@blinkk/root 1.0.0-rc.4 → 1.0.0-rc.41

package/dist/render.js

@@ -3,14 +3,19 @@ import {
   I18N_CONTEXT,
   REQUEST_CONTEXT,
   getTranslations
-} from "./chunk-MJCIAH6K.js";
+} from "./chunk-7IDJ3PBT.js";
 import {
+  RouteTrie,
   htmlMinify,
   htmlPretty,
   parseTagNames
-} from "./chunk-DFBTOMQF.js";
+} from "./chunk-IUQLRDFW.js";
 
 // src/render/render.tsx
+import crypto from "node:crypto";
+import {
+  options as preactOptions
+} from "preact";
 import renderToString from "preact-render-to-string";
 
 // src/core/pages/ErrorPage.tsx
@@ -91,7 +96,6 @@ function ErrorPage(props) {
 // src/core/pages/DevErrorPage.tsx
 import { Fragment as Fragment2, jsx as jsx2, jsxs as jsxs2 } from "preact/jsx-runtime";
 function DevErrorPage(props) {
-  var _a;
   const req = props.req;
   const err = props.error;
   const route = props.route;
@@ -99,7 +103,7 @@ function DevErrorPage(props) {
   let errMsg = String(err);
   if (err && err.stack) {
     errMsg = err.stack.replace(/\(.*node_modules/g, "(node_modules").replace(/at \/.*node_modules/g, "at node_modules");
-    if ((_a = req.rootConfig) == null ? void 0 : _a.rootDir) {
+    if (req.rootConfig?.rootDir) {
       errMsg = errMsg.replaceAll(req.rootConfig.rootDir, "<root>");
     }
     if (process.env.HOME) {
@@ -113,7 +117,7 @@ function DevErrorPage(props) {
     ] }),
     /* @__PURE__ */ jsx2("h2", { children: "Debug Info" }),
     /* @__PURE__ */ jsx2("pre", { className: "box", children: /* @__PURE__ */ jsx2("code", { children: `url: ${req.originalUrl}
-route: ${(route == null ? void 0 : route.src) || "null"}
+route: ${route?.src || "null"}
 routeParams: ${routeParams && JSON.stringify(routeParams) || "null"}` }) })
   ] });
 }
@@ -203,12 +207,51 @@ function parseAcceptLanguage(value) {
 
 // src/render/i18n-fallbacks.ts
 var UNKNOWN_COUNTRY = "zz";
+var ES_419_COUNTRIES = [
+  "ar",
+  // Argentina
+  "bo",
+  // Bolivia
+  "cl",
+  // Chile
+  "co",
+  // Colombia
+  "cr",
+  // Costa Rica
+  "cu",
+  // Cuba
+  "do",
+  // Dominican Republic
+  "ec",
+  // Ecuador
+  "sv",
+  // El Salvador
+  "gt",
+  // Guatemala
+  "hn",
+  // Honduras
+  "mx",
+  // Mexico
+  "ni",
+  // Nicaragua
+  "pa",
+  // Panama
+  "py",
+  // Paraguay
+  "pe",
+  // Peru
+  "pr",
+  // Puerto Rico
+  "uy",
+  // Uruguay
+  "ve"
+  // Venezuela
+];
 function getFallbackLocales(req) {
-  var _a, _b;
   const hl = getFirstQueryParam(req, "hl");
   const countryCode = getCountry(req);
   if (isWebCrawler(req)) {
-    const defaultLocale = ((_b = (_a = req.rootConfig) == null ? void 0 : _a.i18n) == null ? void 0 : _b.defaultLocale) || "en";
+    const defaultLocale = req.rootConfig?.i18n?.defaultLocale || "en";
     if (hl && hl !== defaultLocale) {
       return [hl, defaultLocale];
     }
@@ -226,7 +269,12 @@ function getFallbackLocales(req) {
     locales.add(`${langCode}_${countryCode}`);
   });
   locales.add(`ALL_${countryCode}`);
+  const isEs419Country = test419Country(countryCode);
   langs.forEach((langCode) => {
+    if (langCode === "es" && isEs419Country) {
+      locales.add("es-419_ALL");
+      locales.add("es-419");
+    }
     locales.add(`${langCode}_ALL`);
     locales.add(langCode);
   });
@@ -251,6 +299,9 @@ function getFallbackLanguages(req) {
     parseAcceptLanguage(acceptLangHeader).forEach((lang) => {
       if (lang.region) {
         langs.add(`${lang.code}-${lang.region}`);
+        if (lang.code === "es" && test419Country(lang.region)) {
+          langs.add("es-419");
+        }
       }
       langs.add(lang.code);
     });
@@ -279,275 +330,132 @@ function isWebCrawler(req) {
   const userAgent = userAgentHeader.toLowerCase();
   return userAgent.includes("googlebot") || userAgent.includes("bingbot") || userAgent.includes("twitterbot");
 }
+function test419Country(countryCode) {
+  return ES_419_COUNTRIES.includes(countryCode);
+}
 
 // src/render/router.ts
 import path from "node:path";
-
-// src/render/route-trie.ts
-var RouteTrie = class _RouteTrie {
-  constructor() {
-    this.children = {};
-  }
-  /**
-   * Adds a route to the trie.
