@blinkk/root 1.0.0-rc.35 → 1.0.0-rc.36

package/dist/cli.js

@@ -1,4 +1,5 @@
 import {
+  CliRunner,
   build,
   createDevServer,
   createPreviewServer,
@@ -6,12 +7,13 @@ import {
   dev,
   preview,
   start
-} from "./chunk-5ZBCP3XZ.js";
-import "./chunk-3XHMMHV7.js";
-import "./chunk-JH33OQEK.js";
+} from "./chunk-VDORN4UU.js";
+import "./chunk-TZAHHHA4.js";
+import "./chunk-L2UBQKLP.js";
 import "./chunk-QKBMWK5B.js";
 import "./chunk-IUQLRDFW.js";
 export {
+  CliRunner,
   build,
   createDevServer,
   createPreviewServer,

package/dist/core.d.ts

@@ -1,5 +1,5 @@
-import { R as Route } from './types-a9rD7sef.js';
-export { C as ConfigureServerHook, h as ConfigureServerOptions, l as GetStaticPaths, G as GetStaticProps, p as Handler, H as HandlerContext, s as HandlerRenderFn, r as HandlerRenderOptions, L as LocaleGroup, M as MultipartFile, N as NextFunction, P as Plugin, n as Request, m as RequestMiddleware, o as Response, b as RootConfig, e as RootHeaderConfig, c as RootI18nConfig, d as RootRedirectConfig, f as RootServerConfig, a as RootUserConfig, q as RouteModule, k as RouteParams, S as Server, i as configureServerPlugins, g as defineConfig, j as getVitePlugins } from './types-a9rD7sef.js';
+import { R as Route } from './types-403nR8i5.js';
+export { i as ConfigureServerHook, j as ConfigureServerOptions, C as ContentSecurityPolicyConfig, n as GetStaticPaths, G as GetStaticProps, r as Handler, H as HandlerContext, u as HandlerRenderFn, t as HandlerRenderOptions, L as LocaleGroup, M as MultipartFile, N as NextFunction, P as Plugin, p as Request, o as RequestMiddleware, q as Response, b as RootConfig, e as RootHeaderConfig, c as RootI18nConfig, d as RootRedirectConfig, f as RootSecurityConfig, g as RootServerConfig, a as RootUserConfig, s as RouteModule, m as RouteParams, S as Server, X as XFrameOptionsConfig, k as configureServerPlugins, h as defineConfig, l as getVitePlugins } from './types-403nR8i5.js';
 import * as preact$1 from 'preact';
 import { FunctionalComponent, ComponentChildren } from 'preact';
 import 'express';
@@ -116,6 +116,8 @@ interface RequestContext {
     locale: string;
     /** Translations map for the current locale. */
     translations: Record<string, string>;
+    /** CSP nonce value. */
+    nonce?: string;
 }
 /**
  * A hook that returns information about the current route.

package/dist/core.js

@@ -8,7 +8,7 @@ import {
   getTranslations,
   useI18nContext,
   useRequestContext
-} from "./chunk-MJCIAH6K.js";
+} from "./chunk-7IDJ3PBT.js";
 
