@tinkerlandai/indiana-iam 0.2.0 → 0.3.0

package/src/source-entry.mjs

@@ -0,0 +1,50 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { dependency } from "./dependencies.mjs";
+import { sha256 } from "./integrity.mjs";
+
+/** Select a browser import graph without evaluating the entry or its configuration. */
+export async function sourceEntry({ root, modules, resolveModule, ts, entry }) {
+  let htmlSource;
+  if (entry === undefined) {
+    const file = path.join(root, "index.html");
+    let stat;
+    try { stat = await fs.lstat(file); }
+    catch (error) { if (error.code !== "ENOENT") throw error; }
+    if (stat) {
+      if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 256_000)
+        throw Error("Browser entry HTML must be a bounded local file");
+      const bytes = await fs.readFile(file), text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+      const { JSDOM } = dependency("jsdom").value;
+      const dom = new JSDOM(text);
+      try {
+        const scripts = [...dom.window.document.querySelectorAll('script[type="module"]')];
+        if (scripts.length !== 1 || !scripts[0].hasAttribute("src") || scripts[0].textContent.trim() || dom.window.document.querySelector("base[href]"))
+          throw Error("Ambiguous browser entry: set entry to one local source module");
+        entry = scripts[0].getAttribute("src").replace(/^\/(?!\/)/, "");
+        htmlSource = { file: "index.html", sha256: sha256(bytes), bytes: bytes.length };
+      } finally { dom.window.close(); }
+    }
+  }
+  if (entry === undefined) return { discoveryModules: modules };
+  if (typeof entry !== "string" || !entry || entry.startsWith("/") || /[\\?#:\s]/.test(entry) || entry.split("/").some(part => !part || part === "." || part === "..") || !modules.has(entry))
+    throw Error("entry must name one source module relative to the scanned root");
+  const selected = new Map();
+  function visit(module) {
+    if (selected.has(module.file)) return;
+    selected.set(module.file, module);
+    const dependencies = new Set([...module.imports.values()].map(ref => ref.specifier));
+    function imports(node) {
+      if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) dependencies.add(node.moduleSpecifier.text);
+      if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword && node.arguments.length === 1 && ts.isStringLiteral(node.arguments[0])) dependencies.add(node.arguments[0].text);
+      ts.forEachChild(node, imports);
+    }
+    imports(module.source);
+    for (const specifier of dependencies) {
+      const target = resolveModule(module.file, specifier);
+      if (target) visit(target);
+    }
+  }
+  visit(modules.get(entry));
+  return { discoveryModules: selected, htmlSource, entry };
+}

