npm - @rivetjs/router - Versions diffs - 0.0.0-stage → 0.1.0-alpha.0 - Mend

@rivetjs/router 0.0.0-stage → 0.1.0-alpha.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (143) hide show

package/LICENSE +21 -0
package/README.md +10 -2
package/adapters/assemble.d.ts +32 -0
package/adapters/assemble.js +32 -0
package/adapters/build.d.ts +24 -0
package/adapters/build.js +43 -0
package/adapters/bun.d.ts +18 -0
package/adapters/bun.js +44 -0
package/adapters/cloudflare.d.ts +5 -0
package/adapters/cloudflare.js +8 -0
package/adapters/cluster.d.ts +7 -0
package/adapters/cluster.js +130 -0
package/adapters/csr.d.ts +12 -0
package/adapters/csr.js +11 -0
package/adapters/deno.d.ts +13 -0
package/adapters/deno.js +35 -0
package/adapters/fetch.d.ts +55 -0
package/adapters/fetch.js +72 -0
package/adapters/files.d.ts +7 -0
package/adapters/files.js +103 -0
package/adapters/idle-memory.d.ts +23 -0
package/adapters/idle-memory.js +91 -0
package/adapters/netlify.d.ts +13 -0
package/adapters/netlify.js +15 -0
package/adapters/node.d.ts +163 -0
package/adapters/node.js +940 -0
package/adapters/pack.d.ts +39 -0
package/adapters/pack.js +360 -0
package/adapters/server-target.d.ts +17 -0
package/adapters/server-target.js +8 -0
package/adapters/static.d.ts +84 -0
package/adapters/static.js +231 -0
package/adapters/target-build.d.ts +92 -0
package/adapters/target-build.js +118 -0
package/adapters/vercel-edge.d.ts +7 -0
package/adapters/vercel-edge.js +9 -0
package/adapters/vercel.d.ts +33 -0
package/adapters/vercel.js +45 -0
package/build/codegen.d.ts +84 -0
package/build/codegen.js +920 -0
package/build/dev-errors.d.ts +19 -0
package/build/dev-errors.js +236 -0
package/build/migrate.d.ts +15 -0
package/build/migrate.js +146 -0
package/build/route-css.d.ts +54 -0
package/build/route-css.js +216 -0
package/build/routes.d.ts +50 -0
package/build/routes.js +202 -0
package/build/sync.d.ts +20 -0
package/build/sync.js +16 -0
package/build/vite.d.ts +195 -0
package/build/vite.js +703 -0
package/cli/rivet.d.ts +2 -0
package/cli/rivet.js +100 -0
package/client/active.d.ts +6 -0
package/client/active.js +22 -0
package/client/announce.d.ts +2 -0
package/client/announce.js +21 -0
package/client/dev.d.ts +41 -0
package/client/dev.js +74 -0
package/client/index.d.ts +152 -0
package/client/index.js +680 -0
package/client/layouts.d.ts +110 -0
package/client/layouts.js +310 -0
package/client/leave.d.ts +40 -0
package/client/leave.js +75 -0
package/client/link.d.ts +48 -0
package/client/link.jsx +65 -0
package/client/live.d.ts +57 -0
package/client/live.js +170 -0
package/client/navigate.d.ts +71 -0
package/client/navigate.js +120 -0
package/client/navigation.d.ts +28 -0
package/client/navigation.js +14 -0
package/client/params.d.ts +16 -0
package/client/params.js +28 -0
package/client/route-context.d.ts +32 -0
package/client/route-context.js +21 -0
package/client/scroll.d.ts +16 -0
package/client/scroll.js +80 -0
package/client/search.d.ts +8 -0
package/client/search.js +17 -0
package/client/tailwind.css +8 -0
package/client/transition-helpers.d.ts +28 -0
package/client/transition-helpers.js +63 -0
package/client/transitions.css +90 -0
package/client/transitions.d.ts +21 -0
package/client/transitions.js +156 -0
package/index.d.ts +138 -0
package/index.js +7 -0
package/package.json +156 -4
package/server/app.d.ts +169 -0
package/server/app.js +302 -0
package/server/body.d.ts +20 -0
package/server/body.js +8 -0
package/server/early-hints.d.ts +34 -0
package/server/early-hints.js +63 -0
package/server/handler.d.ts +196 -0
package/server/handler.js +623 -0
package/server/index.d.ts +9 -0
package/server/index.js +6 -0
package/server/inline-styles.d.ts +21 -0
package/server/inline-styles.js +28 -0
package/server/module.d.ts +14 -0
package/server/module.js +78 -0
package/server/render.d.ts +94 -0
package/server/render.js +489 -0
package/server/route-cache.d.ts +175 -0
package/server/route-cache.js +742 -0
package/server/security.d.ts +18 -0
package/server/security.js +47 -0
package/server/strict-csp.d.ts +7 -0
package/server/strict-csp.js +18 -0
package/server-only.d.ts +1 -0
package/server-only.js +3 -0
package/shared/actions.d.ts +10 -0
package/shared/actions.js +18 -0
package/shared/base.d.ts +8 -0
package/shared/base.js +20 -0
package/shared/cookie.d.ts +7 -0
package/shared/cookie.js +32 -0
package/shared/csp-directives.d.ts +9 -0
package/shared/csp-directives.js +85 -0
package/shared/csp-hash.d.ts +39 -0
package/shared/csp-hash.js +121 -0
package/shared/csp.d.ts +26 -0
package/shared/csp.js +13 -0
package/shared/data.d.ts +175 -0
package/shared/data.js +22 -0
package/shared/errors.d.ts +31 -0
package/shared/errors.js +51 -0
package/shared/head.d.ts +57 -0
package/shared/head.js +242 -0
package/shared/nonce.d.ts +2 -0
package/shared/nonce.js +23 -0
package/shared/prefetch-fallback.min.d.ts +1 -0
package/shared/prefetch-fallback.min.js +2 -0
package/shared/prefetch.d.ts +54 -0
package/shared/prefetch.js +74 -0
package/shared/redirect.d.ts +6 -0
package/shared/redirect.js +25 -0
package/shared/slash.d.ts +8 -0
package/shared/slash.js +24 -0