 // src/core/config.ts
 function defineConfig(config) {

package/dist/core.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/config.ts","../src/core/components/Body.tsx","../src/core/components/Head.ts","../src/core/components/Script.ts","../src/core/hooks/useTranslations.ts"],"sourcesContent":["import {UserConfig as ViteUserConfig} from 'vite';\n\nimport {HtmlMinifyOptions} from '../render/html-minify';\nimport {HtmlPrettyOptions} from '../render/html-pretty';\n\nimport {Plugin} from './plugin';\nimport {RequestMiddleware} from './types';\n\nexport interface RootUserConfig {\n  /**\n   * Canonical domain the website will serve on. Useful for things like the\n   * sitemap, SEO tags, etc.\n   */\n  domain?: string;\n\n  /**\n   * The base URL path that the site will serve on. Defaults to `/`;\n   */\n  base?: string;\n\n  /**\n   * Config for auto-injecting custom element dependencies.\n   */\n  elements?: {\n    /**\n     * A list of directories to use to look for custom elements. The dir path\n     * should be relative to the project dir, e.g. \"path/to/elements\".\n     */\n    include?: string[];\n\n    /**\n     * A list of RegEx patterns to exclude. The string passed to the RegEx is\n     * the file URL relative to the project root, e.g. \"/elements/foo/foo.ts\".\n     */\n    exclude?: RegExp[];\n  };\n\n  /**\n   * Config options for localization and internationalization.\n   */\n  i18n?: RootI18nConfig;\n\n  /**\n   * Config options for the Root.js express server.\n   */\n  server?: RootServerConfig;\n\n  /**\n   * Vite config.\n   * @see {@link https://vitejs.dev/config/} for more information.\n   */\n  vite?: ViteUserConfig;\n\n  /**\n   * Whether to automatically minify HTML output. This is enabled by default,\n   * in order to disable, pass `minifyHtml: false` to root.config.ts.\n   */\n  minifyHtml?: boolean;\n\n  /**\n   * Options to pass to html-minifier-terser.\n   */\n  minifyHtmlOptions?: HtmlMinifyOptions;\n\n  /**\n   * Whether to pretty print HTML output.\n   */\n  prettyHtml?: boolean;\n\n  /**\n   * Options to pass to js-beautify.\n   */\n  prettyHtmlOptions?: HtmlPrettyOptions;\n\n  /**\n   * Whether to include a sitemap.xml file to the build output.\n   */\n  sitemap?: boolean;\n\n  /**\n   * Plugins.\n   */\n  plugins?: Plugin[];\n}\n\nexport type RootConfig = RootUserConfig & {\n  rootDir: string;\n};\n\nexport interface LocaleGroup {\n  label?: string;\n  locales: string[];\n}\n\nexport interface RootI18nConfig {\n  /**\n   * Locales enabled for the site.\n   */\n  locales?: string[];\n\n  /**\n   * The default locale to use. Defaults is `en`.\n   */\n  defaultLocale?: string;\n\n  /**\n   * URL format for localized content. Default is `/[locale]/[base]/[path]`.\n   */\n  urlFormat?: string;\n\n  /**\n   * Localization groups, to help UIs (like Root.js CMS) logically group\n   * locales.\n   */\n  groups?: Record<string, LocaleGroup>;\n}\n\nexport interface RootRedirectConfig {\n  source: string;\n  destination: string;\n  type?: number;\n}\n\nexport interface RootHeaderConfig {\n  /** A glob pattern match (regex not supported yet). */\n  source: string;\n  headers: Array<{\n    key: string;\n    value: string;\n  }>;\n}\n\nexport interface RootServerConfig {\n  /**\n   * An array of middleware to add to the express server. These middleware are\n   * added to the beginning of the express app.\n   */\n  middlewares?: RequestMiddleware[];\n\n  /**\n   * The `trailingSlash` config allows you to control how the server handles\n   * trailing slashes. This config only affects URLs that do not have a file\n   * extension (i.e. HTML paths).\n   *\n   * - When `true`, the server redirects URLs to add a trailing slash\n   * - When `false`, the server redirects URLs to remove a trailing slash\n   * - When unspecified, the server allows URLs with and without trailing slash\n   */\n  trailingSlash?: boolean;\n\n  /**\n   * Cookie secret for the session middleware.\n   */\n  sessionCookieSecret?: string | string[];\n\n  /**\n   * List of redirects.\n   */\n  redirects?: RootRedirectConfig[];\n\n  /**\n   * HTTP headers to add to a response.\n   */\n  headers?: RootHeaderConfig[];\n}\n\nexport function defineConfig(config: RootUserConfig): RootUserConfig {\n  return config;\n}\n","import {ComponentChildren, FunctionalComponent} from 'preact';\nimport {useContext} from 'preact/hooks';\n\nimport {HTML_CONTEXT} from './Html';\n\nexport type BodyProps = preact.JSX.HTMLAttributes<HTMLBodyElement> & {\n  children?: ComponentChildren;\n};\n\n/**\n * The `<Body>` component can be used to update attrs in the `<body>` tag.\n *\n * Usage:\n *\n * ```tsx\n * <Body className=\"body\">\n *   <h1>Hello world</h1>\n * </Body>\n * ```\n *\n * Output:\n *\n * ```html\n * <body class=\"body\">\n *   <h1>Hello world</h1>\n * </body>\n */\nexport const Body: FunctionalComponent<BodyProps> = ({children, ...attrs}) => {\n  const context = useContext(HTML_CONTEXT);\n  if (!context) {\n    throw new Error(\n      'HTML_CONTEXT not found, double-check usage of the <Body> component'\n    );\n  }\n  context.bodyAttrs = attrs;\n  return <>{children}</>;\n};\n","import {ComponentChildren, FunctionalComponent} from 'preact';\nimport {useContext} from 'preact/hooks';\n\nimport {HTML_CONTEXT} from './Html';\n\nexport type HeadProps = preact.JSX.HTMLAttributes<HTMLHeadElement> & {\n  children?: ComponentChildren;\n};\n\n/**\n * The <Head> component can be used for injecting elements into the HTML head\n * tag from any part of a page. The <Head> can be added via any component or\n * sub-component and will automatically be hoisted to the `<head>` element.\n *\n * Usage:\n *\n * ```tsx\n * <Head>\n *   <link rel=\"preconnect\" href=\"https://fonts.googleapis.com\" />\n * </Head>\n * ```\n */\nexport const Head: FunctionalComponent<HeadProps> = ({children, ...attrs}) => {\n  const context = useContext(HTML_CONTEXT);\n  if (!context) {\n    throw new Error(\n      'HTML_CONTEXT not found, double-check usage of the <Head> component'\n    );\n  }\n  context.headComponents.push(children);\n  context.headAttrs = attrs;\n  return null;\n};\n","import {FunctionalComponent} from 'preact';\nimport {useContext} from 'preact/hooks';\n\nimport {HTML_CONTEXT} from './Html';\n\nexport type ScriptProps = preact.JSX.HTMLAttributes<HTMLScriptElement>;\n\n/**\n * The <Script> component is used for rendering any custom script modules. At\n * the moment, the system only pre-renders and bundles files that are in the\n * `/bundles` folder at the root of the project.