@blinkk/root 3.0.6 → 3.1.1

package/dist/cli.js

@@ -8,11 +8,15 @@ import {
   dev,
   preview,
   start
-} from "./chunk-3EFECH2D.js";
-import "./chunk-7HK6F5RQ.js";
-import "./chunk-6NBKAR5Y.js";
-import "./chunk-7PSEEE6C.js";
+} from "./chunk-E4F6CMO3.js";
+import "./chunk-YU22SAIG.js";
+import "./chunk-I3RCAIW7.js";
+import "./chunk-M3E4RKS7.js";
+import "./chunk-KHO3HMX6.js";
+import "./chunk-3PWR4F2R.js";
 import "./chunk-XSNCF7WU.js";
+import "./chunk-TM6QRBGS.js";
+import "./chunk-WX62JK5E.js";
 export {
   CliRunner,
   build,

package/dist/core/security.d.ts

@@ -0,0 +1,14 @@
+import { RootConfig, RootSecurityConfig } from './config.js';
+import { Response } from './types.js';
+/**
+ * Returns the `security` config value with default values inserted wherever
+ * a user config value is blank or set to `true`.
+ */
+export declare function getSecurityConfig(rootConfig: RootConfig): Required<RootSecurityConfig>;
+/**
+ * Sets security-related HTTP headers.
+ */
+export declare function setSecurityHeaders(res: Response, options: {
+    securityConfig: Required<RootSecurityConfig>;
+    nonce?: string;
+}): void;

package/dist/functions.js

@@ -1,11 +1,15 @@
 import {
   createPreviewServer,
   createProdServer
-} from "./chunk-3EFECH2D.js";
-import "./chunk-7HK6F5RQ.js";
-import "./chunk-6NBKAR5Y.js";
-import "./chunk-7PSEEE6C.js";
+} from "./chunk-E4F6CMO3.js";
+import "./chunk-YU22SAIG.js";
+import "./chunk-I3RCAIW7.js";
+import "./chunk-M3E4RKS7.js";
+import "./chunk-KHO3HMX6.js";
+import "./chunk-3PWR4F2R.js";
 import "./chunk-XSNCF7WU.js";
+import "./chunk-TM6QRBGS.js";
+import "./chunk-WX62JK5E.js";
 
 // src/functions/server.ts
 import path from "node:path";

package/dist/functions.js.map

@@ -2,6 +2,6 @@
   "version": 3,
   "sources": ["../src/functions/server.ts"],
   "sourcesContent": ["import path from 'node:path';\nimport {HttpsOptions, onRequest} from 'firebase-functions/v2/https';\nimport {createPreviewServer, createProdServer} from '../cli/cli.js';\nimport {Server} from '../core/types.js';\n\nexport interface ProdServerOptions {\n  rootDir?: string;\n  mode?: 'preview' | 'production';\n  httpsOptions?: HttpsOptions;\n}\n\n/**\n * Firebase Function that runs a Root.js server running in SSR mode.\n */\nexport function server(options?: ProdServerOptions) {\n  let rootServer: Server;\n  const rootDir = path.resolve(options?.rootDir || process.cwd());\n  return onRequest(options?.httpsOptions || {}, async (req, res) => {\n    if (!rootServer) {\n      if (options?.mode === 'preview') {\n        rootServer = await createPreviewServer({rootDir});\n      } else {\n        rootServer = await createProdServer({rootDir});\n      }\n    }\n    await rootServer(req, res);\n  });\n}\n"],
-  "mappings": ";;;;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAsB,iBAAgB;AAa/B,SAAS,OAAO,SAA6B;AAClD,MAAI;AACJ,QAAM,UAAU,KAAK,QAAQ,SAAS,WAAW,QAAQ,IAAI,CAAC;AAC9D,SAAO,UAAU,SAAS,gBAAgB,CAAC,GAAG,OAAO,KAAK,QAAQ;AAChE,QAAI,CAAC,YAAY;AACf,UAAI,SAAS,SAAS,WAAW;AAC/B,qBAAa,MAAM,oBAAoB,EAAC,QAAO,CAAC;AAAA,MAClD,OAAO;AACL,qBAAa,MAAM,iBAAiB,EAAC,QAAO,CAAC;AAAA,MAC/C;AAAA,IACF;AACA,UAAM,WAAW,KAAK,GAAG;AAAA,EAC3B,CAAC;AACH;",
+  "mappings": ";;;;;;;;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAsB,iBAAgB;AAa/B,SAAS,OAAO,SAA6B;AAClD,MAAI;AACJ,QAAM,UAAU,KAAK,QAAQ,SAAS,WAAW,QAAQ,IAAI,CAAC;AAC9D,SAAO,UAAU,SAAS,gBAAgB,CAAC,GAAG,OAAO,KAAK,QAAQ;AAChE,QAAI,CAAC,YAAY;AACf,UAAI,SAAS,SAAS,WAAW;AAC/B,qBAAa,MAAM,oBAAoB,EAAC,QAAO,CAAC;AAAA,MAClD,OAAO;AACL,qBAAa,MAAM,iBAAiB,EAAC,QAAO,CAAC;AAAA,MAC/C;AAAA,IACF;AACA,UAAM,WAAW,KAAK,GAAG;AAAA,EAC3B,CAAC;AACH;",
   "names": []
 }

