@nifrajs/web 4.0.0 → 5.0.0

package/src/cdn.ts

@@ -11,6 +11,7 @@
  * for any other. Backend-only: a browser build that reaches this module fails.
  */
 import "@nifrajs/web/backend-only"
+import { writableResponse } from "@nifrajs/core/server"
 import { isDraftEnabled } from "./draft.ts"
 import type { CdnProvider } from "./internal/cdn/core.ts"
 import { pathTag } from "./internal/cdn/core.ts"
@@ -84,15 +85,9 @@ const isHtml = (res: Response): boolean =>
   (res.headers.get("content-type") ?? "").toLowerCase().includes("text/html")
 
 function withHeaders(res: Response, set: Readonly<Record<string, string>>): Response {
-  try {
-    for (const [name, value] of Object.entries(set)) res.headers.set(name, value)
-    return res
-  } catch {
-    // A `fetch()` response has immutable headers: rebuild it around the same body instead.
-    const headers = new Headers(res.headers)
-    for (const [name, value] of Object.entries(set)) headers.set(name, value)
-    return new Response(res.body, { status: res.status, statusText: res.statusText, headers })
-  }
+  const target = writableResponse(res)
+  for (const [name, value] of Object.entries(set)) target.headers.set(name, value)
+  return target
 }
 
 /**
@@ -150,6 +145,12 @@ export interface InvalidatorOptions {
   readonly key?: (path: string) => string | null
   /** The `query` policy given to `withISR`. Default `"bypass"`. Ignored with `key`. */
   readonly query?: ISRQuery
+  /**
+   * Caches below the pages whose entries carry the same tags, such as a `@nifrajs/cache` holding
+   * loader data. Tags reach each of them before the store, so a page regenerated mid-purge cannot be
+   * rebuilt from stale data; a failure rejects before the store is touched. Paths do not reach them.
+   */
+  readonly dataCaches?: readonly { invalidateTag(tag: string): unknown }[]
 }
 
 export interface InvalidateResult {
@@ -196,11 +197,16 @@ export function createInvalidator(options: InvalidatorOptions): {
           throw new TypeError("[nifra/web/cdn] invalidate paths must start with /")
         }
       }
+      if (store !== undefined && tags.length > 0 && store.invalidateTag === undefined) {
+        throw new TypeError("[nifra/web/cdn] this store cannot invalidate by tag")
+      }
+      if (tags.length > 0) {
+        for (const cache of options.dataCaches ?? []) {
+          for (const tag of tags) await cache.invalidateTag(tag)
+        }
+      }
       let origin: InvalidateResult["origin"] = "skipped"
       if (store !== undefined) {
-        if (tags.length > 0 && store.invalidateTag === undefined) {
-          throw new TypeError("[nifra/web/cdn] this store cannot invalidate by tag")
-        }
         for (const path of paths) {
           const key = keyOf?.(path)
           if (key !== null && key !== undefined) await store.delete(key)

package/src/client.ts

@@ -40,7 +40,7 @@ export function currentDocumentNonce(): string | undefined {
  * serves modules as written, so the browser evaluated `public-dir.ts` and died on `node:fs/promises`
  * before hydrating. The fix is for the entry not to name the server module in the first place.
  */
-export { mergeHeads, resolveMeta } from "./internal/head-merge.ts"
+export { mergeHeads, resolveChainMeta, resolveMeta } from "./internal/head-merge.ts"
 export {
   getBrowserNavigate,
   IDLE_BLOCKER,
@@ -206,6 +206,23 @@ export function waitForStyles(options: WaitForStylesOptions = {}): Promise<void>
   return Promise.all(promises).then(() => undefined)
 }
 
