@weft-js/start 0.1.1 → 0.1.3

package/src/auth/better-auth.ts

@@ -1,12 +1,99 @@
 // Better Auth as weft's default auth provider (research 28 §3, 34 §5). `src/auth.server.ts` default-exports `createAuth(…)`.
 // No client code: sign-in is a mutation, so nothing of Better Auth ships to the browser.
 
-import { betterAuth, type BetterAuthOptions } from 'better-auth'
-import { CLIENT_IP, StartError } from '../data'
+import { betterAuth, type BetterAuthOptions, type BetterAuthPlugin } from 'better-auth'
+import { createAuthMiddleware } from 'better-auth/api'
+import { expireCookie } from 'better-auth/cookies'
+import { jwt, type JwtOptions } from 'better-auth/plugins/jwt'
+import { CLIENT_IP, currentScope, fnOf, StartError } from '../data'
 import type { DbHandle } from '../db/core'
 
 const SESSION = /(?:^|;\s*)(?:__Secure-)?[\w.-]*session_token=/
-const buildSecret = () => Array.from(crypto.getRandomValues(new Uint8Array(32)), x => x.toString(16).padStart(2, '0')).join('')
+const BEARER = /^Bearer\s+(\S+)$/i
+const CHUNK = /^(?:__Secure-)?[\w.-]*session_data\.\d+=/
+/** A socket or stream keeps its `ctx` past this request, and an extension's route is its own, so they never read the cache. */
+const HELD = /^\/_weft\/(rt|ws|x\/)/
+const FN = '/_weft/fn/'
+const ANONYMOUS = { user: null, session: null }
+const TABLES = ['user', 'session', 'account', 'verification', 'jwks']
+
+/** A cache too big for one cookie is no cache: that session just reads the database. An expired chunk still goes out. */
+const oversized = (line: string) =>
+  CHUNK.test(line) && !/max-age=0/i.test(line) && !/^[^=]+=;/.test(line)
+
+/** Better Auth's own routes follow the rule `session()` does: only reading who you are can answer from the cache. */
+const cacheRules: BetterAuthPlugin = {
+  id: 'weft-session-cache',
+  hooks: {
+    // `/token` above all: a revoked session mustn't mint a 15-minute token from a cookie it still holds.
+    before: [
+      {
+        matcher: (c) => c.path !== '/get-session',
+        handler: createAuthMiddleware((c) =>
+          Promise.resolve({ context: { query: { ...c.query, disableCookieCache: true } } }),
+        ),
+      },
+    ],
+    // With `revokeOtherSessions` this response already carries the new session's cookies.
+    after: [
+      {
+        matcher: (c) => c.path === '/change-password',
+        handler: createAuthMiddleware((c) =>
+          Promise.resolve(
+            void (c.context.newSession || expireCookie(c, c.context.authCookies.sessionData)),
+          ),
+        ),
+      },
+      // Chunks go on every request after this one: a big enough user would pass the server's header limit and be locked out with 431s.
+      {
+        matcher: () => true,
+        handler: createAuthMiddleware((c) => {
+          const out = (c.context as { responseHeaders?: Headers }).responseHeaders
+          const all = out?.getSetCookie() ?? []
+          if (out && all.some(oversized)) {
+            out.delete('set-cookie')
+            for (const line of all) if (!oversized(line)) out.append('set-cookie', line)
+          }
+          return Promise.resolve()
+        }),
+      },
+    ],
+  },
+}
+
+/** `createAuth({ api })`: Better Auth's `jwt` options, and which server functions take a bearer token. */
+export interface ApiAccess extends JwtOptions {
+  /** The server functions a bearer token may call, as a function so this module needn't load them first. No others read it. */
+  functions?: () => unknown[]
+}
+type Found = NonNullable<
+  Awaited<ReturnType<ReturnType<typeof betterAuth<BetterAuthOptions>>['api']['getSession']>>
+>
+type Session = { user: Found['user'] | null; session: Found['session'] | null }
+/** What a token of ours carries: Better Auth's claims, the session it came from, and the user's fields. */
+type Claims = {
+  sub: string
+  sid: string
+  iss?: string
+  aud?: string | string[]
+  exp?: number
+  iat?: number
+} & Record<string, unknown>
+/** The calls made here. The `jwt` plugin is optional, so `verifyJWT` isn't in the instance's own type. */
+interface Methods {
+  verifyJWT(input: { body: { token: string } }): Promise<{ payload: Claims | null }>
+  getSession(input: {
+    headers: Headers
+    returnHeaders: true
+    query?: { disableCookieCache: boolean }
+  }): Promise<{ headers: Headers; response: Found | null }>
+}
+type Signed = Parameters<NonNullable<NonNullable<JwtOptions['jwt']>['definePayload']>>[0]
+
+const buildSecret = () =>
+  Array.from(crypto.getRandomValues(new Uint8Array(32)), (x) =>
+    x.toString(16).padStart(2, '0'),
+  ).join('')
 
