@octanejs/app-core 0.0.42 → 0.0.44

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@octanejs/app-core",
-  "version": "0.0.42",
+  "version": "0.0.44",
   "license": "MIT",
   "type": "module",
   "engines": {
@@ -75,14 +75,14 @@
     }
   },
   "dependencies": {
-    "@ripple-ts/adapter": "^0.3.118",
+    "@ripple-ts/adapter": "^0.3.125",
     "esbuild": "^0.28.1"
   },
   "peerDependencies": {
-    "octane": "0.1.46"
+    "octane": "0.1.48"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",
-    "octane": "0.1.46"
+    "octane": "0.1.48"
   }
 }

package/src/server/production.js

@@ -54,6 +54,10 @@ import { patch_global_fetch, build_rpc_lookup, is_rpc_request } from '@ripple-ts
 
 export { resolveOctaneConfig } from '../resolve-config.js';
 
+const HEAD_MARKER = '<!--ssr-head-->';
+const BODY_MARKER = '<!--ssr-body-->';
+const BODY_CLOSE_TAG = /<\/body\s*>/i;
+
 // A server integration can reload its compiled manifest repeatedly while the
 // process (and global fetch) stays alive. Ripple's fetch patch is deliberately
 // idempotent, so calling it again cannot replace its closed-over handler or
@@ -124,6 +128,37 @@ function buildRpcDescriptors(rpcModules, hashFn) {
 	return descriptors;
 }
 
+/**
+ * Split the immutable, validated production template around both insertion
+ * markers once. Dynamic head content is then concatenated into the prepared
+ * fragments without rescanning the complete template on every request.
+ *
+ * `splitSsrTemplate` historically revalidated after head insertion. Preserve
+ * that behavior on the exceptional path where inserted content could change
+ * the body-marker contract.
+ *
+ * @param {string} html
+ * @returns {(headContent: string) => string[]}
+ */
+function prepareSsrTemplate(html) {
+	const [prefix, suffix] = splitSsrTemplate(html);
+	const prefixHeadAt = prefix.indexOf(HEAD_MARKER);
+	const headInPrefix = prefixHeadAt !== -1;
+	const headAt = headInPrefix ? prefixHeadAt : suffix.indexOf(HEAD_MARKER);
+	const headSide = headInPrefix ? prefix : suffix;
+	const beforeHead = headSide.slice(0, headAt);
+	const afterHead = headSide.slice(headAt + HEAD_MARKER.length);
+
+	return (headContent) => {
+		const nextPrefix = headInPrefix ? beforeHead + headContent + afterHead : prefix;
+		const nextSuffix = headInPrefix ? suffix : beforeHead + headContent + afterHead;
+		if (headContent.includes(BODY_MARKER) || BODY_CLOSE_TAG.test(headContent)) {
+			return splitSsrTemplate(nextPrefix + BODY_MARKER + nextSuffix);
+		}
+		return [nextPrefix, nextSuffix];
+	};
+}
+
 /**
  * @typedef {import('@octanejs/app-core').RenderRoute} RenderRoute
  * @typedef {import('@octanejs/app-core').Middleware} Middleware
@@ -133,6 +168,71 @@ function buildRpcDescriptors(rpcModules, hashFn) {
 @import { ServerManifest, HandlerOptions, ClientAssetEntry } from '../../types/production.d.ts'
  */
 
