@jk2908/solas 0.15.0 → 0.16.0

package/dist/internal/env/request-context.d.ts

@@ -10,10 +10,12 @@ export declare const RequestContext: {
         req: SolasRequest;
         prerender: "full" | "ppr" | null;
         cache: RequestCache;
+        nonce?: string | undefined;
     };
     write<R>(value: {
         req: SolasRequest;
         prerender: "full" | "ppr" | null;
         cache: RequestCache;
+        nonce?: string | undefined;
     }, fn: () => R | Promise<R>): R | Promise<R>;
 };

package/dist/internal/env/rsc.js

@@ -5,6 +5,7 @@ import { Logger } from '../../utils/logger.js';
 import * as Config from '../../config.js';
 import * as RuntimeManifest from '../../manifest.js';
 import { nodeAssets } from '../assets.js';
+import { addHashesToPolicy, buildPolicy, resolveNonce } from '../csp.js';
 import { createHttpRouter } from '../http-router/create-http-router.js';
 import { HttpRouter } from '../http-router/router.js';
 import { isRscRequest, normaliseTrailingSlash, resolveRequestPath, } from '../http-router/utils.js';
@@ -15,6 +16,7 @@ import * as Prerender from '../prerender.js';
 import { Tree } from '../render/tree.js';
 import { Resolver } from '../resolver.js';
 import { processActionRequest } from '../server/actions.js';
+import { createHeaderResolver } from '../server/headers.js';
 import DefaultErr from '../ui/defaults/error.js';
 import { RequestContext } from './request-context.js';
 import { getKnownDigest, isKnownError } from './utils.js';
@@ -44,13 +46,17 @@ function toClientAsset(relativePath) {
  * Resolves the route match, collects metadata, and returns the stream,
  * status code, and prerender mode needed by the response layer.
  */
-async function createPayload(req, manifest, importMap, baseMetadata, returnValue, formState, temporaryReferences) {
+async function createPayload(req, manifest, importMap, baseMetadata, returnValue, formState, temporaryReferences, nonce) {
     const resolver = new Resolver(manifest, importMap);
     const prerender = req.headers.get(`x-${Config.SLUG}-prerender`) === '1';
     const url = new URL(req.url);
     const routedPath = stripBasePath(url.pathname, BASE_PATH) ?? url.pathname;
     const pathname = routedPath.endsWith('/') && routedPath !== '/' ? routedPath.slice(0, -1) : routedPath;
     const match = resolver.enhance(resolver.reconcile(pathname, req[Config.REQUEST_META_KEY].match, req[Config.REQUEST_META_KEY].error));
+    // build-time prerender requests have no request nonce, and full routes are
+    // served from static HTML. PPR responses are dynamic: the cached prelude uses
+    // hashes, while the resumed holes need the request nonce.
+    const effectiveNonce = prerender || match?.prerender === 'full' ? undefined : nonce;
     // if there's no match then no user supplied error boundary
     // has been found, and we should server render a default
     // error screen
@@ -74,19 +80,21 @@ async function createPayload(req, manifest, importMap, baseMetadata, returnValue
         return {
             // this path is a safety fallback when a prerender request
             // hits an unmatched route. In build prerender we force
-            // mode to 'full' so the 404/error shell resolves
+            // mode to `full` so the 404/error shell resolves
             // immediately. In normal request-time rendering
-            // we keep mode as null (obvi)
+            // we keep mode as null
             stream: RequestContext.write({
                 req,
                 prerender: prerender ? 'full' : null,
                 cache: {},
+                nonce: effectiveNonce,
             }, () => renderToReadableStream(rscPayload, {
                 temporaryReferences,
                 onError,
             })),
             status: 404,
             ppr: false,
+            nonce: effectiveNonce,
         };
     }
     // check if this route is a candidate for ppr
@@ -115,11 +123,12 @@ async function createPayload(req, manifest, importMap, baseMetadata, returnValue
             req,
             prerender: prerender ? (ppr ? 'ppr' : 'full') : null,
             cache: {},
+            nonce: effectiveNonce,
         }, () => renderToReadableStream(rscPayload, {
             temporaryReferences,
             onError,
         }));
-        return { stream, status, ppr };
+        return { stream, status, ppr, nonce: effectiveNonce };
     }
     catch (err) {
         logger.error('[rsc:render]', err);
@@ -140,6 +149,7 @@ async function createPayload(req, manifest, importMap, baseMetadata, returnValue
                 req,
                 prerender: prerender ? 'full' : null,
                 cache: {},
+                nonce: effectiveNonce,
             }, () => renderToReadableStream({
                 root: (_jsxs("html", { lang: "en", children: [
                         _jsxs("head", { children: [
@@ -157,6 +167,7 @@ async function createPayload(req, manifest, importMap, baseMetadata, returnValue
             })),
             status: 500,
             ppr: false,
+            nonce: effectiveNonce,
         };
     }
 }
@@ -171,6 +182,11 @@ export function createHandler(config, manifest, importMap, options = {}) {
     // requests for /_solas and /_solas/* are reserved
     const SOLAS_ASSETS_URL_ROOT = `/${Config.ASSETS_DIR}`;
     const prerenderPathMode = config.trailingSlash === 'always' ? 'always' : 'never';
+    const resolveHeaders = createHeaderResolver(config.headers);
+    const responseNonce = new WeakMap();
+    const clientStyleHashes = [
+        ...new Set(Object.values(runtimeManifest?.artifacts ?? {}).flatMap(artifact => artifact.csp?.style ?? [])),
+    ];
     /**
      * Create the HTTP response for a single incoming request. Runs actions when needed,
      * converts the payload into component, HTML, or prerender artifact responses, and
@@ -188,7 +204,19 @@ export function createHandler(config, manifest, importMap, options = {}) {
                 url: config.url,
             });
         }
-        const { stream: rscStream, status, ppr, } = await createPayload(req, manifest, importMap, config.metadata, opts.returnValue, opts.formState, opts.temporaryReferences);
+        const requestCsp = req.headers.get('content-security-policy');
+        const configuredHeaders = await resolveHeaders(req);
+        const clientNonce = isRscRequest(req) || req[Config.REQUEST_META_KEY].action
+            ? req.headers.get('x-solas-nonce')
+            : null;