 /** `createAuth`: the database, the secret, and any Better Auth option on top. */
 export interface AuthOptions<S extends Record<string, unknown>, O extends BetterAuthOptions> {
@@ -14,16 +101,102 @@ export interface AuthOptions<S extends Record<string, unknown>, O extends Better
   /** The tables, Better Auth's included, for a data layer that needs them. */
   schema?: S
   /** 32+ characters (A001 in production). */
-  secret?: string
+  secret?: string | undefined
   /** The rest of Better Auth's options; they win over the defaults here. */
   options?: O
+  /** Short-lived JWTs for other services and API clients, with a public JWKS: Better Auth's `jwt` options. `false` turns it off. */
+  api?: ApiAccess | false
 }
 
-/** A Better Auth instance with Weft's defaults, on the store `options.database` names. */
-export function createAuth<S extends Record<string, unknown>, const O extends BetterAuthOptions = {}>({ db, secret, options }: AuthOptions<S, O>) {
+function sessionReader(
+  auth: {
+    $context: Promise<{
+      internalAdapter: {
+        listSessions(
+          user: string,
+          options: { onlyActiveSessions: boolean },
+        ): Promise<{ id: string }[]>
+      }
+    }>
+  },
+  methods: Methods,
+  claims: { issuer?: string | undefined; audience?: string | string[] | undefined },
+  functions: (() => unknown[]) | undefined,
+  api: ApiAccess | false | undefined,
+) {
+  /** Who a token says, for a function that takes one. A write also needs the session behind it to still be there. */
+  async function bearer(token: string, read: boolean): Promise<Session> {
+    // Unchecked, Better Auth would skip `iss` and `aud`: with no URL configured, no token is good.
+    if (!claims.issuer || !claims.audience) return ANONYMOUS
+    const { payload } = await methods.verifyJWT({ body: { token } })
+    if (!payload) return ANONYMOUS
+    if (!read) {
+      const live = await (
+        await auth.$context
+      ).internalAdapter.listSessions(payload.sub, { onlyActiveSessions: true })
+      if (!live.some((s) => s.id === payload.sid)) return ANONYMOUS
+    }
+    const { iss: _iss, aud: _aud, exp: _exp, iat: _iat, sub, sid: _sid, ...user } = payload
+    return { user: { ...user, id: sub } as unknown as Found['user'], session: null }
+  }
+
+  const marked = (pathname: string) => {
+    if (!functions || !pathname.startsWith(FN)) return false
+    const id = pathname.slice(FN.length)
+    return functions().some((f) => encodeURIComponent((fnOf(f) as { $id: string }).$id) === id)
+  }
+
+  return async function session(request: Request): Promise<Session> {
+    const read = request.method === 'GET' || request.method === 'HEAD'
+    const { pathname } = new URL(request.url)
+    const token = request.headers.get('authorization')?.match(BEARER)?.[1]
+    if (token && api !== false && marked(pathname)) return bearer(token, read)
+    if (!SESSION.test(request.headers.get('cookie') ?? '')) return ANONYMOUS
+    const { headers, response: s } = await methods.getSession({
+      headers: request.headers,
+      returnHeaders: true,
+      ...(!(read && !HELD.test(pathname)) && { query: { disableCookieCache: true } }),
+    })
+    // A fresh cache cookie, a slid expiry or a dead session's removal. Not `forward`: who's signed in hasn't changed.
+    // A socket's re-check runs inside whichever request poked it, and its cookies are that socket's, not this response's.
+    const scope = currentScope() as { request?: Request; headers?: Headers } | undefined
+    if (scope?.headers && scope.request === request)
+      for (const c of headers.getSetCookie()) scope.headers.append('set-cookie', c)
+    return { user: s?.user ?? null, session: s?.session ?? null }
+  }
+}
+
+function requireStore(db: { $weft: DbHandle }, options: BetterAuthOptions | undefined) {
   const handle = db.$weft
-  if (options?.database) for (const name of ['user', 'session', 'account', 'verification']) handle.exempt.add(name)
-  else throw new StartError('A005', 'Better Auth has no store', 'pass `options.database`: `drizzleAuth(db, schema)` from @weft-js/start/auth/drizzle, or your data layer\'s adapter')
+  if (options?.database) for (const name of TABLES) handle.exempt.add(name)
+  else
+    throw new StartError(
+      'A005',
+      'Better Auth has no store',