package/dist/middleware/common.d.ts

@@ -6,6 +6,24 @@ import { Request, Response, NextFunction } from '../core/types.js';
 export declare function rootProjectMiddleware(options: {
     rootConfig: RootConfig;
 }): (req: Request, _: Response, next: NextFunction) => void;
+/**
+ * Middleware that sets security-related HTTP headers (e.g.
+ * `Strict-Transport-Security`) on all responses using the `server.security`
+ * config in root.config.ts.
+ *
+ * The renderer sets these headers on rendered HTML responses, but responses
+ * that bypass the renderer (e.g. redirects, static files, plugin-served
+ * responses, 404s) would otherwise be served without them. Per
+ * https://hstspreload.org, HSTS preload eligibility requires the HSTS header
+ * on redirects as well.
+ *
+ * NOTE: `Content-Security-Policy` is excluded here since the CSP is
+ * document-specific and depends on a per-request nonce, which is generated by
+ * the renderer at render time.
+ */
+export declare function securityHeadersMiddleware(options: {
+    rootConfig: RootConfig;
+}): (req: Request, res: Response, next: NextFunction) => void;
 /**
  * Middleware that injects HTTP headers from the `server.headers` config in
  * root.config.ts.

package/dist/middleware/compression.d.ts

@@ -0,0 +1,12 @@
+import { Request, Response, NextFunction } from '../core/types.js';
+/**
+ * Response compression middleware shared by the preview and prod servers.
+ *
+ * Uses brotli when the client accepts it (`Accept-Encoding: br`), falling
+ * back to gzip. Brotli quality 4 is used as a balance between compression
+ * ratio and CPU cost for dynamically-rendered responses — it generally
+ * compresses better than gzip's default (level 6) at comparable speed.
+ * Pre-compressed static assets should still be served with higher quality
+ * settings by a CDN or static file server where possible.
+ */
+export declare function compressionMiddleware(): (req: Request, res: Response, next: NextFunction) => void;

package/dist/middleware/middleware.d.ts

@@ -1,3 +1,4 @@
 export * from './common.js';
+export * from './compression.js';
 export * from './multipart.js';
 export * from './session.js';

