@blinkk/root 3.0.6 → 3.1.1

package/dist/chunk-M3E4RKS7.js

@@ -0,0 +1,374 @@
+import {
+  directoryContains,
+  isDirectory,
+  isJsFile,
+  makeDir,
+  writeFile
+} from "./chunk-KHO3HMX6.js";
+import {
+  isValidTagName,
+  parseTagNames,
+  transformHtml
+} from "./chunk-3PWR4F2R.js";
+
+// src/node/element-graph.ts
+import fs from "node:fs";
+import path from "node:path";
+import glob from "tiny-glob";
+import { searchForWorkspaceRoot } from "vite";
+var ElementGraph = class _ElementGraph {
+  /**
+   * Element tagName => sourceFile.
+   */
+  sourceFiles = {};
+  /**
+   * Element tagName => set of element tagName dependencies.
+   */
+  deps = {};
+  constructor(sourceFiles) {
+    this.sourceFiles = sourceFiles;
+  }
+  toJson() {
+    for (const tagName in this.sourceFiles) {
+      this.deps[tagName] ??= this.parseDepsFromSource(tagName);
+    }
+    return {
+      sourceFiles: this.sourceFiles,
+      deps: this.deps
+    };
+  }
+  static fromJson(data) {
+    const graph = new _ElementGraph(data.sourceFiles);
+    graph.deps = data.deps;
+    return graph;
+  }
+  getDeps(tagName, visited) {
+    visited ??= /* @__PURE__ */ new Set();
+    if (visited.has(tagName)) {
+      return [];
+    }
+    visited.add(tagName);
+    this.deps[tagName] ??= this.parseDepsFromSource(tagName);
+    const deps = new Set(this.deps[tagName]);
+    for (const depTagName of this.deps[tagName]) {
+      for (const childDep of this.getDeps(depTagName, visited)) {
+        deps.add(childDep);
+      }
+    }
+    return Array.from(deps);
+  }
+  /**
+   * Parses an element's source file for usage of other custom elements.
+   */
+  parseDepsFromSource(tagName) {
+    const srcFile = this.sourceFiles[tagName];
+    if (!srcFile) {
+      throw new Error(`could not find file path for tagName <${tagName}>`);
+    }
+    const src = fs.readFileSync(srcFile.filePath, "utf-8");
+    const tagNames = parseTagNames(src);
+    const deps = /* @__PURE__ */ new Set();
+    for (const depTagName of tagNames) {
+      if (depTagName !== tagName && depTagName in this.sourceFiles) {
+        deps.add(depTagName);
+      }
+    }
+    return Array.from(deps);
+  }
+};
+async function getElements(rootConfig, pods) {
+  const rootDir = rootConfig.rootDir;
+  const elementsDirs = getElementsDirs(rootConfig, pods);
+  const excludePatterns = rootConfig.elements?.exclude || [];
+  const excludeElement = (moduleId) => {
+    return excludePatterns.some((pattern) => Boolean(moduleId.match(pattern)));
+  };
+  const elementFilePaths = {};
+  for (const dirPath of elementsDirs) {
+    if (await isDirectory(dirPath)) {
+      const files = await glob("**/*", { cwd: dirPath });
+      files.forEach((file) => {
+        const parts = path.parse(file);
+        if (isJsFile(parts.base) && isValidTagName(parts.name)) {
+          const tagName = parts.name;
+          const filePath = path.join(dirPath, file);
+          const relPath = path.relative(rootDir, filePath);
+          if (!excludeElement(relPath)) {
+            elementFilePaths[tagName] = { filePath, relPath };
+          }
+        }
+      });
+    }
+  }
+  const graph = new ElementGraph(elementFilePaths);
+  return graph;
+}
+function getElementsDirs(rootConfig, pods) {
+  const rootDir = rootConfig.rootDir;
+  const workspaceRoot = searchForWorkspaceRoot(rootDir);
+  const elementsDirs = [path.join(rootDir, "elements")];
+  const elementsInclude = rootConfig.elements?.include || [];
+  for (const dirPath of elementsInclude) {
+    const elementsDir = path.resolve(rootDir, dirPath);
+    if (!directoryContains(rootDir, elementsDir)) {
+      throw new Error(
+        `the elements dir (${dirPath}) should be within the project's workspace (${workspaceRoot})`
+      );
+    }
+    elementsDirs.push(elementsDir);
+  }
+  if (pods) {
+    for (const pod of pods) {
+      for (const dir of pod.elementsDirs) {
+        elementsDirs.push(dir);
+      }
+    }
+  }
+  return elementsDirs;
+}
+
+// src/render/asset-map/build-asset-map.ts
+import fs2 from "node:fs";
+import path2 from "node:path";
+var BuildAssetMap = class _BuildAssetMap {
+  rootConfig;
+  srcToAsset;
+  constructor(rootConfig) {
+    this.rootConfig = rootConfig;
+    this.srcToAsset = /* @__PURE__ */ new Map();
+  }
+  async get(src) {
+    const asset = this.srcToAsset.get(src);
+    if (asset) {
+      return asset;
+    }
+    const realSrc = realPathRelativeTo(this.rootConfig.rootDir, src);
+    if (realSrc !== src) {
+      const asset2 = this.srcToAsset.get(realSrc);
+      if (asset2) {
+        return asset2;
+      }
+    }
+    console.log(`could not find build asset: ${src}`);
+    return null;
+  }
+  add(asset) {
+    this.srcToAsset.set(asset.src, asset);
+  }
+  toJson() {
+    const result = {};
+    for (const src of this.srcToAsset.keys()) {
+      result[src] = this.srcToAsset.get(src).toJson();
+    }
+    return result;
+  }
+  static fromViteManifest(rootConfig, clientManifest, elementsGraph, podRoutes = []) {
+    const assetMap = new _BuildAssetMap(rootConfig);
+    const elementFiles = /* @__PURE__ */ new Set();
+    Object.values(elementsGraph.sourceFiles).forEach((elementSource) => {
+      elementFiles.add(elementSource.relPath);
+      const realSrc = realPathRelativeTo(
+        rootConfig.rootDir,
+        elementSource.relPath
+      );
+      if (realSrc !== elementSource.filePath) {
+        elementFiles.add(realSrc);
+      }
+    });
+    Object.keys(clientManifest).forEach((manifestKey) => {
+      const src = manifestKey;
+      const manifestChunk = clientManifest[manifestKey];
+      const isElement = elementFiles.has(src);
+      const assetUrl = src.startsWith("routes/") && isJsFile(src) ? "" : `/${manifestChunk.file}`;
+      const assetData = {
+        src,
+        assetUrl,
+        importedModules: manifestChunk.imports || [],
+        importedCss: (manifestChunk.css || []).map((relPath) => `/${relPath}`),
+        isElement
+      };
+      assetMap.add(new BuildAsset(assetMap, assetData));
+    });
+    podRoutes.forEach((podRoute) => {
+      if (assetMap.srcToAsset.has(podRoute.src)) {
+        return;
+      }
+      const relPath = path2.relative(rootConfig.rootDir, podRoute.filePath).replace(/\\/g, "/");
+      const realPath = realPathRelativeTo(rootConfig.rootDir, relPath).replace(
+        /\\/g,
+        "/"
+      );
+      const candidateKeys = [relPath, realPath];
+      for (const key of candidateKeys) {
+        const asset = assetMap.srcToAsset.get(key);
+        if (asset) {
+          assetMap.add(
+            new BuildAsset(assetMap, {
+              ...asset.toJson(),
+              src: podRoute.src,
+              assetUrl: ""
+            })
+          );
+          break;
+        }
+      }
+    });
+    return assetMap;
+  }
+  static fromRootManifest(rootConfig, rootManifest) {
+    const assetMap = new _BuildAssetMap(rootConfig);
+    Object.keys(rootManifest).forEach((moduleId) => {
+      const assetData = rootManifest[moduleId];
+      assetMap.add(new BuildAsset(assetMap, assetData));
+    });
+    return assetMap;
+  }
+};
+function realPathRelativeTo(rootDir, src) {
+  const fullPath = path2.resolve(rootDir, src);
+  if (!fs2.existsSync(fullPath)) {
+    return src;
+  }
+  const realpath = fs2.realpathSync(path2.resolve(rootDir, src));
+  return path2.relative(rootDir, realpath);
+}
+var BuildAsset = class {
+  src;
+  assetUrl;
+  assetMap;
+  importedModules;
+  importedCss;
+  isElement;
+  constructor(assetMap, assetData) {
+    this.assetMap = assetMap;
+    this.src = assetData.src;
+    this.assetUrl = assetData.assetUrl;
+    this.importedModules = assetData.importedModules;
+    this.importedCss = assetData.importedCss;
+    this.isElement = assetData.isElement;
+  }
+  async getCssDeps() {
+    const visited = /* @__PURE__ */ new Set();
+    const deps = /* @__PURE__ */ new Set();
+    await this.collectCss(this, deps, visited);