+      "pass `options.database`: `drizzleAuth(db, schema)` from @weft-js/start/auth/drizzle, or your data layer's adapter",
+    )
+}
+
+/** A Better Auth instance with Weft's defaults, on the store `options.database` names. */
+export function createAuth<
+  S extends Record<string, unknown>,
+  const O extends BetterAuthOptions = {},
+>({ db, secret, options, api }: AuthOptions<S, O>) {
+  requireStore(db, options)
+  const { functions, ...access } = api || {}
+  const origin =
+    typeof options?.baseURL === 'string' ? options.baseURL : process.env.BETTER_AUTH_URL
+  const claims = {
+    expirationTime: '15m',
+    issuer: origin,
+    audience: origin,
+    ...access.jwt,
+    // Which session a token came from, so a write can ask whether it still exists.
+    definePayload: async (s: Signed) => ({
+      ...((await access.jwt?.definePayload?.(s)) ?? s.user),
+      sid: s.session.id,
+    }),
+  }
   const auth = betterAuth({
     // A build loads this module with no environment, and in production Better Auth refuses to start without a secret: the
     // build gets one of its own, since nothing it makes is signed. A server still needs the real one (A001).
@@ -33,26 +206,51 @@ export function createAuth<S extends Record<string, unknown>, const O extends Be
     telemetry: { enabled: false },
     emailAndPassword: { enabled: true },
     ...options,
+    // Login stays an opaque token in the database. This only spares reads of it, for a window: see `session()`.
+    session: {
+      ...options?.session,
+      cookieCache: {
+        enabled: true,
+        maxAge: 300,
+        strategy: 'compact',
+        ...options?.session?.cookieCache,
+      },
+    },
+    // Signing a JWT on every session read would put a query back on each page, and login has no use for one.
+    plugins: [
+      ...(options?.plugins ?? []),
+      cacheRules,
+      ...(api === false ? [] : [jwt({ ...access, jwt: claims, disableSettingJwtHeader: true })]),
+    ],
     // The server stamps this header from the socket (server.tsx), so rate limits aren't one bucket for everyone.
     // Its schema check runs when this module loads. On Kysely that connects, in a build, and before a fresh database has
     // had weft's migrations. Q014 covers a schema that doesn't match, so it's off unless you turn it on.
-    advanced: { ...options?.advanced, database: { validateSchema: false, ...options?.advanced?.database }, ipAddress: { ipAddressHeaders: [CLIENT_IP], ...options?.advanced?.ipAddress } },
+    advanced: {
+      ...options?.advanced,
+      database: { validateSchema: false, ...options?.advanced?.database },
+      ipAddress: { ipAddressHeaders: [CLIENT_IP], ...options?.advanced?.ipAddress },
+    },
   })
+  const methods = auth.api as unknown as Methods
+
   return Object.assign(auth, {
     basePath: options?.basePath,
-    /** With no session cookie it's `null` without a query, so anonymous pages don't touch the database. */
-    async session(request: Request) {
-      if (!SESSION.test(request.headers.get('cookie') ?? '')) return { user: null, session: null }
-      const s = await (auth as unknown as ReturnType<typeof betterAuth<BetterAuthOptions>>).api.getSession({ headers: request.headers })
-      return { user: s?.user ?? null, session: s?.session ?? null }
-    },
+    /**
+     * With no session cookie it's `null` without a query, so anonymous pages don't touch the database. A page or query
+     * reads the signed cookie cache; a mutation (not GET) and anything that outlives the request read the database, so a
+     * revoked session may be shown a page for the cache's window but can't write.
+     */
+    session: sessionReader(auth, methods, claims, functions, api),
     $weft: {
       /** On the first request (never in a build, which holds no secrets). */
       check() {
         if (process.env.NODE_ENV === 'production' && (secret?.length ?? 0) < 32)
-          throw new StartError('A001', 'the auth secret is missing or under 32 characters', 'set `BETTER_AUTH_SECRET` (`openssl rand -base64 32`) in the server\'s environment')
+          throw new StartError(
+            'A001',
+            'the auth secret is missing or under 32 characters',
+            "set `BETTER_AUTH_SECRET` (`openssl rand -base64 32`) in the server's environment",
+          )
       },
     },
   })
 }
-