-   */
-  add(path2, route) {
-    path2 = this.normalizePath(path2);
-    if (path2 === "") {
-      this.route = route;
-      return;
-    }
-    const [head, tail] = this.splitPath(path2);
-    if (head.startsWith("[[...") && head.endsWith("]]")) {
-      const paramName = head.slice(5, -2);
-      this.optCatchAllNodes = new CatchAllNode(paramName, route);
-      return;
-    }
-    if (head.startsWith("[...") && head.endsWith("]")) {
-      const paramName = head.slice(4, -1);
-      this.catchAllNodes = new CatchAllNode(paramName, route);
-      return;
-    }
-    let nextNode;
-    if (head.startsWith("[") && head.endsWith("]")) {
-      if (!this.paramNodes) {
-        this.paramNodes = {};
-      }
-      const paramName = head.slice(1, -1);
-      if (!this.paramNodes[paramName]) {
-        this.paramNodes[paramName] = new ParamNode(paramName);
-      }
-      nextNode = this.paramNodes[paramName].trie;
-    } else {
-      nextNode = this.children[head];
-      if (!nextNode) {
-        nextNode = new _RouteTrie();
-        this.children[head] = nextNode;
+var ROUTES_FILES = import.meta.glob(
+  ["/routes/*.ts", "/routes/**/*.ts", "/routes/*.tsx", "/routes/**/*.tsx"],
+  { eager: true }
+);
+var Router = class {
+  constructor(rootConfig) {
+    this.rootConfig = rootConfig;
+    this.routeTrie = this.initRouteTrie();
+  }
+  get(url) {
+    return this.routeTrie.get(url);
+  }
+  async walk(cb) {
+    await this.routeTrie.walk(cb);
+  }
+  initRouteTrie() {
+    const locales = this.rootConfig.i18n?.locales || [];
+    const basePath = this.rootConfig.base || "/";
+    const defaultLocale = this.rootConfig.i18n?.defaultLocale || "en";
+    const trie = new RouteTrie();
+    Object.keys(ROUTES_FILES).forEach((modulePath) => {
+      const src = modulePath.slice(1);
+      let relativeRoutePath = modulePath.replace(/^\/routes/, "");
+      const parts = path.parse(relativeRoutePath);
+      if (parts.name.startsWith("_")) {
+        return;
       }
-    }
-    nextNode.add(tail, route);
-  }
-  /**
-   * Returns a route mapped to the given path and any parameter values from the
-   * URL.
-   */
-  get(path2) {
-    const params = {};
-    const route = this.getRoute(path2, params);
-    return [route, params];
-  }
-  /**
-   * Walks the route trie and calls a callback function for each route.
