@stopnetic/js 0.0.4-pilot → 0.0.5-pilot

package/README.md

@@ -6,18 +6,20 @@ frontend build. No React/Vue/Angular dependency or version upgrade is required.
 The hosting server must run Node.js 22 or newer. This is an MIT-licensed pilot SDK;
 hosted production/provider validation is still required before paid rollout.
 
-Version **0.0.4-pilot is prepared locally; it is not published yet**. It adds
-complete copyable React Router, Angular Router/HttpClient, Vue Router, Svelte,
-Solid Router and plain JavaScript examples to the generated guide and package.
-Unchanged 0.0.2/0.0.3 guides migrate safely; custom edits require merging.
+Version **0.0.5-pilot is prepared locally; it is not published yet**. The guide
+offers two explicit rendering paths: preserve SSR or retain a static/CSR app.
+Server document navigation is the default; leave startup/layout unchanged with
+no global checking screen. Optional SPA demos for all six frontends explain
+their asynchronous checks and use empty pending content. Unchanged
+0.0.2/0.0.3/0.0.4 guides migrate safely; custom edits require merging.
 Angular, React, Vue, Svelte, Solid and plain JavaScript share the browser/server
 contracts; no React dependency is required. See the
 [complete generated guide](dist/client-guide.md) for SSR, static builds, frameworks,
 client navigation, API protection and runtime restrictions.
 
-The currently published **0.0.3-pilot** includes the framework-independent
-server/browser setup, complete Node application wrapper and older-guide
-migration. Version 0.0.2 added the reusable browser/server setup for Netlify, Vercel
+The currently published **0.0.4-pilot** includes full frontend examples and the
+framework-independent server/browser setup, complete Node application wrapper
+and older-guide migration. Version 0.0.2 added the reusable browser/server setup for Netlify, Vercel
 and Node/Express, a browser access check and optional React boundary. It also
 normalizes public PEM formatting and rejects placeholder or reused installation
 keys as cookie secrets. Install the published pilot with:
@@ -28,7 +30,14 @@ npm install @stopnetic/js@pilot
 
 ## Framework implementation examples
 
-The guide and `examples/frontend` contain complete, locally tested examples:
+The guide and `examples/frontend` contain complete, locally tested OPTIONAL
+browser-only SPA examples. The default document-navigation integration needs
+the server guard and normal links, not these full-layout browser gates. Keep SSR
+and hydration; do not apply the browser demos to an existing SSR root. A runtime
+incompatibility needs a deployment decision, not an automatic conversion to CSR.
+Dashboard policies decide which paths require verification; demo paths are not
+instructions to protect every page. SPA checks still evaluate public targets
+asynchronously and can show a brief empty pending state. The examples are:
 
 | Frontend | Example |
 | --- | --- |
@@ -40,7 +49,7 @@ The guide and `examples/frontend` contain complete, locally tested examples:
 | Plain JavaScript | DOM rendering, checked navigation and API loading |
 
