href="${escapeHtml(url(alternate.href, `alternates[${index}].href`))}">`);
+        });
+    if (head.meta !== undefined)
+        list(head.meta, 'meta').forEach((entry, index) => {
+            const meta = record(entry, `meta[${index}]`);
+            const keys = Object.keys(meta).sort().join(',');
+            if (keys !== 'content,name' && keys !== 'content,property')
+                refuse(`head.meta[${index}] is { name, content } or { property, content }`);
+            const kind = 'name' in meta ? 'name' : 'property';
+            const name = text(meta[kind], `meta[${index}].${kind}`, 128);
+            if (!META_NAME.test(name))
+                refuse(`head.meta[${index}].${kind} must be letters, digits, :, ., _ or -`);
+            tags.push(`<meta ${kind}="${escapeHtml(name)}" content="${escapeHtml(text(meta.content, `meta[${index}].content`, TEXT_MAX))}">`);
+        });
+    return Object.freeze({ ...(title === undefined ? {} : { title }), tags: tags.join('') });
+}

package/dist/index.d.ts

@@ -3,12 +3,19 @@ import type { FastifyRequest } from 'fastify';
 import { type InertiaApi, type Props } from './responder.js';
 export type { InertiaBootFallback, InertiaBootMessages } from './boot-fallback.js';
 export { InertiaError, type InertiaErrorCode, InertiaUsageError, type InertiaUsageErrorCode, } from './errors.js';
+export type { InertiaHead, InertiaHeadAlternate, InertiaHeadMeta, } from './head.js';
 export { type InertiaPluginOptions, options } from './options.js';
 export { type DeferOptions, deepMerge, defer, InertiaProp, isInertiaProp, type MergeOptions, merge, type OnceOptions, once, type PropValue, } from './props.js';
-export type { InertiaApi, InertiaErrorResponse, InertiaFlash, InertiaOptions, InertiaPage, InertiaRenderOptions, InertiaSsrResult, Json, Props, } from './responder.js';
+export { type InertiaApi, type InertiaErrorResponse, type InertiaFlash, type InertiaOptions, type InertiaPage, type InertiaRenderOptions, type InertiaSsrResult, type Json, type Props, SEAL_HOST_META, VISITOR_GROUP, } from './responder.js';
 export type InertiaShared = (request: FastifyRequest) => Awaitable<Props>;
 export interface InertiaEntry {
+    /** The visitor's own props of every page (the user, preferences): never in a public page's first HTML. */
     readonly shared?: InertiaShared;
+    /**
+     * D-0195: props of every page that are the same for every visitor of a URL (the site's menu,
+     * its name): they go into the first HTML of public pages too.
+     */
+    readonly publicShared?: InertiaShared;
 }
 /**
  * Server rendering of the first HTML of a page (D-0039), in this process: the SSR build output is
@@ -52,8 +59,13 @@ export interface InertiaScopeOptions {
     };
     /** Server rendering for this scope; unset uses the plugin's `ssr`, `false` turns it off. */
     readonly ssr?: InertiaSsrOptions | false;
-    /** Props merged after the plugin's shared props for every page of this scope. */
+    /** Props merged after the plugin's shared props for every page of this scope (the visitor's own). */
     readonly shared?: InertiaShared;
+    /**
+     * D-0195: props of every page of this scope that are the same for every visitor (dokebi-app
+     * gives `app` and `sealed`): they also go into the first HTML of public pages.
+     */
+    readonly publicShared?: InertiaShared;
     /** History encryption of this scope's pages (default `'sealed'`: on for sealed requests). */
     readonly encryptHistory?: boolean | 'sealed';
     /**
@@ -62,8 +74,8 @@ export interface InertiaScopeOptions {
      */
     readonly errorPage?: string | false;
     /**
-     * This scope answers seal hosts (dokebi-app sets it, D-0062). Server rendering would write the
-     * props as plain HTML, so `sealed` with SSR stops the start (`SEAL_SSR_CONFLICT`).
+     * This scope answers seal hosts (dokebi-app sets it, D-0062). With `ssr`, a sealed request is
+     * server rendered only for a public page's first HTML (D-0195); other pages stay sealed.