+/**
+ * @typedef {Object} PreparedRenderRoute
+ * @property {number} index
+ * @property {string | undefined} assetHead
+ */
+
+/**
+ * Index the production manifest once, matching the router's handler-lifetime
+ * snapshot. Integrations create a new handler when replacing that manifest.
+ * Asset tags are populated lazily on the first request for each route, avoiding
+ * both repeated assembly on hot routes and eager work for routes an isolate may
+ * never serve.
+ *
+ * @param {import('@octanejs/app-core').Route[]} routes
+ * @returns {Map<RenderRoute, PreparedRenderRoute>}
+ */
+function prepareRenderRoutes(routes) {
+	/** @type {Map<RenderRoute, PreparedRenderRoute>} */
+	const prepared = new Map();
+	let index = 0;
+	for (const route of routes) {
+		if (route.type !== 'render') continue;
+		// Preserve Array#indexOf semantics if a caller reuses one route object.
+		if (!prepared.has(route)) prepared.set(route, { index, assetHead: undefined });
+		index++;
+	}
+	return prepared;
+}
+
+/**
+ * @param {ServerManifest} manifest
+ * @param {RenderRoute} route
+ * @param {string | undefined} entryPath
+ * @returns {string}
+ */
+function prepareRouteAssetHead(manifest, route, entryPath) {
+	/** @type {string[]} */
+	const tags = [];
+	const clientAssets = manifest.clientAssets;
+	if (clientAssets) {
+		/** @type {Set<string>} */
+		const stylesheets = new Set();
+		for (const modulePath of [
+			entryPath,
+			route.layout,
+			manifest.rootBoundary?.pending ? manifest.rootBoundaryEntries?.pending?.path : undefined,
+			manifest.rootBoundary?.catch ? manifest.rootBoundaryEntries?.catch?.path : undefined,
+		]) {
+			if (!modulePath) continue;
+			for (const cssFile of clientAssets[modulePath]?.css ?? []) {
+				if (stylesheets.has(cssFile)) continue;
+				stylesheets.add(cssFile);
+				tags.push(`<link rel="stylesheet" href="/${cssFile}">`);
+			}
+		}
+	}
+	// Only the page chunk was already eager; do not promote layout, fallback,
+	// or island JavaScript while making their server-rendered CSS available.
+	const entryAssets = entryPath ? clientAssets?.[entryPath] : undefined;
+	if (entryAssets?.js) {
+		tags.push(`<link rel="modulepreload" href="/${entryAssets.js}">`);
+	}
+	return tags.join('\n');
+}
+
 /**
  * Create the production request handler from a manifest.
  *
@@ -150,14 +250,17 @@ function buildRpcDescriptors(rpcModules, hashFn) {
 export function createHandler(manifest, deps) {
 	const { renderToReadableStream, prerender, htmlTemplate, executeServerFunction } = deps;
 	const router = createRouter(manifest.routes);
+	const preparedRenderRoutes = prepareRenderRoutes(manifest.routes);
 	const globalMiddlewares = manifest.middlewares ?? [];
 	const trustProxy = manifest.trustProxy ?? false;
 	const rpcPolicy = manifest.rpc;
 	const runtime = manifest.runtime;
 	validateSsrTemplate(htmlTemplate);
 	// Also pin the built-template contract up front. The marker is emitted by
-	// the integration's HTML transform and survives source hashing.
-	applyHydrationNonce(htmlTemplate, null);
+	// the integration's HTML transform and survives source hashing. Prepare the
+	// normalized no-nonce template once: this is the common request path, and its
+	// static fragments are identical for every request handled by this manifest.
+	const splitHydrationTemplate = prepareSsrTemplate(applyHydrationNonce(htmlTemplate, null));
 
 	// RPC lookup for statically imported `module server` functions
 	// (compiler hash → server function).
@@ -244,6 +347,7 @@ export function createHandler(manifest, deps) {
 	 * @returns {Promise<Response>}
 	 */
 	async function renderRoute(route, context) {
+		const preparedRoute = preparedRenderRoutes.get(route);
 		const entryPath = get_route_entry_path(route.entry);
 		const exportName = get_route_entry_export_name(route.entry);
 		const PageComponent = entryPath
@@ -288,7 +392,7 @@ export function createHandler(manifest, deps) {
 			entry: entryPath,
 			exportName: exportName ?? null,
 			layout: route.layout ?? null,
-			routeIndex: getRenderRouteIndex(manifest.routes, route),
+			routeIndex: preparedRoute?.index,
 			params: context.params,
 			url: requestUrl,
 			preHydrate: manifest.preHydrate ?? null,
@@ -300,35 +404,13 @@ export function createHandler(manifest, deps) {
 		// server HTML before hydration. Their asset records also include CSS for
 		// deferred Hydrate descendants, whose JavaScript must remain lazy. Keep
 		// page CSS first, preserve each record's order, and link shared files once.
-		/** @type {string[]} */
-		const preloadTags = [];
-		const clientAssets = manifest.clientAssets;
-		const entryAssets = entryPath ? clientAssets?.[entryPath] : undefined;
-		if (clientAssets) {
-			/** @type {Set<string>} */
-			const stylesheets = new Set();
-			for (const modulePath of [
-				entryPath,
-				route.layout,
-				manifest.rootBoundary?.pending ? manifest.rootBoundaryEntries?.pending?.path : undefined,
-				manifest.rootBoundary?.catch ? manifest.rootBoundaryEntries?.catch?.path : undefined,
-			]) {
-				if (!modulePath) continue;
-				for (const cssFile of clientAssets[modulePath]?.css ?? []) {
-					if (stylesheets.has(cssFile)) continue;
-					stylesheets.add(cssFile);
-					preloadTags.push(`<link rel="stylesheet" href="/${cssFile}">`);
-				}
-			}
-		}
-		// Only the page chunk was already eager; do not promote layout, fallback,
-		// or island JavaScript while making their server-rendered CSS available.
-		if (entryAssets?.js) {
-			preloadTags.push(`<link rel="modulepreload" href="/${entryAssets.js}">`);
+		let assetHead = preparedRoute?.assetHead;
+		if (assetHead === undefined) {
+			assetHead = prepareRouteAssetHead(manifest, route, entryPath);
+			if (preparedRoute) preparedRoute.assetHead = assetHead;
 		}
-
-		const headContent = [...preloadTags, dataScript].join('\n');
-		const noncedTemplate = applyHydrationNonce(htmlTemplate, nonce);
+		const headContent = assetHead === '' ? dataScript : assetHead + '\n' + dataScript;
+		const noncedTemplate = nonce === null ? null : applyHydrationNonce(htmlTemplate, nonce);
 
