@sasjs/cli 6.12.0 → 6.13.0

package/build/commands/build/internal/mockSite/assets/boot.js

@@ -0,0 +1,149 @@
+/*
+ * The mock host's boot loader. It ships as a file rather than an inline
+ * <script> because an inline one is refused by any app that sets a strict
+ * Content-Security-Policy (default-src 'self' with no 'unsafe-inline' is the
+ * SASjs norm), and the builder cannot add a hash or nonce to a policy it does
+ * not own.
+ *
+ * Order: register the service worker that hosts the mock backend, wait until it
+ * controls this page, hand it the persisted drive (persist.js), install the XHR
+ * bridge (intercept.js), and only then replay the application's own script tags
+ * - in the order the page listed them. Nothing about the app changes: it is the
+ * same tags, the same order, and the same globals, just later than the parser
+ * would have run them.
+ *
+ * The tag list arrives in the `data-scripts` attribute as JSON, written by
+ * buildMockSite. `defer` and `async` are not replayed: execution is sequenced
+ * on purpose here, because the host has to be ready before the first request
+ * the app makes.
+ *
+ * The fallback ladder, because a site whose worker never claims the page fails
+ * every request: an unreadable config stops before the app boots; a script that
+ * fails to load is reported and the next one still runs; a worker that takes
+ * control late is waited for; one that never does gets a single reload, then the
+ * app boots anyway with the failure in the console; and no service worker
+ * support at all boots the app in localStorage-only mode rather than a blank
+ * page.
+ */
+;(function () {
+  'use strict'
+
+  var script = document.currentScript
+  var specs = []
+  try {
+    specs = JSON.parse((script && script.getAttribute('data-scripts')) || '[]')
+  } catch (err) {
+    console.error('[mock] the boot config could not be read: ' + err)
+    return
+  }
+
+  function load(src, next) {
+    var s = document.createElement('script')
+    s.src = src
+    s.onload = next
+    s.onerror = function () {
+      console.error('[mock] failed to load ' + src)
+      next()
+    }
+    document.body.appendChild(s)
+  }
+
+  /** Replay one original tag: same src, and the attributes an app can rely on. */
+  function replay(spec, next) {
+    var s = document.createElement('script')
+    if (spec.type) s.setAttribute('type', spec.type)
+    if (spec.id) s.id = spec.id
+    if (spec.crossOrigin) s.crossOrigin = spec.crossOrigin
+    if (spec.integrity) s.integrity = spec.integrity
+    if (spec.noModule) s.noModule = true
+
+    // an inline snippet runs synchronously on insertion, exactly as it did in
+    // the page - there is no load event to wait for
+    if (spec.code !== undefined && spec.src === undefined) {
+      s.textContent = spec.code
+      document.body.appendChild(s)
+      return next()
+    }
+
+    s.src = spec.src
+    s.onload = next
+    s.onerror = function () {
+      console.error('[mock] failed to load ' + spec.src)
+      next()
+    }
+    document.body.appendChild(s)
+  }
+
+  function replayAll(list, done) {
+    if (!list.length) return done()
+    replay(list[0], function () {
+      replayAll(list.slice(1), done)
+    })
+  }
+
+  function start() {
+    load('host/persist.js', function () {
+      Promise.resolve(window.__sasjsMockReady).then(function (boot) {
+        if (boot && boot.error) console.error('[mock] boot: ' + boot.error)
+        load('host/intercept.js', function () {
+          replayAll(specs, function () {})
+        })
+      })
+    })
+  }
+
+  if (!('serviceWorker' in navigator)) {
+    console.error(
+      '[mock] service workers are unavailable - the mock backend cannot run'
+    )
+    start()
+    return
+  }
+
+  /*
+   * The worker script's own URL is the only thing a returning visitor cannot
+   * bypass: the host files behind it are cache-busted with a version query, but
+   * a cached sw.js keeps serving the previous build's worker - and through it
+   * the previous runtime. The boot tag already carries the host version, so its
+   * query string is reused rather than passing the version twice.