package/src/source-resolution.mjs

@@ -0,0 +1,268 @@
+/** Bounded AST references only. No merchant module, getter, factory or callback is invoked. */
+export function sourceResolution({ ts, resolveModule, resolveBinding }) {
+  const unwrap = (node) => {
+    while (
+      node &&
+      (ts.isParenthesizedExpression(node) ||
+        ts.isAsExpression(node) ||
+        ts.isTypeAssertionExpression(node) ||
+        ts.isSatisfiesExpression(node) ||
+        ts.isNonNullExpression(node) ||
+        ts.isAwaitExpression(node))
+    )
+      node = node.expression;
+    return node;
+  };
+  function reference(node, module, seen = new Set()) {
+    node = unwrap(node);
+    if (!node || seen.size >= 32) return null;
+    const key = module.file + ":" + node.pos + ":" + node.end;
+    if (seen.has(key)) return null;
+    seen = new Set([...seen, key]);
+    if (ts.isIdentifier(node)) {
+      const ref = resolveBinding(module, node.text);
+      return ref && reference(ref.node, ref.module, seen);
+    }
+    if (
+      ts.isPropertyAccessExpression(node) ||
+      ts.isElementAccessExpression(node)
+    ) {
+      if (node.questionDotToken) return null;
+      const name = ts.isPropertyAccessExpression(node)
+        ? node.name.text
+        : string(node.argumentExpression, module, seen);
+      if (typeof name !== "string") return null;
+      if (ts.isIdentifier(node.expression)) {
+        const imported = module.imports.get(node.expression.text);
+        if (imported?.name === "*") {
+          const target = resolveModule(module.file, imported.specifier);
+          const ref =
+            target && resolveBinding(target, target.exports.get(name) ?? name);
+          return ref && reference(ref.node, ref.module, seen);
+        }
+      }
+      const record = reference(node.expression, module, seen);
+      if (!record) return null;
+      if (ts.isEnumDeclaration(record.node)) {
+        const member = record.node.members.find(
+          (member) => member.name.text === name,
+        );
+        return member && reference(member.initializer, record.module, seen);
+      }
+      if (
+        !ts.isObjectLiteralExpression(record.node) ||
+        record.node.properties.some(
+          (property) =>
+            !ts.isPropertyAssignment(property) ||
+            (property.name && ts.isComputedPropertyName(property.name)),
+        )
+      )
+        return null;
+      const fields = record.node.properties.filter(
+        (property) => property.name.text === name,
+      );
+      return fields.length === 1
+        ? reference(fields[0].initializer, record.module, seen)
+        : null;
+    }
+    return { node, module };
+  }
+  function string(node, module, seen = new Set()) {
+    const ref = reference(node, module, seen);
+    if (!ref) return undefined;
+    node = ref.node;
+    module = ref.module;
+    if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node))
+      return node.text;
+    const key = module.file + ":string:" + node.pos;
+    if (seen.has(key) || seen.size >= 32) return undefined;
+    seen = new Set([...seen, key]);
+    if (ts.isTemplateExpression(node)) {
+      let result = node.head.text;
+      for (const span of node.templateSpans) {
+        const value = string(span.expression, module, seen);
+        if (value === undefined) return undefined;
+        result += value + span.literal.text;
+        if (result.length > 2048) return undefined;
+      }
+      return result;
+    }
+    if (
+      ts.isBinaryExpression(node) &&
+      node.operatorToken.kind === ts.SyntaxKind.PlusToken
+    ) {
+      const left = string(node.left, module, seen),
+        right = string(node.right, module, seen);
+      return left !== undefined &&
+        right !== undefined &&
+        left.length + right.length <= 2048
+        ? left + right
+        : undefined;
+    }
+    return undefined;
+  }
+  function external(module, node) {
+    node = unwrap(node);
+    if (node && ts.isIdentifier(node)) return module.imports.get(node.text);
+    if (
+      node &&
+      ts.isPropertyAccessExpression(node) &&
+      ts.isIdentifier(node.expression)
+    ) {
+      const owner = module.imports.get(node.expression.text);
+      if (owner && ["*", "default"].includes(owner.name))
+        return { specifier: owner.specifier, name: node.name.text };
+    }
+    return null;
+  }
+  function functionNode(node) {
+    node = unwrap(node);
+    return node &&
+      (ts.isFunctionDeclaration(node) ||
+        ts.isFunctionExpression(node) ||
+        ts.isArrowFunction(node))
+      ? node
+      : null;
+  }
+  function returned(fn) {
+    if (!fn?.body) return null;
+    if (!ts.isBlock(fn.body)) return fn.body;
+    return fn.body.statements.length === 1 &&
+      ts.isReturnStatement(fn.body.statements[0])
+      ? fn.body.statements[0].expression
+      : null;
+  }
