@nifrajs/web 5.6.0 → 5.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/web",
-  "version": "5.6.0",
+  "version": "5.7.0",
   "description": "Framework-agnostic SSR core for nifra - the render seam + HTML document orchestration.",
   "keywords": [
     "bun",
@@ -360,8 +360,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@nifrajs/core": "5.6.0",
-    "@nifrajs/island-trigger": "5.6.0",
+    "@nifrajs/core": "5.7.0",
+    "@nifrajs/island-trigger": "5.7.0",
     "parse5": "8.0.1"
   },
   "peerDependencies": {

package/src/build.ts

@@ -1338,6 +1338,7 @@ export const SERVER_ENTRY_OPTIONS = [
   "i18n",
   "hostPolicy",
   "live",
+  "keepAlive",
 ] as const
 export type ServerEntryOption = (typeof SERVER_ENTRY_OPTIONS)[number]
 /** Each importable option mapped to the specifier of the module that exports it. */

package/src/client.ts

@@ -5,6 +5,7 @@
  * a full page load). DOM-only - never imported on the server, so the store stays SSR-safe.
  */
 import { trustedHeadAttributes } from "./internal/head-attributes.ts"
+import { setPresenter } from "./internal/present.ts"
 import { appUrl } from "./internal/route-path.ts"
 import { EXECUTABLE_SCRIPT_TYPES, INERT_SCRIPT_TYPES } from "./internal/script-types.ts"
 import type { Meta } from "./manifest.ts"
@@ -44,6 +45,9 @@ export { identityChanged } from "./identity.ts"
  * before hydrating. The fix is for the entry not to name the server module in the first place.
  */
 export { mergeHeads, resolveChainMeta, resolveMeta } from "./internal/head-merge.ts"
+// For route helpers shared by a loader and a component, which the browser loads too: imported from the
+// root, they put its `node:crypto` import into Vite dev's browser deps on every page.
+export { gone, notFound, statusPage } from "./internal/status-page.ts"
 export {
   closeBoundary,
   getBrowserNavigate,
@@ -211,6 +215,10 @@ export function waitForStyles(options: WaitForStylesOptions = {}): Promise<void>
   return Promise.all(promises).then(() => undefined)
 }
 
+// How long a navigation's view transition waits for the frame that captures the page before its
+// animation is skipped: several frames at any refresh rate, and short enough to go unnoticed.
+const CAPTURE_DEADLINE_MS = 100
+
 /**
  * Resolve `href` against this page and keep it only when history may move there without a load: same
  * scheme and host as the document, or null. Compared by protocol + host rather than `URL.origin`,
@@ -325,17 +333,45 @@ export function installHistory(
     return document.getElementById(id)
   }
 
-  // Wrap a navigation's render in a View Transition when the browser supports it - a graceful
-  // enhancement (no-op elsewhere). The captured "before" is held across the data fetch, so pair
-  // with link prefetch (hover/focus warms the cache) to keep most transitions instant.
+  // A navigation loads first and hands only its page swap here, so where the browser has View
+  // Transitions the page keeps painting, pending UI included, while the data loads. The browser runs
+  // the swap once a frame has captured the page; one drawing no frames while it reports itself visible
+  // (an occluded window) would hold it forever, so the deadline skips the animation, running the swap.
   type ViewTransition = {
     readonly ready: Promise<unknown>
     readonly finished: Promise<unknown>
     readonly updateCallbackDone: Promise<unknown>
+    skipTransition(): void
   }
   type ViewTransitionDocument = Document & {
     startViewTransition?: (cb: () => unknown) => ViewTransition
   }
+  setPresenter((swap) => {
+    const doc = document as ViewTransitionDocument
+    const start = doc.startViewTransition
+    if (typeof start !== "function") {
+      swap()
+      return Promise.resolve()
+    }
+    return new Promise((resolve, reject) => {
+      let swapped = false
+      const vt = start.call(doc, () => {
+        swapped = true
+        try {
+          swap()
+          resolve()
+        } catch (error) {
+          reject(error)
+        }
+      })
+      setTimeout(() => {
+        if (!swapped) vt.skipTransition()
+      }, CAPTURE_DEADLINE_MS)
+      // A newer navigation's transition, or the deadline, skips this one and rejects its promises -
+      // InvalidStateError or AbortError by engine. The swap still runs, so these are expected.
+      for (const p of [vt.ready, vt.finished, vt.updateCallbackDone]) p.catch(() => {})
+    })
+  })
   // A navigation that loads takes the page from a partially prerendered first document, which then
   // stops filling its holes and cancels the ones still loading on the server. `navigate` publishes
   // its `pendingPath` before its first await; a client-only search change, or a boundary already
@@ -353,20 +389,6 @@ export function installHistory(
     return run
   }
 
