bun-plugin-stx 0.2.293 → 0.2.294

package/dist/{chunk-nb1x6zdk.js → chunk-awcgpf66.js}

@@ -986,8 +986,8 @@ function getRouterScript() {
   // Unlike a fragment, a document holds the answer directly, so there is
   // nothing to infer from markers or ask the server for: look for the script.
   // Both emitted shapes carry data-stx-runtime \u2014 inline, and the serve-mode
-  // src="/_stx/runtime.js" \u2014 with the content sniff behind it for a document
-  // rendered by a server old enough not to stamp the attribute.
+  // src="/_stx/runtime.<hash>.js" \u2014 with the content sniff behind it for a
+  // document rendered by a server old enough not to stamp the attribute.
   function documentShipsRuntime(doc,html){
     if(doc&&doc.querySelector&&doc.querySelector('script[data-stx-runtime]'))return true;
     return html.indexOf("'use strict';var cloakStyle")!==-1
@@ -998,6 +998,22 @@ function getRouterScript() {
       ||(code.indexOf('_cleanupContainer')!==-1&&code.indexOf('signals runtime loading')!==-1)
       ||code.indexOf("'use strict';var cloakStyle")!==-1;
   }
+  // The runtime and the router themselves, as external script tags.
+  //
+  // Serve mode links both by content hash, so after a deploy the incoming
+  // page's copy has a different URL from the one this document loaded. Every
+  // path below that loads a script[src] it has not seen yet would then run a
+  // second router and a second runtime over the live ones \u2014 two click
+  // handlers on every link, a fresh window.stx under scopes created by the
+  // old one. A new version is picked up by the build-skew reload instead; it
+  // is never loaded into a running page. The attrs form is for the fragment
+  // path, which sees a tag as text.
+  function isSharedClientScript(el){
+    return !!(el&&el.hasAttribute&&(el.hasAttribute('data-stx-runtime')||el.hasAttribute('data-stx-router')));
+  }
+  function isSharedClientScriptAttrs(attrs){
+    return /(?:^|\\s)data-stx-(?:runtime|router)(?:[\\s=]|$)/i.test(attrs||'');
+  }
   // A fragment never carries the signals runtime: the server strips the runtime
   // IIFE out of it, and every re-execution path here filters it out again. So a
   // page that never needed a runtime cannot hydrate a fragment that does \u2014 the
@@ -1554,7 +1570,7 @@ else {
           // file is where the page's factory usually lives.
           var srcMatch=attrs.match(/\\bsrc\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))/i);
           var fragSrc=srcMatch&&(srcMatch[1]||srcMatch[2]||srcMatch[3]);
-          if(fragSrc){fragExternalScripts.push(fragSrc);return ''}
+          if(fragSrc){if(!isSharedClientScriptAttrs(attrs))fragExternalScripts.push(fragSrc);return ''}
           if(code&&code.trim()&&!isSignalsRuntimeScript({hasAttribute:function(name){return name==='data-stx-runtime'&&attrs.indexOf('data-stx-runtime')!==-1}},code)){
             var slot='fragment-'+(++fragScriptId);
             var scoped=/(?:^|\\s)data-stx-scoped(?:\\s|=|$)/i.test(attrs);
@@ -1902,7 +1918,8 @@ else {
           var text=s.textContent||'';
           // Not discarded: queued against docBase, so a relative src resolves
           // against the page being navigated to rather than the current URL.
-          if(s.hasAttribute('src')){routedExternalScripts.push(s.getAttribute('src'));s.remove();return}
+          // The runtime and router are dropped, not queued: see isSharedClientScript.
+          if(s.hasAttribute('src')){if(!isSharedClientScript(s))routedExternalScripts.push(s.getAttribute('src'));s.remove();return}
           var type=(s.getAttribute('type')||'').trim().toLowerCase();
           var executable=!type||type==='text/javascript'||type==='application/javascript'||type==='module';
           if(!executable||!text.trim())return;
@@ -1959,6 +1976,7 @@ else {
       document.querySelectorAll('head script[src]').forEach(function(s){loadedSrcs[s.src]=1});
       var extPromises=[];
       doc.querySelectorAll('head script[src]').forEach(function(s){
+        if(isSharedClientScript(s))return;
         // Fetched-document script: resolve against the page being navigated to
         // (docBase), not the origin root \u2014 same rationale as the <link> reconcile (#1777).
         var src=new URL(s.getAttribute('src'),docBase).href;