package/src/auth/drizzle.ts

@@ -9,7 +9,7 @@ const PROVIDER = { sqlite: 'sqlite', postgresql: 'pg', mysql: 'mysql' } as const
 
 /** Better Auth's store on a Weft database, for `createAuth`'s `options.database`. */
 export function drizzleAuth(db: { $weft: DbHandle }, schema?: Record<string, unknown>) {
-  for (const name of ['user', 'session', 'account', 'verification']) {
+  for (const name of ['user', 'session', 'account', 'verification', 'jwks']) {
     const t = schema?.[name]
     if (isTable(t)) db.$weft.exempt.add(getTableName(t))
   }

package/src/auth.ts

@@ -8,10 +8,13 @@ import { FnError, type Context } from './data'
 export interface AuthProvider<U = unknown, S = unknown> {
   /** Serves everything under `basePath`. */
   handler(request: Request): Promise<Response> | Response
-  /** Who this request is. Anonymous is `{ user: null, session: null }`, and should cost no query. */
+  /**
+   * Who this request is. Anonymous is `{ user: null, session: null }`, and should cost no query. A provider that caches
+   * sessions may answer a GET from the cache, and must ask its store for any other method: that's what a mutation runs on.
+   */
   session(request: Request): Promise<{ user: U | null; session: S | null }>
   /** Where `handler` is mounted (default `/api/auth`). */
-  basePath?: string
+  basePath?: string | undefined
   $weft?: {
     /** On the first request, never in a build: throw for a server that can't run safely. */
     check(): void
@@ -24,7 +27,10 @@ export function defineAuth<U, S>(provider: AuthProvider<U, S>): AuthProvider<U,
 }
 
 /** `{ user, session }` for `ctx` (`src/context.server.ts`), from any provider. */
-export const session = <A extends { session(request: Request): unknown }>(auth: A, request: Request): ReturnType<A['session']> => auth.session(request) as ReturnType<A['session']>
+export const session = <A extends { session(request: Request): unknown }>(
+  auth: A,
+  request: Request,
+): ReturnType<A['session']> => auth.session(request) as ReturnType<A['session']>
 
 const changed = new WeakSet<Headers>()
 
@@ -35,13 +41,22 @@ export const sessionChanged = (headers: Headers) => changed.has(headers)
  * Finish a provider's Response (Better Auth's with `asResponse: true`): its cookies go on this response, so a redirect
  * after it is a full load, and a failure rejects with the provider's message (`e.message` on the client).
  */
-export async function forward<T = unknown>(ctx: Context, call: Response | Promise<Response>): Promise<T> {
+export async function forward<T = unknown>(
+  ctx: Context,
+  call: Response | Promise<Response>,
+): Promise<T> {
   const res = await call
   for (const c of res.headers.getSetCookie()) {
     ctx.response.headers.append('set-cookie', c)
     changed.add(ctx.response.headers)
   }
-  const body = await res.json().catch(() => null) as (T & { code?: string; message?: string }) | null
-  if (!res.ok) throw new FnError({ ...(body?.code && { code: body.code }), message: body?.message ?? 'Authentication failed' }, res.status)
+  const body = (await res.json().catch(() => null)) as
+    | (T & { code?: string; message?: string })
+    | null
+  if (!res.ok)
+    throw new FnError(
+      { ...(body?.code && { code: body.code }), message: body?.message ?? 'Authentication failed' },
+      res.status,
+    )
   return body as T
 }

package/src/boot.ts

@@ -3,7 +3,15 @@
 // less data gets it on interaction only. `#weft-route` and the islands' comments are read by `start()` once it's here.
 