 Each example includes initial access, later navigation, verification redirect,
-pending/denied UI and cancellation. Backend page/API guards remain necessary.
+empty pending content, denied UI and cancellation. Backend page/API guards remain necessary.
 No framework library is added as a required SDK dependency. The generated guide
 embeds the source; use its file paths and helper instructions when copying it.
 The dashboard's frontend selector shows the same files. For maintenance, run
@@ -62,7 +71,7 @@ npm run build
 npm pack
 ```
 
-Install the resulting `stopnetic-js-0.0.4-pilot.tgz` into the website project using
+Install the resulting `stopnetic-js-0.0.5-pilot.tgz` into the website project using
 `npm install <absolute-path-to-tarball>`. The installed package has no Next.js or
 other runtime dependency. The build packages the same signed decision implementation
 as the Next.js adapter. Keep `@stopnetic/next` for its Next.js 16 guided installer.
@@ -98,7 +107,8 @@ preserved. Vercel configuration is preserved. Put runtime settings in the hostin
 provider's server/Functions environment; plain `netlify.toml` build env is not a
 Functions secret store. Copy the generated cookie secret without committing it.
 
-Wire browser route checks and EACH protected API following the generated guide.
+Wire the server page guard and EACH protected API following the generated guide.
+Browser route checks are optional for retained SPA navigation.
 Run `npm exec --no -- stopnetic-js check` after setting credentials (`--local-http`
 for a loopback pilot). This check validates configuration and generated files
 offline; it cannot prove deployment routing, API coverage or browser integration.
@@ -111,12 +121,11 @@ server environment loader. Production credentials belong in runtime settings.
 
 ### Shared browser startup and Node SSR
 
-The generated [framework-independent guide](src/client-guide.md) gives one
-browser entry that calls `checkAccess` before importing the application's
-existing bootstrap. Keep Angular's bootstrapApplication, React's createRoot,
-Vue's createApp, Svelte's mount, Solid's render or plain DOM startup unchanged
-in that bootstrap module. Use document links for server-checked navigation,
-or recheck target access in the client router. A browser-only check is UI behavior.
+The generated [framework-independent guide](dist/client-guide.md) defaults to
+server document navigation: leave browser startup/layout intact, use normal
+links, and let the server apply dashboard policies. It also gives an OPTIONAL
+browser startup gate and separate OPTIONAL SPA router demos. Do not combine
+the alternatives or apply browser-only gates to an SSR hydration root.
 
 For Node SSR use the generated Express helper before static files/rendering,
 or `createStopneticAppHandler` around a Fetch-style application entry (0.0.3).
@@ -128,15 +137,17 @@ adapted; accepting Request/Response does not make an Edge runtime supported.
 The guide includes Angular SSR/rendering and client router examples. Angular
 SSR compiled with the installed Angular 22 dependencies and served real HTML
 after verification in an isolated local fixture. That does not validate a live
-provider deployment. Netlify's automatic Angular SSR uses Edge; choose Node SSR,
-a Node gateway or a deliberate static build. Do not publish protected prerendered
+provider deployment. Netlify's automatic Angular SSR uses Edge; the Node SDK
+has no drop-in integration for that runtime. Preserve SSR and obtain a supported
+Node deployment/gateway decision instead of silently converting the app. Do not publish protected prerendered
 HTML. For other frameworks use the same Node server entry and verify their
 actual deployed runtime. React's boundary remains an optional convenience.
 
 ### Optional React Router boundary
 
 The optional React entry uses Hooks. The core/browser modules need no React.
-Place this component inside BrowserRouter, wrapping your Routes:
+Use this only for explicitly retained browser SPA navigation, inside BrowserRouter,
+around the full target layout. Server document navigation does not require it:
 
 ```jsx
 import { useLocation } from 'react-router-dom';
@@ -144,11 +155,12 @@ import { StopneticBoundary } from '@stopnetic/js/react';
 