+    return Array.from(deps);
+  }
+  async getJsDeps() {
+    const visited = /* @__PURE__ */ new Set();
+    const deps = /* @__PURE__ */ new Set();
+    await this.collectJs(this, deps, visited);
+    return Array.from(deps);
+  }
+  async collectJs(asset, urls, visited) {
+    if (!asset) {
+      return;
+    }
+    if (!asset.src) {
+      return;
+    }
+    if (visited.has(asset.src)) {
+      return;
+    }
+    visited.add(asset.src);
+    if (asset.isElement) {
+      urls.add(asset.assetUrl);
+    }
+    await Promise.all(
+      asset.importedModules.map(async (src) => {
+        const importedAsset = await this.assetMap.get(src);
+        this.collectJs(importedAsset, urls, visited);
+      })
+    );
+  }
+  async collectCss(asset, urls, visited) {
+    if (!asset) {
+      return;
+    }
+    if (!asset.src) {
+      return;
+    }
+    if (visited.has(asset.src)) {
+      return;
+    }
+    visited.add(asset.src);
+    if (asset.importedCss) {
+      asset.importedCss.forEach((cssUrl) => urls.add(cssUrl));
+    }
+    await Promise.all(
+      asset.importedModules.map(async (moduleId) => {
+        const importedAsset = await this.assetMap.get(moduleId);
+        this.collectCss(importedAsset, urls, visited);
+      })
+    );
+  }
+  toJson() {
+    return {
+      src: this.src,
+      assetUrl: this.assetUrl,
+      importedModules: this.importedModules,
+      importedCss: this.importedCss,
+      isElement: this.isElement
+    };
+  }
+};
+
+// src/cli/build-page.ts
+import path3 from "node:path";
+async function buildPage(renderer, rootConfig, buildDir, route, task) {
+  const { urlPath, params } = task;
+  const routeModule = route.module;
+  if (routeModule.getStaticContent) {
+    let props;
+    if (routeModule.getStaticProps) {
+      props = await routeModule.getStaticProps({
+        rootConfig,
+        params
+      });
+      if (props?.notFound) {
+        return { urlPath, notFound: true };
+      }
+    } else {
+      props = { rootConfig, params };
+    }
+    const result = await routeModule.getStaticContent(props);
+    let body;
+    if (typeof result === "string") {
+      body = result;
+    } else if (result && typeof result === "object") {
+      body = result.body;
+    } else {
+      body = "";
+    }
+    const outFilePath2 = urlPath.slice(1);
+    const outPath2 = path3.join(buildDir, outFilePath2);
+    await makeDir(path3.dirname(outPath2));
+    await writeFile(outPath2, normalizeLineEndings(body));
+    return { urlPath, outFilePath: outFilePath2, staticContent: true };
+  }
+  const data = await renderer.renderRoute(route, {
+    routeParams: params
+  });
+  if (data.notFound) {
+    return { urlPath, notFound: true };
+  }
+  let outFilePath = path3.join(urlPath.slice(1), "index.html");
+  if (outFilePath.endsWith("404/index.html")) {
+    outFilePath = outFilePath.replace("404/index.html", "404.html");
+  }
+  const outPath = path3.join(buildDir, outFilePath);
+  const html = await transformHtml(data.html || "", rootConfig);
+  await writeFile(outPath, normalizeLineEndings(html));
+  return { urlPath, outFilePath };
+}
+function normalizeLineEndings(str) {
+  return str.replace(/\r\n?/g, "\n");
+}
+
+export {
+  ElementGraph,
+  getElements,
+  getElementsDirs,
+  BuildAssetMap,
+  buildPage
+};
+//# sourceMappingURL=chunk-M3E4RKS7.js.map

package/dist/chunk-M3E4RKS7.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/node/element-graph.ts", "../src/render/asset-map/build-asset-map.ts", "../src/cli/build-page.ts"],
+  "sourcesContent": ["import fs from 'node:fs';\nimport path from 'node:path';\nimport glob from 'tiny-glob';\nimport {searchForWorkspaceRoot} from 'vite';\nimport {RootConfig} from '../core/config.js';\nimport {isValidTagName, parseTagNames} from '../utils/elements.js';\nimport {directoryContains, isDirectory, isJsFile} from '../utils/fsutils.js';\nimport type {ResolvedPod} from './pod-collector.js';\n\ninterface ElementSourceFile {\n  /** Full file path. */\n  filePath: string;\n  /** Path relative to the root project directory. */\n  relPath: string;\n}\n\n/**\n * Dependency graph for element files to capture which other elements are used\n * by any particular element.\n */\nexport class ElementGraph {\n  /**\n   * Element tagName => sourceFile.\n   */\n  readonly sourceFiles: {[tagName: string]: ElementSourceFile} = {};\n\n  /**\n   * Element tagName => set of element tagName dependencies.\n   */\n  private deps: Record<string, string[]> = {};\n\n  constructor(sourceFiles: {[tagName: string]: ElementSourceFile}) {\n    this.sourceFiles = sourceFiles;\n  }\n\n  toJson() {\n    for (const tagName in this.sourceFiles) {\n      this.deps[tagName] ??= this.parseDepsFromSource(tagName);\n    }\n    return {\n      sourceFiles: this.sourceFiles,\n      deps: this.deps,\n    };\n  }\n\n  static fromJson(data: {deps: any; sourceFiles: any}) {\n    const graph = new ElementGraph(data.sourceFiles);\n    graph.deps = data.deps;\n    return graph;\n  }\n\n  getDeps(tagName: string, visited?: Set<string>): string[] {\n    visited ??= new Set();\n    if (visited.has(tagName)) {\n      return [];\n    }\n\n    visited.add(tagName);\n    this.deps[tagName] ??= this.parseDepsFromSource(tagName);\n\n    const deps = new Set(this.deps[tagName]);\n    for (const depTagName of this.deps[tagName]) {\n      for (const childDep of this.getDeps(depTagName, visited)) {\n        deps.add(childDep);\n      }\n    }\n    return Array.from(deps);\n  }\n\n  /**\n   * Parses an element's source file for usage of other custom elements.\n   */\n  private parseDepsFromSource(tagName: string): string[] {\n    const srcFile = this.sourceFiles[tagName];\n    if (!srcFile) {\n      throw new Error(`could not find file path for tagName <${tagName}>`);\n    }\n    const src = fs.readFileSync(srcFile.filePath, 'utf-8');\n    const tagNames = parseTagNames(src);\n    const deps = new Set<string>();\n    for (const depTagName of tagNames) {\n      if (depTagName !== tagName && depTagName in this.sourceFiles) {\n        deps.add(depTagName);\n      }\n    }\n    return Array.from(deps);\n  }\n}\n\n/**\n * Returns a map of all the element file definitions in the project.\n */\nexport async function getElements(\n  rootConfig: RootConfig,\n  pods?: ResolvedPod[]\n): Promise<ElementGraph> {\n  const rootDir = rootConfig.rootDir;\n\n  const elementsDirs = getElementsDirs(rootConfig, pods);\n  const excludePatterns = rootConfig.elements?.exclude || [];\n  const excludeElement = (moduleId: string) => {\n    return excludePatterns.some((pattern) => Boolean(moduleId.match(pattern)));\n  };\n\n  const elementFilePaths: {[tagName: string]: ElementSourceFile} = {};\n  for (const dirPath of elementsDirs) {\n    if (await isDirectory(dirPath)) {\n      const files = await glob('**/*', {cwd: dirPath});\n      files.forEach((file) => {\n        const parts = path.parse(file);\n        if (isJsFile(parts.base) && isValidTagName(parts.name)) {\n          const tagName = parts.name;\n          const filePath = path.join(dirPath, file);\n          const relPath = path.relative(rootDir, filePath);\n          if (!excludeElement(relPath)) {\n            elementFilePaths[tagName] = {filePath, relPath};\n          }\n        }\n      });\n    }\n  }\n\n  const graph = new ElementGraph(elementFilePaths);\n  return graph;\n}\n\n/**\n * Get all element dirs.\n */\nexport function getElementsDirs(rootConfig: RootConfig, pods?: ResolvedPod[]) {\n  const rootDir = rootConfig.rootDir;\n  const workspaceRoot = searchForWorkspaceRoot(rootDir);\n\n  const elementsDirs = [path.join(rootDir, 'elements')];\n  const elementsInclude = rootConfig.elements?.include || [];\n\n  for (const dirPath of elementsInclude) {\n    const elementsDir = path.resolve(rootDir, dirPath);\n    if (!directoryContains(rootDir, elementsDir)) {\n      throw new Error(\n        `the elements dir (${dirPath}) should be within the project's workspace (${workspaceRoot})`\n      );\n    }\n    elementsDirs.push(elementsDir);\n  }\n\n  // Pod-contributed element dirs bypass the workspace containment check\n  // because they are trusted (registered by plugins, not user input).