npm - @ultimat3/render - Versions diffs - 5.0.0 → 6.0.0 - Mend

@ultimat3/render 5.0.0 → 6.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/CLAUDE.md CHANGED Viewed

@@ -1,8 +1,8 @@
 # @ultimat3/render — boundary
-Owns: the `route` primitive, the five render modes, the route table, the surface boundary,
-islands + budgets, hydration directives, the vendored client router, `<head>` merge, **the server
-JSX runtime and the two Bun loaders that make an app's `.tsx` and `.scss` runnable**.
+Owns: the `route` primitive, the four render modes, the route table, the surface boundary,
+islands + budgets, hydration directives, `<head>` merge, **the server JSX runtime and the two Bun
+loaders that make an app's `.tsx` and `.scss` runnable**.
 `island()` is a **factory over the route's own `hydrate`**, not a ninth primitive and not a
 second render mode — the same rule `llm()` and `backfill()` follow. It adds no key to
@@ -24,7 +24,7 @@ Tier 4. May import tiers 0–3: `core`, `schema`, `i18n`, `money`, `time`, `cach
 | Descriptor `meta` / `load` | always `(x) => Promise<…>`. Authors may declare either sync; consumers never branch. |
 | Descriptor `budget` | always an object, `{}` when undeclared. Its *fields* stay optional — `budget.js === undefined` is the site/ hydration failure. |
 | No `describe()` on a route | `describeRoutes()` is the one route list. A per-route projection would be a second one. |
-| Mode invariants | `modes.ts` only. Never inline a mode check in a render-\* file. |
+| Mode invariants | `modes.ts` only. Never inline a mode check in a render-\* file. **Four modes, and every one renders the route's component** — `spa` did not, and `renderSpa` never read `entry.component`, so a `spa` route served `<div id="x-root"></div>` in every app that ever declared one. A gated page is `ssr`; a body that belongs in the browser is an `island({ src })`. A fifth mode has to name the function that renders it. |
 | Island declaration | `island({ src })` — a **specifier**, never an import. That is the whole boundary: a string has no scope to close over and no edge for a bundler or `checkSurfaceBoundary` to follow, so a `static` page's graph cannot grow the island's dependencies. Never add an overload that takes a component. |
 | Island filename | `*.island.tsx`, `ISLAND_EXTENSION` — one spelling, same rule as `page.tsx`: a module ships to the browser iff its name says so. Never widen it to accept a second, and never make it optional. |
 | Island timing | the route's `hydrate` and nothing else — derived from the declaration, never declared on the island. An island declaring its own strategy would be a second way to say "this route hydrates" (axiom 1) and a second thing `budget.js` would have to chase. `hydrate: 'never'` + an island is still `X_ISLAND_NOT_HYDRATED`, and so is an `island()` call *below* the `defineRoute` that drains it. The `fix:` names exactly ONE of the two edits — `islandNeverDrained(spec)` tells the causes apart at the throw site, and a message offering both makes half the instruction wrong for every reader. |
@@ -52,17 +52,18 @@ Tier 4. May import tiers 0–3: `core`, `schema`, `i18n`, `money`, `time`, `cach
 | `X_ROUTE_LOAD_FAILED` computes its pathname BEFORE the try | `new URL(ctx.url)` inside the catch made a relative `ctx.url` — what a prerender pass, `x build` and every test harness hand in — throw a bare `TypeError` on the one path whose job is a coded error. `pathnameOf` never throws. |
 | ISR store bound | `memoryIsrStore()` caps at `DEFAULT_ISR_MAX_ENTRIES` (1,000), least recently generated first — a route table supports `:params` and `*`, so `/blog/:slug` retains one full HTML string per slug ever requested, 404-shaped ones included. |
 | Route path from file | ONE reader of the surface segment: `locateSurface()` answers which surface AND where it starts. `registry.ts` sliced at `indexOf('app/')` instead, which matched inside `myapp/`, so every route under `apps/myapp/app/` served at `/app/…`. Never re-derive the offset from the surface NAME. |
-| An undecodable path segment | not a match, never a throw, on BOTH sides — `decodeSegment` in `registry.ts` is the one reader, imported by `router-client.ts`. The client half interpolated `decodeURIComponent` raw until 2026-08, and `resolve()` runs from the signal initialiser, from `navigate`, from a `<Link>` prefetch's `mouseenter` and from the popstate handler: `/blog/%zz` failed the SPA at BOOT where the server answers 404. `decodeURIComponent('%zz')` is a bare `URIError` — a 500 for a typo — and `@ultimat3/http`'s router already answers "this branch does not match" for the same input. A literal route matching the same text still wins. |