 function RouteGuard({ children }) {
   const location = useLocation();
-  return <StopneticBoundary path={location.pathname + location.search}>
+  return <StopneticBoundary path={location.pathname + location.search} pending={null}>
     {children}
   </StopneticBoundary>;
 }
-// <BrowserRouter><RouteGuard><Routes>...</Routes></RouteGuard></BrowserRouter>
+// <BrowserRouter><RouteGuard><Layout/></RouteGuard></BrowserRouter>
+// Layout includes the target header, routes and footer.
 ```
 
 The boundary hides children while checking, ignores canceled/stale checks and

package/dist/client-guide.md

@@ -13,8 +13,61 @@ layout, navigation and protected API example, not just the startup function.
 The generated control endpoint is only part of installation. It does not
 automatically intercept pages, edit your router or protect existing APIs.
 
+## Integration contract — read before editing an existing app
+
+1. Inspect the existing server entry, rendering modes, hosting adapter and router.
+   Preserve SSR, hydration, public pages, routes and application features.
+   Installing Stopnetic is not authorization to convert SSR to CSR, delete server
+   files, replace the application's router or copy the demo over an existing app.
+2. Choose ONE of the two rendering paths below. Keep the app's current rendering
+   by default. A hosting/runtime incompatibility must be explained to the owner;
+   do not resolve it by silently removing SSR or changing hosting.
+3. Install the guard before the existing server renders or serves HTML. Keep the
+   existing browser bootstrap unchanged for the default document-navigation mode.
+   Do not add a global `Checking access...` screen or a browser startup gate.
+4. Save protected paths in Stopnetic Policies. Do not add the demo paths, protect
+   every page, copy dashboard rules into a frontend path list, or change defaults
+   without the owner's instruction. Guards evaluate requests; they do not make
+   every evaluated request require verification.
+5. Use normal document navigation for the simplest server-enforced integration.
+   If retaining client-side SPA navigation is required, use the OPTIONAL router
+   examples and explain their asynchronous checks before adding them.
+6. Independently guard private API handlers. Validate public, protected and denied
+   pages plus SSR output before declaring integration complete.
+
+## What visitors should see
+
+For example, suppose only `/members` is Page / Automatic browser flow:
+
+| Request | Normal behavior |
+| --- | --- |
+| `/`, `/about`, `/contact` with no matching rule | Public page; normal layout, no Stopnetic checking screen or verification |
+| `/members` without a valid session | Server verification flow before returning the page |
+| `/members` with a valid session | Normal page content |
+| A Page / Block route | Empty HTTP 404 before any site layout renders |
+| A protected API without a valid session | HTTP 404; no JSON data and no browser challenge |
+
+Generated site mode leaves unmatched paths public; explicit broader rules can
+change that. Public requests still need a valid signed policy response. A service
+failure returns 503 rather than bypassing policy. Rules belong in the dashboard;
+the browser cannot know whether a target is public until the server checks it.
+
 ## 1. Choose the actual rendering and server runtime
 
+**Option A — preserve SSR.** Keep the existing renderer, server entry and
+hydration. Add the Node guard before the renderer (section 3). Use server
+document navigation (section 4). Public pages render normally; protected pages
+render only after the dashboard decision permits them.
+
+**Option B — retain a static/CSR frontend.** Keep the existing browser bootstrap
+and build. Add a Node hosting page guard before HTML (section 3), then use server
+document navigation (section 4). A Node function serving built `index.html` is
+static page handling, not SSR. Choose this option for an existing static app or
+only after an explicit decision to convert rendering.
+
+Neither option requires a global browser boundary. Optional SPA navigation is
+a separate choice, not a third rendering mode.
+
 | Application | Where the shared guard belongs |
 | --- | --- |
 | Node/Express SSR or static-file server | Before body parsers, static files, API handlers and rendering |
@@ -128,11 +181,21 @@ export const serverRoutes: ServerRoute[] = [
 ];
 ```
 
-Netlify's automatic Angular SSR adapter currently uses Edge Functions. Do not
-import this Node SDK into that Edge entry, and do not assume a Netlify Node
-function runs before the Edge renderer. Use a Node SSR deployment, a Node
-gateway that cannot be bypassed, or a static Angular build with Node page
-handling. Switching to static rendering changes SSR behavior; choose deliberately.
+This is an all-request-time demonstration, not an instruction to replace an
+existing hybrid route configuration. Preserve public rendering modes where
+appropriate. Any path the dashboard may protect must reach the guard before
+HTML is served; publicly cached/prerendered HTML bypassing it cannot be protected
+by adding a dashboard rule alone. Plan server coverage for those paths first.
+
+Netlify's automatic Angular SSR adapter currently uses Edge Functions. This
+combination does not have a drop-in integration with the current Node SDK.
+Do not import the SDK into that Edge entry or assume a Node function intercepts
+the Edge renderer. If SSR must stay, keep the SSR files and explain that a
+supported Node SSR deployment or a Node gateway that cannot be bypassed is
+needed. A custom Node SSR adapter requires separate deployment/routing work;
+the static page-function example is not that adapter. Stop and obtain a rendering
+or deployment decision if the current runtime is incompatible. Do not delete
+`server.ts`, `main.server.ts`, SSR providers or hydration as a workaround.
 