+/**
+ * Resolve `href` against this page and keep it only when history may move there without a load: same
+ * scheme and host as the document, or null. Compared by protocol + host rather than `URL.origin`,
+ * which is `"null"` for every non-special scheme - a native webview's `capacitor://localhost` page and
+ * a `javascript:` target alike. An opaque or `file:` document may not push another path at all, so its
+ * links load natively.
+ */
+function sameDocumentUrl(href: string): URL | null {
+  if (location.origin === "null" || location.protocol === "file:") return null
+  try {
+    const url = new URL(href, location.href)
+    return url.protocol === location.protocol && url.host === location.host ? url : null
+  } catch {
+    return null
+  }
+}
+
 /**
  * Attach history + link interception to a router. Returns a teardown function that removes the
  * listeners. A data-fetch failure during a client navigation falls back to a full-page load, so
@@ -288,7 +305,7 @@ export function installHistory(
 
   // Parse a path into the `{ pathname, search, hash }` a `BlockerFunction` decides on.
   const locationOf = (path: string): BlockerLocation => {
-    const url = new URL(path, location.origin)
+    const url = new URL(path, location.href)
     return { pathname: url.pathname, search: url.search, hash: url.hash }
   }
 
@@ -332,17 +349,6 @@ export function installHistory(
   // Commit a navigation only after its URL and origin are known-safe. An unmatched same-origin path
   // becomes a hard load BEFORE history is mutated; otherwise the address bar could change while the
   // router intentionally kept rendering the old route.
-  const parseNavigationUrl = (path: string): URL | null => {
-    try {
-      const url = new URL(path, location.origin)
-      if (url.protocol !== "http:" && url.protocol !== "https:") return null
-      if (url.origin !== location.origin) return null
-      return url
-    } catch {
-      return null
-    }
-  }
-
   const commit = (path: string, url: URL, mode: "push" | "replace", state?: unknown): void => {
     const routePath = url.pathname + url.search
     if (router.match(routePath) === null) {
@@ -387,7 +393,7 @@ export function installHistory(
   const go = (path: string, mode: "push" | "replace", state?: unknown): void => {
     // Validate before the blocker observes the target. A blocker receives parsed locations, so letting a
     // malformed string reach `locationOf` would make an otherwise no-throw navigate unexpectedly throw.
-    const url = parseNavigationUrl(path)
+    const url = sameDocumentUrl(path)
     if (url === null) {
       settle()
       return
@@ -432,8 +438,8 @@ export function installHistory(
     if (anchor.target !== "" && anchor.target !== "_self") return null
     if (anchor.hasAttribute("download")) return null
     if (anchor.getAttribute("rel")?.split(/\s+/).includes("external")) return null
-    const url = new URL(anchor.href)
-    if (url.origin !== location.origin) return null
+    const url = sameDocumentUrl(anchor.href)
+    if (url === null) return null
     if (router.match(url.pathname) === null) return null
     // A same-page fragment link (`#section`, `/here#section` - only the hash differs) → null: let the
     // browser do its native in-page anchor jump. Intercepting it would drop the fragment from the URL
@@ -465,7 +471,7 @@ export function installHistory(
   const warm = (target: EventTarget | null): void => {
     const href = inAppHref(target)
     if (href === null) return
-    const url = new URL(href, location.origin)
+    const url = new URL(href, location.href)
     const path = url.pathname + url.search // the #hash isn't data
     if (path !== location.pathname + location.search) void router.prefetch(path)
   }
@@ -684,23 +690,42 @@ export function applyHead(head: Meta): void {
 }
 