+   */
+  var stamp = ''
+  try {
+    stamp = new URL(script.src, location.href).search
+  } catch (err) {
+    stamp = ''
+  }
+
+  navigator.serviceWorker
+    .register('/sw.js' + stamp, { scope: '/', updateViaCache: 'none' })
+    .then(function () {
+      return navigator.serviceWorker.ready
+    })
+    .then(function () {
+      if (navigator.serviceWorker.controller) return
+      return new Promise(function (resolve) {
+        var timer = setTimeout(resolve, 4000)
+        navigator.serviceWorker.addEventListener(
+          'controllerchange',
+          function () {
+            clearTimeout(timer)
+            resolve()
+          }
+        )
+      })
+    })
+    .then(function () {
+      if (navigator.serviceWorker.controller) return start()
+      if (!sessionStorage.getItem('mock-sw-reloaded')) {
+        sessionStorage.setItem('mock-sw-reloaded', '1')
+        location.reload()
+        return
+      }
+      console.error('[mock] no service worker controller - requests will fail')
+      start()
+    })
+    .catch(function (err) {
+      console.error('[mock] service worker registration failed: ' + err)
+      start()
+    })
+})()

package/build/commands/build/internal/mockSite/mockSite.js

@@ -341,11 +341,60 @@ var countJsPrograms = function (files) {
         return inProgramFolder && key.toLowerCase().endsWith('.js');
     }).length;
 };
-var loaderScript = function (mainScript, version) { return "<script>\n    // Boot order: register the service worker that hosts the mock backend, wait\n    // until it controls this page, hand it the persisted drive, install the XHR\n    // bridge, then start the app.\n    (function () {\n      function load(src, next, isModule) {\n        var s = document.createElement('script')\n        if (isModule) s.type = 'module'\n        s.src = src\n        s.onload = next\n        s.onerror = function () { console.error('[mock] failed to load ' + src); next() }\n        document.body.appendChild(s)\n      }\n      function start() {\n        load('host/persist.js?v=".concat(version, "', function () {\n          Promise.resolve(window.__sasjsMockReady).then(function (boot) {\n            if (boot && boot.error) console.error('[mock] boot: ' + boot.error)\n            load('host/intercept.js?v=").concat(version, "', function () {\n              load('").concat(mainScript, "', function () {}, true)\n            })\n          })\n        })\n      }\n      if (!('serviceWorker' in navigator)) {\n        console.error('[mock] service workers are unavailable - the mock backend cannot run')\n        start()\n        return\n      }\n      navigator.serviceWorker\n        .register('/sw.js', { scope: '/' })\n        .then(function () { return navigator.serviceWorker.ready })\n        .then(function () {\n          if (navigator.serviceWorker.controller) return\n          return new Promise(function (resolve) {\n            var timer = setTimeout(resolve, 4000)\n            navigator.serviceWorker.addEventListener('controllerchange', function () {\n              clearTimeout(timer)\n              resolve()\n            })\n          })\n        })\n        .then(function () {\n          if (navigator.serviceWorker.controller) return start()\n          if (!sessionStorage.getItem('mock-sw-reloaded')) {\n            sessionStorage.setItem('mock-sw-reloaded', '1')\n            location.reload()\n            return\n          }\n          console.error('[mock] no service worker controller - requests will fail')\n          start()\n        })\n        .catch(function (err) {\n          console.error('[mock] service worker registration failed: ' + err)\n          start()\n        })\n    })()\n  </script>"); };
+/** The script-tag attributes that change how an app's script runs. */
+var REPLAYED_ATTRIBUTES = {
+    type: 'type',
+    id: 'id',
+    crossorigin: 'crossOrigin',
+    integrity: 'integrity',
+    nomodule: 'noModule'
+};
+var parseAttributes = function (source) {
+    var _a, _b, _c;
+    var attributes = {};
+    var pattern = /([a-zA-Z_:][-a-zA-Z0-9_:.]*)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+)))?/g;
+    var match;
+    while ((match = pattern.exec(source))) {
+        var value = (_c = (_b = (_a = match[2]) !== null && _a !== void 0 ? _a : match[3]) !== null && _b !== void 0 ? _b : match[4]) !== null && _c !== void 0 ? _c : '';
+        attributes[match[1].toLowerCase()] = value;
+    }
+    return attributes;
+};
+var escapeAttribute = function (value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/'/g, '&#39;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;');
+};
+/**
+ * The boot loader is a FILE rather than an inline script: an app with a strict
+ * Content-Security-Policy (`default-src 'self'`, no `unsafe-inline`) refuses an
+ * inline one, and the builder cannot add a hash or nonce to a policy it does
+ * not own.