\n *\n * Usage:\n *\n * ```tsx\n * <Script src=\"/bundles/main.ts\" />\n * ```\n */\nexport const Script: FunctionalComponent<ScriptProps> = (props) => {\n  const context = useContext(HTML_CONTEXT);\n  if (!context) {\n    throw new Error(\n      'HTML_CONTEXT not found, double-check usage of the <Script> component'\n    );\n  }\n  context.scriptDeps.push(props);\n  return null;\n};\n","import {useI18nContext} from './useI18nContext';\n\n/**\n * A hook that returns a function that can be used to translate a string, and\n * optionally replace any parameterized values that are surrounded in curly\n * braces.\n *\n * Usage:\n *\n * ```ts\n * const t = useTranslations();\n * t('Hello {name}', {name: 'Bob'});\n * // => 'Bounjour Bob'\n */\nexport function useTranslations() {\n  const context = useI18nContext();\n  const translations = context.translations || {};\n  const t = (str: string, params?: Record<string, string | number>) => {\n    const key = normalizeString(str);\n    let translation = translations[key] ?? key ?? '';\n    if (params) {\n      for (const param of Object.keys(params)) {\n        const val = String(params[param] ?? '');\n        translation = translation.replaceAll(`{${param}}`, val);\n      }\n    }\n    return translation;\n  };\n  return t;\n}\n\n/**\n * Cleans a string that's used for translations. Performs the following:\n * - Removes any leading/trailing whitespace\n * - Removes spaces at the end of any line\n */\nexport function normalizeString(str: string) {\n  const lines = String(str)\n    .trim()\n    .split('\\n')\n    .map((line) => line.trimEnd());\n  return lines.join('\\n');\n}\n"],"mappings":";;;;;;;;;;;;;AAsKO,SAAS,aAAa,QAAwC;AACnE,SAAO;AACT;;;ACvKA,SAAQ,kBAAiB;AAkChB;AARF,IAAM,OAAuC,CAAC,EAAC,UAAU,GAAG,MAAK,MAAM;AAC5E,QAAM,UAAU,WAAW,YAAY;AACvC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,UAAQ,YAAY;AACpB,SAAO,gCAAG,UAAS;AACrB;;;ACnCA,SAAQ,cAAAA,mBAAiB;AAqBlB,IAAM,OAAuC,CAAC,EAAC,UAAU,GAAG,MAAK,MAAM;AAC5E,QAAM,UAAUC,YAAW,YAAY;AACvC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,UAAQ,eAAe,KAAK,QAAQ;AACpC,UAAQ,YAAY;AACpB,SAAO;AACT;;;AC/BA,SAAQ,cAAAC,mBAAiB;AAiBlB,IAAM,SAA2C,CAAC,UAAU;AACjE,QAAM,UAAUC,YAAW,YAAY;AACvC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,UAAQ,WAAW,KAAK,KAAK;AAC7B,SAAO;AACT;;;ACbO,SAAS,kBAAkB;AAChC,QAAM,UAAU,eAAe;AAC/B,QAAM,eAAe,QAAQ,gBAAgB,CAAC;AAC9C,QAAM,IAAI,CAAC,KAAa,WAA6C;AACnE,UAAM,MAAM,gBAAgB,GAAG;AAC/B,QAAI,cAAc,aAAa,GAAG,KAAK,OAAO;AAC9C,QAAI,QAAQ;AACV,iBAAW,SAAS,OAAO,KAAK,MAAM,GAAG;AACvC,cAAM,MAAM,OAAO,OAAO,KAAK,KAAK,EAAE;AACtC,sBAAc,YAAY,WAAW,IAAI,KAAK,KAAK,GAAG;AAAA,MACxD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOO,SAAS,gBAAgB,KAAa;AAC3C,QAAM,QAAQ,OAAO,GAAG,EACrB,KAAK,EACL,MAAM,IAAI,EACV,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC;AAC/B,SAAO,MAAM,KAAK,IAAI;AACxB;","names":["useContext","useContext","useContext","useContext"]}
+{"version":3,"sources":["../src/core/config.ts","../src/core/components/Body.tsx","../src/core/components/Head.ts","../src/core/components/Script.ts","../src/core/hooks/useTranslations.ts"],"sourcesContent":["import {UserConfig as ViteUserConfig} from 'vite';\n\nimport {HtmlMinifyOptions} from '../render/html-minify';\nimport {HtmlPrettyOptions} from '../render/html-pretty';\n\nimport {Plugin} from './plugin';\nimport {RequestMiddleware} from './types';\n\nexport interface RootUserConfig {\n  /**\n   * Canonical domain the website will serve on. Useful for things like the\n   * sitemap, SEO tags, etc.\n   */\n  domain?: string;\n\n  /**\n   * The base URL path that the site will serve on. Defaults to `/`;\n   */\n  base?: string;\n\n  /**\n   * Config for auto-injecting custom element dependencies.\n   */\n  elements?: {\n    /**\n     * A list of directories to use to look for custom elements. The dir path\n     * should be relative to the project dir, e.g. \"path/to/elements\".\n     */\n    include?: string[];\n\n    /**\n     * A list of RegEx patterns to exclude. The string passed to the RegEx is\n     * the file URL relative to the project root, e.g. \"/elements/foo/foo.ts\".\n     */\n    exclude?: RegExp[];\n  };\n\n  /**\n   * Config options for localization and internationalization.\n   */\n  i18n?: RootI18nConfig;\n\n  /**\n   * Config options for the Root.js express server.\n   */\n  server?: RootServerConfig;\n\n  /**\n   * Vite config.\n   * @see {@link https://vitejs.dev/config/} for more information.\n   */\n  vite?: ViteUserConfig;\n\n  /**\n   * Whether to automatically minify HTML output. This is enabled by default,\n   * in order to disable, pass `minifyHtml: false` to root.config.ts.\n   */\n  minifyHtml?: boolean;\n\n  /**\n   * Options to pass to html-minifier-terser.\n   */\n  minifyHtmlOptions?: HtmlMinifyOptions;\n\n  /**\n   * Whether to pretty print HTML output.\n   */\n  prettyHtml?: boolean;\n\n  /**\n   * Options to pass to js-beautify.\n   */\n  prettyHtmlOptions?: HtmlPrettyOptions;\n\n  /**\n   * Whether to include a sitemap.xml file to the build output.\n   */\n  sitemap?: boolean;\n\n  /**\n   * Plugins.\n   */\n  plugins?: Plugin[];\n}\n\nexport type RootConfig = RootUserConfig & {\n  rootDir: string;\n};\n\nexport interface LocaleGroup {\n  label?: string;\n  locales: string[];\n}\n\nexport interface RootI18nConfig {\n  /**\n   * Locales enabled for the site.\n   */\n  locales?: string[];\n\n  /**\n   * The default locale to use. Defaults is `en`.\n   */\n  defaultLocale?: string;\n\n  /**\n   * URL format for localized content. Default is `/[locale]/[base]/[path]`.\n   */\n  urlFormat?: string;\n\n  /**\n   * Localization groups, to help UIs (like Root.js CMS) logically group\n   * locales.\n   */\n  groups?: Record<string, LocaleGroup>;\n}\n\nexport interface RootRedirectConfig {\n  source: string;\n  destination: string;\n  type?: number;\n}\n\nexport interface RootHeaderConfig {\n  /** A glob pattern match (regex not supported yet). */\n  source: string;\n  headers: Array<{\n    key: string;\n    value: string;\n  }>;\n}\n\nexport interface ContentSecurityPolicyConfig {\n  directives?: Record<string, string[]>;\n  reportOnly?: boolean;\n}\n\nexport interface XFrameOptionsConfig {\n  action: 'DENY' | 'SAMEORIGIN';\n}\n\nexport interface RootSecurityConfig {\n  /**\n   * Content-Security-Policy config. If enabled, a nonce is auto-generated\n   * for every request and appended to script and stylesheet tags. You can\n   * validate your CSP headers using a tool like {@link https://csp-evaluator.withgoogle.com/}.\n   *\n   * @see {@link https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP}\n   */\n  contentSecurityPolicy?: ContentSecurityPolicyConfig | boolean;\n\n  /**\n   * Strict-Transport-Security config. When enabled, the header value is set\n   * to `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload`.\n   */\n  strictTransportSecurity?: boolean;\n\n  /**\n   * X-Content-Type-Options config. When enabled, the header value is set to\n   * `X-Content-Type-Options: nosniff`.