-   */
-  walk(cb) {
-    const promises = [];
-    const addPromise = (promise) => {
-      if (promise) {
-        promises.push(promise);
+      if (parts.name === "index") {
+        relativeRoutePath = parts.dir;
+      } else {
+        relativeRoutePath = path.join(parts.dir, parts.name);
       }
-    };
-    if (this.route) {
-      addPromise(cb("/", this.route));
-    }
-    if (this.paramNodes) {
-      Object.values(this.paramNodes).forEach((paramChild) => {
-        const param = `[${paramChild.name}]`;
-        paramChild.trie.walk((childPath, route) => {
-          const paramUrlPath = `/${param}${childPath}`;
-          addPromise(cb(paramUrlPath, route));
+      const urlFormat = "/[base]/[path]";
+      const i18nUrlFormat = toSquareBrackets(
+        this.rootConfig.i18n?.urlFormat || "/[locale]/[base]/[path]"
+      );
+      const placeholders = {
+        base: removeSlashes(basePath),
+        path: removeSlashes(relativeRoutePath)
+      };
+      const formatUrl = (format) => {
+        const url = format.replaceAll("[base]", placeholders.base).replaceAll("[path]", placeholders.path);
+        return normalizeUrlPath(url, {
+          trailingSlash: this.rootConfig.server?.trailingSlash
         });
+      };
+      const routePath = formatUrl(urlFormat);
+      const localeRoutePath = formatUrl(i18nUrlFormat);
+      trie.add(routePath, {
+        src,
+        module: ROUTES_FILES[modulePath],
+        locale: defaultLocale,
+        isDefaultLocale: true,
+        routePath,
+        localeRoutePath
       });
-    }
-    if (this.catchAllNodes) {
-      const wildcardUrlPath = `/[...${this.catchAllNodes.name}]`;
-      addPromise(cb(wildcardUrlPath, this.catchAllNodes.route));
-    }
-    if (this.optCatchAllNodes) {
-      const wildcardUrlPath = `/[[...${this.optCatchAllNodes.name}]]`;
-      addPromise(cb(wildcardUrlPath, this.optCatchAllNodes.route));
-    }
-    for (const subpath of Object.keys(this.children)) {
-      const childTrie = this.children[subpath];
-      childTrie.walk((childPath, childRoute) => {
-        addPromise(cb(`/${subpath}${childPath}`, childRoute));
-      });
-    }
-    return Promise.all(promises).then(() => {
-    });
-  }
-  /**
-   * Removes all routes from the trie.
-   */
-  clear() {
-    this.children = {};
-    this.paramNodes = void 0;
-    this.catchAllNodes = void 0;
-    this.optCatchAllNodes = void 0;
-    this.route = void 0;
-  }
-  getRoute(urlPath, params) {
-    urlPath = this.normalizePath(urlPath);
-    if (urlPath === "") {
-      if (this.route) {
-        return this.route;
-      }
-      if (this.optCatchAllNodes) {
-        if (urlPath) {
-          params[this.optCatchAllNodes.name] = urlPath;
-        }
-        return this.optCatchAllNodes.route;
-      }
-      return void 0;
-    }
-    const [head, tail] = this.splitPath(urlPath);
-    const child = this.children[head];
-    if (child) {
-      const route = child.getRoute(tail, params);
-      if (route) {
-        return route;
-      }
-    }
-    if (this.paramNodes) {
-      for (const paramChild of Object.values(this.paramNodes)) {
-        const route = paramChild.trie.getRoute(tail, params);
-        if (route) {
-          params[paramChild.name] = head;
-          return route;
-        }
-      }
-    }
-    if (this.catchAllNodes) {
-      params[this.catchAllNodes.name] = urlPath;
-      return this.catchAllNodes.route;
-    }
-    if (this.optCatchAllNodes) {
-      params[this.optCatchAllNodes.name] = urlPath;
-      return this.optCatchAllNodes.route;
-    }
-    return void 0;
-  }
-  /**
-   * Normalizes a path for inclusion into the route trie.