+| An undecodable path segment | not a match, never a throw — `decodeSegment` in `registry.ts` is the one reader. `decodeURIComponent('%zz')` is a bare `URIError`, so a typo in a path segment was a 500 where `@ultimat3/http`'s router already answers "this branch does not match". A literal route matching the same text still wins. `router-client.ts` was the second reader and went with `createRouter`. |
 | ISR registration | reconciled against `store.paths()` after every generation (`forgetEvictedPaths`). The store is bounded and evicts silently; `registered` and the cache graph behind it only ever grew, one edge per slug ever requested. Never a store callback — a custom `IsrStore` has none. |
 | Stream hole deadline | `DEFAULT_HOLE_TIMEOUT_MS` (15s), `holeTimeoutMs: null` to opt out. A hole is app code the framework `await`s and nothing else bounds it; one that never settles held the response and its whole closure open for the life of the process. A hole reveals exactly once — its promise, its rejection, or its deadline, whichever lands first. |
 | Errors | `errors.ts` subclasses only. Never a bare `Error`, never a bare `TODO`. |
 | Policy | render checks *presence* only. Evaluation belongs to `@ultimat3/policy`. |
-| A gated route is never a cached one | `modes.ts` refuses `policy` on BOTH `static` and `isr` (`X_ROUTE_MODE_INVALID`, `modes.test.ts`). `isr` was not refused until 2026-08 and `dev-render.ts` keys the cache on `url.pathname` alone — no actor, no query string — so a gated ISR route rendered the first actor's document and served it to every later actor who passed the same policy. Keying on more is a trap, not a fix: the key would have to enumerate everything a `policy` and a `load` can read. `ssr` is fresh-and-gated, `spa` is a gated shell. |
+| A gated route is never a cached one | `modes.ts` refuses `policy` on BOTH `static` and `isr` (`X_ROUTE_MODE_INVALID`, `modes.test.ts`). `isr` was not refused until 2026-08 and `dev-render.ts` keys the cache on `url.pathname` alone — no actor, no query string — so a gated ISR route rendered the first actor's document and served it to every later actor who passed the same policy. Keying on more is a trap, not a fix: the key would have to enumerate everything a `policy` and a `load` can read. `ssr` is the one gated mode there is. |
 | Responses | return `RenderResult`. `@ultimat3/http` builds the `Response`. |
-| Solid | no `solid-js` import anywhere in this package — `type-pins.tsx` satisfies its `JSX.Element` structurally, through `jsxImportSource`, and never names it. Inject primitives. The JSX factory in `jsx.ts` builds inert nodes — it is not a Solid renderer and must never become one. |
+| Solid | no `solid-js` import anywhere in this package — `type-pins.tsx` satisfies its `JSX.Element` structurally, through `jsxImportSource`, and never names it. The JSX factory in `jsx.ts` builds inert nodes — it is not a Solid renderer and must never become one. The client half runs in an island chunk, which `@ultimat3/cli`'s `solid-loader.ts` compiles with `babel-preset-solid`: Solid's reactivity is a COMPILE-time contract, so nothing this package could inject would substitute for it. `router-client.ts` was the one file built on that premise ("inject primitives") and it never had a caller. |
+| Root element | `ROOT_ELEMENT_ID` (`render-html.ts`), the id every document's body wraps its component in. It was `SPA_ROOT_ID` in `render-spa.ts`, naming a mode that never used it and that no longer exists. |
 | The loaders | `module-loader.ts` installs them at `index.ts` module scope, once. A plugin only affects modules loaded after it, so a second install point is a page that renders in one entry point and not another. |
 | `<head>` baseline | `documentBaseline()` in `head.ts` — charset, viewport, `color-scheme` — merged FIRST so a route can still override any of them. Absent until `As of 2026-08`, and the missing `viewport` is why every deployed app rendered zoomed-out on a phone whatever its CSS said. |
-| Escaping | `html.ts` only, and that now includes `render-stream.ts` (`holeMarker`'s attribute, and `revealChunk`'s `$X(...)` argument via `JSON.stringify` — an id containing `")` closed the call and ran the rest), `render-spa.ts` (`lang`, `dir`, `buildId`, `rootId`, every chunk url) and `head.ts`'s `themeScript` (`storageKey`/`attribute` as JS string LITERALS). All author-controlled today — the identical status `emitIslandAttributes` had before the last sweep. `lang` is safe on the framework's own path (`currentLocale()` normalises against the configured `supported` list) and is escaped anyway, because `renderSpaShell` is a public export and a caller supplies it directly. A second escaper is how one of them ends up missing a character, and a missing character in an attribute is an injection. `head.ts` and `hydrate.ts` each had a private copy; both now import — `escapeAttribute` for every attribute value (`emitIslandAttributes` interpolated all five of its own raw until 2026-08, while this row already claimed otherwise) and `escapeJsonContent` for a JSON script body. |