package/dist/middleware.js

@@ -1,18 +1,23 @@
 import {
   SESSION_COOKIE,
   Session,
+  compressionMiddleware,
   headersMiddleware,
   multipartMiddleware,
   rootProjectMiddleware,
+  securityHeadersMiddleware,
   sessionMiddleware,
   trailingSlashMiddleware
-} from "./chunk-6NBKAR5Y.js";
+} from "./chunk-TM6QRBGS.js";
+import "./chunk-WX62JK5E.js";
 export {
   SESSION_COOKIE,
   Session,
+  compressionMiddleware,
   headersMiddleware,
   multipartMiddleware,
   rootProjectMiddleware,
+  securityHeadersMiddleware,
   sessionMiddleware,
   trailingSlashMiddleware
 };

package/dist/node.js

@@ -1,16 +1,18 @@
 import {
-  bundleRootConfig,
   collectPods,
   createViteServer,
+  invalidatePodCache,
+  viteSsrLoadModule
+} from "./chunk-YU22SAIG.js";
+import {
+  bundleRootConfig,
   flattenPackageDepsFromMonorepo,
   getMonorepoPackageDeps,
-  invalidatePodCache,
   loadBundledConfig,
   loadPackageJson,
   loadRootConfig,
-  loadRootConfigWithDeps,
-  viteSsrLoadModule
-} from "./chunk-7PSEEE6C.js";
+  loadRootConfigWithDeps
+} from "./chunk-KHO3HMX6.js";
 import "./chunk-XSNCF7WU.js";
 export {
   bundleRootConfig,

package/dist/render/render.d.ts

@@ -13,6 +13,10 @@ export declare class Renderer {
     });
     /** Returns a route from the router. */
     getRoute(url: string): [Route | undefined, Record<string, string>];
+    /** Returns all routes that match a given url path. */
+    getRouteMatches(url: string): Array<[Route, Record<string, string>]>;
+    /** Walks all routes registered with the router. */
+    walkRoutes(cb: (urlPathFormat: string, route: Route) => void | Promise<void>): Promise<void>;
     handle(req: Request, res: Response, next: NextFunction): Promise<void>;
     private renderComponent;
     /** SSG renders a route. */
@@ -45,6 +49,17 @@ export declare class Renderer {
      */
     getSitemap(): Promise<Sitemap>;
     private getJsxRenderOptions;
+    /**
+     * Resolves a synchronous JSX render function, using either the
+     * `@blinkk/root/jsx` package or `preact-render-to-string` depending if the
+     * `jsxRenderer` config is set up in `root.config.ts`.
+     *
+     * Resolving the renderer up front (rather than awaiting inside the render
+     * call) allows callers that temporarily swap global state (e.g. the
+     * `preact.options.vnode` nonce hook) to render synchronously without
+     * yielding to the event loop.
+     */
+    private getJsxRenderFn;
     /**
      * Renders JSX via either the `@blinkk/root/jsx` package or
      * `preact-render-to-string` depending if the `jsxRenderer` config is set up
@@ -75,17 +90,8 @@ export declare class Renderer {
      * automatically adds the JS/CSS deps to the page.
      */
     private collectElementDeps;
-    /**
-     * Returns the `security` config value with default values inserted wherever
-     * a user config value is blank or set to `true`.
-     */
-    private getSecurityConfig;
     /**
      * Generates a random string that can be used as the "nonce" value for CSP.
      */
     private generateNonce;
-    /**
-     * Sets security-related HTTP headers.
-     */
-    private setSecurityHeaders;
 }

package/dist/render.js

@@ -7,14 +7,20 @@ import {
   testPathHasParams
 } from "./chunk-KW7KTYGC.js";
 import {
-  RouteTrie,
+  RouteTrie
+} from "./chunk-I3RCAIW7.js";
+import {
   parseTagNames,
   transformHtml
-} from "./chunk-7HK6F5RQ.js";
+} from "./chunk-3PWR4F2R.js";
 import {
   renderJsxToString
 } from "./chunk-X2C2MEJ2.js";
 import "./chunk-3Z5TNZEP.js";
+import {
+  getSecurityConfig,
+  setSecurityHeaders
+} from "./chunk-WX62JK5E.js";
 