-  const transition = (run: () => Promise<void>): void => {
-    const doc = document as ViewTransitionDocument
-    if (typeof doc.startViewTransition !== "function") {
-      void run()
-      return
-    }
-    const vt = doc.startViewTransition(run)
-    // Rapid in-app clicks supersede an in-flight transition; the browser skips it and rejects its
-    // promises. Reasons vary by engine - InvalidStateError "Transition was aborted because of
-    // invalid state", or AbortError "Transition was skipped". The navigation still completes, so
-    // we swallow these expected aborts rather than let them surface as unhandled rejections.
-    for (const p of [vt.ready, vt.finished, vt.updateCallbackDone]) p.catch(() => {})
-  }
-
   // Parse a path into the `{ pathname, search, hash }` a `BlockerFunction` decides on.
   const locationOf = (path: string): BlockerLocation => {
     const url = new URL(path, location.href)
@@ -443,7 +465,7 @@ export function installHistory(
     here = url.pathname + url.search + url.hash
     expected = routePath
     // The data layer fetches by path+search; the #hash is client-only (never sent to the server).
-    transition(() => navigateFrom(routePath, path))
+    void navigateFrom(routePath, path)
     settle()
   }
 
@@ -600,7 +622,7 @@ export function installHistory(
     pendingScroll = { pos: scrollOf(history.state) }
     const routePath = location.pathname + location.search
     expected = routePath
-    transition(() => navigateFrom(routePath, dest))
+    void navigateFrom(routePath, dest)
     settle()
   }
 
@@ -682,6 +704,7 @@ export function installHistory(
     inView?.disconnect()
     setBrowserNavigate(undefined) // stop routing `useNavigate` to a torn-down router
     setBlockerController(undefined) // stop routing `useBlocker` to a torn-down registry
+    setPresenter(undefined)
     document.removeEventListener("click", onClick)
     document.removeEventListener("pointerover", onPrefetch)
     document.removeEventListener("focusin", onPrefetch)

package/src/index.ts

@@ -107,8 +107,6 @@ export {
 } from "./internal/identity-epoch.ts"
 export type { PrerenderedPages } from "./internal/prerendered-pages.ts"
 export {
-  gone,
-  notFound,
   type RedirectOptions,
   type RenderAssemblyCache,
   type RenderedPage,
@@ -120,9 +118,7 @@ export {
   renderPage,
   renderPageResult,
   revalidate,
-  type StatusPageOptions,
   serializeData,
-  statusPage,
   unsafeInlineScript,
 } from "./internal/render-document.ts"
 export {
@@ -137,6 +133,7 @@ export {
  * stubbed by both build pipelines and waved through by the guard meant to stop it leaking.
  */
 export { SERVER_FN_MODULE } from "./internal/server-boundary.ts"
+export { gone, notFound, type StatusPageOptions, statusPage } from "./internal/status-page.ts"
 export {
   type CreateWebAppOptions,
   createWebApp,