+ *
+ * The app's script tags travel to it in `data-scripts`, in document order. Any
+ * number of tags works - one bundle, or several plain scripts a page loads in
+ * order, plus the inline snippets some pages use to set up a global before the
+ * bundle runs - so the host does not dictate how the app is built.
+ */
+var bootTag = function (scripts, version) {
+    return "<script src=\"host/boot.js?v=".concat(version, "\" data-scripts='").concat(escapeAttribute(JSON.stringify(scripts)), "'></script>");
+};
+/**
+ * Script types the browser executes. Anything else (`application/ld+json`, a
+ * template) is data the page keeps for later, so it stays where it is.
+ */
+var EXECUTABLE_TYPES = [
+    '',
+    'module',
+    'text/javascript',
+    'application/javascript'
+];
 /**
- * Points the app at its own origin and replaces its bundle tag with the
- * boot loader. Both changes are reported when the expected markup is absent,
- * rather than producing a site that silently talks to a real server.
+ * Points the app at its own origin and replaces its script tags with the boot
+ * loader. Both changes are reported when the expected markup is absent, rather
+ * than producing a site that silently talks to a real server.
  */
 var patchIndexHtml = function (html, version) {
     var warnings = [];
@@ -357,12 +406,56 @@ var patchIndexHtml = function (html, version) {
     else {
         warnings.push('no <sasjs> element found - check the adapter configuration manually');
     }
-    var mainMatch = patched.match(/<script[^>]*src="([^"]*main[^"]*\.js)"[^>]*><\/script>/i);
-    if (mainMatch) {
-        patched = patched.replace(mainMatch[0], loaderScript(mainMatch[1], version));
+    var scripts = [];
+    var tagPattern = /<script\b([^>]*)>([\s\S]*?)<\/script>[ \t]*\r?\n?/gi;
+    patched = patched.replace(tagPattern, function (tag, source, body) {
+        var e_6, _a;
+        var attributes = parseAttributes(source);
+        var type = (attributes.type || '').trim().toLowerCase();
+        var inlined = !attributes.src;
+        // data blocks stay in the page; they are not scripts to replay
+        if (!EXECUTABLE_TYPES.includes(type))
+            return tag;
+        var spec = inlined
+            ? {}
+            : { src: attributes.src };
+        if (inlined) {
+            var code = body.trim();
+            // an empty inline tag (a placeholder, or a commented-out block) is not
+            // worth a round trip
+            if (!code)
+                return '';
+            spec.code = code;
+        }
+        try {
+            for (var _b = __values(Object.keys(REPLAYED_ATTRIBUTES)), _c = _b.next(); !_c.done; _c = _b.next()) {
+                var attribute = _c.value;
+                if (attributes[attribute] === undefined)
+                    continue;
+                if (attribute === 'type' && !attributes.type)
+                    continue;
+                var name_1 = REPLAYED_ATTRIBUTES[attribute];
+                spec[name_1] = attribute === 'nomodule' ? 'true' : attributes[attribute];
+            }
+        }
+        catch (e_6_1) { e_6 = { error: e_6_1 }; }
+        finally {
+            try {
+                if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
+            }
+            finally { if (e_6) throw e_6.error; }
+        }
+        scripts.push(spec);
+        return '';
+    });
+    if (scripts.length) {
+        var tag = bootTag(scripts, version);
+        patched = /<\/body>/i.test(patched)
+            ? patched.replace(/<\/body>/i, "".concat(tag, "\n</body>"))
+            : patched + tag;
     }
     else {
-        warnings.push('no main bundle script tag found - the mock loader was not installed');
+        warnings.push('no script tags found - the mock loader was not installed');
     }
     return { patched: patched, warnings: warnings };
 };
@@ -383,7 +476,7 @@ var patchIndexHtml = function (html, version) {
 function buildMockSite(target) {
     return __awaiter(this, void 0, void 0, function () {
         var projectDir, appLocRaw, appLoc, buildFolder, webSourceRaw, webFolder, outputFolder, streamConfig, excluded, _a, seed, skipped, jsPrograms, driveEntries, webFileCount, hostFolder, _b, _c, asset, hostVersion, swPath, snapshotSource, hasSnapshot, indexPath, _d, patched, warnings;
-        var e_6, _e;
+        var e_7, _e;
         var _f, _g, _h;
         return __generator(this, function (_j) {
             switch (_j.label) {
@@ -465,18 +558,19 @@ function buildMockSite(target) {
                             'md5.js',
                             'runtime-core.js',
                             'persist.js',
-                            'intercept.js'
+                            'intercept.js',
+                            'boot.js'
                         ]), _c = _b.next(); !_c.done; _c = _b.next()) {
                             asset = _c.value;
                             fs_1.default.copyFileSync(path_1.default.join(ASSETS_FOLDER, asset), path_1.default.join(hostFolder, asset));
                         }
                     }
-                    catch (e_6_1) { e_6 = { error: e_6_1 }; }
+                    catch (e_7_1) { e_7 = { error: e_7_1 }; }
                     finally {
                         try {
                             if (_c && !_c.done && (_e = _b.return)) _e.call(_b);
                         }
-                        finally { if (e_6) throw e_6.error; }
+                        finally { if (e_7) throw e_7.error; }