+  // Prove only the successful module return of a forwarding function. Catch
+  // side effects are opaque and must rethrow; finally/alternate module returns refuse.
+  function forwards(node, module, parameters, depth = 0) {
+    node = unwrap(node);
+    if (!node || depth > 8 || !ts.isCallExpression(node)) return false;
+    if (
+      ts.isIdentifier(node.expression) &&
+      parameters.has(node.expression.text)
+    )
+      return node.arguments.length === 0;
+    if (!ts.isIdentifier(node.expression)) return false;
+    const ref = resolveBinding(module, node.expression.text),
+      fn = ref && functionNode(ref.node);
+    if (
+      !fn ||
+      fn.asteriskToken ||
+      fn.parameters.length !== 1 ||
+      fn.parameters[0].dotDotDotToken ||
+      !ts.isIdentifier(fn.parameters[0].name) ||
+      node.arguments.length !== 1 ||
+      !ts.isIdentifier(node.arguments[0]) ||
+      !parameters.has(node.arguments[0].text)
+    )
+      return false;
+    const nested = new Set([fn.parameters[0].name.text]);
+    let result = returned(fn);
+    if (
+      !result &&
+      fn.body &&
+      ts.isBlock(fn.body) &&
+      fn.body.statements.length === 1
+    ) {
+      const statement = fn.body.statements[0];
+      if (
+        !ts.isTryStatement(statement) ||
+        statement.finallyBlock ||
+        !statement.catchClause ||
+        !ts.isThrowStatement(statement.catchClause.block.statements.at(-1))
+      )
+        return false;
+      let overrides = false;
+      const visit = (item) => {
+        if (ts.isReturnStatement(item)) overrides = true;
+        ts.forEachChild(item, visit);
+      };
+      visit(statement.catchClause);
+      if (
+        overrides ||
+        statement.tryBlock.statements.length !== 1 ||
+        !ts.isReturnStatement(statement.tryBlock.statements[0])
+      )
+        return false;
+      result = statement.tryBlock.statements[0].expression;
+    }
+    return forwards(result, ref.module, nested, depth + 1);
+  }
+  function lazyFactory(call, module) {
+    if (call.arguments.length !== 1) return null;
+    const imported = external(module, call.expression);
+    if (imported?.specifier === "react" && imported.name === "lazy")
+      return { node: call.arguments[0], module, wrapped: false };
+    if (!ts.isIdentifier(call.expression)) return null;
+    const ref = resolveBinding(module, call.expression.text),
+      fn = ref && functionNode(ref.node);
+    if (
+      !fn ||
+      fn.asteriskToken ||
+      fn.parameters.length !== 1 ||
+      fn.parameters[0].dotDotDotToken ||
+      !ts.isIdentifier(fn.parameters[0].name)
+    )
+      return null;
+    if (fn.modifiers?.some(modifier => modifier.kind === ts.SyntaxKind.AsyncKeyword)) return null;
+    const value = unwrap(returned(fn));
+    if (!value || !ts.isCallExpression(value) || value.arguments.length !== 1)
+      return null;
+    const wrapper = external(ref.module, value.expression),
+      callback = functionNode(value.arguments[0]);
+    if (
+      wrapper?.specifier !== "react" ||
+      wrapper.name !== "lazy" ||
+      !callback ||
+      callback.asteriskToken ||
+      callback.parameters.length ||
+      !forwards(
+        returned(callback),
+        ref.module,
+        new Set([fn.parameters[0].name.text]),
+      )
+    )
+      return null;
+    return { node: call.arguments[0], module, wrapped: true };
+  }
+  function component(module, name) {
+    if (typeof name !== "string" || !name) return null;
+    const parts = name.split(".");
+    let ref;
+    if (parts.length === 2) {
+      const imported = module.imports.get(parts[0]),
+        target =
+          imported &&
+          ["*", "default"].includes(imported.name) &&
+          resolveModule(module.file, imported.specifier);
+      ref =
+        target &&
+        resolveBinding(target, target.exports.get(parts[1]) ?? parts[1]);
+    } else if (parts.length === 1) ref = resolveBinding(module, name);
+    if (!ref) return null;
+    const node = unwrap(ref.node);
+    if (node && ts.isCallExpression(node)) {
+      const factory = lazyFactory(node, ref.module),
+        callback = factory && functionNode(factory.node),
+        body = callback && unwrap(returned(callback));
+      if (
+        body &&
+        !callback.asteriskToken &&
+        !callback.parameters.length &&
+        ts.isCallExpression(body) &&
+        body.expression.kind === ts.SyntaxKind.ImportKeyword &&
+        body.arguments.length === 1
+      ) {
+        const specifier = string(body.arguments[0], factory.module),
+          target =
+            typeof specifier === "string" &&
+            resolveModule(factory.module.file, specifier);
+        const resolved = target && resolveBinding(target, target.defaultName);
+        if (resolved)
+          return { ...resolved, lazy: true, wrapped: factory.wrapped };
+      }
+    }
+    return ref;
+  }
+  return { reference, string, component };
+}