package/shared/data.d.ts ADDED Viewed

@@ -0,0 +1,175 @@
+/** Query flag marking a client-navigation data request. */
+export declare const DATA_PARAM = "_rivet";
+/** Data requests: comma-separated ids of the layouts whose data the client still has (loaders skipped). */
+export declare const KEEP_PARAM = "_rivet_keep";
+/** `_rivet_keep` entry naming the page's own loader (`invalidate(key)` of layout keys only: same URL). */
+export declare const KEEP_PAGE = ".";
+/**
+ * `search` (`?a&b=c d`) without the router's own params (`_rivet`, `_rivet_keep`), every other byte
+ * as sent: loaders see the page URL's query exactly, so their keys match on HTML and data requests.
+ */
+export declare function withoutRivet(search: string): string;
+/** Dependency keys (`event.depends()`) per loader, route data order; undefined: none. Omitted when no loader called it. */
+export type LoaderDeps = readonly (readonly string[] | undefined)[];
+/**
+ * Document head a route (or a component, with `@rivetjs/kit`) contributes. Merged by rank: inner
+ * route levels win; within a level components win over the route's `head` export.
+ */
+export interface Head {
+    title?: string;
+    /** `"%s · Shop"`: applied once to the merged title; innermost wins. */
+    titleTemplate?: string;
+    /** `<html>` attributes (needs the kit head hold; merged per attribute). */
+    html?: {
+        lang?: string;
+        dir?: "ltr" | "rtl" | "auto";
+        class?: string;
+    };
+    body?: {
+        class?: string;
+    };
+    base?: {
+        href: string;
+        target?: string;
+    };
+    meta?: readonly HeadMeta[];
+    /** `<link>` tags; keyed per rel (one `canonical`; alternates by hreflang/type; others by href). */
+    links?: readonly HeadLink[];
+    scripts?: readonly HeadScript[];
+    /** Inline `<style>` blocks (trusted CSS, request nonce; deduped by `key`, else by text). Never managed: client navigation keeps them. */
+    styles?: readonly HeadStyle[];
+}
+/** An inline head `<style>` (component CSS such as `@rivetjs/motion` entrance rules). */
+export interface HeadStyle {
+    /** Trusted CSS text (a `</style` sequence is escaped). */
+    css: string;
+    /** Dedupe key (default: the CSS text). */
+    key?: string;
+    media?: string;
+}
+/** A head `<meta>`. */
+export interface HeadMeta {
+    name?: string;
+    property?: string;
+    httpEquiv?: string;
+    itemprop?: string;
+    content: string;
+    /** e.g. `theme-color` per color scheme; part of the dedupe key. */
+    media?: string;
+    /** Explicit dedupe key. */
+    key?: string;
+}
+/** A head `<link>`. */
+export interface HeadLink {
+    rel: string;
+    href: string;
+    type?: string;
+    hreflang?: string;
+    media?: string;
+    sizes?: string;
+    as?: string;
+    crossorigin?: "anonymous" | "use-credentials";
+    imagesrcset?: string;
+    imagesizes?: string;
+    fetchpriority?: "high" | "low" | "auto";
+    title?: string;
+    color?: string;
+    integrity?: string;
+    referrerpolicy?: string;
+    key?: string;
+}
+/** When a script runs: in the head while parsing (`blocking`, `eager` = async, `defer`) or later from a tiny bootstrap. */
+export type ScriptStrategy = "blocking" | "eager" | "defer" | "load" | "idle" | "interaction";
+/** Static inline script code (see `inlineScript`); plain strings are refused. */
+export interface InlineScript {
+    readonly code: string;
+}
+/** A head script: external (`src`), inline code, or a JSON-LD data block. */
+export type HeadScript = {
+    src: string;
+    type?: "module" | "classic";
+    /** Default `defer`. */
+    strategy?: ScriptStrategy;
+    id?: string;
+    integrity?: string;
+    crossorigin?: "anonymous" | "use-credentials";
+    referrerpolicy?: string;
+    key?: string;
+} | {
+    inline: InlineScript;
+    /** Position in the head (inline scripts always run while parsing). Default `defer`. */
+    strategy?: "blocking" | "eager" | "defer";
+    /** JSON the script reads from `document.currentScript.previousElementSibling`. */
+    data?: unknown;
+    id?: string;
+    key?: string;
+} | {
+    jsonLd: object;
+    id?: string;
+    key?: string;
+};
+/** Request collector of component head entries (`@rivetjs/kit`), provided through `ServerData`. */
+export interface HeadSink {
+    /** Record `head` for route level `level`; after the hold, returns the markup body-valid entries write in place. */
+    push(level: number, head: Head, component?: string): string | undefined;
+    /** CSP nonce of the response (inline scripts carry it). */
+    readonly nonce: string | undefined;
+}
+/** An action's outcome (form POST `?/name`): its return value, or the data and status of `fail()`. */
+export interface ActionResult {
+    readonly name: string;
+    readonly result: unknown;
+    /** Set when the action failed (`fail(status, data)`): the response status; `result` is the data. */
+    readonly status?: number;
+}
+/** The `error` member of a JSON answer: a request that failed (guard, action, loader, 404/405/413…). */
+export interface AnswerError {
+    readonly status: number;
+    readonly message: string;
+}
+/**
+ * The handler's JSON answer to an enhanced action POST (`?/name` with `accept: application/json`),
+ * resume-format encoded (`encodeData`); `@rivetjs/forms` decodes it. Exactly one of `action`,
+ * `redirect` or `error` is set.
+ */
+export interface ActionAnswer {
+    /** The action ran: its return value, or the data and status of `fail()`. */
+    readonly action?: ActionResult;
+    /** Single flight (`x-rivet-revalidate` request header, status < 400): the page's re-run loader data, layouts outermost first. */
+    readonly data?: readonly unknown[];
+    /** Single flight: the route head for the fresh data (when the app has a `head` hook). */
+    readonly head?: Head;
+    /** Single flight: the loaders' `event.depends()` keys (absent when none called it). */
+    readonly deps?: LoaderDeps;
+    /** A redirect (guard, `redirect()` in the action, a request handler's 3xx) the client follows; `status` is its 3xx. */
+    readonly redirect?: string;
+    readonly status?: number;
+    readonly error?: AnswerError;
+}
+/** The handler's JSON answer to a client-navigation data request (`?_rivet=data`), resume-format encoded. */
+export interface DataAnswer {
+    /** Loader results, layouts outermost first (`undefined` for the `keep` indices). */
+    readonly data?: readonly unknown[];
+    readonly status?: number;
+    readonly head?: Head;
+    /** Indices into `data` of kept layouts the server skipped (`_rivet_keep`). */
+    readonly keep?: readonly number[];
+    /** Indices of layouts whose loader read the URL. */
+    readonly byURL?: readonly number[];
+    readonly deps?: LoaderDeps;
+    readonly redirect?: string;
+    /** A guard or request handler answered with a non-redirect Response: load the document instead. */
+    readonly reload?: true;
+    readonly error?: AnswerError;
+}
+/** Loader results for one URL: layouts outermost first, then the page. */
+export interface RoutePayload {
+    readonly data: readonly unknown[];
+    readonly head?: Head;
+    /** Data requests: indices into `data` of layouts the server skipped (the client keeps their data). */
+    readonly kept?: readonly number[];
+    /** Data requests: indices of layouts whose loader read the URL (reloaded on every URL change). */
+    readonly byURL?: readonly number[];
+    /** Keys the loaders that ran passed to `event.depends()` (absent: none did). */
+    readonly deps?: LoaderDeps;
+}