                     }
                     fs_1.default.copyFileSync(API_BROWSER_BUILD, path_1.default.join(hostFolder, 'api-browser.js'));
                     // sw.js sits at the site root: a worker can only control the folder it is
@@ -502,6 +596,7 @@ function buildMockSite(target) {
                         'runtime-core.js',
                         'persist.js',
                         'intercept.js',
+                        'boot.js',
                         'api-browser.js',
                         'webout-prelude.json'
                     ]

package/build/commands/build/internal/mockSite/spec/boot.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/build/commands/build/internal/mockSite/spec/boot.spec.js

@@ -0,0 +1,462 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var loadBoot = function (specs, options) {
+    if (options === void 0) { options = {}; }
+    jest.resetModules();
+    var appended = [];
+    var timeline = [];
+    var registered = [];
+    var stored = {};
+    if (options.guard)
+        stored['mock-sw-reloaded'] = options.guard;
+    var createElement = function () {
+        var element = {
+            attributes: {},
+            setAttribute: function (name, value) {
+                element.attributes[name] = value;
+                if (name === 'type')
+                    element.type = value;
+            }
+        };
+        return element;
+    };
+    var document = {
+        currentScript: options.noScript
+            ? null
+            : {
+                // the builder stamps the boot tag with the host version, and the
+                // loader reuses that query for the worker's own URL
+                src: options.noStamp
+                    ? 'http://localhost:8123/host/boot.js'
+                    : 'http://localhost:8123/host/boot.js?v=abc123',
+                getAttribute: function (name) {
+                    if (name !== 'data-scripts')
+                        return null;
+                    return options.brokenConfig ? 'not json' : JSON.stringify(specs);
+                }
+            },
+        createElement: createElement,
+        body: {
+            appendChild: function (element) {
+                appended.push(element);
+                timeline.push(element.src || '[' + element.textContent + ']');
+                if (!element.src)
+                    return element;
+                setTimeout(function () {
+                    var failed = (options.failSrcs || []).includes(element.src);
+                    if (failed && element.onerror)
+                        element.onerror();
+                    else if (element.onload)
+                        element.onload();
+                }, 0);
+                return element;
+            }
+        }
+    };
+    var listeners = {};
+    var controller = options.controller || 'present';
+    var navigator = {
+        serviceWorker: {
+            register: function (url, init) {
+                registered.push(url + ' ' + JSON.stringify(init));
+                return options.registerFails
+                    ? Promise.reject(new Error('nope'))
+                    : Promise.resolve();
+            },
+            ready: Promise.resolve(),
+            get controller() {
+                if (controller === 'present')
+                    return {};
+                if (controller === 'late' && late)
+                    return {};
+                return null;
+            },
+            addEventListener: function (type, fn) {
+                listeners[type] = listeners[type] || [];
+                listeners[type].push(fn);
+            }
+        }
+    };
+    var late = false;
+    global.document = document;
+    global.navigator = navigator;
+    global.window = options.bootError
+        ? { __sasjsMockReady: Promise.resolve({ error: options.bootError }) }
+        : {};
+    global.sessionStorage = {
+        getItem: function (key) { return (key in stored ? stored[key] : null); },
+        setItem: function (key, value) {
+            stored[key] = value;
+        }
+    };
+    global.location = { reload: function () { return timeline.push('reload'); } };
+    jest.spyOn(console, 'error').mockImplementation(function () { });
+    require('../assets/boot.js');
+    var claim = function () {
+        late = true;
+        (listeners['controllerchange'] || []).forEach(function (fn) { return fn(); });
+    };
+    return { appended: appended, timeline: timeline, registered: registered, stored: stored, claim: claim };
+};
+var settle = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var i;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                i = 0;
+                _a.label = 1;
+            case 1:
+                if (!(i < 20)) return [3 /*break*/, 4];
+                return [4 /*yield*/, new Promise(function (r) { return setTimeout(r, 1); })];
+            case 2:
+                _a.sent();
+                _a.label = 3;
+            case 3:
+                i++;
+                return [3 /*break*/, 1];
+            case 4: return [2 /*return*/];
+        }
+    });
+}); };
+describe('the boot loader', function () {
+    afterEach(function () {
+        delete global.document;
+        delete global.navigator;
+        delete global.window;
+        delete global.sessionStorage;
+        delete global.location;
+    });
+    it("registers the worker at the site root, at the build's version", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var registered;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    registered = loadBoot([]).registered;