      */
     readonly sealed?: boolean;
     /**
@@ -75,6 +87,8 @@ export interface InertiaScopeOptions {
 /** The `inertia` engine contributed to `dokebi-web:view-engine` (web `WebViewEngine` shape). */
 export interface InertiaViewEngine {
     readonly name: 'inertia';
+    /** D-0195: `scope` takes `publicShared` and `render` takes `public` (dokebi-app checks it). */
+    readonly publicPages: true;
     scope(input: InertiaScopeOptions): Promise<InertiaApi>;
 }
 export interface InertiaPluginApi extends InertiaApi {

package/dist/index.js

@@ -13,12 +13,13 @@ import { bootHashes } from './boot-fallback.js';
 import { builtFolderFile, HASHED } from './built-files.js';
 import { InertiaError, InertiaUsageError } from './errors.js';
 import { options } from './options.js';
-import { InertiaResponder, normalizeInertiaOptions, vary, } from './responder.js';
+import { cacheableReplies, InertiaResponder, normalizeInertiaOptions, vary, } from './responder.js';
 import { isViteUpgrade, openViteDev, viteDevRequested } from './vite-dev.js';
 import { DEV_CLIENT_HEADER, isLoopbackHost, isRemoteRequest } from './vite-files.js';
 export { InertiaError, InertiaUsageError, } from './errors.js';
 export { options } from './options.js';
 export { deepMerge, defer, InertiaProp, isInertiaProp, merge, once, } from './props.js';
+export { SEAL_HOST_META, VISITOR_GROUP, } from './responder.js';
 /** The SSR render deadline when `ssr.timeoutMs` is not set (D-0107 §4); the schema's default. */
 const SSR_TIMEOUT_MS = 5000;
 const SSR_TIMEOUT_MAX_MS = 600_000;
@@ -299,10 +300,6 @@ const session = optionalDependency({
     name: 'dokebi-session',
     version: '^0.4.0',
 });
-/** SSR writes props as plain HTML: it cannot serve a sealed scope (D-0062). */
-function sealSsrConflict() {
-    return new InertiaError('SEAL_SSR_CONFLICT', 'An Inertia scope of seal hosts cannot use SSR: server rendering writes the props as plain HTML. Set ssr: false for this app or drop seal from its hosts.');
-}
 /** The boot text of a scope for its debug record: the CSP hashes of its inline style and script. */
 function bootLog(options) {
     const boot = options.bootFallback;
@@ -345,26 +342,27 @@ function parseEntry(input) {
         types.isProxy(input) ||
         ![Object.prototype, null].includes(Object.getPrototypeOf(input)))
         throw new InertiaUsageError('INVALID_ENTRY', 'Invalid Inertia entry');
-    let shared;
+    const found = {};
     for (const key of Reflect.ownKeys(input)) {
         // Module namespaces carry Symbol.toStringTag; only string exports are entry fields.
         if (typeof key !== 'string')
             continue;
         const descriptor = Object.getOwnPropertyDescriptor(input, key);
-        if (key !== 'shared' || !descriptor || !('value' in descriptor))
+        if ((key !== 'shared' && key !== 'publicShared') || !descriptor || !('value' in descriptor))
             throw new InertiaUsageError('INVALID_ENTRY', 'Invalid Inertia entry');
-        shared = descriptor.value;
+        if (descriptor.value !== undefined && typeof descriptor.value !== 'function')
+            throw new InertiaUsageError('INVALID_ENTRY', `Inertia ${key} must be a function`);
+        if (descriptor.value !== undefined)
+            found[key] = descriptor.value;
     }
-    if (shared !== undefined && typeof shared !== 'function')
-        throw new InertiaUsageError('INVALID_ENTRY', 'Inertia shared must be a function');
-    return shared === undefined ? {} : { shared: shared };
+    return found;
 }
 class InertiaRuntime {
     settings;
-    shared;
-    constructor(settings, shared) {
+    entry;
+    constructor(settings, entry) {
         this.settings = settings;
-        this.shared = shared;
+        this.entry = entry;
     }
     async setup(context) {
         const server = context.getDependency(web);
@@ -374,15 +372,59 @@ class InertiaRuntime {
             plugin: 'dokebi-template-inertia',
             reserved: ['errors', 'flash'],
         });
-        const entryShared = this.shared;
-        const shared = !pluginData.keys.length
-            ? entryShared
-            : entryShared
-                ? async (request) => ({
-                    ...(await pluginData.values(request)),
-                    ...(await entryShared(request)),
-                })
-                : async (request) => (await pluginData.values(request));
+        const entryShared = this.entry.shared;
+        const entryPublic = this.entry.publicShared;
+        // D-0195: view data its contributor calls public (@dokebi/i18n) goes into a public page's
+        // first HTML; a dokebi-web before 0.4.6 names none, so all of it waits for the visit.
+        const publicView = new Set(pluginData.publicKeys ?? []);
+        const visitorView = pluginData.keys.filter((key) => !publicView.has(key));
+        const PUBLIC_VIEW = Object.freeze({ public: true });
+        /**
+         * The shared props of a scope (D-0195), in this order, later winning: plugin view data, the
+         * entry's `publicShared`, its `shared`, the scope's `publicShared`, its `shared`. For a
+         * public first HTML only the public ones are computed; the keys of the others are named.