package/shared/data.js ADDED Viewed

@@ -0,0 +1,22 @@
+// Wire contract between the server handler and the client router.
+/** Query flag marking a client-navigation data request. */
+export const DATA_PARAM = "_rivet";
+/** Data requests: comma-separated ids of the layouts whose data the client still has (loaders skipped). */
+export const KEEP_PARAM = "_rivet_keep";
+/** `_rivet_keep` entry naming the page's own loader (`invalidate(key)` of layout keys only: same URL). */
+export const KEEP_PAGE = ".";
+/**
+ * `search` (`?a&b=c d`) without the router's own params (`_rivet`, `_rivet_keep`), every other byte
+ * as sent: loaders see the page URL's query exactly, so their keys match on HTML and data requests.
+ */
+export function withoutRivet(search) {
+    if (!search.includes(DATA_PARAM))
+        return search;
+    let out = "";
+    for (const part of search.slice(1).split("&")) {
+        const name = part.split("=", 1)[0];
+        if (name !== DATA_PARAM && name !== KEEP_PARAM)
+            out += (out ? "&" : "?") + part;
+    }
+    return out;
+}

package/shared/errors.d.ts ADDED Viewed

@@ -0,0 +1,31 @@
+/** A redirect, denial or HTTP failure ending the guard/loader chain. */
+export declare class HttpError extends Error {
+    readonly status: number;
+    /** Redirect target for 3xx. */
+    readonly location: string | undefined;
+    /** Safe to show to users (4xx messages); 5xx details stay server-side. */
+    readonly expose: boolean;
+    constructor(status: number, message: string, location?: string);
+}
+/** Options of `redirect()`. */
+export interface RedirectOptions {
+    status?: 301 | 302 | 303 | 307 | 308;
+    /** Allow an absolute `http(s):` URL on another origin (payment providers, SSO). */
+    external?: boolean;
+}
+type RedirectStatus = NonNullable<RedirectOptions["status"]>;
+/**
+ * Redirect (default 302 Found, 303 See Other from actions; 307/308 keep the method). Same-origin
+ * only: relative targets, or absolute URLs on the request's origin; `{ external: true }` allows
+ * other origins. Protocol-relative (`//x`), backslash and control-character targets throw.
+ */
+export declare function redirect(location: string, status?: RedirectStatus | RedirectOptions, options?: RedirectOptions): HttpError;
+/** Refuse access (default 403). */
+export declare function deny(status?: 401 | 403, message?: string): HttpError;
+/** The resource does not exist; renders the nearest `_404`. */
+export declare function notFound(message?: string): HttpError;
+/** Fail with an explicit status; renders the nearest `_error`. */
+export declare function error(status: number, message: string): HttpError;
+/** Whether a value is an `HttpError` thrown by `error()` / `notFound()`. */
+export declare const isHttpError: (value: unknown) => value is HttpError;
+export {};

package/shared/errors.js ADDED Viewed

@@ -0,0 +1,51 @@
+// Control-flow results for guards, loaders and actions: thrown or returned, never rendered as data.
+import { unsafeTarget } from "./redirect.js";
+/** A redirect, denial or HTTP failure ending the guard/loader chain. */
+export class HttpError extends Error {
+    constructor(status, message, location) {
+        super(message);
+        this.name = "HttpError";
+        this.status = status;
+        this.location = location;
+        this.expose = status < 500;
+    }
+}
+/**
+ * Redirect (default 302 Found, 303 See Other from actions; 307/308 keep the method). Same-origin
+ * only: relative targets, or absolute URLs on the request's origin; `{ external: true }` allows
+ * other origins. Protocol-relative (`//x`), backslash and control-character targets throw.
+ */
+export function redirect(location, status, options) {
+    const opts = typeof status === "object" ? status : options;
+    const code = typeof status === "number" ? status : opts?.status;
+    const external = opts?.external === true;
+    const unsafe = unsafeTarget(location);
+    if (unsafe)
+        throw new Error(`redirect(): unsafe target ${JSON.stringify(location)} (${unsafe})`);
+    if (external && !/^https?:\/\//i.test(location))
+        throw new Error(`redirect(): external target must be an absolute http(s) URL, got ${JSON.stringify(location)}`);
+    const error = new HttpError(code ?? 302, "Redirect", location);
+    // Actions answer a defaulted redirect with 303 (POST → GET); an explicit status is kept.
