vue-ssr-lite 0.0.3 → 0.0.5

package/README.md

@@ -103,6 +103,12 @@ overrides (migration compatibility), and a per-request CSP `nonce` provider.
 `ssrApolloNoExternal` from `vue-ssr-lite/vite` is the SSR dependency-inlining
 preset for the Apollo cluster.
 
+The Apollo adapter targets the public Apollo Client 3 core ESM module at
+`@apollo/client/core/index.js`. Consumers must install a compatible
+`@apollo/client` 3.x peer and should use `ssrApolloNoExternal` when Vite needs
+to inline Apollo's dual-format dependency cluster. Do not alias Apollo paths
+in consumer applications.
+
 ## Embedding the engine (no standalone server)
 
 `createSsrRequestHandler` from `vue-ssr-lite/engine` is the framework-agnostic
@@ -139,6 +145,25 @@ or server file.
 build step — the package ships plain ESM with hand-maintained type
 declarations).
 
+Apollo and GraphQL are development dependencies so the adapter's ESM,
+request-isolation, and cache-hydration contracts run in a normal development
+or prepublish install. Apollo remains an optional peer for consumers that do
+not enable the Apollo integration. In a deliberately dependency-free source
+checkout, only the Apollo-specific contracts are skipped.
+
+The package publication allowlist contains only runtime JavaScript, type
+declarations, and the CLI. Hidden filesystem artifacts, caches, coverage, and
+test output are intentionally excluded even when they appear below a runtime
+directory.
+
+## 0.0.4
+
+- Corrects Node ESM loading of the Apollo adapter by replacing the unsupported
+  `@apollo/client/core` directory import with its concrete ESM entry.
+- Adds Apollo request-isolation, hydration-cache, export-map, and package
+  content regression contracts.
+- Tightens published-file selection so hidden FUSE files cannot be included.
+
 ## Publishing
 
 Choose the release type and run the corresponding command:

package/apollo/SsrApolloAdapter.js

@@ -14,7 +14,7 @@ import {
 	ApolloLink,
 	HttpLink,
 	InMemoryCache,
-} from '@apollo/client/core'
+} from '@apollo/client/core/index.js'
 
 const DEFAULT_TIMEOUT_MS = 8000
 const DEFAULT_SSR_FORCE_FETCH_DELAY_MS = 150

package/apollo/index.d.ts

@@ -4,7 +4,7 @@ import type {
 	DefaultOptions,
 	InMemoryCacheConfig,
 	NormalizedCacheObject,
-} from '@apollo/client/core'
+} from '@apollo/client/core/index.js'
 import type { SsrApolloDefinition, SsrRequestContext } from '../index'
 
 export interface SsrApolloClientOptions {

package/index.d.ts

@@ -1,6 +1,6 @@
 import type { App, Component, InjectionKey, Ref } from 'vue'
 import type { Router, RouteRecordRaw, RouterScrollBehavior } from 'vue-router'
-import type { ApolloClient, ApolloLink, DefaultOptions, InMemoryCacheConfig, NormalizedCacheObject } from '@apollo/client/core'
+import type { ApolloClient, ApolloLink, DefaultOptions, InMemoryCacheConfig, NormalizedCacheObject } from '@apollo/client/core/index.js'
 
 export interface SsrRequestContext<
 	TConfig extends Record<string, unknown> = Record<string, unknown>,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vue-ssr-lite",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "description": "Low-configuration Vue 3 + Vite server-side rendering: engine, standalone server, hydration runtime, Apollo SSR adapter, and Vite integration with virtual entries.",
   "author": "safdar-azeem",
   "license": "MIT",
@@ -12,12 +12,17 @@
     "vue-ssr-lite": "./bin/vue-ssr-lite.mjs"
   },
   "files": [
-    "bin",
-    "engine",
-    "server",
-    "runtime",
-    "apollo",
-    "vite",
+    "bin/*.mjs",
+    "engine/*.js",
+    "engine/*.d.ts",
+    "server/*.js",
+    "server/*.d.ts",
+    "runtime/*.js",
+    "runtime/*.d.ts",
+    "apollo/*.js",
+    "apollo/*.d.ts",
+    "vite/*.js",
+    "vite/*.d.ts",
     "index.js",
     "index.d.ts"
   ],
@@ -69,6 +74,10 @@
       "optional": true
     }
   },
+  "devDependencies": {
+    "@apollo/client": "^3.13.9",
+    "graphql": "^16.12.0"
+  },
   "scripts": {
     "test": "node --test tests/*.test.mjs",
     "preversion": "npm test",