\n   */\n  xContentTypeOptions?: boolean;\n\n  /**\n   * X-Frame-Options config. Setting this value to `true` will default the\n   * header value to `X-Frame-Options: SAMEORIGIN`.\n   *\n   * @see {@link https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options}\n   */\n  xFrameOptions?: 'DENY' | 'SAMEORIGIN' | boolean;\n\n  /**\n   * X-XSS-Protection config. When enabled, the header value is set to\n   * `X-XSS-Protection: 1; mode=block`.\n   */\n  xXssProtection?: boolean;\n}\n\nexport interface RootServerConfig {\n  /**\n   * An array of middleware to add to the express server. These middleware are\n   * added to the beginning of the express app.\n   */\n  middlewares?: RequestMiddleware[];\n\n  /**\n   * The `trailingSlash` config allows you to control how the server handles\n   * trailing slashes. This config only affects URLs that do not have a file\n   * extension (i.e. HTML paths).\n   *\n   * - When `true`, the server redirects URLs to add a trailing slash\n   * - When `false`, the server redirects URLs to remove a trailing slash\n   * - When unspecified, the server allows URLs with and without trailing slash\n   */\n  trailingSlash?: boolean;\n\n  /**\n   * Cookie secret for the session middleware.\n   */\n  sessionCookieSecret?: string | string[];\n\n  /**\n   * List of redirects.\n   */\n  redirects?: RootRedirectConfig[];\n\n  /**\n   * HTTP headers to add to a response.\n   */\n  headers?: RootHeaderConfig[];\n\n  /**\n   * HTTP security settings. By default, all security settings are enabled with\n   * commonly used default values.\n   */\n  security?: RootSecurityConfig;\n}\n\nexport function defineConfig(config: RootUserConfig): RootUserConfig {\n  return config;\n}\n","import {ComponentChildren, FunctionalComponent} from 'preact';\nimport {useContext} from 'preact/hooks';\n\nimport {HTML_CONTEXT} from './Html';\n\nexport type BodyProps = preact.JSX.HTMLAttributes<HTMLBodyElement> & {\n  children?: ComponentChildren;\n};\n\n/**\n * The `<Body>` component can be used to update attrs in the `<body>` tag.\n *\n * Usage:\n *\n * ```tsx\n * <Body className=\"body\">\n *   <h1>Hello world</h1>\n * </Body>\n * ```\n *\n * Output:\n *\n * ```html\n * <body class=\"body\">\n *   <h1>Hello world</h1>\n * </body>\n */\nexport const Body: FunctionalComponent<BodyProps> = ({children, ...attrs}) => {\n  const context = useContext(HTML_CONTEXT);\n  if (!context) {\n    throw new Error(\n      'HTML_CONTEXT not found, double-check usage of the <Body> component'\n    );\n  }\n  context.bodyAttrs = attrs;\n  return <>{children}</>;\n};\n","import {ComponentChildren, FunctionalComponent} from 'preact';\nimport {useContext} from 'preact/hooks';\n\nimport {HTML_CONTEXT} from './Html';\n\nexport type HeadProps = preact.JSX.HTMLAttributes<HTMLHeadElement> & {\n  children?: ComponentChildren;\n};\n\n/**\n * The <Head> component can be used for injecting elements into the HTML head\n * tag from any part of a page. The <Head> can be added via any component or\n * sub-component and will automatically be hoisted to the `<head>` element.\n *\n * Usage:\n *\n * ```tsx\n * <Head>\n *   <link rel=\"preconnect\" href=\"https://fonts.googleapis.com\" />\n * </Head>\n * ```\n */\nexport const Head: FunctionalComponent<HeadProps> = ({children, ...attrs}) => {\n  const context = useContext(HTML_CONTEXT);\n  if (!context) {\n    throw new Error(\n      'HTML_CONTEXT not found, double-check usage of the <Head> component'\n    );\n  }\n  context.headComponents.push(children);\n  context.headAttrs = attrs;\n  return null;\n};\n","import {FunctionalComponent} from 'preact';\nimport {useContext} from 'preact/hooks';\n\nimport {HTML_CONTEXT} from './Html';\n\nexport type ScriptProps = preact.JSX.HTMLAttributes<HTMLScriptElement>;\n\n/**\n * The <Script> component is used for rendering any custom script modules. At\n * the moment, the system only pre-renders and bundles files that are in the\n * `/bundles` folder at the root of the project.\n *\n * Usage:\n *\n * ```tsx\n * <Script src=\"/bundles/main.ts\" />\n * ```\n */\nexport const Script: FunctionalComponent<ScriptProps> = (props) => {\n  const context = useContext(HTML_CONTEXT);\n  if (!context) {\n    throw new Error(\n      'HTML_CONTEXT not found, double-check usage of the <Script> component'\n    );\n  }\n  context.scriptDeps.push(props);\n  return null;\n};\n","import {useI18nContext} from './useI18nContext';\n\n/**\n * A hook that returns a function that can be used to translate a string, and\n * optionally replace any parameterized values that are surrounded in curly\n * braces.\n *\n * Usage:\n *\n * ```ts\n * const t = useTranslations();\n * t('Hello {name}', {name: 'Bob'});\n * // => 'Bounjour Bob'\n */\nexport function useTranslations() {\n  const context = useI18nContext();\n  const translations = context.translations || {};\n  const t = (str: string, params?: Record<string, string | number>) => {\n    const key = normalizeString(str);\n    let translation = translations[key] ?? key ?? '';\n    if (params) {\n      for (const param of Object.keys(params)) {\n        const val = String(params[param] ?? '');\n        translation = translation.replaceAll(`{${param}}`, val);\n      }\n    }\n    return translation;\n  };\n  return t;\n}\n\n/**\n * Cleans a string that's used for translations. Performs the following:\n * - Removes any leading/trailing whitespace\n * - Removes spaces at the end of any line\n */\nexport function normalizeString(str: string) {\n  const lines = String(str)\n    .trim()\n    .split('\\n')\n    .map((line) => line.trimEnd());\n  return lines.join('\\n');\n}\n"],"mappings":";;;;;;;;;;;;;AA0NO,SAAS,aAAa,QAAwC;AACnE,SAAO;AACT;;;AC3NA,SAAQ,kBAAiB;AAkChB;AARF,IAAM,OAAuC,CAAC,EAAC,UAAU,GAAG,MAAK,MAAM;AAC5E,QAAM,UAAU,WAAW,YAAY;AACvC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,UAAQ,YAAY;AACpB,SAAO,gCAAG,UAAS;AACrB;;;ACnCA,SAAQ,cAAAA,mBAAiB;AAqBlB,IAAM,OAAuC,CAAC,EAAC,UAAU,GAAG,MAAK,MAAM;AAC5E,QAAM,UAAUC,YAAW,YAAY;AACvC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,UAAQ,eAAe,KAAK,QAAQ;AACpC,UAAQ,YAAY;AACpB,SAAO;AACT;;;AC/BA,SAAQ,cAAAC,mBAAiB;AAiBlB,IAAM,SAA2C,CAAC,UAAU;AACjE,QAAM,UAAUC,YAAW,YAAY;AACvC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,UAAQ,WAAW,KAAK,KAAK;AAC7B,SAAO;AACT;;;ACbO,SAAS,kBAAkB;AAChC,QAAM,UAAU,eAAe;AAC/B,QAAM,eAAe,QAAQ,gBAAgB,CAAC;AAC9C,QAAM,IAAI,CAAC,KAAa,WAA6C;AACnE,UAAM,MAAM,gBAAgB,GAAG;AAC/B,QAAI,cAAc,aAAa,GAAG,KAAK,OAAO;AAC9C,QAAI,QAAQ;AACV,iBAAW,SAAS,OAAO,KAAK,MAAM,GAAG;AACvC,cAAM,MAAM,OAAO,OAAO,KAAK,KAAK,EAAE;AACtC,sBAAc,YAAY,WAAW,IAAI,KAAK,KAAK,GAAG;AAAA,MACxD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOO,SAAS,gBAAgB,KAAa;AAC3C,QAAM,QAAQ,OAAO,GAAG,EACrB,KAAK,EACL,MAAM,IAAI,EACV,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC;AAC/B,SAAO,MAAM,KAAK,IAAI;AACxB;","names":["useContext","useContext","useContext","useContext"]}

