@warlock.js/web 5.1.0 → 5.2.1

package/esm/server/settle-page-response.mjs

@@ -1,47 +1,11 @@
 import { randomUUID } from "node:crypto";
 
 //#region ../web/src/server/settle-page-response.ts
-/** Root → leaf. The pipeline's one ordering, used by every stage that walks levels. */
 const LEVEL_ORDER = [
 	"app",
 	"layout",
 	"page"
 ];
-/**
-* Settle the surviving buffers root→leaf, per cookie name / header key: a
-* leafward level re-writing the same key wins it, everything else merges.
-*
-* **Headers and status are mirrored onto the live response here; COOKIES ARE
-* NOT**, and that asymmetry is the fix for a real defect rather than an
-* oversight. `header()` and `setStatusCode()` are keyed SETs, so mirroring here
-* and re-applying at the emit is idempotent. `cookie()` APPENDS — Fastify emits
-* one `Set-Cookie` per call — so doing both put the same cookie on the wire
-* twice, on every page response including the happy path.
-*
-* The emit is the authoritative application site (`createPageRouteHandler`
-* replays `rendered.cookies` through `applyBufferedCookie`), so the cookie loop
-* is the one that goes.
-*/
-function commitBuffers(realResponse, ordered, forcedStatusCode) {
-	const headers = /* @__PURE__ */ new Map();
-	const cookies = /* @__PURE__ */ new Map();
-	let statusCode;
-	for (const { buffer } of ordered) {
-		for (const header of buffer.headers) headers.set(header.key.toLowerCase(), header);
-		for (const cookie of buffer.cookies) cookies.set(cookie.name, cookie);
-		if (buffer.statusCode !== void 0) statusCode = buffer.statusCode;
-	}
-	if (forcedStatusCode !== void 0) statusCode = forcedStatusCode;
-	for (const header of headers.values()) realResponse.header(header.key, header.value);
-	if (statusCode !== void 0) realResponse.setStatusCode(statusCode);
-	return {
-		headers: [...headers.values()],
-		cookies: [...cookies.values()],
-		statusCode,
-		committedLevels: ordered.map(({ level }) => level)
-	};
-}
-/** Nearest `ErrorBoundary` at or rootward of the throw; `app` is terminal. */
 function designateBoundary(throwingLevel, triple) {
 	const throwingIndex = LEVEL_ORDER.indexOf(throwingLevel);
 	for (let index = throwingIndex; index >= 0; index--) {
@@ -56,14 +20,6 @@ function designateBoundary(throwingLevel, triple) {
 		boundaryLevel: "app"
 	};
 }
-/**
-* The one place a throw enters the bundle.
-*
-* **Production never lets the raw error reach a client** — the boundary gets a
-* surrogate carrying only `digest`, which is all the reference app's
-* ErrorBoundary renders. Dev keeps the real thrown value so the stack survives,
-* and it is never mutated to attach `digest`: that lives on the RECORD only.
-*/
 function buildErrorRecord(thrown, boundary, requestPath) {
 	const digest = randomUUID();
 	console.error("[warlock] page error", digest, ...requestPath ? [requestPath] : [], thrown);
@@ -71,6 +27,7 @@ function buildErrorRecord(thrown, boundary, requestPath) {
 		const surrogate = /* @__PURE__ */ new Error("An unexpected error occurred.");
 		surrogate.digest = digest;
 		return {
+			originalError: thrown,
 			error: surrogate,
 			boundary,
 			digest,
@@ -78,13 +35,121 @@ function buildErrorRecord(thrown, boundary, requestPath) {
 		};
 	}
 	return {
+		originalError: void 0,
 		error: thrown,
 		boundary,
 		digest,
 		scrubbed: false
 	};
 }
+const LOADER_SHORT_CIRCUIT = Symbol("warlock.page.loaderShortCircuit");
+function isLoaderShortCircuit(value) {
+	return Boolean(value) && typeof value === "object" && LOADER_SHORT_CIRCUIT in value;
+}
+function createLevelBuffer() {
+	return {
+		headers: [],
+		cookies: []
+	};
+}
+function createBufferedResponse(buffer) {
+	const bufferedResponse = {
+		header(key, value) {
+			buffer.headers.push({
+				key,
+				value: String(value)
+			});
+			return bufferedResponse;
+		},
+		headers(bag) {
+			for (const [key, value] of Object.entries(bag)) bufferedResponse.header(key, value);
+			return bufferedResponse;
+		},
+		cookie(name, value, options) {
+			buffer.cookies.push({
+				name,
+				value,
+				options
+			});
+			return bufferedResponse;
+		},
+		setStatusCode(statusCode) {
+			buffer.statusCode = statusCode;
+			return bufferedResponse;
+		},
+		redirect(url, statusCode = 302) {
+			buffer.statusCode = statusCode;
+			buffer.headers.push({
+				key: "Location",
+				value: url
+			});
+			return {
+				[LOADER_SHORT_CIRCUIT]: true,
+				kind: "redirect",
+				statusCode,
+				url,
+				body: void 0
+			};
+		},
+		permanentRedirect(url) {
+			return bufferedResponse.redirect(url, 301);
+		},
+		notFound(body) {
+			buffer.statusCode = 404;
+			return {
+				[LOADER_SHORT_CIRCUIT]: true,
+				kind: "notFound",
+				statusCode: 404,
+				url: void 0,
+				body
+			};
+		}
+	};
+	return bufferedResponse;
+}
+/**
+* Fold every surviving buffer root→leaf into ONE map per key (header key
+* case-insensitively, cookie by name) — leafward wins, insertion position
+* stays where the key FIRST appeared. Applies the folded headers and status
+* to the REAL response (`header()`/`setStatusCode()` are idempotent keyed
+* sets, so this is safe even though `commitBuffers` can run before render
+* changes its mind about the status later). Cookies are NOT applied to the
+* real response here — `cookie()` APPENDS, so mirroring it here and again at
+* the wire emit would duplicate every `Set-Cookie`. The single application
+* site is the emit (`create-page-route-handler.ts`, via `applyBufferedCookie`
+* over `bundle.commit.cookies`).
+*/
+function commitBuffers(response, buffers, committedLevels) {
+	const headerOrder = [];
+	const headerMap = /* @__PURE__ */ new Map();
+	const cookieOrder = [];
+	const cookieMap = /* @__PURE__ */ new Map();
+	let statusCode;
+	for (const level of committedLevels) {
+		const buffer = buffers[level];
+		for (const header of buffer.headers) {
+			const key = header.key.toLowerCase();
+			if (!headerMap.has(key)) headerOrder.push(key);
+			headerMap.set(key, header);
+		}
+		for (const cookie of buffer.cookies) {
+			if (!cookieMap.has(cookie.name)) cookieOrder.push(cookie.name);
+			cookieMap.set(cookie.name, cookie);
+		}
+		if (buffer.statusCode !== void 0) statusCode = buffer.statusCode;
+	}
+	const headers = headerOrder.map((key) => headerMap.get(key));
+	const cookies = cookieOrder.map((name) => cookieMap.get(name));
+	for (const header of headers) response.header(header.key, header.value);
+	if (statusCode !== void 0) response.setStatusCode(statusCode);
+	return {
+		committedLevels,
+		headers,
+		cookies,
+		statusCode
+	};
+}
 
 //#endregion
-export { LEVEL_ORDER, buildErrorRecord, commitBuffers, designateBoundary };
+export { LEVEL_ORDER, buildErrorRecord, commitBuffers, createBufferedResponse, createLevelBuffer, designateBoundary, isLoaderShortCircuit };
 //# sourceMappingURL=settle-page-response.mjs.map