package/src/internal/codegen.ts

@@ -10,6 +10,7 @@ import {
   DATA_GLOBAL,
   HANDOVER_ID,
   LAYOUT_DATA_GLOBAL,
+  LIVE_GLOBAL,
   LOCALES_GLOBAL,
   ROOT_ATTRIBUTE,
   ROUTE_GLOBAL,
@@ -354,7 +355,11 @@ export function generateClientEntry(
     "const handover = handovers[handovers.length - 1]",
     "if (handover !== undefined) {",
     '  const state = JSON.parse(handover.textContent || "{}")',
-    `  for (const key of ${jsValueLiteral(options.copyChunks === true ? [...HANDOVER_GLOBALS, COPY_CHUNKS_GLOBAL] : HANDOVER_GLOBALS)}) {`,
+    `  for (const key of ${jsValueLiteral([
+      ...HANDOVER_GLOBALS,
+      ...(options.copyChunks === true ? [COPY_CHUNKS_GLOBAL] : []),
+      ...(live === undefined ? [] : [LIVE_GLOBAL]),
+    ])}) {`,
     "    if (Object.prototype.hasOwnProperty.call(state, key)) Reflect.set(window, key, state[key])",
     "  }",
     "}",
@@ -386,6 +391,8 @@ export function generateClientEntry(
     `  layoutData: window.${LAYOUT_DATA_GLOBAL} && window.${LAYOUT_DATA_GLOBAL}.map(mapDeferred),`,
     `  boundaries: mapDeferred(window.${BOUNDARY_GLOBAL}),`,
     `  serverComponents: window.${COMPONENT_GLOBAL},`,
+    // The seed the server rendered the page with: the live client exchanges it for its first grant.
+    ...(live === undefined ? [] : [`  live: window.${LIVE_GLOBAL},`]),
     // actionData (only set after a form POST) is in the initial state so the binding hydrates
     // consistently with the server-rendered markup; mapped through `mapDeferred` too so a deferred
     // action's placeholders become registry markers (a no-op when the action didn't defer).

package/src/internal/identity-epoch.ts

@@ -14,8 +14,8 @@ import { EPOCH_COOKIE, LOCAL_EPOCH_COOKIE } from "../identity.ts"
 export interface KeepAliveServerOptions {
   /**
    * Cookies whose change means a different visitor, on top of the session cookies of
-   * `@nifrajs/auth`, Better Auth and Auth.js under their default names. Name a custom session cookie
-   * here, or kept pages survive a sign-in or sign-out through it.
+   * `@nifrajs/auth` and Auth.js under their default names and Better Auth's under any `cookiePrefix`.
+   * Name a custom session cookie here, or kept pages survive a sign-in or sign-out through it.
    */
   readonly identityCookies?: readonly string[]
   /** `HttpOnly` cookies that say nothing about who is signed in; development stops asking about them. */
@@ -33,16 +33,9 @@ interface RequestView {
 }
 
 // Session cookies by their default names, without a `__Secure-` / `__Host-` prefix.
-const IDENTITY_DEFAULTS = [
-  "nifra_session",
-  "better-auth.session_token",
-  "authjs.session-token",
-  "next-auth.session-token",
-]
+const IDENTITY_DEFAULTS = ["nifra_session", "authjs.session-token", "next-auth.session-token"]
 // `HttpOnly` cookies the same integrations write that carry no identity of their own.
 const IGNORE_DEFAULTS = [
-  "better-auth.session_data",
-  "better-auth.dont_remember",
   "authjs.csrf-token",
   "authjs.callback-url",
   "authjs.pkce.code_verifier",
@@ -56,6 +49,11 @@ const IGNORE_DEFAULTS = [
   "__nifra_draft",
 ]
 