-   */
-  normalizePath(path2) {
-    return path2.replace(/^\/+/g, "").replace(/\/+$/g, "");
-  }
-  /**
-   * Splits the parent directory from its children, e.g.:
-   *
-   *     splitPath("foo/bar/baz") -> ["foo", "bar/baz"]
-   */
-  splitPath(path2) {
-    const i = path2.indexOf("/");
-    if (i === -1) {
-      return [path2, ""];
-    }
-    return [path2.slice(0, i), path2.slice(i + 1)];
-  }
-};
-var ParamNode = class {
-  constructor(name) {
-    this.trie = new RouteTrie();
-    this.name = name;
-  }
-};
-var CatchAllNode = class {
-  constructor(name, route) {
-    this.name = name;
-    this.route = route;
-  }
-};
-
-// src/render/router.ts
-function getRoutes(config) {
-  var _a, _b, _c;
-  const locales = ((_a = config.i18n) == null ? void 0 : _a.locales) || [];
-  const i18nUrlFormat = ((_b = config.i18n) == null ? void 0 : _b.urlFormat) || "/{locale}/{path}";
-  const defaultLocale = ((_c = config.i18n) == null ? void 0 : _c.defaultLocale) || "en";
-  const routes = import.meta.glob(
-    ["/routes/*.ts", "/routes/**/*.ts", "/routes/*.tsx", "/routes/**/*.tsx"],
-    {
-      eager: true
-    }
-  );
-  const trie = new RouteTrie();
-  Object.keys(routes).forEach((modulePath) => {
-    const src = modulePath.slice(1);
-    let routePath = modulePath.replace(/^\/routes/, "");
-    const parts = path.parse(routePath);
-    if (parts.name.startsWith("_")) {
-      return;
-    }
-    if (parts.name === "index") {
-      routePath = parts.dir;
-    } else {
-      routePath = path.join(parts.dir, parts.name);
-    }
-    const localeRoutePath = i18nUrlFormat.replace("{locale}", "[locale]").replace("{path}", routePath.replace(/^\/*/, ""));
-    trie.add(routePath, {
-      src,
-      module: routes[modulePath],
-      locale: defaultLocale,
-      isDefaultLocale: true,
-      routePath: normalizeUrlPath(routePath),
-      localeRoutePath: normalizeUrlPath(localeRoutePath)
-    });
-    locales.forEach((locale) => {
-      const localePath = localeRoutePath.replace("[locale]", locale);
-      if (localePath !== routePath) {
-        trie.add(localePath, {
-          src,
-          module: routes[modulePath],
-          locale,
-          isDefaultLocale: false,
-          routePath,
-          localeRoutePath
+      if (i18nUrlFormat.includes("[locale]")) {
+        locales.forEach((locale) => {
+          const localePath = localeRoutePath.replace("[locale]", locale);
+          if (localePath !== relativeRoutePath) {
+            trie.add(localePath, {
+              src,
+              module: ROUTES_FILES[modulePath],
+              locale,
+              isDefaultLocale: false,
+              routePath,
+              localeRoutePath
+            });
+          }
         });
       }
     });
-  });
-  return trie;
-}
-async function getAllPathsForRoute(urlPathFormat, route) {
-  const routeModule = route.module;
-  if (!routeModule.default) {
-    return [];
+    return trie;
   }
-  const urlPaths = [];
-  if (routeModule.getStaticPaths) {
-    const staticPaths = await routeModule.getStaticPaths();
-    if (staticPaths.paths) {
-      staticPaths.paths.forEach(
-        (pathParams) => {
-          const urlPath = replaceParams(urlPathFormat, pathParams.params || {});
-          if (pathContainsPlaceholders(urlPath)) {
-            console.warn(
-              `path contains placeholders: ${urlPathFormat}, double check getStaticPaths() and ensure all params are returned. more info: https://rootjs.dev/guide/routes#getStaticPaths`
+  async getAllPathsForRoute(urlPathFormat, route) {
+    const routeModule = route.module;
+    if (!routeModule.default) {
+      return [];
+    }
+    const urlPaths = [];
+    if (routeModule.getStaticPaths) {
+      const staticPaths = await routeModule.getStaticPaths({
+        rootConfig: this.rootConfig
+      });
+      if (staticPaths.paths) {
+        staticPaths.paths.forEach(
+          (pathParams) => {
+            const urlPath = replaceParams(
+              urlPathFormat,
+              pathParams.params || {}
             );
-          } else {
-            urlPaths.push({
-              urlPath: normalizeUrlPath(urlPath),
-              params: pathParams.params || {}