 export function installForms(router: ClientRouter): () => void {
+  // Forms whose data submit failed before the server answered: their next submit event is the native
+  // post that replaces it.
+  const native = new WeakSet<HTMLFormElement>()
   const onSubmit = (event: SubmitEvent): void => {
     if (event.defaultPrevented) return
     const form = event.target
     if (!(form instanceof HTMLFormElement)) return
-    if (form.method.toLowerCase() !== "post") return // GET forms submit natively
-    const url = new URL(form.action) // resolved (or the current document URL if unset)
-    if (url.origin !== location.origin) return
+    if (native.delete(form)) return
+    // The button that submitted can override the form's method, action and target, and its
+    // name=value is part of the submission (`<button name="intent" value="delete">`).
+    // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: a submit event's submitter is the submit button or input that fired it, or null
+    const submitter = event.submitter as HTMLButtonElement | null
+    const method = submitter?.hasAttribute("formmethod") ? submitter.formMethod : form.method
+    if (method.toLowerCase() !== "post") return // GET forms submit natively
+    const target = submitter?.hasAttribute("formtarget") ? submitter.formTarget : form.target
+    if (target !== "" && target !== "_self") return // it loads in another browsing context
+    // Resolved (or the current document URL if unset).
+    const url = sameDocumentUrl(
+      submitter?.hasAttribute("formaction") ? submitter.formAction : form.action,
+    )
+    if (url === null) return
     if (router.match(url.pathname) === null) return // not an app route → native submit
     event.preventDefault()
     // `data-nifra-revalidate="false"` opts out of the post-action loader revalidation (the action's
     // actionData drives the update); absent or any other value keeps the default revalidation.
     const revalidate = form.dataset.nifraRevalidate !== "false"
-    router.submit(url.pathname + url.search, new FormData(form), { revalidate }).catch((error) => {
+    const body = new FormData(form, submitter)
+    router.submit(url.pathname + url.search, body, { revalidate }).catch((error) => {
       const to = redirectOf(error)
-      // The action ran: load the page that shows its result rather than run it again.
+      // The server answered: load the page that shows the result rather than run the action again.
       if (to !== undefined) location.assign(to)
-      else form.submit() // data submit failed - fall back to a full-page POST
+      else {
+        // Nothing reached the server - post natively, through the same button.
+        native.add(form)
+        form.requestSubmit(submitter)
+      }
     })
   }
   document.addEventListener("submit", onSubmit)

package/src/deferred.ts

@@ -6,6 +6,7 @@
  * resolution scripts settle. The per-adapter `<Await>` lives in `@nifrajs/web-{solid,react}/client`.
  */
 import { plainJsonCodec, type TransportCodec } from "@nifrajs/core/transport-codec"
+import { parsePageData } from "./internal/revive-dates.ts"
 
 /**
  * A loader value marked to stream in after the shell. The component consumes it with the adapter's
@@ -164,25 +165,29 @@ export function ndjsonStream(
   deferred: ReadonlyArray<{ readonly id: number; readonly promise: Promise<unknown> }>,
   codec: TransportCodec = plainJsonCodec,
 ): ReadableStream<Uint8Array> {
+  // A client that goes away cancels the body; a value settling after that has nowhere to go.
+  let cancelled = false
   return new ReadableStream({
     async start(controller) {
       controller.enqueue(NDJSON_ENCODER.encode(`${codec.encode(forClient)}\n`))
       await Promise.all(
         deferred.map(async (d) => {
+          let line: string
           try {
-            const value = await d.promise
-            controller.enqueue(NDJSON_ENCODER.encode(`${codec.encode({ i: d.id, v: value })}\n`))
+            line = codec.encode({ i: d.id, v: await d.promise })
           } catch (err) {
             // Redact: stream a stable opaque code, never the raw error text; log the real reason
             // server-side. The client's <Await> errorFallback receives this code.
             console.error("[nifra/web] deferred value rejected:", err)
-            controller.enqueue(
-              NDJSON_ENCODER.encode(`${codec.encode({ i: d.id, e: DEFERRED_ERROR_CODE })}\n`),
-            )
+            line = codec.encode({ i: d.id, e: DEFERRED_ERROR_CODE })
           }
+          if (!cancelled) controller.enqueue(NDJSON_ENCODER.encode(`${line}\n`))
         }),
       )
-      controller.close()
+      if (!cancelled) controller.close()
+    },
+    cancel() {
+      cancelled = true
     },
   })
 }
@@ -213,7 +218,16 @@ export const DEFERRED_RUNTIME = `(() => {
   // Tag the promise (status/value/reason) - React's use() reads them and returns SYNCHRONOUSLY at
   // hydration, so it renders the resolved content directly into the <Suspense> boundary the server
   // streamed (no re-suspend, no fallback flash). r/j also wake awaiters (Solid uses its own _$HY).
-  window.__nifraResolve = (id, v) => { const e = get(id); e.p.status = "fulfilled"; e.p.value = v; e.r(v); };
+  // A t.date() value arrives tagged; rebuild it before anything reads the settled value.
+  const __nifraDates = (d) => {
+    if (!d || typeof d !== "object") return d
+    if (Array.isArray(d)) { for (let i = 0; i < d.length; i++) d[i] = __nifraDates(d[i]); return d }
+    const k = Object.keys(d)
+    if (k.length === 1 && k[0] === "__nifra_date" && typeof d.__nifra_date === "string") return new Date(d.__nifra_date)
+    for (const x of k) { const v = __nifraDates(d[x]); if (v !== d[x]) Object.defineProperty(d, x, { value: v, enumerable: true, writable: true, configurable: true }) }
+    return d
+  };
+  window.__nifraResolve = (id, v) => { v = __nifraDates(v); const e = get(id); e.p.status = "fulfilled"; e.p.value = v; e.r(v); };
   window.__nifraReject = (id, x) => { const e = get(id); e.p.status = "rejected"; e.p.reason = x; e.j(x); };
 })();`
 
