# Static Hydrate starter

This is an advanced self-hosted Drive example. For the ordinary one-script CDN
start, use the package [README](../../README.md).

It is a zero-Go, no-build KitJS site made from ordinary files. The home,
about, and search routes use Drive/Morph because they keep one exact executable
topology:

```html
<script defer src="/assets/hydrate.kit.1.0.0.01b23e3e45ce5604.js" integrity="sha256-AbI+PkXOVgSxZDNiMjQCxehrcASWQuW+mJHrSmfS57k=" data-kit-drive="stable"></script>
<script defer src="/assets/components.f36f63925e06368e.js" integrity="sha256-829jkl4GNo7nnI0KtX/+3wCEEfVvVF7TtxOZxDfoXEw=" data-kit-drive="stable"></script>
```

Both scripts are classic, same-origin, direct children of `head`. The component
bundle registers the unversioned `static-page` definition used by each route.
Their immutable URLs and SRI bind the reviewed bytes; the identical `stable`
marker is supplemental topology consent and does not replace the URL/hash/SRI
content identity. There are no inline executable scripts.

The home route also contains an ordinary same-origin GET search form. Its named
query and section controls, plus the clicked submit button's `name` and `value`,
become the `/search/` query through Drive. The browser still receives normal
history and focus behavior, and Back restores the home route without replacing
the live document.

The native route adds the content-identified and integrity-checked
`/assets/native-only.0d4648c28b38b53e.js`. That deliberate topology change
makes Drive fetch and reject the destination, then hand navigation back to the
browser before Morph. Only the browser document loader executes the extra
script.

Every page carries the same authored policy:

```html
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'none'">
```

The development server intentionally sends no CSP or CSP-Report-Only response
header for HTML. Hydrate can compare an identical meta policy across fetched
documents, but it cannot preserve or apply an incoming response header to the
already-live document. A static host that requires CSP response headers must
accept native navigation for that boundary; do not weaken the policy to force
Drive compatibility.

## Run the source-checkout example

From `packages/kit.js`:

```sh
node ./examples/static-hydrate/server.mjs
```

Open `http://127.0.0.1:4173/`. The included development server uses only Node
standard-library modules and serves `dist/hydrate.kit.js` at the example's
same-origin content-identified Hydrate URL shown above.

HTML uses `Cache-Control: no-store`. The three content-identified scripts use
`Cache-Control: public, max-age=31536000, immutable`, JavaScript content types,
and `X-Content-Type-Options: nosniff`.

The local Hydrate file matches the deterministic `1.0.0` artifact in this
checkout. Running the example proves the behavior of this self-hosted topology;
public npm/CDN availability is recorded separately only after retrieval.

## Deploy on an ordinary static host

Copy this directory to the host, then copy the exact reviewed Hydrate profile
beside the other assets:

```sh
cp ./dist/hydrate.kit.js ./examples/static-hydrate/assets/hydrate.kit.1.0.0.01b23e3e45ce5604.js
```

Configure directory indexes so `/`, `/about/`, `/search/`, and `/native/`
resolve to their respective `index.html` files, including when `/search/` has a
query string. Preserve the exact filenames, SRI, tag order, and attributes on
every compatible route. Never replace bytes behind one of these immutable URLs;
a changed file needs a new digest filename, SRI, and coordinated HTML release.

The checked HTML targets the origin root. When deploying below a project
subpath (for example `/my-site/`), replace every root-relative route and asset
URL with that one fixed prefix on every page. Drive requires the executable
script URL and its authored attributes to remain identical across compatible
routes; route-relative script paths are therefore not interchangeable.

This example uses the exact reviewed `1.0.0` Hydrate bytes from a self-hosted
content-identified URL. The immutable `1.0.0-rc.2` npm/CDN verification remains
historical evidence; stable public evidence is added only after publication
and independent retrieval.