+         */
+        const sharedSource = (scopePublic, scopeShared) => {
+            if (!pluginData.keys.length && !entryShared && !entryPublic && !scopePublic && !scopeShared)
+                return undefined;
+            return {
+                resolve: async (request, view) => {
+                    if (view.public) {
+                        const data = publicView.size
+                            ? await pluginData.values(request, PUBLIC_VIEW)
+                            : undefined;
+                        const props = {
+                            ...data,
+                            ...(await entryPublic?.(request)),
+                            ...(await scopePublic?.(request)),
+                        };
+                        // A dokebi-web before 0.4.6 gives every value: only the public keys are kept.
+                        if (data)
+                            for (const key of Object.keys(data))
+                                if (!publicView.has(key))
+                                    delete props[key];
+                        const visitor = [
+                            ...visitorView,
+                            ...Object.keys((await entryShared?.(request)) ?? {}),
+                            ...Object.keys((await scopeShared?.(request)) ?? {}),
+                        ];
+                        return { props, visitor };
+                    }
+                    const data = pluginData.keys.length
+                        ? (await pluginData.values(request))
+                        : undefined;
+                    const publicOwn = await entryPublic?.(request);
+                    const own = await entryShared?.(request);
+                    const scopeOwnPublic = await scopePublic?.(request);
+                    const scopeOwn = await scopeShared?.(request);
+                    return {
+                        props: { ...data, ...publicOwn, ...own, ...scopeOwnPublic, ...scopeOwn },
+                        visitor: [...visitorView, ...Object.keys(own ?? {}), ...Object.keys(scopeOwn ?? {})],
+                    };
+                },
+            };
+        };
+        const shared = sharedSource(undefined, undefined);
         const sessions = context.getOptionalDependency(session);
         const sessionOf = (request) => 
         // Static paths excluded by the session plugin have none (`request.session` is null).
@@ -438,6 +480,22 @@ class InertiaRuntime {
                 }
                 : {}),
         });
+        // D-0195: a public first page with the app's own Cache-Control must never be kept by a
+        // shared cache when its answer sets a cookie (a session, a token): back to no-store.
+        const cacheGuard = async (scope) => {
+            scope.addHook('onSend', async (request, reply, payload) => {
+                if (!cacheableReplies.has(reply) || !reply.hasHeader('set-cookie'))
+                    return payload;
+                reply.header('Cache-Control', 'no-store');
+                if (logger.isEnabled('debug'))
+                    logger.log('debug', 'Inertia public page sets a cookie: not cacheable', {
+                        route: request.routeOptions.url ?? 'unmatched',
+                    });
+                return payload;
+            });
+        };
+        cacheGuard[Symbol.for('skip-override')] = true;
+        server.register(cacheGuard, {});
         if (sessions) {
             const carry = async (scope) => {
                 scope.addHook('onSend', async (request, reply, payload) => {
@@ -480,7 +538,9 @@ class InertiaRuntime {
             devHosts: this.settings.devHosts.length,
             defaultVersion: this.settings.defaultVersion,
             shared: entryShared !== undefined,
+            publicShared: entryPublic !== undefined,
             viewData: pluginData.keys,
+            publicViewData: [...publicView],
             flash: flash !== undefined,
             historyReset: hooks.historyReset !== undefined,
             encryptHistory: this.settings.document.encryptHistory,
@@ -917,7 +977,7 @@ class InertiaRuntime {
             render: rootRender,
             ssrStats: () => Object.freeze({ ...stats }),
             scope: async (options) => {
-                const { shared: extra, vite, ssr: ssrInput, sealed = false, app: appName, ...fields } = (options ?? {});
+                const { shared: extra, publicShared: extraPublic, vite, ssr: ssrInput, sealed = false, app: appName, ...fields } = (options ?? {});
                 // Audit r6: `app` goes into log records as it is, so it is checked like the other fields
                 // (it used to be refused as an unknown key; anything was accepted once it became one).