+| Escaping | `html.ts` only, and that now includes `render-stream.ts` (`holeMarker`'s attribute, and `revealChunk`'s `$X(...)` argument via `JSON.stringify` — an id containing `")` closed the call and ran the rest) and `head.ts`'s `themeScript` (`storageKey`/`attribute` as JS string LITERALS). All author-controlled today — the identical status `emitIslandAttributes` had before the last sweep. `render-spa.ts` was the third entry here and went with the mode. A second escaper is how one of them ends up missing a character, and a missing character in an attribute is an injection. `head.ts` and `hydrate.ts` each had a private copy; both now import — `escapeAttribute` for every attribute value (`emitIslandAttributes` interpolated all five of its own raw until 2026-08, while this row already claimed otherwise) and `escapeJsonContent` for a JSON script body. |
 | Script and style CONTENT | never emitted raw. Three rules, one choice: HTML text (`escapeText`), raw text for code (`escapeRawTextContent`: `</` → `<\/`, `<!--` → `<\!--`), and the total JSON rule for a `type` ending in `json` (`escapeJsonContent`: `<`, `>`, `&`, U+2028/9 → `\uXXXX`, still valid JSON). `meta.ld` is built from route data, and it was emitted VERBATIM until `As of 2026-08` — a title could close the element. Never HTML-escape a script body: a character reference is not decoded there, so `&lt;` corrupts the code AND leaves the hole. |
 | Which export is the page | `route-component.ts`, one precedence: `Page` → a single `…Page` → a single capitalised function. Never a per-generator name table. |
 | Stylesheets | compiled by `css-modules.ts` and served **inlined** per surface. `sass` is this package's only third-party dependency and its only reason to exist here. |

package/README.md CHANGED Viewed

@@ -1,6 +1,6 @@
 # 🖼 @ultimat3/render
-The `route` primitive and the five render modes.
+The `route` primitive and the four render modes.
 | Mode | Behavior | Use |
 |---|---|---|
@@ -8,11 +8,10 @@ The `route` primitive and the five render modes.
 | `isr` | static + background regen on tag/TTL | catalogs, profiles |
 | `ssr` | per-request full render | fresh SEO pages |
 | `stream` | static shell flushed instantly, holes streamed | **default for app pages** |
-| `spa` | shell only, client fetches | dashboards behind auth |
 ```ts
 export const config = defineRoute({
-  render:     'isr',                  // static | isr | ssr | stream | spa
+  render:     'isr',                  // static | isr | ssr | stream
   revalidate: { tags: [tag.post] },
   prerender:  () => db.posts.slugs(),
   offline:    'precache',             // precache | runtime | network-only
@@ -104,9 +103,8 @@ a hydrating `site/` route below.
 | `isr` | needs a trigger: `revalidate.tags` or `revalidate.ttl`; **no `policy`** — one cached document per URL cannot answer two actors | `X_ROUTE_MODE_INVALID` |
 | `ssr` | cannot be prerendered | `X_ROUTE_MODE_INVALID` |
 | `stream` | at least one `<Suspense>` boundary | `X_ROUTE_MODE_INVALID` |
-| `spa` | requires a `policy` (authed dashboards only) | `X_ROUTE_MODE_INVALID` |
-Plus surface rules: `site/` allows `static | isr | ssr`, `app/` allows `stream | spa | ssr`,
+Plus surface rules: `site/` allows `static | isr | ssr`, `app/` allows `stream | ssr`,
 `api/` renders nothing, and a `site/` route that opts into hydration without a `budget.js`
 is a build error.
@@ -284,10 +282,9 @@ would paper over the contradiction.
 | `checkSurfaceBoundary`, `assertSurfaceBoundary`, `surfaceOf` | the hard boundary |
 | `renderStatic`, `enumeratePrerender` | build-time render, content hashing |
 | `createIsrController`, `invalidateAndRevalidate` | SWR + single-flight + tag triggers |
-| `renderSsr`, `streamResult`, `renderSpa` | the per-request modes |
+| `renderSsr`, `streamResult` | the per-request modes |
 | `emitIslandAttributes`, `hydrateRuntime` | the four hydration strategies |
 | `graphFor`, `checkBudget`, `assertBudget` | two bundle graphs, per-route budgets |
-| `createRouter` | the vendored client router |
 | `mergeHead`, `renderHead`, `themeScript` | `<head>` merge + the one inlined script |
 ## Notes
@@ -311,7 +308,11 @@ would paper over the contradiction.