package/esm/server/settle-page-response.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"settle-page-response.mjs","names":[],"sources":["../../../../../../../web/src/server/settle-page-response.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport type { BufferedCookie, BufferedHeader, ResponseBuffer } from \"./buffered-response\";\nimport type {\n  PageBoundaryDesignation,\n  PageErrorRecord,\n  PageLevelName,\n  PageResponseCommit,\n  PageRouteEntry,\n  PipelineResponse,\n} from \"./execute-page-request.types\";\n\n/** Root → leaf. The pipeline's one ordering, used by every stage that walks levels. */\nexport const LEVEL_ORDER: readonly PageLevelName[] = [\"app\", \"layout\", \"page\"];\n\n/**\n * Settle the surviving buffers root→leaf, per cookie name / header key: a\n * leafward level re-writing the same key wins it, everything else merges.\n *\n * **Headers and status are mirrored onto the live response here; COOKIES ARE\n * NOT**, and that asymmetry is the fix for a real defect rather than an\n * oversight. `header()` and `setStatusCode()` are keyed SETs, so mirroring here\n * and re-applying at the emit is idempotent. `cookie()` APPENDS — Fastify emits\n * one `Set-Cookie` per call — so doing both put the same cookie on the wire\n * twice, on every page response including the happy path.\n *\n * The emit is the authoritative application site (`createPageRouteHandler`\n * replays `rendered.cookies` through `applyBufferedCookie`), so the cookie loop\n * is the one that goes.\n */\nexport function commitBuffers(\n  realResponse: PipelineResponse,\n  ordered: readonly { level: PageLevelName; buffer: ResponseBuffer }[],\n  forcedStatusCode?: number,\n): PageResponseCommit {\n  const headers = new Map<string, BufferedHeader>();\n  const cookies = new Map<string, BufferedCookie>();\n  let statusCode: number | undefined;\n\n  for (const { buffer } of ordered) {\n    for (const header of buffer.headers) headers.set(header.key.toLowerCase(), header);\n    for (const cookie of buffer.cookies) cookies.set(cookie.name, cookie);\n    if (buffer.statusCode !== undefined) statusCode = buffer.statusCode;\n  }\n\n  if (forcedStatusCode !== undefined) statusCode = forcedStatusCode;\n\n  for (const header of headers.values()) realResponse.header(header.key, header.value);\n  if (statusCode !== undefined) realResponse.setStatusCode(statusCode);\n\n  // No `realResponse.cookie(...)` loop — see above. Settled cookies leave\n  // through the return value only, and the emit applies them exactly once.\n\n  return {\n    headers: [...headers.values()],\n    cookies: [...cookies.values()],\n    statusCode,\n    committedLevels: ordered.map(({ level }) => level),\n  };\n}\n\n/** Nearest `ErrorBoundary` at or rootward of the throw; `app` is terminal. */\nexport function designateBoundary(\n  throwingLevel: PageLevelName,\n  triple: PageRouteEntry[\"triple\"],\n): PageBoundaryDesignation {\n  const throwingIndex = LEVEL_ORDER.indexOf(throwingLevel);\n\n  for (let index = throwingIndex; index >= 0; index--) {\n    const level = LEVEL_ORDER[index];\n\n    if (triple[level].ErrorBoundary) {\n      return { throwingLevel, boundaryLevel: level };\n    }\n  }\n\n  // The framework owns a root boundary.\n  return { throwingLevel, boundaryLevel: \"app\" };\n}\n\n/**\n * The one place a throw enters the bundle.\n *\n * **Production never lets the raw error reach a client** — the boundary gets a\n * surrogate carrying only `digest`, which is all the reference app's\n * ErrorBoundary renders. Dev keeps the real thrown value so the stack survives,\n * and it is never mutated to attach `digest`: that lives on the RECORD only.\n */\nexport function buildErrorRecord(\n  thrown: unknown,\n  boundary: PageBoundaryDesignation,\n  requestPath?: string,\n): PageErrorRecord {\n  const digest = randomUUID();\n\n  // The boundary tells the user this was logged, so log it. A digest that\n  // appears in no log is worse than no digest.\n  console.error(\"[warlock] page error\", digest, ...(requestPath ? [requestPath] : []), thrown);\n\n  if (process.env.NODE_ENV === \"production\") {\n    const surrogate = new Error(\"An unexpected error occurred.\");\n\n    (surrogate as Error & { digest: string }).digest = digest;\n\n    return { error: surrogate, boundary, digest, scrubbed: true };\n  }\n\n  return { error: thrown, boundary, digest, scrubbed: false };\n}\n"],"mappings":";;;;AAYA,MAAa,cAAwC;CAAC;CAAO;CAAU;AAAM;;;;;;;;;;;;;;;;AAiB7E,SAAgB,cACd,cACA,SACA,kBACoB;CACpB,MAAM,0BAAU,IAAI,IAA4B;CAChD,MAAM,0BAAU,IAAI,IAA4B;CAChD,IAAI;CAEJ,KAAK,MAAM,EAAE,YAAY,SAAS;EAChC,KAAK,MAAM,UAAU,OAAO,SAAS,QAAQ,IAAI,OAAO,IAAI,YAAY,GAAG,MAAM;EACjF,KAAK,MAAM,UAAU,OAAO,SAAS,QAAQ,IAAI,OAAO,MAAM,MAAM;EACpE,IAAI,OAAO,eAAe,QAAW,aAAa,OAAO;CAC3D;CAEA,IAAI,qBAAqB,QAAW,aAAa;CAEjD,KAAK,MAAM,UAAU,QAAQ,OAAO,GAAG,aAAa,OAAO,OAAO,KAAK,OAAO,KAAK;CACnF,IAAI,eAAe,QAAW,aAAa,cAAc,UAAU;CAKnE,OAAO;EACL,SAAS,CAAC,GAAG,QAAQ,OAAO,CAAC;EAC7B,SAAS,CAAC,GAAG,QAAQ,OAAO,CAAC;EAC7B;EACA,iBAAiB,QAAQ,KAAK,EAAE,YAAY,KAAK;CACnD;AACF;;AAGA,SAAgB,kBACd,eACA,QACyB;CACzB,MAAM,gBAAgB,YAAY,QAAQ,aAAa;CAEvD,KAAK,IAAI,QAAQ,eAAe,SAAS,GAAG,SAAS;EACnD,MAAM,QAAQ,YAAY;EAE1B,IAAI,OAAO,MAAM,CAAC,eAChB,OAAO;GAAE;GAAe,eAAe;EAAM;CAEjD;CAGA,OAAO;EAAE;EAAe,eAAe;CAAM;AAC/C;;;;;;;;;AAUA,SAAgB,iBACd,QACA,UACA,aACiB;CACjB,MAAM,SAAS,WAAW;CAI1B,QAAQ,MAAM,wBAAwB,QAAQ,GAAI,cAAc,CAAC,WAAW,IAAI,CAAC,GAAI,MAAM;CAE3F,IAAI,QAAQ,IAAI,aAAa,cAAc;EACzC,MAAM,4BAAY,IAAI,MAAM,+BAA+B;EAE3D,AAAC,UAAyC,SAAS;EAEnD,OAAO;GAAE,OAAO;GAAW;GAAU;GAAQ,UAAU;EAAK;CAC9D;CAEA,OAAO;EAAE,OAAO;EAAQ;EAAU;EAAQ,UAAU;CAAM;AAC5D"}
+{"version":3,"file":"settle-page-response.mjs","names":[],"sources":["../../../../../../../web/src/server/settle-page-response.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport type { Response } from \"@warlock.js/core\";\nimport type {\n  PageBoundaryDesignation,\n  PageErrorRecord,\n  PageLevelName,\n  PageRouteEntry,\n} from \"./execute-page-request.types\";\n\nexport const LEVEL_ORDER: readonly PageLevelName[] = [\"app\", \"layout\", \"page\"];\n\nexport function designateBoundary(\n  throwingLevel: PageLevelName,\n  triple: PageRouteEntry[\"triple\"],\n): PageBoundaryDesignation {\n  const throwingIndex = LEVEL_ORDER.indexOf(throwingLevel);\n\n  for (let index = throwingIndex; index >= 0; index--) {\n    const level = LEVEL_ORDER[index];\n\n    if (triple[level].ErrorBoundary) {\n      return { throwingLevel, boundaryLevel: level };\n    }\n  }\n\n  return { throwingLevel, boundaryLevel: \"app\" };\n}\n\nexport function buildErrorRecord(\n  thrown: unknown,\n  boundary: PageBoundaryDesignation,\n  requestPath?: string,\n): PageErrorRecord {\n  const digest = randomUUID();\n\n  console.error(\"[warlock] page error\", digest, ...(requestPath ? [requestPath] : []), thrown);\n\n  if (process.env.NODE_ENV === \"production\") {\n    const surrogate = new Error(\"An unexpected error occurred.\");\n\n    (surrogate as Error & { digest: string }).digest = digest;\n\n    return { originalError: thrown, error: surrogate, boundary, digest, scrubbed: true };\n  }\n\n  // `error` already IS the real thrown value here — `originalError` only ever\n  // needs to diverge from it on the scrubbed (production) path above. Leaving\n  // it `undefined` rather than a redundant second reference to the same object\n  // keeps the record's `toEqual` shape honest (undefined properties compare as\n  // absent) and readers still get the real error via\n  // `record.originalError ?? record.error`.\n  return { originalError: undefined, error: thrown, boundary, digest, scrubbed: false };\n}\n\n// ---------------------------------------------------------------------------\n// Stage 6/7 — buffered per-level responses, and the root→leaf commit\n// ---------------------------------------------------------------------------\n\n/** A single committed response header, in application order. */\nexport type BufferedHeader = { key: string; value: string };\n\n/** A single committed response cookie — the shape `applyBufferedCookie` replays. */\nexport type BufferedCookie = {\n  name: string;\n  value: unknown;\n  options?: Record<string, unknown>;\n};\n\n/** The two loader short-circuit kinds a buffered response can signal. */\nexport type LoaderShortCircuitKind = \"redirect\" | \"notFound\";\n\nconst LOADER_SHORT_CIRCUIT = Symbol(\"warlock.page.loaderShortCircuit\");\n\n/**\n * What `response.redirect()` / `response.permanentRedirect()` / `response.notFound()`\n * return from inside a loader — a branded value the stage 7 settle scan\n * recognises by symbol, never by shape (so an app returning an\n * accidentally-similar plain object can't be mistaken for one).