@c9up/aurora 0.1.29 → 0.1.31

package/dist/AuroraProvider.d.ts

@@ -28,6 +28,7 @@ export interface AuroraAppContext {
     config: AuroraConfigStore;
 }
 export default class AuroraProvider {
+    #private;
     protected app: AuroraAppContext;
     constructor(app: AuroraAppContext);
     register(): void;
@@ -35,19 +36,5 @@ export default class AuroraProvider {
     start(): Promise<void>;
     ready(): Promise<void>;
     shutdown(): Promise<void>;
-    /**
-     * Resolve the user-supplied config:
-     *   - relative `pages.root` (e.g. `./resources/pages`) is joined to
-     *     the project's `appRoot` URL — same convention `modules.path`
-     *     uses;
-     *   - absolute paths are passed through;
-     *   - missing config falls back to `<appRoot>/resources/pages`.
-     *
-     * `appRoot` is fetched from the container if the host registered
-     * one (Ream does, since v0.x — see Ignitor); other hosts get the
-     * `process.cwd()` fallback.
-     */
-    private resolveConfig;
-    private readAppRoot;
 }
 export {};

package/dist/AuroraProvider.js

@@ -29,7 +29,7 @@ export default class AuroraProvider {
     register() {
         this.app.container.singleton(AuroraManager, async () => {
             const raw = this.app.config.get("aurora");
-            const config = await this.resolveConfig(raw);
+            const config = await this.#resolveConfig(raw);
             const manager = new AuroraManager(config);
             setAurora(manager);
             return manager;
@@ -89,8 +89,8 @@ export default class AuroraProvider {
      * one (Ream does, since v0.x — see Ignitor); other hosts get the
      * `process.cwd()` fallback.
      */
-    async resolveConfig(raw) {
-        const appRoot = await this.readAppRoot();
+    async #resolveConfig(raw) {
+        const appRoot = await this.#readAppRoot();
         const userRoot = raw?.pages?.root;
         const root = typeof userRoot === "string" && userRoot.length > 0
             ? isAbsolute(userRoot)
@@ -102,7 +102,7 @@ export default class AuroraProvider {
             pages: { ...(raw?.pages ?? {}), root },
         };
     }
-    async readAppRoot() {
+    async #readAppRoot() {
         try {
             const raw = await this.app.container.resolve("appRoot");
             if (raw instanceof URL)

package/dist/Pages.d.ts

@@ -45,10 +45,10 @@ export interface PagesConfig {
  * call `register()` to short-circuit the disk lookup.
  */
 export declare class Pages {
+    #private;
     readonly root: string;
     readonly urlPrefix: string;
     readonly extension: string;
-    private readonly registry;
     constructor(config: PagesConfig);
     /**
      * Pre-register a page factory under `name`, bypassing the disk

package/dist/Pages.js

@@ -26,7 +26,7 @@ export class Pages {
     root;
     urlPrefix;
     extension;
-    registry = new Map();
+    #registry = new Map();
     constructor(config) {
         // Normalize the root ONCE so the `startsWith(root + sep)` containment
         // check below compares like-for-like against the resolved page path.
@@ -47,7 +47,7 @@ export class Pages {
      * back as `unknown` — the renderer JSON.stringifies them either way.
      */
     register(name, factory) {
-        this.registry.set(name, factory);
+        this.#registry.set(name, factory);
     }
     /**
      * Resolve a page name to its factory function. Throws when the
@@ -58,7 +58,7 @@ export class Pages {
      * under `root` — defense in depth against URL-decoding tricks.
      */
     async resolve(name) {
-        const preset = this.registry.get(name);
+        const preset = this.#registry.get(name);
         if (preset)
             return preset;
         assertSafeName(name);