\n  if (pods) {\n    for (const pod of pods) {\n      for (const dir of pod.elementsDirs) {\n        elementsDirs.push(dir);\n      }\n    }\n  }\n\n  return elementsDirs;\n}\n", "import fs from 'node:fs';\nimport path from 'node:path';\nimport {Manifest} from 'vite';\nimport {RootConfig} from '../../core/config.js';\nimport {ElementGraph} from '../../node/element-graph.js';\nimport {isJsFile} from '../../utils/fsutils.js';\nimport {Asset, AssetMap} from './asset-map.js';\n\nexport type BuildAssetManifest = Record<\n  string,\n  {\n    src: string;\n    assetUrl: string;\n    importedModules: string[];\n    importedCss: string[];\n    isElement: boolean;\n  }\n>;\n\n/**\n * A pod route, used to alias the route's virtual `pod/<name>/...` src to the\n * real asset built from the route's file. See `fromViteManifest()`.\n */\nexport interface PodRouteAsset {\n  /** Virtual src, e.g. `pod/<name>/<relPath>`. */\n  src: string;\n  /** Absolute path to the pod route file. */\n  filePath: string;\n}\n\nexport class BuildAssetMap implements AssetMap {\n  private rootConfig: RootConfig;\n  private srcToAsset: Map<string, BuildAsset>;\n\n  constructor(rootConfig: RootConfig) {\n    this.rootConfig = rootConfig;\n    this.srcToAsset = new Map();\n  }\n\n  async get(src: string): Promise<Asset | null> {\n    const asset = this.srcToAsset.get(src);\n    if (asset) {\n      return asset;\n    }\n    // Try resolving the realpath of the asset, following symlinks.\n    const realSrc = realPathRelativeTo(this.rootConfig.rootDir, src);\n    if (realSrc !== src) {\n      const asset = this.srcToAsset.get(realSrc);\n      if (asset) {\n        return asset;\n      }\n    }\n    console.log(`could not find build asset: ${src}`);\n    return null;\n  }\n\n  private add(asset: BuildAsset) {\n    this.srcToAsset.set(asset.src, asset);\n  }\n\n  toJson(): BuildAssetManifest {\n    const result: BuildAssetManifest = {};\n    for (const src of this.srcToAsset.keys()) {\n      result[src] = this.srcToAsset.get(src)!.toJson();\n    }\n    return result;\n  }\n\n  static fromViteManifest(\n    rootConfig: RootConfig,\n    clientManifest: Manifest,\n    elementsGraph: ElementGraph,\n    podRoutes: PodRouteAsset[] = []\n  ) {\n    const assetMap = new BuildAssetMap(rootConfig);\n\n    const elementFiles = new Set();\n    Object.values(elementsGraph.sourceFiles).forEach((elementSource) => {\n      elementFiles.add(elementSource.relPath);\n      // Vite will resolve symlinks, so we need to follow the src and add the\n      // realpath to the element files.\n      const realSrc = realPathRelativeTo(\n        rootConfig.rootDir,\n        elementSource.relPath\n      );\n      if (realSrc !== elementSource.filePath) {\n        elementFiles.add(realSrc);\n      }\n    });\n\n    Object.keys(clientManifest).forEach((manifestKey) => {\n      const src = manifestKey;\n      const manifestChunk = clientManifest[manifestKey];\n      const isElement = elementFiles.has(src);\n      // NOTES(stevenle): routes/ files are included in the manifest for\n      // their CSS deps, but do not have an asset URL.\n      const assetUrl =\n        src.startsWith('routes/') && isJsFile(src)\n          ? ''\n          : `/${manifestChunk.file}`;\n      const assetData = {\n        src: src,\n        assetUrl: assetUrl,\n        importedModules: manifestChunk.imports || [],\n        importedCss: (manifestChunk.css || []).map((relPath) => `/${relPath}`),\n        isElement: isElement,\n      };\n      assetMap.add(new BuildAsset(assetMap, assetData));\n    });\n\n    // Pod routes are looked up by their virtual `pod/<name>/...` src at render\n    // time, but the manifest keys them by their real file path. Register an\n    // alias for each pod route so `get(route.src)` resolves to the built asset\n    // (and the route's CSS deps are collected) instead of logging\n    // \"could not find build asset\". Like user `routes/`, the alias has no asset\n    // URL of its own (the route's client JS is injected via elements/bundles).\n    podRoutes.forEach((podRoute) => {\n      if (assetMap.srcToAsset.has(podRoute.src)) {\n        return;\n      }\n      const relPath = path\n        .relative(rootConfig.rootDir, podRoute.filePath)\n        .replace(/\\\\/g, '/');\n      // `realPathRelativeTo()` returns a `path.relative()` result with\n      // OS-specific separators; normalize to forward slashes to match the\n      // manifest keys (and `relPath` above) on Windows/symlinked setups.\n      const realPath = realPathRelativeTo(rootConfig.rootDir, relPath).replace(\n        /\\\\/g,\n        '/'\n      );\n      const candidateKeys = [relPath, realPath];\n      for (const key of candidateKeys) {\n        const asset = assetMap.srcToAsset.get(key);\n        if (asset) {\n          assetMap.add(\n            new BuildAsset(assetMap, {\n              ...asset.toJson(),\n              src: podRoute.src,\n              assetUrl: '',\n            })\n          );\n          break;\n        }\n      }\n    });\n\n    return assetMap;\n  }\n\n  static fromRootManifest(\n    rootConfig: RootConfig,\n    rootManifest: BuildAssetManifest\n  ) {\n    const assetMap = new BuildAssetMap(rootConfig);\n    Object.keys(rootManifest).forEach((moduleId) => {\n      const assetData = rootManifest[moduleId];\n      assetMap.add(new BuildAsset(assetMap, assetData));\n    });\n    return assetMap;\n  }\n}\n\n/**\n * Returns the realpath of a src file, relative to the rootDir.\n */\nfunction realPathRelativeTo(rootDir: string, src: string) {\n  const fullPath = path.resolve(rootDir, src);\n  if (!fs.existsSync(fullPath)) {\n    return src;\n  }\n  const realpath = fs.realpathSync(path.resolve(rootDir, src));\n  return path.relative(rootDir, realpath);\n}\n\nexport class BuildAsset {\n  src: string;\n  assetUrl: string;\n  private assetMap: BuildAssetMap;\n  private importedModules: string[];\n  private importedCss: string[];\n  isElement: boolean;\n\n  constructor(\n    assetMap: BuildAssetMap,\n    assetData: {\n      src: string;\n      assetUrl: string;\n      importedModules: string[];\n      importedCss: string[];\n      isElement: boolean;\n    }\n  ) {\n    this.assetMap = assetMap;\n    this.src = assetData.src;\n    this.assetUrl = assetData.assetUrl;\n    this.importedModules = assetData.importedModules;\n    this.importedCss = assetData.importedCss;\n    this.isElement = assetData.isElement;\n  }\n\n  async getCssDeps(): Promise<string[]> {\n    const visited = new Set<string>();\n    const deps = new Set<string>();\n    await this.collectCss(this, deps, visited);\n    return Array.from(deps);\n  }\n\n  async getJsDeps(): Promise<string[]> {\n    const visited = new Set<string>();\n    const deps = new Set<string>();\n    await this.collectJs(this, deps, visited);\n    return Array.from(deps);\n  }\n\n  private async collectJs(\n    asset: BuildAsset | null,\n    urls: Set<string>,\n    visited: Set<string>\n  ) {\n    if (!asset) {\n      return;\n    }\n    if (!asset.src) {\n      return;\n    }\n    if (visited.has(asset.src)) {\n      return;\n    }\n    visited.add(asset.src);\n    if (asset.isElement) {\n      urls.add(asset.assetUrl);\n    }\n    await Promise.all(\n      asset.importedModules.map(async (src) => {\n        const importedAsset = (await this.assetMap.get(src)) as BuildAsset;\n        this.collectJs(importedAsset, urls, visited);\n      })\n    );\n  }\n\n  private async collectCss(\n    asset: BuildAsset | null,\n    urls: Set<string>,\n    visited: Set<string>\n  ) {\n    if (!asset) {\n      return;\n    }\n    if (!asset.src) {\n      return;\n    }\n    if (visited.has(asset.src)) {\n      return;\n    }\n    visited.add(asset.src);\n    