                 if (appName !== undefined && (typeof appName !== 'string' || !SCOPE_APP.test(appName)))
@@ -925,16 +985,10 @@ class InertiaRuntime {
                 if (typeof sealed !== 'boolean')
                     throw new InertiaUsageError('INVALID_SCOPE', 'Inertia scope sealed must be a boolean');
                 const ssr = ssrInput === undefined ? this.settings.ssr : parseSsr(ssrInput);
-                if (sealed && ssr) {
-                    logger.log('error', 'Inertia scope of seal hosts with SSR', {
-                        code: 'SEAL_SSR_CONFLICT',
-                        title: typeof fields.title === 'string' ? fields.title.slice(0, 100) : null,
-                        fix: 'Set inertia.ssr: false for this app, or remove seal: true from its domains',
-                    });
-                    throw sealSsrConflict();
-                }
                 if (extra !== undefined && typeof extra !== 'function')
                     throw new InertiaUsageError('INVALID_SCOPE', 'Inertia scope shared must be a function');
+                if (extraPublic !== undefined && typeof extraPublic !== 'function')
+                    throw new InertiaUsageError('INVALID_SCOPE', 'Inertia scope publicShared must be a function');
                 if (vite !== undefined && ['version', 'scripts', 'styles'].some((key) => key in fields))
                     throw new InertiaUsageError('INVALID_SCOPE', 'Inertia vite options replace version, scripts and styles');
                 const scoped = normalizeInertiaOptions({
@@ -942,9 +996,7 @@ class InertiaRuntime {
                     ...fields,
                     ...(vite === undefined ? {} : await built(parseVite(vite))),
                 });
-                const merged = shared && extra
-                    ? async (request) => ({ ...(await shared(request)), ...(await extra(request)) })
-                    : (extra ?? shared);
+                const merged = sharedSource(extraPublic, extra);
                 const scopedVite = vite === undefined ? this.settings.vite : parseVite(vite);
                 const responder = new InertiaResponder(scoped, merged, await serverRendering(ssr, scopedVite), diagnostics, flash, hooks);
                 // Once the scope is valid: a scope refused above serves no page with the default version.
@@ -961,8 +1013,11 @@ class InertiaRuntime {
                     rootId: scoped.rootId,
                     vite: scopedVite ? scopedVite.entry : false,
                     ssr: ssr ? ssr.bundle : false,
-                    shared: merged !== undefined,
+                    shared: extra !== undefined,
+                    publicShared: extraPublic !== undefined,
                     sealed,
+                    // D-0195: a seal host's requests are server rendered only for public first pages.
+                    ...(sealed && ssr ? { ssrOnSealedHosts: 'public pages' } : {}),
                     encryptHistory: scoped.encryptHistory,
                     errorPage: scoped.errorPage,
                     bootFallback: bootLog(scoped),
@@ -973,6 +1028,7 @@ class InertiaRuntime {
         // D-0063 §5: the view engine `inertia` for dokebi-app (inert until a plugin collects it).
         context.contribute(viewEngines, Object.freeze({
             name: 'inertia',
+            publicPages: true,
             scope: (input) => plugin.scope(input),
         }));
         return plugin;
@@ -980,12 +1036,12 @@ class InertiaRuntime {
 }
 export const createPlugin = definePlugin({
     name: 'dokebi-template-inertia',
-    version: '0.4.4',
+    version: '0.4.6',
     core: '^0.4.2',
     options,
     entry: parseEntry,
     contributes: [viewEngines],
     collects: [viewData],
     dependencies: () => [web, session],
-    instance: ({ options, entry }) => new InertiaRuntime(settings(options), entry?.shared),
+    instance: ({ options, entry }) => new InertiaRuntime(settings(options), entry ?? {}),
 });

package/dist/responder.d.ts

@@ -3,6 +3,7 @@ import { diagnostics } from '@dokebi/core/libraries';
 import { type WebErrorResponse } from '@dokebi/web';
 import type { FastifyReply, FastifyRequest } from 'fastify';
 import { type InertiaBootFallback, type NormalizedBootFallback } from './boot-fallback.js';
+import { type InertiaHead } from './head.js';
 import { type InertiaProp } from './props.js';
 export type Json = null | boolean | number | string | readonly Json[] | {
     readonly [key: string]: Json;
@@ -35,7 +36,7 @@ export interface InertiaOptions {
 }
 /** What `answerError` reads of a dokebi-web error answer (`WebErrorResponse`). */
 export type InertiaErrorResponse = Pick<WebErrorResponse, 'request' | 'reply' | 'status' | 'body' | 'format' | 'sealed'>;
-/** Per response history settings; unset values come from the scope (`encryptHistory`) and session. */
+/** Per response settings; unset history values come from the scope (`encryptHistory`) and session. */
 export interface InertiaRenderOptions {
     /** Encrypt this page in the browser history (Inertia `encryptHistory`). */
     readonly encryptHistory?: boolean;
@@ -44,7 +45,44 @@ export interface InertiaRenderOptions {
      * the session was destroyed or regenerated (@dokebi/session 0.2 `historyReset`, logout, login).