\n */\nexport type LoaderShortCircuitSignal = {\n  readonly [LOADER_SHORT_CIRCUIT]: true;\n  kind: LoaderShortCircuitKind;\n  statusCode: number;\n  url?: string;\n  body?: unknown;\n};\n\nexport function isLoaderShortCircuit(value: unknown): value is LoaderShortCircuitSignal {\n  return Boolean(value) && typeof value === \"object\" && LOADER_SHORT_CIRCUIT in (value as object);\n}\n\n/** One level's scratch buffer — what `response.header()`/`.cookie()` write into. */\nexport type LevelBuffer = {\n  headers: BufferedHeader[];\n  cookies: BufferedCookie[];\n  statusCode?: number;\n};\n\nexport function createLevelBuffer(): LevelBuffer {\n  return { headers: [], cookies: [] };\n}\n\n/**\n * The response surface a LOADER sees — never the live core `Response`.\n * `header()`/`cookie()` queue into the level's own buffer; nothing here\n * touches the real reply. `redirect()`/`permanentRedirect()`/`notFound()`\n * queue the buffer's own status (+ `Location`, for the two redirects) AND\n * return the branded signal stage 7 detects — the loader is expected to\n * `return response.redirect(...)`.\n */\nexport type BufferedResponse = {\n  header(key: string, value: unknown): BufferedResponse;\n  headers(bag: Record<string, unknown>): BufferedResponse;\n  cookie(name: string, value: unknown, options?: Record<string, unknown>): BufferedResponse;\n  setStatusCode(statusCode: number): BufferedResponse;\n  redirect(url: string, statusCode?: number): LoaderShortCircuitSignal;\n  permanentRedirect(url: string): LoaderShortCircuitSignal;\n  notFound(body?: unknown): LoaderShortCircuitSignal;\n};\n\nexport function createBufferedResponse(buffer: LevelBuffer): BufferedResponse {\n  const bufferedResponse: BufferedResponse = {\n    header(key, value) {\n      buffer.headers.push({ key, value: String(value) });\n      return bufferedResponse;\n    },\n    headers(bag) {\n      for (const [key, value] of Object.entries(bag)) bufferedResponse.header(key, value);\n      return bufferedResponse;\n    },\n    cookie(name, value, options) {\n      buffer.cookies.push({ name, value, options });\n      return bufferedResponse;\n    },\n    setStatusCode(statusCode) {\n      buffer.statusCode = statusCode;\n      return bufferedResponse;\n    },\n    redirect(url, statusCode = 302) {\n      buffer.statusCode = statusCode;\n      buffer.headers.push({ key: \"Location\", value: url });\n      return { [LOADER_SHORT_CIRCUIT]: true, kind: \"redirect\", statusCode, url, body: undefined };\n    },\n    permanentRedirect(url) {\n      return bufferedResponse.redirect(url, 301);\n    },\n    notFound(body) {\n      buffer.statusCode = 404;\n      return { [LOADER_SHORT_CIRCUIT]: true, kind: \"notFound\", statusCode: 404, url: undefined, body };\n    },\n  };\n\n  return bufferedResponse;\n}\n\n/** Stage 7's folded, applied result — what `bundle.commit` carries. */\nexport type PageResponseCommit = {\n  committedLevels: PageLevelName[];\n  headers: BufferedHeader[];\n  cookies: BufferedCookie[];\n  statusCode?: number;\n};\n\n/**\n * Fold every surviving buffer root→leaf into ONE map per key (header key\n * case-insensitively, cookie by name) — leafward wins, insertion position\n * stays where the key FIRST appeared. Applies the folded headers and status\n * to the REAL response (`header()`/`setStatusCode()` are idempotent keyed\n * sets, so this is safe even though `commitBuffers` can run before render\n * changes its mind about the status later). Cookies are NOT applied to the\n * real response here — `cookie()` APPENDS, so mirroring it here and again at\n * the wire emit would duplicate every `Set-Cookie`. The single application\n * site is the emit (`create-page-route-handler.ts`, via `applyBufferedCookie`\n * over `bundle.commit.cookies`).\n */\nexport function commitBuffers(\n  response: Response,\n  buffers: Record<PageLevelName, LevelBuffer>,\n  committedLevels: PageLevelName[],\n): PageResponseCommit {\n  const headerOrder: string[] = [];\n  const headerMap = new Map<string, BufferedHeader>();\n  const cookieOrder: string[] = [];\n  const cookieMap = new Map<string, BufferedCookie>();\n  let statusCode: number | undefined;\n\n  for (const level of committedLevels) {\n    const buffer = buffers[level];\n\n    for (const header of buffer.headers) {\n      const key = header.key.toLowerCase();\n      if (!headerMap.has(key)) headerOrder.push(key);\n      headerMap.set(key, header);\n    }\n\n    for (const cookie of buffer.cookies) {\n      if (!cookieMap.has(cookie.name)) cookieOrder.push(cookie.name);\n      cookieMap.set(cookie.name, cookie);\n    }\n\n    if (buffer.statusCode !== undefined) statusCode = buffer.statusCode;\n  }\n\n  const headers = headerOrder.map(key => headerMap.get(key)!);\n  const cookies = cookieOrder.map(name => cookieMap.get(name)!);\n\n  for (const header of headers) response.header(header.key, header.value);\n  if (statusCode !== undefined) response.setStatusCode(statusCode);\n\n  return { committedLevels, headers, cookies, statusCode };\n}\n"],"mappings":";;;AASA,MAAa,cAAwC;CAAC;CAAO;CAAU;AAAM;AAE7E,SAAgB,kBACd,eACA,QACyB;CACzB,MAAM,gBAAgB,YAAY,QAAQ,aAAa;CAEvD,KAAK,IAAI,QAAQ,eAAe,SAAS,GAAG,SAAS;EACnD,MAAM,QAAQ,YAAY;EAE1B,IAAI,OAAO,OAAO,eAChB,OAAO;GAAE;GAAe,eAAe;EAAM;CAEjD;CAEA,OAAO;EAAE;EAAe,eAAe;CAAM;AAC/C;AAEA,SAAgB,iBACd,QACA,UACA,aACiB;CACjB,MAAM,SAAS,WAAW;CAE1B,QAAQ,MAAM,wBAAwB,QAAQ,GAAI,cAAc,CAAC,WAAW,IAAI,CAAC,GAAI,MAAM;CAE3F,IAAI,QAAQ,IAAI,aAAa,cAAc;EACzC,MAAM,4BAAY,IAAI,MAAM,+BAA+B;EAE3D,AAAC,UAAyC,SAAS;EAEnD,OAAO;GAAE,eAAe;GAAQ,OAAO;GAAW;GAAU;GAAQ,UAAU;EAAK;CACrF;CAQA,OAAO;EAAE,eAAe;EAAW,OAAO;EAAQ;EAAU;EAAQ,UAAU;CAAM;AACtF;AAmBA,MAAM,uBAAuB,OAAO,iCAAiC;AAgBrE,SAAgB,qBAAqB,OAAmD;CACtF,OAAO,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,wBAAyB;AACjF;AASA,SAAgB,oBAAiC;CAC/C,OAAO;EAAE,SAAS,CAAC;EAAG,SAAS,CAAC;CAAE;AACpC;AAoBA,SAAgB,uBAAuB,QAAuC;CAC5E,MAAM,mBAAqC;EACzC,OAAO,KAAK,OAAO;GACjB,OAAO,QAAQ,KAAK;IAAE;IAAK,OAAO,OAAO,KAAK;GAAE,CAAC;GACjD,OAAO;EACT;EACA,QAAQ,KAAK;GACX,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,GAAG,GAAG,iBAAiB,OAAO,KAAK,KAAK;GAClF,OAAO;EACT;EACA,OAAO,MAAM,OAAO,SAAS;GAC3B,OAAO,QAAQ,KAAK;IAAE;IAAM;IAAO;GAAQ,CAAC;GAC5C,OAAO;EACT;EACA,cAAc,YAAY;GACxB,OAAO,aAAa;GACpB,OAAO;EACT;EACA,SAAS,KAAK,aAAa,KAAK;GAC9B,OAAO,aAAa;GACpB,OAAO,QAAQ,KAAK;IAAE,KAAK;IAAY,OAAO;GAAI,CAAC;GACnD,OAAO;KAAG,uBAAuB;IAAM,MAAM;IAAY;IAAY;IAAK,MAAM;GAAU;EAC5F;EACA,kBAAkB,KAAK;GACrB,OAAO,iBAAiB,SAAS,KAAK,GAAG;EAC3C;EACA,SAAS,MAAM;GACb,OAAO,aAAa;GACpB,OAAO;KAAG,uBAAuB;IAAM,MAAM;IAAY,YAAY;IAAK,KAAK;IAAW;GAAK;EACjG;CACF;CAEA,OAAO;AACT;;;;;;;;;;;;;AAsBA,SAAgB,cACd,UACA,SACA,iBACoB;CACpB,MAAM,cAAwB,CAAC;CAC/B,MAAM,4BAAY,IAAI,IAA4B;CAClD,MAAM,cAAwB,CAAC;CAC/B,MAAM,4BAAY,IAAI,IAA4B;CAClD,IAAI;CAEJ,KAAK,MAAM,SAAS,iBAAiB;EACnC,MAAM,SAAS,QAAQ;EAEvB,KAAK,MAAM,UAAU,OAAO,SAAS;GACnC,MAAM,MAAM,OAAO,IAAI,YAAY;GACnC,IAAI,CAAC,UAAU,IAAI,GAAG,GAAG,YAAY,KAAK,GAAG;GAC7C,UAAU,IAAI,KAAK,MAAM;EAC3B;EAEA,KAAK,MAAM,UAAU,OAAO,SAAS;GACnC,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,GAAG,YAAY,KAAK,OAAO,IAAI;GAC7D,UAAU,IAAI,OAAO,MAAM,MAAM;EACnC;EAEA,IAAI,OAAO,eAAe,QAAW,aAAa,OAAO;CAC3D;CAEA,MAAM,UAAU,YAAY,KAAI,QAAO,UAAU,IAAI,GAAG,CAAE;CAC1D,MAAM,UAAU,YAAY,KAAI,SAAQ,UAAU,IAAI,IAAI,CAAE;CAE5D,KAAK,MAAM,UAAU,SAAS,SAAS,OAAO,OAAO,KAAK,OAAO,KAAK;CACtE,IAAI,eAAe,QAAW,SAAS,cAAc,UAAU;CAE/D,OAAO;EAAE;EAAiB;EAAS;EAAS;CAAW;AACzD"}

package/esm/server/stylesheet-urls.d.mts

@@ -1,24 +1,4 @@
 //#region ../web/src/server/stylesheet-urls.d.ts
-/**
- * The stylesheets the ROOT document imports, as dev URLs.