+        const generatedNonce = config.csp && !requestCsp ? clientNonce || crypto.randomUUID() : undefined;
+        if (config.csp && generatedNonce) {
+            responseNonce.set(req, generatedNonce);
+        }
+        const nonce = requestCsp
+            ? resolveNonce(requestCsp, configuredHeaders, clientNonce)
+            : (generatedNonce ?? resolveNonce(null, configuredHeaders, clientNonce));
+        const { stream: rscStream, status, ppr, nonce: effectiveNonce, } = await createPayload(req, manifest, importMap, config.metadata, opts.returnValue, opts.formState, opts.temporaryReferences, nonce);
         const stream = await rscStream;
         if (isRscRequest(req)) {
             return new Response(stream, {
@@ -219,7 +247,7 @@ export function createHandler(config, manifest, importMap, options = {}) {
             // rebuild the route through the nearest matching status boundary
             req[Config.REQUEST_META_KEY].error = toHttpException(err);
             try {
-                const { stream: retriedRscStream, status: retriedStatus } = await createPayload(req, manifest, importMap, config.metadata, opts.returnValue, opts.formState, opts.temporaryReferences);
+                const { stream: retriedRscStream, status: retriedStatus } = await createPayload(req, manifest, importMap, config.metadata, opts.returnValue, opts.formState, opts.temporaryReferences, nonce);
                 const retriedStream = await retriedRscStream;
                 return {
                     retriedStatus,
@@ -285,11 +313,11 @@ export function createHandler(config, manifest, importMap, options = {}) {
                     // the cached prelude already carries the static payload, only needs to
                     // stream the html completions for postponed boundaries
                     const resumeStream = await mod.resume(stream, postponedState, {
-                        nonce: undefined,
+                        nonce: effectiveNonce,
                         injectPayload: false,
                     });
                     const body = prelude
-                        ? Prerender.composePreludeAndResume(prelude, resumeStream)
+                        ? Prerender.composePreludeAndResume(prelude, resumeStream, effectiveNonce)
                         : resumeStream;
                     return new Response(body, {
                         headers: {
@@ -303,6 +331,7 @@ export function createHandler(config, manifest, importMap, options = {}) {
             }
             const htmlStream = await mod.ssr(stream, {
                 formState: opts.formState,
+                nonce: effectiveNonce,
                 ppr: runtimePpr,
             });
             return new Response(htmlStream, {
@@ -321,6 +350,7 @@ export function createHandler(config, manifest, importMap, options = {}) {
             if (recovered) {
                 const retriedHtmlStream = await mod.ssr(recovered.retriedStream, {
                     formState: opts.formState,
+                    nonce: effectiveNonce,
                     ppr: false,
                 });
                 return new Response(retriedHtmlStream, {
@@ -369,16 +399,66 @@ export function createHandler(config, manifest, importMap, options = {}) {
     }
     const httpRouter = createHttpRouter(config, manifest, importMap, createResponse, serveFullPrerender);
     /**
-     * Add the configured `headers` to a response. Clones the response so
-     * immutable ones (redirects, cached assets) can still be augmented.
+     * Hash sources for a prerendered document. The route's own scripts are
+     * immutable, while the union of prerendered styles also covers style tags a
+     * client navigation can insert from another route.
+     */
+    function getCspHashes(req, res) {
+        if (!runtimeManifest)
+            return;
+        const contentType = res.headers.get('content-type');
+        if (!contentType?.toLowerCase().startsWith('text/html'))
+            return;
+        const routedPath = stripBasePath(new URL(req.url).pathname, BASE_PATH);
+        if (routedPath == null)
+            return;
+        const lookupPath = normaliseTrailingSlash(routedPath, prerenderPathMode);
+        const artifact = runtimeManifest.artifacts[lookupPath];
+        if (!artifact?.csp)
+            return;
+        return {
+            script: artifact.csp.script,
+            style: [...new Set([...artifact.csp.style, ...clientStyleHashes])],
+        };
+    }
+    /**
+     * Add the configured `headers` and any prerender CSP hashes to a response.
+     * Clones the response so immutable ones (redirects, cached assets) can still
+     * be augmented.
      */
     async function withHeaders(res, req) {
-        if (!config.headers)
-            return res;
-        const entries = typeof config.headers === 'function' ? await config.headers(req) : config.headers;
         const headers = new Headers(res.headers);
-        for (const [key, value] of Object.entries(entries))
-            headers.set(key, value);
+        let changed = false;
+        if (config.headers) {
+            const entries = await resolveHeaders(req);
+            const requestCsp = req.headers.get('content-security-policy');
+            for (const [key, value] of Object.entries(entries)) {
+                if (requestCsp && key.toLowerCase() === 'content-security-policy')
+                    continue;
+                headers.set(key, value);
+                changed = true;
+            }
+        }
+        const hashes = getCspHashes(req, res);
+        const isHtml = res.headers.get('content-type')?.toLowerCase().startsWith('text/html');
+        const nonce = responseNonce.get(req);
+        if (config.csp && !req.headers.has('content-security-policy') && isHtml) {
+            const built = buildPolicy(config.csp.directives, { nonce, hashes });
+            if (built) {
+                headers.set('content-security-policy', built);
+                changed = true;
+            }
+        }
+        const csp = headers.get('content-security-policy');
+        if (hashes && csp) {
+            const updated = addHashesToPolicy(csp, hashes);
+            if (updated !== csp) {
+                headers.set('content-security-policy', updated);
+                changed = true;
+            }
+        }
+        if (!changed)
+            return res;
         return new Response(res.body, {
             status: res.status,
             statusText: res.statusText,