+// Better Auth names its cookies `<advanced.cookiePrefix>.<name>`, "better-auth" unless the app sets
+// one, so these count under any prefix.
+const BETTER_AUTH_SESSION = ".session_token"
+const BETTER_AUTH_IGNORED = [".session_data", ".dont_remember"]
+
 // `__Secure-a.0` and `__Host-a` are the cookie `a`: a prefix, then Auth.js's chunk index.
 const baseName = (name: string): string =>
   name.replace(/^__(?:secure|host)-/i, "").replace(/\.\d+$/, "")
@@ -148,8 +146,14 @@ export function identityEpochHook(
   options: KeepAliveServerOptions,
   development: boolean,
 ): (headers: HeaderView, request: RequestView) => void {
-  const identity = new Set([...IDENTITY_DEFAULTS, ...(options.identityCookies ?? []).map(baseName)])
-  const ignored = new Set([...IGNORE_DEFAULTS, ...(options.ignoreCookies ?? []).map(baseName)])
+  const named = new Set([...IDENTITY_DEFAULTS, ...(options.identityCookies ?? []).map(baseName)])
+  const told = new Set((options.ignoreCookies ?? []).map(baseName))
+  const ignored = new Set([...IGNORE_DEFAULTS, ...told])
+  // An app's own `ignoreCookies` entry outranks the Better Auth suffix, never a name it listed.
+  const isIdentity = (base: string): boolean =>
+    named.has(base) || (base.endsWith(BETTER_AUTH_SESSION) && !told.has(base))
+  const isIgnored = (base: string): boolean =>
+    ignored.has(base) || BETTER_AUTH_IGNORED.some((suffix) => base.endsWith(suffix))
   const reported = new Set<string>()
   return (headers, request) => {
     const joined = headers.get("set-cookie")
@@ -166,20 +170,20 @@ export function identityEpochHook(
           renewed === undefined &&
           !cookie.deleted &&
           (cookie.maxAge !== undefined || cookie.expires !== undefined) &&
-          identity.has(base)
+          isIdentity(base)
         )
           renewed = cookie
         continue
       }
-      if (identity.has(base)) {
+      if (isIdentity(base)) {
         // The first identity cookie still set gives the lifetime; a sign-out deletes them all.
         if (changed === undefined || (changed.deleted && !cookie.deleted)) changed = cookie
         continue
       }
-      if (!development || !cookie.httpOnly || ignored.has(base) || reported.has(base)) continue
+      if (!development || !cookie.httpOnly || isIgnored(base) || reported.has(base)) continue
       reported.add(base)
       console.warn(
-        `[nifra/web] NIFRA_KEEPALIVE_IDENTITY_COOKIE: this app keeps pages alive, and a response changed the HttpOnly cookie "${cookie.name}", which nifra does not know as a sign-in cookie. If it says who is signed in, add it to createWebApp({ keepAlive: { identityCookies: ["${base}"] } }) so a sign-in or sign-out drops the pages kept for the previous visitor; if it does not, add it to keepAlive.ignoreCookies.`,
+        `[nifra/web] NIFRA_KEEPALIVE_IDENTITY_COOKIE: this app keeps pages alive, and a response changed the HttpOnly cookie "${cookie.name}", which nifra does not know as a sign-in cookie. If it says who is signed in, name it in keepAlive: { identityCookies: ["${base}"] } so a sign-in or sign-out drops the pages kept for the previous visitor; if it does not, in keepAlive.ignoreCookies. An app run by \`nifra dev\` and \`nifra build\` exports keepAlive from backend/framework.ts; a server you write passes it to createWebApp.`,
       )
     }
     if (changed !== undefined) {

package/src/internal/live-contract.ts

@@ -30,6 +30,11 @@ export interface LiveAttachment {
   readonly onRequest: (req: Request) => Promise<Request | Response> | undefined
   /** The live load a page request belongs to, or `undefined` for every request that is not one. */
   readonly loadOf: (req: Request) => LiveLoad | undefined
+  /**
+   * The seed a server-rendered page of `routeId` collects its keys into, or `undefined` when none can
+   * be issued now (the runtime not started, the bus down, Workers). Never admitted: it is no live load.
+   */
+  readonly seedOf: (req: Request, routeId: string) => LiveLoad | undefined
 }
 
 /** One live load, from the page handler's side. */

package/src/internal/page-execution.ts

@@ -71,23 +71,18 @@ import {
 } from "./ppr/contract.ts"
 import {
   EMPTY_RETAIN,
-  type HeadersLike,
   isControlFlow,
   isResponseResult,
   isRevalidateResult,
-  isStatusSignal,
   type LoadedLayoutModules,
   layoutErrorId,
-  notFound,
   type RenderAssemblyCache,
   type RenderedPage,
   type RenderPageOptions,
   type RevalidateResult,
   redirect,
   renderPageResult,
-  STATUS_SIGNAL,
   STATUS_TEXT,
-  type StatusSignal,
   scopeParams,
   tagLayoutError,
   withDuplicateInstanceHint,
@@ -105,6 +100,13 @@ import {
   privateOutcome,
   varyOnDataHeader,
 } from "./response-controls.ts"
+import {
+  type HeadersLike,
+  isStatusSignal,
+  notFound,
+  STATUS_SIGNAL,
+  type StatusSignal,
+} from "./status-page.ts"
 
 export type { NonceResolver } from "../nonce.ts"
 