+                    return [4 /*yield*/, settle()
+                        // a cached sw.js would keep a returning visitor on the previous build's
+                        // worker, so the URL carries the host version and the check skips the cache
+                    ];
+                case 1:
+                    _a.sent();
+                    // a cached sw.js would keep a returning visitor on the previous build's
+                    // worker, so the URL carries the host version and the check skips the cache
+                    expect(registered).toEqual([
+                        '/sw.js?v=abc123 ' +
+                            JSON.stringify({ scope: '/', updateViaCache: 'none' })
+                    ]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('boots the host before the app, then replays every tag in order', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var timeline;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    timeline = loadBoot([
+                        { src: 'sasjs.js', id: 'sasjs-adapter' },
+                        { code: 'window.__config = 1' },
+                        { src: 'js/backend.js' },
+                        { src: 'js/game.js' }
+                    ]).timeline;
+                    return [4 /*yield*/, settle()];
+                case 1:
+                    _a.sent();
+                    expect(timeline).toEqual([
+                        'host/persist.js',
+                        'host/intercept.js',
+                        'sasjs.js',
+                        '[window.__config = 1]',
+                        'js/backend.js',
+                        'js/game.js'
+                    ]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('keeps the attributes an app relies on', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var appended, app;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    appended = loadBoot([
+                        { src: 'sasjs.js', id: 'sasjs-adapter' },
+                        { src: 'main.js', type: 'module' },
+                        { src: 'cdn.js', crossOrigin: 'anonymous', integrity: 'sha384-x' },
+                        { src: 'legacy.js', noModule: 'true' }
+                    ]).appended;
+                    return [4 /*yield*/, settle()
+                        // the first two are the host's own: persist.js and intercept.js
+                    ];
+                case 1:
+                    _a.sent();
+                    app = appended.slice(2);
+                    expect(app.map(function (element) { return element.src; })).toEqual([
+                        'sasjs.js',
+                        'main.js',
+                        'cdn.js',
+                        'legacy.js'
+                    ]);
+                    expect(app[0].id).toEqual('sasjs-adapter');
+                    expect(app[1].type).toEqual('module');
+                    expect(app[2].crossOrigin).toEqual('anonymous');
+                    expect(app[2].integrity).toEqual('sha384-x');
+                    expect(app[3].noModule).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('runs an inline snippet without waiting for a load event', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var appended, inline;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    appended = loadBoot([{ code: 'window.__boot = 1' }]).appended;
+                    return [4 /*yield*/, settle()];
+                case 1:
+                    _a.sent();
+                    inline = appended.find(function (element) { return element.textContent; });
+                    expect(inline).toBeDefined();
+                    expect(inline.src).toBeUndefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('moves on when a script fails to load', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var timeline;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    timeline = loadBoot([{ src: 'missing.js' }, { src: 'js/game.js' }], { failSrcs: ['missing.js'] }).timeline;
+                    return [4 /*yield*/, settle()];
+                case 1:
+                    _a.sent();
+                    expect(timeline.slice(-2)).toEqual(['missing.js', 'js/game.js']);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('moves on when a host script fails to load', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var timeline;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    timeline = loadBoot([{ src: 'js/game.js' }], {
+                        failSrcs: ['host/persist.js']
+                    }).timeline;
+                    return [4 /*yield*/, settle()
+                        // a dead persist.js still reaches the app rather than hanging the page
+                    ];
+                case 1:
+                    _a.sent();
+                    // a dead persist.js still reaches the app rather than hanging the page
+                    expect(timeline).toContain('js/game.js');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('reports an error the host booted with', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    loadBoot([], { bootError: 'seed missing' });
+                    return [4 /*yield*/, settle()];
+                case 1:
+                    _a.sent();