package/src/tanstack-routes.mjs

@@ -0,0 +1,143 @@
+/** Generated file-route graphs only: read the registered tree, never execute a router. */
+export function tanstackRoutes({ discoveryModules, ts, resolution, gap, component, add, externalImport }) {
+  let routers = 0;
+  const unwrap = node => {
+    while (node && (ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isSatisfiesExpression(node) || ts.isNonNullExpression(node))) node = node.expression;
+    return node;
+  };
+  const fail = message => { throw Error("TanStack route adapter: " + message); };
+  function ref(node, module) {
+    const resolved = resolution.reference(node, module);
+    if (!resolved) fail("unresolved or cyclic source reference");
+    return resolved;
+  }
+  function fields(node, module) {
+    const resolved = ref(node, module);
+    node = resolved.node;
+    if (!ts.isObjectLiteralExpression(node) || node.properties.some(p => !(ts.isPropertyAssignment(p) || ts.isShorthandPropertyAssignment(p) || ts.isMethodDeclaration(p)) || ts.isComputedPropertyName(p.name))) fail("configuration must be a literal record without spreads or getters");
+    const values = new Map();
+    for (const property of node.properties) {
+      if (values.has(property.name.text)) fail("duplicate configuration field");
+      values.set(property.name.text, ts.isShorthandPropertyAssignment(property) ? property.name : ts.isMethodDeclaration(property) ? property : property.initializer);
+    }
+    return { module: resolved.module, node, values };
+  }
+  function returned(node) {
+    node = unwrap(node);
+    if (!node || !(ts.isArrowFunction(node) || ts.isFunctionExpression(node)) || node.parameters.length) fail("parent must be a parameterless source callback");
+    if (!ts.isBlock(node.body)) return node.body;
+    if (node.body.statements.length === 1 && ts.isReturnStatement(node.body.statements[0])) return node.body.statements[0].expression;
+    fail("parent callback is not a direct return");
+  }
+  function identity(node, module, depth = 0) {
+    if (depth > 32) fail("route reference budget exceeded");
+    const resolved = ref(node, module);
+    node = resolved.node; module = resolved.module;
+    if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression) && ["update", "_addFileChildren", "_addFileTypes"].includes(node.expression.name.text)) return identity(node.expression.expression, module, depth + 1);
+    return module.file + ":" + node.pos + ":" + node.end;
+  }
+  function graph(node, module, seen = new Set()) {
+    const resolved = ref(node, module);
+    node = resolved.node; module = resolved.module;
+    const key = module.file + ":" + node.pos + ":" + node.end;
+    if (seen.has(key) || seen.size > 32) fail("cyclic or excessive route graph");
+    seen = new Set([...seen, key]);
+    if (!ts.isCallExpression(node)) fail("route graph is not a supported source declaration");
+    if (ts.isPropertyAccessExpression(node.expression)) {
+      const method = node.expression.name.text;
+      if (method === "_addFileTypes" && !node.arguments.length) return graph(node.expression.expression, module, seen);
+      if (method === "_addFileChildren" && node.arguments.length === 1) {
+        const parent = graph(node.expression.expression, module, seen), children = fields(node.arguments[0], module);
+        if (parent.children.length) fail("route children registered more than once");
+        parent.children = [...children.values.values()].map(child => graph(child, children.module, seen));
+        return parent;
+      }
+      if (method === "update" && node.arguments.length === 1) {
+        const original = graph(node.expression.expression, module, seen), config = fields(node.arguments[0], module);
+        if (original.root || original.updated || original.children.length) fail("unexpected route update");
+        if ([...config.values.keys()].some(key => !["id", "path", "getParentRoute"].includes(key))) fail("unsupported generated update field");
+        const routeId = resolution.string(config.values.get("id"), config.module);
+        if (!routeId || !config.values.has("getParentRoute")) fail("route update needs a static id and parent");
+        original.parent = identity(returned(config.values.get("getParentRoute")), config.module);
+        original.path = config.values.has("path") ? resolution.string(config.values.get("path"), config.module) : undefined;
+        if (config.values.has("path") && original.path === undefined) fail("dynamic generated path");
+        original.updated = true;
+        original.id = routeId;
+        original.routeModule = module;
+        original.routeNode = node;
+        return original;
+      }
+      fail("unsupported graph method " + method);
+    }
+    let factory = node.expression, options = node.arguments[0], root = false, sourceId = "$root";
+    if (ts.isCallExpression(factory)) {
+      const creator = externalImport(module, factory.expression.getText(module.source));
