@blinkk/root 3.0.5 → 3.1.1

package/dist/render.js

@@ -7,15 +7,20 @@ import {
   testPathHasParams
 } from "./chunk-KW7KTYGC.js";
 import {
-  RouteTrie,
-  htmlMinify,
-  htmlPretty,
-  parseTagNames
-} from "./chunk-6P3B7ZXL.js";
+  RouteTrie
+} from "./chunk-I3RCAIW7.js";
+import {
+  parseTagNames,
+  transformHtml
+} from "./chunk-3PWR4F2R.js";
 import {
   renderJsxToString
 } from "./chunk-X2C2MEJ2.js";
 import "./chunk-3Z5TNZEP.js";
+import {
+  getSecurityConfig,
+  setSecurityHeaders
+} from "./chunk-WX62JK5E.js";
 
 // src/render/render.tsx
 import crypto from "node:crypto";
@@ -13120,6 +13125,14 @@ var Renderer = class {
   getRoute(url) {
     return this.router.get(url);
   }
+  /** Returns all routes that match a given url path. */
+  getRouteMatches(url) {
+    return this.router.matchAll(url);
+  }
+  /** Walks all routes registered with the router. */
+  async walkRoutes(cb) {
+    await this.router.walk(cb);
+  }
   async handle(req, res, next) {
     let url = req.path;
     if (url.includes("%")) {
@@ -13171,6 +13184,7 @@ var Renderer = class {
       scriptDeps: []
     };
     const vdom = /* @__PURE__ */ jsx4(REQUEST_CONTEXT.Provider, { value: ctx, children: /* @__PURE__ */ jsx4(I18N_CONTEXT.Provider, { value: { locale, translations }, children: /* @__PURE__ */ jsx4(HTML_CONTEXT.Provider, { value: htmlContext, children: /* @__PURE__ */ jsx4(Component, { ...props }) }) }) });
+    const renderJsxFn = await this.getJsxRenderFn();
     const preactHook = preactOptions.vnode;
     let mainHtml;
     try {
@@ -13188,11 +13202,9 @@ var Renderer = class {
           preactHook(vnode);
         }
       };
-      mainHtml = await this.renderJsx(vdom);
-      preactOptions.vnode = preactHook;
-    } catch (err) {
+      mainHtml = renderJsxFn(vdom);
+    } finally {
       preactOptions.vnode = preactHook;
-      throw err;
     }
     const jsDeps = /* @__PURE__ */ new Set();
     const cssDeps = /* @__PURE__ */ new Set();
@@ -13322,7 +13334,7 @@ var Renderer = class {
         render404();
         return;
       }
-      const securityConfig = this.getSecurityConfig();
+      const securityConfig = getSecurityConfig(this.rootConfig);
       const cspEnabled = !!securityConfig.contentSecurityPolicy;
       const currentPath = req.path;
       const locale = options2?.locale || route.locale;
@@ -13336,12 +13348,7 @@ var Renderer = class {
         translations,
         nonce
       });
-      let html = output.html;
-      if (this.rootConfig.prettyHtml) {
-        html = await htmlPretty(html, this.rootConfig.prettyHtmlOptions);
-      } else if (this.rootConfig.minifyHtml !== false) {
-        html = await htmlMinify(html, this.rootConfig.minifyHtmlOptions);
-      }
+      let html = await transformHtml(output.html, this.rootConfig);
       if (req.viteServer) {
         html = await req.viteServer.transformIndexHtml(currentPath, html);
         if (nonce) {
@@ -13371,7 +13378,7 @@ var Renderer = class {
       }
       res.status(statusCode);
       res.set({ "Content-Type": "text/html" });
-      this.setSecurityHeaders(res, {
+      setSecurityHeaders(res, {
         securityConfig,
         nonce
       });
@@ -13499,13 +13506,19 @@ var Renderer = class {
     return this.rootConfig.jsxRenderer || {};
   }
   /**
-   * Renders JSX via either the `@blinkk/root/jsx` package or
-   * `preact-render-to-string` depending if the `jsxRenderer` config is set up
-   * in `root.config.ts`.
+   * Resolves a synchronous JSX render function, using either the
+   * `@blinkk/root/jsx` package or `preact-render-to-string` depending if the
+   * `jsxRenderer` config is set up in `root.config.ts`.
+   *
+   * Resolving the renderer up front (rather than awaiting inside the render
+   * call) allows callers that temporarily swap global state (e.g. the
+   * `preact.options.vnode` nonce hook) to render synchronously without
+   * yielding to the event loop.
    */
-  async renderJsx(vnode) {
+  async getJsxRenderFn() {
     if (this.rootConfig.jsxRenderer?.mode) {
-      return renderJsxToString(vnode, this.getJsxRenderOptions());
+      const options = this.getJsxRenderOptions();