@@ -225,6 +239,7 @@ export const DEFERRED_RUNTIME = `(() => {
 export const MAP_DEFERRED_SOURCE = `const mapDeferred = (d) => {
   if (!d || typeof d !== "object") return d
   if (typeof d.__nifra_deferred === "number") return { __nifra_deferred: true, id: d.__nifra_deferred, promise: window.__nifraDeferred(d.__nifra_deferred) }
+  if (typeof d.__nifra_date === "string" && Object.keys(d).length === 1) return new Date(d.__nifra_date)
   if (Array.isArray(d)) return d.map(mapDeferred)
   const out = {}
   for (const k of Object.keys(d)) Object.defineProperty(out, k, { value: mapDeferred(d[k]), enumerable: true, writable: true, configurable: true })
@@ -326,8 +341,11 @@ export async function parseNdjsonData(
   }
 
   const pending: Pending = new Map()
+  // Only plain JSON carries t.date() tags; a richer codec decodes its own dates.
+  const decode = (line: string): unknown =>
+    codec === plainJsonCodec ? parsePageData(line) : codec.decode(line)
   const first = await readLine()
-  const data = markersFromPlaceholders(first === null ? null : codec.decode(first), pending)
+  const data = markersFromPlaceholders(first === null ? null : decode(first), pending)
 
   void (async () => {
     try {
@@ -335,7 +353,7 @@ export async function parseNdjsonData(
         const line = await readLine()
         if (line === null) break
         if (line === "") continue
-        const msg = codec.decode(line) as { i: number; v?: unknown; e?: string }
+        const msg = decode(line) as { i: number; v?: unknown; e?: string }
         const entry = pending.get(msg.i)
         if (entry === undefined) continue
         pending.delete(msg.i)

package/src/dev-feed.ts

@@ -392,6 +392,25 @@ function fnv1a(text: string): string {
   return (hash >>> 0).toString(16).padStart(8, "0")
 }
 
