react-cheminfo 0.4.1 → 0.7.0

package/src/seo/core/routes.ts

@@ -8,6 +8,17 @@
  * the table is a page a search engine only ever sees as the home page.
  */
 
+import { stripBasePath } from '../../router/core/basePath.ts';
+
+const QUERY_OR_FRAGMENT = /[?#]/;
+
+const TRAILING_SLASHES = /\/+$/;
+
+// A scheme and an authority: what `location.href` hands out, and the one shape
+// that cannot be confused with a path. `//host/path` is left as a path, because
+// a route table is free to name one.
+const ABSOLUTE_URL = /^[a-z][\d+.a-z-]*:\/\//i;
+
 /** A page, as a crawler and a shared card see it. */
 export interface RouteMeta {
   /** Absolute path, without a trailing slash and without a query string. */
@@ -16,10 +27,34 @@ export interface RouteMeta {
   title: string;
   /** One sentence, in the words someone would search for. */
   description: string;
+  /**
+   * The label the page is linked under where a title written for a search
+   * result is too long to read as a menu entry — the `noscript` index.
+   * @default the route's own title
+   */
+  short?: string;
+  /**
+   * What the page is for, written after an em dash next to its link in the
+   * `noscript` index.
+   * @default undefined — the link stands on its own
+   */
+  note?: string;
+  /**
+   * Whether the route also answers every address beneath it, so a section
+   * carrying more pages than a table can hold — an entry per structure, per
+   * ligand, per identifier — is indexed under the section rather than under the
+   * home page. Those addresses are canonical to the section itself.
+   * @default false
+   */
+  prefix?: boolean;
 }
 
 /**
  * The route an address names.
+ *
+ * An address a route claims exactly always wins over one that claims it as a
+ * subtree, and between two subtrees the longer claim wins, so `/molecules/HEM`
+ * is a molecule rather than whatever `/` answers.
  * @param routes - Every address the site answers.
  * @param path - Absolute path, without a query string.
  * @returns Its entry, or `undefined` when the site does not know the address.
@@ -28,11 +63,7 @@ export function routeFor(
   routes: readonly RouteMeta[],
   path: string,
 ): RouteMeta | undefined {
-  const wanted = trimTrailingSlash(path) || '/';
-  for (const route of routes) {
-    if (trimTrailingSlash(route.path) === wanted) return route;
-  }
-  return undefined;
+  return exactRoute(routes, path) ?? prefixRoute(routes, path);
 }
 
 /**
@@ -41,20 +72,51 @@ export function routeFor(
  * An address the site does not know is described as the home page rather than
  * invented on the fly, which is what the router does with it too. The query
  * string never reaches the answer: the structure being drawn and the
- * configuration a shared link carries are not pages of their own.
+ * configuration a shared link carries are not pages of their own. An absolute
+ * address is read for its path, so an app handing over `location.href` after an
+ * in-app move is answered rather than silently described as the home page.
+ *
+ * The route table is written from the site's own root, and a server behind a
+ * mount is handed the address the browser asked for — `/surge/exercises` for a
+ * table that names `/exercises`. So the address is read at the site's own root
+ * first, and the four lookups run in this order:
+ *
+ * 1. the mount taken off, claimed exactly;
+ * 2. the address as written, claimed exactly;
+ * 3. the mount taken off, claimed as a subtree;
+ * 4. the address as written, claimed as a subtree.
+ *
+ * Exact before subtree, or a `prefix` route — a home page answering everything
+ * beneath it above all — would claim every mounted address and the mount would
+ * never come off. Stripped before as-written, or the mount itself would open
+ * whichever page happens to carry the mount's own name rather than the site's
+ * front page. Taking the address as written second is what leaves an unmounted
+ * caller answering exactly as before, and lets a table whose own paths start
+ * with the mount's name still be read.
  * @param routes - Every address the site answers.
- * @param url - The address, query string and fragment included.
+ * @param url - The address, query string and fragment included, either as a
+ * path or as an absolute `scheme://host/path` address.
+ * @param basePath - The path the site is mounted at, when the address carries
+ * it, written `surge`, `/surge` or `/surge/`.
+ * @default '' — the address is already written from the site's own root
  * @returns The route it is indexed as.
  * @throws {Error} When the table is empty, so there is no page to fall back to.
  */
 export function pageMetaFor(
   routes: readonly RouteMeta[],
   url: string,
+  basePath = '',
 ): RouteMeta {
   const home = homeRoute(routes);
-  const cut = url.search(/[?#]/);
-  const path = cut === -1 ? url : url.slice(0, cut);
-  return routeFor(routes, path) ?? home;
+  const path = pathOf(url);
+  const own = stripBasePath(basePath, path);
+  return (
+    exactRoute(routes, own) ??
+    exactRoute(routes, path) ??
+    prefixRoute(routes, own) ??
+    prefixRoute(routes, path) ??
+    home
+  );
 }
 