- *
- * Dev has no manifest, so the source is the root file itself: whatever
- * `root.tsx` imports with a stylesheet extension is what the document needs.
- * That is deliberately narrow — it answers "what CSS does this application
- * set up globally", which is where `app.css` lives and where Tailwind is
- * wired, and it does NOT try to reproduce Vite's per-route CSS graph.
- *
- * The narrowness is the honest part: production splits CSS per chunk, dev
- * links the root's stylesheets on every page. A page whose own module imports
- * its own stylesheet still gets it in dev — Vite's client graph injects it as
- * before — it simply is not render-blocking the way the root's is. That is a
- * smaller gap than the flash this removes, and it is stated rather than
- * hidden.
- *
- * Specifiers are resolved against the root file and expressed relative to the
- * app root, because that is the shape Vite's dev server serves from.
- */
-declare function devStylesheetUrls(appRoot: string, appFile: string): string[];
 /**
  * A stylesheet Vite serves in DEV must be requested with `?direct`.
  *
@@ -30,23 +10,54 @@ declare function devStylesheetUrls(appRoot: string, appFile: string): string[];
  */
 declare const VITE_DIRECT_CSS_QUERY = "?direct";
 /**
- * Every stylesheet the client build emitted, as URLs the asset route serves.
+ * ONE source file's own directly imported stylesheets, as dev URLs.
+ *
+ * Dev has no manifest, so the source is the file itself: whatever it imports
+ * with a stylesheet extension is what it needs. This is deliberately narrow —
+ * it answers "what CSS does THIS file set up", not "what CSS does the whole
+ * module graph this file eventually reaches end up pulling in" — because the
+ * latter would require reproducing Vite's module graph, which is precisely
+ * what dev has no manifest to shortcut.
+ *
+ * The narrowness is the honest part: production splits CSS per chunk and can
+ * follow imported chunks (`productionStylesheetUrls` below); dev can only read
+ * the ONE file handed to it. A page whose own module imports its own
+ * stylesheet still gets it in dev — Vite's client graph injects it as before —
+ * it simply is not render-blocking the way a chain member's own import is.
+ *
+ * Called once per chain member — root, then every matched layout outer to
+ * inner, then the page — by the installers below, which is what turns "one
+ * file's own imports" into a handler's whole CSS chain.
+ *
+ * Specifiers are resolved against `sourceFile` and expressed relative to
+ * `appRoot`, because that is the shape Vite's dev server serves from.
+ */
+declare function devStylesheetUrls(appRoot: string, sourceFile: string): string[];
+/**
+ * ONE handler's whole production CSS chain.
  *
- * Vite records CSS against the CHUNK that imported it — an app whose
- * `root.tsx` imports `app.css` produces a `root.tsx` entry carrying
- * `css: ["assets/root-<hash>.css"]`, not a hydration entry carrying it. So
- * this collects across every entry rather than looking under one name, which
- * would silently find nothing the moment a stylesheet moved file.
+ * `sourceFiles` is `[root, ...outer-to-inner matched layouts, page]`, each an
+ * app-root-relative POSIX source id — the SAME id
+ * `install-page-routes-from-manifest.ts` already carries as `sourceFile` on
+ * every manifest entry, because that identity is what lets this function match
+ * EXPLICITLY rather than guess: every id is looked up on its own
+ * (`findManifestKey`), its own chunk's CSS is collected
+ * (`collectManifestCss`), and an id with no matching entry contributes
+ * nothing — it is never treated as license to fall back to scanning the whole
+ * manifest, which is what let an unrelated page's CSS leak onto this handler
+ * before.
  *
- * Duplicates are collapsed and order is preserved: two chunks importing the
- * same stylesheet must not emit two `<link>` tags.
+ * Duplicates are collapsed and order is preserved across the WHOLE chain, in
+ * the order `sourceFiles` was given — root's own CSS first, then each
+ * layout's outer to inner, then the page's — so cascade order matches the
+ * chain's own outer-to-inner rendering order.
  *
  * A missing or malformed manifest returns NOTHING rather than throwing. The
  * hydration resolver already fails loudly on exactly those conditions, from
  * exactly the same file, and it runs first — a second, worse error for the
  * same cause helps nobody.
  */
-declare function productionStylesheetUrls(clientDir: string): string[];
+declare function productionStylesheetUrls(clientDir: string, sourceFiles: readonly string[]): string[];
 //#endregion
 export { VITE_DIRECT_CSS_QUERY, devStylesheetUrls, productionStylesheetUrls };
 //# sourceMappingURL=stylesheet-urls.d.mts.map

package/esm/server/stylesheet-urls.mjs

@@ -1,10 +1,10 @@
 import { CLIENT_ASSET_URL_PREFIX } from "./client-asset-url-prefix.mjs";
-import path from "node:path";
 import { readFileSync } from "node:fs";
+import path from "node:path";
 
 //#region ../web/src/server/stylesheet-urls.ts
 /**
-* Which stylesheets a document must link, in each of the two modes.
+* Which stylesheets a REGISTERED HANDLER must link, in each of the two modes.
 *
 * WHY THIS EXISTS AT ALL. Nothing used to put CSS into the server-rendered
 * document. A stylesheet reached the browser only because the CLIENT bundle
@@ -13,13 +13,22 @@ import { readFileSync } from "node:fs";
 * moment later. The markup was correct the whole time, which is precisely why
 * it was easy to miss.
 *
+* THE SCOPE IS PER HANDLER, NOT PER APPLICATION. Every page renders inside
+* `[root, ...outer-to-inner matched layouts, page]` — that is the exact triple
+* (widened to a chain) `create-page-route-handler.ts` loads per request — so a
+* handler's CSS is the ordered, deduped union of what those specific source
+* files pull in, and nothing else. Collecting across the WHOLE application
+* (every page's manifest entry, every root import) is the bug this shape
+* exists to avoid: it ships page B's stylesheet on page A's response, and it
+* only gets worse as an application grows.
+*
 * The two modes learn the answer from different places, and neither can use
 * the other's:
 *
-*  - PRODUCTION reads Vite's client manifest, the same artifact the hydration
-*    entry is already resolved from.
+*  - PRODUCTION reads Vite's client manifest, matching each source file's own
+*    id and walking its recorded `css` and imported chunks.
 *  - DEV has no manifest — Vite serves modules on demand — so the URLs are
-*    derived from the source files themselves.
+*    derived from each source file's own import statements.
 */
 /** Stylesheet extensions Vite can serve directly. Mirrors the build's list. */
 const STYLE_EXTENSIONS = [
@@ -30,39 +39,53 @@ const STYLE_EXTENSIONS = [
 	".styl"
 ];
 /**
-* The stylesheets the ROOT document imports, as dev URLs.
-*
-* Dev has no manifest, so the source is the root file itself: whatever
-* `root.tsx` imports with a stylesheet extension is what the document needs.
-* That is deliberately narrow — it answers "what CSS does this application
-* set up globally", which is where `app.css` lives and where Tailwind is
-* wired, and it does NOT try to reproduce Vite's per-route CSS graph.