+                    expect(console.error).toHaveBeenCalledWith(expect.stringContaining('seed missing'));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('refuses a boot config it cannot read instead of guessing', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var timeline;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    timeline = loadBoot([], { brokenConfig: true }).timeline;
+                    return [4 /*yield*/, settle()];
+                case 1:
+                    _a.sent();
+                    expect(timeline).toEqual([]);
+                    expect(console.error).toHaveBeenCalledWith(expect.stringContaining('boot config could not be read'));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('registers the plain worker URL when the tag carries no version', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var registered;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    registered = loadBoot([], { noStamp: true }).registered;
+                    return [4 /*yield*/, settle()];
+                case 1:
+                    _a.sent();
+                    expect(registered[0]).toMatch(/^\/sw\.js /);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('boots the host with no app scripts when the tag carries no config', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var timeline;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    timeline = loadBoot([], { noScript: true }).timeline;
+                    return [4 /*yield*/, settle()];
+                case 1:
+                    _a.sent();
+                    expect(timeline).toEqual(['host/persist.js', 'host/intercept.js']);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('waits for a worker that takes control a moment later', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, timeline, claim;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = loadBoot([{ src: 'app.js' }], {
+                        controller: 'late'
+                    }), timeline = _a.timeline, claim = _a.claim;
+                    return [4 /*yield*/, settle()];
+                case 1:
+                    _b.sent();
+                    claim();
+                    return [4 /*yield*/, settle()];
+                case 2:
+                    _b.sent();
+                    expect(timeline).toEqual(['host/persist.js', 'host/intercept.js', 'app.js']);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('boots anyway when the worker cannot be registered at all', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var timeline;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    timeline = loadBoot([{ src: 'app.js' }], {
+                        registerFails: true,
+                        controller: 'never'
+                    }).timeline;
+                    return [4 /*yield*/, settle()];
+                case 1:
+                    _a.sent();
+                    expect(timeline).toEqual(['host/persist.js', 'host/intercept.js', 'app.js']);
+                    expect(console.error).toHaveBeenCalledWith(expect.stringContaining('service worker registration failed'));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('reloads once when the worker never claims the page', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, timeline, stored;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = loadBoot([{ src: 'app.js' }], {
+                        controller: 'never'
+                    }), timeline = _a.timeline, stored = _a.stored;
+                    // the loader's grace period is 4s: wait past it so its timer cannot fire
+                    // into the next test's globals
+                    return [4 /*yield*/, new Promise(function (r) { return setTimeout(r, 4200); })];
+                case 1:
+                    // the loader's grace period is 4s: wait past it so its timer cannot fire
+                    // into the next test's globals
+                    _b.sent();
+                    expect(stored['mock-sw-reloaded']).toEqual('1');
+                    expect(timeline).toEqual(['reload']);
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 10000);
+    it('boots anyway once the reload has already been tried', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var timeline;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    timeline = loadBoot([{ src: 'app.js' }], {
+                        controller: 'never',
+                        guard: '1'
+                    }).timeline;
+                    return [4 /*yield*/, new Promise(function (r) { return setTimeout(r, 4200); })];
+                case 1:
+                    _a.sent();
+                    expect(timeline).toEqual(['host/persist.js', 'host/intercept.js', 'app.js']);
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 10000);
+    it('starts without a worker when service workers are unavailable', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var timeline, document;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    jest.resetModules();
+                    timeline = [];
+                    document = {
+                        currentScript: {
+                            getAttribute: function () { return JSON.stringify([{ src: 'app.js' }]); }
+                        },
+                        createElement: function () { return ({}); },
+                        body: {
+                            appendChild: function (element) {
+                                timeline.push(element.src);
+                                setTimeout(function () { return element.onload && element.onload(); }, 0);
+                                return element;
+                            }
+                        }