      */
     readonly clearHistory?: boolean;
+    /**
+     * D-0195: a public page, whose first HTML is the same for every visitor (a crawler, a guest, a
+     * signed-in member). That HTML carries only the props of `render` and the public shared props
+     * (view data such as @dokebi/i18n's, the entry's and the scope's `publicShared`); the visitor's
+     * own (auth, csrf, the entry's `shared`) are announced as the deferred group `dokebi-visitor`
+     * and fetched by the client right after it starts, through a visit (sealed on a seal host). The
+     * flash and the history reset are left for the next page. On a seal host the first HTML is
+     * plain and server rendered when the scope has `ssr`. `cacheControl` replaces `no-store` for
+     * that HTML (never when the answer sets a cookie). Inertia visits are unchanged.
+     */
+    readonly public?: boolean | {
+        readonly cacheControl?: string;
+    };
+    /** D-0195: head tags of the first HTML (title, description, canonical, alternates, meta). */
+    readonly head?: InertiaHead;
 }
+/**
+ * Where a responder gets the shared props of a page (D-0195). `public` asks only for what is the
+ * same for every visitor (the first HTML of a public page); `visitor` names the keys of the rest,
+ * which that HTML leaves out.
+ */
+export interface InertiaSharedSource {
+    resolve(request: FastifyRequest, view: {
+        readonly public: boolean;
+    }): Promise<{
+        readonly props: Props;
+        readonly visitor: readonly string[];
+    }>;
+}
+/** The deferred group of a public page's visitor props (D-0195). */
+export declare const VISITOR_GROUP = "dokebi-visitor";
+/**
+ * Replies of public first pages with the app's own Cache-Control: an answer among them that
+ * sets a cookie goes back to `no-store` on its way out (the plugin's onSend hook).
+ */
+export declare const cacheableReplies: WeakSet<FastifyReply<import("fastify").RouteGenericInterface, import("fastify").RawServerDefault, import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown>>;
+/** The `<meta>` that tells `sealInertia` of @dokebi/seal/http that a plain first page is on a seal host. */
+export declare const SEAL_HOST_META = "<meta name=\"dokebi-seal\" content=\"host\">";
 /**
  * What the plugin gives a responder besides its options: the sealing of a request (dokebi-web
  * `sealOf`) and the session's history reset signal.
@@ -130,13 +168,14 @@ export type NormalizedInertiaOptions = Readonly<Required<Omit<InertiaOptions, 'b
 export declare function normalizeInertiaOptions(options?: InertiaOptions): NormalizedInertiaOptions;
 export declare class InertiaResponder implements InertiaApi {
     #private;
-    readonly shared?: ((request: FastifyRequest) => Awaitable<Props>) | undefined;
     readonly ssr?: InertiaSsr | undefined;
     readonly diagnostics?: InertiaDiagnostics | undefined;
     readonly flash?: InertiaFlash | undefined;
     readonly hooks: InertiaHooks;
     readonly options: NormalizedInertiaOptions;
-    constructor(options?: InertiaOptions, shared?: ((request: FastifyRequest) => Awaitable<Props>) | undefined, ssr?: InertiaSsr | undefined, diagnostics?: InertiaDiagnostics | undefined, flash?: InertiaFlash | undefined, hooks?: InertiaHooks);
+    constructor(options?: InertiaOptions, 
+    /** A function gives the visitor's props (none of them public); a source can give both. */
+    shared?: ((request: FastifyRequest) => Awaitable<Props>) | InertiaSharedSource, ssr?: InertiaSsr | undefined, diagnostics?: InertiaDiagnostics | undefined, flash?: InertiaFlash | undefined, hooks?: InertiaHooks);
     close(): void;
     render(request: FastifyRequest, reply: FastifyReply, component: string, input?: Props, history?: InertiaRenderOptions): Promise<never>;
     /**

package/dist/responder.js

@@ -2,8 +2,19 @@ import { diagnostics } from '@dokebi/core/libraries';
 import { formFieldErrors } from '@dokebi/web';
 import { bootMarkup, normalizeBootFallback, } from './boot-fallback.js';
 import { InertiaError, InertiaUsageError } from './errors.js';
+import { headMarkup } from './head.js';
 import { VERSION } from './options.js';
-import { isInertiaProp } from './props.js';
+import { defer, isInertiaProp } from './props.js';
+/** The deferred group of a public page's visitor props (D-0195). */
+export const VISITOR_GROUP = 'dokebi-visitor';
+/**
+ * Replies of public first pages with the app's own Cache-Control: an answer among them that
+ * sets a cookie goes back to `no-store` on its way out (the plugin's onSend hook).
