@docubook/flame 1.6.2 → 1.6.4

package/.docu/lib/build.deno.js

@@ -1,9 +1,9 @@
 import {
   runBuildCli
-} from "./chunk-OREEWUOV.js";
+} from "./chunk-RH3WF75F.js";
 import "./chunk-WSJC3PRH.js";
 import "./chunk-EOK6KATZ.js";
-import "./chunk-TU7G4RJV.js";
+import "./chunk-QYKLXNNB.js";
 import "./chunk-4IQXHHPF.js";
 
 // .docu/node/build.deno.ts

package/.docu/lib/{build.impl-CFTUVIX7.js → build.impl-ZLUUXLJ2.js}

@@ -1,10 +1,10 @@
 import {
   runBuild,
   runBuildCli
-} from "./chunk-OREEWUOV.js";
+} from "./chunk-RH3WF75F.js";
 import "./chunk-WSJC3PRH.js";
 import "./chunk-EOK6KATZ.js";
-import "./chunk-TU7G4RJV.js";
+import "./chunk-QYKLXNNB.js";
 import "./chunk-4IQXHHPF.js";
 export {
   runBuild,

package/.docu/lib/build.node.js

@@ -1,9 +1,9 @@
 import {
   runBuildCli
-} from "./chunk-OREEWUOV.js";
+} from "./chunk-RH3WF75F.js";
 import "./chunk-WSJC3PRH.js";
 import "./chunk-EOK6KATZ.js";
-import "./chunk-TU7G4RJV.js";
+import "./chunk-QYKLXNNB.js";
 import "./chunk-4IQXHHPF.js";
 
 // .docu/node/build.node.ts

package/.docu/lib/{chunk-77NNQDFX.js → chunk-6JMYQIHO.js}

@@ -27,7 +27,7 @@ import {
 } from "./chunk-EOK6KATZ.js";
 import {
   logger
-} from "./chunk-TU7G4RJV.js";
+} from "./chunk-QYKLXNNB.js";
 import {
   DIST_DIR,
   DOCS_DIR,
@@ -59,7 +59,7 @@ function createHtmlResponse(title, description, body, status, state, depth = 0)
     themeCss: state.inlineThemeCss,
     depth
   });
-  return htmlResponse(html, nonce, status, process.env.NODE_ENV !== "production");
+  return htmlResponse(html, nonce, status, true);
 }
 async function getDocsForSlug(slug, state) {
   if (!isSlugSafe(slug, DOCS_DIR)) return null;
@@ -161,7 +161,7 @@ async function renderDocsServerPage(doc, slug, pathname, state) {
       depth
     });
     html = await state.builder.runTransformHtmlChain(html, ctx);
-    return htmlResponse(html, nonce, 200, process.env.NODE_ENV !== "production");
+    return htmlResponse(html, nonce, 200, true);
   }
   return createHtmlResponse(title, description, body, 200, state, depth);
 }

package/.docu/lib/{chunk-KHRQUSNL.js → chunk-NN5T3Z5R.js}

@@ -24,6 +24,7 @@ var NGINX_CONF = `server {
   add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
   add_header Referrer-Policy "strict-origin-when-cross-origin" always;
   add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+  add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' https: data:; font-src 'self' data:; connect-src 'self' https:; frame-src https://www.youtube-nocookie.com; frame-ancestors 'none'" always;
 
   location /assets/ {
     expires 1y;
@@ -33,6 +34,7 @@ var NGINX_CONF = `server {
     add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' https: data:; font-src 'self' data:; connect-src 'self' https:; frame-src https://www.youtube-nocookie.com; frame-ancestors 'none'" always;
   }
 
   location /docs/assets/ {
@@ -43,6 +45,7 @@ var NGINX_CONF = `server {
     add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' https: data:; font-src 'self' data:; connect-src 'self' https:; frame-src https://www.youtube-nocookie.com; frame-ancestors 'none'" always;
   }
 
   location / {
@@ -104,7 +107,10 @@ function detectPkgManager(dir) {
 var HEADERS_FILE = `/*
   X-Frame-Options: DENY
   X-Content-Type-Options: nosniff
+  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
   Referrer-Policy: strict-origin-when-cross-origin
+  Permissions-Policy: camera=(), microphone=(), geolocation=()
+  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' https: data:; font-src 'self' data:; connect-src 'self' https:; frame-src https://www.youtube-nocookie.com; frame-ancestors 'none'
 