 ### Static apps on Netlify / Vercel
 
@@ -148,7 +211,55 @@ root rather than `/assets`. Bundle the correct HTML and assets, preserve their
 MIME types, and do not use the Vite-only file paths unchanged for Angular.
 Reject direct entry-HTML and function aliases that would bypass protected paths.
 
-## 4. Browser startup: the same code for every frontend
+## 4. Navigation — server enforcement by default
+
+For BOTH rendering options, leave the existing browser entry and app layout
+alone. Use document links for page navigation so every target reaches the
+guarded server before rendering. No global `checkAccess`, `StopneticBoundary`,
+startup import gate, root access service or loading message is required.
+
+| Frontend | Document navigation |
+| --- | --- |
+| Angular | `<a href="/members">Members</a>` instead of `routerLink` for this navigation |
+| React | `<a href="/members">Members</a>` instead of router `<Link>` |
+| Vue | `<a href="/members">Members</a>` instead of `<RouterLink>` |
+| Svelte / SvelteKit | `<a href="/members" data-sveltekit-reload>Members</a>`; disable any custom interception |
+| Solid | `<a href="/members" target="_self">Members</a>` instead of router `<A>` |
+| Plain JavaScript | `<a href="/members">Members</a>`; do not intercept it with `pushState` |
+
+Replace programmatic SPA transitions with `location.assign('/members')` when
+using this mode. Turn off router prefetch/preload of protected page data that
+would bypass the guarded document request. Existing routers may still resolve
+the current URL after loading. Normal pages keep their usual loading behavior;
+Stopnetic's verification HTML is sent only when the server decision requires it.
+
+For SSR, hydrate the HTML already authorized by the server. Do not replace it
+with a browser-only loading screen or run a redundant startup check. Private API
+requests remain independently checked by their server handler.
+
+### Optional SPA navigation — explicit asynchronous tradeoff
+
+Retain SPA navigation only when needed. SPA transitions do not make a new
+document request, so check each target in the router before showing its content.
+The current browser API returns access after a server request; it does not
+provide a synchronous dashboard route manifest. Public transitions also need
+that check to discover the current policy. A brief empty pending state is
+possible; it is not a challenge and is not advertised as instant public rendering.
+Use document navigation above if this delay is unacceptable. Do not bypass
+checks with a hardcoded public/protected list, cached `allowed` flag, or client
+user-agent detection. Keep full target content hidden until the check succeeds.
+
+The six optional demos below intentionally check their sample router targets.
+They are not instructions to protect all those paths in Policies. Their pending
+state contains no `Checking access...` text. They do not provide server SSR
+integration or HTTP status changes. Do not install both a startup check and a
+router gate; do not apply these browser demos to an existing hydrated SSR root.
+
+### Optional browser startup gate for a browser-only app
+
+This alternative is useful only if browser mounting must wait for an access
+check. Skip it when the server already guards HTML and document navigation is
+used. It is not required by either rendering option above.
 
 For a browser-only/static app, move the existing startup code from `src/main.ts`
 or `src/main.js` into `src/bootstrap.ts` or `src/bootstrap.js`. Keep its original
@@ -186,26 +297,26 @@ This is browser code, not a server hook. The startup file can use any framework:
 | Solid | Your existing `render(...)` |
 | Plain JavaScript | Your existing DOM rendering code |
 
-Use ordinary `<a href>` document links for guarded navigation: each navigation
-then reaches the server before a new page is shown. Client router navigation
-does not rerun the startup file. If keeping SPA navigation, call `checkAccess`
-in that router's before-navigation guard for every target and handle denial,
-verification redirects, outages and stale/cancelled requests. A UI check cannot
-set the original HTTP status or make public bundles private.
+Client router navigation does not rerun this optional startup file. A UI check
+cannot set the original HTTP status or make public bundles private.
 