+ */
+export const cacheableReplies = new WeakSet();
+/** The `<meta>` that tells `sealInertia` of @dokebi/seal/http that a plain first page is on a seal host. */
+export const SEAL_HOST_META = '<meta name="dokebi-seal" content="host">';
+const CACHE_CONTROL = /^[\x21-\x7e](?:[\x20-\x7e]{0,254}[\x21-\x7e])?$/;
 const escapeHtml = (value) => value.replace(/[&<>"']/g, (char) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[char] ?? char);
 /**
  * A `<title>` head tag of the SSR bundle with its text made safe. @inertiajs/vue3 escapes the
@@ -159,25 +170,36 @@ function checkScalar(value) {
     throw new InertiaUsageError('INVALID_PROPS', UNSUPPORTED);
 }
 export class InertiaResponder {
-    shared;
     ssr;
     diagnostics;
     flash;
     hooks;
     options;
+    /** The shared props of every page (D-0195: public and visitor ones). */
+    #shared;
     /**
      * Every value of a page is checked outside production (where the mistake is made and seen);
      * in production only the top-level props are, and the page goes to JSON.stringify as it is.
      */
     #deepCheck = process.env.NODE_ENV !== 'production';
     #closed = false;
-    constructor(options = {}, shared, ssr, diagnostics, flash, hooks = {}) {
-        this.shared = shared;
+    constructor(options = {}, 
+    /** A function gives the visitor's props (none of them public); a source can give both. */
+    shared, ssr, diagnostics, flash, hooks = {}) {
         this.ssr = ssr;
         this.diagnostics = diagnostics;
         this.flash = flash;
         this.hooks = hooks;
         this.options = normalizeInertiaOptions(options);
+        this.#shared =
+            typeof shared === 'function'
+                ? {
+                    resolve: async (request, view) => {
+                        const props = (await shared(request)) ?? {};
+                        return { props: view.public ? {} : props, visitor: Object.keys(props) };
+                    },
+                }
+                : shared;
     }
     close() {
         this.#closed = true;
@@ -190,9 +212,13 @@ export class InertiaResponder {
         this.#check();
         if (history === null ||
             typeof history !== 'object' ||
+            Object.keys(history).some((key) => !['encryptHistory', 'clearHistory', 'public', 'head'].includes(key)) ||
             (history.encryptHistory !== undefined && typeof history.encryptHistory !== 'boolean') ||
             (history.clearHistory !== undefined && typeof history.clearHistory !== 'boolean'))
-            throw new InertiaUsageError('INVALID_RENDER', 'Inertia render options are { encryptHistory?, clearHistory? } booleans');
+            throw new InertiaUsageError('INVALID_RENDER', 'Inertia render options are { encryptHistory?, clearHistory?, public?, head? }');
+        publicSettings(history.public);
+        if (history.head !== undefined)
+            headMarkup(history.head);
         if (!['GET', 'HEAD'].includes(request.method))
             throw new InertiaError('METHOD_NOT_ALLOWED', 'Render pages using GET/HEAD; redirect mutations or use REST');
         if (!validComponent(component))
@@ -279,11 +305,30 @@ export class InertiaResponder {
                 .header('X-Inertia-Version', this.options.version)
                 .send();
         }
-        // A sealed request (seal host, D-0062): the props leave as one sealed frame, never as HTML.
+        // A sealed request (seal host, D-0062): the props leave as one sealed frame, never as HTML,
+        // except the first HTML of a public page (D-0195), which holds no visitor's value.
         const sealer = this.hooks.sealOf?.(request);
-        if (sealer && this.ssr && !inertia)
-            throw new InertiaError('SEAL_SSR_CONFLICT', 'A sealed page cannot be server rendered: SSR writes the props as plain HTML. Turn off ssr for this app or seal for its hosts.');
-        const props = { ...(withShared ? await this.shared?.(request) : undefined), ...input };
+        const publicPage = publicSettings(history.public);
+        const publicHtml = publicPage !== undefined && !inertia;
+        // D-0195: the shared props. The first HTML of a public page gets only the public ones; the
+        // visitor's own are announced as a deferred group, fetched by a visit after the page starts.
+        let props = { ...input };
+        let visitor;
+        if (withShared && this.#shared) {
+            const shared = await this.#shared.resolve(request, { public: publicHtml });
+            props = { ...shared.props, ...input };
+            if (publicPage !== undefined)
+                visitor = new Set(shared.visitor);
+            if (publicHtml)
+                for (const key of shared.visitor)
+                    if (key !== 'errors' && !Object.hasOwn(input, key))
+                        Object.defineProperty(props, key, {
+                            value: defer(() => null, VISITOR_GROUP),
+                            enumerable: true,
+                            writable: true,
+                            configurable: true,
+                        });
+        }
         const partial = inertia && request.headers['x-inertia-partial-component'] === component;
         const list = (key) => typeof request.headers[key] === 'string'
             ? new Set(request.headers[key]
@@ -297,21 +342,23 @@ export class InertiaResponder {
         const meta = buildMetadata(props, partial, only, except, reset, held);
         // The client ignores the flash of a deferred-props fetch (it keeps the page's), so such a
         // request leaves the session's flash for the next page instead of using it up.