package/dist/server/renderPage.d.ts

@@ -31,12 +31,34 @@ export interface RenderResponse {
     status(code: number): RenderResponse;
     header(name: string, value: string): RenderResponse;
     send(body: string): void;
+    /**
+     * Per-request CSP nonce, when a security layer set one.
+     *
+     * `@c9up/blackhole` seeds it on the response (the AdonisJS idiom,
+     * `response.nonce`) whenever the policy uses `@nonce`. Optional, and read
+     * structurally: aurora stays free of any dependency on it, and a host that
+     * sets no policy renders exactly as before.
+     */
+    nonce?: string;
 }
 export interface RenderHttpContext {
     request: unknown;
     response: RenderResponse;
+    /** Per-request bag; blackhole also seeds `cspNonce` here. */
+    store?: {
+        get(key: string): unknown;
+    };
 }
 export interface RenderPageOptions {
+    /**
+     * CSP nonce for the inline scripts this page emits.
+     *
+     * Normally left unset: it is read from `response.nonce` (what blackhole
+     * seeds) or from the request store. Pass it only when the security layer
+     * puts it somewhere else. It must be the SAME nonce the policy header
+     * names, otherwise the browser blocks the scripts anyway.
+     */
+    nonce?: string;
     /**
      * Importmap entries injected into `<head>`. Defaults to mapping
      * `@c9up/aurora` to `/__assets/aurora/index.js`. Override to point

package/dist/server/renderPage.js

@@ -73,17 +73,23 @@ async function renderPageInScope(ctx, pages, name, props, options) {
     const rootClass = options.rootClass;
     const lang = options.lang ?? "en";
     const pageUrl = pages.urlFor(name);
+    // A CSP that names a nonce blocks every inline script that lacks it, and the
+    // page then renders but never hydrates — the HTML is byte-identical, so only
+    // a real browser shows the failure. Reading it here is what lets a default
+    // policy stay strict instead of being turned off.
+    const nonce = resolveNonce(ctx, options.nonce);
+    const nonceAttr = nonce === undefined ? "" : ` nonce="${escapeAttr(nonce)}"`;
     const doc = `<!doctype html>
 <html lang="${escapeAttr(lang)}">
 <head>
 <meta charset="utf-8" />
 <meta name="viewport" content="width=device-width,initial-scale=1" />
-<script type="importmap">${escapeJsonForScript({ imports: importmap })}</script>
+<script${nonceAttr} type="importmap">${escapeJsonForScript({ imports: importmap })}</script>
 ${options.headExtra ?? ""}
 </head>
 <body>
 <${rootTag}${rootAttrs(rootId, rootClass)}>${body}</${rootTag}>
-<script id="aurora-page-data" type="application/json">${escapeJsonForScript({
+<script${nonceAttr} id="aurora-page-data" type="application/json">${escapeJsonForScript({
         name,
         props: pageProps,
         url: pageUrl,
@@ -91,7 +97,7 @@ ${options.headExtra ?? ""}
         routes: options.routes ?? {},
         version: options.assetsVersion ?? null,
     })}</script>
-<script type="module">
+<script${nonceAttr} type="module">
 import { hydrate, setRouteManifest } from '@c9up/aurora'
 import Page from ${JSON.stringify(pageUrl)}
 const data = JSON.parse(document.getElementById('aurora-page-data').textContent)
@@ -103,6 +109,26 @@ hydrate(document.getElementById(data.rootId), () => Page(data.props))
     ctx.response.header("content-type", "text/html; charset=utf-8");
     ctx.response.send(doc);
 }
+/**
+ * The nonce to stamp on inline scripts, or `undefined` when there is none.
+ *
+ * Explicit option first, then `response.nonce` (what AdonisJS exposes and what
+ * blackhole seeds), then the `cspNonce` a middleware may have left in the
+ * per-request store. Never generated here: a nonce aurora invented would not
+ * appear in the policy header, so it would block the page rather than unblock
+ * it.
+ */
+function resolveNonce(ctx, explicit) {
+    if (typeof explicit === "string" && explicit.length > 0)
+        return explicit;
+    const fromResponse = ctx.response.nonce;
+    if (typeof fromResponse === "string" && fromResponse.length > 0)
+        return fromResponse;
+    const fromStore = ctx.store?.get("cspNonce");
+    if (typeof fromStore === "string" && fromStore.length > 0)
+        return fromStore;
+    return undefined;
+}
 async function resolveSharedProps(ctx, shared) {
     if (!shared)
         return {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c9up/aurora",
-  "version": "0.1.29",
+  "version": "0.1.31",
   "description": "Aurora — reactive UI runtime for the Ream framework. Tagged-template DOM, signal-based state, isomorphic SSR + hydration, zero build step.",
   "license": "MIT",
   "type": "module",