+      return (vnode) => renderJsxToString(vnode, options);
     }
     const { renderToString } = await import("preact-render-to-string");
     if (!renderToString) {
@@ -13513,7 +13526,16 @@ var Renderer = class {
         'failed to render jsx. either install preact-render-to-string or add the "jsxRenderer" config to root.config.ts'
       );
     }
-    return renderToString(vnode);
+    return (vnode) => renderToString(vnode);
+  }
+  /**
+   * Renders JSX via either the `@blinkk/root/jsx` package or
+   * `preact-render-to-string` depending if the `jsxRenderer` config is set up
+   * in `root.config.ts`.
+   */
+  async renderJsx(vnode) {
+    const render = await this.getJsxRenderFn();
+    return render(vnode);
   }
   getConfiguredStyleEntries() {
     const styleEntries = this.rootConfig.styles?.entries || [];
@@ -13685,94 +13707,13 @@ ${content}`;
     );
     return { jsDeps, cssDeps };
   }
-  /**
-   * Returns the `security` config value with default values inserted wherever
-   * a user config value is blank or set to `true`.
-   */
-  getSecurityConfig() {
-    const userConfig = this.rootConfig.server?.security || {};
-    const securityConfig = {};
-    if (isTrueOrUndefined(userConfig.contentSecurityPolicy)) {
-      securityConfig.contentSecurityPolicy = {
-        directives: {
-          "base-uri": ["'none'"],
-          "object-src": ["'none'"],
-          // NOTE: nonce is automatically added to this list.
-          "script-src": [
-            "'unsafe-inline'",
-            "'unsafe-eval'",
-            "'strict-dynamic' https: http:"
-          ]
-        },
-        reportOnly: true
-      };
-    } else {
-      securityConfig.contentSecurityPolicy = userConfig.contentSecurityPolicy;
-    }
-    if (isTrueOrUndefined(userConfig.xFrameOptions)) {
-      securityConfig.xFrameOptions = "SAMEORIGIN";
-    } else {
-      securityConfig.xFrameOptions = userConfig.xFrameOptions;
-    }
-    securityConfig.strictTransportSecurity = userConfig.strictTransportSecurity ?? true;
-    securityConfig.xContentTypeOptions = userConfig.xContentTypeOptions ?? true;
-    securityConfig.xXssProtection = userConfig.xXssProtection ?? true;
-    return securityConfig;
-  }
   /**
    * Generates a random string that can be used as the "nonce" value for CSP.
    */
   generateNonce() {
     return crypto.randomBytes(16).toString("base64");
   }
-  /**
-   * Sets security-related HTTP headers.
-   */
-  setSecurityHeaders(res, options) {
-    const securityConfig = options.securityConfig;
-    const contentSecurityPolicy = securityConfig.contentSecurityPolicy;
-    if (typeof contentSecurityPolicy === "object") {
-      const directives = { ...contentSecurityPolicy.directives };
-      if (options.nonce) {
-        const scriptSrc = directives["script-src"] || [
-          "'unsafe-inline'",
-          "'unsafe-eval'",
-          "'strict-dynamic' https: http:"
-        ];
-        const scriptSrcWithNonce = [...scriptSrc, `'nonce-${options.nonce}'`];
-        directives["script-src"] = scriptSrcWithNonce;
-      }
-      const headerSegments = [];
-      Object.entries(directives).forEach(([key, values]) => {
-        headerSegments.push([key, ...values].join(" "));
-      });
-      const csp = headerSegments.join("; ");
-      if (contentSecurityPolicy.reportOnly === false) {
-        res.setHeader("content-security-policy", csp);
-      } else {
-        res.setHeader("content-security-policy-report-only", csp);
-      }
-    }
-    if (typeof securityConfig.xFrameOptions === "string") {
-      res.setHeader("x-frame-options", securityConfig.xFrameOptions);
-    }
-    if (securityConfig.strictTransportSecurity) {
-      res.setHeader(
-        "strict-transport-security",
-        "max-age=63072000; includeSubdomains; preload"
-      );
-    }
-    if (securityConfig.xContentTypeOptions) {
-      res.setHeader("x-content-type-options", "nosniff");
-    }
-    if (securityConfig.xXssProtection) {
-      res.setHeader("x-xss-protection", "1; mode=block");
-    }
-  }
 };
-function isTrueOrUndefined(value) {
-  return value === true || value === void 0;
-}
 function sortLocales(a, b) {
   if (a === "x-default") {
     return -1;