 		const status = route.status ?? 200;
 		const headers = { 'Content-Type': 'text/html; charset=utf-8' };
@@ -346,8 +428,12 @@ export function createHandler(manifest, deps) {
 		// match, and this text now carries author-controlled metadata as well as
 		// the serialized route data.
 		/** @param {string} hoistedHead */
-		const splitAroundBody = (hoistedHead) =>
-			splitSsrTemplate(noncedTemplate.replace('<!--ssr-head-->', () => headContent + hoistedHead));
+		const splitAroundBody = (hoistedHead) => {
+			const completeHead = headContent + hoistedHead;
+			return noncedTemplate === null
+				? splitHydrationTemplate(completeHead)
+				: splitSsrTemplate(noncedTemplate.replace(HEAD_MARKER, () => completeHead));
+		};
 
 		if (manifest.render === 'buffered') {
 			// Await-everything fallback (`prerender` from octane/static): no
@@ -397,17 +483,6 @@ export function createHandler(manifest, deps) {
 	return handler;
 }
 
-/**
- * @param {import('@octanejs/app-core').Route[]} routes
- * @param {RenderRoute} route
- * @returns {number | undefined}
- */
-function getRenderRouteIndex(routes, route) {
-	const renderRoutes = routes.filter((r) => r.type === 'render');
-	const index = renderRoutes.indexOf(route);
-	return index === -1 ? undefined : index;
-}
-
 /**
  * Escape script content to prevent XSS in the inline JSON data block.
  * @param {string} str

package/src/server/router.js

@@ -14,20 +14,20 @@
 /**
  * @typedef {Object} CompiledRoute
  * @property {Route} route
- * @property {RegExp} pattern
+ * @property {string | RegExp} pattern
  * @property {string[]} paramNames
  * @property {number} specificity - Higher = more specific (static > param > catch-all)
  */
 
 /**
- * Convert a route path pattern to a RegExp
+ * Compile a route path into an exact string or capturing RegExp
  * Supports:
  * - Static segments: /about, /api/hello
  * - Named params: /posts/:id, /users/:userId/posts/:postId
  * - Catch-all: /docs/*slug
  *
  * @param {string} path
- * @returns {{ pattern: RegExp, paramNames: string[], specificity: number }}
+ * @returns {{ pattern: string | RegExp, paramNames: string[], specificity: number }}
  */
 function compilePath(path) {
 	/** @type {string[]} */
@@ -62,7 +62,9 @@ function compilePath(path) {
 		})
 		.join('/');
 
-	const pattern = new RegExp(`^${regexString || '/'}$`);
+	// Static paths are already exact matchers. Keep RegExp capture work for the
+	// parameter and catch-all routes that need it.
+	const pattern = paramNames.length === 0 ? path || '/' : new RegExp(`^${regexString || '/'}$`);
 	return { pattern, paramNames, specificity };
 }
 
@@ -98,24 +100,30 @@ export function createRouter(routes) {
 		 * @returns {RouteMatch | null}
 		 */
 		match(method, pathname) {
+			let normalizedMethod;
 			for (const { route, pattern, paramNames } of compiledRoutes) {
 				// Check method for ServerRoute
 				if (route.type === 'server') {
 					const methods = /** @type {ServerRoute} */ (route).methods;
-					if (!methods.includes(method.toUpperCase())) {
+					normalizedMethod ??= method.toUpperCase();
+					if (!methods.includes(normalizedMethod)) {
 						continue;
 					}
 				}
 
+				if (typeof pattern === 'string') {
+					if (pathname === pattern) return { route, params: {} };
+					continue;
+				}
+
 				const match = pathname.match(pattern);
-				if (match) {
-					/** @type {Record<string, string>} */
-					const params = {};
-					for (let i = 0; i < paramNames.length; i++) {
-						params[paramNames[i]] = decodeURIComponent(match[i + 1]);
-					}
-					return { route, params };
+				if (!match) continue;
+				/** @type {Record<string, string>} */
+				const params = {};
+				for (let i = 0; i < paramNames.length; i++) {
+					params[paramNames[i]] = decodeURIComponent(match[i + 1]);
 				}
+				return { route, params };
 			}
 			return null;
 		},

package/types/index.d.ts

@@ -393,7 +393,7 @@ export interface OctaneConfigOptions {
 	adapter?: OctaneAdapter;
 	/** @experimental Compiler-owned configuration shared by all bundler integrations. */
 	compiler?: {
-		/** Reject unsafe state updates and ref writes in application-owned modules. @default false */
+		/** Assert pure immutable-snapshot renders and reject detectable violations. @default false */
 		strong?: boolean;
 		renderers?: ExperimentalRendererConfigOptions;
 	};