package/dist/functions.js

@@ -1,9 +1,9 @@
 import {
   createPreviewServer,
   createProdServer
-} from "./chunk-5ZBCP3XZ.js";
-import "./chunk-3XHMMHV7.js";
-import "./chunk-JH33OQEK.js";
+} from "./chunk-VDORN4UU.js";
+import "./chunk-TZAHHHA4.js";
+import "./chunk-L2UBQKLP.js";
 import "./chunk-QKBMWK5B.js";
 import "./chunk-IUQLRDFW.js";
 
@@ -12,10 +12,10 @@ import path from "node:path";
 import { onRequest } from "firebase-functions/v2/https";
 function server(options) {
   let rootServer;
-  const rootDir = path.resolve((options == null ? void 0 : options.rootDir) || process.cwd());
-  return onRequest((options == null ? void 0 : options.httpsOptions) || {}, async (req, res) => {
+  const rootDir = path.resolve(options?.rootDir || process.cwd());
+  return onRequest(options?.httpsOptions || {}, async (req, res) => {
     if (!rootServer) {
-      if ((options == null ? void 0 : options.mode) === "preview") {
+      if (options?.mode === "preview") {
         rootServer = await createPreviewServer({ rootDir });
       } else {
         rootServer = await createProdServer({ rootDir });

package/dist/functions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/functions/server.ts"],"sourcesContent":["import path from 'node:path';\nimport {HttpsOptions, onRequest} from 'firebase-functions/v2/https';\nimport {createPreviewServer, createProdServer} from '../cli/cli';\nimport {Server} from '../core/types';\n\nexport interface ProdServerOptions {\n  rootDir?: string;\n  mode?: 'preview' | 'production';\n  httpsOptions?: HttpsOptions;\n}\n\n/**\n * Firebase Function that runs a Root.js server running in SSR mode.\n */\nexport function server(options?: ProdServerOptions) {\n  let rootServer: Server;\n  const rootDir = path.resolve(options?.rootDir || process.cwd());\n  return onRequest(options?.httpsOptions || {}, async (req, res) => {\n    if (!rootServer) {\n      if (options?.mode === 'preview') {\n        rootServer = await createPreviewServer({rootDir});\n      } else {\n        rootServer = await createProdServer({rootDir});\n      }\n    }\n    await rootServer(req, res);\n  });\n}\n"],"mappings":";;;;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAsB,iBAAgB;AAa/B,SAAS,OAAO,SAA6B;AAClD,MAAI;AACJ,QAAM,UAAU,KAAK,SAAQ,mCAAS,YAAW,QAAQ,IAAI,CAAC;AAC9D,SAAO,WAAU,mCAAS,iBAAgB,CAAC,GAAG,OAAO,KAAK,QAAQ;AAChE,QAAI,CAAC,YAAY;AACf,WAAI,mCAAS,UAAS,WAAW;AAC/B,qBAAa,MAAM,oBAAoB,EAAC,QAAO,CAAC;AAAA,MAClD,OAAO;AACL,qBAAa,MAAM,iBAAiB,EAAC,QAAO,CAAC;AAAA,MAC/C;AAAA,IACF;AACA,UAAM,WAAW,KAAK,GAAG;AAAA,EAC3B,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/functions/server.ts"],"sourcesContent":["import path from 'node:path';\nimport {HttpsOptions, onRequest} from 'firebase-functions/v2/https';\nimport {createPreviewServer, createProdServer} from '../cli/cli';\nimport {Server} from '../core/types';\n\nexport interface ProdServerOptions {\n  rootDir?: string;\n  mode?: 'preview' | 'production';\n  httpsOptions?: HttpsOptions;\n}\n\n/**\n * Firebase Function that runs a Root.js server running in SSR mode.\n */\nexport function server(options?: ProdServerOptions) {\n  let rootServer: Server;\n  const rootDir = path.resolve(options?.rootDir || process.cwd());\n  return onRequest(options?.httpsOptions || {}, async (req, res) => {\n    if (!rootServer) {\n      if (options?.mode === 'preview') {\n        rootServer = await createPreviewServer({rootDir});\n      } else {\n        rootServer = await createProdServer({rootDir});\n      }\n    }\n    await rootServer(req, res);\n  });\n}\n"],"mappings":";;;;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAsB,iBAAgB;AAa/B,SAAS,OAAO,SAA6B;AAClD,MAAI;AACJ,QAAM,UAAU,KAAK,QAAQ,SAAS,WAAW,QAAQ,IAAI,CAAC;AAC9D,SAAO,UAAU,SAAS,gBAAgB,CAAC,GAAG,OAAO,KAAK,QAAQ;AAChE,QAAI,CAAC,YAAY;AACf,UAAI,SAAS,SAAS,WAAW;AAC/B,qBAAa,MAAM,oBAAoB,EAAC,QAAO,CAAC;AAAA,MAClD,OAAO;AACL,qBAAa,MAAM,iBAAiB,EAAC,QAAO,CAAC;AAAA,MAC/C;AAAA,IACF;AACA,UAAM,WAAW,KAAK,GAAG;AAAA,EAC3B,CAAC;AACH;","names":[]}