 <!-- BEGIN FRONTEND EXAMPLES -->
 
-### Choose your frontend implementation
+### Optional SPA demos — choose your frontend implementation
 
 The package includes copyable source files in `examples/frontend`. The same
-examples appear below and in the dashboard frontend selector. Choose the
-example for your app; the shared startup above is an alternative. These are
-complete small layouts with sample routes. Merge the guard into your own
-layout and replace the sample pages/paths with your actual pages. Keep all
-navigation, routes and footer inside the gate. The server setup remains required.
-
-These router/layout examples run in the browser. Framework SSR request
-handlers remain in section 3; keep browser checks out of server rendering.
+examples appear below and in the dashboard frontend selector. Skip this
+section for the default server/document-navigation integration. These are
+optional browser-only demos, not replacements for an existing app or SSR
+entry. Retaining SPA navigation requires asynchronous target checks, even
+for public targets. Pending content is empty; no global checking text is
+required. Keep the target layout hidden until allowed to avoid exposing it
+on denial. Only dashboard rules decide which paths require verification.
+
+If explicitly choosing this mode, merge the relevant hooks into your own
+browser router and adapt the sample paths. Do not add every demo path to
+Policies. Do not combine these gates with the optional startup gate or
+apply them to a hydrated SSR root. SSR uses section 3 and document navigation.
 
 Copy the selected folder under `src/<frontend>/` and the shared data helper
 to `src/load-private-data.js` (plus its `.d.ts` file for TypeScript). This keeps
@@ -261,7 +372,7 @@ import { loadPrivateData } from '../load-private-data.js';
 function RouteGuard({ children }: { children: ReactNode }) {
   const location = useLocation();
   return <StopneticBoundary path={location.pathname + location.search}
-    pending={<p>Checking access...</p>}
+    pending={null}
     blocked={<p>Access unavailable.</p>}>
     {children}
   </StopneticBoundary>;
@@ -314,7 +425,7 @@ createRoot(document.getElementById('app')!).render(<App/>);
 
 ### Angular Router
 
-The service records checking/allowed/denied state. Apply the route guard to every page and gate the full layout. Members uses HttpClient after route access succeeds. Merge providers into your existing appConfig, keeping SSR/hydration settings. This standalone example uses modern Angular syntax.
+Optional browser-only SPA demo: the service records checking/allowed/denied state. Checks evaluate policy; only dashboard rules require verification. Members uses HttpClient after route access succeeds. Merge providers into your existing browser appConfig. Preserve SSR/hydration with the server/document-navigation option instead of applying this demo to a hydrated root. Modern standalone Angular syntax.
 