 /**
@@ -66,14 +128,119 @@ export function pageMetaFor(
 export function homeRoute(routes: readonly RouteMeta[]): RouteMeta {
   const first = routes[0];
   if (first === undefined) throw new Error('a site answers at least one route');
-  return routeFor(routes, '/') ?? first;
+  return exactRoute(routes, '/') ?? first;
 }
 
 /**
- * Drop a trailing slash, so `/about/` and `/about` are one page.
+ * Check a route table before a build reads it as a set of file names.
+ *
+ * An address written twice ships two sitemap entries and two links to a page
+ * only the first entry describes, and one carrying a `..` segment writes its
+ * file outside the build output — a real build asked for `/../escaped` and got
+ * a sibling of `dist`. Two addresses that differ only in an empty segment or in
+ * case are the same defect wearing a disguise: `//x` and `/x` both write
+ * `dist/x/index.html`, and so do `/About` and `/about` on the case-insensitive
+ * filesystem macOS and Windows ship by default — one file, two sitemap entries,
+ * and only one of the two descriptions survives. All of it is author
+ * configuration read at build time, so it is refused where it is written rather
+ * than repaired where it lands.
+ * @param routes - Every address the site answers.
+ * @throws {Error} When the table is empty, names one address twice — under any
+ * of those spellings — or carries a path that is not one.
+ */
+export function assertRoutes(routes: readonly RouteMeta[]): void {
+  if (routes.length === 0) throw new Error('a site answers at least one route');
+
+  const claimed = new Set<string>();
+  const folded = new Map<string, string>();
+  for (const route of routes) {
+    const written = JSON.stringify(route.path);
+    assertPath(route.path, written);
+    const address = trimTrailingSlash(route.path) || '/';
+    if (address.includes('//')) {
+      throw new Error(`a route path names no empty segment: ${written}`);
+    }
+    if (claimed.has(address)) {
+      throw new Error(`a route path is written once: ${written}`);
+    }
+    const first = folded.get(address.toLowerCase());
+    if (first !== undefined) {
+      throw new Error(
+        `two route paths name one file on a case-insensitive disk: ${first} and ${written}`,
+      );
+    }
+    claimed.add(address);
+    folded.set(address.toLowerCase(), written);
+  }
+}
+
+/**
+ * Drop the trailing slashes, so `/about/` and `/about` are one page and an
+ * origin written `https://host/surge//` composes one address rather than one
+ * with an empty segment in it.
  * @param value - A path or an origin.
- * @returns It, without the trailing slash `/` itself keeps.
+ * @returns It, without the trailing slashes `/` itself keeps.
  */
 export function trimTrailingSlash(value: string): string {
-  return value.length > 1 && value.endsWith('/') ? value.slice(0, -1) : value;
+  const trimmed = value.replace(TRAILING_SLASHES, '');
+  return trimmed === '' && value !== '' ? '/' : trimmed;
+}
+
+function assertPath(path: string, written: string): void {
+  if (!path.startsWith('/')) {
+    throw new Error(`a route path starts at the site root: ${written}`);
+  }
+  if (QUERY_OR_FRAGMENT.test(path)) {
+    throw new Error(
+      `a route path carries no query string and no fragment: ${written}`,
+    );
+  }
+  if (path.split('/').includes('..')) {
+    throw new Error(`a route path stays inside the site: ${written}`);
+  }
+}
+
+// The path half of whatever the caller had at hand: an absolute address, or a
+// path already, with the query string and the fragment cut off either way.
+function pathOf(url: string): string {
+  if (ABSOLUTE_URL.test(url) && URL.canParse(url)) return new URL(url).pathname;
+  const cut = url.search(QUERY_OR_FRAGMENT);
+  return cut === -1 ? url : url.slice(0, cut);
+}
+
+function exactRoute(
+  routes: readonly RouteMeta[],
+  path: string,
+): RouteMeta | undefined {
+  const wanted = trimTrailingSlash(path) || '/';
+  for (const route of routes) {
+    if ((trimTrailingSlash(route.path) || '/') === wanted) return route;
+  }
+  return undefined;
+}
+
+function prefixRoute(
+  routes: readonly RouteMeta[],
+  path: string,
+): RouteMeta | undefined {
+  const wanted = trimTrailingSlash(path) || '/';
+  let claimed: RouteMeta | undefined;
+  let claimedLength = -1;
+
+  for (const route of routes) {
+    if (route.prefix !== true) continue;
+    const routePath = trimTrailingSlash(route.path) || '/';
+    if (!isUnder(routePath, wanted)) continue;
+    if (routePath.length > claimedLength) {
+      claimed = route;
+      claimedLength = routePath.length;
+    }
+  }
+  return claimed;
+}
+
+function isUnder(routePath: string, path: string): boolean {
+  // `/surgeon` is not a page of `/surge`, so a claim only holds when what
+  // follows it is a path of its own.
+  return routePath === '/' || path.startsWith(`${routePath}/`);
 }