package/src/AuroraProvider.ts

@@ -54,7 +54,7 @@ export default class AuroraProvider {
 	register(): void {
 		this.app.container.singleton(AuroraManager, async () => {
 			const raw = this.app.config.get<AuroraManagerConfig>("aurora");
-			const config = await this.resolveConfig(raw);
+			const config = await this.#resolveConfig(raw);
 			const manager = new AuroraManager(config);
 			setAurora(manager);
 			return manager;
@@ -127,10 +127,10 @@ export default class AuroraProvider {
 	 * one (Ream does, since v0.x — see Ignitor); other hosts get the
 	 * `process.cwd()` fallback.
 	 */
-	private async resolveConfig(
+	async #resolveConfig(
 		raw: AuroraManagerConfig | undefined,
 	): Promise<AuroraManagerConfig> {
-		const appRoot = await this.readAppRoot();
+		const appRoot = await this.#readAppRoot();
 		const userRoot = raw?.pages?.root;
 		const root =
 			typeof userRoot === "string" && userRoot.length > 0
@@ -144,7 +144,7 @@ export default class AuroraProvider {
 		};
 	}
 
-	private async readAppRoot(): Promise<string> {
+	async #readAppRoot(): Promise<string> {
 		try {
 			const raw = await this.app.container.resolve<unknown>("appRoot");
 			if (raw instanceof URL) return fileURLToPath(raw);

package/src/Pages.ts

@@ -59,7 +59,7 @@ export class Pages {
 	readonly urlPrefix: string;
 	readonly extension: string;
 
-	private readonly registry = new Map<string, PageFactory>();
+	readonly #registry = new Map<string, PageFactory>();
 
 	constructor(config: PagesConfig) {
 		// Normalize the root ONCE so the `startsWith(root + sep)` containment
@@ -82,7 +82,7 @@ export class Pages {
 	 * back as `unknown` — the renderer JSON.stringifies them either way.
 	 */
 	register<P>(name: string, factory: PageFactory<P>): void {
-		this.registry.set(name, factory as PageFactory);
+		this.#registry.set(name, factory as PageFactory);
 	}
 
 	/**
@@ -94,7 +94,7 @@ export class Pages {
 	 * under `root` — defense in depth against URL-decoding tricks.
 	 */
 	async resolve(name: string): Promise<PageFactory> {
-		const preset = this.registry.get(name);
+		const preset = this.#registry.get(name);
 		if (preset) return preset;
 
 		assertSafeName(name);

package/src/server/renderPage.ts

@@ -37,13 +37,33 @@ export interface RenderResponse {
 	status(code: number): RenderResponse;
 	header(name: string, value: string): RenderResponse;
 	send(body: string): void;
+	/**
+	 * Per-request CSP nonce, when a security layer set one.
+	 *
+	 * `@c9up/blackhole` seeds it on the response (the AdonisJS idiom,
+	 * `response.nonce`) whenever the policy uses `@nonce`. Optional, and read
+	 * structurally: aurora stays free of any dependency on it, and a host that
+	 * sets no policy renders exactly as before.
+	 */
+	nonce?: string;
 }
 export interface RenderHttpContext {
 	request: unknown;
 	response: RenderResponse;
+	/** Per-request bag; blackhole also seeds `cspNonce` here. */
+	store?: { get(key: string): unknown };
 }
 