+    if (code === undefined)
+        Object.defineProperty(error, "defaultStatus", { value: true });
+    // The handler checks absolute targets against the request origin unless external.
+    if (external)
+        Object.defineProperty(error, "external", { value: true });
+    return error;
+}
+/** Refuse access (default 403). */
+export function deny(status = 403, message = status === 401 ? "Unauthorized" : "Forbidden") {
+    return new HttpError(status, message);
+}
+/** The resource does not exist; renders the nearest `_404`. */
+export function notFound(message = "Not found") {
+    return new HttpError(404, message);
+}
+/** Fail with an explicit status; renders the nearest `_error`. */
+export function error(status, message) {
+    if (!Number.isInteger(status) || status < 400 || status > 599)
+        throw new RangeError("error() status must be 4xx or 5xx");
+    return new HttpError(status, message);
+}
+/** Whether a value is an `HttpError` thrown by `error()` / `notFound()`. */
+export const isHttpError = (value) => value instanceof HttpError;

package/shared/head.d.ts ADDED Viewed

@@ -0,0 +1,57 @@
+import type { Head, HeadLink, HeadMeta, HeadScript, InlineScript } from "./data.js";
+/** One head contribution: `level` −1 document defaults, layouts 0…n−1, page n; `phase` 0 route export, 1 components. */
+export interface RankedHead {
+    readonly level: number;
+    readonly phase: 0 | 1;
+    readonly seq: number;
+    readonly head: Head;
+}
+/** Brand static inline script code (kit `?script` imports, `unsafeInlineScript`). */
+export declare function inlineScript(code: string): InlineScript;
+export declare const isInlineScript: (value: unknown) => value is InlineScript;
+export declare function metaKey(meta: HeadMeta): string;
+export declare function linkKey(link: HeadLink): string;
+export declare function scriptKey(script: HeadScript): string;
+/**
+ * Merge contributions by rank `(level, phase, seq)`, later winning per key. The title template
+ * applies once to the winning title (the output's `title` is final; `titleTemplate` is kept).
+ */
+export declare function rankMerge(entries: readonly RankedHead[]): Head | undefined;
+export interface HeadTagOptions {
+    /** Stylesheet URLs, linked before the head's own stylesheets (capo position 7). */
+    styles?: readonly string[];
+    /** Entries of `styles` written as an inline `<style>` (URL → CSS, with the nonce) instead of a link, in place. */
+    inlineStyles?: Readonly<Record<string, string>> | undefined;
+    /** CSP nonce for inline and external scripts. */
+    nonce?: string | undefined;
+    /**
+     * Mark managed tags `data-rh` (kit updates them on client navigation); entries in `persistent`
+     * (root layout components, never re-rendered in the browser) get `data-rh="0"` and are kept.
+     */
+    managed?: boolean | HeadManaged | undefined;
+}
+export interface HeadManaged {
+    readonly persistent: ReadonlySet<object>;
+}
+export declare function linkTag(link: HeadLink, mark?: string): string;
+export declare function metaTag(meta: HeadMeta, mark?: string): string;
+export declare const jsonLdTag: (data: object, id?: string, mark?: string) => string;
+export declare const BOOT_LIST_END = ",d=document,";
+/**
+ * Bootstrap for `load` / `idle` / `interaction` scripts: `list` (escaped JSON array) inlined, code
+ * for only the strategies the page uses. Injected scripts are async by default.
+ */
+export declare function _scriptBootstrap(strategies: Iterable<string>, list?: string): string;
+/**
+ * Tags for a merged head in capo.js order: base, title, preconnect, async scripts, blocking scripts,
+ * stylesheets (`styles` first), preloads, deferred scripts (+ bootstrap), prefetch, meta / SEO links,
+ * JSON-LD. Charset, viewport and the CSP meta belong to the shell.
+ */
+export declare function headTags(head: Head | undefined, options?: HeadTagOptions): string;
+/** `<html>` attributes (leading space) for shells: the head's `html` over request defaults (i18n `locale`/`dir`). */
+export declare function htmlAttributes(head: Head | undefined, defaults?: {
+    lang?: string | undefined;
+    dir?: string | undefined;
+}): string;
+/** `<body>` attributes (leading space). */
+export declare const bodyAttributes: (head: Head | undefined) => string;