-            });
+            if (pathContainsPlaceholders(urlPath)) {
+              console.warn(
+                `path contains placeholders: ${urlPathFormat}, double check getStaticPaths() and ensure all params are returned. more info: https://rootjs.dev/guide/routes#getStaticPaths`
+              );
+            } else {
+              urlPaths.push({
+                urlPath: normalizeUrlPath(urlPath),
+                params: pathParams.params || {}
+              });
+            }
           }
-        }
+        );
+      }
+    } else if (routeModule.getStaticProps && !pathContainsPlaceholders(urlPathFormat)) {
+      urlPaths.push({ urlPath: normalizeUrlPath(urlPathFormat), params: {} });
+    } else if (!routeModule.handle && !pathContainsPlaceholders(urlPathFormat)) {
+      urlPaths.push({ urlPath: normalizeUrlPath(urlPathFormat), params: {} });
+    } else if (pathContainsPlaceholders(urlPathFormat) && !routeModule.handle && !routeModule.getStaticPaths) {
+      console.warn(
+        [
+          `warning: path contains placeholders: ${urlPathFormat}.`,
+          `define either ssg getStaticPaths() or ssr handle() for route: ${route.src}.`,
+          "more info: https://rootjs.dev/guide/routes"
+        ].join("\n")
       );
     }
-  } else if (routeModule.getStaticProps && !pathContainsPlaceholders(urlPathFormat)) {
-    urlPaths.push({ urlPath: normalizeUrlPath(urlPathFormat), params: {} });
-  } else if (!routeModule.handle && !pathContainsPlaceholders(urlPathFormat)) {
-    urlPaths.push({ urlPath: normalizeUrlPath(urlPathFormat), params: {} });
-  } else if (pathContainsPlaceholders(urlPathFormat) && !routeModule.handle && !routeModule.getStaticPaths) {
-    console.warn(
-      [
-        `warning: path contains placeholders: ${urlPathFormat}.`,
-        `define either ssg getStaticPaths() or ssr handle() for route: ${route.src}.`,
-        "more info: https://rootjs.dev/guide/routes"
-      ].join("\n")
-    );
+    return urlPaths;
   }
-  return urlPaths;
-}
+};
 function replaceParams(urlPathFormat, params) {
   const urlPath = urlPathFormat.replaceAll(
     /\[\[?(\.\.\.)?([\w\-_]*)\]?\]/g,
@@ -561,10 +469,17 @@ function replaceParams(urlPathFormat, params) {
   );
   return urlPath;
 }
-function normalizeUrlPath(urlPath) {
-  if (urlPath !== "/" && urlPath.endsWith("/")) {
+function normalizeUrlPath(urlPath, options) {
+  urlPath = urlPath.replace(/\/+/g, "/");
+  if (options?.trailingSlash === false && urlPath !== "/" && urlPath.endsWith("/")) {
     urlPath = urlPath.replace(/\/*$/g, "");
   }
+  if (urlPath.endsWith("/index")) {
+    urlPath = urlPath.slice(0, -6);
+  }
+  if (!urlPath.startsWith("/")) {
+    urlPath = `/${urlPath}`;
+  }
   return urlPath;
 }
 function pathContainsPlaceholders(urlPath) {
@@ -573,19 +488,30 @@ function pathContainsPlaceholders(urlPath) {
     return segment.startsWith("[") && segment.endsWith("]");
   });
 }
+function removeSlashes(str) {
+  return str.replace(/^\/*/g, "").replace(/\/*$/g, "");
+}
+function toSquareBrackets(str) {
+  if (str.includes("{") || str.includes("}")) {
+    const val = str.replaceAll("{", "[").replaceAll("}", "]");
+    console.warn(`"${str}" is a deprecated format, please switch to "${val}"`);
+    return val;
+  }
+  return str;
+}
 
 // src/render/render.tsx
 import { jsx as jsx4, jsxs as jsxs4 } from "preact/jsx-runtime";
 var Renderer = class {
   constructor(rootConfig, options) {
     this.rootConfig = rootConfig;
-    this.routes = getRoutes(this.rootConfig);
     this.assetMap = options.assetMap;
     this.elementGraph = options.elementGraph;
+    this.router = new Router(rootConfig);
   }
   async handle(req, res, next) {
-    const url = req.path.toLowerCase();
-    const [route, routeParams] = this.routes.get(url);
+    const url = req.path;
+    const [route, routeParams] = this.router.get(url);
     if (!route) {
       next();
       return;
@@ -595,14 +521,13 @@ var Renderer = class {
     }
     const fallbackLocales = route.isDefaultLocale ? getFallbackLocales(req) : [route.locale];
     const getPreferredLocale = (availableLocales) => {
-      var _a, _b;
       const lowerLocales = availableLocales.map((l) => l.toLowerCase());