package/src/seo/core/siteFiles.ts

@@ -1,21 +1,26 @@
 /**
- * The files and blocks a crawler reads besides the head: the sitemap, the
- * robots policy, the structured-data block and the list of addresses a visitor
- * without JavaScript can still follow.
+ * The sitemap, and what every other file a crawler fetches on its own is
+ * derived from: which site is being written, where it is served, and the path
+ * it is mounted at.
  *
- * All four are derived from the site's own record and its route table, so a
- * page added to the table is added to every one of them at once.
+ * A deployment names where it serves the site in full — origin and mount path
+ * in one value — because the origin is what a canonical link and a sitemap
+ * entry need. The mount is read back out of it here, so the addresses these
+ * files hand out start where the site actually answers.
  */
 
-import { siteById, siteDisplayName } from '../../ecosystem/core/lookup.ts';
+import { siteById } from '../../ecosystem/core/lookup.ts';
 import type { EcosystemSite, SiteId } from '../../ecosystem/core/sites.ts';
-import { escapeAttribute, escapeText } from '../../share/core/escape.ts';
+import { basePathOf } from '../../router/core/basePath.ts';
+import { escapeText } from '../../share/core/escape.ts';
 
 import type { RouteMeta } from './routes.ts';
 import { trimTrailingSlash } from './routes.ts';
 
-/** The sequence that must not appear raw inside a script element. */
-const SCRIPT_SAFE_LESS_THAN = String.raw`\u003c`;
+// A crawler fetches what it is given over HTTP, so an origin is written in one
+// of the two schemes it speaks. Parsing alone does not say that: `localhost:3000`
+// parses, with `localhost:` as its scheme and `3000` as its path.
+const HTTP_ORIGIN = /^https?:\/\//i;
 
 /** What a crawler is told about the site as a whole. */
 export interface SiteFilesOptions {
@@ -24,7 +29,9 @@ export interface SiteFilesOptions {
   /** Every address it answers. */
   routes: readonly RouteMeta[];
   /**
-   * Origin every absolute address is built on.
+   * Where the site is served, mount path included, e.g.
+   * `https://learn.cheminfo.org/surge`. Every absolute address is built on it,
+   * and every path one of these files writes starts at its mount.
    * @default `https://<the site's host>`
    */
   origin?: string;
@@ -32,11 +39,20 @@ export interface SiteFilesOptions {
 
 /**
  * Every routed address, as the sitemap lists them.
+ *
+ * A sitemap names at least one address: `<url>` is required by the sitemaps.org
+ * schema, and `robots.txt` advertises the file, so an empty one is reported as
+ * an error on every fetch rather than read as a site with nothing to index.
  * @param options - The site and its routes.
  * @returns The `sitemap.xml` document.
+ * @throws {Error} When the site answers no route, or names an origin that is
+ * not an absolute address.
  */
 export function sitemapXml(options: SiteFilesOptions): string {
   const origin = originOf(options);
+  if (options.routes.length === 0) {
+    throw new Error('a sitemap lists at least one address');
+  }
   const entries = options.routes
     .map(
       (route) =>
@@ -51,100 +67,46 @@ ${entries}
 }
 
