@ultimat3/cli 27.8.0 → 27.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/cli",
-  "version": "27.8.0",
+  "version": "27.8.1",
   "description": "The `x` binary: new, dev, build, verify, generate, db, mcp, doctor, deploy",
   "license": "MIT",
   "type": "module",
@@ -39,33 +39,33 @@
   },
   "dependencies": {
     "@babel/core": "^8.0.1",
-    "@ultimat3/action": "27.8.0",
-    "@ultimat3/admin": "27.8.0",
-    "@ultimat3/ai": "27.8.0",
-    "@ultimat3/auth": "27.8.0",
-    "@ultimat3/cache": "27.8.0",
-    "@ultimat3/core": "27.8.0",
-    "@ultimat3/db": "27.8.0",
-    "@ultimat3/entity": "27.8.0",
-    "@ultimat3/flags": "27.8.0",
-    "@ultimat3/http": "27.8.0",
-    "@ultimat3/i18n": "27.8.0",
-    "@ultimat3/jobs": "27.8.0",
-    "@ultimat3/mail": "27.8.0",
-    "@ultimat3/manifest": "27.8.0",
-    "@ultimat3/mcp": "27.8.0",
-    "@ultimat3/money": "27.8.0",
-    "@ultimat3/notify": "27.8.0",
-    "@ultimat3/policy": "27.8.0",
-    "@ultimat3/pwa": "27.8.0",
-    "@ultimat3/query": "27.8.0",
-    "@ultimat3/realtime": "27.8.0",
-    "@ultimat3/render": "27.8.0",
-    "@ultimat3/schema": "27.8.0",
-    "@ultimat3/seo": "27.8.0",
-    "@ultimat3/storage": "27.8.0",
-    "@ultimat3/testing": "27.8.0",
-    "@ultimat3/time": "27.8.0",
+    "@ultimat3/action": "27.8.1",
+    "@ultimat3/admin": "27.8.1",
+    "@ultimat3/ai": "27.8.1",
+    "@ultimat3/auth": "27.8.1",
+    "@ultimat3/cache": "27.8.1",
+    "@ultimat3/core": "27.8.1",
+    "@ultimat3/db": "27.8.1",
+    "@ultimat3/entity": "27.8.1",
+    "@ultimat3/flags": "27.8.1",
+    "@ultimat3/http": "27.8.1",
+    "@ultimat3/i18n": "27.8.1",
+    "@ultimat3/jobs": "27.8.1",
+    "@ultimat3/mail": "27.8.1",
+    "@ultimat3/manifest": "27.8.1",
+    "@ultimat3/mcp": "27.8.1",
+    "@ultimat3/money": "27.8.1",
+    "@ultimat3/notify": "27.8.1",
+    "@ultimat3/policy": "27.8.1",
+    "@ultimat3/pwa": "27.8.1",
+    "@ultimat3/query": "27.8.1",
+    "@ultimat3/realtime": "27.8.1",
+    "@ultimat3/render": "27.8.1",
+    "@ultimat3/schema": "27.8.1",
+    "@ultimat3/seo": "27.8.1",
+    "@ultimat3/storage": "27.8.1",
+    "@ultimat3/testing": "27.8.1",
+    "@ultimat3/time": "27.8.1",
     "babel-preset-solid": "^1.9.15"
   }
 }

package/src/runtime-address.ts

@@ -0,0 +1,16 @@
+// The URL a SHARED document (`static`, `isr`) is rendered at and kept under: the request's own, at
+// the one spelling of the address the router matched. The router answers `/about/`, `//about` and
+// `/%61bout` with one page; a document one visitor's spelling rendered and the next visitor is
+// answered must not carry the first one's spelling in its `canonical`, nor be kept once per spelling.
+
+import type { RequestContext } from '@ultimat3/http';
+import { requestAddress } from '@ultimat3/http';
+
+/** `url` with its pathname respelled (`requestAddress`); unchanged before a route matched. */
+export function addressedUrl(url: URL, ctx: RequestContext): URL {
+  const address = requestAddress(ctx);
+  if (address === undefined || address.pathname === url.pathname) return url;
+  const at = new URL(url);
+  at.pathname = address.pathname;
+  return at;
+}