package/dist/internal/env/ssr.js

@@ -32,6 +32,8 @@ async function ssr(rscStream, opts = {}) {
     if (ppr) {
         const { prelude } = await reactPrerender(_jsx(A, { payloadPromise: payloadPromise }), {
             bootstrapScriptContent,
+            // @ts-expect-error React 19 accepts the object form; @types/react-dom declares only string
+            nonce: nonce ? { script: nonce, style: nonce } : undefined,
             onError(err) {
                 const digest = getKnownDigest(err);
                 if (digest)
@@ -45,7 +47,8 @@ async function ssr(rscStream, opts = {}) {
     }
     const htmlStream = await renderToReadableStream(_jsx(A, { payloadPromise: payloadPromise }), {
         bootstrapScriptContent,
-        nonce,
+        // @ts-expect-error React 19 accepts the object form; @types/react-dom declares only string
+        nonce: { script: nonce, style: nonce },
         formState,
         onError(err) {
             const digest = getKnownDigest(err);
@@ -119,6 +122,8 @@ async function prerender(rscStream, opts = {}) {
     }
     const stream = await renderToReadableStream(_jsx(A, { payloadPromise: payloadPromise }), {
         bootstrapScriptContent,
+        // @ts-expect-error React 19 accepts the object form; @types/react-dom declares only string
+        nonce: { script: nonce, style: nonce },
         onError(err) {
             const digest = getKnownDigest(err);
             if (digest)
@@ -144,7 +149,8 @@ async function resume(rscStream, postponedState, opts = {}) {
     const [s1, s2] = rscStream.tee();
     const payloadPromise = createFromReadableStream(s1);
     const htmlStream = await reactResume(_jsx(A, { payloadPromise: payloadPromise }), postponedState, {
-        nonce: opts.nonce,
+        // @ts-expect-error React 19 accepts the object form; @types/react-dom declares only string
+        nonce: opts.nonce ? { script: opts.nonce, style: opts.nonce } : undefined,
         onError(err) {
             const digest = getKnownDigest(err);
             if (digest)