package/engine/.fuse_hidden0000002d00000001

@@ -1,166 +0,0 @@
-// SsrEngineHtml — package-owned HTML document primitives.
-//
-// These are invariants, not configuration: escaping rules, XSS-safe state
-// serialization, marker names, and head-tag rendering order are identical in
-// development and production and identical across consumers. The head payload
-// contract and tag order are byte-compatible with the audited ERP renderer so
-// the ERP migration cannot change its SEO output.
-
-export const SSR_MARKERS = Object.freeze({
-	head: '<!--app-head-->',
-	html: '<!--app-html-->',
-	state: '<!--app-state-->',
-	teleports: '<!--app-teleports-->',
-})
-
-export const escapeHtml = (value) =>
-	String(value ?? '')
-		.replaceAll('&', '&amp;')
-		.replaceAll('<', '&lt;')
-		.replaceAll('>', '&gt;')
-		.replaceAll('"', '&quot;')
-		.replaceAll("'", '&#39;')
-
-export const escapeXml = (value) =>
-	String(value ?? '')
-		.replaceAll('&', '&amp;')
-		.replaceAll('<', '&lt;')
-		.replaceAll('>', '&gt;')
-		.replaceAll('"', '&quot;')
-		.replaceAll("'", '&apos;')
-
-/** XSS-safe JSON serialization for inline <script> payloads. */
-export const serializeState = (value) =>
-	JSON.stringify(value)
-		.replaceAll('<', '\\u003c')
-		.replaceAll('
', '\\u2028')
-		.replaceAll('
', '\\u2029')
-
-/**
- * Render a head payload into escaped tags.
- *
- * Payload contract (all fields optional): title, description, keywords,
- * robots, ogTitle, ogDescription, ogImage, ogImageAlt, ogUrl, ogType,
- * ogSiteName, ogLocale, twitterCard, twitterTitle, twitterDescription,
- * twitterImage, twitterImageAlt, twitterSite, twitterCreator, canonicalUrl,
- * favicon, jsonLd (array of objects).
- *
- * Every rendered tag carries `attribute` so the browser runtime can remove
- * server-rendered tags before the client SEO layer takes over.
- */
-export const renderHeadTags = (payload, attribute = 'data-ssr-head') => {
-	if (!payload) return ''
-	const tags = []
-	if (payload.title) {
-		tags.push(`<title ${attribute}>${escapeHtml(payload.title)}</title>`)
-	}
-	const meta = [
-		['name', 'description', payload.description],
-		['name', 'keywords', payload.keywords],
-		['name', 'robots', payload.robots],
-		['property', 'og:title', payload.ogTitle],
-		['property', 'og:description', payload.ogDescription],
-		['property', 'og:image', payload.ogImage],
-		['property', 'og:image:alt', payload.ogImageAlt],
-		['property', 'og:url', payload.ogUrl],
-		['property', 'og:type', payload.ogType],
-		['property', 'og:site_name', payload.ogSiteName],
-		['property', 'og:locale', payload.ogLocale],
-		['name', 'twitter:card', payload.twitterCard],
-		['name', 'twitter:title', payload.twitterTitle],
-		['name', 'twitter:description', payload.twitterDescription],
-		['name', 'twitter:image', payload.twitterImage],
-		['name', 'twitter:image:alt', payload.twitterImageAlt],
-		['name', 'twitter:site', payload.twitterSite],
-		['name', 'twitter:creator', payload.twitterCreator],
-	]
-	for (const [attributeName, name, content] of meta) {
-		if (content != null && content !== '') {
-			tags.push(
-				`<meta ${attribute} ${attributeName}="${escapeHtml(name)}" content="${escapeHtml(content)}">`,
-			)
-		}
-	}
-	if (payload.canonicalUrl) {
-		tags.push(
-			`<link ${attribute} rel="canonical" href="${escapeHtml(payload.canonicalUrl)}">`,
-		)
-	}
-	if (payload.favicon) {
-		tags.push(`<link ${attribute} rel="icon" href="${escapeHtml(payload.favicon)}">`)