@@ -409,6 +411,8 @@ export interface PageExecutionOptions<Env = unknown> {
   ) => Promise<void> | undefined
   /** The live load a request belongs to; only set when the app configures `live`. */
   readonly liveLoadOf?: ((request: Request) => LiveLoad | undefined) | undefined
+  /** The seed a rendered document collects its keys into; only set when the app configures `live`. */
+  readonly liveSeedOf?: ((request: Request, routeId: string) => LiveLoad | undefined) | undefined
   readonly onLoaderError?: (
     error: unknown,
     ctx: {
@@ -544,6 +548,7 @@ export function createPageRequestExecutor<Env = unknown>(
   )
   const routeById = new Map(manifest.routes.map((route) => [route.id, route]))
   const liveLoadOf = options.liveLoadOf
+  const liveSeedOf = options.liveSeedOf
 
   /** A live load holds one admission slot from before its middleware until its body is complete. */
   const admitLive =
@@ -1345,6 +1350,7 @@ export function createPageRequestExecutor<Env = unknown>(
     personalized: boolean,
     serverComponents?: import("../server-components/types.ts").ComponentState,
     live?: LiveEnvelope | Deferred<LiveEnvelope>,
+    liveSeed?: LiveEnvelope,
   ): Promise<PageResponse> => {
     // Every layout loader settled before the page rendered, so a status or error page can reuse them.
     const settled: LayoutChainSource = async (_page, count) =>
@@ -1436,6 +1442,7 @@ export function createPageRequestExecutor<Env = unknown>(
         ...localeOption(req),
       }
       if (serverComponents !== undefined) page.serverComponents = serverComponents
+      if (liveSeed?.grant !== undefined) page.live = liveSeed
       if (progressiveActionData.has(req)) page.actionData = progressiveActionData.get(req)
       const swapSlot = swapSlotOf(req)
       if (swapSlot !== undefined) page.swapSlot = swapSlot
@@ -1796,7 +1803,7 @@ export function createPageRequestExecutor<Env = unknown>(
         c: PageRouteContext<Env>,
         controls: PageResponseControls,
       ): Promise<PageResponse> => {
-        const live = liveLoadOf?.(c.req)
+        let live = liveLoadOf?.(c.req)
         const componentRuntime = options.serverComponents
         const componentOwner = componentRuntime?.owns(route.id) === true
         let componentRequest:
@@ -1813,6 +1820,17 @@ export function createPageRequestExecutor<Env = unknown>(
         }
         const loaded = loadModule(route)
         const mod = cacheModules && !(loaded instanceof Promise) ? loaded : await loaded
+        // A document's loaders declare their keys into a seed, which the page exchanges for a grant
+        // once its socket opens, instead of loading itself again. Partially prerendered pages, whose
+        // holes settle after the shell, and server-component routes load as before.
+        const seeding =
+          live === undefined &&
+          liveSeedOf !== undefined &&
+          !componentOwner &&
+          componentRequest === undefined &&
+          (options.ppr === undefined || mod.shellLoader === undefined) &&
+          !isDataRequest(c)
+        if (seeding) live = liveSeedOf(c.req, route.id)
         const draft = await draftFlag(c.req)
         // Unpublished content is the editor's alone: whatever cache-control a loader sets, no cache keeps it.
         if (draft) controls.personalize()
@@ -2094,7 +2112,7 @@ export function createPageRequestExecutor<Env = unknown>(
         }
         const isData = isDataRequest(c)
         const liveEnvelope =
-          live === undefined || !isData || isStatusSignal(data) || isControlFlow(data)
+          live === undefined || (!isData && !seeding) || isStatusSignal(data) || isControlFlow(data)
             ? undefined
             : await liveEnvelopeOf(
                 live,
@@ -2125,7 +2143,10 @@ export function createPageRequestExecutor<Env = unknown>(
           responseHeaders,
           controls.personalized,
           componentState,
-          liveEnvelope,
+          seeding ? undefined : liveEnvelope,
+          seeding && liveEnvelope !== undefined && !("__nifra_deferred" in liveEnvelope)
+            ? liveEnvelope
+            : undefined,
         )
       }
       return withResponseControls(liveLoadOf === undefined ? page : admitLive(page))

package/src/internal/parity.ts

@@ -99,6 +99,9 @@ export interface IdentityParityFinding {
    * before anything loads. Reported, never fatal - see `SingleCopyCoverage`.
    */
   readonly deduplicated: boolean
+  /** Unbundled commands that still load both copies of a deduplicated package, because bunfig.toml
+   * does not preload the registrar for them. Absent when both are covered. */
+  readonly unenforced?: readonly ("bun run" | "bun test")[]
 }
 
