a < b<\/title>/) assert.match(head, /<link rel="stylesheet" href="\/assets\/x.css">/) assert.match(head, /<link rel="modulepreload" href="\/assets\/dep.js">/) assert.match(head, /<script type="module" src="\/assets\/main.js"><\/script>/) assert.match(head, /^<!doctype html>/) }) test('serializeState blocks script breakouts and drops recomputed internals', () => { const json = serializeState({ events: { RENDER: 'render' }, cache: null, prefetch: [], count: 3, evil: '</script><script>alert(1)</script>', nested: { events: 'keep me' } }) assert.ok(!json.includes('</script'), 'no closing-script breakout') const parsed = JSON.parse(json.replace(/\\u003c/g, '<')) assert.strictEqual(parsed.count, 3) assert.strictEqual(parsed.events, undefined, 'top-level events dropped') assert.strictEqual(parsed.cache, undefined) assert.strictEqual(parsed.prefetch, undefined) assert.strictEqual(parsed.nested.events, 'keep me', 'only top-level internals dropped') }) test('documentTail is an inline script plus the html close', () => { const tail = documentTail({ count: 1 }) assert.match(tail, /<script>window.initialState=\{"count":1\}<\/script>/) assert.match(tail, /<\/html>/) }) test('assetLinks builds Early Hints link values', () => { const links = assetLinks({ scripts: ['/assets/main.js'], modulepreload: ['/assets/dep.js'], css: ['/assets/x.css'] }) assert.deepStrictEqual(links, [ '</assets/main.js>; rel=modulepreload', '</assets/dep.js>; rel=modulepreload', '</assets/x.css>; rel=preload; as=style' ]) })

import { test } from 'node:test' import assert from 'node:assert' import { documentHead, documentTail, serializeState, assetLinks } from '../lib/document.js' test('documentHead renders title, css, preloads and module scripts', () => { const head = documentHead({ title: 'a < b', css: ['/assets/x.css'], modulepreload: ['/assets/dep.js'], scripts: ['/assets/main.js'] }) assert.match(head, /a < b<\/title>/) assert.match(head, /<link rel="stylesheet" href="\/assets\/x.css">/) assert.match(head, /<link rel="modulepreload" href="\/assets\/dep.js">/) assert.match(head, /<script type="module" src="\/assets\/main.js"><\/script>/) assert.match(head, /^<!doctype html>/) }) test('serializeState blocks script breakouts and drops recomputed internals', () => { const json = serializeState({ events: { RENDER: 'render' }, cache: null, prefetch: [], count: 3, evil: '</script><script>alert(1)</script>', nested: { events: 'keep me' } }) assert.ok(!json.includes('</script'), 'no closing-script breakout') const parsed = JSON.parse(json.replace(/\\u003c/g, '<')) assert.strictEqual(parsed.count, 3) assert.strictEqual(parsed.events, undefined, 'top-level events dropped') assert.strictEqual(parsed.cache, undefined) assert.strictEqual(parsed.prefetch, undefined) assert.strictEqual(parsed.nested.events, 'keep me', 'only top-level internals dropped') }) test('documentTail is an inline script plus the html close', () => { const tail = documentTail({ count: 1 }) assert.match(tail, /<script>window.initialState=\{"count":1\}<\/script>/) assert.match(tail, /<\/html>/) }) test('assetLinks builds Early Hints link values', () => { const links = assetLinks({ scripts: ['/assets/main.js'], modulepreload: ['/assets/dep.js'], css: ['/assets/x.css'] }) assert.deepStrictEqual(links, [ '</assets/main.js>; rel=modulepreload', '</assets/dep.js>; rel=modulepreload', '</assets/x.css>; rel=preload; as=style' ]) })