       for (const fallbackLocale of fallbackLocales) {
         if (lowerLocales.includes(fallbackLocale.toLowerCase())) {
           return fallbackLocale;
         }
       }
-      return ((_b = (_a = req.rootConfig) == null ? void 0 : _a.i18n) == null ? void 0 : _b.defaultLocale) || "en";
+      return req.rootConfig?.i18n?.defaultLocale || "en";
     };
     const render404 = async () => {
       next();
@@ -613,15 +538,19 @@ var Renderer = class {
         render404();
         return;
       }
+      const securityConfig = this.getSecurityConfig();
+      const cspEnabled = !!securityConfig.contentSecurityPolicy;
       const currentPath = req.path;
-      const locale = (options == null ? void 0 : options.locale) || route.locale;
-      const translations = options == null ? void 0 : options.translations;
+      const locale = options?.locale || route.locale;
+      const translations = options?.translations;
+      const nonce = cspEnabled ? this.generateNonce() : void 0;
       const output = await this.renderComponent(route.module.default, props2, {
         currentPath,
         route,
         routeParams,
         locale,
-        translations
+        translations,
+        nonce
       });
       let html = output.html;
       if (this.rootConfig.prettyHtml) {
@@ -631,6 +560,12 @@ var Renderer = class {
       }
       if (req.viteServer) {
         html = await req.viteServer.transformIndexHtml(currentPath, html);
+        if (nonce) {
+          html = html.replace(
+            '<script type="module" src="/@vite/client"></script>',
+            `<script type="module" src="/@vite/client" nonce="${nonce}"></script>`
+          );
+        }
       }
       let statusCode = 200;
       if (route.src === "routes/404.tsx") {
@@ -639,7 +574,13 @@ var Renderer = class {
         statusCode = 500;
       }
       req.hooks.trigger("preRender");
-      res.status(statusCode).set({ "Content-Type": "text/html" }).end(html);
+      res.status(statusCode);
+      res.set({ "Content-Type": "text/html" });
+      this.setSecurityHeaders(res, {
+        securityConfig,
+        nonce
+      });
+      res.end(html);
     };
     if (route.module.handle) {
       const handlerContext = {
@@ -669,7 +610,7 @@ var Renderer = class {
     await render(props);
   }
   async renderComponent(Component, props, options) {
-    const { currentPath, route, routeParams } = options;
+    const { currentPath, route, routeParams, nonce } = options;
     const locale = options.locale;
     const translations = {
       ...getTranslations(locale),
@@ -681,7 +622,8 @@ var Renderer = class {
       props,
       routeParams,
       locale,
-      translations
+      translations,
+      nonce
     };
     const htmlContext = {
       htmlAttrs: {},
@@ -691,13 +633,40 @@ var Renderer = class {
       scriptDeps: []
     };
     const vdom = /* @__PURE__ */ jsx4(REQUEST_CONTEXT.Provider, { value: ctx, children: /* @__PURE__ */ jsx4(I18N_CONTEXT.Provider, { value: { locale, translations }, children: /* @__PURE__ */ jsx4(HTML_CONTEXT.Provider, { value: htmlContext, children: /* @__PURE__ */ jsx4(Component, { ...props }) }) }) });
-    const mainHtml = renderToString(vdom);
+    const preactHook = preactOptions.vnode;
+    let mainHtml;
+    try {
+      preactOptions.vnode = (vnode) => {
+        if (vnode && vnode.type === "script") {
+          vnode.props.nonce = nonce;
+        }
+        if (vnode && vnode.type === "style") {
+          vnode.props.nonce = nonce;
+        }
+        if (vnode && vnode.type === "link" && vnode.props.rel === "stylesheet") {
+          vnode.props.nonce = nonce;
+        }
+        if (preactHook) {
+          preactHook(vnode);
+        }
+      };
+      mainHtml = renderToString(vdom);
+      preactOptions.vnode = preactHook;
+    } catch (err) {
+      preactOptions.vnode = preactHook;
+      throw err;
+    }
     const jsDeps = /* @__PURE__ */ new Set();
     const cssDeps = /* @__PURE__ */ new Set();
     const routeAsset = await this.assetMap.get(route.src);
     if (routeAsset) {
       const routeCssDeps = await routeAsset.getCssDeps();
-      routeCssDeps.forEach((dep) => cssDeps.add(dep));