package/shared/head.js ADDED Viewed

@@ -0,0 +1,242 @@
+// Head merging (rank + dedupe keys) and serialization (capo.js order), shared by server and kit.
+import { escapeJSON } from "@rivetjs/runtime/resume-format";
+import { escapeAttribute, escapeText } from "@rivetjs/runtime/escape";
+const inline = new WeakSet();
+/** Brand static inline script code (kit `?script` imports, `unsafeInlineScript`). */
+export function inlineScript(code) {
+    const script = Object.freeze({ code });
+    inline.add(script);
+    return script;
+}
+export const isInlineScript = (value) => typeof value === "object" && value !== null && inline.has(value);
+export function metaKey(meta) {
+    if (meta.key !== undefined)
+        return "k:" + meta.key;
+    const base = meta.name !== undefined
+        ? "n:" + meta.name
+        : meta.property !== undefined
+            ? "p:" + meta.property
+            : meta.httpEquiv !== undefined
+                ? "h:" + meta.httpEquiv.toLowerCase()
+                : "i:" + meta.itemprop;
+    return meta.media !== undefined ? base + "|" + meta.media : base;
+}
+export function linkKey(link) {
+    if (link.key !== undefined)
+        return "k:" + link.key;
+    const rel = link.rel.toLowerCase();
+    if (rel === "canonical")
+        return "canonical";
+    // hreflang alternates may share an href (`en` and `x-default`); feeds differ by href.
+    if (rel === "alternate")
+        return link.hreflang !== undefined ? `alternate ${link.hreflang} ${link.type ?? ""}` : `alternate ${link.type ?? ""} ${link.href}`;
+    if (rel === "icon" || rel === "apple-touch-icon" || rel === "mask-icon")
+        return `${rel} ${link.sizes ?? ""} ${link.media ?? ""}`;
+    return `${rel} ${link.href || link.imagesrcset || ""} ${link.media ?? ""}`;
+}
+let jsonLdSeq = 0;
+export function scriptKey(script) {
+    if (script.key !== undefined)
+        return "k:" + script.key;
+    if ("src" in script)
+        return "s:" + (script.id ?? script.src);
+    if ("inline" in script)
+        return "i:" + (script.id ?? script.inline.code);
+    // JSON-LD without an id is never deduplicated (several blocks are fine).
+    return script.id !== undefined ? "j:" + script.id : "j#" + jsonLdSeq++;
+}
+/**
+ * Merge contributions by rank `(level, phase, seq)`, later winning per key. The title template
+ * applies once to the winning title (the output's `title` is final; `titleTemplate` is kept).
+ */
+export function rankMerge(entries) {
+    if (!entries.length)
+        return undefined;
+    const sorted = [...entries].sort((a, b) => a.level - b.level || a.phase - b.phase || a.seq - b.seq);
+    let title, template, base;
+    let html, body;
+    const meta = new Map(), links = new Map(), scripts = new Map(), styles = new Map();
+    for (const { head } of sorted) {
+        if (head.title !== undefined)
+            title = head.title;
+        if (head.titleTemplate !== undefined)
+            template = head.titleTemplate;
+        if (head.base)
+            base = head.base;
+        if (head.html)
+            html = { ...html, ...head.html };
+        if (head.body)
+            body = { ...body, ...head.body };
+        for (const entry of head.meta ?? [])
+            meta.set(metaKey(entry), entry);
+        for (const entry of head.links ?? [])
+            links.set(linkKey(entry), entry);
+        for (const entry of head.scripts ?? [])
+            scripts.set(scriptKey(entry), entry);
+        for (const entry of head.styles ?? [])
+            styles.set(entry.key ?? entry.css, entry);
+    }
+    if (title !== undefined && template !== undefined)
+        title = template.replace("%s", title);
+    // The template stays alongside the final title: client head updates template component titles.
+    return {
+        ...(title !== undefined ? { title } : {}),
+        ...(template !== undefined ? { titleTemplate: template } : {}),
+        ...(html ? { html } : {}),
+        ...(body ? { body } : {}),
+        ...(base ? { base } : {}),
+        ...(meta.size ? { meta: [...meta.values()] } : {}),
+        ...(links.size ? { links: [...links.values()] } : {}),
+        ...(scripts.size ? { scripts: [...scripts.values()] } : {}),
+        ...(styles.size ? { styles: [...styles.values()] } : {}),