 /** What the inline script left on `window`: the queue, and how to play or wake it. */
-export interface Held { q: unknown[]; p: (held: unknown) => void; w?: (k: Element, lead?: 1) => void; r?: 1; n?: unknown; l?: Element; d?: unknown }
+export interface Held {
+  q: unknown[]
+  p: (held: unknown) => void
+  w?: (k: Element, lead?: 1) => void
+  r?: 1
+  n?: unknown
+  l?: Element
+  d?: unknown
+}
 
 export function boot(full: () => Promise<unknown>) {
   const q = (window as Window & { __wq?: Held }).__wq
@@ -26,13 +34,16 @@ export function boot(full: () => Promise<unknown>) {
   if (q.d) return
   const first = new WeakSet<Element>()
   const needs = new WeakSet<Element>()
-  io = new IntersectionObserver(list => {
-    for (const e of list) {
-      const was = first.has(e.target)
-      first.add(e.target)
-      if (e.isIntersecting && (was || needs.has(e.target))) return go()
-    }
-  }, { rootMargin: '600px' })
+  io = new IntersectionObserver(
+    (list) => {
+      for (const e of list) {
+        const was = first.has(e.target)
+        first.add(e.target)
+        if (e.isIntersecting && (was || needs.has(e.target))) return go()
+      }
+    },
+    { rootMargin: '600px' },
+  )
   const w = document.createTreeWalker(document.body, 128)
   while (w.nextNode()) {
     const c = w.currentNode as Comment

package/src/bus/postgres.ts

@@ -16,11 +16,23 @@ const CHANNEL = 'weft_bus'
 const WHOLE = 7_900
 const CHUNK = 7_800
 
+function delivery(listeners: Map<string, Set<(message: string) => void>>) {
+  return (text: string) => {
+    const at = text.indexOf('\n')
+    const list = listeners.get(text.slice(0, at))
+    if (list) for (const on of list) on(text.slice(at + 1))
+  }
+}
+
 /** A bus on Postgres NOTIFY, for several instances with no broker beside the database. */
 export function postgresBus({ url }: PostgresBusOptions): Bus {
   if (!url && process.env.WEFT_BUILD) url = 'postgres://localhost/build' // a build loads this module and never connects
   if (!/^postgres(ql)?:\/\//.test(url ?? ''))
-    throw new StartError('Q013', `\`postgresBus\` needs a \`postgres://\` URL, not \`${(url ?? '').replace(/\/\/.*@/, '//…@')}\``, 'set `DATABASE_URL`, or leave `bus` out for the memory bus on one instance')
+    throw new StartError(
+      'Q013',
+      `\`postgresBus\` needs a \`postgres://\` URL, not \`${(url ?? '').replace(/\/\/.*@/, '//…@')}\``,
+      'set `DATABASE_URL`, or leave `bus` out for the memory bus on one instance',
+    )
   let sql: ReturnType<typeof postgres> | undefined
   const client = () => (sql ??= postgres(url, { max: 2, idle_timeout: 20, onnotice: () => {} }))
   const listeners = new Map<string, Set<(message: string) => void>>()
@@ -29,15 +41,12 @@ export function postgresBus({ url }: PostgresBusOptions): Bus {
   let listening: Promise<unknown> | undefined
   let connected = false
 