+      routeCssDeps.forEach((dep) => {
+        if (dep.endsWith("?inline")) {
+          return;
+        }
+        cssDeps.add(dep);
+      });
     }
     await this.collectElementDeps(mainHtml, jsDeps, cssDeps);
     await Promise.all(
@@ -715,10 +684,10 @@ var Renderer = class {
       })
     );
     const styleTags = Array.from(cssDeps).map((cssUrl) => {
-      return /* @__PURE__ */ jsx4("link", { rel: "stylesheet", href: cssUrl });
+      return /* @__PURE__ */ jsx4("link", { rel: "stylesheet", href: cssUrl, nonce });
     });
     const scriptTags = Array.from(jsDeps).map((jsUrls) => {
-      return /* @__PURE__ */ jsx4("script", { type: "module", src: jsUrls });
+      return /* @__PURE__ */ jsx4("script", { type: "module", src: jsUrls, nonce });
     });
     const html = await this.renderHtml(mainHtml, {
       htmlAttrs: htmlContext.htmlAttrs,
@@ -780,8 +749,8 @@ var Renderer = class {
   }
   async getSitemap() {
     const sitemap = {};
-    await this.routes.walk(async (urlPath, route) => {
-      const routePaths = await getAllPathsForRoute(urlPath, route);
+    await this.router.walk(async (urlPath, route) => {
+      const routePaths = await this.router.getAllPathsForRoute(urlPath, route);
       routePaths.forEach((routePath) => {
         sitemap[routePath.urlPath] = {
           route,
@@ -792,13 +761,13 @@ var Renderer = class {
     return sitemap;
   }
   async renderHtml(html, options) {
-    const htmlAttrs = (options == null ? void 0 : options.htmlAttrs) || {};
-    const headAttrs = (options == null ? void 0 : options.headAttrs) || {};
-    const bodyAttrs = (options == null ? void 0 : options.bodyAttrs) || {};
+    const htmlAttrs = options?.htmlAttrs || {};
+    const headAttrs = options?.headAttrs || {};
+    const bodyAttrs = options?.bodyAttrs || {};
     const page = /* @__PURE__ */ jsxs4("html", { ...htmlAttrs, children: [
       /* @__PURE__ */ jsxs4("head", { ...headAttrs, children: [
         /* @__PURE__ */ jsx4("meta", { charSet: "utf-8" }),
-        options == null ? void 0 : options.headComponents
+        options?.headComponents
       ] }),
       /* @__PURE__ */ jsx4("body", { ...bodyAttrs, dangerouslySetInnerHTML: { __html: html } })
     ] });
@@ -807,8 +776,8 @@ ${renderToString(page)}
 `;
   }
   async render404(options) {
-    const currentPath = (options == null ? void 0 : options.currentPath) || "/404";
-    const [route, routeParams] = this.routes.get("/404");
+    const currentPath = options?.currentPath || "/404";
+    const [route, routeParams] = this.router.get("/404");
     if (route && route.src === "routes/404.tsx" && route.module.default) {
       const Component = route.module.default;
       return this.renderComponent(
@@ -843,8 +812,8 @@ ${renderToString(page)}
     return { html };
   }
   async renderError(err, options) {
-    const currentPath = (options == null ? void 0 : options.currentPath) || "/500";
-    const [route, routeParams] = this.routes.get("/500");
+    const currentPath = options?.currentPath || "/500";
+    const [route, routeParams] = this.router.get("/500");
     if (route && route.src === "routes/500.tsx" && route.module.default) {
       const Component = route.module.default;
       return this.renderComponent(
@@ -889,7 +858,7 @@ ${renderToString(page)}
     return { html };
   }
   async renderDevServer500(req, error) {
-    const [route, routeParams] = this.routes.get(req.path);
+    const [route, routeParams] = this.router.get(req.path);
     const mainHtml = renderToString(
       /* @__PURE__ */ jsx4(
         DevErrorPage,
@@ -932,12 +901,105 @@ ${renderToString(page)}
         const assetJsDeps = await asset.getJsDeps();
         assetJsDeps.forEach((dep) => jsDeps.add(dep));
         const assetCssDeps = await asset.getCssDeps();
-        assetCssDeps.forEach((dep) => cssDeps.add(dep));
+        assetCssDeps.forEach((dep) => {
+          if (dep.endsWith("?inline")) {
+            return;
+          }
+          cssDeps.add(dep);
+        });
       })
     );
     return { jsDeps, cssDeps };
   }
+  /**
+   * Returns the `security` config value with default values inserted wherever
+   * a user config value is blank or set to `true`.