 // src/render/render.tsx
 import crypto from "node:crypto";
@@ -13119,6 +13125,14 @@ var Renderer = class {
   getRoute(url) {
     return this.router.get(url);
   }
+  /** Returns all routes that match a given url path. */
+  getRouteMatches(url) {
+    return this.router.matchAll(url);
+  }
+  /** Walks all routes registered with the router. */
+  async walkRoutes(cb) {
+    await this.router.walk(cb);
+  }
   async handle(req, res, next) {
     let url = req.path;
     if (url.includes("%")) {
@@ -13170,6 +13184,7 @@ var Renderer = class {
       scriptDeps: []
     };
     const vdom = /* @__PURE__ */ jsx4(REQUEST_CONTEXT.Provider, { value: ctx, children: /* @__PURE__ */ jsx4(I18N_CONTEXT.Provider, { value: { locale, translations }, children: /* @__PURE__ */ jsx4(HTML_CONTEXT.Provider, { value: htmlContext, children: /* @__PURE__ */ jsx4(Component, { ...props }) }) }) });
+    const renderJsxFn = await this.getJsxRenderFn();
     const preactHook = preactOptions.vnode;
     let mainHtml;
     try {
@@ -13187,11 +13202,9 @@ var Renderer = class {
           preactHook(vnode);
         }
       };
-      mainHtml = await this.renderJsx(vdom);
-      preactOptions.vnode = preactHook;
-    } catch (err) {
+      mainHtml = renderJsxFn(vdom);
+    } finally {
       preactOptions.vnode = preactHook;
-      throw err;
     }
     const jsDeps = /* @__PURE__ */ new Set();
     const cssDeps = /* @__PURE__ */ new Set();
@@ -13321,7 +13334,7 @@ var Renderer = class {
         render404();
         return;
       }
-      const securityConfig = this.getSecurityConfig();
+      const securityConfig = getSecurityConfig(this.rootConfig);
       const cspEnabled = !!securityConfig.contentSecurityPolicy;
       const currentPath = req.path;
       const locale = options2?.locale || route.locale;
@@ -13365,7 +13378,7 @@ var Renderer = class {
       }
       res.status(statusCode);
       res.set({ "Content-Type": "text/html" });
-      this.setSecurityHeaders(res, {
+      setSecurityHeaders(res, {
         securityConfig,
         nonce
       });
@@ -13493,13 +13506,19 @@ var Renderer = class {
     return this.rootConfig.jsxRenderer || {};
   }
   /**
-   * Renders JSX via either the `@blinkk/root/jsx` package or
-   * `preact-render-to-string` depending if the `jsxRenderer` config is set up
-   * in `root.config.ts`.
+   * Resolves a synchronous JSX render function, using either the
+   * `@blinkk/root/jsx` package or `preact-render-to-string` depending if the
+   * `jsxRenderer` config is set up in `root.config.ts`.
+   *
+   * Resolving the renderer up front (rather than awaiting inside the render
+   * call) allows callers that temporarily swap global state (e.g. the
+   * `preact.options.vnode` nonce hook) to render synchronously without
+   * yielding to the event loop.
    */
-  async renderJsx(vnode) {
+  async getJsxRenderFn() {
     if (this.rootConfig.jsxRenderer?.mode) {
-      return renderJsxToString(vnode, this.getJsxRenderOptions());
+      const options = this.getJsxRenderOptions();
+      return (vnode) => renderJsxToString(vnode, options);
     }
     const { renderToString } = await import("preact-render-to-string");
     if (!renderToString) {
@@ -13507,7 +13526,16 @@ var Renderer = class {
         'failed to render jsx. either install preact-render-to-string or add the "jsxRenderer" config to root.config.ts'
       );
     }
-    return renderToString(vnode);
+    return (vnode) => renderToString(vnode);
+  }
+  /**
+   * Renders JSX via either the `@blinkk/root/jsx` package or
+   * `preact-render-to-string` depending if the `jsxRenderer` config is set up