if (asset.importedCss) {\n      asset.importedCss.forEach((cssUrl) => urls.add(cssUrl));\n    }\n    await Promise.all(\n      asset.importedModules.map(async (moduleId) => {\n        const importedAsset = (await this.assetMap.get(moduleId)) as BuildAsset;\n        this.collectCss(importedAsset, urls, visited);\n      })\n    );\n  }\n\n  toJson() {\n    return {\n      src: this.src,\n      assetUrl: this.assetUrl,\n      importedModules: this.importedModules,\n      importedCss: this.importedCss,\n      isElement: this.isElement,\n    };\n  }\n}\n", "import path from 'node:path';\n\nimport {RootConfig} from '../core/config.js';\nimport {Route} from '../core/types.js';\nimport {transformHtml} from '../render/html-transform.js';\nimport {makeDir, writeFile} from '../utils/fsutils.js';\n\ntype Renderer = import('../render/render.js').Renderer;\n\n/** A single page to build during the SSG phase of `root build`. */\nexport interface BuildPageTask {\n  /** The url path to build, e.g. `/intl/de/about/`. */\n  urlPath: string;\n  /** Route params used to build the page. */\n  params: Record<string, string>;\n  /**\n   * The route's src file (e.g. `routes/blog/[slug].tsx`). Used by worker\n   * threads to disambiguate overlapping routes that match the same url path.\n   */\n  routeSrc?: string;\n  /** The route's locale, used with `routeSrc` to disambiguate routes. */\n  locale?: string;\n}\n\n/** The result of building a single page. */\nexport interface BuildPageResult {\n  urlPath: string;\n  /** Output file path relative to the build dir. Unset when `notFound`. */\n  outFilePath?: string;\n  notFound?: boolean;\n  /** Whether the output was generated via `getStaticContent()`. */\n  staticContent?: boolean;\n}\n\n/** Message sent from the build worker to the main thread. */\nexport type BuildWorkerResponse =\n  | {type: 'ready'}\n  | {type: 'result'; id: number; result: BuildPageResult}\n  | {\n      type: 'error';\n      id: number;\n      urlPath: string;\n      params: Record<string, string>;\n      routeSrc?: string;\n      error: string;\n    }\n  | {type: 'fatal'; error: string};\n\n/** Message sent from the main thread to the build worker. */\nexport type BuildWorkerRequest = {\n  type: 'render';\n  id: number;\n  task: BuildPageTask;\n};\n\n/**\n * Builds a single page (or static content file) to the build dir. Shared by\n * the in-process SSG build loop and the `--threads` build worker.\n */\nexport async function buildPage(\n  renderer: Renderer,\n  rootConfig: RootConfig,\n  buildDir: string,\n  route: Route,\n  task: BuildPageTask\n): Promise<BuildPageResult> {\n  const {urlPath, params} = task;\n  const routeModule = route.module;\n  if (routeModule.getStaticContent) {\n    let props: any;\n    if (routeModule.getStaticProps) {\n      props = await routeModule.getStaticProps({\n        rootConfig,\n        params,\n      });\n      if (props?.notFound) {\n        return {urlPath, notFound: true};\n      }\n    } else {\n      props = {rootConfig, params};\n    }\n    const result = await routeModule.getStaticContent(props);\n    let body: string;\n    if (typeof result === 'string') {\n      body = result;\n    } else if (result && typeof result === 'object') {\n      body = result.body;\n    } else {\n      body = '';\n    }\n    const outFilePath = urlPath.slice(1);\n    const outPath = path.join(buildDir, outFilePath);\n    await makeDir(path.dirname(outPath));\n    await writeFile(outPath, normalizeLineEndings(body));\n    return {urlPath, outFilePath, staticContent: true};\n  }\n\n  const data = await renderer.renderRoute(route, {\n    routeParams: params,\n  });\n  if (data.notFound) {\n    return {urlPath, notFound: true};\n  }\n\n  let outFilePath = path.join(urlPath.slice(1), 'index.html');\n  if (outFilePath.endsWith('404/index.html')) {\n    outFilePath = outFilePath.replace('404/index.html', '404.html');\n  }\n  const outPath = path.join(buildDir, outFilePath);\n\n  const html = await transformHtml(data.html || '', rootConfig);\n  await writeFile(outPath, normalizeLineEndings(html));\n  return {urlPath, outFilePath};\n}\n\nexport function normalizeLineEndings(str: string): string {\n  return str.replace(/\\r\\n?/g, '\\n');\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,OAAO,UAAU;AACjB,SAAQ,8BAA6B;AAiB9B,IAAM,eAAN,MAAM,cAAa;AAAA;AAAA;AAAA;AAAA,EAIf,cAAsD,CAAC;AAAA;AAAA;AAAA;AAAA,EAKxD,OAAiC,CAAC;AAAA,EAE1C,YAAY,aAAqD;AAC/D,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,SAAS;AACP,eAAW,WAAW,KAAK,aAAa;AACtC,WAAK,KAAK,OAAO,MAAM,KAAK,oBAAoB,OAAO;AAAA,IACzD;AACA,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,MAClB,MAAM,KAAK;AAAA,IACb;AAAA,EACF;AAAA,EAEA,OAAO,SAAS,MAAqC;AACnD,UAAM,QAAQ,IAAI,cAAa,KAAK,WAAW;AAC/C,UAAM,OAAO,KAAK;AAClB,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ,SAAiB,SAAiC;AACxD,gBAAY,oBAAI,IAAI;AACpB,QAAI,QAAQ,IAAI,OAAO,GAAG;AACxB,aAAO,CAAC;AAAA,IACV;AAEA,YAAQ,IAAI,OAAO;AACnB,SAAK,KAAK,OAAO,MAAM,KAAK,oBAAoB,OAAO;AAEvD,UAAM,OAAO,IAAI,IAAI,KAAK,KAAK,OAAO,CAAC;AACvC,eAAW,cAAc,KAAK,KAAK,OAAO,GAAG;AAC3C,iBAAW,YAAY,KAAK,QAAQ,YAAY,OAAO,GAAG;AACxD,aAAK,IAAI,QAAQ;AAAA,MACnB;AAAA,IACF;AACA,WAAO,MAAM,KAAK,IAAI;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA,EAKQ,oBAAoB,SAA2B;AACrD,UAAM,UAAU,KAAK,YAAY,OAAO;AACxC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,yCAAyC,OAAO,GAAG;AAAA,IACrE;AACA,UAAM,MAAM,GAAG,aAAa,QAAQ,UAAU,OAAO;AACrD,UAAM,WAAW,cAAc,GAAG;AAClC,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,cAAc,UAAU;AACjC,UAAI,eAAe,WAAW,cAAc,KAAK,aAAa;AAC5D,aAAK,IAAI,UAAU;AAAA,MACrB;AAAA,IACF;AACA,WAAO,MAAM,KAAK,IAAI;AAAA,EACxB;AACF;AAKA,eAAsB,YACpB,YACA,MACuB;AACvB,QAAM,UAAU,WAAW;AAE3B,QAAM,eAAe,gBAAgB,YAAY,IAAI;AACrD,QAAM,kBAAkB,WAAW,UAAU,WAAW,CAAC;AACzD,QAAM,iBAAiB,CAAC,aAAqB;AAC3C,WAAO,gBAAgB,KAAK,CAAC,YAAY,QAAQ,SAAS,MAAM,OAAO,CAAC,CAAC;AAAA,EAC3E;AAEA,QAAM,mBAA2D,CAAC;AAClE,aAAW,WAAW,cAAc;AAClC,QAAI,MAAM,YAAY,OAAO,GAAG;AAC9B,YAAM,QAAQ,MAAM,KAAK,QAAQ,EAAC,KAAK,QAAO,CAAC;AAC/C,YAAM,QAAQ,CAAC,SAAS;AACtB,cAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,YAAI,SAAS,MAAM,IAAI,KAAK,eAAe,MAAM,IAAI,GAAG;AACtD,gBAAM,UAAU,MAAM;AACtB,gBAAM,WAAW,KAAK,KAAK,SAAS,IAAI;AACxC,gBAAM,UAAU,KAAK,SAAS,SAAS,QAAQ;AAC/C,cAAI,CAAC,eAAe,OAAO,GAAG;AAC5B,6BAAiB,OAAO,IAAI,EAAC,UAAU,QAAO;AAAA,UAChD;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,QAAQ,IAAI,aAAa,gBAAgB;AAC/C,SAAO;AACT;AAKO,SAAS,gBAAgB,YAAwB,MAAsB;AAC5E,QAAM,UAAU,WAAW;AAC3B,QAAM,gBAAgB,uBAAuB,OAAO;AAEpD,QAAM,eAAe,CAAC,KAAK,KAAK,SAAS,UAAU,CAAC;AACpD,QAAM,kBAAkB,WAAW,UAAU,WAAW,CAAC;AAEzD,aAAW,WAAW,iBAAiB;AACrC,UAAM,cAAc,KAAK,QAAQ,SAAS,OAAO;AACjD,QAAI,CAAC,kBAAkB,SAAS,WAAW,GAAG;AAC5C,YAAM,IAAI;AAAA,QACR,qBAAqB,OAAO,+CAA+C,aAAa;AAAA,MAC1F;AAAA,IACF;AACA,iBAAa,KAAK,WAAW;AAAA,EAC/B;AAIA,MAAI,MAAM;AACR,eAAW,OAAO,MAAM;AACtB,iBAAW,OAAO,IAAI,cAAc;AAClC,qBAAa,KAAK,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;;;AC7JA,OAAOA,SAAQ;AACf,OAAOC,WAAU;AA6BV,IAAM,gBAAN,MAAM,eAAkC;AAAA,EACrC;AAAA,EACA;AAAA,EAER,YAAY,YAAwB;AAClC,SAAK,aAAa;AAClB,SAAK,aAAa,oBAAI,IAAI;AAAA,EAC5B;AAAA,EAEA,MAAM,IAAI,KAAoC;AAC5C,UAAM,QAAQ,KAAK,WAAW,IAAI,GAAG;AACrC,QAAI,OAAO;AACT,aAAO;AAAA,IACT;AAEA,UAAM,UAAU,mBAAmB,KAAK,WAAW,SAAS,GAAG;AAC/D,QAAI,YAAY,KAAK;AACnB,YAAMC,SAAQ,KAAK,WAAW,IAAI,OAAO;AACzC,UAAIA,QAAO;AACT,eAAOA;AAAA,MACT;AAAA,IACF;AACA,YAAQ,IAAI,+BAA+B,GAAG,EAAE;AAChD,WAAO;AAAA,EACT;AAAA,EAEQ,IAAI,OAAmB;AAC7B,SAAK,WAAW,IAAI,MAAM,KAAK,KAAK;AAAA,EACtC;AAAA,EAEA,SAA6B;AAC3B,UAAM,SAA6B,CAAC;AACpC,eAAW,OAAO,KAAK,WAAW,KAAK,GAAG;AACxC,aAAO,GAAG,IAAI,KAAK,WAAW,IAAI,GAAG,EAAG,OAAO;AAAA,IACjD;AACA,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,iBACL,YACA,gBACA,eACA,YAA6B,CAAC,GAC9B;AACA,UAAM,WAAW,IAAI,eAAc,UAAU;AAE7C,UAAM,eAAe,oBAAI,IAAI;AAC7B,WAAO,OAAO,cAAc,WAAW,EAAE,QAAQ,CAAC,kBAAkB;AAClE,mBAAa,IAAI,cAAc,OAAO;AAGtC,YAAM,UAAU;AAAA,QACd,WAAW;AAAA,QACX,cAAc;AAAA,MAChB;AACA,UAAI,YAAY,cAAc,UAAU;AACtC,qBAAa,IAAI,OAAO;AAAA,MAC1B;AAAA,IACF,CAAC;AAED,WAAO,KAAK,cAAc,EAAE,QAAQ,CAAC,gBAAgB;AACnD,YAAM,MAAM;AACZ,YAAM,gBAAgB,eAAe,WAAW;AAChD,YAAM,YAAY,aAAa,IAAI,GAAG;AAGtC,YAAM,WACJ,IAAI,WAAW,SAAS,KAAK,SAAS,GAAG,IACrC,KACA,IAAI,cAAc,IAAI;AAC5B,YAAM,YAAY;AAAA,QAChB;AAAA,QACA;AAAA,QACA,iBAAiB,cAAc,WAAW,CAAC;AAAA,QAC3C,cAAc,cAAc,OAAO,CAAC,GAAG,IAAI,CAAC,YAAY,IAAI,OAAO,EAAE;AAAA,QACrE;AAAA,MACF;AACA,eAAS,IAAI,IAAI,WAAW,UAAU,SAAS,CAAC;AAAA,IAClD,CAAC;AAQD,cAAU,QAAQ,CAAC,aAAa;AAC9B,UAAI,SAAS,WAAW,IAAI,SAAS,GAAG,GAAG;AACzC;AAAA,MACF;AACA,YAAM,UAAUC,MACb,SAAS,WAAW,SAAS,SAAS,QAAQ,EAC9C,QAAQ,OAAO,GAAG;AAIrB,YAAM,WAAW,mBAAmB,WAAW,SAAS,OAAO,EAAE;AAAA,QAC/D;AAAA,QACA;AAAA,MACF;AACA,YAAM,gBAAgB,CAAC,SAAS,QAAQ;AACxC,iBAAW,OAAO,eAAe;AAC/B,cAAM,QAAQ,SAAS,WAAW,IAAI,GAAG;AACzC,YAAI,OAAO;AACT,mBAAS;AAAA,YACP,IAAI,WAAW,UAAU;AAAA,cACvB,GAAG,MAAM,OAAO;AAAA,cAChB,KAAK,SAAS;AAAA,cACd,UAAU;AAAA,YACZ,CAAC;AAAA,UACH;AACA;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,iBACL,YACA,cACA;AACA,UAAM,WAAW,IAAI,eAAc,UAAU;AAC7C,WAAO,KAAK,YAAY,EAAE,QAAQ,CAAC,aAAa;AAC9C,YAAM,YAAY,aAAa,QAAQ;AACvC,eAAS,IAAI,IAAI,WAAW,UAAU,SAAS,CAAC;AAAA,IAClD,CAAC;AACD,WAAO;AAAA,EACT;AACF;AAKA,SAAS,mBAAmB,SAAiB,KAAa;AACxD,QAAM,WAAWA,MAAK,QAAQ,SAAS,GAAG;AAC1C,MAAI,CAACC,IAAG,WAAW,QAAQ,GAAG;AAC5B,WAAO;AAAA,EACT;AACA,QAAM,WAAWA,IAAG,aAAaD,MAAK,QAAQ,SAAS,GAAG,CAAC;AAC3D,SAAOA,MAAK,SAAS,SAAS,QAAQ;AACxC;AAEO,IAAM,aAAN,MAAiB;AAAA,EACtB;AAAA,EACA;AAAA,EACQ;AAAA,EACA;AAAA,EACA;AAAA,EACR;AAAA,EAEA,YACE,UACA,WAOA;AACA,SAAK,WAAW;AAChB,SAAK,MAAM,UAAU;AACrB,SAAK,WAAW,UAAU;AAC1B,SAAK,kBAAkB,UAAU;AACjC,SAAK,cAAc,UAAU;AAC7B,SAAK,YAAY,UAAU;AAAA,EAC7B;AAAA,EAEA,MAAM,aAAgC;AACpC,UAAM,UAAU,oBAAI,IAAY;AAChC,UAAM,OAAO,oBAAI,IAAY;AAC7B,UAAM,KAAK,WAAW,MAAM,MAAM,OAAO;AACzC,WAAO,MAAM,KAAK,IAAI;AAAA,EACxB;AAAA,EAEA,MAAM,YAA+B;AACnC,UAAM,UAAU,oBAAI,IAAY;AAChC,UAAM,OAAO,oBAAI,IAAY;AAC7B,UAAM,KAAK,UAAU,MAAM,MAAM,OAAO;AACxC,WAAO,MAAM,KAAK,IAAI;AAAA,EACxB;AAAA,EAEA,MAAc,UACZ,OACA,MACA,SACA;AACA,QAAI,CAAC,OAAO;AACV;AAAA,IACF;AACA,QAAI,CAAC,MAAM,KAAK;AACd;AAAA,IACF;AACA,QAAI,QAAQ,IAAI,MAAM,GAAG,GAAG;AAC1B;AAAA,IACF;AACA,YAAQ,IAAI,MAAM,GAAG;AACrB,QAAI,MAAM,WAAW;AACnB,WAAK,IAAI,MAAM,QAAQ;AAAA,IACzB;AACA,UAAM,QAAQ;AAAA,MACZ,MAAM,gBAAgB,IAAI,OAAO,QAAQ;AACvC,cAAM,gBAAiB,MAAM,KAAK,SAAS,IAAI,GAAG;AAClD,aAAK,UAAU,eAAe,MAAM,OAAO;AAAA,MAC7C,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAc,WACZ,OACA,MACA,SACA;AACA,QAAI,CAAC,OAAO;AACV;AAAA,IACF;AACA,QAAI,CAAC,MAAM,KAAK;AACd;AAAA,IACF;AACA,QAAI,QAAQ,IAAI,MAAM,GAAG,GAAG;AAC1B;AAAA,IACF;AACA,YAAQ,IAAI,MAAM,GAAG;AACrB,QAAI,MAAM,aAAa;AACrB,YAAM,YAAY,QAAQ,CAAC,WAAW,KAAK,IAAI,MAAM,CAAC;AAAA,IACxD;AACA,UAAM,QAAQ;AAAA,MACZ,MAAM,gBAAgB,IAAI,OAAO,aAAa;AAC5C,cAAM,gBAAiB,MAAM,KAAK,SAAS,IAAI,QAAQ;AACvD,aAAK,WAAW,eAAe,MAAM,OAAO;AAAA,MAC9C,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,SAAS;AACP,WAAO;AAAA,MACL,KAAK,KAAK;AAAA,MACV,UAAU,KAAK;AAAA,MACf,iBAAiB,KAAK;AAAA,MACtB,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,IAClB;AAAA,EACF;AACF;;;ACnRA,OAAOE,WAAU;AA2DjB,eAAsB,UACpB,UACA,YACA,UACA,OACA,MAC0B;AAC1B,QAAM,EAAC,SAAS,OAAM,IAAI;AAC1B,QAAM,cAAc,MAAM;AAC1B,MAAI,YAAY,kBAAkB;AAChC,QAAI;AACJ,QAAI,YAAY,gBAAgB;AAC9B,cAAQ,MAAM,YAAY,eAAe;AAAA,QACvC;AAAA,QACA;AAAA,MACF,CAAC;AACD,UAAI,OAAO,UAAU;AACnB,eAAO,EAAC,SAAS,UAAU,KAAI;AAAA,MACjC;AAAA,IACF,OAAO;AACL,cAAQ,EAAC,YAAY,OAAM;AAAA,IAC7B;AACA,UAAM,SAAS,MAAM,YAAY,iBAAiB,KAAK;AACvD,QAAI;AACJ,QAAI,OAAO,WAAW,UAAU;AAC9B,aAAO;AAAA,IACT,WAAW,UAAU,OAAO,WAAW,UAAU;AAC/C,aAAO,OAAO;AAAA,IAChB,OAAO;AACL,aAAO;AAAA,IACT;AACA,UAAMC,eAAc,QAAQ,MAAM,CAAC;AACnC,UAAMC,WAAUC,MAAK,KAAK,UAAUF,YAAW;AAC/C,UAAM,QAAQE,MAAK,QAAQD,QAAO,CAAC;AACnC,UAAM,UAAUA,UAAS,qBAAqB,IAAI,CAAC;AACnD,WAAO,EAAC,SAAS,aAAAD,cAAa,eAAe,KAAI;AAAA,EACnD;AAEA,QAAM,OAAO,MAAM,SAAS,YAAY,OAAO;AAAA,IAC7C,aAAa;AAAA,EACf,CAAC;AACD,MAAI,KAAK,UAAU;AACjB,WAAO,EAAC,SAAS,UAAU,KAAI;AAAA,EACjC;AAEA,MAAI,cAAcE,MAAK,KAAK,QAAQ,MAAM,CAAC,GAAG,YAAY;AAC1D,MAAI,YAAY,SAAS,gBAAgB,GAAG;AAC1C,kBAAc,YAAY,QAAQ,kBAAkB,UAAU;AAAA,EAChE;AACA,QAAM,UAAUA,MAAK,KAAK,UAAU,WAAW;AAE/C,QAAM,OAAO,MAAM,cAAc,KAAK,QAAQ,IAAI,UAAU;AAC5D,QAAM,UAAU,SAAS,qBAAqB,IAAI,CAAC;AACnD,SAAO,EAAC,SAAS,YAAW;AAC9B;AAEO,SAAS,qBAAqB,KAAqB;AACxD,SAAO,IAAI,QAAQ,UAAU,IAAI;AACnC;",
+  "names": ["fs", "path", "asset", "path", "fs", "path", "outFilePath", "outPath", "path"]
+}

package/dist/{chunk-6NBKAR5Y.js → chunk-TM6QRBGS.js}

@@ -1,3 +1,8 @@
+import {
+  getSecurityConfig,
+  setSecurityHeaders
+} from "./chunk-WX62JK5E.js";
+
 // src/middleware/common.ts
 import path from "node:path";
 import micromatch from "micromatch";
@@ -7,6 +12,16 @@ function rootProjectMiddleware(options) {
     next();
   };
 }
+function securityHeadersMiddleware(options) {
+  const securityConfig = {
+    ...getSecurityConfig(options.rootConfig),
+    contentSecurityPolicy: false
+  };
+  return (req, res, next) => {
+    setSecurityHeaders(res, { securityConfig });
+    next();
+  };
+}
 function headersMiddleware(options) {
   const headersUserConfig = options.rootConfig.server?.headers || [];
   const headersConfig = headersUserConfig.filter((headerConfig) => {
@@ -60,6 +75,19 @@ function removeTrailingSlashes(urlPath) {
   return urlPath;
 }
 
+// src/middleware/compression.ts
+import zlib from "node:zlib";
+import compression from "compression";
+function compressionMiddleware() {
+  return compression({
+    brotli: {
+      params: {
+        [zlib.constants.BROTLI_PARAM_QUALITY]: 4
+      }
+    }
+  });
+}
+
 // src/middleware/multipart.ts
 import busboy from "busboy";
 var DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
@@ -212,11 +240,13 @@ function base64Decode(str) {
 
 export {
   rootProjectMiddleware,
+  securityHeadersMiddleware,
   headersMiddleware,
   trailingSlashMiddleware,
+  compressionMiddleware,
   multipartMiddleware,
   SESSION_COOKIE,
   sessionMiddleware,
   Session
 };
-//# sourceMappingURL=chunk-6NBKAR5Y.js.map
+//# sourceMappingURL=chunk-TM6QRBGS.js.map

package/dist/chunk-TM6QRBGS.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/middleware/common.ts", "../src/middleware/compression.ts", "../src/middleware/multipart.ts", "../src/middleware/session.ts"],
+  "sourcesContent": ["import path from 'node:path';\nimport micromatch from 'micromatch';\nimport {RootConfig} from '../core/config.js';\nimport {getSecurityConfig, setSecurityHeaders} from '../core/security.js';\nimport {Request, Response, NextFunction} from '../core/types.js';\n\n/**\n * Middleware that injects the root.js project config into the request context.\n */\nexport function rootProjectMiddleware(options: {rootConfig: RootConfig}) {\n  return (req: Request, _: Response, next: NextFunction) => {\n    req.rootConfig = options.rootConfig;\n    next();\n  };\n}\n\n/**\n * Middleware that sets security-related HTTP headers (e.g.\n * `Strict-Transport-Security`) on all responses using the `server.security`\n * config in root.config.ts.\n *\n * The renderer sets these headers on rendered HTML responses, but responses\n * that bypass the renderer (e.g. redirects, static files, plugin-served\n * responses, 404s) would otherwise be served without them. Per\n * https://hstspreload.org, HSTS preload eligibility requires the HSTS header\n * on redirects as well.\n *\n * NOTE: `Content-Security-Policy` is excluded here since the CSP is\n * document-specific and depends on a per-request nonce, which is generated by\n * the renderer at render time.\n */\nexport function securityHeadersMiddleware(options: {rootConfig: RootConfig}) {\n  const securityConfig = {\n    ...getSecurityConfig(options.rootConfig),\n    contentSecurityPolicy: false as const,\n  };\n  return (req: Request, res: Response, next: NextFunction) => {\n    setSecurityHeaders(res, {securityConfig});\n    next();\n  };\n}\n\n/**\n * Middleware that injects HTTP headers from the `server.headers` config in\n * root.config.ts.\n */\nexport function headersMiddleware(options: {rootConfig: RootConfig}) {\n  const headersUserConfig = options.rootConfig.server?.headers || [];\n  // Filter header config values that are invalid.