+   */
+  getSecurityConfig() {
+    const userConfig = this.rootConfig.server?.security || {};
+    const securityConfig = {};
+    if (isTrueOrUndefined(userConfig.contentSecurityPolicy)) {
+      securityConfig.contentSecurityPolicy = {
+        directives: {
+          "base-uri": ["'none'"],
+          "object-src": ["'none'"],
+          // NOTE: nonce is automatically added to this list.
+          "script-src": [
+            "'unsafe-inline'",
+            "'unsafe-eval'",
+            "'strict-dynamic' https: http:"
+          ]
+        },
+        reportOnly: true
+      };
+    } else {
+      securityConfig.contentSecurityPolicy = userConfig.contentSecurityPolicy;
+    }
+    if (isTrueOrUndefined(userConfig.xFrameOptions)) {
+      securityConfig.xFrameOptions = "SAMEORIGIN";
+    } else {
+      securityConfig.xFrameOptions = userConfig.xFrameOptions;
+    }
+    securityConfig.strictTransportSecurity = userConfig.strictTransportSecurity ?? true;
+    securityConfig.xContentTypeOptions = userConfig.xContentTypeOptions ?? true;
+    securityConfig.xXssProtection = userConfig.xXssProtection ?? true;
+    return securityConfig;
+  }
+  /**
+   * Generates a random string that can be used as the "nonce" value for CSP.
+   */
+  generateNonce() {
+    return crypto.randomBytes(16).toString("base64");
+  }
+  /**
+   * Sets security-related HTTP headers.
+   */
+  setSecurityHeaders(res, options) {
+    const securityConfig = options.securityConfig;
+    const contentSecurityPolicy = securityConfig.contentSecurityPolicy;
+    if (typeof contentSecurityPolicy === "object") {
+      const directives = contentSecurityPolicy.directives || {};
+      if (options.nonce) {
+        if (!directives["script-src"]) {
+          directives["script-src"] = [
+            "'unsafe-inline'",
+            "'unsafe-eval'",
+            "'strict-dynamic' https: http:"
+          ];
+        }
+        directives["script-src"].push(`'nonce-${options.nonce}'`);
+      }
+      const headerSegments = [];
+      Object.entries(directives).forEach(([key, values]) => {
+        headerSegments.push([key, ...values].join(" "));
+      });
+      const csp = headerSegments.join("; ");
+      if (contentSecurityPolicy.reportOnly === false) {
+        res.setHeader("content-security-policy", csp);
+      } else {
+        res.setHeader("content-security-policy-report-only", csp);
+      }
+    }
+    if (typeof securityConfig.xFrameOptions === "string") {
+      res.setHeader("x-frame-options", securityConfig.xFrameOptions);
+    }
+    if (securityConfig.strictTransportSecurity) {
+      res.setHeader(
+        "strict-transport-security",
+        "max-age=63072000; includeSubdomains; preload"
+      );
+    }
+    if (securityConfig.xContentTypeOptions) {
+      res.setHeader("x-content-type-options", "nosniff");
+    }
+    if (securityConfig.xXssProtection) {
+      res.setHeader("x-xss-protection", "1; mode=block");
+    }
+  }
 };
+function isTrueOrUndefined(value) {
+  return value === true || value === void 0;
+}
 export {
   Renderer
 };