LiveBoot

What a page must embed so the remote runtime can take a component's action over the wire. The client cannot mint a CSRF token (it has no secret) and should not invent a session id: the SERVER issues both when it renders the page, and hands them over in ONE place the runtime reads — `<script id="milpa-live-boot" type="application/json">`. This object is that place, plus the script tags that load the two runtimes and the vendored Alpine in the order they need (greenhouse decisions/0083: the remote runtime is another layer; the page declares its boot). It is also the ONE emitter of the client runtime (greenhouse decisions/0211): a host never hand-writes runtime `<script>` tags — it hands {@see html()} the {@see ClientAssets} its compiled page declared, and gets back the stylesheets, the boot, the local runtime, the remote runtime, the plugin modules and Alpine, each once and in that order. One runtime per page: a guest never loads Alpine or `milpa-live.js` itself. It holds no secret: the CSRF token is opaque to the client and bound to this session id and this route by {@see CsrfGuardInterface::issueToken()}; whoever echoes it must also present the matching session id, and the endpoint verifies both. The session id travels in this payload: the runtime echoes it in every request body, and the host's adapter is to fill `LiveHttpRequest::$sessionId` from there — not from a cookie another page set.

public function __construct(string $endpoint, string $sessionId, string $csrfToken, ?string $authorization = null):

Parameters

public static function issue(Milpa\Live\Contracts\Security\CsrfGuardInterface $csrf, string $endpoint, ?string $authorization = null): self

Issues a fresh page session and its CSRF token for `$endpoint`. The session id is random and per page load: it is not an identity (the principal comes from the request's authentication, never from here), only the binding the CSRF token is checked against. It is what the runtime echoes as `sessionId` on every action, so a host adapter needs no cookie to know which session a token was issued for.

Parameters

public function toArray(): array

The boot payload as data — what the runtime's `bootData()` reads.

public function scriptTag(): string

The `<script id="milpa-live-boot" type="application/json">` element, JSON-encoded so it can never break out of its tag (`<` is escaped).

public function html(?array $assets = null, ?Milpa\Live\ValueObjects\ClientAssets $clientAssets = null): string

Everything the page loads, in the one order that works — each URL once: 1. every declared stylesheet, as `<link rel="stylesheet">` (before any script, so the first paint is styled); 2. the boot tag; 3. the local runtime (`milpa-live.js`) — it owns `MilpaLive.register()` and the built-in factories; 4. the remote runtime (`milpa-live-remote.js`) — it registers through the same path; 5. every declared plugin script, in declared order — each calls `MilpaLive.register(...)`; 6. Alpine, last — it starts and flushes the registrations. Every script is `defer`, so they run after the document in document order. A declared script that names one of the three runtime files is skipped: the host emits the runtime, a plugin never does (greenhouse decisions/0211).

Parameters