 - **`hydrate: 'never'`** emits no attributes beyond the marker and no runtime — the `site/`
   0kb default is mechanical, not aspirational. A page that renders an island anyway is
   `X_ISLAND_NOT_HYDRATED`, not a silently dead button.
-- **The client router is vendored** rather than depending on a moving SolidStart alpha. It
-  imports no `solid-js`: reactive primitives and the DOM host are injected.
+- **A gated page is `ssr`**, never a client-rendered shell. `spa` and `createRouter` were
+  deleted `As of 2026-08-20`: `renderSpa` never read the route's component and no build ever produced the
+  `chunks` it preloaded, so every `spa` route served an empty `<div id="x-root">`, and the router
+  that shell would have needed had no caller in the framework or in either tracked app. A page
+  whose body belongs in the browser declares `island({ src })` — one interactivity model, one
+  bundler entry point, one budget measured against real bytes.
 - `@ultimat3/http`'s `html()` / `stream()` turn a `RenderResult` into a `Response`; render
   never constructs one.

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/render",
-  "version": "5.0.0",
+  "version": "6.0.0",
   "description": "The route primitive and the five render modes: static, isr, ssr, stream, spa.",
   "license": "MIT",
   "type": "module",
@@ -31,10 +31,10 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/cache": "5.0.0",
-    "@ultimat3/core": "5.0.0",
-    "@ultimat3/i18n": "5.0.0",
-    "@ultimat3/seo": "5.0.0",
+    "@ultimat3/cache": "6.0.0",
+    "@ultimat3/core": "6.0.0",
+    "@ultimat3/i18n": "6.0.0",
+    "@ultimat3/seo": "6.0.0",
     "sass": "1.102.0"
   }
 }

package/src/index.ts CHANGED Viewed

@@ -120,7 +120,7 @@ export {
   routePathFromFile,
 } from './registry';
 export type { RenderHtmlOptions } from './render-html';
-export { renderComponent, renderToHtml } from './render-html';
+export { ROOT_ELEMENT_ID, renderComponent, renderToHtml } from './render-html';
 export type {
   IsrController,
   IsrControllerOptions,
@@ -138,8 +138,6 @@ export {
   isrKey,
   memoryIsrStore,
 } from './render-isr';
-export type { SpaShell, SpaShellInput } from './render-spa';
-export { renderSpa, renderSpaShell, SPA_ROOT_ID } from './render-spa';
 export type { SsrOptions, SsrRenderFn, SsrRenderInput } from './render-ssr';
 export { renderSsr, ssrHeaders } from './render-ssr';
 export type { StaticArtifact, StaticBuildOptions, StaticRenderFn } from './render-static';
@@ -195,19 +193,6 @@ export {
 export type { RouteComponent } from './route-component';
 export { pageComponentOf } from './route-component';
 export { metaContextFor, routeDataFor } from './route-data';
-export type {
-  NavigateOptions,
-  NavigationGuard,
-  PrefetchContainer,
-  PrefetchLink,
-  ReactivePrimitives,
-  ResolvedRoute,
-  Router,
-  RouterHost,
-  RouterOptions,
-  RouterRoute,
-} from './router-client';
-export { createRouter } from './router-client';
 export type {
   BoundaryRule,
   BoundaryViolation,

package/src/modes.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
- * The five render modes as a table of invariants, checked at registration.
+ * The four render modes as a table of invariants, checked at registration.
  * Each mode has properties the framework can rely on; a config that contradicts one is
  * rejected with `X_ROUTE_MODE_INVALID` and the exact edit that fixes it. A mode whose
  * invariant is only documented is a mode that silently degrades in production.