package/src/runtime-isr-outcome.ts

@@ -4,11 +4,11 @@
 
 import { logger } from '@ultimat3/core';
 import type { RedirectIntent, RequestContext, RouteParams } from '@ultimat3/http';
-import { asCtx, takeRedirect } from '@ultimat3/http';
+import { asCtx, requestAddress, takeRedirect } from '@ultimat3/http';
 import type { RenderResult, RouteData, RouteEntry } from '@ultimat3/render';
-import { routeDataFor, routeNoStoreOf, routeStatusOf } from '@ultimat3/render';
+import { describePages, routeDataFor, routeNoStoreOf, routeStatusOf } from '@ultimat3/render';
 import type { IsrController, IsrEntry } from '@ultimat3/render/server';
-import { isrKey, isrRequestUrl, undeclaredQuery } from '@ultimat3/render/server';
+import { isrKey, isrRequestUrl, isrRouteFor, undeclaredQuery } from '@ultimat3/render/server';
 
 export type IsrOutcome =
   | { readonly kind: 'page'; readonly result: RenderResult }
@@ -38,15 +38,17 @@ const NAMED_PARAMS = 5;
 const NAMED_PARAM_CHARS = 40;
 
 /**
- * The request narrowed to what the route declared it varies on (`revalidate.query`). ONE narrowing
- * feeds the store key, `load`, `meta` and the page, so a parameter outside the key cannot reach
- * the document stored under it.
+ * The request narrowed to what the route declared it varies on (`revalidate.query`), AT the one
+ * spelling of its address (`pathname`). ONE narrowing feeds the store key, `load`, `meta` and the
+ * page, so neither a parameter outside the key nor the way a visitor happened to spell the path
+ * (`/blog//a/`, `/blog/%61`) can reach the document stored under it.
  *
  * A route that declared NOTHING still keys on the whole query, and is told so once, the first time
  * a visitor uses that: every distinct query string is then a render and a stored page of its own.
  */
-function keyedData(entry: RouteEntry, data: IsrData): IsrData {
+function keyedData(entry: RouteEntry, data: IsrData, pathname: string | undefined): IsrData {
   const url = new URL(data.url);
+  if (pathname !== undefined) url.pathname = pathname;
   const declared = entry.config.revalidate?.query ?? null;
   if (declared === null && !toldUndeclared.has(entry.file)) {
     const minted = undeclaredQuery(url, declared);
@@ -96,12 +98,27 @@ function dropPage(isr: IsrController, key: string): void {
  * redirected decides for itself, exactly as the static single-flight in `appRoutes` does.
  */
 export async function isrOutcome(arrived: IsrRequest): Promise<IsrOutcome> {
-  const request: IsrRequest = { ...arrived, data: keyedData(arrived.entry, arrived.data) };
+  // Where the router MATCHED this request, never where the visitor wrote it: the router answers
+  // many spellings with one page, and a key built from the raw pathname stored each of them.
+  const address = requestAddress(arrived.ctx);
+  const request: IsrRequest = {
+    ...arrived,
+    data: keyedData(arrived.entry, arrived.data, address?.pathname),
+  };
   const { entry, data, ctx, isr } = request;
   // `isrKey(url, locale)`, never `url.pathname`: the DECLARED query is part of what was rendered —
   // `meta` reads `data.url` — so two URLs differing in it are two documents (#171). The locale is
-  // `ctx.locale`, the one the `locale` stage negotiated for THIS request.
-  const key = isrKey(new URL(data.url), asCtx(ctx).locale);
+  // `ctx.locale`, the one the `locale` stage negotiated for THIS request. The key's path carries
+  // NO base path: the route table has never heard of the mount, so a key that kept it matched no
+  // route — and every `isr` page of an app under a `basePath` was stored with no ttl and no tags.
+  const keyed = new URL(data.url);
+  if (address !== undefined) keyed.pathname = address.path;
+  const key = isrKey(keyed, asCtx(ctx).locale);
+  // The key has to read back as THIS route, or its ttl, its tags and what a bust does to it are
+  // another route's or nobody's. It always does for an address the framework's URL scheme can
+  // spell; what is left is a path the router matched that another reading claims (`//en/x` is the
+  // `/:lang/x` route with no locale, and `/en/x` is the `/x` route in English). Answered, uncached.
+  if (isrRouteFor(describePages(), key)?.file !== entry.file) return ownOutcome(request);
   let decided: RedirectIntent | undefined;
   // `{ html, status }`, never the bare string: the entry stores the status beside the HTML and
   // serves it on every hit, so a 404 under `isr` is a 404 for its whole TTL.
@@ -127,9 +144,9 @@ export async function isrOutcome(arrived: IsrRequest): Promise<IsrOutcome> {
 }
 