 #### src/angular/app/app.config.ts
 
@@ -375,9 +486,7 @@ import { StopneticAccess } from './stopnetic-access.service';
       </nav></header>
       <router-outlet/>
       <footer>Example site</footer>
-    } @else if (access.state() === 'checking') {
-      <p role="status">Checking access...</p>
-    } @else {
+    } @else if (access.state() === 'denied') {
       <p role="alert">Access unavailable.</p>
     }
   `,
@@ -478,8 +587,7 @@ import { accessState } from './router.js';
     <RouterView/>
     <footer>Example site</footer>
   </template>
-  <p v-else-if="accessState === 'checking'" role="status">Checking access...</p>
-  <p v-else role="alert">Access unavailable.</p>
+  <p v-else-if="accessState === 'denied'" role="alert">Access unavailable.</p>
 </template>
 ```
 
@@ -620,9 +728,7 @@ Svelte 5 example with onMount, History API navigation, popstate and abort cleanu
   </nav></header>
   <main><h1>{path === '/members' ? 'Members' : path === '/' ? 'Home' : path === '/slow' ? 'Slow' : 'Not found'}</h1><p>{data}</p></main>
   <footer>Example site</footer>
-{:else if state === 'checking'}
-  <p role="status">Checking access...</p>
-{:else}
+{:else if state === 'denied'}
   <p role="alert">Access unavailable.</p>
 {/if}
 ```
@@ -668,8 +774,8 @@ const GuardedLayout: ParentComponent = props => {
     onCleanup(() => controller.abort());
   });
   return <Show when={result().allowed && result().path === path() ? result() : undefined}
-    fallback={<Show when={result().pending || result().path !== path()}
-      fallback={<p role="alert">Access unavailable.</p>}><p role="status">Checking access...</p></Show>}>
+    fallback={<Show when={!result().pending && result().path === path()}>
+      <p role="alert">Access unavailable.</p></Show>}>
     {_checked => <>
       <header><nav><A href="/">Home</A>{' '}<A href="/members">Members</A>{' '}
         <A href="/slow">Slow</A>{' '}<A href="/blocked">Blocked</A>{' '}<A href="/offline">Offline</A>
@@ -725,7 +831,7 @@ let current;
 async function showPage() {
   current?.abort();
   const controller = new AbortController(); current = controller;
-  root.replaceChildren(document.createTextNode('Checking access...'));
+  root.replaceChildren();
   try {
     const path = location.pathname;
     const result = await checkAccess(path + location.search, { signal: controller.signal });
@@ -810,6 +916,14 @@ client navigation, entry HTML, aliases, prerender outputs and caches. A denied
 request must not execute the renderer or data handler. The offline CLI check
 validates configuration and generated files, not deployed coverage.
 
+With only `/members` protected, confirm `/about` and `/contact` render without
+a Stopnetic checking screen. Change a dashboard rule and make a new document
+request: the change must apply without editing a client route list. For SSR,
+confirm permitted HTML contains server-rendered page content before JavaScript
+runs, hydration still works, and the renderer is never called on denial. Verify
+the deployed request actually reaches Node; an SSR build alone proves nothing
+about a provider's deployed runtime. Optional SPA checks may have a pending delay.
+
 Ordinary policy changes apply on subsequent guarded requests without reinstalling
 or redeploying. Already loaded content is not recalled. Public HTML/JS/assets and
 content bundled into frontend code remain public; keep private data in guarded
@@ -818,7 +932,7 @@ server endpoints.
 ## Updating an existing generated guide
 
 After installing the new SDK, rerun `stopnetic-js init --platform <same-platform>`
-(preview with `--dry-run`). An unchanged 0.0.2/0.0.3 generated guide is upgraded
+(preview with `--dry-run`). An unchanged 0.0.2/0.0.3/0.0.4 generated guide is upgraded
 with its setup manifest. Your key, cookie secret and server files are preserved.
 Customized guides or handlers require manual merging; switching platforms also
 requires review. This command does not publish, deploy or contact Stopnetic.

package/dist/setup.js

@@ -38,6 +38,7 @@ function platformFor(root, supplied) {
 const legacyGuideDigests = new Set([
   'b1f149af44f9ceb08fb80c18cb5d4b521620196f536d8ad422ab94d15d1d125d', // 0.0.2
   '55e36295b6aa87ad9558cde29786998483095adeae74e149ff5c7fe78507fad7', // published 0.0.3
+  '08f919257d8c85af4e56e842705825832ae2810ed68d5c1dfc8405c8f7be7610', // published 0.0.4
 ]);
 const clientGuide = readFileSync(new URL('./client-guide.md', import.meta.url), 'utf8');
 