 /assets/*
   Cache-Control: public, max-age=31536000, immutable
@@ -127,7 +133,7 @@ async function runBuild() {
     process.env.FLAME_BUILD_SILENT = "1";
     process.env.LOG_LEVEL = "error";
   }
-  const { runBuildCli } = await import("./build.impl-CFTUVIX7.js");
+  const { runBuildCli } = await import("./build.impl-ZLUUXLJ2.js");
   await runBuildCli();
 }
 async function writeDockerFiles() {
@@ -146,7 +152,6 @@ RUN ${pm.runCmd} run build
 FROM nginx:alpine
 COPY --from=builder /app/.docu/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
-USER nginx
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]
 `

package/.docu/lib/{chunk-TU7G4RJV.js → chunk-QYKLXNNB.js}

@@ -5,7 +5,7 @@ import {
 // package.json
 var package_default = {
   name: "@docubook/flame",
-  version: "1.6.2",
+  version: "1.6.4",
   description: "A blazing-fast React + MDX framework powered by Bun, built for modern documentation experiences.",
   type: "module",
   bin: {

package/.docu/lib/{chunk-OREEWUOV.js → chunk-RH3WF75F.js}

@@ -21,7 +21,7 @@ import {
 } from "./chunk-EOK6KATZ.js";
 import {
   logger
-} from "./chunk-TU7G4RJV.js";
+} from "./chunk-QYKLXNNB.js";
 import {
   ASSETS_DIR,
   CACHE_FILE,
@@ -146,7 +146,7 @@ ${msg}`, { cause: err });
   const depth = slug ? slug.split("/").length : 1;
   const favicon = docuConfig.meta?.favicon || "/docs/assets/images/favicon.ico";
   const seo = buildSeoMeta(docuConfig, frontmatter, slug || "");
-  const csp = cspHeader(nonce, process.env.NODE_ENV !== "production");
+  const csp = cspHeader(nonce, true);
   let html = htmlShell({
     title,
     description,
@@ -332,7 +332,8 @@ async function runBuild() {
     body: renderToString(landingPage),
     favicon: landingFavicon,
     seo: landingSeo,
-    csp: cspHeader(landingNonce, process.env.NODE_ENV !== "production"),
+    /** unsafe-eval required by mdx-remote hydration — see above. */
+    csp: cspHeader(landingNonce, true),
     css: assetManifest.css,
     js: assetManifest.js,
     nonce: landingNonce,
@@ -352,7 +353,8 @@ async function runBuild() {
     body: renderToString(notFoundPage),
     favicon: notFoundFavicon,
     headExtra: ['<meta name="robots" content="noindex,follow">'],
-    csp: cspHeader(notFoundNonce, process.env.NODE_ENV !== "production"),
+    /** unsafe-eval required by mdx-remote hydration — see above. */
+    csp: cspHeader(notFoundNonce, true),
     css: assetManifest.css,
     js: assetManifest.js,
     nonce: notFoundNonce,

package/.docu/lib/{chunk-N25ZVCKO.js → chunk-UNRSSV2E.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-EOK6KATZ.js";
 import {
   logger
-} from "./chunk-TU7G4RJV.js";
+} from "./chunk-QYKLXNNB.js";
 import {
   DIST_DIR
 } from "./chunk-4IQXHHPF.js";

package/.docu/lib/clean.js

@@ -1,6 +1,6 @@
 import {
   logger
-} from "./chunk-TU7G4RJV.js";
+} from "./chunk-QYKLXNNB.js";
 import "./chunk-4IQXHHPF.js";
 
 // .docu/node/clean.ts

package/.docu/lib/deploy.deno.js

@@ -1,6 +1,6 @@
 import {
   runDeploy
-} from "./chunk-KHRQUSNL.js";
+} from "./chunk-NN5T3Z5R.js";
 import "./chunk-4IQXHHPF.js";
 
 // .docu/node/deploy.deno.ts

package/.docu/lib/deploy.node.js

@@ -1,6 +1,6 @@
 import {
   runDeploy
-} from "./chunk-KHRQUSNL.js";
+} from "./chunk-NN5T3Z5R.js";
 import "./chunk-4IQXHHPF.js";
 
 // .docu/node/deploy.node.ts

package/.docu/lib/preview.deno.js

@@ -1,8 +1,8 @@
 import {
   runPreview
-} from "./chunk-N25ZVCKO.js";
+} from "./chunk-UNRSSV2E.js";
 import "./chunk-EOK6KATZ.js";
-import "./chunk-TU7G4RJV.js";
+import "./chunk-QYKLXNNB.js";
 import "./chunk-4IQXHHPF.js";
 