@@ -12,7 +12,7 @@ import { HYDRATE_STRATEGIES } from './route';
 import type { Surface } from './surfaces';
 import { SURFACE_SPECS, surfaceAllows } from './surfaces';
-export const RENDER_MODES = ['static', 'isr', 'ssr', 'stream', 'spa'] as const;
+export const RENDER_MODES = ['static', 'isr', 'ssr', 'stream'] as const;
 /**
  * Everything about a route except the two keys carrying its data generic. Mode invariants never
@@ -35,8 +35,6 @@ export interface ModeSpec {
   readonly needsRevalidate: boolean;
   /** Does the mode need at least one `<Suspense>` boundary to mean anything? */
   readonly needsSuspense: boolean;
-  /** Does the mode need a `policy` (it renders no data, so the shell must be gated)? */
-  readonly needsPolicy: boolean;
   readonly description: string;
 }
@@ -47,7 +45,6 @@ export const MODE_SPECS: Readonly<Record<RenderMode, ModeSpec>> = Object.freeze(
     prerenderable: true,
     needsRevalidate: false,
     needsSuspense: false,
-    needsPolicy: false,
     description: 'built once, served as a file',
   },
   isr: {
@@ -56,7 +53,6 @@ export const MODE_SPECS: Readonly<Record<RenderMode, ModeSpec>> = Object.freeze(
     prerenderable: true,
     needsRevalidate: true,
     needsSuspense: false,
-    needsPolicy: false,
     description: 'static + background regen on tag/TTL',
   },
   ssr: {
@@ -65,7 +61,6 @@ export const MODE_SPECS: Readonly<Record<RenderMode, ModeSpec>> = Object.freeze(
     prerenderable: false,
     needsRevalidate: false,
     needsSuspense: false,
-    needsPolicy: false,
     description: 'per-request full render',
   },
   stream: {
@@ -74,18 +69,8 @@ export const MODE_SPECS: Readonly<Record<RenderMode, ModeSpec>> = Object.freeze(
     prerenderable: false,
     needsRevalidate: false,
     needsSuspense: true,
-    needsPolicy: false,
     description: 'static shell flushed instantly, holes streamed',
   },
-  spa: {
-    mode: 'spa',
-    perRequestState: false,
-    prerenderable: true,
-    needsRevalidate: false,
-    needsSuspense: false,
-    needsPolicy: true,
-    description: 'shell only, client fetches',
-  },
 });
 /** Mode-local checks that need nothing but the config. Called by `defineRoute`. */
@@ -116,7 +101,7 @@ export function assertModeShape(config: RouteShape): void {
     throw new RouteModeInvalidError(
       "render: 'static' cannot read per-request state, but a `policy` was declared " +
         `(${config.policy.permission} needs an actor)`,
-      "change render to 'ssr' (fresh, gated) or 'spa' (gated shell), or drop the policy",
+      "change render to 'ssr' — per-request and gated — or drop the policy",
     );
   }
   if (config.render === 'static' && config.revalidate !== undefined) {
@@ -135,7 +120,7 @@ export function assertModeShape(config: RouteShape): void {
     throw new RouteModeInvalidError(
       "render: 'isr' caches one document per URL and cannot be gated, but a `policy` was " +
         `declared (${config.policy.permission} varies the answer per actor)`,
-      "change render to 'ssr' (fresh, gated) or 'spa' (gated shell), or drop the policy",
+      "change render to 'ssr' — per-request and gated — or drop the policy",
     );
   }
@@ -154,14 +139,6 @@ export function assertModeShape(config: RouteShape): void {
       "change render to 'isr' to prerender and regenerate, or remove prerender",
     );
   }
-  // spa: the shell carries no data, so authz has to live on the route itself.
-  if (config.render === 'spa' && config.policy === undefined) {
-    throw new RouteModeInvalidError(
-      "render: 'spa' ships a shell with no server-rendered data and requires a `policy`",
-      "add policy: can('dashboard:read') — or use 'stream' for a public page",
-    );
-  }
 }
 function hasRevalidateTrigger(config: RouteShape): boolean {

package/src/registry.ts CHANGED Viewed

@@ -370,9 +370,9 @@ export function matchRoute(pathname: string): RouteMatch | null {
  * `decodeURIComponent('%zz')` throws a bare `URIError` — no code, no fix line — which escaped
  * `matchRoute` as a 500 and an error-monitor page for somebody's typo.
  *
- * Exported for `router-client.ts`, which answers the same question about the same pathname on the
- * other side of the wire: two decoders is how the client throws out of a popstate listener for an
- * address the server 404s.
+ * Still exported after `router-client.ts` went with `createRouter`: it is the one answer to "is
+ * this segment decodable?" on this side of the wire, and a second copy of it is how one of the two
+ * ends up throwing where the other 404s.