+    };
+}
+const attr = (name, value) => value === undefined || value === false ? "" : value === true ? " " + name : ` ${name}="${escapeAttribute(value)}"`;
+const LINK_ATTRIBUTES = [
+    "rel",
+    "href",
+    "type",
+    "hreflang",
+    "media",
+    "sizes",
+    "as",
+    "crossorigin",
+    "imagesrcset",
+    "imagesizes",
+    "fetchpriority",
+    "title",
+    "color",
+    "integrity",
+    "referrerpolicy",
+];
+export function linkTag(link, mark = "") {
+    let tag = "<link";
+    for (const name of LINK_ATTRIBUTES)
+        tag += attr(name, link[name]);
+    return tag + mark + ">";
+}
+export function metaTag(meta, mark = "") {
+    const key = meta.name !== undefined
+        ? attr("name", meta.name)
+        : meta.property !== undefined
+            ? attr("property", meta.property)
+            : meta.httpEquiv !== undefined
+                ? attr("http-equiv", meta.httpEquiv)
+                : meta.itemprop !== undefined
+                    ? attr("itemprop", meta.itemprop)
+                    : "";
+    return key ? `<meta${key} content="${escapeAttribute(meta.content)}"${attr("media", meta.media)}${mark}>` : "";
+}
+export const jsonLdTag = (data, id, mark = "") => `<script type="application/ld+json"${attr("id", id)}${mark}>${escapeJSON(JSON.stringify(data))}</script>`;
+const deferred = (s) => s.strategy === "load" || s.strategy === "idle" || s.strategy === "interaction";
+// Script bootstrap (minified by hand), one inline script per page: `{let l=<list>,…}` (block scope).
+// It runs while the head parses, before `load`. List entries: `{ u: src, k, …script properties }`,
+// `k` = index in STRATEGY_CODES. `l` doubles as the policy's allowlist.
+const STRATEGY_CODES = ["load", "idle", "interaction"];
+export const BOOT_LIST_END = ",d=document,";
+const BOOT_CORE = BOOT_LIST_END +
+    'E=addEventListener,p,r=k=>l.map(({u,k:s,...o})=>s==k&&d.head.append(Object.assign(d.createElement("script"),o,{src:p?.createScriptURL(u)??u})));' +
+    // The page's one `rivet-script` policy (unlisted URLs become ""; JSON-only scripts for kit JSON-LD), shared with kit's head manager.
+    'try{d.$rs={p:p=trustedTypes.createPolicy("rivet-script",{createScriptURL:u=>l.some(s=>s.u==u)?u:"",createScript:c=>JSON.parse(c)&&c}),l}}catch{}';
+// Window-level scroll / wheel listeners are passive already; listeners stay attached as no-ops. Touch
+// interaction arrives as pointerdown.
+const BOOT_IDLE = 'let t,n,g=()=>n||(clearTimeout(t),t=setTimeout(()=>{n=1;(self.requestIdleCallback||setTimeout)(()=>r(1),{timeout:4e3})},150));E("scroll",g);g();';
+const BOOT_INTERACTION = 'let i,x=()=>i||(i=r(2));"pointerdown keydown wheel".split(" ").map(e=>E(e,x,!0));';
+/**
+ * Bootstrap for `load` / `idle` / `interaction` scripts: `list` (escaped JSON array) inlined, code
+ * for only the strategies the page uses. Injected scripts are async by default.
+ */
+export function _scriptBootstrap(strategies, list = "[]") {
+    const used = new Set(strategies);
+    const onload = (used.has("load") ? "r(0);" : "") + (used.has("idle") ? BOOT_IDLE : "");
+    return "{let l=" + list + BOOT_CORE + (onload ? `E("load",()=>{${onload}});` : "") + (used.has("interaction") ? BOOT_INTERACTION : "") + "}";
+}
+function scriptTag(script, nonce, mark) {
+    const module = script.type === "module";
+    const strategy = script.strategy ?? "defer";
+    const timing = strategy === "eager" ? " async" : strategy === "defer" && !module ? " defer" : "";
+    return `<script${module ? ' type="module"' : ""}${timing} src="${escapeAttribute(script.src)}"${attr("id", script.id)}${attr("integrity", script.integrity)}${attr("crossorigin", script.crossorigin)}${attr("referrerpolicy", script.referrerpolicy)}${nonce}${mark}></script>`;
+}
+/** Inline `<style>` (unmanaged: never `data-rh`). CSS never contains a closing tag. */
+const styleTag = (style, nonce) => `<style${attr("media", style.media)}${nonce}>${style.css.replace(/<\/(style)/gi, "<\\/$1")}</style>`;
+/** Inline script: its JSON data block (if any) right before it. Code never contains a closing tag. */
+function inlineTag(script, nonce) {
+    if (!isInlineScript(script.inline))
+        throw new TypeError("head script `inline` must be an InlineScript (`?script` import or unsafeInlineScript)");