-  const deliver = (text: string) => {
-    const at = text.indexOf('\n')
-    const list = listeners.get(text.slice(0, at))
-    if (list) for (const on of list) on(text.slice(at + 1))
-  }
+  const deliver = delivery(listeners)
   const received = (payload: string) => {
     if (payload[0] === '=') return deliver(payload.slice(1))
     const [id, i, n, body] = payload.slice(1).split(':')
-    if (id === undefined || i === undefined || n === undefined || body === undefined) return undefined
+    if (id === undefined || i === undefined || n === undefined || body === undefined)
+      return undefined
     const got = parts.get(id) ?? []
     got[+i] = body
     parts.set(id, got)
@@ -46,16 +55,19 @@ export function postgresBus({ url }: PostgresBusOptions): Bus {
     deliver(Buffer.from(got.join(''), 'base64').toString())
   }
   /** `onlisten` runs on every (re)connect: after the first, whatever was published meanwhile is gone. */
-  const listen = () => (listening ??= client().listen(CHANNEL, received, () => {
-    if (connected) {
-      parts.clear()
-      for (const gap of gaps) gap()
-    }
-    connected = true
-  }).catch(e => {
-    listening = undefined // the next subscribe tries again
-    throw e
-  }))
+  const listen = () =>
+    (listening ??= client()
+      .listen(CHANNEL, received, () => {
+        if (connected) {
+          parts.clear()
+          for (const gap of gaps) gap()
+        }
+        connected = true
+      })
+      .catch((e) => {
+        listening = undefined // the next subscribe tries again
+        throw e
+      }))
 
   return {
     name: 'postgres',
@@ -65,8 +77,9 @@ export function postgresBus({ url }: PostgresBusOptions): Bus {
       const b64 = Buffer.from(text).toString('base64')
       const id = crypto.randomUUID()
       const n = Math.ceil(b64.length / CHUNK)
-      await client().begin(async tx => {
-        for (let i = 0; i < n; i++) await tx`select pg_notify(${CHANNEL}, ${`+${id}:${i}:${n}:${b64.slice(i * CHUNK, (i + 1) * CHUNK)}`})`
+      await client().begin(async (tx) => {
+        for (let i = 0; i < n; i++)
+          await tx`select pg_notify(${CHANNEL}, ${`+${id}:${i}:${n}:${b64.slice(i * CHUNK, (i + 1) * CHUNK)}`})`
       })
     },
     async subscribe(channel, on, gap) {

package/src/bus.ts

@@ -19,9 +19,9 @@ export function slotBus(plugin: string, load: () => Promise<Bus>): Bus {
   const get = () => (bus ??= load())
   return {
     name: plugin.replace(/^.*realtime-/, ''),
-    publish: (channel, message) => get().then(b => b.publish(channel, message)),
-    subscribe: (channel, on, gap) => get().then(b => b.subscribe(channel, on, gap)),
-    close: () => (bus ? bus.then(b => b.close?.()) : Promise.resolve()),
+    publish: (channel, message) => get().then((b) => b.publish(channel, message)),
+    subscribe: (channel, on, gap) => get().then((b) => b.subscribe(channel, on, gap)),
+    close: () => (bus ? bus.then((b) => b.close?.()) : Promise.resolve()),
   }
 }
 
@@ -32,7 +32,10 @@ export function memoryBus(): Bus {
     name: 'memory',
     publish(channel, message) {
       const list = channels.get(channel)
-      if (list) queueMicrotask(() => { for (const on of list) on(message) })
+      if (list)
+        queueMicrotask(() => {
+          for (const on of list) on(message)
+        })
       return Promise.resolve()
     },
     subscribe(channel, on) {

package/src/{capture.mjs → capture.ts}

@@ -12,4 +12,37 @@
 const CODE = `(n=>{var d=document,c=navigator.connection,q=window.__wq={q:[],n:n,w(){},d:matchMedia("(prefers-reduced-data: reduce)").matches||!!(c&&c.saveData),p(e){var t=e.target,r=q.r,s=e.submitter;if(t.isConnected){q.r=1;try{e.type=="submit"?t.requestSubmit(s&&s.isConnected?s:void 0):e.type=="reset"?t.reset():t.dispatchEvent(new e.constructor(e.type,e))}finally{q.r=r}}}},o=t=>t.closest&&t.closest("[wk]"),h=e=>{var k=!q.r&&o(e.target);if(k&&(!k.$k||q.q.length)&&!((e.metaKey||e.ctrlKey||e.shiftKey)&&e.type=="click"&&e.target.closest("a"))){q.q.push(e);/^(click|submit|reset)$/.test(e.type)&&e.preventDefault();q.w(k)}},l=e=>{var k=o(e.target);k&&!k.$k&&!q.d&&q.w(k,1)};"click dblclick pointerdown pointerup mousedown mouseup keydown keyup input change submit reset focus blur focusin focusout".split(" ").forEach(t=>d.addEventListener(t,h,!0));"pointerover touchstart".split(" ").forEach(t=>d.addEventListener(t,l,{capture:!0,passive:!0}))})`
 