  */
 export function decodeSegment(value: string): string | undefined {
   try {

package/src/render-html.ts CHANGED Viewed

@@ -20,6 +20,13 @@ import { islandWithoutCollector } from './island-collector';
 import type { JsxComponent, JsxProps } from './jsx';
 import { isJsxNode } from './jsx';
+/**
+ * The id of the element every document wraps its route component in — one name, because a service
+ * worker, a test and a client entry all address the same element. It was `SPA_ROOT_ID` in
+ * `render-spa.ts` and named a mode that no longer exists, while every mode has always used it.
+ */
+export const ROOT_ELEMENT_ID = 'x-root';
 /** Depth is bounded so a component that renders itself fails with a cause instead of a stack trace. */
 const MAX_DEPTH = 500;

package/src/route.ts CHANGED Viewed

@@ -21,7 +21,7 @@ import type { IslandSpec } from './island';
 import { drainDeclaredIslands } from './island';
 import { assertModeShape } from './modes';
-export type RenderMode = 'static' | 'isr' | 'ssr' | 'stream' | 'spa';
+export type RenderMode = 'static' | 'isr' | 'ssr' | 'stream';
 export type OfflineStrategy = 'precache' | 'runtime' | 'network-only';
 export type HydrateStrategy = 'idle' | 'visible' | 'interaction' | 'never';

package/src/surfaces.ts CHANGED Viewed

@@ -36,7 +36,7 @@ export const SURFACE_SPECS: Readonly<Record<Surface, SurfaceSpec>> = Object.free
   app: {
     surface: 'app',
     defaultMode: 'stream',
-    allowedModes: ['stream', 'spa', 'ssr'],
+    allowedModes: ['stream', 'ssr'],
     jsBaselineBytes: 14_336,
     mayImport: ['shared'],
     mayImportTypes: ['shared', 'api'],

package/src/render-spa.ts DELETED Viewed

@@ -1,79 +0,0 @@
-/**
- * `spa` — shell only, client fetches everything. For dashboards behind auth, where the
- * shell is identical for every actor and therefore cacheable, and the data is not.
- * `modes.ts` requires a `policy` on this mode: nothing is server-rendered, so the route
- * itself is the only place authz can live.
- */
-import { RouteModeInvalidError } from './errors';
-import { escapeAttribute } from './html';
-import type { RouteEntry } from './registry';
-import { contentHash } from './render-static';
-import type { RenderResult } from './route';
-export const SPA_ROOT_ID = 'x-root';
-export interface SpaShellInput {
-  readonly entry: RouteEntry;
-  readonly buildId: string;
-  /** Everything inside `<head>`, already merged by `head.ts`. */
-  readonly head: string;
-  /** Build-id-immutable chunk URLs to preload; order is preserved for determinism. */
-  readonly chunks: readonly string[];
-  readonly rootId?: string;
-  readonly lang: string;
-  readonly dir?: 'ltr' | 'rtl';
-}
-export interface SpaShell {
-  readonly html: string;
-  readonly hash: string;
-}
-export function renderSpaShell(input: SpaShellInput): SpaShell {
-  if (input.entry.config.policy === undefined) {
-    throw new RouteModeInvalidError(
-      `${input.entry.file} declares render: 'spa' with no policy, so the shell would be public`,
-      `add policy: can('…') to ${input.entry.file}`,
-    );
-  }
-  // Every attribute value through `html.ts`'s ONE escaper — the package's own escaping rule, and
-  // the same repair `emitIslandAttributes` took. `head` is the exception by construction: it is
-  // already-merged markup from `head.ts`, which escaped it on the way in.
-  const rootId = escapeAttribute(input.rootId ?? SPA_ROOT_ID);
-  const preloads = input.chunks
-    .map((chunk) => `<link rel="modulepreload" href="${escapeAttribute(chunk)}">`)
-    .join('');
-  const scripts = input.chunks
-    .map((chunk) => `<script type="module" src="${escapeAttribute(chunk)}"></script>`)
-    .join('');
-  const html =
-    `<!doctype html><html lang="${escapeAttribute(input.lang)}" ` +
-    `dir="${escapeAttribute(input.dir ?? 'ltr')}">` +
-    `<head>${input.head}${preloads}` +
-    `<meta name="x-ultimate-build" content="${escapeAttribute(input.buildId)}">` +
-    `</head><body><div id="${rootId}"></div>${scripts}</body></html>`;
-  return { html, hash: contentHash(html) };
-}
-/**
- * The shell is identical for every actor, so it is cache-first in `sw.js` and
- * revalidate-on-navigation over HTTP. The build id in the document is what
- * `@ultimat3/pwa`'s skew detection compares against the server's.