+/**
+ * A query value may be a single-use ticket or a token no redaction pattern knows, so the feed keeps
+ * which keys a request sent and never their values. `/x?ticket=abc&page` -> `/x?ticket=[redacted]&[redacted]`.
+ */
+function queryKeysOnly(target: string): string {
+  const at = target.indexOf("?")
+  if (at === -1) return target
+  const hash = target.indexOf("#", at)
+  const parts = target
+    .slice(at + 1, hash === -1 ? undefined : hash)
+    .split("&")
+    .filter((part) => part.length > 0)
+    .map((part) => {
+      const eq = part.indexOf("=")
+      return eq === -1 ? "[redacted]" : `${part.slice(0, eq)}=[redacted]`
+    })
+  return parts.length === 0 ? target.slice(0, at) : `${target.slice(0, at)}?${parts.join("&")}`
+}
+
 const cap = (text: string, max: number): string =>
   text.length <= max ? text : `${text.slice(0, max)}... [${text.length - max} more chars]`
 
@@ -477,7 +496,7 @@ export function createDevFeed(options: DevFeedOptions): DevFeed {
     if (diagnostic.request !== undefined) {
       redacted.request = {
         method: diagnostic.request.method,
-        url: cap(redactText(diagnostic.request.url), 2048),
+        url: cap(redactText(queryKeysOnly(diagnostic.request.url)), 2048),
       }
     }
     if (diagnostic.codeframe !== undefined) {
@@ -530,7 +549,7 @@ export function createDevFeed(options: DevFeedOptions): DevFeed {
     record.resolvedAt = undefined
     if (requestId !== undefined) record.requestId = requestId
     if (meta.route !== undefined) record.route = meta.route
-    if (meta.page !== undefined) record.page = meta.page
+    if (meta.page !== undefined) record.page = cap(redactText(queryKeysOnly(meta.page)), 2048)
     // Re-insert: Map order is recency order, which eviction relies on.
     errors.delete(key)
     errors.set(key, record)
@@ -557,7 +576,7 @@ export function createDevFeed(options: DevFeedOptions): DevFeed {
       message: text,
     }
     if (requestId !== undefined) entry.requestId = requestId
-    if (meta.page !== undefined) entry.page = meta.page
+    if (meta.page !== undefined) entry.page = cap(redactText(queryKeysOnly(meta.page)), 2048)
     logs.push(entry)
     logBytes += text.length
     if (logs.length > limits.logs || logBytes > limits.logBytes) {
@@ -607,7 +626,7 @@ export function createDevFeed(options: DevFeedOptions): DevFeed {
         seq,
         requestId,
         method,
-        path: cap(redactText(path), 2048),
+        path: cap(redactText(queryKeysOnly(path)), 2048),
         at: nowIso(),
         status: undefined,
         durationMs: undefined,
@@ -856,7 +875,7 @@ export function writeDevServerRecord(root: string, record: DevServerRecord): voi
 
 /** Remove the record only while it is still this server's: a newer server may have replaced it. */
 export function removeDevServerRecord(root: string, token: string): void {
-  // @nifra-gate-reviewed: the server comparing its own token with a file on this machine; no request
+  // nifra-expect NF-S002: the server comparing its own token with a file on this machine; no request
   // reaches this comparison.
   if (readDevServerRecord(root)?.token !== token) return
   rmSync(join(root, DEV_SERVER_RECORD_FILE), { force: true })

package/src/dev-session.ts

@@ -8,6 +8,7 @@
  * either. `/__nifra/last-error` keeps its older, token-free contract behind the same Host check.
  */
 import { performance } from "node:perf_hooks"
+import { writableResponse } from "@nifrajs/core/server"
 import {
   type BrowserError,
   CLIENT_BATCH_MAX_BYTES,
@@ -649,19 +650,9 @@ export function createDevSession(options: DevSessionOptions): DevSession {
       },
       performance.now() - started,
     )
-    try {
-      response.headers.set(DEV_REQUEST_ID_HEADER, requestId)
-      return response
-    } catch {
-      // `Response.redirect()` and fetched responses carry immutable headers on some runtimes.
-      const headers = new Headers(response.headers)
-      headers.set(DEV_REQUEST_ID_HEADER, requestId)
-      return new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers,
-      })
-    }
+    const target = writableResponse(response)
+    target.headers.set(DEV_REQUEST_ID_HEADER, requestId)
+    return target
   }
 