 /** The script's text. `now`: the page has work that can't wait, so its code loads straight away. */
-export const capture = now => `${CODE}(${now ? 1 : 0})`
+export const capture = (now: boolean) => `${CODE}(${now ? 1 : 0})`
+
+/**
+ * A page that runs no client until it's needed follows its links with full loads, so the browser prefetches the one the
+ * pointer rests on (`moderate`). Not a prerender, which would run the next page's code unseen. An island's links go
+ * through the router once its code comes, so they're left out, as is `/_weft/` and anything under `data-preload="off"`;
+ * `start()` takes the rules down when the router takes over, so nothing is fetched twice.
+ */
+const RULES = JSON.stringify({
+  prefetch: [
+    {
+      source: 'document',
+      where: {
+        and: [
+          { href_matches: '/*' },
+          { not: { href_matches: '/_weft/*' } },
+          {
+            not: {
+              selector_matches:
+                '[wk] a, a[wk], [data-preload="off"] a, a[data-preload="off"], a[download]',
+            },
+          },
+        ],
+      },
+      eagerness: 'moderate',
+    },
+  ],
+})
+
+/** The rules, for a page whose code waits (`now` false, nothing streaming). */
+export const speculate = (shape: { now: boolean; streaming?: boolean }) =>
+  shape.now || shape.streaming
+    ? ''
+    : `<script type="speculationrules" id="weft-speculate">${RULES}</script>\n`

package/src/changes-sql.d.mts

@@ -9,6 +9,12 @@ export const LOG_ROWS: number
 /** Between statements of generated SQL, as Drizzle splits them. */
 export const BREAK: string
 /** The trigger statements for these tables, one by one. */
-export function changeStatements(dialect: string, tables: readonly { name: string; pk?: string[] }[]): string[]
+export function changeStatements(
+  dialect: string,
+  tables: readonly { name: string; pk?: string[] }[],
+): string[]
 /** The same statements as one migration. */
-export function changeSql(dialect: string, tables: readonly { name: string; pk?: string[] }[]): string
+export function changeSql(
+  dialect: string,
+  tables: readonly { name: string; pk?: string[] }[],
+): string

package/src/changes-sql.mjs

@@ -14,10 +14,10 @@ export const MAX_IDS = 32
 export const LOG_ROWS = 4096
 export const BREAK = '\n--> statement-breakpoint\n'
 
-const pgName = n => `"${n.replaceAll('"', '""')}"`
-const myName = n => `\`${n.replaceAll('`', '``')}\``
-const literal = s => `'${s.replaceAll("'", "''")}'`
-const safe = t => t.replace(/\W/g, '_')
+const pgName = (n) => `"${n.replaceAll('"', '""')}"`
+const myName = (n) => `\`${n.replaceAll('`', '``')}\``
+const literal = (s) => `'${s.replaceAll("'", "''")}'`
+const safe = (t) => t.replace(/\W/g, '_')
 