-	}
-	for (const block of payload.jsonLd || []) {
-		const json = JSON.stringify(block).replaceAll('<', '\\u003c')
-		tags.push(`<script ${attribute} type="application/ld+json">${json}</script>`)
-	}
-	return tags.join('')
-}
-
-/**
- * Render the state script exposing serialized public config and hydration
- * state on package-owned (or consumer-overridden) globals. Emits nothing when
- * both parts are empty. `nonce` supports strict Content Security Policies.
- */
-export const renderStateScript = (
-	{ config, state },
-	{ configKey = '__SSR_CONFIG__', stateKey = '__SSR_STATE__', nonce } = {},
-) => {
-	const parts = []
-	if (config != null && Object.keys(config).length > 0) {
-		parts.push(`window.${configKey}=${serializeState(config)}`)
-	}
-	if (state != null) {
-		parts.push(`window.${stateKey}=${serializeState(state)}`)
-	}
-	if (parts.length === 0) return ''
-	const nonceAttribute = nonce ? ` nonce="${escapeHtml(nonce)}"` : ''
-	return `<script${nonceAttribute}>${parts.join(';')}</script>`
-}
-
-/** Inject rendered fragments into a marker-carrying HTML template. */
-export const injectSsrDocument = (template, { head = '', html = '', state = '', teleports = '' }) =>
-	template
-		.replace(SSR_MARKERS.head, head)
-		.replace(SSR_MARKERS.teleports, teleports)
-		.replace(SSR_MARKERS.html, html)
-		.replace(SSR_MARKERS.state, state)
-
-/**
- * Guarantee the four SSR markers exist in a template so consumers never learn
- * marker names. Existing markers are left untouched; missing ones are added:
- * head before </head>, teleports after <body>, html inside the mount element,
- * state before </body>.
- */
-export const ensureSsrMarkers = (template, { mountSelector = '#app' } = {}) => {
-	let html = String(template)
-	if (!html.includes(SSR_MARKERS.head)) {
-		html = html.replace(/<\/head>/i, `${SSR_MARKERS.head}\n</head>`)
-	}
-	if (!html.includes(SSR_MARKERS.teleports)) {
-		html = html.replace(/<body([^>]*)>/i, `<body$1>${SSR_MARKERS.teleports}`)
-	}
-	if (!html.includes(SSR_MARKERS.html)) {
-		const id = mountSelector.startsWith('#') ? mountSelector.slice(1) : mountSelector
-		const mountPattern = new RegExp(`(<div[^>]*id=["']${id}["'][^>]*>)(</div>)`, 'i')
-		html = html.replace(mountPattern, `$1${SSR_MARKERS.html}$2`)
-	}
-	if (!html.includes(SSR_MARKERS.state)) {
-		html = html.replace(/<\/body>/i, `${SSR_MARKERS.state}\n</body>`)
-	}
-	return html
-}
-
-/** Generic accessible error markup used by fallback shells (overridable upstream). */
-export const renderErrorMarkup = (title, message) => `
-<main id="main-content" style="min-height:70vh;display:grid;place-items:center;padding:2rem;text-align:center;font-family:system-ui,sans-serif" tabindex="-1">
-	<div><h1>${escapeHtml(title)}</h1><p>${escapeHtml(message)}</p><p><a href="/">Return home</a></p></div>
-</main>`
-
-/** Sitemap primitives shared by consumers that serve SEO XML from the server. */
-export const renderSitemapUrlSet = (urls) => {
-	const uniqueUrls = [...new Set(urls)]
-	return `<?xml version="1.0" encoding="UTF-8"?>\n<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">${uniqueUrls.map((url) => `\n  <url><loc>${escapeXml(url)}</loc></url>`).join('')}\n</urlset>\n`
-}
-
-export const renderSitemapIndex = (urls) =>
-	`<?xml version="1.0" encoding="UTF-8"?>\n<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">${urls.map((url) => `\n  <sitemap><loc>${escapeXml(url)}</loc></sitemap>`).join('')}\n</sitemapindex>\n`