@zubra/server 5.5.0 → 5.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zubra/server",
-  "version": "5.5.0",
+  "version": "5.7.0",
   "description": "Zubra on the server: render components into any template engine's pages, serve their browser modules, and give frameworks' HTML its components' shadow roots.",
   "type": "module",
   "main": "./src/index.js",
@@ -35,8 +35,8 @@
     "test": "node --test \"test/*.test.js\""
   },
   "peerDependencies": {
-    "@zubra/compiler": "^5.5.0",
-    "@zubra/runtime": "^5.5.0"
+    "@zubra/compiler": "^5.7.0",
+    "@zubra/runtime": "^5.7.0"
   },
   "devDependencies": {
     "@minify-html/node": "0.18.1",

package/src/core.js

@@ -19,7 +19,7 @@ export { SOURCE_EXTENSION, TYPES };
  * host serves under `<base>/` beyond the components' modules (`{ status, type, body }` or null).
  * `needs(name, code)`: the host's check on a compiled module (a package it needs being installed).
  */
-export function createCore({ request, files, sourcesOf: readSources, cache = true, devtools = false, base, imports = {}, syncImports = {}, needs = (_name, code) => code, where = 'the components', assets = () => null }) {
+export function createCore({ request, files, sourcesOf: readSources, cache = true, devtools = false, base, imports = {}, syncImports = {}, needs = (_name, code) => code, where = 'the components', assets = () => null, warn = (message) => console.warn(message) }) {
   const memo = new Map();
   const once = (key, make) => {
     if (!cache || !memo.has(key)) memo.set(key, make());
@@ -42,8 +42,15 @@ export function createCore({ request, files, sourcesOf: readSources, cache = tru
   const byTag = () => once('tags', () => new Map([...files.keys()].map((name) => [describe(name).tag, name])));
   const nameOf = (nameOrTag) => (files.has(nameOrTag) ? nameOrTag : byTag().get(nameOrTag));
 
-  const render = (name, props = {}, slots = {}, pending = []) =>
-    call(pathOf(name), { emit: 'html', props, slots, slotSource: 'html', partial: true, ...(pending.length ? { pending } : {}) });
+  const render = (name, props = {}, slots = {}, pending = []) => {
+    const path = pathOf(name);
+    const response = request({ path, files: sourcesOf(path), emit: 'html', props, slots, slotSource: 'html', partial: true, ...(pending.length ? { pending } : {}) });
+    if (!response.ok) throw new Error(response.error);
+    // A value that isn't a safe URL (a user's `javascript:` link) is left out, as the element
+    // leaves it out in the browser; the page still renders, and this says what was dropped.
+    for (const message of response.omitted ?? []) warn(`@zubra/server: <${name}>: ${message}`);
+    return response.output;
+  };
   const css = (name) => once(`css:${name}`, () => call(pathOf(name), { emit: 'css' }));
   const js = (name) => once(`js:${name}`, () => {
     const path = pathOf(name);

package/src/edge.d.ts

@@ -37,6 +37,8 @@ export interface EdgeOptions {
   devtools?: boolean;
   /** More import map entries; use it to point `@zubra/runtime` at a CDN, or at your static assets. */
   imports?: Record<string, string>;
+  /** Told when a render leaves out an attribute whose value isn't a safe URL (default `console.warn`). */
+  warn?: (message: string) => void;
 }
 
 export declare function createZubra(options: EdgeOptions): EdgeZubra;

package/src/edge.js

@@ -37,7 +37,7 @@ function normalize(path) {
  * `cache`, `devtools` (off by default here: the DevTools need the runtime's development build,
  * which you would have to serve yourself) and `imports`.
  */
-export function createZubra({ wasm, compiler = wasm ? createCompiler(wasm) : null, components = {}, prefix = '/_zubra', cache = true, devtools = false, imports = {} } = {}) {
+export function createZubra({ wasm, compiler = wasm ? createCompiler(wasm) : null, components = {}, prefix = '/_zubra', cache = true, devtools = false, imports = {}, warn } = {}) {
   if (!compiler) throw new Error("@zubra/server/edge: createZubra() needs the compiler's WebAssembly module (`wasm`), or a `compiler` from createCompiler()");
   const sources = new Map(); // path → source
   const files = new Map(); // name → path
@@ -73,6 +73,7 @@ export function createZubra({ wasm, compiler = wasm ? createCompiler(wasm) : nul
   }
 
   return createCore({
+    warn,
     request: (body) => compiler.request(body),
     files,
     sourcesOf: (path) => sourcesOf(path),

package/src/index.d.ts

@@ -4,7 +4,10 @@ export interface ComponentInfo { tag: string; shadow: boolean; form: boolean; pr
 export interface Page {
   /** The components this page rendered, in order. */
   readonly used: string[];
-  /** A component's server-rendered HTML (by its file name, or its tag). */
+  /**
+   * A component's server-rendered HTML (by its file name, or its tag). `slots` are HTML, kept as
+   * written: other components' `render()` output included, so one can be put inside another.
+   */
   render(name: string, props?: Record<string, unknown>, slots?: Record<string, string>): string;
   /** The used components' CSS and the import map, for `<head>`. */
   head(): string;
@@ -66,6 +69,8 @@ export interface ZubraOptions {
    * except in production; `ZUBRA_DEVTOOLS=1` turns it on there too).
    */
   devtools?: boolean;
+  /** Told when a render leaves out an attribute whose value isn't a safe URL (default `console.warn`). */
+  warn?: (message: string) => void;
 }
 
 export declare function createZubra(options?: ZubraOptions): Zubra;

package/src/index.js

@@ -43,7 +43,7 @@ const posix = (path) => path.split(sep).join('/');
  *
  * Everything that doesn't need a disk is in `core.js`, shared with `edge.js` (Workers).
  */
-export function createZubra({ components = 'components', prefix = '/_zubra', cache = true, production = process.env.NODE_ENV === 'production', devtools = process.env.ZUBRA_DEVTOOLS === '1' || !production, imports = {} } = {}) {
+export function createZubra({ components = 'components', prefix = '/_zubra', cache = true, production = process.env.NODE_ENV === 'production', devtools = process.env.ZUBRA_DEVTOOLS === '1' || !production, imports = {}, warn } = {}) {
   const root = resolve(components);
   if (!existsSync(root)) throw new Error(`@zubra/server: no components folder at ${root}`);
   const sourceDir = dirname(fileURLToPath(import.meta.resolve('@zubra/runtime')));
@@ -99,6 +99,7 @@ export function createZubra({ components = 'components', prefix = '/_zubra', cac
   };
 
   const core = createCore({
+    warn,
     request: (body) => compiler.request(body),
     files,
     sourcesOf: (path) => compiler.sources(path),