 function postgres(tables) {
   const fn = `CREATE OR REPLACE FUNCTION weft_changes_notify() RETURNS trigger AS $weft$
@@ -48,7 +48,12 @@ $weft$ LANGUAGE plpgsql`
       `DROP TRIGGER IF EXISTS weft_changes_${suffix} ON ${on}`,
       `CREATE TRIGGER weft_changes_${suffix} AFTER ${event} ON ${on} ${rows ? `REFERENCING ${rows} TABLE AS weft_rows ` : ''}FOR EACH STATEMENT EXECUTE FUNCTION weft_changes_notify(${args})`,
     ]
-    return [...trigger('ins', 'INSERT', 'NEW'), ...trigger('upd', 'UPDATE', 'NEW'), ...trigger('del', 'DELETE', 'OLD'), ...trigger('trn', 'TRUNCATE')]
+    return [
+      ...trigger('ins', 'INSERT', 'NEW'),
+      ...trigger('upd', 'UPDATE', 'NEW'),
+      ...trigger('del', 'DELETE', 'OLD'),
+      ...trigger('trn', 'TRUNCATE'),
+    ]
   })
   return [fn, ...list]
 }
@@ -56,7 +61,8 @@ $weft$ LANGUAGE plpgsql`
 function sqlite(tables) {
   const log = `CREATE TABLE IF NOT EXISTS ${LOG} (seq INTEGER PRIMARY KEY AUTOINCREMENT, tbl TEXT NOT NULL, pk TEXT)`
   const list = tables.flatMap(({ name, pk }) => {
-    const id = row => (pk.length ? pk.map(c => `${row}.${pgName(c)}`).join(` || ':' || `) : 'NULL')
+    const id = (row) =>
+      pk.length ? pk.map((c) => `${row}.${pgName(c)}`).join(` || ':' || `) : 'NULL'
     const trigger = (suffix, event, row) => [
       `DROP TRIGGER IF EXISTS weft_changes_${safe(name)}_${suffix}`,
       `CREATE TRIGGER weft_changes_${safe(name)}_${suffix} AFTER ${event} ON ${pgName(name)} BEGIN
@@ -64,7 +70,11 @@ function sqlite(tables) {
   DELETE FROM ${LOG} WHERE seq <= last_insert_rowid() - ${LOG_ROWS};
 END`,
     ]
-    return [...trigger('ins', 'INSERT', 'NEW'), ...trigger('upd', 'UPDATE', 'NEW'), ...trigger('del', 'DELETE', 'OLD')]
+    return [
+      ...trigger('ins', 'INSERT', 'NEW'),
+      ...trigger('upd', 'UPDATE', 'NEW'),
+      ...trigger('del', 'DELETE', 'OLD'),
+    ]
   })
   return [log, ...list]
 }
@@ -72,12 +82,17 @@ END`,
 function mysql(tables) {
   const log = `CREATE TABLE IF NOT EXISTS ${LOG} (seq BIGINT AUTO_INCREMENT PRIMARY KEY, tbl VARCHAR(64) NOT NULL, pk VARCHAR(255), at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, KEY at_idx (at))`
   const list = tables.flatMap(({ name, pk }) => {
-    const id = row => (pk.length ? `CONCAT_WS(':', ${pk.map(c => `${row}.${myName(c)}`).join(', ')})` : 'NULL')
+    const id = (row) =>
+      pk.length ? `CONCAT_WS(':', ${pk.map((c) => `${row}.${myName(c)}`).join(', ')})` : 'NULL'
     const trigger = (suffix, event, row) => [
       `DROP TRIGGER IF EXISTS weft_changes_${safe(name)}_${suffix}`,
       `CREATE TRIGGER weft_changes_${safe(name)}_${suffix} AFTER ${event} ON ${myName(name)} FOR EACH ROW INSERT INTO ${LOG} (tbl, pk) VALUES (${literal(name)}, ${id(row)})`,
     ]
-    return [...trigger('ins', 'INSERT', 'NEW'), ...trigger('upd', 'UPDATE', 'NEW'), ...trigger('del', 'DELETE', 'OLD')]
+    return [
+      ...trigger('ins', 'INSERT', 'NEW'),
+      ...trigger('upd', 'UPDATE', 'NEW'),
+      ...trigger('del', 'DELETE', 'OLD'),
+    ]
   })
   return [log, ...list]
 }
@@ -96,4 +111,5 @@ export function changeStatements(dialect, tables) {
 }
 
 /** A migration file, in drizzle-kit's format. */
-export const changeSql = (dialect, tables) => `-- weft: report changes to ${tables.map(t => t.name).join(', ')} (\`weft db live\`). Ids only, never a row.\n${changeStatements(dialect, tables).join(`;${BREAK}`)};\n`
+export const changeSql = (dialect, tables) =>
+  `-- weft: report changes to ${tables.map((t) => t.name).join(', ')} (\`weft db live\`). Ids only, never a row.\n${changeStatements(dialect, tables).join(`;${BREAK}`)};\n`