package/dist/serve.d.ts

@@ -99,6 +99,23 @@ export declare function isProductionServe(): boolean;
  * given URL, so it gets the long immutable lifetime.
  */
 export declare function staticCacheControl(pathname: string, production?: boolean): string;
+/**
+ * `Cache-Control` for the shared runtime and router scripts.
+ *
+ * Pages link them by content hash (getServeClientAsset), so a request whose
+ * hash is the current content's can never see different bytes under that URL:
+ * cache it for a year.
+ *
+ * Anything else is answered with today's content but must not be kept. The
+ * unhashed URL is what HTML rendered before content addressing still points
+ * at, and a stale hash is a page from the previous deploy; either one caching
+ * the current bytes would pin them there. `no-cache`, not a short max-age:
+ * Cloudflare raises a max-age below its browser-TTL setting (four hours by
+ * default) to that setting, which is exactly how the old fixed URL served a
+ * previous release's router for hours after a deploy. It leaves `no-cache`
+ * alone, and the ETag keeps the revalidation to a 304.
+ */
+export declare function sharedScriptCacheControl(requestedHash: string | undefined, currentHash: string): string;
 /**
  * Render the built-in fallback 404 page.
  *
@@ -170,6 +187,8 @@ export declare function serve(options: ServeOptions): Promise<void>;
  * is the name every double-submit implementation in this ecosystem uses.
  */
 export declare const CSRF_COOKIE: 'X-CSRF-Token';
+/** `/_stx/runtime.js`, `/_stx/router.<16 hex>.js`, … — the shared client scripts. */
+export declare const SHARED_SCRIPT_PATH: unknown;
 /**
  * Build the candidate regexes for a dynamic route file (stacksjs/stx#1927).
  *

package/dist/serve.js

@@ -8940,6 +8940,10 @@ function staticCacheControl(pathname, production = isProductionServe()) {
   const fingerprinted = /[.-][0-9a-f]{8,}\.[a-z0-9]+$/i.test(pathname);
   return fingerprinted ? "public, max-age=31536000, immutable" : "public, max-age=3600";
 }
+var SHARED_SCRIPT_PATH = /^\/_stx\/(runtime|router)(?:\.([0-9a-f]{16}))?\.js$/;
+function sharedScriptCacheControl(requestedHash, currentHash) {
+  return requestedHash === currentHash ? "public, max-age=31536000, immutable" : "no-cache";
+}
 function render404Page(opts) {
   const { path, routes = [], isProduction } = opts;
   const baseStyles = `
@@ -9700,7 +9704,7 @@ function __stxOverlay(errs){
     pageMiddlewarePatterns.length = 0;
     await Promise.all(files.map((f) => detectPageMiddleware(f)));
     try {
-      const { Router } = await import("./chunk-nb1x6zdk.js");
+      const { Router } = await import("./chunk-awcgpf66.js");
       const pagesDirs = patterns.map((p) => p.replace(/\/$/, "")).filter(Boolean);
       const router = new Router(process19.cwd(), { pagesDirs, stateDir: stateDirName() });
       if (!options.quiet)
@@ -10427,13 +10431,15 @@ ${block}`;
                     }
                   });
                 }
-                if (path === "/_stx/runtime.js" || path === "/_stx/router.js") {
+                const sharedScript = path.match(SHARED_SCRIPT_PATH);
+                if (sharedScript) {
                   const stx = await stxModule;
-                  const content2 = path === "/_stx/runtime.js" ? await stx.getCachedSignalsRuntime(stxConfig.debug === true) : await stx.getCachedRouterScript();
-                  const etag = `"${Bun.hash(content2).toString(16)}"`;
+                  const asset = await stx.getServeClientAsset(sharedScript[1], sharedScript[1] === "runtime" && stxConfig.debug === true);
+                  const content2 = asset.content;
+                  const etag = `"${asset.hash}"`;
                   const headers = {
                     "Content-Type": "application/javascript; charset=utf-8",
-                    "Cache-Control": production ? "public, max-age=3600, stale-while-revalidate=86400" : "public, max-age=0, must-revalidate",
+                    "Cache-Control": sharedScriptCacheControl(sharedScript[2], asset.hash),
                     ETag: etag,
                     ...corsHeaders
                   };
@@ -11090,6 +11096,7 @@ if (import.meta.main) {
 export {
   usableErrorPage,
   staticCacheControl,
+  sharedScriptCacheControl,
   serve,
   routeSpecificity,
   resolveServeOpenUrl,
@@ -11105,5 +11112,6 @@ export {
   bundleBrowserAsset,
   buildDynamicRouteRegexes,
   boundedCache,
+  SHARED_SCRIPT_PATH,
   CSRF_COOKIE
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bun-plugin-stx",
   "type": "module",
-  "version": "0.2.293",
+  "version": "0.2.294",
   "description": "A Bun plugin that allows for using Laravel Blade-like syntax.",
   "author": "Chris Breuer <chris@stacksjs.org>",
   "license": "MIT",