+   * in `root.config.ts`.
+   */
+  async renderJsx(vnode) {
+    const render = await this.getJsxRenderFn();
+    return render(vnode);
   }
   getConfiguredStyleEntries() {
     const styleEntries = this.rootConfig.styles?.entries || [];
@@ -13679,94 +13707,13 @@ ${content}`;
     );
     return { jsDeps, cssDeps };
   }
-  /**
-   * Returns the `security` config value with default values inserted wherever
-   * a user config value is blank or set to `true`.
-   */
-  getSecurityConfig() {
-    const userConfig = this.rootConfig.server?.security || {};
-    const securityConfig = {};
-    if (isTrueOrUndefined(userConfig.contentSecurityPolicy)) {
-      securityConfig.contentSecurityPolicy = {
-        directives: {
-          "base-uri": ["'none'"],
-          "object-src": ["'none'"],
-          // NOTE: nonce is automatically added to this list.
-          "script-src": [
-            "'unsafe-inline'",
-            "'unsafe-eval'",
-            "'strict-dynamic' https: http:"
-          ]
-        },
-        reportOnly: true
-      };
-    } else {
-      securityConfig.contentSecurityPolicy = userConfig.contentSecurityPolicy;
-    }
-    if (isTrueOrUndefined(userConfig.xFrameOptions)) {
-      securityConfig.xFrameOptions = "SAMEORIGIN";
-    } else {
-      securityConfig.xFrameOptions = userConfig.xFrameOptions;
-    }
-    securityConfig.strictTransportSecurity = userConfig.strictTransportSecurity ?? true;
-    securityConfig.xContentTypeOptions = userConfig.xContentTypeOptions ?? true;
-    securityConfig.xXssProtection = userConfig.xXssProtection ?? true;
-    return securityConfig;
-  }
   /**
    * Generates a random string that can be used as the "nonce" value for CSP.
    */
   generateNonce() {
     return crypto.randomBytes(16).toString("base64");
   }
-  /**
-   * Sets security-related HTTP headers.
-   */
-  setSecurityHeaders(res, options) {
-    const securityConfig = options.securityConfig;
-    const contentSecurityPolicy = securityConfig.contentSecurityPolicy;
-    if (typeof contentSecurityPolicy === "object") {
-      const directives = { ...contentSecurityPolicy.directives };
-      if (options.nonce) {
-        const scriptSrc = directives["script-src"] || [
-          "'unsafe-inline'",
-          "'unsafe-eval'",
-          "'strict-dynamic' https: http:"
-        ];
-        const scriptSrcWithNonce = [...scriptSrc, `'nonce-${options.nonce}'`];
-        directives["script-src"] = scriptSrcWithNonce;
-      }
-      const headerSegments = [];
-      Object.entries(directives).forEach(([key, values]) => {
-        headerSegments.push([key, ...values].join(" "));
-      });
-      const csp = headerSegments.join("; ");
-      if (contentSecurityPolicy.reportOnly === false) {
-        res.setHeader("content-security-policy", csp);
-      } else {
-        res.setHeader("content-security-policy-report-only", csp);
-      }
-    }
-    if (typeof securityConfig.xFrameOptions === "string") {
-      res.setHeader("x-frame-options", securityConfig.xFrameOptions);
-    }
-    if (securityConfig.strictTransportSecurity) {
-      res.setHeader(
-        "strict-transport-security",
-        "max-age=63072000; includeSubdomains; preload"
-      );
-    }
-    if (securityConfig.xContentTypeOptions) {
-      res.setHeader("x-content-type-options", "nosniff");
-    }
-    if (securityConfig.xXssProtection) {
-      res.setHeader("x-xss-protection", "1; mode=block");
-    }
-  }
 };
-function isTrueOrUndefined(value) {
-  return value === true || value === void 0;
-}
 function sortLocales(a, b) {
   if (a === "x-default") {
     return -1;