@blinkk/root 4.1.1 → 4.1.2

package/dist/render/render.d.ts

@@ -19,6 +19,19 @@ export declare class Renderer {
     walkRoutes(cb: (urlPathFormat: string, route: Route) => void | Promise<void>): Promise<void>;
     handle(req: Request, res: Response, next: NextFunction): Promise<void>;
     private renderComponent;
+    /**
+     * Runs a synchronous render function with a hook installed that auto-injects
+     * the CSP nonce into `<script>`, `<style>` and `<link rel="stylesheet">`
+     * vnodes.
+     *
+     * NOTE: `preactOptions.vnode` is a global, so the hook must be installed and
+     * restored within a single synchronous block. Awaiting inside the swapped
+     * window allows concurrent renders to interleave, leaking a stale hook (and
+     * its nonce) into other requests.
+     *
+     * https://preactjs.com/guide/v10/options/
+     */
+    private withNonceHooks;
     /** SSG renders a route. */
     renderRoute(route: Route, options: {
         routeParams: Record<string, string>;

package/dist/render.js

@@ -13213,42 +13213,10 @@ var Renderer = class {
       scriptDeps: [],
       styleDeps: []
     };
-    const vdom = /* @__PURE__ */ jsx4(ASSET_MAP_CONTEXT.Provider, { value: this.assetMap, children: /* @__PURE__ */ jsx4(REQUEST_CONTEXT.Provider, { value: ctx, children: /* @__PURE__ */ jsx4(I18N_CONTEXT.Provider, { value: { locale, translations }, children: /* @__PURE__ */ jsx4(HTML_CONTEXT.Provider, { value: htmlContext, children: /* @__PURE__ */ jsx4(Component, { ...props }) }) }) }) });
+    const withProviders = (children) => /* @__PURE__ */ jsx4(ASSET_MAP_CONTEXT.Provider, { value: this.assetMap, children: /* @__PURE__ */ jsx4(REQUEST_CONTEXT.Provider, { value: ctx, children: /* @__PURE__ */ jsx4(I18N_CONTEXT.Provider, { value: { locale, translations }, children: /* @__PURE__ */ jsx4(HTML_CONTEXT.Provider, { value: htmlContext, children }) }) }) });
+    const vdom = withProviders(/* @__PURE__ */ jsx4(Component, { ...props }));
     const renderJsxFn = await this.getJsxRenderFn({ mode: options2.renderMode });
-    const injectNonce = (vnode) => {
-      if (!vnode) {
-        return;
-      }
-      if (vnode.type === "script" || vnode.type === "style") {
-        vnode.props.nonce = nonce;
-      }
-      if (vnode.type === "link" && vnode.props.rel === "stylesheet") {
-        vnode.props.nonce = nonce;
-      }
-    };
-    const preactHook = preactOptions.vnode;
-    const rootJsxHook = options.vnode;
-    let mainHtml;
-    try {
-      preactOptions.vnode = (vnode) => {
-        injectNonce(vnode);
-        if (preactHook) {
-          preactHook(vnode);
-        }
-      };
-      if (options !== preactOptions) {
-        options.vnode = (vnode) => {
-          injectNonce(vnode);
-          if (rootJsxHook) {
-            rootJsxHook(vnode);
-          }
-        };
-      }
-      mainHtml = renderJsxFn(vdom);
-    } finally {
-      preactOptions.vnode = preactHook;
-      options.vnode = rootJsxHook;
-    }
+    const mainHtml = this.withNonceHooks(nonce, () => renderJsxFn(vdom));
     const jsDeps = /* @__PURE__ */ new Set();
     const cssDeps = /* @__PURE__ */ new Set();
     const preloadDeps = this.rootConfig.modulePreload !== false ? /* @__PURE__ */ new Set() : null;
@@ -13301,16 +13269,66 @@ var Renderer = class {
       htmlAttrs: htmlContext.htmlAttrs,
       headAttrs: htmlContext.headAttrs,
       bodyAttrs: htmlContext.bodyAttrs,
+      // Components passed as `<Head>` children are only rendered here, so they
+      // need the same context providers and nonce hooks as the main render.
       headComponents: [
-        ...htmlContext.headComponents,
+        withProviders(htmlContext.headComponents),
         ...styleTags,
         ...preloadTags,
         ...scriptTags
       ],
-      renderMode: options2.renderMode
+      renderMode: options2.renderMode,
+      nonce
     });
     return { html };
   }
+  /**
+   * Runs a synchronous render function with a hook installed that auto-injects
+   * the CSP nonce into `<script>`, `<style>` and `<link rel="stylesheet">`
+   * vnodes.
+   *
+   * NOTE: `preactOptions.vnode` is a global, so the hook must be installed and
+   * restored within a single synchronous block. Awaiting inside the swapped
+   * window allows concurrent renders to interleave, leaking a stale hook (and
+   * its nonce) into other requests.
+   *
+   * https://preactjs.com/guide/v10/options/
+   */
+  withNonceHooks(nonce, fn) {
+    const injectNonce = (vnode) => {
+      if (!vnode) {
+        return;
+      }
+      if (vnode.type === "script" || vnode.type === "style") {
+        vnode.props.nonce = nonce;
+      }
+      if (vnode.type === "link" && vnode.props.rel === "stylesheet") {
+        vnode.props.nonce = nonce;
+      }
+    };
+    const preactHook = preactOptions.vnode;
+    const rootJsxHook = options.vnode;
+    try {
+      preactOptions.vnode = (vnode) => {
+        injectNonce(vnode);
+        if (preactHook) {
+          preactHook(vnode);
+        }
+      };
+      if (options !== preactOptions) {
+        options.vnode = (vnode) => {
+          injectNonce(vnode);
+          if (rootJsxHook) {
+            rootJsxHook(vnode);
+          }
+        };
+      }
+      return fn();
+    } finally {
+      preactOptions.vnode = preactHook;
+      options.vnode = rootJsxHook;
+    }
+  }
   /** SSG renders a route. */
   async renderRoute(route, options2) {
     const routeParams = options2.routeParams;
@@ -13618,7 +13636,9 @@ var Renderer = class {
         }
       )
     ] });
-    const content = await this.renderJsx(page, { mode: options2?.renderMode });
+    const renderJsxFn = await this.getJsxRenderFn({ mode: options2?.renderMode });
+    const nonce = options2?.nonce;
+    const content = nonce ? this.withNonceHooks(nonce, () => renderJsxFn(page)) : renderJsxFn(page);
     return `<!doctype html>
 ${content}`;
   }