-*
-* The narrowness is the honest part: production splits CSS per chunk, dev
-* links the root's stylesheets on every page. A page whose own module imports
-* its own stylesheet still gets it in dev — Vite's client graph injects it as
-* before — it simply is not render-blocking the way the root's is. That is a
-* smaller gap than the flash this removes, and it is stated rather than
-* hidden.
-*
-* Specifiers are resolved against the root file and expressed relative to the
-* app root, because that is the shape Vite's dev server serves from.
+* A stylesheet Vite serves in DEV must be requested with `?direct`.
+*
+* Without it Vite answers the same URL with `text/javascript` — its CSS-as-JS
+* module transform, meant for `import "./app.css"` — and a
+* `<link rel="stylesheet">` pointing at a JavaScript response applies
+* NOTHING, silently. No console error, no network failure, just an unstyled
+* page. `?direct` is what makes Vite reply with real `text/css`.
 */
-function devStylesheetUrls(appRoot, appFile) {
+const VITE_DIRECT_CSS_QUERY = "?direct";
+/**
+* ONE source file's own directly imported stylesheets, as dev URLs.
+*
+* Dev has no manifest, so the source is the file itself: whatever it imports
+* with a stylesheet extension is what it needs. This is deliberately narrow —
+* it answers "what CSS does THIS file set up", not "what CSS does the whole
+* module graph this file eventually reaches end up pulling in" — because the
+* latter would require reproducing Vite's module graph, which is precisely
+* what dev has no manifest to shortcut.
+*
+* The narrowness is the honest part: production splits CSS per chunk and can
+* follow imported chunks (`productionStylesheetUrls` below); dev can only read
+* the ONE file handed to it. A page whose own module imports its own
+* stylesheet still gets it in dev — Vite's client graph injects it as before —
+* it simply is not render-blocking the way a chain member's own import is.
+*
+* Called once per chain member — root, then every matched layout outer to
+* inner, then the page — by the installers below, which is what turns "one
+* file's own imports" into a handler's whole CSS chain.
+*
+* Specifiers are resolved against `sourceFile` and expressed relative to
+* `appRoot`, because that is the shape Vite's dev server serves from.
+*/
+function devStylesheetUrls(appRoot, sourceFile) {
 	let source;
 	try {
-		source = readFileSync(appFile, "utf-8");
+		source = readFileSync(sourceFile, "utf-8");
 	} catch {
 		return [];
 	}
 	const urls = [];
-	const pattern = /\bimport\s*["']([^"']+)["']/g;
+	const pattern = /\bimport\s*(?:\(\s*)?["']([^"']+)["']/g;
 	let match = pattern.exec(source);
 	while (match !== null) {
 		const specifier = match[1];
 		const lowered = specifier.toLowerCase();
 		if (STYLE_EXTENSIONS.some((extension) => lowered.endsWith(extension))) {
-			const absolute = path.resolve(path.dirname(appFile), specifier);
+			const absolute = path.resolve(path.dirname(sourceFile), specifier);
 			const relative = path.relative(appRoot, absolute).split(path.sep).join("/");
 			if (!relative.startsWith("..")) {
 				const url = `/${relative}${VITE_DIRECT_CSS_QUERY}`;
@@ -74,33 +97,93 @@ function devStylesheetUrls(appRoot, appFile) {
 	return urls;
 }
 /**
-* A stylesheet Vite serves in DEV must be requested with `?direct`.
+* ONE handler's whole dev CSS chain: every `sourceFiles` member's own direct
+* stylesheet imports (`devStylesheetUrls`), in the order given — the caller
+* passes `[root, ...outer-to-inner matched layouts, page]` — concatenated and
+* deduped across the WHOLE chain, not just within one file.
 *
-* Without it Vite answers the same URL with `text/javascript` — its CSS-as-JS
-* module transform, meant for `import "./app.css"` — and a
-* `<link rel="stylesheet">` pointing at a JavaScript response applies
-* NOTHING, silently. No console error, no network failure, just an unstyled
-* page. `?direct` is what makes Vite reply with real `text/css`.
+* Cross-file dedup matters as much as within-file dedup: an application-wide
+* `app.css` imported by both the root and a page must still produce one
+* `<link>`, not two.
 */
-const VITE_DIRECT_CSS_QUERY = "?direct";
+function devHandlerStylesheetUrls(appRoot, sourceFiles) {
+	const urls = [];
+	for (const sourceFile of sourceFiles) for (const url of devStylesheetUrls(appRoot, sourceFile)) if (!urls.includes(url)) urls.push(url);
+	return urls;
+}
 /**
-* Every stylesheet the client build emitted, as URLs the asset route serves.
+* Find the manifest key for an app-root-relative POSIX source id.
 *
-* Vite records CSS against the CHUNK that imported it — an app whose
-* `root.tsx` imports `app.css` produces a `root.tsx` entry carrying
-* `css: ["assets/root-<hash>.css"]`, not a hydration entry carrying it. So
-* this collects across every entry rather than looking under one name, which
-* would silently find nothing the moment a stylesheet moved file.
+* VITE KEYS BY SOURCE PATH RELATIVE TO ITS OWN `root`, not to the app's
+* `appRoot` — the client build's `root` is the framework's own package
+* (`build-client.ts`), so a key for an app source file carries a `../`-laden
+* prefix (`"../my-app/src/web/root.tsx"`) rather than matching `sourceFile`
+* (`"src/web/root.tsx"`) byte for byte. The two forms always share the same
+* TAIL, though — both are anchored at the same file — so an exact match is
+* tried first (the case where the client build's root IS the app root, which
+* every fixture and every test below uses) and a `/`-boundary suffix match
+* second, rather than trying to reconstruct the build's own root here, which
+* this runtime read has no way to independently confirm.
+*/
+function findManifestKey(manifest, sourceFile) {
+	if (manifest[sourceFile] !== void 0) return sourceFile;
+	const suffix = `/${sourceFile}`;
+	for (const key of Object.keys(manifest)) if (key.endsWith(suffix)) return key;
+}
+/**
+* Every stylesheet reachable from ONE manifest entry: its own recorded `css`,
+* plus the same walk repeated over every chunk it STATICALLY `imports`.
+*
+* `imports` only, never `dynamicImports`. Vite's manifest records
+* `dynamicImports` on shared entry points (the hydration entry names every
+* page as one) precisely because the browser must NOT download them eagerly —
+* walking that array here would pull every other page's CSS onto this one,
+* which is the exact "unrelated pages" leak this module exists to end.
+* `imports`, by contrast, are chunks THIS module synchronously depends on:
+* code Vite split out of it but that loads whenever it does, so their CSS is
+* this handler's CSS too.
 *
-* Duplicates are collapsed and order is preserved: two chunks importing the
-* same stylesheet must not emit two `<link>` tags.
+* `visited` guards against a chunk graph cycle; sharing one set across the
+* whole walk from a single entry is enough; a shared chunk revisited from a
+* SEPARATE top-level entry (root vs. a layout vs. the page) is deliberately
+* walked again — the final merge in `productionStylesheetUrls` dedupes by URL,
+* and a fresh `visited` set per entry is simpler to reason about than one
+* threaded across unrelated chains.
+*/
+function collectManifestCss(manifest, key, visited) {
+	if (visited.has(key)) return [];
+	visited.add(key);
+	const entry = manifest[key];
+	if (entry === void 0) return [];
+	const ownCss = Array.isArray(entry.css) ? entry.css.filter((file) => typeof file === "string" && file !== "") : [];
+	const imports = Array.isArray(entry.imports) ? entry.imports.filter((id) => typeof id === "string") : [];
+	return [...ownCss, ...imports.flatMap((importedKey) => collectManifestCss(manifest, importedKey, visited))];
+}
+/**
+* ONE handler's whole production CSS chain.
+*
+* `sourceFiles` is `[root, ...outer-to-inner matched layouts, page]`, each an
+* app-root-relative POSIX source id — the SAME id
+* `install-page-routes-from-manifest.ts` already carries as `sourceFile` on
+* every manifest entry, because that identity is what lets this function match
+* EXPLICITLY rather than guess: every id is looked up on its own
+* (`findManifestKey`), its own chunk's CSS is collected
+* (`collectManifestCss`), and an id with no matching entry contributes
+* nothing — it is never treated as license to fall back to scanning the whole
+* manifest, which is what let an unrelated page's CSS leak onto this handler
+* before.
+*
+* Duplicates are collapsed and order is preserved across the WHOLE chain, in
+* the order `sourceFiles` was given — root's own CSS first, then each
+* layout's outer to inner, then the page's — so cascade order matches the
+* chain's own outer-to-inner rendering order.
 *
 * A missing or malformed manifest returns NOTHING rather than throwing. The
 * hydration resolver already fails loudly on exactly those conditions, from
 * exactly the same file, and it runs first — a second, worse error for the
 * same cause helps nobody.