package/dist/middleware.d.ts

@@ -1,5 +1,5 @@
-import { b as RootConfig, n as Request, o as Response, N as NextFunction } from './types-a9rD7sef.js';
-export { t as SESSION_COOKIE, v as SaveSessionOptions, x as Session, u as SessionMiddlewareOptions, w as sessionMiddleware } from './types-a9rD7sef.js';
+import { b as RootConfig, p as Request, q as Response, N as NextFunction } from './types-403nR8i5.js';
+export { v as SESSION_COOKIE, x as SaveSessionOptions, z as Session, w as SessionMiddlewareOptions, y as sessionMiddleware } from './types-403nR8i5.js';
 import { RequestHandler } from 'express';
 import 'preact';
 import 'vite';

package/dist/middleware.js

@@ -6,7 +6,7 @@ import {
   rootProjectMiddleware,
   sessionMiddleware,
   trailingSlashMiddleware
-} from "./chunk-3XHMMHV7.js";
+} from "./chunk-TZAHHHA4.js";
 export {
   SESSION_COOKIE,
   Session,

package/dist/node.d.ts

@@ -1,4 +1,4 @@
-import { b as RootConfig } from './types-a9rD7sef.js';
+import { b as RootConfig } from './types-403nR8i5.js';
 import { ViteDevServer } from 'vite';
 import 'express';
 import 'preact';

package/dist/node.js

@@ -4,7 +4,7 @@ import {
   loadBundledConfig,
   loadRootConfig,
   viteSsrLoadModule
-} from "./chunk-JH33OQEK.js";
+} from "./chunk-L2UBQKLP.js";
 import "./chunk-QKBMWK5B.js";
 export {
   bundleRootConfig,

package/dist/render.d.ts

@@ -1,4 +1,4 @@
-export { y as Renderer } from './types-a9rD7sef.js';
+export { A as Renderer } from './types-403nR8i5.js';
 import 'express';
 import 'preact';
 import 'vite';

package/dist/render.js

@@ -3,7 +3,7 @@ import {
   I18N_CONTEXT,
   REQUEST_CONTEXT,
   getTranslations
-} from "./chunk-MJCIAH6K.js";
+} from "./chunk-7IDJ3PBT.js";
 import {
   RouteTrie,
   htmlMinify,
@@ -12,6 +12,10 @@ import {
 } from "./chunk-IUQLRDFW.js";
 
 // src/render/render.tsx
+import crypto from "node:crypto";
+import {
+  options as preactOptions
+} from "preact";
 import renderToString from "preact-render-to-string";
 
