or request-time (they are NOT resolved on the client-side in the browser), you can safely use these secrets.
The secrets you use to resolve that data won't end up on the client-side at all unless you include any sensitive data in your Route Module's `Data` value.
The automatic serialization we get from the Lamdera Compiler gives us this abstraction for free. Before elm-pages v3, the `OptimizedDecoder` abstraction
was used to serialize all data involved in resolve the BackendTask. This would include any secret environment variables that were used along the way, which
is why elm-pages v2 had the Secrets API - to ensure that you could use sensitive values without them showing up on the client-side. Thanks to the Lamdera Compiler,
we're able to serialize only the final value for your Route Module's `Data` (not any of the intermediary values), so the user can reason about it more easily
and write less code. It also improves performance because we serialize the `Data` value in a binary format, reducing the transfer size.
an open source, source-available tool, but there's no guarantee of that or timeline.
## Is elm-pages full-stack? Can I use it for pure static sites without a server? Can I use it for server-rendered pages with dynamic user content?
Starting with `elm-pages` v3, the answer to all of the above is yes! Before `elm-pages` v3, it was a static-only site generator, meaning that you run
a build step (`elm-pages build`), it outputs files, and a static host (like Netlify or GitHub pages) serves up those static files. In elm-pages v3,
if you only use `RouteBuilder.preRender`, then you can use elm-pages as a purely static site generator and host your site without any dynamic server rendering
or related server hosting functionality (just serve the generated files from `elm-pages build` like before).
But starting with v3, you are also able to define server-rendered routes using `RouteBuilder.serverRender`. With this lifecycle, you're able to respond dynamically
to a request, which means that you can do things like
- If the session cookie is absent, redirect to the login page using an HTTP 301 response code
- Load data dynmically at request-time, so every time the page is loaded you have the latest data (compared to statically built sites that have data from the time when the site was last built)
## Why does elm-pages use BackendTask rather than just using Elm's `Task`?
There's a very intentional design behind having `Task` and `BackendTask` be separate, though. One of the big reasons is that there are `Task`'s that wouldn't make sense in a backend context:
- Browser DOM API, like focus, blur, getViewport. These don't exit in a backend, so making it possible to call those from BackendTask would be misleading: https://package.elm-lang.org/packages/elm/browser/latest/Browser-Dom
- Get current Timezone (often on servers this is a foot-gun because you want to use UTC, though if you really wanted to get the timezone that the server or local machine is running in you can always define a BackendTask.Custom to do that)
Other reasons include performance (BackendTask runs in parallel by default, whereas Elm Task runs sequentially by default [source: https://github.com/elm/core/blob/84f38891468e8e153fc85a9b63bdafd81b24664e/src/Task.elm#L139-L143] which is not ideal - possible to work around, but another foot-gun that we can avoid). And we can use Fetch instead of XHR to perform HTTP requests as well, which has some performance benefits (fetch can do JSON parsing in a more parallel way).
Yes, see the [Pages.Flags module](https://package.elm-lang.org/packages/dillonkearns/elm-pages/latest/Pages-Flags). Note that elm-pages apps have a different life-cycle than standard Elm applications because they pre-render pages (either at build-time for static routes, or at request-time for server-rendered routes). So for example, if you get the window dimensions from the flags and do responsive design based on that, then you'll see a flash after the client-side code takes over since you need to give a value to use at pre-render time (before the app has reached the user's browser so before there are any dimensions available). So that semantics of the flags are not quite intuitive there.So you have to explicitly say how to handle the case where you don't have access to flags.