+    const data = script.data !== undefined ? `<script type="application/json">${escapeJSON(JSON.stringify(script.data))}</script>` : "";
+    return `${data}<script${attr("id", script.id)}${nonce}>${script.inline.code.replace(/<\/(script)/gi, "<\\/$1")}</script>`;
+}
+/**
+ * Tags for a merged head in capo.js order: base, title, preconnect, async scripts, blocking scripts,
+ * stylesheets (`styles` first), preloads, deferred scripts (+ bootstrap), prefetch, meta / SEO links,
+ * JSON-LD. Charset, viewport and the CSP meta belong to the shell.
+ */
+export function headTags(head, options = {}) {
+    const managed = options.managed;
+    const markOf = (entry) => (!managed ? "" : typeof managed === "object" && managed.persistent.has(entry) ? ' data-rh="0"' : ' data-rh=""');
+    const nonce = options.nonce !== undefined ? ` nonce="${options.nonce.replace(/[^\w+/=-]/g, "")}"` : "";
+    // One string per capo.js group (index = order), appended in place.
+    const groups = ["", "", "", "", "", "", "", "", "", "", "", ""];
+    const sheets = options.inlineStyles;
+    for (const href of options.styles ?? []) {
+        const css = sheets && Object.hasOwn(sheets, href) ? sheets[href] : undefined;
+        groups[5] += css !== undefined ? styleTag({ css }, nonce) : `<link rel="stylesheet" href="${escapeAttribute(href)}">`;
+    }
+    // Inline styles after the stylesheets (same group): component rules (motion entrances) win ties over sheet rules.
+    const inlineStyles = head?.styles?.map((style) => styleTag(style, nonce)).join("") ?? "";
+    if (head?.base)
+        groups[0] += `<base href="${escapeAttribute(head.base.href)}"${attr("target", head.base.target)}>`;
+    if (head?.title !== undefined)
+        groups[1] += `<title>${escapeText(head.title)}</title>`;
+    for (const link of head?.links ?? []) {
+        const rel = link.rel.toLowerCase();
+        const group = rel === "preconnect"
+            ? 2
+            : rel === "stylesheet"
+                ? 5
+                : rel === "preload" || rel === "modulepreload"
+                    ? 6
+                    : rel === "prefetch" || rel === "dns-prefetch" || rel === "prerender"
+                        ? 8
+                        : 10;
+        groups[group] += linkTag(link, markOf(link));
+    }
+    groups[5] += inlineStyles;
+    const later = [];
+    for (const script of head?.scripts ?? []) {
+        if ("jsonLd" in script)
+            groups[11] += jsonLdTag(script.jsonLd, script.id, markOf(script));
+        else if ("inline" in script) {
+            const strategy = script.strategy ?? "defer";
+            groups[strategy === "eager" ? 3 : strategy === "blocking" ? 4 : 7] += inlineTag(script, nonce);
+        }
+        else if (deferred(script))
+            later.push(script);
+        else {
+            const strategy = script.strategy ?? "defer";
+            groups[strategy === "eager" ? 3 : strategy === "blocking" ? 4 : 7] += scriptTag(script, nonce, markOf(script));
+        }
+    }
+    if (later.length) {
+        const list = later.map((s) => ({
+            u: s.src,
+            k: STRATEGY_CODES.indexOf(s.strategy),
+            ...(s.type === "module" ? { type: "module" } : {}),
+            ...(s.id ? { id: s.id } : {}),
+            ...(s.integrity ? { integrity: s.integrity } : {}),
+            ...(s.crossorigin ? { crossOrigin: s.crossorigin } : {}),
+            ...(s.referrerpolicy ? { referrerPolicy: s.referrerpolicy } : {}),
+        }));
+        groups[7] += `<script id="rivet-scripts"${nonce}>${_scriptBootstrap(later.map((s) => s.strategy), escapeJSON(JSON.stringify(list)))}</script>`;
+    }
+    for (const meta of head?.meta ?? [])
+        groups[9] += metaTag(meta, markOf(meta));
+    return groups.join("");
+}
+/** `<html>` attributes (leading space) for shells: the head's `html` over request defaults (i18n `locale`/`dir`). */
+export function htmlAttributes(head, defaults = {}) {
+    const html = { ...defaults, ...head?.html };
+    return attr("lang", html.lang) + attr("dir", html.dir) + attr("class", head?.html?.class);
+}
+/** `<body>` attributes (leading space). */
+export const bodyAttributes = (head) => attr("class", head?.body?.class);

