npm - @pylonsync/functions - Versions diffs - 0.5.7 → 0.6.0 - Mend

@pylonsync/functions 0.5.7 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/dist/ssr-runtime.d.ts CHANGED Viewed

@@ -368,7 +368,7 @@ isBoundary?: boolean): SsrMetadata | undefined;
  * and corrupt on an unrelated CSS change. A streaming decoder holds the
  * partial sequence back until the bytes that complete it arrive.
  */
-export declare function streamWithHeadInjection(reader: ReadableStreamDefaultReader<Uint8Array>, headBlob: string, sendChunk: (text: string) => void): Promise<void>;
+export declare function streamWithHeadInjection(reader: ReadableStreamDefaultReader<Uint8Array>, headBlob: string, sendChunk: (text: string) => void, bodyBlob?: string): Promise<void>;
 /**
  * Dev-only tail chunk: the `__PYLON_DEV__` info blob (cache verdict, render
  * mode/timing, route) + the HUD bootstrap. Embedded after the page tail so the
@@ -384,6 +384,21 @@ export declare function streamWithHeadInjection(reader: ReadableStreamDefaultRea
  */
 export declare function escapeScriptJson(json: string): string;
 export declare function buildDevHudChunk(devInfo: Record<string, unknown>): string;
+/**
+ * The free-tier attribution badge, injected before `</body>` when the control
+ * plane sets `PYLON_CLOUD_BADGE` (it does so only for hobby-plan projects, and
+ * the key is protected so an app cannot unset it for itself).
+ *
+ * Deliberately plain: one anchor, inline styles, no script, no webfont, no
+ * network request. It renders inside somebody else's app, so it must not fight
+ * their layout or cost their visitors a round trip. Everything it could
+ * inherit from the host page — font, line-height, box-sizing, text-transform —
+ * is stated rather than left to chance.
+ *
+ * Returns "" when the flag is unset: every paid project, and every self-hosted
+ * install.
+ */
+export declare function buildCloudBadgeChunk(env?: Record<string, string | undefined>): string;
 export declare function cssHeadTag(css: string, prefix: string, routeOverride?: boolean): Promise<string>;
 /**
  * Build the hydration tail appended after React's stream EOFs: the

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@pylonsync/functions",
-  "version": "0.5.7",
+  "version": "0.6.0",
   "description": "TypeScript function runtime for pylon — defines server-side queries, mutations, and actions.",
   "type": "module",
   "main": "src/index.ts",

