LiveBoot

What a page must embed so the remote runtime can take a component's action over the wire. The client cannot mint a CSRF token (it has no secret) and should not invent a session id: the SERVER issues both when it renders the page, and hands them over in ONE place the runtime reads — `<script id="milpa-live-boot" type="application/json">`. This object is that place, plus the script tags that load the two runtimes and the vendored Alpine in the order they need (greenhouse decisions/0083: the remote runtime is another layer; the page declares its boot). It holds no secret: the CSRF token is opaque to the client and bound to this session id and this route by {@see CsrfGuardInterface::issueToken()}; whoever echoes it must also present the matching session id, and the endpoint verifies both.

public function __construct(string $endpoint, string $sessionId, string $csrfToken, ?string $authorization = null):

Parameters

public static function issue(Milpa\Live\Contracts\Security\CsrfGuardInterface $csrf, string $endpoint, ?string $authorization = null): self

Issues a fresh page session and its CSRF token for `$endpoint`. The session id is random and per page load: it is not an identity (the principal comes from the request's authentication, never from here), only the binding the CSRF token is checked against.

Parameters

public function toArray(): array

The boot payload as data — what the runtime's `bootData()` reads.

public function scriptTag(): string

The `<script id="milpa-live-boot" type="application/json">` element, JSON-encoded so it can never break out of its tag (`<` is escaped).

public function html(?array $assets = null): string

The boot tag followed by the runtime script tags in load order — local runtime, remote runtime, Alpine — each `defer` so they run after the document, in document order.

Parameters