 /**
@@ -743,11 +746,34 @@ const describeProvenance = (copies: readonly IdentityParityCopy[]): string | und
   return `reached through ${one ? "a symlink" : "symlinks"} that ${one ? "points" : "point"} outside the importer's install: ${lines.join(", ")}. Unless the importer declares ${one ? "it" : "them"} as a \`link:\` dependency, ${one ? "the link was" : "the links were"} planted by hand, by another project, or by \`bun link\` - remove ${one ? "it" : "them"} and reinstall there, so the importer resolves its own install's copy.`
 }
 
-/** What is left to do about a duplicate the declaration already covers. */
-const deduplicatedRemediation = (registration: SingleCopyRegistration): string =>
-  registration.run || registration.test
-    ? "Declared single-copy and enforced: every duplicate is rewritten to this app's copy, so one module instance loads."
-    : `Declared single-copy, so bundled output is deduplicated by the build. Unbundled runs are NOT: Bun's runtime never offers a bare specifier to a resolver, so add preload = ["${SINGLE_COPY_REGISTER_SPECIFIER}"] to bunfig.toml (and under [test]) or \`bun test\` still loads both copies.`
+/**
+ * What is left to do about a duplicate the declaration already covers. Bun reads the top-level
+ * `preload` for `bun run` (and the nifra CLI, which runs under the app's bunfig) and `[test] preload`
+ * for `bun test`, never one for the other, so each half is reported on its own.
+ */
+const deduplicatedRemediation = (registration: SingleCopyRegistration): string => {
+  if (registration.run && registration.test)
+    return "Declared single-copy and enforced: every duplicate is rewritten to this app's copy, so one module instance loads."
+  const preload = `preload = ["${SINGLE_COPY_REGISTER_SPECIFIER}"]`
+  const ignored =
+    registration.ignored === undefined
+      ? ""
+      : ` The ${preload} under [${registration.ignored.join("], [")}] belongs to that table, so Bun never runs it.`
+  if (registration.test)
+    return `Declared single-copy and enforced under \`bun test\` only: \`bun run\`, \`nifra dev\` and the CLI's app imports still load both copies until bunfig.toml carries ${preload} at the top level, above the first [table].${ignored}`
+  if (registration.run)
+    return `Declared single-copy and enforced under \`bun run\` only: \`bun test\` still loads both copies until bunfig.toml carries ${preload} under [test].`
+  return `Declared single-copy, so bundled output is deduplicated by the build. Unbundled runs are NOT: Bun's runtime never offers a bare specifier to a resolver, so add ${preload} to bunfig.toml above the first [table], and again under [test], or \`bun run\` and \`bun test\` still load both copies.${ignored}`
+}
+
+const unenforcedCommands = (
+  registration: SingleCopyRegistration,
+): readonly ("bun run" | "bun test")[] => {
+  const commands: ("bun run" | "bun test")[] = []
+  if (!registration.run) commands.push("bun run")
+  if (!registration.test) commands.push("bun test")
+  return commands
+}
 
 /**
  * Read the declaration and its runtime proof, preferring the directory the caller is in.
@@ -861,6 +887,7 @@ export async function collectIdentityParity(
     // so the skew stays fatal and the ranges have to be fixed.
     const covered =
       cause === "duplicate-path" && matchesSingleCopyDeclaration(singleCopy.declared, name)
+    const unenforced = covered ? unenforcedCommands(singleCopy.registration) : []
     const finding: IdentityParityFinding = {
       package: name,
       copies: resolvedCopies,
@@ -880,7 +907,9 @@ export async function collectIdentityParity(
       ...(provenance === undefined ? {} : { provenance }),
       deduplicated: covered,
     }
-    ;(covered ? deduplicated : findings).push(finding)
+    ;(covered ? deduplicated : findings).push(
+      unenforced.length === 0 ? finding : { ...finding, unenforced },
+    )
   }
   return {
     workspaceRoot: scanRoot,

package/src/internal/ppr/runtime.ts

@@ -1,4 +1,5 @@
 import { hashSource } from "../../csp.ts"
+import { REVIVE_DATES_SOURCE } from "../revive-dates.ts"
 