- */
-export function renderSpa(input: SpaShellInput): RenderResult {
-  const shell = renderSpaShell(input);
-  return {
-    status: 200,
-    headers: {
-      'content-type': 'text/html; charset=utf-8',
-      'cache-control': 'private, max-age=0, must-revalidate',
-      etag: `"${shell.hash}"`,
-      'x-ultimate-build': input.buildId,
-    },
-    body: shell.html,
-  };
-}

package/src/router-client.ts DELETED Viewed

@@ -1,236 +0,0 @@
-/**
- * The minimal client router. Vendored on purpose: the router is load-bearing for every
- * app page, and a moving SolidStart alpha is not something a framework should depend on.
- *
- * No `solid-js` import — reactive primitives and the DOM are injected, so this file runs
- * under `bun test` with no DOM and no framework runtime.
- */
-import type { CompiledPattern } from './registry';
-import { compilePattern, decodeSegment } from './registry';
-import type { RouteParams } from './route';
-export interface RouterRoute {
-  readonly path: string;
-  /** Module URL for the route chunk; used by `prefetch`. */
-  readonly chunk?: string;
-}
-export interface ResolvedRoute {
-  readonly route: RouterRoute;
-  readonly params: RouteParams;
-  readonly pathname: string;
-  readonly search: string;
-}
-/** Injected instead of imported so there is no framework runtime dependency here. */
-export interface ReactivePrimitives {
-  createSignal<T>(initial: T): readonly [() => T, (next: T) => void];
-}
-export interface RouterHost {
-  readonly pathname: () => string;
-  readonly search: () => string;
-  readonly pushState: (url: string) => void;
-  readonly replaceState: (url: string) => void;
-  readonly onPopState: (handler: () => void) => void;
-  readonly scrollTo: (x: number, y: number) => void;
-  readonly scrollY: () => number;
-  /** `document.startViewTransition` when present; falls back to running the update. */
-  readonly viewTransition?: (update: () => void) => void;
-  /** Warm a chunk. Defaults to a no-op host in tests. */
-  readonly preload?: (chunk: string) => void;
-}
-export type NavigationGuard = (
-  to: ResolvedRoute,
-  from: ResolvedRoute | null,
-) => boolean | Promise<boolean>;
-export interface RouterOptions {
-  readonly routes: readonly RouterRoute[];
-  readonly host: RouterHost;
-  readonly primitives: ReactivePrimitives;
-  /** Hover dwell before prefetching, ms. */
-  readonly prefetchDelayMs?: number;
-}
-export interface NavigateOptions {
-  readonly replace?: boolean;
-  readonly scroll?: boolean;
-}
-export interface Router {
-  readonly current: () => ResolvedRoute | null;
-  readonly navigate: (to: string, options?: NavigateOptions) => Promise<boolean>;
-  readonly resolve: (url: string) => ResolvedRoute | null;
-  readonly prefetch: (to: string) => void;
-  readonly guard: (guard: NavigationGuard) => () => void;
-  /** Attach hover/visible prefetch + scroll restoration to a container element. */
-  readonly attach: (container: PrefetchContainer) => () => void;
-}
-/** Structural view of the DOM bits the router touches, so tests can fake them. */
-export type DomEventHandler = (event: { target: unknown }) => void;
-export interface PrefetchContainer {
-  querySelectorAll(selector: string): Iterable<PrefetchLink>;
-  addEventListener(type: string, handler: DomEventHandler, options?: unknown): void;
-  removeEventListener(type: string, handler: DomEventHandler, options?: unknown): void;
-}
-export interface PrefetchLink {
-  getAttribute(name: string): string | null;
-}
-interface CompiledRoute {
-  readonly route: RouterRoute;
-  readonly pattern: CompiledPattern;
-}
-export function createRouter(options: RouterOptions): Router {
-  const compiled: readonly CompiledRoute[] = options.routes
-    .map((route) => ({ route, pattern: compilePattern(route.path) }))
-    .sort((a, b) => b.pattern.specificity - a.pattern.specificity);
-  const guards = new Set<NavigationGuard>();
-  const scrollPositions = new Map<string, number>();
-  const prefetched = new Set<string>();
-  const host = options.host;
-  const [current, setCurrent] = options.primitives.createSignal<ResolvedRoute | null>(
-    resolve(`${host.pathname()}${host.search()}`),
-  );
-  function resolve(url: string): ResolvedRoute | null {
-    const [rawPath = '/', rawSearch = ''] = splitUrl(url);
-    for (const candidate of compiled) {
-      const match = candidate.pattern.regex.exec(rawPath);
-      if (match === null) continue;
-      const params: Record<string, string> = {};
-      let undecodable = false;
-      candidate.pattern.keys.forEach((key, index) => {
-        const value = match[index + 1];
-        if (value === undefined) return;
-        // `decodeSegment`, the server router's own reader: `decodeURIComponent('%zz')` is a bare
-        // `URIError`, and `resolve` is called from the signal initialiser, from `navigate`, from a
-        // `mouseenter` prefetch and from the popstate handler — so a typo in the address bar took
-        // the whole SPA down at boot instead of failing this one branch.