+      if (creator?.specifier !== "@tanstack/react-router") fail("unrecognized route factory");
+      if (creator.name === "createFileRoute") {
+        if (factory.arguments.length !== 1 || resolution.string(factory.arguments[0], module) === undefined) fail("file route identity must be static");
+        sourceId = resolution.string(factory.arguments[0], module);
+      } else if (creator.name === "createRootRouteWithContext" && !factory.arguments.length) root = true;
+      else fail("unsupported route factory");
+    } else {
+      const creator = externalImport(module, factory.getText(module.source));
+      if (creator?.specifier !== "@tanstack/react-router" || creator.name !== "createRootRoute") fail("unrecognized root factory");
+      root = true;
+    }
+    if (node.arguments.length !== 1) fail("route factory needs one source configuration");
+    const config = fields(options, module);
+    if (["id", "path", "getParentRoute"].some(key => config.values.has(key))) fail("file-route URL configuration must come from the generated update");
+    if ([...config.values.keys()].some(key => ["loader", "beforeLoad", "validateSearch", "errorComponent", "notFoundComponent", "pendingComponent"].includes(key))) gap("ROUTE_DATA_UNOBSERVED", module.file, "TanStack loaders, guards, search and error states are not executed");
+    return { key: identity(node, module), root, sourceId, config, children: [], routeModule: module, routeNode: node };
+  }
+  function pathOf(parent, child) {
+    if (child === undefined) return parent;
+    if (/[?#\\\s]/.test(child) || child.split("/").some(part => part === "." || part === "..")) fail("invalid generated path");
+    const segments = child.split("/").filter(Boolean).map(part => {
+      if (part === "$") return "*";
+      if (/^\$[A-Za-z_][A-Za-z0-9_]*$/.test(part)) return ":" + part.slice(1);
+      if (/[$\[\]{}()*:]/.test(part)) fail("unsupported parameter pattern");
+      return part;
+    });
+    return (parent.replace(/\/$/, "") + "/" + segments.join("/")).replace(/\/$/, "") || "/";
+  }
+  function project(root) {
+    const registered = new Set();
+    function walk(route, parent, path, ancestors, depth = 0) {
+      if (depth > 16 || registered.size >= 200 || registered.has(route.key)) fail("duplicate, cyclic or excessive registered route");
+      registered.add(route.key);
+      if (parent ? route.root || !route.updated || route.parent !== parent.key : !route.root) fail("registered parent does not match generated parent");
+      const publicPath = pathOf(path, route.path);
+      // Use source route identity, not the public URL, for inline layout symbols.
+      const target = component(route.config.values.get("component"), route.config.module, "$tanstack:" + route.config.module.file + ":" + route.sourceId);
+      let indexAtPath = false;
+      const childIds = new Set();
+      for (const child of route.children) {
+        if (childIds.has(child.id)) fail("duplicate generated child id");
+        childIds.add(child.id);
+      }
+      for (const child of route.children) indexAtPath = walk(child, route, publicPath, target ? [...ancestors, target] : ancestors, depth + 1) || indexAtPath;
+      const ownsPath = route.root || route.path !== undefined;
+      if (ownsPath && !indexAtPath && target) add(route.routeModule, route.routeNode, publicPath, target, ancestors);
+      if (ownsPath && !target && !route.children.length) gap("ROUTE_COMPONENT_UNSUPPORTED", route.config.module.file, "TanStack route without an inspectable component");
+      return ownsPath && publicPath === path || indexAtPath && publicPath === path;
+    }
+    walk(root, null, "/", []);
+  }
+  for (const module of discoveryModules.values()) {
+    function visit(node) {
+      if (ts.isCallExpression(node)) {
+        const imported = externalImport(module, node.expression.getText(module.source));
+        if (imported?.specifier === "@tanstack/react-router" && imported.name === "createRouter") {
+          if (++routers > 1) fail("multiple router authorities require one explicit entry");
+          const options = fields(node.arguments[0], module);
+          if (node.arguments.length !== 1 || !options.values.has("routeTree") || ["basepath", "history", "rewrite", "trailingSlash"].some(key => options.values.has(key))) fail("custom URL routing requires a separate adapter");
+          project(graph(options.values.get("routeTree"), options.module));
+          return;
+        }
+      }
+      ts.forEachChild(node, visit);
+    }
+    visit(module.source);
+  }
+  return routers;
+}

package/src/transform.mjs

@@ -1,6 +1,6 @@
 import MagicString from "magic-string";
 import { dependency } from "./dependencies.mjs";
-import { automaticSourceAnchors, instrumentableSource } from "./anchors.mjs";
+import { automaticSourceAnchors, instrumentableSource, sourceScriptKind } from "./anchors.mjs";
 
