@octanejs/app-core 0.0.52 → 0.0.54

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@octanejs/app-core",
-  "version": "0.0.52",
+  "version": "0.0.54",
   "license": "MIT",
   "type": "module",
   "engines": {
@@ -79,10 +79,10 @@
     "esbuild": "^0.28.1"
   },
   "peerDependencies": {
-    "octane": "^0.3.0"
+    "octane": "^0.4.0"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",
-    "octane": "0.3.0"
+    "octane": "0.4.0"
   }
 }

package/src/html.js

@@ -1,4 +1,5 @@
 export { composeHtmlStream } from './server/html-stream.js';
+export { serializeRouteData } from './server/route-data.js';
 export {
 	HYDRATION_NONCE_PLACEHOLDER,
 	applyHydrationNonce,

package/src/server/production.js

@@ -18,8 +18,8 @@
  * BUILT dist/client/index.html (hashed hydrate script already in place, so
  * nothing is injected per-request), per-route `<link rel=stylesheet/modulepreload>`
  * tags from the client manifest join the head, and render errors produce a
- * plain 500 (no dev stack page). Keep the two files in sync when the shape
- * changes.
+ * plain 500 (no dev stack page). Both handlers use the shared route-data
+ * serializer when the hydration payload shape changes.
  */
 
 import { createRouter } from './router.js';
@@ -31,6 +31,7 @@ import { runServerRequest } from './signal-owners.js';
 import { rpcIdCollision } from './rpc-registry.js';
 import { handleServerRoute } from './server-route.js';
 import { composeHtmlStream } from './html-stream.js';
+import { serializeRouteData } from './route-data.js';
 import {
 	applyHydrationNonce,
 	getContextNonce,
@@ -253,7 +254,7 @@ function prepareIndependentHydration(manifest) {
  * Snapshot completed build authority once per handler, never from request data.
  * Legacy custom handlers without a client build retain their existing path.
  * @param {ServerManifest} manifest
- * @returns {ServerManifest['clientBuild'] | undefined}
+ * @returns {import('@octanejs/app-core/production').ClientBuildManifest | undefined}
  */
 function prepareClientBuild(manifest) {
 	const build = manifest.clientBuild;
@@ -505,8 +506,7 @@ export function createHandler(manifest, deps) {
 			deps,
 		);
 
-		// The hydration payload — SAME keys, SAME order as dev render-route.js, so
-		// the data script is byte-identical between dev and production.
+		// Share payload ordering and script escaping with the dev handler.
 		const streamedSignals =
 			clientBuild == null
 				? undefined
@@ -514,7 +514,7 @@ export function createHandler(manifest, deps) {
 						buildId: clientBuild.buildId,
 						documentId: crypto.randomUUID(),
 					};
-		const routeData = JSON.stringify({
+		const routeData = serializeRouteData({
 			entry: entryPath,
 			exportName: exportName ?? null,
 			layout: route.layout ?? null,
@@ -526,7 +526,7 @@ export function createHandler(manifest, deps) {
 			clientBuild,
 			streamedSignals,
 		});
-		const dataScript = `<script id="__octane_data" type="application/json"${nonceAttribute(nonce)}>${escapeScript(routeData)}</script>`;
+		const dataScript = `<script id="__octane_data" type="application/json"${nonceAttribute(nonce)}>${routeData}</script>`;
 
 		// The page, layout, and configured root fallbacks can all contribute
 		// server HTML before hydration. Their asset records also include CSS for
@@ -620,12 +620,3 @@ export function createHandler(manifest, deps) {
 
 	return handler;
 }
-
-/**
- * Escape script content to prevent XSS in the inline JSON data block.
- * @param {string} str
- * @returns {string}
- */
-function escapeScript(str) {
-	return str.replace(/</g, '\\u003c').replace(/>/g, '\\u003e');
-}

package/src/server/route-data.js

@@ -0,0 +1,25 @@
+// @ts-check
+
+/**
+ * Serialize the common dev/production hydration payload in a stable order.
+ * Build and document identities are supplied by the caller, never generated or
+ * cached here. Escape HTML delimiters before embedding JSON in an inline script.
+ * @param {import('@octanejs/app-core/html').RouteHydrationData} data
+ * @returns {string}
+ */
+export function serializeRouteData(data) {
+	return JSON.stringify({
+		entry: data.entry,
+		exportName: data.exportName ?? null,
+		layout: data.layout ?? null,
+		routeIndex: data.routeIndex,
+		params: data.params,
+		url: data.url,
+		preHydrate: data.preHydrate ?? null,
+		rootBoundary: data.rootBoundary ?? { pending: null, catch: null },
+		clientBuild: data.clientBuild,
+		streamedSignals: data.streamedSignals,
+	})
+		.replace(/</g, '\\u003c')
+		.replace(/>/g, '\\u003e');
+}

package/types/html.d.ts

@@ -1,4 +1,21 @@
 import type { Context } from '@octanejs/app-core';
+import type { ClientBuildManifest, ServerManifest } from '@octanejs/app-core/production';
+
+/** Request-local inputs to the script-safe dev/production hydration payload. */
+export interface RouteHydrationData {
+	entry: string | undefined;
+	exportName?: string | null;
+	layout?: string | null;
+	routeIndex?: number;
+	params: Record<string, string>;
+	url: string;
+	preHydrate?: string | null;
+	rootBoundary?: ServerManifest['rootBoundaryEntries'];
+	clientBuild?: ClientBuildManifest;
+	streamedSignals?: { buildId: string; documentId: string };
+}
+
+export function serializeRouteData(data: RouteHydrationData): string;
 
 export const HYDRATION_NONCE_PLACEHOLDER: '__OCTANE_REQUEST_NONCE__';
 export function composeHtmlStream(