 export interface RenderPageOptions {
+	/**
+	 * CSP nonce for the inline scripts this page emits.
+	 *
+	 * Normally left unset: it is read from `response.nonce` (what blackhole
+	 * seeds) or from the request store. Pass it only when the security layer
+	 * puts it somewhere else. It must be the SAME nonce the policy header
+	 * names, otherwise the browser blocks the scripts anyway.
+	 */
+	nonce?: string;
 	/**
 	 * Importmap entries injected into `<head>`. Defaults to mapping
 	 * `@c9up/aurora` to `/__assets/aurora/index.js`. Override to point
@@ -203,25 +223,34 @@ async function renderPageInScope<P>(
 	const lang = options.lang ?? "en";
 	const pageUrl = pages.urlFor(name);
 
+	// A CSP that names a nonce blocks every inline script that lacks it, and the
+	// page then renders but never hydrates — the HTML is byte-identical, so only
+	// a real browser shows the failure. Reading it here is what lets a default
+	// policy stay strict instead of being turned off.
+	const nonce = resolveNonce(ctx, options.nonce);
+	const nonceAttr = nonce === undefined ? "" : ` nonce="${escapeAttr(nonce)}"`;
+
 	const doc = `<!doctype html>
 <html lang="${escapeAttr(lang)}">
 <head>
 <meta charset="utf-8" />
 <meta name="viewport" content="width=device-width,initial-scale=1" />
-<script type="importmap">${escapeJsonForScript({ imports: importmap })}</script>
+<script${nonceAttr} type="importmap">${escapeJsonForScript({ imports: importmap })}</script>
 ${options.headExtra ?? ""}
 </head>
 <body>
 <${rootTag}${rootAttrs(rootId, rootClass)}>${body}</${rootTag}>
-<script id="aurora-page-data" type="application/json">${escapeJsonForScript({
-		name,
-		props: pageProps,
-		url: pageUrl,
-		rootId,
-		routes: options.routes ?? {},
-		version: options.assetsVersion ?? null,
-	})}</script>
-<script type="module">
+<script${nonceAttr} id="aurora-page-data" type="application/json">${escapeJsonForScript(
+		{
+			name,
+			props: pageProps,
+			url: pageUrl,
+			rootId,
+			routes: options.routes ?? {},
+			version: options.assetsVersion ?? null,
+		},
+	)}</script>
+<script${nonceAttr} type="module">
 import { hydrate, setRouteManifest } from '@c9up/aurora'
 import Page from ${JSON.stringify(pageUrl)}
 const data = JSON.parse(document.getElementById('aurora-page-data').textContent)
@@ -235,6 +264,28 @@ hydrate(document.getElementById(data.rootId), () => Page(data.props))
 	ctx.response.send(doc);
 }
 
+/**
+ * The nonce to stamp on inline scripts, or `undefined` when there is none.
+ *
+ * Explicit option first, then `response.nonce` (what AdonisJS exposes and what
+ * blackhole seeds), then the `cspNonce` a middleware may have left in the
+ * per-request store. Never generated here: a nonce aurora invented would not
+ * appear in the policy header, so it would block the page rather than unblock
+ * it.
+ */
+function resolveNonce(
+	ctx: RenderHttpContext,
+	explicit?: string,
+): string | undefined {
+	if (typeof explicit === "string" && explicit.length > 0) return explicit;
+	const fromResponse = ctx.response.nonce;
+	if (typeof fromResponse === "string" && fromResponse.length > 0)
+		return fromResponse;
+	const fromStore = ctx.store?.get("cspNonce");
+	if (typeof fromStore === "string" && fromStore.length > 0) return fromStore;
+	return undefined;
+}
+
 async function resolveSharedProps(
 	ctx: RenderHttpContext,
 	shared: RenderPageOptions["shared"],