\n  const headersConfig = headersUserConfig.filter((headerConfig) => {\n    return (\n      headerConfig.source &&\n      headerConfig.headers &&\n      headerConfig.headers.length > 0\n    );\n  });\n  return (req: Request, res: Response, next: NextFunction) => {\n    headersConfig.forEach((headerConfig) => {\n      if (micromatch.isMatch(req.path, headerConfig.source)) {\n        headerConfig.headers.forEach((header) => {\n          if (header.key) {\n            res.setHeader(String(header.key), String(header.value));\n          }\n        });\n      }\n    });\n    next();\n  };\n}\n\n/**\n * Trailing slash middleware. Handles trailing slash redirects (preserving any\n * query params) using the `server.trailingSlash` config in root.config.ts.\n */\nexport function trailingSlashMiddleware(options: {rootConfig: RootConfig}) {\n  const trailingSlash = options.rootConfig.server?.trailingSlash;\n\n  return (req: Request, res: Response, next: NextFunction) => {\n    // If `trailingSlash: false`, force a trailing slash in the URL.\n    if (\n      trailingSlash === true &&\n      !path.extname(req.path) &&\n      !req.path.endsWith('/')\n    ) {\n      const redirectPath = `${req.path}/`;\n      redirectWithQuery(req, res, 301, redirectPath);\n      return;\n    }\n\n    // If `trailingSlash: false`, remove any trailing slash from the URL.\n    if (\n      trailingSlash === false &&\n      !path.extname(req.path) &&\n      req.path !== '/' &&\n      req.path.endsWith('/')\n    ) {\n      const redirectPath = removeTrailingSlashes(req.path);\n      redirectWithQuery(req, res, 301, redirectPath);\n      return;\n    }\n\n    next();\n  };\n}\n\n/**\n * Issues an HTTP redirect, preserving any query params from the original req.\n */\nfunction redirectWithQuery(\n  req: Request,\n  res: Response,\n  redirectCode: number,\n  redirectPath: string\n) {\n  const queryStr = getQueryStr(req);\n  const redirectUrl = queryStr ? `${redirectPath}?${queryStr}` : redirectPath;\n  res.redirect(redirectCode, redirectUrl);\n}\n\n/**\n * Returns the query string for a request, or empty string if no query.\n */\nfunction getQueryStr(req: Request): string {\n  const qIndex = req.originalUrl.indexOf('?');\n  if (qIndex === -1) {\n    return '';\n  }\n  return req.originalUrl.slice(qIndex + 1);\n}\n\n/**\n * Removes trailing slashes from a URL path.\n * Note: A path with only slashes (e.g. `///`) returns `/`.\n */\nfunction removeTrailingSlashes(urlPath: string) {\n  while (urlPath.endsWith('/') && urlPath !== '/') {\n    urlPath = urlPath.slice(0, -1);\n  }\n  return urlPath;\n}\n", "import zlib from 'node:zlib';\n\nimport compression from 'compression';\n\nimport {Request, Response, NextFunction} from '../core/types.js';\n\n/**\n * Response compression middleware shared by the preview and prod servers.\n *\n * Uses brotli when the client accepts it (`Accept-Encoding: br`), falling\n * back to gzip. Brotli quality 4 is used as a balance between compression\n * ratio and CPU cost for dynamically-rendered responses \u2014 it generally\n * compresses better than gzip's default (level 6) at comparable speed.\n * Pre-compressed static assets should still be served with higher quality\n * settings by a CDN or static file server where possible.\n */\nexport function compressionMiddleware(): (\n  req: Request,\n  res: Response,\n  next: NextFunction\n) => void {\n  return compression({\n    brotli: {\n      params: {\n        [zlib.constants.BROTLI_PARAM_QUALITY]: 4,\n      },\n    },\n  }) as (req: Request, res: Response, next: NextFunction) => void;\n}\n", "import busboy from 'busboy';\nimport {RequestHandler} from 'express';\nimport {Request, Response, NextFunction, MultipartFile} from '../core/types.js';\n\nconst DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB\n\n/**\n * Middleware for parsing multipart file uploads that's compatible with the dev\n * server and Firebase Functions.\n *\n * Context:\n * https://stackoverflow.com/questions/47242340/how-to-perform-an-http-file-upload-using-express-on-cloud-functions-for-firebase\n */\nexport function multipartMiddleware(options?: {\n  maxFileSize?: number;\n}): RequestHandler {\n  const maxFileSize = options?.maxFileSize || DEFAULT_MAX_FILE_SIZE;\n  const handler: any = (req: Request, res: Response, next: NextFunction) => {\n    const contentType = String(req.headers['content-type'] || '');\n    if (\n      req.method === 'POST' &&\n      contentType.startsWith('multipart/form-data')\n    ) {\n      const parser = busboy({headers: req.headers});\n\n      // Data storage for fields and files\n      const fields: {[fieldname: string]: string} = {};\n      const files: {[name: string]: MultipartFile} = {};\n\n      // Handle field data.\n      parser.on('field', (fieldname: string, val: any) => {\n        fields[fieldname] = val;\n      });\n\n      // Handle file data. Files are saved to an in-memory buffer.\n      parser.on(\n        'file',\n        (\n          fieldname: string,\n          file: any,\n          meta: {\n            filename: string;\n            encoding: string;\n            mimeType: string;\n          }\n        ) => {\n          const {filename, encoding, mimeType: mimetype} = meta;\n          const fileChunks: Uint8Array[] = [];\n          let totalBytesRead = 0;\n\n          file.on('data', (chunk: Uint8Array) => {\n            totalBytesRead += chunk.length;\n\n            if (totalBytesRead > maxFileSize) {\n              // File size exceeds the limit, stop reading.\n              console.error(`File size exceeds the limit: ${fieldname}.`);\n              file.removeAllListeners('data');\n              // Consume and discard remaining data.\n              file.resume();\n            } else {\n              fileChunks.push(chunk);\n            }\n          });\n\n          file.on('end', () => {\n            if (totalBytesRead <= maxFileSize) {\n              const buffer = Buffer.concat(fileChunks);\n\n              files[fieldname] = {\n                fieldname,\n                buffer,\n                originalName: filename,\n                encoding,\n                mimetype,\n              };\n            }\n          });\n        }\n      );\n\n      // Update `req.body` and `req.files`.\n      parser.on('finish', () => {\n        req.body = fields;\n        req.files = files;\n        next();\n      });\n\n      // Pipe the request to Busboy. On Firebase Functions, `rawBody` contains\n      // the multipart request. Otherwise the express request can be piped to\n      // the Busboy parser.\n      if (req.rawBody) {\n        parser.end(req.rawBody);\n      } else {\n        req.pipe(parser);\n      }\n    } else {\n      next();\n    }\n  };\n  return handler;\n}\n", "import {NextFunction, Request, Response} from '../core/types.js';\n\nexport const SESSION_COOKIE = '__session';\nlet hasWarnedMissingSessionCookieSecret = false;\n\n// 5 days.\nconst DEFAULT_MAX_AGE = 60 * 60 * 24 * 5 * 1000;\n\nexport interface SessionMiddlewareOptions {\n  maxAge?: number;\n}\n\nexport interface SaveSessionOptions {\n  sameSite?: 'strict' | 'lax' | 'none';\n}\n\n/**\n * Middleware for storing session data stored in an http cookie called\n * `__session`. This cookie is compatible with Firebase Hosting:\n * https://firebase.google.com/docs/hosting/manage-cache#using_cookies\n */\nexport function sessionMiddleware(options?: SessionMiddlewareOptions) {\n  const maxAge = options?.maxAge || DEFAULT_MAX_AGE;\n  return (req: Request, res: Response, next: NextFunction) => {\n    const cookieValue = String(req.signedCookies[SESSION_COOKIE] || '');\n    const session = Session.fromCookieValue(cookieValue);\n    req.session = session;\n    res.session = session;\n    res.saveSession = (saveSessionOptions?: SaveSessionOptions) => {\n      if (!session.hasChanges) {\n        return;\n      }\n\n      const hasConfiguredSessionSecret = Boolean(\n        req.rootConfig?.server?.sessionCookieSecret\n      );\n      if (!hasConfiguredSessionSecret && !hasWarnedMissingSessionCookieSecret) {\n        console.warn(\n          'session cookie is being set without a configured server.sessionCookieSecret; sessions may be invalidated across server restarts'\n        );\n        hasWarnedMissingSessionCookieSecret = true;\n      }\n\n      // \"secure\" cookies require https, so disable \"secure\" when in development.