 */
-function productionStylesheetUrls(clientDir) {
+function productionStylesheetUrls(clientDir, sourceFiles) {
 	const manifestPath = path.join(clientDir, ".vite", "manifest.json");
 	let manifest;
 	try {
@@ -109,19 +192,21 @@ function productionStylesheetUrls(clientDir) {
 		return [];
 	}
 	if (typeof manifest !== "object" || manifest === null) return [];
+	const files = [];
+	for (const sourceFile of sourceFiles) {
+		const key = findManifestKey(manifest, sourceFile);
+		if (key === void 0) continue;
+		files.push(...collectManifestCss(manifest, key, /* @__PURE__ */ new Set()));
+	}
 	const urls = [];
-	for (const entry of Object.values(manifest)) {
-		if (entry === void 0 || !Array.isArray(entry.css)) continue;
-		for (const file of entry.css) {
-			if (typeof file !== "string" || file === "") continue;
-			const url = `/${file}`;
-			if (!url.startsWith(`${"/assets"}/`)) continue;
-			if (!urls.includes(url)) urls.push(url);
-		}
+	for (const file of files) {
+		const url = `/${file}`;
+		if (!url.startsWith(`${"/assets"}/`)) continue;
+		if (!urls.includes(url)) urls.push(url);
 	}
 	return urls;
 }
 
 //#endregion
-export { VITE_DIRECT_CSS_QUERY, devStylesheetUrls, productionStylesheetUrls };
+export { VITE_DIRECT_CSS_QUERY, devHandlerStylesheetUrls, devStylesheetUrls, productionStylesheetUrls };
 //# sourceMappingURL=stylesheet-urls.mjs.map

package/esm/server/stylesheet-urls.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"stylesheet-urls.mjs","names":[],"sources":["../../../../../../../web/src/server/stylesheet-urls.ts"],"sourcesContent":["/**\n * Which stylesheets a document must link, in each of the two modes.\n *\n * WHY THIS EXISTS AT ALL. Nothing used to put CSS into the server-rendered\n * document. A stylesheet reached the browser only because the CLIENT bundle\n * imported it, which means JavaScript applied it after the module graph\n * loaded — so every full page load painted unstyled first and restyled a\n * moment later. The markup was correct the whole time, which is precisely why\n * it was easy to miss.\n *\n * The two modes learn the answer from different places, and neither can use\n * the other's:\n *\n *  - PRODUCTION reads Vite's client manifest, the same artifact the hydration\n *    entry is already resolved from.\n *  - DEV has no manifest — Vite serves modules on demand — so the URLs are\n *    derived from the source files themselves.\n */\nimport { readFileSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { CLIENT_ASSET_URL_PREFIX } from \"./client-asset-url-prefix\";\n\n/** Stylesheet extensions Vite can serve directly. Mirrors the build's list. */\nconst STYLE_EXTENSIONS = [\".css\", \".scss\", \".sass\", \".less\", \".styl\"];\n\n/**\n * The stylesheets the ROOT document imports, as dev URLs.\n *\n * Dev has no manifest, so the source is the root file itself: whatever\n * `root.tsx` imports with a stylesheet extension is what the document needs.\n * That is deliberately narrow — it answers \"what CSS does this application\n * set up globally\", which is where `app.css` lives and where Tailwind is\n * wired, and it does NOT try to reproduce Vite's per-route CSS graph.\n *\n * The narrowness is the honest part: production splits CSS per chunk, dev\n * links the root's stylesheets on every page. A page whose own module imports\n * its own stylesheet still gets it in dev — Vite's client graph injects it as\n * before — it simply is not render-blocking the way the root's is. That is a\n * smaller gap than the flash this removes, and it is stated rather than\n * hidden.\n *\n * Specifiers are resolved against the root file and expressed relative to the\n * app root, because that is the shape Vite's dev server serves from.\n */\nexport function devStylesheetUrls(appRoot: string, appFile: string): string[] {\n  let source: string;\n\n  try {\n    source = readFileSync(appFile, \"utf-8\");\n  } catch {\n    return [];\n  }\n\n  const urls: string[] = [];\n  const pattern = /\\bimport\\s*[\"']([^\"']+)[\"']/g;\n\n  let match = pattern.exec(source);\n\n  while (match !== null) {\n    const specifier = match[1];\n    const lowered = specifier.toLowerCase();\n\n    if (STYLE_EXTENSIONS.some((extension) => lowered.endsWith(extension))) {\n      const absolute = path.resolve(path.dirname(appFile), specifier);\n      const relative = path.relative(appRoot, absolute).split(path.sep).join(\"/\");\n\n      // Outside the app root Vite would need an `/@fs/` URL and a widened\n      // `fs.allow`; a stylesheet living there is unusual enough that guessing\n      // is worse than leaving it to the client import.\n      if (!relative.startsWith(\"..\")) {\n        const url = `/${relative}${VITE_DIRECT_CSS_QUERY}`;\n\n        if (!urls.includes(url)) urls.push(url);\n      }\n    }\n\n    match = pattern.exec(source);\n  }\n\n  return urls;\n}\n\n/**\n * A stylesheet Vite serves in DEV must be requested with `?direct`.\n *\n * Without it Vite answers the same URL with `text/javascript` — its CSS-as-JS\n * module transform, meant for `import \"./app.css\"` — and a\n * `<link rel=\"stylesheet\">` pointing at a JavaScript response applies\n * NOTHING, silently. No console error, no network failure, just an unstyled\n * page. `?direct` is what makes Vite reply with real `text/css`.\n */\nexport const VITE_DIRECT_CSS_QUERY = \"?direct\";\n\ntype ManifestEntry = {\n  css?: unknown;\n  file?: unknown;\n};\n\n/**\n * Every stylesheet the client build emitted, as URLs the asset route serves.\n *\n * Vite records CSS against the CHUNK that imported it — an app whose\n * `root.tsx` imports `app.css` produces a `root.tsx` entry carrying\n * `css: [\"assets/root-<hash>.css\"]`, not a hydration entry carrying it. So\n * this collects across every entry rather than looking under one name, which\n * would silently find nothing the moment a stylesheet moved file.\n *\n * Duplicates are collapsed and order is preserved: two chunks importing the\n * same stylesheet must not emit two `<link>` tags.\n *\n * A missing or malformed manifest returns NOTHING rather than throwing. The\n * hydration resolver already fails loudly on exactly those conditions, from\n * exactly the same file, and it runs first — a second, worse error for the\n * same cause helps nobody.\n */\nexport function productionStylesheetUrls(clientDir: string): string[] {\n  const manifestPath = path.join(clientDir, \".vite\", \"manifest.json\");\n\n  let manifest: Record<string, ManifestEntry | undefined>;\n\n  try {\n    manifest = JSON.parse(readFileSync(manifestPath, \"utf-8\")) as Record<\n      string,\n      ManifestEntry | undefined\n    >;\n  } catch {\n    return [];\n  }\n\n  if (typeof manifest !== \"object\" || manifest === null) return [];\n\n  const urls: string[] = [];\n\n  for (const entry of Object.values(manifest)) {\n    if (entry === undefined || !Array.isArray(entry.css)) continue;\n\n    for (const file of entry.css) {\n      if (typeof file !== \"string\" || file === \"\") continue;\n\n      // Built EXACTLY as the hydration entry's URL is built — `/${file}`, then\n      // checked against the prefix — rather than reassembled from a basename.\n      // The manifest already records `assets/root-<hash>.css`, and rebuilding\n      // that path here would be a second expression of a convention\n      // `client-asset-url-prefix.ts` owns.\n      const url = `/${file}`;\n\n      // A stylesheet outside the directory the asset route mounts would 404.\n      // Dropped rather than emitted, because a dead <link> in <head> is a\n      // silent styling failure — the exact thing this module exists to end.