   return {

package/src/dev.ts

@@ -58,7 +58,12 @@ import { dirname, relative, resolve } from "node:path"
 import { type BuildClientOptions, buildClient } from "./build.ts"
 import { type DevEntryMatch, resolveDevEntry } from "./bun-dev-entry.ts"
 import { explainBindFailure } from "./dev-port.ts"
-import { createDevSession, type DevAppHooks, type DevSession } from "./dev-session.ts"
+import {
+  createDevSession,
+  type DevAppHooks,
+  type DevSession,
+  isLoopbackHost,
+} from "./dev-session.ts"
 import { createSsrGraph, type SsrGraph } from "./dev-ssr-graph.ts"
 import { discoverRoutes } from "./fs.ts"
 import { DEFAULT_DEV_PORT, generateClientEntry } from "./index.ts"
@@ -112,6 +117,13 @@ export interface DevServerOptions extends Omit<BuildClientOptions, "minify"> {
    * fix (default `true`). Off, the errors still reach the feed.
    */
   readonly indicator?: boolean
+  /**
+   * Host names the dev server answers besides loopback ones (`localhost`, `*.localhost`, `127.0.0.1`,
+   * `[::1]`), port ignored. Every other `Host` gets a 403: a page on another site whose name a DNS
+   * rebind points at 127.0.0.1 would otherwise read the dev server's pages, loader data and error
+   * overlay. Add a name here when a hosts-file entry or tunnel reaches the server under it.
+   */
+  readonly allowedHosts?: readonly string[]
 }
 
 export interface DevServer {
@@ -465,6 +477,7 @@ export async function createDevServer(options: DevServerOptions): Promise<DevSer
     }
   }
 
+  const allowedHosts = new Set((options.allowedHosts ?? []).map(hostName))
   try {
     server = serve({
       port,
@@ -474,6 +487,12 @@ export async function createDevServer(options: DevServerOptions): Promise<DevSer
       routes: { [PROBE_PATH]: htmlModule.default },
       fetch: async (req: Request): Promise<Response> => {
         const url = new URL(req.url)
+        const host = req.headers.get("host") ?? url.host
+        if (!isLoopbackHost(host) && !allowedHosts.has(hostName(host)))
+          return new Response(
+            `[nifra/web/dev] ${hostName(host)} is not a loopback host; add it to allowedHosts if this server should answer it.\n`,
+            { status: 403, headers: { "content-type": "text/plain; charset=utf-8" } },
+          )
         // The stable client-entry URL. Pages reference THIS; it redirects to whichever hashed chunk Bun
         // is serving at the moment the browser asks. A redirect rather than a proxy so the module's final
         // URL is Bun's own - its HMR client derives its socket and module identity from `import.meta.url`,
@@ -620,6 +639,15 @@ export async function createDevServer(options: DevServerOptions): Promise<DevSer
  * whose message is just "Bundle failed" - the actionable part (which file, which import) lives in
  * `.errors`. Surface it, or the guard reports a failure while hiding the reason.
  */
+/** A Host header's name: lowercased, without its port or IPv6 brackets. */
+function hostName(host: string): string {
+  const name = host.trim().toLowerCase()
+  if (name.startsWith("["))
+    return name.slice(1, name.indexOf("]") === -1 ? undefined : name.indexOf("]"))
+  const colon = name.lastIndexOf(":")
+  return colon === -1 ? name : name.slice(0, colon)
+}
+
 export function buildFailureDetail(err: unknown): string {
   return err instanceof AggregateError && err.errors.length > 0
     ? err.errors.map((e) => `  ${e instanceof Error ? e.message : String(e)}`).join("\n")

