@panphora/clayjs 0.2.1 → 0.4.1

package/src/core/host-attrs.js

@@ -0,0 +1,46 @@
+/**
+ * host-attrs.js — the attributes a host puts on <html>, and what they mean.
+ *
+ * These are ephemeral: the host injects them into the response and strips them
+ * back out of whatever the client saves, so they never reach disk. clayjs only
+ * ever reads them, and reads them here so the two spellings of the save token
+ * cannot drift between the edit-mode ladder and the save lane.
+ */
+
+import { HOST_TOKEN_ATTRS, SAVE_TRANSPORT_ATTR } from "../lib/root-attrs.js";
+
+// A host that wants the desktop JSON envelope on its save lane declares it on
+// the root. This replaced a `location.hostname === 'localhost'` sniff, which sent
+// the envelope to every host that happened to be local, including ones whose
+// save lane takes text and answers 415.
+export const DESKTOP_JSON = "desktop-json-v1";
+
+/**
+ * The per-document save token this response carries, or null.
+ * @returns {?string}
+ */
+export function saveToken() {
+  if (typeof document === "undefined") return null;
+  for (const attr of HOST_TOKEN_ATTRS) {
+    const value = document.documentElement.getAttribute(attr);
+    if (value) return value;
+  }
+  return null;
+}
+
+/**
+ * True when the host handed this response a save token of either spelling.
+ * @returns {boolean}
+ */
+export function hasSaveToken() {
+  return saveToken() !== null;
+}
+
+/**
+ * The save transport the served document declares, or null.
+ * @returns {?string}
+ */
+export function saveTransport() {
+  if (typeof document === "undefined") return null;
+  return document.documentElement.getAttribute(SAVE_TRANSPORT_ATTR);
+}

package/src/core/is-edit-mode.js

@@ -1,12 +1,20 @@
 import cookie from "../lib/cookie.js";
 import query from "../lib/query.js";
+import { hasSaveToken } from "./host-attrs.js";
 
 // Edit-mode precedence: an explicit ?editmode=true|false URL param wins, then an
 // opt-in window.clayEditMode global (with the legacy window.__hyperclayEditMode
-// still honored as a fallback — htmlclay injects it today), then the platform's
-// isAdminOfCurrentResource cookie. The global is for standalone uses (demos,
-// htmlclay, any self-saving file) that are always editable and have no owner
-// cookie; setting it before clayjs loads turns on the edit-only modules.
+// still honored as a fallback — htmlclay injects it today), then a save token the
+// host put on the root, then the platform's isAdminOfCurrentResource cookie. The
+// global is for standalone uses (demos, htmlclay, any self-saving file) that are
+// always editable and have no owner cookie; setting it before clayjs loads turns
+// on the edit-only modules.
+//
+// The token sits above the cookie because it is the stronger claim and often the
+// only one visible: the host minted it for this response and nothing else, while
+// the cookie is ambient. A sandboxed document cannot read the cookie at all, so
+// without this rung a host that sandboxes its own documents can hand one a save
+// token and still watch it render read-only.
 let forcedEditMode = null;
 if (typeof window !== "undefined") {
   if (window.clayEditMode != null) {
@@ -17,10 +25,10 @@ if (typeof window !== "undefined") {
 }
 
 const isEditMode = query.editmode
-  ? query.editmode === "true" // takes precedence over the global and cookie
+  ? query.editmode === "true" // takes precedence over the global, token and cookie
   : forcedEditMode != null
     ? forcedEditMode
-    : Boolean(cookie.get("isAdminOfCurrentResource"));
+    : hasSaveToken() || Boolean(cookie.get("isAdminOfCurrentResource"));
 
 const isOwner = Boolean(cookie.get("isAdminOfCurrentResource"));
 

package/src/core/persist.js

@@ -10,7 +10,10 @@ import { serializeControlToAttributes, finalizeControlForSave } from '../vendor/
 //
 // The per-control rules (which attribute represents which control's state) live
 // in control-serialize.vendor.js — the single source of truth shared verbatim
-// with sapjs (carrier mirror) so the two implementations never drift. This
+// with sapjs (carrier mirror) so the two implementations never drift. sapjs
+// `npm run propagate` writes this copy and hyperclayjs's from one destination
+// table, and `--check` fails on either being stale, so the invariant is
+// enforced rather than remembered. This
 // module owns only the triggers (which elements, on which events) and the
 // snapshot safety net; serializeControlToAttributes / finalizeControlForSave do
 // the actual attribute writes.
@@ -86,7 +89,14 @@ export default function enablePersistentFormInputValues(filterBySelector = "[per
     const finalize = (selector) => {
       const live = document.querySelectorAll(selector);
       const cloned = doc.querySelectorAll(selector);
-      cloned.forEach((c, i) => { if (live[i]) finalizeControlForSave(c, live[i]); });
+      // Index pairing only holds while the two lists describe the same tree. If a
+      // hook ever diverges them, writing one control's value into another's is
+      // worse than writing none, so fail loudly instead of silently.
+      if (live.length !== cloned.length) {
+        console.warn('[persist] live/clone counts differ for', selector, '— skipping');
+        return;
+      }
+      cloned.forEach((c, i) => finalizeControlForSave(c, live[i]));
     };
     finalize(inputSelector);
     finalize(textareaSelector);