\n      if (!url.startsWith(`${CLIENT_ASSET_URL_PREFIX}/`)) continue;\n\n      if (!urls.includes(url)) urls.push(url);\n    }\n  }\n\n  return urls;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAM,mBAAmB;CAAC;CAAQ;CAAS;CAAS;CAAS;AAAO;;;;;;;;;;;;;;;;;;;;AAqBpE,SAAgB,kBAAkB,SAAiB,SAA2B;CAC5E,IAAI;CAEJ,IAAI;EACF,SAAS,aAAa,SAAS,OAAO;CACxC,QAAQ;EACN,OAAO,CAAC;CACV;CAEA,MAAM,OAAiB,CAAC;CACxB,MAAM,UAAU;CAEhB,IAAI,QAAQ,QAAQ,KAAK,MAAM;CAE/B,OAAO,UAAU,MAAM;EACrB,MAAM,YAAY,MAAM;EACxB,MAAM,UAAU,UAAU,YAAY;EAEtC,IAAI,iBAAiB,MAAM,cAAc,QAAQ,SAAS,SAAS,CAAC,GAAG;GACrE,MAAM,WAAW,KAAK,QAAQ,KAAK,QAAQ,OAAO,GAAG,SAAS;GAC9D,MAAM,WAAW,KAAK,SAAS,SAAS,QAAQ,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;GAK1E,IAAI,CAAC,SAAS,WAAW,IAAI,GAAG;IAC9B,MAAM,MAAM,IAAI,WAAW;IAE3B,IAAI,CAAC,KAAK,SAAS,GAAG,GAAG,KAAK,KAAK,GAAG;GACxC;EACF;EAEA,QAAQ,QAAQ,KAAK,MAAM;CAC7B;CAEA,OAAO;AACT;;;;;;;;;;AAWA,MAAa,wBAAwB;;;;;;;;;;;;;;;;;;AAwBrC,SAAgB,yBAAyB,WAA6B;CACpE,MAAM,eAAe,KAAK,KAAK,WAAW,SAAS,eAAe;CAElE,IAAI;CAEJ,IAAI;EACF,WAAW,KAAK,MAAM,aAAa,cAAc,OAAO,CAAC;CAI3D,QAAQ;EACN,OAAO,CAAC;CACV;CAEA,IAAI,OAAO,aAAa,YAAY,aAAa,MAAM,OAAO,CAAC;CAE/D,MAAM,OAAiB,CAAC;CAExB,KAAK,MAAM,SAAS,OAAO,OAAO,QAAQ,GAAG;EAC3C,IAAI,UAAU,UAAa,CAAC,MAAM,QAAQ,MAAM,GAAG,GAAG;EAEtD,KAAK,MAAM,QAAQ,MAAM,KAAK;GAC5B,IAAI,OAAO,SAAS,YAAY,SAAS,IAAI;GAO7C,MAAM,MAAM,IAAI;GAKhB,IAAI,CAAC,IAAI,WAAW,aAA2B,EAAE,GAAG;GAEpD,IAAI,CAAC,KAAK,SAAS,GAAG,GAAG,KAAK,KAAK,GAAG;EACxC;CACF;CAEA,OAAO;AACT"}
+{"version":3,"file":"stylesheet-urls.mjs","names":[],"sources":["../../../../../../../web/src/server/stylesheet-urls.ts"],"sourcesContent":["/**\n * Which stylesheets a REGISTERED HANDLER must link, in each of the two modes.\n *\n * WHY THIS EXISTS AT ALL. Nothing used to put CSS into the server-rendered\n * document. A stylesheet reached the browser only because the CLIENT bundle\n * imported it, which means JavaScript applied it after the module graph\n * loaded — so every full page load painted unstyled first and restyled a\n * moment later. The markup was correct the whole time, which is precisely why\n * it was easy to miss.\n *\n * THE SCOPE IS PER HANDLER, NOT PER APPLICATION. Every page renders inside\n * `[root, ...outer-to-inner matched layouts, page]` — that is the exact triple\n * (widened to a chain) `create-page-route-handler.ts` loads per request — so a\n * handler's CSS is the ordered, deduped union of what those specific source\n * files pull in, and nothing else. Collecting across the WHOLE application\n * (every page's manifest entry, every root import) is the bug this shape\n * exists to avoid: it ships page B's stylesheet on page A's response, and it\n * only gets worse as an application grows.\n *\n * The two modes learn the answer from different places, and neither can use\n * the other's:\n *\n *  - PRODUCTION reads Vite's client manifest, matching each source file's own\n *    id and walking its recorded `css` and imported chunks.\n *  - DEV has no manifest — Vite serves modules on demand — so the URLs are\n *    derived from each source file's own import statements.\n */\nimport { readFileSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { CLIENT_ASSET_URL_PREFIX } from \"./client-asset-url-prefix\";\n\n/** Stylesheet extensions Vite can serve directly. Mirrors the build's list. */\nconst STYLE_EXTENSIONS = [\".css\", \".scss\", \".sass\", \".less\", \".styl\"];\n\n/**\n * A stylesheet Vite serves in DEV must be requested with `?direct`.\n *\n * Without it Vite answers the same URL with `text/javascript` — its CSS-as-JS\n * module transform, meant for `import \"./app.css\"` — and a\n * `<link rel=\"stylesheet\">` pointing at a JavaScript response applies\n * NOTHING, silently. No console error, no network failure, just an unstyled\n * page. `?direct` is what makes Vite reply with real `text/css`.\n */\nexport const VITE_DIRECT_CSS_QUERY = \"?direct\";\n\n/**\n * ONE source file's own directly imported stylesheets, as dev URLs.\n *\n * Dev has no manifest, so the source is the file itself: whatever it imports\n * with a stylesheet extension is what it needs. This is deliberately narrow —\n * it answers \"what CSS does THIS file set up\", not \"what CSS does the whole\n * module graph this file eventually reaches end up pulling in\" — because the\n * latter would require reproducing Vite's module graph, which is precisely\n * what dev has no manifest to shortcut.\n *\n * The narrowness is the honest part: production splits CSS per chunk and can\n * follow imported chunks (`productionStylesheetUrls` below); dev can only read\n * the ONE file handed to it. A page whose own module imports its own\n * stylesheet still gets it in dev — Vite's client graph injects it as before —\n * it simply is not render-blocking the way a chain member's own import is.\n *\n * Called once per chain member — root, then every matched layout outer to\n * inner, then the page — by the installers below, which is what turns \"one\n * file's own imports\" into a handler's whole CSS chain.\n *\n * Specifiers are resolved against `sourceFile` and expressed relative to\n * `appRoot`, because that is the shape Vite's dev server serves from.\n */\nexport function devStylesheetUrls(appRoot: string, sourceFile: string): string[] {\n  let source: string;\n\n  try {\n    source = readFileSync(sourceFile, \"utf-8\");\n  } catch {\n    return [];\n  }\n\n  const urls: string[] = [];\n  const pattern = /\\bimport\\s*(?:\\(\\s*)?[\"']([^\"']+)[\"']/g;\n\n  let match = pattern.exec(source);\n\n  while (match !== null) {\n    const specifier = match[1];\n    const lowered = specifier.toLowerCase();\n\n    if (STYLE_EXTENSIONS.some((extension) => lowered.endsWith(extension))) {\n      const absolute = path.resolve(path.dirname(sourceFile), specifier);\n      const relative = path.relative(appRoot, absolute).split(path.sep).join(\"/\");\n\n      // Outside the app root Vite would need an `/@fs/` URL and a widened\n      // `fs.allow`; a stylesheet living there is unusual enough that guessing\n      // is worse than leaving it to the client import.\n      if (!relative.startsWith(\"..\")) {\n        const url = `/${relative}${VITE_DIRECT_CSS_QUERY}`;\n\n        if (!urls.includes(url)) urls.push(url);\n      }\n    }\n\n    match = pattern.exec(source);\n  }\n\n  return urls;\n}\n\n/**\n * ONE handler's whole dev CSS chain: every `sourceFiles` member's own direct\n * stylesheet imports (`devStylesheetUrls`), in the order given — the caller\n * passes `[root, ...outer-to-inner matched layouts, page]` — concatenated and\n * deduped across the WHOLE chain, not just within one file.\n *\n * Cross-file dedup matters as much as within-file dedup: an application-wide\n * `app.css` imported by both the root and a page must still produce one\n * `<link>`, not two.\n */\nexport function devHandlerStylesheetUrls(\n  appRoot: string,\n  sourceFiles: readonly string[],\n): string[] {\n  const urls: string[] = [];\n\n  for (const sourceFile of sourceFiles) {\n    for (const url of devStylesheetUrls(appRoot, sourceFile)) {\n      if (!urls.includes(url)) urls.push(url);\n    }\n  }\n\n  return urls;\n}\n\ntype ManifestEntry = {\n  css?: unknown;\n  imports?: unknown;\n};\n\n/**\n * Find the manifest key for an app-root-relative POSIX source id.\n *\n * VITE KEYS BY SOURCE PATH RELATIVE TO ITS OWN `root`, not to the app's\n * `appRoot` — the client build's `root` is the framework's own package\n * (`build-client.ts`), so a key for an app source file carries a `../`-laden\n * prefix (`\"../my-app/src/web/root.tsx\"`) rather than matching `sourceFile`\n * (`\"src/web/root.tsx\"`) byte for byte. The two forms always share the same\n * TAIL, though — both are anchored at the same file — so an exact match is\n * tried first (the case where the client build's root IS the app root, which\n * every fixture and every test below uses) and a `/`-boundary suffix match\n * second, rather than trying to reconstruct the build's own root here, which\n * this runtime read has no way to independently confirm.