 /**
- * The crawl policy.
- *
- * Our tools are meant to be found, so only the endpoints are disallowed — an
- * API prefix and its documentation are not pages. The sitemap is named only
- * because this module also writes it: a `Sitemap:` line pointing at a 404 is
- * reported as an error on every fetch.
- * @param options - The site and its routes.
- * @param disallow - Address prefixes to keep out of the index.
- * @returns The `robots.txt` document.
+ * The site these files are being written for.
+ * @param site - The site, named or passed.
+ * @returns Its record.
  */
-export function robotsTxt(
-  options: SiteFilesOptions,
-  disallow: readonly string[] = [],
-): string {
-  const lines = ['User-agent: *', 'Allow: /'];
-  for (const path of disallow) lines.push(`Disallow: ${path}`);
-  lines.push('', `Sitemap: ${originOf(options)}/sitemap.xml`, '');
-  return lines.join('\n');
-}
-
-/** What the structured-data block says the tool is. */
-export interface StructuredDataOptions extends SiteFilesOptions {
-  /**
-   * The schema.org application category.
-   * @default 'EducationalApplication'
-   */
-  category?: string;
-  /**
-   * What the tool needs to run.
-   * @default 'Any modern browser'
-   */
-  operatingSystem?: string;
+export function resolveSite(site: EcosystemSite | SiteId): EcosystemSite {
+  return typeof site === 'string' ? siteById(site) : site;
 }
 
 /**
- * One `application/ld+json` block describing the tool.
+ * Where the site is served, as an absolute address without a trailing slash.
  *
- * It is the same on every page of a site — what varies per page is the head —
- * so it is written into the built page once rather than per route.
- * @param options - The site, and what kind of application it is.
- * @returns The script tag, ready to put in the head.
+ * It is an absolute `http` or `https` address or it is refused: a canonical
+ * link, an `og:url` and a sitemap entry are addresses a crawler resolves on its
+ * own, and one written from an origin missing its scheme is resolved against
+ * whatever directory the page was fetched from — pointing every page of the
+ * site at a sibling of itself. A dev or staging origin written `localhost:3000`
+ * is refused for the same reason: it parses, but as a path under a `localhost:`
+ * scheme, so the mount read back off it would be `/3000`.
+ * @param options - The site and where it is served.
+ * @returns The origin, mount path included when the deployment named one.
+ * @throws {Error} When the deployment named something that is not an absolute
+ * `http` or `https` address.
  */
-export function structuredDataScript(options: StructuredDataOptions): string {
-  const site = resolveSite(options.site);
-  const data = {
-    '@context': 'https://schema.org',
-    '@type': 'WebApplication',
-    name: siteDisplayName(site),
-    url: `${originOf(options)}/`,
-    description: site.tagline,
-    applicationCategory: options.category ?? 'EducationalApplication',
-    operatingSystem: options.operatingSystem ?? 'Any modern browser',
-    offers: { '@type': 'Offer', price: '0', priceCurrency: 'EUR' },
-    publisher: { '@type': 'Organization', name: 'cheminfo' },
-  };
-  const json = JSON.stringify(data, null, 2).replaceAll(
-    '<',
-    SCRIPT_SAFE_LESS_THAN,
-  );
-  return `<script type="application/ld+json">\n${json}\n</script>`;
+export function originOf(options: SiteFilesOptions): string {
+  const origin = options.origin ?? `https://${resolveSite(options.site).host}`;
+  if (!HTTP_ORIGIN.test(origin) || !URL.canParse(origin)) {
+    throw new Error(
+      `an origin is an absolute address, e.g. https://surge.cheminfo.org: ${JSON.stringify(origin)}`,
+    );
+  }
+  return trimTrailingSlash(origin);
 }
 