 // .docu/node/preview.deno.ts

package/.docu/lib/preview.node.js

@@ -1,8 +1,8 @@
 import {
   runPreview
-} from "./chunk-N25ZVCKO.js";
+} from "./chunk-UNRSSV2E.js";
 import "./chunk-EOK6KATZ.js";
-import "./chunk-TU7G4RJV.js";
+import "./chunk-QYKLXNNB.js";
 import "./chunk-4IQXHHPF.js";
 
 // .docu/node/preview.node.ts

package/.docu/lib/server.deno.js

@@ -1,9 +1,9 @@
 import {
   runServer
-} from "./chunk-77NNQDFX.js";
+} from "./chunk-6JMYQIHO.js";
 import "./chunk-WSJC3PRH.js";
 import "./chunk-EOK6KATZ.js";
-import "./chunk-TU7G4RJV.js";
+import "./chunk-QYKLXNNB.js";
 import "./chunk-4IQXHHPF.js";
 
 // .docu/node/server.deno.ts

package/.docu/lib/server.node.js

@@ -1,9 +1,9 @@
 import {
   runServer
-} from "./chunk-77NNQDFX.js";
+} from "./chunk-6JMYQIHO.js";
 import "./chunk-WSJC3PRH.js";
 import "./chunk-EOK6KATZ.js";
-import "./chunk-TU7G4RJV.js";
+import "./chunk-QYKLXNNB.js";
 import "./chunk-4IQXHHPF.js";
 
 // .docu/node/server.node.ts

package/.docu/node/build.impl.ts

@@ -149,7 +149,11 @@ async function renderDocsPage(
   const depth = slug ? slug.split("/").length : 1;
   const favicon = docuConfig.meta?.favicon || "/docs/assets/images/favicon.ico";
   const seo = buildSeoMeta(docuConfig, frontmatter, slug || "");
-  const csp = cspHeader(nonce, process.env.NODE_ENV !== "production");
+  /**
+   * @docubook/mdx-remote uses new Function(compiledSource) for
+   * client-side MDX hydration. Keep allowEval=true until mdx-remote drops new Function.
+   */
+  const csp = cspHeader(nonce, true);
   let html = htmlShell({
     title,
     description,
@@ -358,7 +362,8 @@ export async function runBuild(): Promise<void> {
     body: renderToString(landingPage),
     favicon: landingFavicon,
     seo: landingSeo,
-    csp: cspHeader(landingNonce, process.env.NODE_ENV !== "production"),
+    /** unsafe-eval required by mdx-remote hydration — see above. */
+    csp: cspHeader(landingNonce, true),
     css: assetManifest.css,
     js: assetManifest.js,
     nonce: landingNonce,
@@ -379,7 +384,8 @@ export async function runBuild(): Promise<void> {
     body: renderToString(notFoundPage),
     favicon: notFoundFavicon,
     headExtra: ['<meta name="robots" content="noindex,follow">'],
-    csp: cspHeader(notFoundNonce, process.env.NODE_ENV !== "production"),
+    /** unsafe-eval required by mdx-remote hydration — see above. */
+    csp: cspHeader(notFoundNonce, true),
     css: assetManifest.css,
     js: assetManifest.js,
     nonce: notFoundNonce,

package/.docu/node/deploy.shared.ts

@@ -31,6 +31,7 @@ export const NGINX_CONF = `server {
   add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
   add_header Referrer-Policy "strict-origin-when-cross-origin" always;
   add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+  add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' https: data:; font-src 'self' data:; connect-src 'self' https:; frame-src https://www.youtube-nocookie.com; frame-ancestors 'none'" always;
 
   location /assets/ {
     expires 1y;
@@ -40,6 +41,7 @@ export const NGINX_CONF = `server {
     add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' https: data:; font-src 'self' data:; connect-src 'self' https:; frame-src https://www.youtube-nocookie.com; frame-ancestors 'none'" always;
   }
 
   location /docs/assets/ {
@@ -50,6 +52,7 @@ export const NGINX_CONF = `server {
     add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' https: data:; font-src 'self' data:; connect-src 'self' https:; frame-src https://www.youtube-nocookie.com; frame-ancestors 'none'" always;
   }
 
   location / {
@@ -126,7 +129,10 @@ export function detectPkgManager(dir: string): {
 export const HEADERS_FILE = `/*
   X-Frame-Options: DENY
   X-Content-Type-Options: nosniff
+  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
   Referrer-Policy: strict-origin-when-cross-origin
+  Permissions-Policy: camera=(), microphone=(), geolocation=()
+  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' https: data:; font-src 'self' data:; connect-src 'self' https:; frame-src https://www.youtube-nocookie.com; frame-ancestors 'none'
 