 /** Adds build-only anchors without editing merchant source or evaluating any expression. */
 export function transformSourceForIam(code, file) {
@@ -12,7 +12,7 @@ export function transformSourceForIam(code, file) {
     code,
     ts.ScriptTarget.Latest,
     true,
-    /\.jsx?$/.test(file) ? ts.ScriptKind.JSX : ts.ScriptKind.TSX,
+    sourceScriptKind(file, ts),
   );
   if (source.parseDiagnostics.length)
     throw new Error("IAM cannot instrument invalid source: " + file);

package/src/upload.mjs

@@ -2,10 +2,13 @@ import { repositoryCommit } from "./git-metadata.mjs";
 import { randomUUID } from "node:crypto";
 
 export const DEFAULT_BASE_URL = "https://tinker.cash";
+/** One App environment can hold several clients (named builds); each has its own current version. */
+export const DEFAULT_CLIENT = "web";
+const CLIENT_KEY = /^[a-z][a-z0-9-]{0,39}$/;
 const SIGNED_UPLOAD_ORIGIN = "https://storage.googleapis.com";
 
-/** The build's upload settings: the key and API origin come from options or the build environment. */
-export function uploadSettings({ apiKey, baseUrl, upload = "production" } = {}, env = process.env) {
+/** The build's upload settings: the key, client and API origin come from options or the build environment. */
+export function uploadSettings({ apiKey, baseUrl, upload = "production", client } = {}, env = process.env) {
   const key = apiKey ?? env.INDIANA_IAM_KEY ?? "";
   const mode = upload === true ? "always" : upload;
   const enabled =
@@ -13,7 +16,13 @@ export function uploadSettings({ apiKey, baseUrl, upload = "production" } = {},
     mode !== false &&
     // On Vercel only production deployments upload; preview builds would keep switching the current version.
     (mode === "always" || !env.VERCEL_ENV || env.VERCEL_ENV === "production");
-  return { enabled, apiKey: key, baseUrl: baseUrl ?? env.INDIANA_IAM_BASE_URL ?? DEFAULT_BASE_URL, missingKey: !key };
+  return {
+    enabled,
+    apiKey: key,
+    baseUrl: baseUrl ?? env.INDIANA_IAM_BASE_URL ?? DEFAULT_BASE_URL,
+    client: client ?? env.INDIANA_IAM_CLIENT ?? DEFAULT_CLIENT,
+    missingKey: !key,
+  };
 }
 
 /** A short version label: the commit being built when the CI or git exposes it. */
@@ -35,19 +44,32 @@ async function failure(response, step) {
 /**
  * Uploads one generated IAM to Indiana: register, PUT the bytes to the server-signed URL,
  * then let the server verify them. The key needs only the app-manifests:write permission;
- * the uploaded (or redeployed) version becomes the App environment's current version.
+ * the uploaded (or redeployed) version becomes its client's current version.
  */
-export async function uploadAppManifest({ serialized, digest, label, apiKey, baseUrl = DEFAULT_BASE_URL, fetch = globalThis.fetch }) {
+export async function uploadAppManifest({
+  serialized,
+  digest,
+  label,
+  client = DEFAULT_CLIENT,
+  apiKey,
+  baseUrl = DEFAULT_BASE_URL,
+  fetch = globalThis.fetch,
+}) {
   if (!apiKey) throw new Error("IAM upload needs a key with the app-manifests:write permission");
   const base = new URL(baseUrl);
   if (base.protocol !== "https:" && !["localhost", "127.0.0.1", "[::1]"].includes(base.hostname))
     throw new Error("IAM upload needs an https Indiana origin");
+  if (!CLIENT_KEY.test(client))
+    throw new Error("IAM client must be 1-40 lowercase letters, digits or hyphens, starting with a letter");
+  // The server checks the stored file declares this same platform before the version becomes current.
+  const platforms = JSON.parse(serialized)?.app?.platforms;
+  if (!Array.isArray(platforms) || platforms.length !== 1) throw new Error("IAM upload needs a manifest for exactly one platform");
   const bytes = Buffer.from(serialized);
   const authorization = { Authorization: "Bearer " + apiKey };
   const registered = await fetch(new URL("/api/iam/versions", base), {
     method: "POST",
     headers: { ...authorization, "Content-Type": "application/json" },
-    body: JSON.stringify({ requestId: randomUUID(), label, sha256: digest, bytes: bytes.byteLength }),
+    body: JSON.stringify({ requestId: randomUUID(), client, platform: platforms[0], label, sha256: digest, bytes: bytes.byteLength }),
     signal: AbortSignal.timeout(60_000),
   });
   if (!registered.ok) throw await failure(registered, "registration");