 /**
- * A readable page for a visitor, or a crawler, with no JavaScript.
- *
- * The body of our sites is an empty root element, so this is the only crawl
- * path through them that costs nothing to render — and it is honest: it says
- * the tool needs JavaScript, and links every address it answers.
- * @param options - The site and its routes.
- * @returns The `noscript` block, ready to put in the body.
+ * The path the deployment is mounted at, read off the address it named.
+ * @param options - The site and where it is served.
+ * @returns `''` for a site owning its host, `/surge` for one mounted under it.
+ * @throws {Error} When the deployment named something that is not an absolute
+ * address, so there is no path to read off it.
  */
-export function noscriptIndex(options: SiteFilesOptions): string {
-  const site = resolveSite(options.site);
-  const items = options.routes
-    .map(
-      (route) =>
-        `    <li><a href="${escapeAttribute(route.path)}">${escapeText(route.title)}</a></li>`,
-    )
-    .join('\n');
-  return `<noscript>
-  <h1>${escapeText(siteDisplayName(site))}</h1>
-  <p>${escapeText(site.tagline)} This tool needs JavaScript; these are the pages it offers:</p>
-  <ul>
-${items}
-  </ul>
-</noscript>`;
-}
-
-function resolveSite(site: EcosystemSite | SiteId): EcosystemSite {
-  return typeof site === 'string' ? siteById(site) : site;
-}
-
-function originOf(options: SiteFilesOptions): string {
-  return trimTrailingSlash(
-    options.origin ?? `https://${resolveSite(options.site).host}`,
-  );
+export function mountPathOf(options: SiteFilesOptions): string {
+  return basePathOf(originOf(options));
 }

package/src/seo/core/startDocumentMeta.ts

@@ -0,0 +1,77 @@
+/**
+ * Keep the tab and the canonical link in step with the page on screen.
+ *
+ * The server, or the build that wrote one file per address, already titled the
+ * page it handed out; this is what a move inside the app changes, and what a
+ * crawler that renders the page reads afterwards. Every site did the same three
+ * things around it — read the address it is on, look it up in its route table,
+ * write the head — so all three live here, and a site says only where its
+ * address is read and how a change to it is noticed.
+ */
+
+import { writeDocumentMeta } from './documentMeta.ts';
+import type { PageMetaOptions } from './pageMeta.ts';
+import { pageDocumentMeta } from './pageMeta.ts';
+
+/** Where a site's address is read, and how a change to it is noticed. */
+export interface StartDocumentMetaOptions extends Omit<
+  PageMetaOptions,
+  'url' | 'image'
+> {
+  /**
+   * The address on screen, query string included: a path, or the absolute
+   * address read off the page. It is read again on every write, so a `follow`
+   * that tracks what it reads — a signals `effect` — notices the next page.
+   */
+  url: () => string;
+  /**
+   * How a change of page is noticed: `effect` from `@preact/signals-react`
+   * follows whichever signals `url` reads and hands back the function that
+   * stops it. Left out, the head is written once, which is what a site calling
+   * this from its own `popstate` handler wants.
+   * @default undefined — the head is written once
+   */
+  follow?: (write: () => void) => () => void;
+}
+
+/**
+ * Write the head of the page on screen, and keep it in step as the page
+ * changes.
+ *
+ * Nothing happens where there is no document — a prerender script, a unit test
+ * of the route table — so this is safe to call from a module either of them
+ * imports.
+ * @param options - The site, its routes, where its address is read and how a
+ * change to it is noticed.
+ * @returns The function that stops following, which does nothing when nothing
+ * was followed.
+ * @throws {Error} When the site answers no route, or names an origin that is
+ * not an absolute address.
+ */
+export function startDocumentMeta(
+  options: StartDocumentMetaOptions,
+): () => void {
+  if (typeof document === 'undefined') return stopNothing;
+
+  const write = (): void => {
+    writeDocumentMeta(
+      pageDocumentMeta({
+        site: options.site,
+        routes: options.routes,
+        url: options.url(),
+        origin: options.origin,
+      }),
+    );
+  };
+
+  return (options.follow ?? writeOnce)(write);
+}
+
+function writeOnce(write: () => void): () => void {
+  write();
+  return stopNothing;
+}
+
+function stopNothing(): void {
+  // Nothing was followed, so there is nothing to stop.
+}