 /assets/*
   Cache-Control: public, max-age=31536000, immutable
@@ -172,7 +178,6 @@ RUN ${pm.runCmd} run build
 FROM nginx:alpine
 COPY --from=builder /app/.docu/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
-USER nginx
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]
 `

package/.docu/node/deploy.ts

@@ -53,7 +53,6 @@ RUN bun run build
 FROM nginx:alpine
 COPY --from=builder /app/.docu/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
-USER nginx
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]
 `;

package/.docu/node/server-routes.ts

@@ -45,7 +45,8 @@ function createHtmlResponse(
     themeCss: state.inlineThemeCss,
     depth,
   });
-  return htmlResponse(html, nonce, status, process.env.NODE_ENV !== "production");
+  /** unsafe-eval required by mdx-remote hydration — see build.impl.ts */
+  return htmlResponse(html, nonce, status, true);
 }
 
 async function getDocsForSlug(
@@ -183,7 +184,8 @@ async function renderDocsServerPage(
       depth,
     });
     html = await state.builder.runTransformHtmlChain(html, ctx);
-    return htmlResponse(html, nonce, 200, process.env.NODE_ENV !== "production");
+    /** unsafe-eval required by mdx-remote hydration — see build.impl.ts */
+    return htmlResponse(html, nonce, 200, true);
   }
 
   return createHtmlResponse(title, description, body, 200, state, depth);

package/bin/cli.js

@@ -61,6 +61,16 @@ const hasSilent = process.argv.includes("--silent");
 if (hasDocker) process.env.FLAME_DEPLOY_DOCKER = "1";
 if (hasSilent) process.env.FLAME_DEPLOY_SILENT = "1";
 
+// Production mode for build/preview/deploy — ensures minified client bundle
+// on all platforms (Coolify, Vercel, etc.) without requiring the user to
+// set NODE_ENV manually.
+if (
+  (command === "build" || command === "preview" || command === "deploy") &&
+  !process.env.NODE_ENV
+) {
+  process.env.NODE_ENV = "production";
+}
+
 if (!command || command === "--help" || command === "-h") {
   console.log(`
   @docubook/flame — A blazing-fast React + MDX framework for modern documentation experiences. Runs on Bun, Node.js, and Deno.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@docubook/flame",
-  "version": "1.6.2",
+  "version": "1.6.4",
   "description": "A blazing-fast React + MDX framework powered by Bun, built for modern documentation experiences.",
   "type": "module",
   "bin": {
@@ -57,8 +57,8 @@
     "@docubook/core": "^1.8.2",
     "@docubook/mdx-content": "^3.4.5",
     "@docubook/runt": "^1.0.0",
-    "@docubook/ui-react": "^1.0.0",
-    "@docubook/themes-colors": "^1.0.2"
+    "@docubook/themes-colors": "^1.0.2",
+    "@docubook/ui-react": "^1.0.0"
   },
   "peerDependencies": {
     "@sentry/bun": "^10.0.0"

package/template/.env.example

@@ -1,10 +1,26 @@
-# Server
+# ── Server ──────────────────────────────────────────────
+# Dev/preview server port.
 PORT=3000
 
-# Theme (optional — overrides docu.json themes.colors)
+# ── Build ────────────────────────────────────────────────
+# Max concurrent MDX pages to build (default: 4).
+# Increase for faster builds on high-core machines.
+# BUILD_CONCURRENCY=8
+
+# ── Logging ──────────────────────────────────────────────
+# Log level: debug | info | warn | error (default: info)
+LOG_LEVEL=info
+# Log format: pretty | json (default: pretty)
+LOG_FORMAT=pretty
+
+# ── Theme ────────────────────────────────────────────────
+# Override docu.json themes.colors at runtime.
+# Available presets: default, freshlime, coffee
 # FLAME_THEME=default
 # FLAME_THEME=freshlime
 # FLAME_THEME=coffee
 
-# Error Monitoring (optional)
+# ── Error Monitoring (optional) ─────────────────────────
+# Requires @sentry/bun installed (Bun) or @sentry/node (Node/Deno).
 # SENTRY_DSN=https://your-dsn@sentry.io/project-id
+# SENTRY_RELEASE=1.0.0