 /**
- * A joiner whose leader's load redirected: its own `load`, answered for this request alone. A page
- * here is NOT stored — the store was just told the key has none — so it is `private, no-store`;
- * the next request to miss stores one.
+ * A request answered for itself alone: a joiner whose leader's load redirected, or one whose key
+ * is not its own route's. Its own `load`; a page here is NOT stored — the store was just told the
+ * key has none, or the key is another page's — so it is `private, no-store`.
  */
 async function ownOutcome(request: IsrRequest): Promise<IsrOutcome> {
   const loaded = await routeDataFor(request.entry.config, request.data);

package/src/runtime-render.ts

@@ -53,6 +53,7 @@ import {
   principalRelocation,
 } from './page-navigation';
 import { bootScript, collectorFor } from './route-islands';
+import { addressedUrl } from './runtime-address';
 import { attachedIsr } from './runtime-isr';
 import { isrOutcome } from './runtime-isr-outcome';
 import type { StaticResult } from './static-document';
@@ -425,7 +426,7 @@ export function appRoutes(options: DevRenderOptions): readonly Route[] {
       // A static page already rendered by this process is answered without `load` or a render.
       const key =
         options.memoStatic === true
-          ? staticMemoKey(entry, request.url, asCtx(ctx).locale)
+          ? staticMemoKey(entry, addressedUrl(request.url, ctx), asCtx(ctx).locale)
           : undefined;
       const kept = key === undefined ? undefined : memo.get(key);
       if (kept !== undefined) return staticResponse(request, kept);
@@ -461,7 +462,9 @@ async function renderEntry(
   options: DevRenderOptions,
   isr: IsrController,
 ): Promise<Rendered> {
-  const data: DevRouteData = { url: request.url.href, params: ctx.params };
+  // A `static` document is one file in the export, so it is rendered AT its one address here too.
+  const at = entry.config.render === 'static' ? addressedUrl(request.url, ctx) : request.url;
+  const data: DevRouteData = { url: at.href, params: ctx.params };
   if (entry.config.render === 'isr') return renderIsr(entry, data, ctx, options, isr);
   // ONCE per request, before the mode is chosen: every branch of `resultFor` reads this same
   // object, so a route's `load` runs exactly once however its mode splits head from body.

package/src/static-document.ts

@@ -12,9 +12,11 @@ import { etagMatches } from './runtime-storage';
 export type StaticResult = RenderResult & { readonly body: string };
 
 /**
- * The entries one process keeps. A static route has no params here and no query, so the real count
- * is routes × locales; the cap is what a forged `Host` (part of the key when the app declares no
- * origin) can cost — past it a page is rendered per request, as before, never refused.
+ * The entries one process keeps. A static route has no params here and no query, and the key's
+ * path is the request's ADDRESS (`runtime-address.ts`), never its raw pathname — `/about/`,
+ * `//about` and `/%61bout` are one entry — so the real count is routes × locales; the cap is what a
+ * forged `Host` (part of the key when the app declares no origin) can cost — past it a page is
+ * rendered per request, as before, never refused.
  */
 export const STATIC_MEMO_LIMIT = 1024;
 
@@ -77,7 +79,9 @@ export function createStaticMemo(
  * The key a request's document is kept under, or `undefined` when it must be rendered: a query
  * string is part of what `meta` reads (`data.url`), and a dynamic segment is an unbounded set an
  * anonymous visitor chooses. The origin is in the key because canonical and `og:url` are absolute
- * against the request's own when the app declares none.
+ * against the request's own when the app declares none. `url` is `addressedUrl`'s: keyed on the
+ * pathname as written, any visitor filled the memo with spellings of one page (`/about//`, …) and
+ * every page that arrived after the cap was rendered per request for the life of the process.
  */
 export function staticMemoKey(
   entry: Pick<RouteEntry, 'config' | 'pattern'>,