package/src/seo/core/structuredData.ts

@@ -0,0 +1,80 @@
+/**
+ * One `application/ld+json` block describing the tool.
+ *
+ * It is the same on every page of a site — what varies per page is the head —
+ * so it is written into the built page once rather than per route.
+ */
+
+import { siteDisplayName } from '../../ecosystem/core/lookup.ts';
+
+import type { SiteFilesOptions } from './siteFiles.ts';
+import { originOf, resolveSite } from './siteFiles.ts';
+
+/** The sequence that must not appear raw inside a script element. */
+const SCRIPT_SAFE_LESS_THAN = String.raw`\u003c`;
+
+/** What the structured-data block says the tool is. */
+export interface StructuredDataOptions extends SiteFilesOptions {
+  /**
+   * The schema.org application category.
+   * @default 'EducationalApplication'
+   */
+  category?: string;
+  /**
+   * What the tool needs to run.
+   * @default 'Any modern browser'
+   */
+  operatingSystem?: string;
+  /**
+   * What the tool does, in the words a search result is read in. A site whose
+   * indexed sentence says more than the line its tile in the family menu
+   * carries writes it here.
+   * @default the site's tagline
+   */
+  description?: string;
+  /**
+   * What a browser has to offer for the tool to run. Ours run in the page.
+   * @default 'Requires JavaScript'
+   */
+  browserRequirements?: string;
+  /**
+   * The currency the price is quoted in. The price is zero either way, but the
+   * pair has to agree with the audience the site is read by.
+   * @default 'EUR'
+   */
+  currency?: string;
+}
+
+/**
+ * The structured-data block, ready to put in the head.
+ *
+ * It always says the tool is free: the price is zero, and a block that leaves
+ * that implicit is one a rich result declines to show.
+ * @param options - The site, and what kind of application it is.
+ * @returns The script tag.
+ */
+export function structuredDataScript(options: StructuredDataOptions): string {
+  const site = resolveSite(options.site);
+  const data = {
+    '@context': 'https://schema.org',
+    '@type': 'WebApplication',
+    name: siteDisplayName(site),
+    url: `${originOf(options)}/`,
+    description: options.description ?? site.tagline,
+    applicationCategory: options.category ?? 'EducationalApplication',
+    operatingSystem: options.operatingSystem ?? 'Any modern browser',
+    browserRequirements: options.browserRequirements ?? 'Requires JavaScript',
+    offers: {
+      '@type': 'Offer',
+      price: '0',
+      priceCurrency: options.currency ?? 'EUR',
+    },
+    isAccessibleForFree: true,
+    publisher: { '@type': 'Organization', name: 'cheminfo' },
+  };
+  const json = JSON.stringify(data, null, 2).replaceAll(
+    '<',
+    SCRIPT_SAFE_LESS_THAN,
+  );
+  return `<script type="application/ld+json">\n${json}\n</script>`;
+}

package/src/seo/core/template.ts

@@ -0,0 +1,54 @@
+/**
+ * Where a built page lets its head and its body be written.
+ *
+ * Every address of a site needs its own title, description, canonical and card,
+ * and a static build ships one `index.html`. Rather than look for the tags a
+ * page already carries and operate on them, the template says where they go:
+ * two comments, replaced by what the build or the server writes for the address
+ * being answered.
+ *
+ * ```html
+ * <head>
+ *   <meta charset="utf-8" />
+ *   <link rel="icon" href="%BASE_URL%favicon.svg" />
+ *   <!--cheminfo:head-->
+ * </head>
+ * <body>
+ *   <div id="root"></div>
+ *   <!--cheminfo:body-->
+ * </body>
+ * ```
+ *
+ * The template carries no title and no description of its own, so nothing can
+ * be duplicated and nothing has to be taken back out. Nothing is parsed and
+ * nothing is searched for but the marker, so what the rest of the page holds — a
+ * byte order mark, an implicit head, a `</head>` its prose displays or a script
+ * quotes, an unterminated comment — cannot reach the result.
+ */
+
+/** Where the head a crawler reads is written. */
+export const PAGE_HEAD_MARKER = '<!--cheminfo:head-->';
+
+/** Where the crawl path a visitor with no JavaScript reads is written. */
+export const PAGE_BODY_MARKER = '<!--cheminfo:body-->';
+
+/**
+ * Write content in the place the template kept for it.
+ *
+ * The marker is consumed, so a page is always filled from the template and
+ * never from a filled page: applying this twice throws rather than writing a
+ * second head, which is why idempotence is not something the caller has to
+ * defend.
+ * @param html - The template.
+ * @param marker - {@link PAGE_HEAD_MARKER} or {@link PAGE_BODY_MARKER}.
+ * @param content - The markup to write, taken as written: no `$&`, `$1` or
+ * `$<name>` is expanded.
+ * @returns The page.
+ * @throws {Error} When the template carries no such marker, rather than
+ * silently shipping a page with no head.
+ */
+export function fill(html: string, marker: string, content: string): string {
+  const at = html.indexOf(marker);
+  if (at === -1) throw new Error(`the page carries no ${marker}`);
+  return html.slice(0, at) + content + html.slice(at + marker.length);
+}