+        // The fetch of a public page's visitor props (D-0195) is such a fetch too.
         const deferredFetch = partial &&
             only.size > 0 &&
             [...only].every((key) => {
                 const value = Object.hasOwn(props, key) ? props[key] : undefined;
-                return isInertiaProp(value) && value.group !== undefined;
+                return (isInertiaProp(value) && value.group !== undefined) || visitor?.has(key) === true;
             });
         const values = await Promise.all(meta.selected.map(([key, value, prop]) => this.#evaluate(component, key, value, prop, meta.rescued)));
         // Read after the props: a failed render leaves the flash for the next page. An error page
         // leaves it (and the history reset) for the page the user goes to next.
-        const flash = this.flash && session && !deferredFetch ? await this.flash(request) : undefined;
+        // A public page's first HTML is the same for every visitor: the flash and the history reset
+        // stay for the next page (D-0195).
+        const visitorState = session && !deferredFetch && !publicHtml;
+        const flash = this.flash && visitorState ? await this.flash(request) : undefined;
         // Read like the flash: once, by the page that shows it (logout or login happened before).
         const clearHistory = history.clearHistory ??
-            (this.hooks.historyReset && session && !deferredFetch
-                ? await this.hooks.historyReset(request)
-                : false);
+            (this.hooks.historyReset && visitorState ? await this.hooks.historyReset(request) : false);
         const configured = this.options.encryptHistory;
         const encryptHistory = history.encryptHistory ?? (configured === 'sealed' ? sealer !== undefined : configured);
         // An ordinary object: JSON.stringify of a null-prototype object leaves V8's fast path (2×
@@ -395,7 +442,9 @@ export class InertiaResponder {
         // The XHR answer is JSON: dokebi-web seals it on the way out for a sealed request.
         if (inertia)
             return reply.header('X-Inertia', 'true').type('application/json; charset=utf-8').send(json);
-        const { rootId, title, scripts, styles } = this.options;
+        const head = history.head === undefined ? undefined : headMarkup(history.head);
+        const { rootId, scripts, styles } = this.options;
+        const title = head?.title ?? this.options.title;
         const language = reply.getHeader('content-language');
         const htmlLanguage = typeof language === 'string' && /^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$/.test(language)
             ? ` lang="${escapeHtml(language)}"`
@@ -404,27 +453,47 @@ export class InertiaResponder {
         const boot = this.options.bootFallback.enabled
             ? bootMarkup(this.options.bootFallback, rootId, typeof language === 'string' ? language : undefined)
             : undefined;
-        if (sealer) {
+        if (sealer && !publicHtml) {
             // `E:<ts>:<base64>` holds no HTML specials; the client opens it before Inertia starts
-            // (`sealInertia` of @dokebi/seal/http). No SSR here (refused above).
+            // (`sealInertia` of @dokebi/seal/http). Never server rendered: SSR writes the props as
+            // plain HTML (only a public page's are, below).
             const frame = sealer.encode(json);
             return reply
                 .type('text/html; charset=utf-8')
-                .send(`<!doctype html><html${htmlLanguage}><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(title)}</title>${styles.map((url) => `<link rel="stylesheet" href="${escapeHtml(url)}">`).join('')}${boot?.head ?? ''}${scripts.map((url) => `<script type="module" src="${escapeHtml(url)}"></script>`).join('')}</head><body><script data-page="${rootId}" type="application/json" data-sealed="true">${escapeHtml(frame)}</script><div id="${rootId}">${boot?.root ?? ''}</div></body></html>`);
+                .send(`<!doctype html><html${htmlLanguage}><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(title)}</title>${head?.tags ?? ''}${styles.map((url) => `<link rel="stylesheet" href="${escapeHtml(url)}">`).join('')}${boot?.head ?? ''}${scripts.map((url) => `<script type="module" src="${escapeHtml(url)}"></script>`).join('')}</head><body><script data-page="${rootId}" type="application/json" data-sealed="true">${escapeHtml(frame)}</script><div id="${rootId}">${boot?.root ?? ''}</div></body></html>`);
         }
         // Only the first HTML is server rendered; Inertia visits above stay JSON.