@@ -119,5 +120,5 @@ export function checkSetup(input, { localHttp = false } = {}) {
     if (!localHttp && !options.apiUrl?.startsWith('https:')) throw new Error();
     createStopneticAccessHandler(options);
   } catch { throw new SetupError('Check server settings, HTTPS URLs, installation/signing keys and the separate cookie secret. No secret values are displayed.'); }
-  return `Checked ${manifest.platform} generated files and server configuration offline. Confirm the browser boundary, API wrappers and hosting routing with a deployed test. This does not prove coverage or start a trial.`;
+  return `Checked ${manifest.platform} generated files and server configuration offline. Confirm server page enforcement, your chosen navigation mode, API wrappers and hosting routing with a deployed test. Preserve existing SSR; browser gates are optional. This does not prove coverage or start a trial.`;
 }

package/examples/frontend/angular/app/app.ts

@@ -13,9 +13,7 @@ import { StopneticAccess } from './stopnetic-access.service';
       </nav></header>
       <router-outlet/>
       <footer>Example site</footer>
-    } @else if (access.state() === 'checking') {
-      <p role="status">Checking access...</p>
-    } @else {
+    } @else if (access.state() === 'denied') {
       <p role="alert">Access unavailable.</p>
     }
   `,

package/examples/frontend/react/App.tsx

@@ -6,7 +6,7 @@ import { loadPrivateData } from '../load-private-data.js';
 function RouteGuard({ children }: { children: ReactNode }) {
   const location = useLocation();
   return <StopneticBoundary path={location.pathname + location.search}
-    pending={<p>Checking access...</p>}
+    pending={null}
     blocked={<p>Access unavailable.</p>}>
     {children}
   </StopneticBoundary>;

package/examples/frontend/solid/App.tsx

@@ -21,8 +21,8 @@ const GuardedLayout: ParentComponent = props => {
     onCleanup(() => controller.abort());
   });
   return <Show when={result().allowed && result().path === path() ? result() : undefined}
-    fallback={<Show when={result().pending || result().path !== path()}
-      fallback={<p role="alert">Access unavailable.</p>}><p role="status">Checking access...</p></Show>}>
+    fallback={<Show when={!result().pending && result().path === path()}>
+      <p role="alert">Access unavailable.</p></Show>}>
     {_checked => <>
       <header><nav><A href="/">Home</A>{' '}<A href="/members">Members</A>{' '}
         <A href="/slow">Slow</A>{' '}<A href="/blocked">Blocked</A>{' '}<A href="/offline">Offline</A>

package/examples/frontend/svelte/App.svelte

@@ -51,8 +51,6 @@
   </nav></header>
   <main><h1>{path === '/members' ? 'Members' : path === '/' ? 'Home' : path === '/slow' ? 'Slow' : 'Not found'}</h1><p>{data}</p></main>
   <footer>Example site</footer>
-{:else if state === 'checking'}
-  <p role="status">Checking access...</p>
-{:else}
+{:else if state === 'denied'}
   <p role="alert">Access unavailable.</p>
 {/if}

package/examples/frontend/vanilla/main.js

@@ -5,7 +5,7 @@ let current;
 async function showPage() {
   current?.abort();
   const controller = new AbortController(); current = controller;
-  root.replaceChildren(document.createTextNode('Checking access...'));
+  root.replaceChildren();
   try {
     const path = location.pathname;
     const result = await checkAccess(path + location.search, { signal: controller.signal });

package/examples/frontend/vue/App.vue

@@ -13,6 +13,5 @@ import { accessState } from './router.js';
     <RouterView/>
     <footer>Example site</footer>
   </template>
-  <p v-else-if="accessState === 'checking'" role="status">Checking access...</p>
-  <p v-else role="alert">Access unavailable.</p>
+  <p v-else-if="accessState === 'denied'" role="alert">Access unavailable.</p>
 </template>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stopnetic/js",
-  "version": "0.0.4-pilot",
+  "version": "0.0.5-pilot",
   "description": "Server-side Stopnetic guard for JavaScript websites, Node.js and Express-compatible servers.",
   "type": "module",
   "license": "MIT",