-        const decoded = decodeSegment(value);
-        if (decoded === undefined) undecodable = true;
-        else params[key] = decoded;
-      });
-      // Fails only the branch that would have decoded it, exactly as `matchRoute` answers: a
-      // literal route matching the same text still wins, and an unclaimed pathname is a non-match.
-      if (undecodable) continue;
-      return {
-        route: candidate.route,
-        params,
-        pathname: rawPath,
-        search: rawSearch === '' ? '' : `?${rawSearch}`,
-      };
-    }
-    return null;
-  }
-  async function navigate(to: string, navOptions: NavigateOptions = {}): Promise<boolean> {
-    const next = resolve(to);
-    if (next === null) return false;
-    const from = current();
-    for (const guard of guards) {
-      // A guard that says no is a hard stop: no history entry, no scroll change.
-      if (!(await guard(next, from))) return false;
-    }
-    if (from !== null) scrollPositions.set(keyOf(from), host.scrollY());
-    const commit = (): void => {
-      if (navOptions.replace === true) host.replaceState(to);
-      else host.pushState(to);
-      setCurrent(next);
-      if (navOptions.scroll !== false) restoreScroll(next);
-    };
-    if (host.viewTransition !== undefined) host.viewTransition(commit);
-    else commit();
-    return true;
-  }
-  function restoreScroll(route: ResolvedRoute): void {
-    host.scrollTo(0, scrollPositions.get(keyOf(route)) ?? 0);
-  }
-  function prefetch(to: string): void {
-    const target = resolve(to);
-    const chunk = target?.route.chunk;
-    if (chunk === undefined || prefetched.has(chunk)) return;
-    prefetched.add(chunk);
-    host.preload?.(chunk);
-  }
-  host.onPopState(() => {
-    const next = resolve(`${host.pathname()}${host.search()}`);
-    if (next !== null) {
-      setCurrent(next);
-      restoreScroll(next);
-    }
-  });
-  return {
-    current,
-    navigate,
-    resolve,
-    prefetch,
-    guard(guard) {
-      guards.add(guard);
-      return () => guards.delete(guard);
-    },
-    attach(container) {
-      let timer: ReturnType<typeof setTimeout> | null = null;
-      const onEnter = (event: { target: unknown }): void => {
-        const href = hrefOf(event.target);
-        if (href === null) return;
-        if (timer !== null) clearTimeout(timer);
-        timer = setTimeout(() => prefetch(href), options.prefetchDelayMs ?? 80);
-      };
-      const onLeave = (): void => {
-        if (timer !== null) clearTimeout(timer);
-        timer = null;
-      };
-      container.addEventListener('mouseenter', onEnter, true);
-      container.addEventListener('mouseleave', onLeave, true);
-      // Visible prefetch: everything explicitly marked, warmed once it is on screen.
-      for (const link of container.querySelectorAll('a[data-prefetch="visible"]')) {
-        const href = link.getAttribute('href');
-        if (href !== null) prefetch(href);
-      }
-      return () => {
-        container.removeEventListener('mouseenter', onEnter, true);
-        container.removeEventListener('mouseleave', onLeave, true);
-        onLeave();
-      };
-    },
-  };
-}
-function keyOf(route: ResolvedRoute): string {
-  return `${route.pathname}${route.search}`;
-}
-function splitUrl(url: string): readonly [string, string] {
-  const hashless = url.split('#')[0] ?? '/';
-  const index = hashless.indexOf('?');
-  if (index === -1) return [hashless === '' ? '/' : hashless, ''];
-  return [hashless.slice(0, index) || '/', hashless.slice(index + 1)];
-}
-function hrefOf(target: unknown): string | null {
-  if (typeof target !== 'object' || target === null) return null;
-  if (!('getAttribute' in target)) return null;
-  const link = target as PrefetchLink;
-  return link.getAttribute('href');
-}