package/src/draft.ts

@@ -1,7 +1,9 @@
 /**
  * Draft / preview mode - let an editor see unpublished content by flipping a signed cookie that
  * loaders read (`ctx.draft`) and ISR bypasses (fresh render, never cached). The cookie is **HMAC-signed**
- * (so a visitor can't forge it) and **HttpOnly** (JS can't read it). You gate `enableDraft` yourself -
+ * (so a visitor can't forge it), **HttpOnly** (JS can't read it) and carries its own expiry, which the
+ * server checks (a copied cookie stops working when the browser would have dropped it). You gate
+ * `enableDraft` yourself -
  * behind an editor login or a `?token=` check - exactly like Next's `draftMode().enable()`.
  *
  *   // a route you've protected (e.g. checked ?token= against a secret):
@@ -26,9 +28,23 @@ import { assertTokenSecret, timingSafeEqual } from "./internal/timing-safe-equal
 /** The cookie name nifra uses for draft/preview mode. */
 export const DRAFT_COOKIE = "__nifra_draft"
 
-// The signed cookie's payload is a fixed marker - a *valid signature* (not the value) is the signal
-// that the server issued this via enableDraft(). Nothing secret is stored in it.
-const DRAFT_MARKER = "1"
+// The signed payload is `1:<expiry in Unix seconds>`. A valid signature says the server issued it; the
+// expiry bounds a replayed copy, which Max-Age alone cannot, since a client can resend any cookie it holds.
+const DRAFT_PREFIX = "1:"
+
+function draftPayload(options: EnableDraftOptions): string {
+  return `${DRAFT_PREFIX}${Math.floor(Date.now() / 1000) + draftMaxAge(options)}`
+}
+
+function draftMaxAge(options: EnableDraftOptions): number {
+  const seconds = options.maxAgeSeconds ?? 3600
+  if (!Number.isSafeInteger(seconds) || seconds <= 0) {
+    throw new RangeError(
+      `[nifra] draft maxAgeSeconds must be a positive whole number of seconds, got ${seconds}`,
+    )
+  }
+  return seconds
+}
 
 /** The response-cookie surface `enableDraft`/`disableDraft` need - nifra's `c.set`. Structural, so any
  * nifra handler context satisfies it without importing the full `Context`. */
@@ -38,7 +54,8 @@ export interface DraftCookieControls {
 }
 
 export interface EnableDraftOptions {
-  /** Cookie lifetime in **seconds** (default `3600` = 1h). Keep it short - draft is an editor session. */
+  /** Draft session lifetime in **seconds** (default `3600` = 1h): the cookie's `Max-Age`, and the expiry
+   * signed into the cookie that the server enforces. Keep it short - draft is an editor session. */
   readonly maxAgeSeconds?: number
   /** Cookie `Path` (default `"/"`). */
   readonly path?: string
@@ -57,8 +74,8 @@ export async function enableDraft(
   secret: string,
   options: EnableDraftOptions = {},
 ): Promise<void> {
-  const signed = await signValue(DRAFT_MARKER, secret)
-  c.set.cookie(DRAFT_COOKIE, signed, draftCookieOptions(options))
+  const cookieOptions = draftCookieOptions(options)
+  c.set.cookie(DRAFT_COOKIE, await signValue(draftPayload(options), secret), cookieOptions)
 }
 
 /**
@@ -77,7 +94,7 @@ function draftCookieOptions(options: EnableDraftOptions): CookieOptions {
     httpOnly: true,
     sameSite: "lax",
     path: options.path ?? "/",
-    maxAge: options.maxAgeSeconds ?? 3600,
+    maxAge: draftMaxAge(options),
     secure: options.secure ?? true,
   }
 }
@@ -91,14 +108,17 @@ export function disableDraft(
 }
 