\n      const secureCookie = Boolean(process.env.NODE_ENV !== 'development');\n      const cookieValue = session.toString();\n      let sameSite = saveSessionOptions?.sameSite;\n      if (!sameSite) {\n        // Default the sameSite setting to \"none\", which allows it to be used in\n        // multi-site contexts.\n        // \"Cookies with SameSite=None must also specify Secure, meaning they require a secure context.\"\n        // https://web.dev/articles/samesite-cookies-explained#samesite_cookie_recipes\n        sameSite = secureCookie ? 'none' : 'strict';\n      }\n      res.cookie(SESSION_COOKIE, cookieValue, {\n        maxAge: maxAge,\n        httpOnly: true,\n        secure: secureCookie,\n        signed: true,\n        sameSite: sameSite,\n      });\n    };\n    req.hooks.add('preRender', () => {\n      res.saveSession();\n    });\n    next();\n  };\n}\n\nexport class Session {\n  private data: Record<string, string> = {};\n  hasChanges = false;\n\n  constructor(data?: Record<string, string>) {\n    this.data = data || {};\n  }\n\n  static fromCookieValue(cookieValue: string) {\n    const data: Record<string, string> = {};\n    if (cookieValue.startsWith('b64:')) {\n      try {\n        const encodedStr = cookieValue.slice(4);\n        const params = new URLSearchParams(base64Decode(encodedStr));\n        for (const [key, value] of params.entries()) {\n          data[key] = value;\n        }\n      } catch (err) {\n        console.warn('failed to parse session cookie:', err);\n        return new Session();\n      }\n    }\n    return new Session(data);\n  }\n\n  getItem(key: string): string | null {\n    return this.data[key] ?? null;\n  }\n\n  setItem(key: string, value: string) {\n    this.data[key] = value;\n    this.hasChanges = true;\n  }\n\n  removeItem(key: string) {\n    delete this.data[key];\n    this.hasChanges = true;\n  }\n\n  toString(): string {\n    const params = new URLSearchParams(this.data);\n    return `b64:${base64Encode(params.toString())}`;\n  }\n}\n\nfunction base64Encode(str: string): string {\n  return Buffer.from(str, 'utf-8').toString('base64');\n}\n\nfunction base64Decode(str: string): string {\n  return Buffer.from(str, 'base64').toString('utf-8');\n}\n"],
+  "mappings": ";;;;;;AAAA,OAAO,UAAU;AACjB,OAAO,gBAAgB;AAQhB,SAAS,sBAAsB,SAAmC;AACvE,SAAO,CAAC,KAAc,GAAa,SAAuB;AACxD,QAAI,aAAa,QAAQ;AACzB,SAAK;AAAA,EACP;AACF;AAiBO,SAAS,0BAA0B,SAAmC;AAC3E,QAAM,iBAAiB;AAAA,IACrB,GAAG,kBAAkB,QAAQ,UAAU;AAAA,IACvC,uBAAuB;AAAA,EACzB;AACA,SAAO,CAAC,KAAc,KAAe,SAAuB;AAC1D,uBAAmB,KAAK,EAAC,eAAc,CAAC;AACxC,SAAK;AAAA,EACP;AACF;AAMO,SAAS,kBAAkB,SAAmC;AACnE,QAAM,oBAAoB,QAAQ,WAAW,QAAQ,WAAW,CAAC;AAEjE,QAAM,gBAAgB,kBAAkB,OAAO,CAAC,iBAAiB;AAC/D,WACE,aAAa,UACb,aAAa,WACb,aAAa,QAAQ,SAAS;AAAA,EAElC,CAAC;AACD,SAAO,CAAC,KAAc,KAAe,SAAuB;AAC1D,kBAAc,QAAQ,CAAC,iBAAiB;AACtC,UAAI,WAAW,QAAQ,IAAI,MAAM,aAAa,MAAM,GAAG;AACrD,qBAAa,QAAQ,QAAQ,CAAC,WAAW;AACvC,cAAI,OAAO,KAAK;AACd,gBAAI,UAAU,OAAO,OAAO,GAAG,GAAG,OAAO,OAAO,KAAK,CAAC;AAAA,UACxD;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AACD,SAAK;AAAA,EACP;AACF;AAMO,SAAS,wBAAwB,SAAmC;AACzE,QAAM,gBAAgB,QAAQ,WAAW,QAAQ;AAEjD,SAAO,CAAC,KAAc,KAAe,SAAuB;AAE1D,QACE,kBAAkB,QAClB,CAAC,KAAK,QAAQ,IAAI,IAAI,KACtB,CAAC,IAAI,KAAK,SAAS,GAAG,GACtB;AACA,YAAM,eAAe,GAAG,IAAI,IAAI;AAChC,wBAAkB,KAAK,KAAK,KAAK,YAAY;AAC7C;AAAA,IACF;AAGA,QACE,kBAAkB,SAClB,CAAC,KAAK,QAAQ,IAAI,IAAI,KACtB,IAAI,SAAS,OACb,IAAI,KAAK,SAAS,GAAG,GACrB;AACA,YAAM,eAAe,sBAAsB,IAAI,IAAI;AACnD,wBAAkB,KAAK,KAAK,KAAK,YAAY;AAC7C;AAAA,IACF;AAEA,SAAK;AAAA,EACP;AACF;AAKA,SAAS,kBACP,KACA,KACA,cACA,cACA;AACA,QAAM,WAAW,YAAY,GAAG;AAChC,QAAM,cAAc,WAAW,GAAG,YAAY,IAAI,QAAQ,KAAK;AAC/D,MAAI,SAAS,cAAc,WAAW;AACxC;AAKA,SAAS,YAAY,KAAsB;AACzC,QAAM,SAAS,IAAI,YAAY,QAAQ,GAAG;AAC1C,MAAI,WAAW,IAAI;AACjB,WAAO;AAAA,EACT;AACA,SAAO,IAAI,YAAY,MAAM,SAAS,CAAC;AACzC;AAMA,SAAS,sBAAsB,SAAiB;AAC9C,SAAO,QAAQ,SAAS,GAAG,KAAK,YAAY,KAAK;AAC/C,cAAU,QAAQ,MAAM,GAAG,EAAE;AAAA,EAC/B;AACA,SAAO;AACT;;;AC3IA,OAAO,UAAU;AAEjB,OAAO,iBAAiB;AAcjB,SAAS,wBAIN;AACR,SAAO,YAAY;AAAA,IACjB,QAAQ;AAAA,MACN,QAAQ;AAAA,QACN,CAAC,KAAK,UAAU,oBAAoB,GAAG;AAAA,MACzC;AAAA,IACF;AAAA,EACF,CAAC;AACH;;;AC5BA,OAAO,YAAY;AAInB,IAAM,wBAAwB,KAAK,OAAO;AASnC,SAAS,oBAAoB,SAEjB;AACjB,QAAM,cAAc,SAAS,eAAe;AAC5C,QAAM,UAAe,CAAC,KAAc,KAAe,SAAuB;AACxE,UAAM,cAAc,OAAO,IAAI,QAAQ,cAAc,KAAK,EAAE;AAC5D,QACE,IAAI,WAAW,UACf,YAAY,WAAW,qBAAqB,GAC5C;AACA,YAAM,SAAS,OAAO,EAAC,SAAS,IAAI,QAAO,CAAC;AAG5C,YAAM,SAAwC,CAAC;AAC/C,YAAM,QAAyC,CAAC;AAGhD,aAAO,GAAG,SAAS,CAAC,WAAmB,QAAa;AAClD,eAAO,SAAS,IAAI;AAAA,MACtB,CAAC;AAGD,aAAO;AAAA,QACL;AAAA,QACA,CACE,WACA,MACA,SAKG;AACH,gBAAM,EAAC,UAAU,UAAU,UAAU,SAAQ,IAAI;AACjD,gBAAM,aAA2B,CAAC;AAClC,cAAI,iBAAiB;AAErB,eAAK,GAAG,QAAQ,CAAC,UAAsB;AACrC,8BAAkB,MAAM;AAExB,gBAAI,iBAAiB,aAAa;AAEhC,sBAAQ,MAAM,gCAAgC,SAAS,GAAG;AAC1D,mBAAK,mBAAmB,MAAM;AAE9B,mBAAK,OAAO;AAAA,YACd,OAAO;AACL,yBAAW,KAAK,KAAK;AAAA,YACvB;AAAA,UACF,CAAC;AAED,eAAK,GAAG,OAAO,MAAM;AACnB,gBAAI,kBAAkB,aAAa;AACjC,oBAAM,SAAS,OAAO,OAAO,UAAU;AAEvC,oBAAM,SAAS,IAAI;AAAA,gBACjB;AAAA,gBACA;AAAA,gBACA,cAAc;AAAA,gBACd;AAAA,gBACA;AAAA,cACF;AAAA,YACF;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAGA,aAAO,GAAG,UAAU,MAAM;AACxB,YAAI,OAAO;AACX,YAAI,QAAQ;AACZ,aAAK;AAAA,MACP,CAAC;AAKD,UAAI,IAAI,SAAS;AACf,eAAO,IAAI,IAAI,OAAO;AAAA,MACxB,OAAO;AACL,YAAI,KAAK,MAAM;AAAA,MACjB;AAAA,IACF,OAAO;AACL,WAAK;AAAA,IACP;AAAA,EACF;AACA,SAAO;AACT;;;AClGO,IAAM,iBAAiB;AAC9B,IAAI,sCAAsC;AAG1C,IAAM,kBAAkB,KAAK,KAAK,KAAK,IAAI;AAepC,SAAS,kBAAkB,SAAoC;AACpE,QAAM,SAAS,SAAS,UAAU;AAClC,SAAO,CAAC,KAAc,KAAe,SAAuB;AAC1D,UAAM,cAAc,OAAO,IAAI,cAAc,cAAc,KAAK,EAAE;AAClE,UAAM,UAAU,QAAQ,gBAAgB,WAAW;AACnD,QAAI,UAAU;AACd,QAAI,UAAU;AACd,QAAI,cAAc,CAAC,uBAA4C;AAC7D,UAAI,CAAC,QAAQ,YAAY;AACvB;AAAA,MACF;AAEA,YAAM,6BAA6B;AAAA,QACjC,IAAI,YAAY,QAAQ;AAAA,MAC1B;AACA,UAAI,CAAC,8BAA8B,CAAC,qCAAqC;AACvE,gBAAQ;AAAA,UACN;AAAA,QACF;AACA,8CAAsC;AAAA,MACxC;AAGA,YAAM,eAAe,QAAQ,QAAQ,IAAI,aAAa,aAAa;AACnE,YAAMA,eAAc,QAAQ,SAAS;AACrC,UAAI,WAAW,oBAAoB;AACnC,UAAI,CAAC,UAAU;AAKb,mBAAW,eAAe,SAAS;AAAA,MACrC;AACA,UAAI,OAAO,gBAAgBA,cAAa;AAAA,QACtC;AAAA,QACA,UAAU;AAAA,QACV,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR;AAAA,MACF,CAAC;AAAA,IACH;AACA,QAAI,MAAM,IAAI,aAAa,MAAM;AAC/B,UAAI,YAAY;AAAA,IAClB,CAAC;AACD,SAAK;AAAA,EACP;AACF;AAEO,IAAM,UAAN,MAAM,SAAQ;AAAA,EACX,OAA+B,CAAC;AAAA,EACxC,aAAa;AAAA,EAEb,YAAY,MAA+B;AACzC,SAAK,OAAO,QAAQ,CAAC;AAAA,EACvB;AAAA,EAEA,OAAO,gBAAgB,aAAqB;AAC1C,UAAM,OAA+B,CAAC;AACtC,QAAI,YAAY,WAAW,MAAM,GAAG;AAClC,UAAI;AACF,cAAM,aAAa,YAAY,MAAM,CAAC;AACtC,cAAM,SAAS,IAAI,gBAAgB,aAAa,UAAU,CAAC;AAC3D,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAAG;AAC3C,eAAK,GAAG,IAAI;AAAA,QACd;AAAA,MACF,SAAS,KAAK;AACZ,gBAAQ,KAAK,mCAAmC,GAAG;AACnD,eAAO,IAAI,SAAQ;AAAA,MACrB;AAAA,IACF;AACA,WAAO,IAAI,SAAQ,IAAI;AAAA,EACzB;AAAA,EAEA,QAAQ,KAA4B;AAClC,WAAO,KAAK,KAAK,GAAG,KAAK;AAAA,EAC3B;AAAA,EAEA,QAAQ,KAAa,OAAe;AAClC,SAAK,KAAK,GAAG,IAAI;AACjB,SAAK,aAAa;AAAA,EACpB;AAAA,EAEA,WAAW,KAAa;AACtB,WAAO,KAAK,KAAK,GAAG;AACpB,SAAK,aAAa;AAAA,EACpB;AAAA,EAEA,WAAmB;AACjB,UAAM,SAAS,IAAI,gBAAgB,KAAK,IAAI;AAC5C,WAAO,OAAO,aAAa,OAAO,SAAS,CAAC,CAAC;AAAA,EAC/C;AACF;AAEA,SAAS,aAAa,KAAqB;AACzC,SAAO,OAAO,KAAK,KAAK,OAAO,EAAE,SAAS,QAAQ;AACpD;AAEA,SAAS,aAAa,KAAqB;AACzC,SAAO,OAAO,KAAK,KAAK,QAAQ,EAAE,SAAS,OAAO;AACpD;",
+  "names": ["cookieValue"]
+}

package/dist/chunk-WX62JK5E.js

@@ -0,0 +1,81 @@
+// src/core/security.ts
+function getSecurityConfig(rootConfig) {
+  const userConfig = rootConfig.server?.security || {};
+  const securityConfig = {};
+  if (isTrueOrUndefined(userConfig.contentSecurityPolicy)) {
+    securityConfig.contentSecurityPolicy = {
+      directives: {
+        "base-uri": ["'none'"],
+        "object-src": ["'none'"],
+        // NOTE: nonce is automatically added to this list.