package/shared/nonce.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ /** Fresh 128-bit CSP nonce (base64) for one response's inline scripts. */
2	+ export declare function nonce(): string;

package/shared/nonce.js ADDED Viewed

@@ -0,0 +1,23 @@
+// CSP nonces: the one generator behind the node and fetch adapters (Web Crypto, every runtime).
+// 16 fresh CSPRNG bytes per nonce, cut from a pooled 4 KiB `getRandomValues` fill (every byte used once; the pool
+// refills when it runs out) and base64-encoded by table: one `getRandomValues` + `btoa(String.fromCharCode(…))`
+// per request cost ~0.8 µs, this ~0.1 µs.
+const POOL = 4096;
+const pool = new Uint8Array(POOL);
+let at = POOL;
+const DIGITS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+/** Fresh 128-bit CSP nonce (base64) for one response's inline scripts. */
+export function nonce() {
+    if (at + 16 > POOL) {
+        crypto.getRandomValues(pool);
+        at = 0;
+    }
+    let out = "";
+    // 5 groups of 3 bytes → 20 digits, then the 16th byte → 2 digits + "==".
+    for (let end = at + 15; at < end; at += 3) {
+        const n = (pool[at] << 16) | (pool[at + 1] << 8) | pool[at + 2];
+        out += DIGITS[n >> 18] + DIGITS[(n >> 12) & 63] + DIGITS[(n >> 6) & 63] + DIGITS[n & 63];
+    }
+    const last = pool[at++];
+    return out + DIGITS[last >> 2] + DIGITS[(last & 3) << 4] + "==";
+}

package/shared/prefetch-fallback.min.d.ts ADDED Viewed

@@ -0,0 +1 @@

+ export declare const FALLBACK = "(function(m,g){const a=document;if(HTMLScriptElement.supports?.(\"speculationrules\"))return;const r=new Set,v=a.createElement(\"link\").relList.supports?.(\"prefetch\"),u=\"rivet:prefetch\",f={priority:\"low\"},y={capture:!0,passive:!0},s=(t,e)=>a.addEventListener(t,e,y);let i,c=null,n=2;try{n=sessionStorage.getItem(u)||2}catch{}const h=t=>{const e=t.target?.closest?.(m);return e&&g?.test(e.pathname)&&!e.matches(\"[data-rivet-reload],[rel~=external]\")?null:e},p=t=>{const e=navigator.connection;if(!t||e?.saveData||/2g/.test(e?.effectiveType))return;const o=t.href.split(\"#\")[0];if(t.origin!==location.origin||o===location.href.split(\"#\")[0]||r.has(o)||n<1)return;r.size>99&&r.delete(r.values().next().value),r.add(o);const d=()=>v?a.head.append(Object.assign(a.createElement(\"link\"),{rel:\"prefetch\",as:\"document\",href:o})):fetch(o,f).catch(()=>{});if(n==\"1\")return void d();n=\"\",fetch(o,{...f,cache:\"no-store\"}).then(l=>{l.body?.cancel();const T=l.headers.get(\"cache-control\")+\",\"+l.headers.get(\"pragma\");n=/no-(store|cache)|^(?!.*stale-while).*max-age=0\\b/.test(T)?\"0\":\"1\";try{sessionStorage.setItem(u,n)}catch{}n==\"1\"&&d()},()=>{n=2,r.delete(o)})};s(\"pointerover\",t=>{const e=h(t)||null;e!==c&&(clearTimeout(i),c=e,e&&(i=setTimeout(p,65,e)))}),s(\"pointerout\",t=>{c&&!c.contains(t.relatedTarget)&&(clearTimeout(i),c=null)});for(const t of[\"focusin\",\"touchstart\",\"pointerdown\"])s(t,e=>p(h(e)))})";

package/shared/prefetch-fallback.min.js ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ // Generated by build/prefetch-script.ts from client/prefetch-fallback.ts. Do not edit.
2	+ export const FALLBACK = "(function(m,g){const a=document;if(HTMLScriptElement.supports?.(\"speculationrules\"))return;const r=new Set,v=a.createElement(\"link\").relList.supports?.(\"prefetch\"),u=\"rivet:prefetch\",f={priority:\"low\"},y={capture:!0,passive:!0},s=(t,e)=>a.addEventListener(t,e,y);let i,c=null,n=2;try{n=sessionStorage.getItem(u)\|\|2}catch{}const h=t=>{const e=t.target?.closest?.(m);return e&&g?.test(e.pathname)&&!e.matches(\"[data-rivet-reload],[rel~=external]\")?null:e},p=t=>{const e=navigator.connection;if(!t\|\|e?.saveData\|\|/2g/.test(e?.effectiveType))return;const o=t.href.split(\"#\")[0];if(t.origin!==location.origin\|\|o===location.href.split(\"#\")[0]\|\|r.has(o)\|\|n<1)return;r.size>99&&r.delete(r.values().next().value),r.add(o);const d=()=>v?a.head.append(Object.assign(a.createElement(\"link\"),{rel:\"prefetch\",as:\"document\",href:o})):fetch(o,f).catch(()=>{});if(n==\"1\")return void d();n=\"\",fetch(o,{...f,cache:\"no-store\"}).then(l=>{l.body?.cancel();const T=l.headers.get(\"cache-control\")+\",\"+l.headers.get(\"pragma\");n=/no-(store\|cache)\|^(?!.stale-while).max-age=0\\b/.test(T)?\"0\":\"1\";try{sessionStorage.setItem(u,n)}catch{}n==\"1\"&&d()},()=>{n=2,r.delete(o)})};s(\"pointerover\",t=>{const e=h(t)\|\|null;e!==c&&(clearTimeout(i),c=e,e&&(i=setTimeout(p,65,e)))}),s(\"pointerout\",t=>{c&&!c.contains(t.relatedTarget)&&(clearTimeout(i),c=null)});for(const t of[\"focusin\",\"touchstart\",\"pointerdown\"])s(t,e=>p(h(e)))})";