 /**
- * Whether `request` carries a **valid** signed draft cookie (constant-time verify via `unsignValue`).
- * `createWebApp` uses it to set `ctx.draft`; `withISR` uses it to bypass the cache for editors. A
- * missing, forged, or tampered cookie returns `false`.
+ * Whether `request` carries a **valid**, unexpired signed draft cookie (constant-time verify via
+ * `unsignValue`). `createWebApp` uses it to set `ctx.draft`; `withISR` uses it to bypass the cache for
+ * editors. A missing, forged, tampered, or expired cookie returns `false`.
  */
 export async function isDraftEnabled(request: Request, secret: string): Promise<boolean> {
   const cookie = parseCookies(request.headers.get("cookie"))[DRAFT_COOKIE]
   if (cookie === undefined) return false
-  return (await unsignValue(cookie, secret)) !== null
+  const payload = await unsignValue(cookie, secret)
+  if (payload === null || !payload.startsWith(DRAFT_PREFIX)) return false
+  const expires = Number(payload.slice(DRAFT_PREFIX.length))
+  return Number.isSafeInteger(expires) && Date.now() / 1000 < expires
 }
 
 /**
@@ -173,7 +193,8 @@ export function previewEndpoint(
       `[nifra] previewEndpoint fallbackPath must be a site-relative path, got ${JSON.stringify(fallbackPath)}`,
     )
   }
-  const cookieOptions = draftCookieOptions(options.cookie ?? {})
+  const draftOptions = options.cookie ?? {}
+  const cookieOptions = draftCookieOptions(draftOptions)
   return async (request) => {
     const url = new URL(request.url)
     if (!timingSafeEqual(url.searchParams.get(tokenParam) ?? "", options.secret)) {
@@ -184,7 +205,7 @@ export function previewEndpoint(
     if (destination === null) {
       return Response.json({ ok: false, error: "invalid_redirect" }, { status: 400 })
     }
-    const signed = await signValue(DRAFT_MARKER, options.draftSecret)
+    const signed = await signValue(draftPayload(draftOptions), options.draftSecret)
     return new Response(null, {
       status: 302,
       headers: {

package/src/fonts-google.ts

@@ -113,6 +113,10 @@ const DEFAULT_MAX_FONT_BYTES = 5 * 1024 * 1024
 const MAX_CSS_BYTES = 512 * 1024
 const MAX_TEXT_LEN = 2048
 
+/** A face's weight as Google writes it: `400`, a variable `100 900`, or a keyword. It lands in the
+ * written file's name, so anything else (a tampered `400/../..`) is refused. */
+const FACE_WEIGHT = /^(?:\d{1,4}(?: \d{1,4})?|normal|bold)$/
+
 const VALID_DISPLAY: ReadonlySet<string> = new Set([
   "auto",
   "block",
@@ -420,6 +424,12 @@ export async function loadGoogleFont(
           "the stylesheet may be tampered with",
       )
     }
+    if (!FACE_WEIGHT.test(face.weight)) {
+      throw new Error(
+        `loadGoogleFont: refusing an unexpected font-weight ${JSON.stringify(face.weight.slice(0, 40))}; ` +
+          "the stylesheet may be tampered with",
+      )
+    }
     const bytes = await fetchBounded(fetchImpl, source.url, maxBytes)
     const hash = await contentHash(bytes)
     const style = face.style === "italic" ? "italic" : "normal"

package/src/index.ts

@@ -85,8 +85,8 @@ export {
   generateServerManifest,
 } from "./internal/codegen.ts"
 // Generated client entries intentionally import the browser router from the client subpath:
-// `import { createClientRouter, createMatcher, mergeHeads, resolveMeta } from "@nifrajs/web/client"`.
-export { mergeHeads, resolveMeta } from "./internal/head-merge.ts"
+// `import { createClientRouter, createMatcher, mergeHeads, resolveChainMeta } from "@nifrajs/web/client"`.
+export { mergeHeads, resolveChainMeta, resolveMeta } from "./internal/head-merge.ts"
 export {
   canonical,
   gone,
@@ -141,6 +141,7 @@ export {
   type ISROptions,
   type ISRPlatform,
   type ISRQuery,
+  type ISRStoreOp,
   isCacheablePage,
   KVCacheStore,
   type KVCacheStoreOptions,