 // src/core/pages/ErrorPage.tsx
@@ -92,7 +96,6 @@ function ErrorPage(props) {
 // src/core/pages/DevErrorPage.tsx
 import { Fragment as Fragment2, jsx as jsx2, jsxs as jsxs2 } from "preact/jsx-runtime";
 function DevErrorPage(props) {
-  var _a;
   const req = props.req;
   const err = props.error;
   const route = props.route;
@@ -100,7 +103,7 @@ function DevErrorPage(props) {
   let errMsg = String(err);
   if (err && err.stack) {
     errMsg = err.stack.replace(/\(.*node_modules/g, "(node_modules").replace(/at \/.*node_modules/g, "at node_modules");
-    if ((_a = req.rootConfig) == null ? void 0 : _a.rootDir) {
+    if (req.rootConfig?.rootDir) {
       errMsg = errMsg.replaceAll(req.rootConfig.rootDir, "<root>");
     }
     if (process.env.HOME) {
@@ -114,7 +117,7 @@ function DevErrorPage(props) {
     ] }),
     /* @__PURE__ */ jsx2("h2", { children: "Debug Info" }),
     /* @__PURE__ */ jsx2("pre", { className: "box", children: /* @__PURE__ */ jsx2("code", { children: `url: ${req.originalUrl}
-route: ${(route == null ? void 0 : route.src) || "null"}
+route: ${route?.src || "null"}
 routeParams: ${routeParams && JSON.stringify(routeParams) || "null"}` }) })
   ] });
 }
@@ -245,11 +248,10 @@ var ES_419_COUNTRIES = [
   // Venezuela
 ];
 function getFallbackLocales(req) {
-  var _a, _b;
   const hl = getFirstQueryParam(req, "hl");
   const countryCode = getCountry(req);
   if (isWebCrawler(req)) {
-    const defaultLocale = ((_b = (_a = req.rootConfig) == null ? void 0 : _a.i18n) == null ? void 0 : _b.defaultLocale) || "en";
+    const defaultLocale = req.rootConfig?.i18n?.defaultLocale || "en";
     if (hl && hl !== defaultLocale) {
       return [hl, defaultLocale];
     }
@@ -350,13 +352,11 @@ var Router = class {
     await this.routeTrie.walk(cb);
   }
   initRouteTrie() {
-    var _a, _b;
-    const locales = ((_a = this.rootConfig.i18n) == null ? void 0 : _a.locales) || [];
+    const locales = this.rootConfig.i18n?.locales || [];
     const basePath = this.rootConfig.base || "/";
-    const defaultLocale = ((_b = this.rootConfig.i18n) == null ? void 0 : _b.defaultLocale) || "en";
+    const defaultLocale = this.rootConfig.i18n?.defaultLocale || "en";
     const trie = new RouteTrie();
     Object.keys(ROUTES_FILES).forEach((modulePath) => {
-      var _a2;
       const src = modulePath.slice(1);
       let relativeRoutePath = modulePath.replace(/^\/routes/, "");
       const parts = path.parse(relativeRoutePath);
@@ -370,17 +370,16 @@ var Router = class {
       }
       const urlFormat = "/[base]/[path]";
       const i18nUrlFormat = toSquareBrackets(
-        ((_a2 = this.rootConfig.i18n) == null ? void 0 : _a2.urlFormat) || "/[locale]/[base]/[path]"
+        this.rootConfig.i18n?.urlFormat || "/[locale]/[base]/[path]"
       );
       const placeholders = {
         base: removeSlashes(basePath),
         path: removeSlashes(relativeRoutePath)
       };
       const formatUrl = (format) => {
-        var _a3;
         const url = format.replaceAll("[base]", placeholders.base).replaceAll("[path]", placeholders.path);
         return normalizeUrlPath(url, {
-          trailingSlash: (_a3 = this.rootConfig.server) == null ? void 0 : _a3.trailingSlash
+          trailingSlash: this.rootConfig.server?.trailingSlash
         });
       };
       const routePath = formatUrl(urlFormat);
@@ -472,7 +471,7 @@ function replaceParams(urlPathFormat, params) {
 }
 function normalizeUrlPath(urlPath, options) {
   urlPath = urlPath.replace(/\/+/g, "/");
-  if ((options == null ? void 0 : options.trailingSlash) === false && urlPath !== "/" && urlPath.endsWith("/")) {
+  if (options?.trailingSlash === false && urlPath !== "/" && urlPath.endsWith("/")) {
     urlPath = urlPath.replace(/\/*$/g, "");
   }
   if (urlPath.endsWith("/index")) {
@@ -522,14 +521,13 @@ var Renderer = class {
     }
     const fallbackLocales = route.isDefaultLocale ? getFallbackLocales(req) : [route.locale];
     const getPreferredLocale = (availableLocales) => {
-      var _a, _b;
       const lowerLocales = availableLocales.map((l) => l.toLowerCase());
       for (const fallbackLocale of fallbackLocales) {
         if (lowerLocales.includes(fallbackLocale.toLowerCase())) {
           return fallbackLocale;
         }
       }
-      return ((_b = (_a = req.rootConfig) == null ? void 0 : _a.i18n) == null ? void 0 : _b.defaultLocale) || "en";
+      return req.rootConfig?.i18n?.defaultLocale || "en";
     };
     const render404 = async () => {
       next();
@@ -540,15 +538,19 @@ var Renderer = class {
         render404();
         return;
       }
+      const securityConfig = this.getSecurityConfig();
+      const cspEnabled = !!securityConfig.contentSecurityPolicy;
       const currentPath = req.path;
-      const locale = (options == null ? void 0 : options.locale) || route.locale;
-      const translations = options == null ? void 0 : options.translations;
+      const locale = options?.locale || route.locale;
+      const translations = options?.translations;
+      const nonce = cspEnabled ? this.generateNonce() : void 0;
       const output = await this.renderComponent(route.module.default, props2, {
         currentPath,
         route,
         routeParams,
         locale,
-        translations
+        translations,
+        nonce
       });
       let html = output.html;
       if (this.rootConfig.prettyHtml) {
@@ -566,7 +568,13 @@ var Renderer = class {
         statusCode = 500;
       }
       req.hooks.trigger("preRender");
-      res.status(statusCode).set({ "Content-Type": "text/html" }).end(html);
+      res.status(statusCode);
+      res.set({ "Content-Type": "text/html" });
+      this.setSecurityHeaders(res, {
+        securityConfig,
+        nonce
+      });
+      res.end(html);
     };
     if (route.module.handle) {
       const handlerContext = {
@@ -596,7 +604,7 @@ var Renderer = class {
     await render(props);
   }
   async renderComponent(Component, props, options) {
-    const { currentPath, route, routeParams } = options;
+    const { currentPath, route, routeParams, nonce } = options;
     const locale = options.locale;
     const translations = {
       ...getTranslations(locale),
@@ -608,7 +616,8 @@ var Renderer = class {
       props,
       routeParams,
       locale,
-      translations
+      translations,
+      nonce
     };
     const htmlContext = {
       htmlAttrs: {},
@@ -618,7 +627,26 @@ var Renderer = class {
       scriptDeps: []
     };