         const rendered = this.ssr ? await this.#serverRender(JSON.parse(json), rootId) : undefined;
+        if (publicPage !== undefined) {
+            if (publicPage.cacheControl !== undefined) {
+                reply.header('Cache-Control', publicPage.cacheControl);
+                cacheableReplies.add(reply);
+            }
+            if (logger?.isEnabled('debug'))
+                logger.log('debug', 'Inertia public page', {
+                    component,
+                    sealedHost: sealer !== undefined,
+                    serverRendered: rendered !== undefined,
+                    visitor: [...(visitor ?? [])].slice(0, 64),
+                    cacheControl: publicPage.cacheControl ?? 'no-store',
+                });
+        }
         const safeJson = json
             .replace(/</g, '\\u003c')
             .replace(/\//g, '\\/')
             .replace(/\u2028/g, '\\u2028')
             .replace(/\u2029/g, '\\u2029');
-        // A <title> from the page's <Head> replaces the configured one.
-        const head = (rendered?.head ?? []).map(safeTitleTag);
-        const titled = head.some((tag) => /^<title[\s>]/i.test(tag));
+        // A <title> from the page's <Head> replaces the configured one; the route's head title
+        // (D-0195) replaces both.
+        const ssrHead = (rendered?.head ?? [])
+            .map(safeTitleTag)
+            .filter((tag) => head?.title === undefined || !/^<title[\s>]/i.test(tag));
+        const titled = head?.title === undefined && ssrHead.some((tag) => /^<title[\s>]/i.test(tag));
+        // D-0195: a plain first page of a seal host tells sealInertia to seal what follows.
+        const sealHost = sealer ? SEAL_HOST_META : '';
         return reply
             .type('text/html; charset=utf-8')
-            .send(`<!doctype html><html${htmlLanguage}><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">${titled ? '' : `<title>${escapeHtml(title)}</title>`}${styles.map((url) => `<link rel="stylesheet" href="${escapeHtml(url)}">`).join('')}${rendered ? '' : (boot?.head ?? '')}${scripts.map((url) => `<script type="module" src="${escapeHtml(url)}"></script>`).join('')}${head.join('')}</head><body>${rendered?.body ?? `<script data-page="${rootId}" type="application/json">${safeJson}</script><div id="${rootId}">${boot?.root ?? ''}</div>`}</body></html>`);
+            .send(`<!doctype html><html${htmlLanguage}><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">${sealHost}${titled ? '' : `<title>${escapeHtml(title)}</title>`}${head?.tags ?? ''}${styles.map((url) => `<link rel="stylesheet" href="${escapeHtml(url)}">`).join('')}${rendered ? '' : (boot?.head ?? '')}${scripts.map((url) => `<script type="module" src="${escapeHtml(url)}"></script>`).join('')}${ssrHead.join('')}</head><body>${rendered?.body ?? `<script data-page="${rootId}" type="application/json">${safeJson}</script><div id="${rootId}">${boot?.root ?? ''}</div>`}</body></html>`);
     }
     /**
      * The value of one selected prop. A function runs here; a rescued deferred prop that throws is
@@ -506,6 +575,24 @@ export class InertiaResponder {
     }
 }
 const RESCUED = Symbol('rescued');
+/**
+ * The checked `public` render option (D-0195): undefined for an ordinary page, the settings of a
+ * public one. Throws INVALID_RENDER for anything else.
+ */
+function publicSettings(value) {
+    if (value === undefined || value === false)
+        return undefined;
+    if (value === true)
+        return {};
+    if (value !== null &&
+        typeof value === 'object' &&
+        !Array.isArray(value) &&
+        Object.keys(value).every((key) => key === 'cacheControl') &&
+        (value.cacheControl === undefined ||
+            (typeof value.cacheControl === 'string' && CACHE_CONTROL.test(value.cacheControl))))
+        return value;
+    throw new InertiaUsageError('INVALID_RENDER', 'Inertia render option public is true or { cacheControl } (1-256 printable ASCII characters)');
+}
 /**
  * An ordinary object with the Map's entries as own keys (JSON.stringify keeps its fast path, see
  * the page props); `__proto__` is defined as an own key, never assigned.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dokebi/template-inertia",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "Inertia v3 server adapter for Dokebi: page JSON, Vite manifest assets and optional server-side rendering.",
   "keywords": [
     "dokebi",
@@ -135,9 +135,9 @@
     ]
   },
   "devDependencies": {
-    "@dokebi/i18n": "0.2.0",
-    "@dokebi/session": "0.4.4",
-    "@dokebi/web": "0.4.3",
+    "@dokebi/i18n": "0.2.2",
+    "@dokebi/session": "0.4.6",
+    "@dokebi/web": "0.4.6",
     "@dokebi/websocket": "0.4.2",
     "@dokebi/websocket-hub": "0.4.2",
     "@inertiajs/vue3": "3.9.1",