Viewing File: /usr/local/cpanel/base/frontend/meridian/index.auto.tmpl

[%
# Copyright 2026 WebPros International, LLC
# All rights reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited.
%]

[%-
#  Meridian homepage — loads the Meridian React shell as the dashboard.
#  The shell handles all hub navigation from here.
#
#  All window.PAGE shell-mode data (basePath, applications, securityToken,
#  account_locale, features, analytics_info) is injected by the canonical
#  shell-data BLOCK at theme/_assets/react_shell_data.html.tt, which
#  master.html.tt INCLUDEs once per shell render. This file owns only the
#  bootstrap markup (registry script + #root mount point).

SET CPANEL.CPVAR.dprefix = "./";
SET CPANEL.CPVAR.indexpage = "1";

WRAPPER '_assets/master.html.tt'
    app_key                    = 'tools',
    page_title                 = locale.maketext("Dashboard"),
    include_legacy_stylesheets = 0,
    include_legacy_scripts     = 0,
    include_cjt                = 0,
    use_master_bootstrap       = 1,
    is_ng                      = 1,
    is_react_app               = 1,
    hide_license_warnings      = 1,
    load_meridian_shell_bundle = 1;
-%]
<script src="[% theme_magic_url('_assets/_registry.js') %]"></script>
<script>
    /* Emit <link rel="modulepreload"> for every hub manifest authored with
     * loadPriority:"eager" so its ENTIRE module graph parallel-loads with the
     * shell bundle: remoteEntry.js at default priority plus every chunk the
     * registry recorded in preloadAssets (see scripts/rebuild-meridian-registry)
     * at fetchpriority="low" — early enough to stay ahead of Module
     * Federation, low enough not to outrank first paint (see preload()).
     * Without the asset preloads, Module Federation discovers the graph one
     * serial round-trip at a time (remoteEntry -> exposes -> module chunk ->
     * share shims), which is seconds of blank main pane on cpsrvd's HTTP/1.x.
     * Currently this is just the dashboard hub — any future always-mounted
     * hub inherits the behavior by setting "eager" in its manifest.json.
     * URLs match federation-runtime.ts (and remoteEntry's own relative
     * imports, which resolve against its magic-revision URL) so the browser
     * module cache reuses each preload when MF later imports the chunk. */
    (function () {
        var registry = window.__MERIDIAN_REGISTRY__;
        if (!Array.isArray(registry) || registry.length === 0) return;
        var token = [% cp_security_token.json() %] || '';
        /* Do NOT set link.crossOrigin: the chunks are same-origin
         * (cpsrvd) and Module Federation's runtime injects the eventual
         * <script type="module"> without a crossorigin attribute. Setting
         * crossOrigin='' here would force a CORS preload request whose
         * cache key would not match MF's later non-CORS import — the
         * browser would refetch and the preload would be wasted (or
         * worse, opaque on a non-ACAO response). Bare modulepreload on
         * same-origin uses module CORS mode "same-origin" by default,
         * which doesn't require ACAO. */
        function preload(href, deprioritize) {
            var link = document.createElement('link');
            link.rel = 'modulepreload';
            /* cpsrvd speaks HTTP/1.1, so the browser has ~6 sockets per
             * origin and dispatches them by priority. modulepreload
             * defaults to High, which puts these level with the shell's
             * OWN render-critical chunks — and _registry.js (7 KB) lands
             * well before the shell entry (128 KB), so this loop used to
             * fire first and take every socket. Measured on the dashboard:
             * 16 hub preloads at t=1048ms pushed src.js (131 KB) and
             * src2.js (220 KB) from t=1017ms to t=1099ms and out to
             * t=2234ms, regressing FCP ~700ms (1556 -> 2252ms observed).
             * 14 of those 16 are under 3 KB (9 are MF share-shims, 12 KB
             * total), so they were trading first paint for almost no bytes.
             *
             * fetchpriority="low" keeps the whole graph in flight early
             * (which is what collapses MF's serial remoteEntry -> exposes
             * -> chunk -> share-shim walk and buys the LCP win) while
             * yielding sockets to whatever the shell needs to paint.
             * Set via setAttribute, not the .fetchPriority property, so
             * engines without the property still get the attribute; any
             * engine that ignores it simply gets the previous behavior.
             */
            if (deprioritize) link.setAttribute('fetchpriority', 'low');
            link.href = href;
            document.head.appendChild(link);
        }
        for (var i = 0; i < registry.length; i++) {
            var m = registry[i];
            if (!m || m.loadPriority !== 'eager') continue;
            if (!m.slug) continue;
            var entrypoints = m.entrypoints || {};
            var entryFile = (entrypoints.mf || 'remoteEntry.js').replace(/^\.\//, '');
            var magicPrefix = m.entryMtime ? '/cPanel_magic_revision_' + m.entryMtime : '';
            var hubBase = token + magicPrefix + '/frontend/meridian/' + m.slug + '/';
            /* remoteEntry keeps default (High) priority: it is ~0.5 KB and
             * every other chunk below is discovered THROUGH it, so delaying
             * it would just reinstate the serial walk one level up. */
            preload(hubBase + entryFile);
            var assets = m.preloadAssets || [];
            for (var j = 0; j < assets.length; j++) {
                preload(hubBase + assets[j], true);
            }
        }
    })();
</script>
<div id="root"></div><!-- Softaculous --><script src="softaculous-nav/softaculous-nav.js" data-show-softaculous="1" data-softaculous-label="Softaculous Apps Installer" data-show-wordpress="1"></script><!-- Softaculous -->
[% END %]