package/src/ssr-runtime.ts CHANGED Viewed

@@ -1401,11 +1401,43 @@ export async function streamWithHeadInjection(
   reader: ReadableStreamDefaultReader<Uint8Array>,
   headBlob: string,
   sendChunk: (text: string) => void,
+  bodyBlob = "",
 ): Promise<void> {
-  let headInjected = headBlob.length === 0;
+  // Injections in document order, each consumed the first time its marker is
+  // seen. Once the list empties the reader is a straight pass-through, which
+  // is every chunk after the <head> on a normal page.
+  const pending: Array<{ marker: string; blob: string }> = [];
+  if (headBlob.length > 0) pending.push({ marker: "</head>", blob: headBlob });
+  if (bodyBlob.length > 0) pending.push({ marker: "</body>", blob: bodyBlob });
   let carry = "";
-  const HEAD_CLOSE = "</head>";
   const decoder = new TextDecoder("utf-8");
+  const feed = (text: string): void => {
+    let buf = carry + text;
+    carry = "";
+    while (pending.length > 0) {
+      const next = pending[0];
+      const idx = buf.indexOf(next.marker);
+      if (idx < 0) break;
+      sendChunk(buf.slice(0, idx));
+      sendChunk(next.blob);
+      sendChunk(next.marker);
+      buf = buf.slice(idx + next.marker.length);
+      pending.shift();
+    }
+    if (pending.length === 0) {
+      if (buf) sendChunk(buf);
+      return;
+    }
+    // Withhold len(marker) − 1 so a marker straddling a chunk boundary is
+    // still matched once the next read arrives.
+    const keep = pending[0].marker.length - 1;
+    if (buf.length > keep) {
+      sendChunk(buf.slice(0, buf.length - keep));
+      carry = buf.slice(buf.length - keep);
+    } else {
+      carry = buf;
+    }
+  };
   for (;;) {
     const { value, done } = await reader.read();
     if (done) break;
@@ -1414,41 +1446,16 @@ export async function streamWithHeadInjection(
     // A chunk that ended mid-character decodes to "" — the bytes are held
     // in the decoder until the rest arrives. Nothing to emit yet.
     if (!text) continue;
-    if (!headInjected) {
-      const combined = carry + text;
-      const idx = combined.indexOf(HEAD_CLOSE);
-      if (idx >= 0) {
-        sendChunk(combined.slice(0, idx));
-        sendChunk(headBlob);
-        sendChunk(HEAD_CLOSE);
-        const after = combined.slice(idx + HEAD_CLOSE.length);
-        if (after) sendChunk(after);
-        headInjected = true;
-        carry = "";
-      } else {
-        const keep = HEAD_CLOSE.length - 1;
-        if (combined.length > keep) {
-          sendChunk(combined.slice(0, combined.length - keep));
-          carry = combined.slice(combined.length - keep);
-        } else {
-          carry = combined;
-        }
-      }
-    } else {
-      sendChunk(text);
-    }
+    feed(text);
   }
   // Flush the decoder. A stream that ends mid-character is genuinely
   // truncated input, and this is where it becomes a replacement character
   // rather than silently vanishing.
   const tail = decoder.decode();
-  if (tail) {
-    if (!headInjected) {
-      carry += tail;
-    } else {
-      sendChunk(tail);
-    }
-  }
+  if (tail) feed(tail);
+  // A document with no `</body>` (fragment renders, truncated streams) leaves
+  // its injection unconsumed. Emit the held-back bytes as-is rather than
+  // forcing a badge into markup with nowhere to put it.
   if (carry) sendChunk(carry);
 }
@@ -1831,6 +1838,58 @@ export function buildDevHudChunk(devInfo: Record<string, unknown>): string {
   );
 }
+/**
+ * The free-tier attribution badge, injected before `</body>` when the control
+ * plane sets `PYLON_CLOUD_BADGE` (it does so only for hobby-plan projects, and
+ * the key is protected so an app cannot unset it for itself).
+ *
+ * Deliberately plain: one anchor, inline styles, no script, no webfont, no
+ * network request. It renders inside somebody else's app, so it must not fight
+ * their layout or cost their visitors a round trip. Everything it could
+ * inherit from the host page — font, line-height, box-sizing, text-transform —
+ * is stated rather than left to chance.
+ *
+ * Returns "" when the flag is unset: every paid project, and every self-hosted
+ * install.
+ */
+export function buildCloudBadgeChunk(
+  env: Record<string, string | undefined> = process.env,
+): string {
+  const flag = env.PYLON_CLOUD_BADGE?.trim().toLowerCase();
+  if (!flag || flag === "0" || flag === "false" || flag === "no") return "";
+  const href =
+    "https://stack0.dev/?utm_source=stack0_badge&utm_medium=app&utm_campaign=hobby";
+  const style = [
+    "position:fixed",
+    "right:12px",
+    "bottom:12px",
+    "z-index:2147483000",
+    "display:inline-flex",
+    "align-items:center",
+    "gap:6px",
+    "box-sizing:border-box",
+    "margin:0",
+    "padding:6px 10px",
+    "border-radius:8px",
+    "border:1px solid rgba(247,245,239,.14)",
+    "background:#1a1814",
+    "color:#f7f5ef",
+    "font:500 12px/1 ui-sans-serif,system-ui,-apple-system,'Segoe UI',sans-serif",
+    "letter-spacing:0",
+    "text-transform:none",
+    "text-decoration:none",
+    "white-space:nowrap",
+    "opacity:.92",
+  ].join(";");
+  const dot =
+    "width:6px;height:6px;border-radius:50%;background:#3b5bdb;flex:none";
+  return (
+    `<a href="${href}" target="_blank" rel="noopener noreferrer"` +
+    ` aria-label="Built on Stack0" data-pylon-badge style="${style}">` +
+    `<span style="${dot}"></span>Built on Stack0</a>`
+  );
+}
 /**
  * Build the <head> blob for a boundary render: the union of every route's
  * stylesheet links from the client build manifest. Boundary modules aren't
@@ -2222,7 +2281,12 @@ async function renderBoundaryToClient(
       data: Buffer.from(text, "utf8").toString("base64"),
     });
   };
-  await streamWithHeadInjection(stream.getReader(), headBlob, sendChunk);
+  await streamWithHeadInjection(
+    stream.getReader(),
+    headBlob,
+    sendChunk,
+    buildCloudBadgeChunk(),
+  );
   if (tail && manifestRoute) {
     const tailHtml = buildHydrationTail({
       component: tail.component,
@@ -3617,7 +3681,15 @@ export async function handleRenderRoute(
           "</head><body>",
       );
     } else {
-      await streamWithHeadInjection(stream.getReader(), headBlob, sendChunk);
+      // navRender is skipped deliberately: it ships a data-only shell whose
+      // markup the client throws away, so a badge there would never be seen
+      // and would ride in every client-side navigation payload.
+      await streamWithHeadInjection(
+        stream.getReader(),
+        headBlob,
+        sendChunk,
+        buildCloudBadgeChunk(),
+      );
     }
     // #278: detect a late response.* mutation from a suspended subtree that the

