ugly-app 0.1.844 → 0.1.845

package/README.md

@@ -43,6 +43,7 @@ import {
   type RequestHandlers,
 } from 'ugly-app';
 import { dbDefaults } from 'ugly-app/shared';
+import { nanoid } from 'nanoid';
 import { requests, messages } from '../shared/api';
 import { collections } from '../shared/collections';
 import { pages } from '../shared/pages';
@@ -51,7 +52,7 @@ const app = createApp(
   { requests, messages },
   {
     createTodo: async (userId, { text }) => {
-      const _id = crypto.randomUUID();
+      const _id = nanoid();
       await app.db.setDoc(collections.todo, { _id, userId, text, done: false, ...dbDefaults() });
       return { id: _id };
     },
@@ -233,7 +234,9 @@ export type AppPages = typeof pages;
 
 - `:param` matches a single path segment; `*param` is greedy (captures slashes).
 - The generic on `definePage<Params>()` is **phantom** — never set at runtime, used for client-side type inference.
-- `auth` defaults to `true`. `ssr` defaults to `false`.
+- `auth` defaults to `true`. `ssr` defaults to `false`. `auth: true` + `ssr: true` logs a warning and drops SSR — the SSR document is shared via the edge cache, so it must not depend on the caller.
+- `cacheQuery?: string[]` — query params that participate in the edge cache key. Anything not listed BYPASSES the cache (so `?utm=…` spam can't poison the entry, and pages that read an unlisted param aren't served the wrong variant).
+- `ssrCacheTimeout?: number` — edge `s-maxage` in seconds. Omit for the default (1 year — the `buildId` in the cache key invalidates on every deploy). Set explicitly only for content that drifts between deploys (e.g. a store listing that updates when a third-party app registers).
 - Query-string params are declared in `Params` but never appear in the path template.
 
 ---
@@ -294,12 +297,15 @@ export const { RouterProvider, RouterView, useRouter } = createRouter({
 });
 ```
 
-`createRouter` returns:
+`createRouter` accepts `{ pages, allPages?, ssrPages? }` and returns:
 
-- **`RouterProvider`** — props: `children`, `fallback?`, `isAuthenticated?`. Manages route state, browser history, and the popup layer. When `isAuthenticated()` returns false and the current route declares `auth: true`, the framework's `<AuthRoot>` renders in place of the page synchronously — apps cannot override this fallback. (Silent SSO now happens in `bootstrapApp`, not in the router — the previous first-paint-blocking `<AutoLoginGate>` iframe was removed so logged-out landing pages paint immediately.)
-- **`RouterView`** — renders the active page with animated transitions. Props: `durationMs?`, `easing?`, `transitionComponent?` (replaces `ViewFlipper`), `renderPage?` (sync alternative to `allPages` loaders, called with `RouterStateRaw`).
+- **`RouterProvider`** — props: `children`, `fallback?`, `isAuthenticated?`, `initialUrl?`. Manages route state, browser history, and the popup layer. `initialUrl` seeds the first route synchronously — required for SSR (there is no `window`) and used during hydration so the client's first render matches the server's. When `isAuthenticated()` returns false and the current route declares `auth: true`, the framework's `<AuthRoot>` renders in place of the page synchronously — apps cannot override this fallback. `AuthRoot` dispatches on `window.__UGLY_APP_AUTH_MODE__` (Mode A → `<LoginPopup>`, Mode B → `<MagicLinkForm>` + optional Google button). (Silent SSO now happens in `bootstrapApp`, not in the router — the previous first-paint-blocking `<AutoLoginGate>` iframe was removed so logged-out landing pages paint immediately.)
+- **`RouterView`** — renders the active page with animated transitions. Props: `durationMs?`, `easing?`, `transitionComponent?` (replaces `ViewFlipper`, receives `RouterTransitionProps`), `renderPage?` (sync alternative to `allPages` loaders, called with `RouterStateRaw`; ignored when the router is showing the auth fallback).
 - **`useRouter()`** — returns the router context (see below).
 - **`Link`** — typed SPA link bound to this router's pages. Renders a real `<a>` (right-click / cmd-click / SEO keep working) but intercepts a plain left-click and routes through `push` / `replace`. Props: `to`, `params` (both type-checked against `pages`), `replace?`, `children`, plus the usual anchor attrs.
+- **`setAllPages(map)`** — register the lazy page map after construction. Use this from the browser entry when your app also server-renders: the Workers bundle has no code-splitting, so listing `allPages` on the `createRouter` config inlines EVERY page (and its deps — three.js, chart libs, …) into `worker.js`. Passing it via `setAllPages` on the client keeps them out of the Worker's import graph. Subsequent client navigations still resolve through this map.
+
+`ssrPages` is a `Partial<Record<route, ComponentType<Params>>>` of statically-imported components for the SSR-enabled routes. It's imported by both server (needed synchronously to render) and client (needed during hydration so the first render exactly matches the SSR output — an async `import()` would resolve to `null` on that first pass and guarantee a hydration mismatch). Only list routes you actually server-render — every entry inlines that page + its deps into `worker.js`.
 
 ### Page map — `lazyPage` / `lazyPageLoader`
 
@@ -573,8 +579,9 @@ const k = db.cacheKey('prefix', id);
 ```typescript
 import { createUserHelper, dbDefaults } from 'ugly-app';
 
-const newDoc = { _id: crypto.randomUUID(), ...dbDefaults(), title: 'Hi' };
-//                                          ^^^^^^^^^^^^^^^ { version: 1, created, updated }
+import { nanoid } from 'nanoid';
+const newDoc = { _id: nanoid(), ...dbDefaults(), title: 'Hi' };
+//                              ^^^^^^^^^^^^^^^ { version: 1, created, updated }
 
 const userHelper = createUserHelper<User>(collections.user);
 const user = await userHelper.get(db, userId);

package/dist/cli/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.1.844";
+export declare const CLI_VERSION = "0.1.845";
 //# sourceMappingURL=version.d.ts.map

package/dist/cli/version.js

@@ -1,3 +1,3 @@
 // Auto-generated by prebuild — do not edit manually
-export const CLI_VERSION = "0.1.844";
+export const CLI_VERSION = "0.1.845";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ugly-app",
-  "version": "0.1.844",
+  "version": "0.1.845",
   "type": "module",
   "comment:files": "Allowlist what ships to npm. dist = runtime; src = sourcemap targets (dist/*.js.map reference ../../src/); templates = CLI scaffold. Everything else at repo root (.pgdata local Postgres, coverage, assets/icons sources, test/, test-results/) is excluded by omission. The !negations strip the scaffold's installed deps + cruft (templates/node_modules is 200MB+ and must never ship). package.json/README/LICENSE ship automatically.",
   "files": [

package/src/cli/version.ts

@@ -1,2 +1,2 @@
 // Auto-generated by prebuild — do not edit manually
-export const CLI_VERSION = "0.1.844";
+export const CLI_VERSION = "0.1.845";