 /**
  * The PPR client runtime: one inline script in the shell, constant per release, listed in the CSP by
@@ -14,7 +15,9 @@ import { hashSource } from "../../csp.ts"
  * HTML before framing it; the policy only names the one sink.
  */
 export const PPR_RUNTIME =
-  '(()=>{var w=window,d=document,h={},s={},dead=0,p;var pol=function(){if(!p){try{p=w.trustedTypes?w.trustedTypes.createPolicy("nifra-ppr",{createHTML:function(x){return x}}):null}catch(_){}p=p||{createHTML:function(x){return x}}}return p};var ap=function(t,n,v){t.innerHTML=pol().createHTML(typeof v.html==="string"?v.html:"");t.setAttribute("data-nifra-filled","");t.setAttribute("aria-busy","false");if(v.error)t.setAttribute("data-nifra-hole-error","");else t.removeAttribute("data-nifra-hole-error");var o={props:v.props,error:!!v.error};if(v.component){o.component=v.component;o.html=v.html}h[n]=o;return o};var f=function(n){if(dead)return;var e=d.getElementById("nifra-ppr:"+n);if(!e)return;var v;try{v=JSON.parse(e.textContent)}catch(_){return}e.remove();var t=d.querySelector(\'[data-nifra-hole="\'+n+\'"]\');if(!t||t.hasAttribute("data-nifra-filled"))return;var o=ap(t,n,v);(s[n]||[]).slice().forEach(function(c){c(o)})};f.put=function(n,v,t){if(v&&typeof v==="object"&&t&&t.getAttribute&&t.getAttribute("data-nifra-hole")===n)ap(t,n,v)};f.get=function(n){return h[n]};f.subscribe=function(n,c){(s[n]||(s[n]=[])).push(c);return function(){s[n]=(s[n]||[]).filter(function(x){return x!==c})}};f.leave=function(){if(dead)return;dead=1;s={};var r=d.getElementById("nifra-ppr-req");if(!r)return;var q;try{q=JSON.parse(r.textContent)}catch(_){return}if(q.cancel&&q.holes.some(function(n){return!h[n]})&&navigator.sendBeacon)navigator.sendBeacon(q.cancel,q.token)};f.dead=function(){return!!dead};f.boot=function(){var c=d.currentScript,e=c&&c.previousElementSibling;if(e&&e.rel==="modulepreload"&&e.href)import(e.href)};w.__nifraPpr=f})()'
+  "(()=>{" +
+  REVIVE_DATES_SOURCE +
+  ';var w=window,d=document,h={},s={},dead=0,p;var pol=function(){if(!p){try{p=w.trustedTypes?w.trustedTypes.createPolicy("nifra-ppr",{createHTML:function(x){return x}}):null}catch(_){}p=p||{createHTML:function(x){return x}}}return p};var ap=function(t,n,v){t.innerHTML=pol().createHTML(typeof v.html==="string"?v.html:"");t.setAttribute("data-nifra-filled","");t.setAttribute("aria-busy","false");if(v.error)t.setAttribute("data-nifra-hole-error","");else t.removeAttribute("data-nifra-hole-error");var o={props:__nifraDates(v.props),error:!!v.error};if(v.component){o.component=v.component;o.html=v.html}h[n]=o;return o};var f=function(n){if(dead)return;var e=d.getElementById("nifra-ppr:"+n);if(!e)return;var v;try{v=JSON.parse(e.textContent)}catch(_){return}e.remove();var t=d.querySelector(\'[data-nifra-hole="\'+n+\'"]\');if(!t||t.hasAttribute("data-nifra-filled"))return;var o=ap(t,n,v);(s[n]||[]).slice().forEach(function(c){c(o)})};f.put=function(n,v,t){if(v&&typeof v==="object"&&t&&t.getAttribute&&t.getAttribute("data-nifra-hole")===n)ap(t,n,v)};f.get=function(n){return h[n]};f.subscribe=function(n,c){(s[n]||(s[n]=[])).push(c);return function(){s[n]=(s[n]||[]).filter(function(x){return x!==c})}};f.leave=function(){if(dead)return;dead=1;s={};var r=d.getElementById("nifra-ppr-req");if(!r)return;var q;try{q=JSON.parse(r.textContent)}catch(_){return}if(q.cancel&&q.holes.some(function(n){return!h[n]})&&navigator.sendBeacon)navigator.sendBeacon(q.cancel,q.token)};f.dead=function(){return!!dead};f.boot=function(){var c=d.currentScript,e=c&&c.previousElementSibling;if(e&&e.rel==="modulepreload"&&e.href)import(e.href)};w.__nifraPpr=f})()'
 