package/src/ssr-utf8.test.ts CHANGED Viewed

@@ -14,7 +14,10 @@
  * server-only text corrupts with no warning at all.
  */
 import { describe, expect, test } from "bun:test";
-import { streamWithHeadInjection } from "./ssr-runtime";
+import {
+  buildCloudBadgeChunk,
+  streamWithHeadInjection,
+} from "./ssr-runtime";
 /** A reader over pre-split byte chunks — the shape React hands us. */
 function readerOf(chunks: Uint8Array[]): ReadableStreamDefaultReader<Uint8Array> {
@@ -32,9 +35,18 @@ function splitAt(text: string, at: number): Uint8Array[] {
   return [bytes.slice(0, at), bytes.slice(at)];
 }
-async function collect(chunks: Uint8Array[], headBlob = ""): Promise<string> {
+async function collect(
+  chunks: Uint8Array[],
+  headBlob = "",
+  bodyBlob = "",
+): Promise<string> {
   const out: string[] = [];
-  await streamWithHeadInjection(readerOf(chunks), headBlob, (t) => out.push(t));
+  await streamWithHeadInjection(
+    readerOf(chunks),
+    headBlob,
+    (t) => out.push(t),
+    bodyBlob,
+  );
   return out.join("");
 }
@@ -108,3 +120,80 @@ describe("streamWithHeadInjection — UTF-8 across chunk boundaries", () => {
     }
   });
 });
+describe("streamWithHeadInjection — body injection", () => {
+  const doc = "<html><head><title>t</title></head><body><p>hi</p></body></html>";
+  const withBadge =
+    "<html><head><title>t</title></head><body><p>hi</p><i>B</i></body></html>";
+  test("the blob lands immediately before </body>", async () => {
+    const bytes = new TextEncoder().encode(doc);
+    expect(await collect([bytes], "", "<i>B</i>")).toBe(withBadge);
+  });
+  test("head and body blobs both land, in document order", async () => {
+    const bytes = new TextEncoder().encode(doc);
+    expect(await collect([bytes], "<meta>", "<i>B</i>")).toBe(
+      "<html><head><title>t</title><meta></head><body><p>hi</p><i>B</i></body></html>",
+    );
+  });
+  test("</body> split across every chunk boundary still matches", async () => {
+    // The carry buffer is the point: React splits wherever it likes, so a
+    // marker cut in half must not be missed (dropping the badge) or matched
+    // twice (duplicating it).
+    const bytes = new TextEncoder().encode(doc);
+    for (let at = 1; at < bytes.length; at++) {
+      const out = await collect(
+        [bytes.slice(0, at), bytes.slice(at)],
+        "",
+        "<i>B</i>",
+      );
+      expect(out).toBe(withBadge);
+    }
+  });
+  test("a document with no </body> passes through untouched", async () => {
+    // Fragment renders have no body close. Emitting the blob anyway would put
+    // a floating badge into markup meant to be embedded.
+    const frag = "<p>fragment</p>";
+    expect(await collect([new TextEncoder().encode(frag)], "", "<i>B</i>")).toBe(
+      frag,
+    );
+  });
+  test("an empty body blob leaves the stream byte-identical", async () => {
+    expect(await collect([new TextEncoder().encode(doc)])).toBe(doc);
+  });
+  test("only the first </body> is injected into", async () => {
+    const nested = "<body>a</body><body>b</body>";
+    expect(await collect([new TextEncoder().encode(nested)], "", "X")).toBe(
+      "<body>aX</body><body>b</body>",
+    );
+  });
+});
+describe("buildCloudBadgeChunk", () => {
+  test("returns nothing unless the control plane sets the flag", () => {
+    // Every paid project and every self-hosted install lands here.
+    expect(buildCloudBadgeChunk({})).toBe("");
+    expect(buildCloudBadgeChunk({ PYLON_CLOUD_BADGE: "" })).toBe("");
+    expect(buildCloudBadgeChunk({ PYLON_CLOUD_BADGE: "0" })).toBe("");
+    expect(buildCloudBadgeChunk({ PYLON_CLOUD_BADGE: "false" })).toBe("");
+    expect(buildCloudBadgeChunk({ PYLON_CLOUD_BADGE: "no" })).toBe("");
+  });
+  test("renders one self-contained anchor when enabled", () => {
+    const html = buildCloudBadgeChunk({ PYLON_CLOUD_BADGE: "1" });
+    expect(html).toContain("stack0.dev");
+    expect(html).toContain('aria-label="Built on Stack0"');
+    expect(html).toContain('rel="noopener noreferrer"');
+    // It renders inside someone else's app: no script, and nothing that costs
+    // their visitors a network round trip.
+    expect(html).not.toContain("<script");
+    expect(html).not.toContain("<link");
+    expect(html).not.toContain("@import");
+    expect(html.match(/<a /g)?.length).toBe(1);
+  });
+});