package/src/validate.mjs

@@ -1,3 +1,4 @@
+import { documentDom, assertDomBudget } from "./dom-payload.mjs";
 import { loadTrustedRuntimes } from "./runtime-asset.mjs";
 export { parseManifest } from "./json.mjs";
 import { dependency } from "./dependencies.mjs";
@@ -31,6 +32,14 @@ export async function validate(manifest) {
   const verifiedSelectors = new Map();
   canonical(manifest);
   assertManifestShape(manifest);
+  assertDomBudget(manifest.documents);
+  if (manifest.documents.some(doc => doc.domPayload)) assertManifestShape({
+    ...manifest,
+    documents: manifest.documents.map(doc => {
+      const { domPayload, ...body } = doc;
+      return { ...body, ...documentDom(doc) };
+    }),
+  });
   const map = (values, key) => {
     const result = new Map(values.map((v) => [v[key], v]));
     if (result.size !== values.length) throw new Error("Duplicate " + key);
@@ -57,7 +66,7 @@ export async function validate(manifest) {
     if (!components.has(element.componentKey))
       throw new Error("Missing element component");
   }
-  if (["react-router", "react-spa"].includes(manifest.routing.framework)) {
+  if (["react-router", "react-spa", "tanstack-router"].includes(manifest.routing.framework)) {
     if (manifest.routing.basePath || manifest.routing.trailingSlash || manifest.routing.routeSources?.length !== pages.size)
       throw Error("React route provenance is incomplete");
     for (const row of manifest.routing.routeSources) {
@@ -121,10 +130,11 @@ export async function validate(manifest) {
       throw new Error("Document hash mismatch");
     const fullNodes=documentNodes(doc);
     if (doc.sourceMappingsHash !== sourceMappingsHash(fullNodes, elements)) throw new Error('Source mapping hash mismatch');
-    expandedDocuments.push({...doc,nodes:fullNodes});
+    const decoded = documentDom(doc);
+    expandedDocuments.push({...doc,html:decoded.html,nodes:fullNodes});
     const nodes = map(fullNodes, "nodeId");
     const dom = new JSDOM(
-      "<!doctype html><html><body>" + doc.html + "</body></html>",
+      "<!doctype html><html><body>" + decoded.html + "</body></html>",
     );
     try {
     const document = dom.window.document;
@@ -277,7 +287,7 @@ export async function validate(manifest) {
     components: components.size,
     elements: elements.size,
     documents: docs.size,
-    concreteNodes: manifest.documents.reduce((n, d) => n + d.nodes.length, 0),
+    concreteNodes: expandedDocuments.reduce((n, d) => n + d.nodes.length, 0),
     runtimeObserved: manifest.coverage.runtimeObserved,
     routeTree,
   };

package/src/vite.d.ts

@@ -6,7 +6,10 @@ export declare function indianaIam(options?: IndianaIamBuildOptions): {
   name: "indiana-iam";
   apply: "build";
   enforce: "pre";
-  transform(code: string, id: string): IamSourceTransform | null;
+  transform: {
+    order: "pre";
+    handler(code: string, id: string): IamSourceTransform | null;
+  };
   config(config: {
     root?: string;
     build?: { ssr?: unknown };