\n */\nfunction findManifestKey(\n  manifest: Record<string, ManifestEntry | undefined>,\n  sourceFile: string,\n): string | undefined {\n  if (manifest[sourceFile] !== undefined) return sourceFile;\n\n  const suffix = `/${sourceFile}`;\n\n  for (const key of Object.keys(manifest)) {\n    if (key.endsWith(suffix)) return key;\n  }\n\n  return undefined;\n}\n\n/**\n * Every stylesheet reachable from ONE manifest entry: its own recorded `css`,\n * plus the same walk repeated over every chunk it STATICALLY `imports`.\n *\n * `imports` only, never `dynamicImports`. Vite's manifest records\n * `dynamicImports` on shared entry points (the hydration entry names every\n * page as one) precisely because the browser must NOT download them eagerly —\n * walking that array here would pull every other page's CSS onto this one,\n * which is the exact \"unrelated pages\" leak this module exists to end.\n * `imports`, by contrast, are chunks THIS module synchronously depends on:\n * code Vite split out of it but that loads whenever it does, so their CSS is\n * this handler's CSS too.\n *\n * `visited` guards against a chunk graph cycle; sharing one set across the\n * whole walk from a single entry is enough; a shared chunk revisited from a\n * SEPARATE top-level entry (root vs. a layout vs. the page) is deliberately\n * walked again — the final merge in `productionStylesheetUrls` dedupes by URL,\n * and a fresh `visited` set per entry is simpler to reason about than one\n * threaded across unrelated chains.\n */\nfunction collectManifestCss(\n  manifest: Record<string, ManifestEntry | undefined>,\n  key: string,\n  visited: Set<string>,\n): string[] {\n  if (visited.has(key)) return [];\n  visited.add(key);\n\n  const entry = manifest[key];\n  if (entry === undefined) return [];\n\n  const ownCss = Array.isArray(entry.css)\n    ? entry.css.filter((file): file is string => typeof file === \"string\" && file !== \"\")\n    : [];\n\n  const imports = Array.isArray(entry.imports)\n    ? entry.imports.filter((id): id is string => typeof id === \"string\")\n    : [];\n\n  return [\n    ...ownCss,\n    ...imports.flatMap((importedKey) => collectManifestCss(manifest, importedKey, visited)),\n  ];\n}\n\n/**\n * ONE handler's whole production CSS chain.\n *\n * `sourceFiles` is `[root, ...outer-to-inner matched layouts, page]`, each an\n * app-root-relative POSIX source id — the SAME id\n * `install-page-routes-from-manifest.ts` already carries as `sourceFile` on\n * every manifest entry, because that identity is what lets this function match\n * EXPLICITLY rather than guess: every id is looked up on its own\n * (`findManifestKey`), its own chunk's CSS is collected\n * (`collectManifestCss`), and an id with no matching entry contributes\n * nothing — it is never treated as license to fall back to scanning the whole\n * manifest, which is what let an unrelated page's CSS leak onto this handler\n * before.\n *\n * Duplicates are collapsed and order is preserved across the WHOLE chain, in\n * the order `sourceFiles` was given — root's own CSS first, then each\n * layout's outer to inner, then the page's — so cascade order matches the\n * chain's own outer-to-inner rendering order.\n *\n * A missing or malformed manifest returns NOTHING rather than throwing. The\n * hydration resolver already fails loudly on exactly those conditions, from\n * exactly the same file, and it runs first — a second, worse error for the\n * same cause helps nobody.\n */\nexport function productionStylesheetUrls(\n  clientDir: string,\n  sourceFiles: readonly string[],\n): string[] {\n  const manifestPath = path.join(clientDir, \".vite\", \"manifest.json\");\n\n  let manifest: Record<string, ManifestEntry | undefined>;\n\n  try {\n    manifest = JSON.parse(readFileSync(manifestPath, \"utf-8\")) as Record<\n      string,\n      ManifestEntry | undefined\n    >;\n  } catch {\n    return [];\n  }\n\n  if (typeof manifest !== \"object\" || manifest === null) return [];\n\n  const files: string[] = [];\n\n  for (const sourceFile of sourceFiles) {\n    const key = findManifestKey(manifest, sourceFile);\n    if (key === undefined) continue;\n\n    files.push(...collectManifestCss(manifest, key, new Set()));\n  }\n\n  const urls: string[] = [];\n\n  for (const file of files) {\n    // Built EXACTLY as the hydration entry's URL is built — `/${file}`, then\n    // checked against the prefix — rather than reassembled from a basename.\n    // The manifest already records `assets/root-<hash>.css`, and rebuilding\n    // that path here would be a second expression of a convention\n    // `client-asset-url-prefix.ts` owns.\n    const url = `/${file}`;\n\n    // A stylesheet outside the directory the asset route mounts would 404.\n    // Dropped rather than emitted, because a dead <link> in <head> is a\n    // silent styling failure — the exact thing this module exists to end.\n    if (!url.startsWith(`${CLIENT_ASSET_URL_PREFIX}/`)) continue;\n\n    if (!urls.includes(url)) urls.push(url);\n  }\n\n  return urls;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,MAAM,mBAAmB;CAAC;CAAQ;CAAS;CAAS;CAAS;AAAO;;;;;;;;;;AAWpE,MAAa,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;AAyBrC,SAAgB,kBAAkB,SAAiB,YAA8B;CAC/E,IAAI;CAEJ,IAAI;EACF,SAAS,aAAa,YAAY,OAAO;CAC3C,QAAQ;EACN,OAAO,CAAC;CACV;CAEA,MAAM,OAAiB,CAAC;CACxB,MAAM,UAAU;CAEhB,IAAI,QAAQ,QAAQ,KAAK,MAAM;CAE/B,OAAO,UAAU,MAAM;EACrB,MAAM,YAAY,MAAM;EACxB,MAAM,UAAU,UAAU,YAAY;EAEtC,IAAI,iBAAiB,MAAM,cAAc,QAAQ,SAAS,SAAS,CAAC,GAAG;GACrE,MAAM,WAAW,KAAK,QAAQ,KAAK,QAAQ,UAAU,GAAG,SAAS;GACjE,MAAM,WAAW,KAAK,SAAS,SAAS,QAAQ,EAAE,MAAM,KAAK,GAAG,EAAE,KAAK,GAAG;GAK1E,IAAI,CAAC,SAAS,WAAW,IAAI,GAAG;IAC9B,MAAM,MAAM,IAAI,WAAW;IAE3B,IAAI,CAAC,KAAK,SAAS,GAAG,GAAG,KAAK,KAAK,GAAG;GACxC;EACF;EAEA,QAAQ,QAAQ,KAAK,MAAM;CAC7B;CAEA,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,yBACd,SACA,aACU;CACV,MAAM,OAAiB,CAAC;CAExB,KAAK,MAAM,cAAc,aACvB,KAAK,MAAM,OAAO,kBAAkB,SAAS,UAAU,GACrD,IAAI,CAAC,KAAK,SAAS,GAAG,GAAG,KAAK,KAAK,GAAG;CAI1C,OAAO;AACT;;;;;;;;;;;;;;;AAqBA,SAAS,gBACP,UACA,YACoB;CACpB,IAAI,SAAS,gBAAgB,QAAW,OAAO;CAE/C,MAAM,SAAS,IAAI;CAEnB,KAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,GACpC,IAAI,IAAI,SAAS,MAAM,GAAG,OAAO;AAIrC;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAS,mBACP,UACA,KACA,SACU;CACV,IAAI,QAAQ,IAAI,GAAG,GAAG,OAAO,CAAC;CAC9B,QAAQ,IAAI,GAAG;CAEf,MAAM,QAAQ,SAAS;CACvB,IAAI,UAAU,QAAW,OAAO,CAAC;CAEjC,MAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,IAClC,MAAM,IAAI,QAAQ,SAAyB,OAAO,SAAS,YAAY,SAAS,EAAE,IAClF,CAAC;CAEL,MAAM,UAAU,MAAM,QAAQ,MAAM,OAAO,IACvC,MAAM,QAAQ,QAAQ,OAAqB,OAAO,OAAO,QAAQ,IACjE,CAAC;CAEL,OAAO,CACL,GAAG,QACH,GAAG,QAAQ,SAAS,gBAAgB,mBAAmB,UAAU,aAAa,OAAO,CAAC,CACxF;AACF;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,SAAgB,yBACd,WACA,aACU;CACV,MAAM,eAAe,KAAK,KAAK,WAAW,SAAS,eAAe;CAElE,IAAI;CAEJ,IAAI;EACF,WAAW,KAAK,MAAM,aAAa,cAAc,OAAO,CAAC;CAI3D,QAAQ;EACN,OAAO,CAAC;CACV;CAEA,IAAI,OAAO,aAAa,YAAY,aAAa,MAAM,OAAO,CAAC;CAE/D,MAAM,QAAkB,CAAC;CAEzB,KAAK,MAAM,cAAc,aAAa;EACpC,MAAM,MAAM,gBAAgB,UAAU,UAAU;EAChD,IAAI,QAAQ,QAAW;EAEvB,MAAM,KAAK,GAAG,mBAAmB,UAAU,qBAAK,IAAI,IAAI,CAAC,CAAC;CAC5D;CAEA,MAAM,OAAiB,CAAC;CAExB,KAAK,MAAM,QAAQ,OAAO;EAMxB,MAAM,MAAM,IAAI;EAKhB,IAAI,CAAC,IAAI,WAAW,aAA2B,EAAE,GAAG;EAEpD,IAAI,CAAC,KAAK,SAAS,GAAG,GAAG,KAAK,KAAK,GAAG;CACxC;CAEA,OAAO;AACT"}