+        "script-src": [
+          "'unsafe-inline'",
+          "'unsafe-eval'",
+          "'strict-dynamic' https: http:"
+        ]
+      },
+      reportOnly: true
+    };
+  } else {
+    securityConfig.contentSecurityPolicy = userConfig.contentSecurityPolicy;
+  }
+  if (isTrueOrUndefined(userConfig.xFrameOptions)) {
+    securityConfig.xFrameOptions = "SAMEORIGIN";
+  } else {
+    securityConfig.xFrameOptions = userConfig.xFrameOptions;
+  }
+  securityConfig.strictTransportSecurity = userConfig.strictTransportSecurity ?? true;
+  securityConfig.xContentTypeOptions = userConfig.xContentTypeOptions ?? true;
+  securityConfig.xXssProtection = userConfig.xXssProtection ?? true;
+  return securityConfig;
+}
+function setSecurityHeaders(res, options) {
+  const securityConfig = options.securityConfig;
+  const contentSecurityPolicy = securityConfig.contentSecurityPolicy;
+  if (typeof contentSecurityPolicy === "object") {
+    const directives = { ...contentSecurityPolicy.directives };
+    if (options.nonce) {
+      const scriptSrc = directives["script-src"] || [
+        "'unsafe-inline'",
+        "'unsafe-eval'",
+        "'strict-dynamic' https: http:"
+      ];
+      const scriptSrcWithNonce = [...scriptSrc, `'nonce-${options.nonce}'`];
+      directives["script-src"] = scriptSrcWithNonce;
+    }
+    const headerSegments = [];
+    Object.entries(directives).forEach(([key, values]) => {
+      headerSegments.push([key, ...values].join(" "));
+    });
+    const csp = headerSegments.join("; ");
+    if (contentSecurityPolicy.reportOnly === false) {
+      res.setHeader("content-security-policy", csp);
+    } else {
+      res.setHeader("content-security-policy-report-only", csp);
+    }
+  }
+  if (typeof securityConfig.xFrameOptions === "string") {
+    res.setHeader("x-frame-options", securityConfig.xFrameOptions);
+  }
+  if (securityConfig.strictTransportSecurity) {
+    res.setHeader(
+      "strict-transport-security",
+      "max-age=63072000; includeSubDomains; preload"
+    );
+  }
+  if (securityConfig.xContentTypeOptions) {
+    res.setHeader("x-content-type-options", "nosniff");
+  }
+  if (securityConfig.xXssProtection) {
+    res.setHeader("x-xss-protection", "1; mode=block");
+  }
+}
+function isTrueOrUndefined(value) {
+  return value === true || value === void 0;
+}
+
+export {
+  getSecurityConfig,
+  setSecurityHeaders
+};
+//# sourceMappingURL=chunk-WX62JK5E.js.map

package/dist/chunk-WX62JK5E.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/core/security.ts"],
+  "sourcesContent": ["import {RootConfig, RootSecurityConfig} from './config.js';\nimport {Response} from './types.js';\n\n/**\n * Returns the `security` config value with default values inserted wherever\n * a user config value is blank or set to `true`.\n */\nexport function getSecurityConfig(\n  rootConfig: RootConfig\n): Required<RootSecurityConfig> {\n  const userConfig: Partial<RootSecurityConfig> =\n    rootConfig.server?.security || {};\n  const securityConfig: Partial<RootSecurityConfig> = {};\n\n  if (isTrueOrUndefined(userConfig.contentSecurityPolicy)) {\n    // CSP default values from:\n    // https://csp.withgoogle.com/docs/strict-csp.html\n    securityConfig.contentSecurityPolicy = {\n      directives: {\n        'base-uri': [\"'none'\"],\n        'object-src': [\"'none'\"],\n        // NOTE: nonce is automatically added to this list.\n        'script-src': [\n          \"'unsafe-inline'\",\n          \"'unsafe-eval'\",\n          \"'strict-dynamic' https: http:\",\n        ],\n      },\n      reportOnly: true,\n    };\n  } else {\n    securityConfig.contentSecurityPolicy = userConfig.contentSecurityPolicy;\n  }\n\n  if (isTrueOrUndefined(userConfig.xFrameOptions)) {\n    securityConfig.xFrameOptions = 'SAMEORIGIN';\n  } else {\n    securityConfig.xFrameOptions = userConfig.xFrameOptions;\n  }\n\n  securityConfig.strictTransportSecurity =\n    userConfig.strictTransportSecurity ?? true;\n  securityConfig.xContentTypeOptions = userConfig.xContentTypeOptions ?? true;\n  securityConfig.xXssProtection = userConfig.xXssProtection ?? true;\n\n  return securityConfig as Required<RootSecurityConfig>;\n}\n\n/**\n * Sets security-related HTTP headers.\n */\nexport function setSecurityHeaders(\n  res: Response,\n  options: {securityConfig: Required<RootSecurityConfig>; nonce?: string}\n) {\n  const securityConfig = options.securityConfig;\n\n  // Content-Security-Policy.\n  const contentSecurityPolicy = securityConfig.contentSecurityPolicy;\n  if (typeof contentSecurityPolicy === 'object') {\n    // Copy the CSP `directives` value since the `script-src` value will be\n    // updated with a `nonce-` value.\n    const directives = {...contentSecurityPolicy.directives};\n    if (options.nonce) {\n      // Create a new array for `script-src` and append a `nonce-` value.\n      const scriptSrc = directives['script-src'] || [\n        \"'unsafe-inline'\",\n        \"'unsafe-eval'\",\n        \"'strict-dynamic' https: http:\",\n      ];\n      const scriptSrcWithNonce = [...scriptSrc, `'nonce-${options.nonce}'`];\n      directives['script-src'] = scriptSrcWithNonce;\n    }\n    const headerSegments: string[] = [];\n    Object.entries(directives).forEach(([key, values]) => {\n      headerSegments.push([key, ...values].join(' '));\n    });\n    const csp = headerSegments.join('; ');\n    if (contentSecurityPolicy.reportOnly === false) {\n      res.setHeader('content-security-policy', csp);\n    } else {\n      res.setHeader('content-security-policy-report-only', csp);\n    }\n  }\n\n  // X-Frame-Options.\n  if (typeof securityConfig.xFrameOptions === 'string') {\n    res.setHeader('x-frame-options', securityConfig.xFrameOptions);\n  }\n\n  // Strict-Transport-Security.\n  if (securityConfig.strictTransportSecurity) {\n    res.setHeader(\n      'strict-transport-security',\n      'max-age=63072000; includeSubDomains; preload'\n    );\n  }\n\n  // X-Content-Type-Options.\n  if (securityConfig.xContentTypeOptions) {\n    res.setHeader('x-content-type-options', 'nosniff');\n  }\n\n  // X-XSS-Protection.\n  if (securityConfig.xXssProtection) {\n    res.setHeader('x-xss-protection', '1; mode=block');\n  }\n}\n\nfunction isTrueOrUndefined(value: any) {\n  return value === true || value === undefined;\n}\n"],
+  "mappings": ";AAOO,SAAS,kBACd,YAC8B;AAC9B,QAAM,aACJ,WAAW,QAAQ,YAAY,CAAC;AAClC,QAAM,iBAA8C,CAAC;AAErD,MAAI,kBAAkB,WAAW,qBAAqB,GAAG;AAGvD,mBAAe,wBAAwB;AAAA,MACrC,YAAY;AAAA,QACV,YAAY,CAAC,QAAQ;AAAA,QACrB,cAAc,CAAC,QAAQ;AAAA;AAAA,QAEvB,cAAc;AAAA,UACZ;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,MACA,YAAY;AAAA,IACd;AAAA,EACF,OAAO;AACL,mBAAe,wBAAwB,WAAW;AAAA,EACpD;AAEA,MAAI,kBAAkB,WAAW,aAAa,GAAG;AAC/C,mBAAe,gBAAgB;AAAA,EACjC,OAAO;AACL,mBAAe,gBAAgB,WAAW;AAAA,EAC5C;AAEA,iBAAe,0BACb,WAAW,2BAA2B;AACxC,iBAAe,sBAAsB,WAAW,uBAAuB;AACvE,iBAAe,iBAAiB,WAAW,kBAAkB;AAE7D,SAAO;AACT;AAKO,SAAS,mBACd,KACA,SACA;AACA,QAAM,iBAAiB,QAAQ;AAG/B,QAAM,wBAAwB,eAAe;AAC7C,MAAI,OAAO,0BAA0B,UAAU;AAG7C,UAAM,aAAa,EAAC,GAAG,sBAAsB,WAAU;AACvD,QAAI,QAAQ,OAAO;AAEjB,YAAM,YAAY,WAAW,YAAY,KAAK;AAAA,QAC5C;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,qBAAqB,CAAC,GAAG,WAAW,UAAU,QAAQ,KAAK,GAAG;AACpE,iBAAW,YAAY,IAAI;AAAA,IAC7B;AACA,UAAM,iBAA2B,CAAC;AAClC,WAAO,QAAQ,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,MAAM,MAAM;AACpD,qBAAe,KAAK,CAAC,KAAK,GAAG,MAAM,EAAE,KAAK,GAAG,CAAC;AAAA,IAChD,CAAC;AACD,UAAM,MAAM,eAAe,KAAK,IAAI;AACpC,QAAI,sBAAsB,eAAe,OAAO;AAC9C,UAAI,UAAU,2BAA2B,GAAG;AAAA,IAC9C,OAAO;AACL,UAAI,UAAU,uCAAuC,GAAG;AAAA,IAC1D;AAAA,EACF;AAGA,MAAI,OAAO,eAAe,kBAAkB,UAAU;AACpD,QAAI,UAAU,mBAAmB,eAAe,aAAa;AAAA,EAC/D;AAGA,MAAI,eAAe,yBAAyB;AAC1C,QAAI;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI,eAAe,qBAAqB;AACtC,QAAI,UAAU,0BAA0B,SAAS;AAAA,EACnD;AAGA,MAAI,eAAe,gBAAgB;AACjC,QAAI,UAAU,oBAAoB,eAAe;AAAA,EACnD;AACF;AAEA,SAAS,kBAAkB,OAAY;AACrC,SAAO,UAAU,QAAQ,UAAU;AACrC;",
+  "names": []
+}