+                    };
+                    global.document = document;
+                    global.navigator = {};
+                    global.window = {};
+                    global.sessionStorage = { getItem: function () { return null; }, setItem: function () { } };
+                    global.location = { reload: function () { } };
+                    jest.spyOn(console, 'error').mockImplementation(function () { });
+                    require('../assets/boot.js');
+                    return [4 /*yield*/, settle()];
+                case 1:
+                    _a.sent();
+                    expect(timeline).toEqual(['host/persist.js', 'host/intercept.js', 'app.js']);
+                    expect(console.error).toHaveBeenCalledWith(expect.stringContaining('service workers are unavailable'));
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});

package/build/commands/build/internal/mockSite/spec/mockSite.spec.js

@@ -168,6 +168,7 @@ describe('browser-hosted build', function () {
                             'runtime-core.js',
                             'persist.js',
                             'intercept.js',
+                            'boot.js',
                             'api-browser.js'
                         ]), _b = _a.next(); !_b.done; _b = _a.next()) {
                             asset = _b.value;
@@ -353,9 +354,50 @@ describe('browser-hosted build', function () {
                     expect(html).toContain('serverurl=""');
                     expect(html).toContain('loginmechanism="Default"');
                     expect(html).not.toContain('https://sas.example.com');
-                    expect(html).toContain("register('/sw.js'");
-                    expect(html).toContain('host/persist.js');
-                    expect(html).toContain('main.abc123.js');
+                    // the loader is a file, never an inline script: an app with a strict
+                    // Content-Security-Policy would refuse an inline one
+                    expect(html).toContain('<script src="host/boot.js?v=');
+                    expect(html).not.toContain('<script>');
+                    expect(fs_1.default.existsSync(path_1.default.join(out(), 'host', 'boot.js'))).toBe(true);
+                    // the app's own tags are replayed by the loader, in the order the page has
+                    // them, and are gone from the page itself
+                    expect(html).not.toContain('<script src="main.abc123.js"');
+                    expect(html).toContain('"src":"main.abc123.js","type":"module"');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('replays every script tag a page loads, not just a bundled entry point', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var html, tag, specs;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    write(path_1.default.join(root, 'client', 'dist', 'index.html'), [
+                        '<!doctype html><html><body>',
+                        '<sasjs serverurl="https://sas.example.com" apploc="/Public/app/test"></sasjs>',
+                        '<script type="application/ld+json">{"name":"app"}</script>',
+                        '<script defer id="sasjs-adapter" src="sasjs.js"></script>',
+                        '<script>window.__boot = {ready: false}</script>',
+                        '<script src="js/backend.js"></script>',
+                        '<script src="js/game.js" crossorigin="anonymous"></script>',
+                        '</body></html>'
+                    ].join('\n'));
+                    return [4 /*yield*/, (0, mockSite_1.buildMockSite)(target())];
+                case 1:
+                    _a.sent();
+                    html = fs_1.default.readFileSync(path_1.default.join(out(), 'index.html'), 'utf8');
+                    tag = html.match(/data-scripts='([^']*)'/);
+                    expect(tag).toBeTruthy();
+                    specs = JSON.parse(tag[1].replace(/&#39;/g, "'").replace(/&amp;/g, '&'));
+                    expect(specs).toEqual([
+                        { src: 'sasjs.js', id: 'sasjs-adapter' },
+                        { code: 'window.__boot = {ready: false}' },
+                        { src: 'js/backend.js' },
+                        { src: 'js/game.js', crossOrigin: 'anonymous' }
+                    ]);
+                    expect(html).not.toContain('<script src="js/backend.js"');
+                    // a data block is not a script: it stays in the page
+                    expect(html).toContain('<script type="application/ld+json">');
                     return [2 /*return*/];
             }
         });
@@ -580,7 +622,7 @@ describe('browser-hosted build', function () {
                     result = _c.sent();
                     expect(result.webFileCount).toBeGreaterThan(0);
                     expect((_a = process.logger) === null || _a === void 0 ? void 0 : _a.warn).toHaveBeenCalledWith(expect.stringContaining('no <sasjs> element found'));
-                    expect((_b = process.logger) === null || _b === void 0 ? void 0 : _b.warn).toHaveBeenCalledWith(expect.stringContaining('no main bundle script tag found'));
+                    expect((_b = process.logger) === null || _b === void 0 ? void 0 : _b.warn).toHaveBeenCalledWith(expect.stringContaining('no script tags found'));
                     return [2 /*return*/];
             }
         });

package/package.json

@@ -124,5 +124,5 @@
     "ws": "8.21.0",
     "nanoid": "3.3.18"
   },
-  "version": "6.12.0"
+  "version": "6.13.0"
 }