 /**
  * What loads each module script of a shell, after a `<link rel="modulepreload">` naming it. WebKit

package/src/internal/ppr/server.ts

@@ -10,7 +10,8 @@ import { type CspPolicy, cspHeaderWithSources, prepareCspPolicy } from "../../cs
 import { defer } from "../../deferred.ts"
 import type { RenderAdapter } from "../../render-seam.ts"
 import { HOLE_ERROR_HTML } from "../hole-runtime.ts"
-import { isControlFlow, isStatusSignal, notFound } from "../render-document.ts"
+import { isControlFlow } from "../render-document.ts"
+import { isStatusSignal, notFound } from "../status-page.ts"
 import { HoleAdmission, type HoleRun, type HoleSlot, watchAbort } from "./admission.ts"
 import type { ShellCheckRecord } from "./compile-shell.ts"
 import {
@@ -178,8 +179,9 @@ const pendingStates = (holes: readonly HoleRegistration[]): BoundaryStates => {
 const shellKey = (deployment: string, request: PprRequest): string =>
   `ppr:v1|${deployment}|${request.routeId}|${request.locale ?? ""}|${request.path}|${variationQuery(request.variations)}`
 
+// No `?.`: a bundler's NODE_ENV define replaces only the plain member read, and this runs per request.
 const isProduction = (): boolean =>
-  typeof process !== "undefined" && process.env?.NODE_ENV === "production"
+  typeof process !== "undefined" && process.env.NODE_ENV === "production"
 
 const concat = (chunks: readonly Uint8Array[]): Uint8Array => {
   let length = 0

package/src/internal/ppr/shell-store.ts

@@ -5,7 +5,9 @@
  * fails the check is a miss.
  */
 import type { CachedResponse, CacheStore } from "../../isr.ts"
+import { DATE_TAG } from "../revive-dates.ts"
 import { storeSigner } from "../store-signature.ts"
+import { wireDate } from "../wire-date.ts"
 
 /** A shell or a shared hole's frame as the shared store holds it: everything a process needs to
  * serve it. */
@@ -61,6 +63,7 @@ const isStoredEntry = (value: unknown): value is StoredEntry => {
   )
 }
 
+/** Read and write signed deployment-scoped PPR entries, treating malformed data as cache misses. */
 export function sharedShellStore(
   store: CacheStore,
   secret: string,
@@ -81,7 +84,17 @@ export function sharedShellStore(
       }
       let payload: unknown
       try {
-        payload = JSON.parse(cached.body)
+        // Match page-data revival, but keep the server's tagged toJSON for subsequent responses.
+        // JSON.parse defines own properties (including __proto__) without invoking setters.
+        payload = JSON.parse(cached.body, (_key, value: unknown) => {
+          if (typeof value !== "object" || value === null) return value
+          const tagged: unknown = Reflect.get(value, DATE_TAG)
+          if (typeof tagged !== "string" || Object.keys(value).length !== 1) return value
+          const time = Date.parse(tagged)
+          // An invalid wireDate would throw later from toJSON, outside this cache-miss boundary.
+          if (!Number.isFinite(time)) throw new RangeError("invalid cached date tag")
+          return wireDate(time)
+        })
       } catch {
         return undefined
       }

package/src/internal/present.ts

@@ -0,0 +1,20 @@
+/**
+ * How a client navigation's page swap reaches the screen. The router loads a page first and hands only
+ * the swap here, so the history layer can wrap the swap alone in a view transition rather than the
+ * whole load. Module-scoped: one app per page; unset on the server and without `installHistory`.
+ */
+export type Presenter = (swap: () => void) => Promise<void>
+
+let presenter: Presenter | undefined
+
+/** Set (or clear, with `undefined`) the presenter - called by `installHistory`. */
+export function setPresenter(next: Presenter | undefined): void {
+  presenter = next
+}
+
+/** Run `swap` through the presenter, or at once when none is set. */
+export function present(swap: () => void): Promise<void> | undefined {
+  if (presenter !== undefined) return presenter(swap)
+  swap()
+  return undefined
+}