     const vdom = /* @__PURE__ */ jsx4(REQUEST_CONTEXT.Provider, { value: ctx, children: /* @__PURE__ */ jsx4(I18N_CONTEXT.Provider, { value: { locale, translations }, children: /* @__PURE__ */ jsx4(HTML_CONTEXT.Provider, { value: htmlContext, children: /* @__PURE__ */ jsx4(Component, { ...props }) }) }) });
-    const mainHtml = renderToString(vdom);
+    const preactHook = preactOptions.vnode;
+    let mainHtml;
+    try {
+      preactOptions.vnode = (vnode) => {
+        if (vnode && vnode.type === "script") {
+          vnode.props.nonce = nonce;
+        }
+        if (vnode && vnode.type === "link" && vnode.props.rel === "stylesheet") {
+          vnode.props.nonce = nonce;
+        }
+        if (preactHook) {
+          preactHook(vnode);
+        }
+      };
+      mainHtml = renderToString(vdom);
+      preactOptions.vnode = preactHook;
+    } catch (err) {
+      preactOptions.vnode = preactHook;
+      throw err;
+    }
     const jsDeps = /* @__PURE__ */ new Set();
     const cssDeps = /* @__PURE__ */ new Set();
     const routeAsset = await this.assetMap.get(route.src);
@@ -647,10 +675,10 @@ var Renderer = class {
       })
     );
     const styleTags = Array.from(cssDeps).map((cssUrl) => {
-      return /* @__PURE__ */ jsx4("link", { rel: "stylesheet", href: cssUrl });
+      return /* @__PURE__ */ jsx4("link", { rel: "stylesheet", href: cssUrl, nonce });
     });
     const scriptTags = Array.from(jsDeps).map((jsUrls) => {
-      return /* @__PURE__ */ jsx4("script", { type: "module", src: jsUrls });
+      return /* @__PURE__ */ jsx4("script", { type: "module", src: jsUrls, nonce });
     });
     const html = await this.renderHtml(mainHtml, {
       htmlAttrs: htmlContext.htmlAttrs,
@@ -724,13 +752,13 @@ var Renderer = class {
     return sitemap;
   }
   async renderHtml(html, options) {
-    const htmlAttrs = (options == null ? void 0 : options.htmlAttrs) || {};
-    const headAttrs = (options == null ? void 0 : options.headAttrs) || {};
-    const bodyAttrs = (options == null ? void 0 : options.bodyAttrs) || {};
+    const htmlAttrs = options?.htmlAttrs || {};
+    const headAttrs = options?.headAttrs || {};
+    const bodyAttrs = options?.bodyAttrs || {};
     const page = /* @__PURE__ */ jsxs4("html", { ...htmlAttrs, children: [
       /* @__PURE__ */ jsxs4("head", { ...headAttrs, children: [
         /* @__PURE__ */ jsx4("meta", { charSet: "utf-8" }),
-        options == null ? void 0 : options.headComponents
+        options?.headComponents
       ] }),
       /* @__PURE__ */ jsx4("body", { ...bodyAttrs, dangerouslySetInnerHTML: { __html: html } })
     ] });
@@ -739,7 +767,7 @@ ${renderToString(page)}
 `;
   }
   async render404(options) {
-    const currentPath = (options == null ? void 0 : options.currentPath) || "/404";
+    const currentPath = options?.currentPath || "/404";
     const [route, routeParams] = this.router.get("/404");
     if (route && route.src === "routes/404.tsx" && route.module.default) {
       const Component = route.module.default;
@@ -775,7 +803,7 @@ ${renderToString(page)}
     return { html };
   }
   async renderError(err, options) {
-    const currentPath = (options == null ? void 0 : options.currentPath) || "/500";
+    const currentPath = options?.currentPath || "/500";
     const [route, routeParams] = this.router.get("/500");
     if (route && route.src === "routes/500.tsx" && route.module.default) {
       const Component = route.module.default;
@@ -874,7 +902,86 @@ ${renderToString(page)}
     );
     return { jsDeps, cssDeps };
   }
+  /**
+   * Returns the `security` config value with default values inserted wherever
+   * a user config value is blank or set to `true`.
+   */
+  getSecurityConfig() {
+    const userConfig = this.rootConfig.server?.security || {};
+    const securityConfig = {};
+    if (isTrueOrUndefined(userConfig.contentSecurityPolicy)) {
+      securityConfig.contentSecurityPolicy = {
+        directives: {
+          "base-uri": ["'none'"],
+          "object-src": ["'none'"],
+          "script-src": ["'self'"]
+        },
+        reportOnly: true
+      };
+    } else {
+      securityConfig.contentSecurityPolicy = userConfig.contentSecurityPolicy;
+    }
+    if (isTrueOrUndefined(userConfig.xFrameOptions)) {
+      securityConfig.xFrameOptions = "SAMEORIGIN";
+    } else {
+      securityConfig.xFrameOptions = userConfig.xFrameOptions;
+    }
+    securityConfig.strictTransportSecurity = userConfig.strictTransportSecurity ?? true;
+    securityConfig.xContentTypeOptions = userConfig.xContentTypeOptions ?? true;
+    securityConfig.xXssProtection = userConfig.xXssProtection ?? true;
+    return securityConfig;
+  }
+  /**
+   * Generates a random string that can be used as the "nonce" value for CSP.
+   */
+  generateNonce() {
+    return crypto.randomBytes(16).toString("base64");
+  }
+  /**
+   * Sets security-related HTTP headers.
+   */
+  setSecurityHeaders(res, options) {
+    const securityConfig = options.securityConfig;
+    const contentSecurityPolicy = securityConfig.contentSecurityPolicy;
+    if (typeof contentSecurityPolicy === "object") {
+      const directives = contentSecurityPolicy.directives || {};
+      if (options.nonce) {
+        if (!directives["script-src"]) {
+          directives["script-src"] = ["'self'"];
+        }
+        directives["script-src"].push(`'nonce-${options.nonce}'`);
+      }
+      const headerSegments = [];
+      Object.entries(directives).forEach(([key, values]) => {
+        headerSegments.push([key, ...values].join(" "));
+      });
+      const csp = headerSegments.join("; ");
+      if (contentSecurityPolicy.reportOnly === false) {
+        res.setHeader("content-security-policy", csp);
+      } else {
+        res.setHeader("content-security-policy-report-only", csp);
+      }
+    }
+    if (typeof securityConfig.xFrameOptions === "string") {
+      res.setHeader("x-frame-options", securityConfig.xFrameOptions);
+    }
+    if (securityConfig.strictTransportSecurity) {
+      res.setHeader(
+        "strict-transport-security",
+        "max-age=63072000; includeSubdomains; preload"
+      );
+    }
+    if (securityConfig.xContentTypeOptions) {
+      res.setHeader("x-content-type-options", "nosniff");
+    }
+    if (securityConfig.xXssProtection) {
+      res.setHeader("x-xss-protection", "1; mode=block");
+    }
+  }
 };
+function isTrueOrUndefined(value) {
+  return value === true || value === void 0;
+}
 export {
   Renderer
 };