package/dist/internal/hash-inline-assets.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Collect CSP hash sources for every non-empty inline script and style in a
+ * finished HTML document.
+ *
+ * The document must be complete: hashes are over the text the browser actually
+ * parses, including any escaping already applied to inline scripts.
+ */
+export declare function hashInlineAssets(html: string): {
+    script: string[];
+    style: string[];
+};

package/dist/internal/hash-inline-assets.js

@@ -0,0 +1,103 @@
+import { createHash } from 'node:crypto';
+const NAME_CHAR = /[a-zA-Z0-9:_-]/;
+/**
+ * Collect CSP hash sources for every non-empty inline script and style in a
+ * finished HTML document.
+ *
+ * The document must be complete: hashes are over the text the browser actually
+ * parses, including any escaping already applied to inline scripts.
+ */
+export function hashInlineAssets(html) {
+    const scripts = new Set();
+    const styles = new Set();
+    const lower = html.toLowerCase();
+    let index = 0;
+    while (index < html.length) {
+        const open = html.indexOf('<', index);
+        if (open === -1)
+            break;
+        if (html.startsWith('<!--', open)) {
+            const end = html.indexOf('-->', open + 4);
+            if (end === -1)
+                break;
+            index = end + 3;
+            continue;
+        }
+        if (html[open + 1] === '!' || html[open + 1] === '?') {
+            const end = getTagEnd(html, open + 2);
+            if (end === -1)
+                break;
+            index = end + 1;
+            continue;
+        }
+        const closing = html[open + 1] === '/';
+        const nameStart = open + (closing ? 2 : 1);
+        if (!NAME_CHAR.test(html[nameStart] ?? '')) {
+            index = open + 1;
+            continue;
+        }
+        let nameEnd = nameStart;
+        while (nameEnd < html.length && NAME_CHAR.test(html[nameEnd]))
+            nameEnd++;
+        const name = lower.slice(nameStart, nameEnd);
+        const tagEnd = getTagEnd(html, nameEnd);
+        if (tagEnd === -1)
+            break;
+        if (!closing && (name === 'script' || name === 'style')) {
+            const end = getRawTextEnd(lower, tagEnd + 1, name);
+            if (!end)
+                break;
+            const content = html.slice(tagEnd + 1, end.start);
+            if (content) {
+                const source = `'sha256-${createHash('sha256').update(content.replace(/\r\n?/g, '\n')).digest('base64')}'`;
+                const hashes = name === 'script' ? scripts : styles;
+                hashes.add(source);
+            }
+            index = end.end;
+            continue;
+        }
+        index = tagEnd + 1;
+    }
+    return {
+        script: [...scripts],
+        style: [...styles],
+    };
+}
+/**
+ * Find the closing `>` of a tag while ignoring brackets inside quoted values.
+ */
+function getTagEnd(html, start) {
+    let quote;
+    for (let index = start; index < html.length; index++) {
+        const char = html[index];
+        if (quote) {
+            if (char === quote)
+                quote = undefined;
+            continue;
+        }
+        if (char === '"' || char === "'") {
+            quote = char;
+            continue;
+        }
+        if (char === '>')
+            return index;
+    }
+    return -1;
+}
+/**
+ * Find the end tag for a raw text element. Script and style bodies are not
+ * parsed as HTML, so the first valid `</script` or `</style` wins.
+ */
+function getRawTextEnd(lower, start, name) {
+    const needle = `</${name}`;
+    let index = lower.indexOf(needle, start);
+    while (index !== -1) {
+        const next = lower[index + needle.length];
+        if (next === undefined || next === '>' || next === '/' || /\s/.test(next)) {
+            const end = getTagEnd(lower, index + needle.length);
+            if (end !== -1)
+                return { start: index, end: end + 1 };
+        }
+        index = lower.indexOf(needle, index + needle.length);
+    }
+}

package/dist/internal/http-router/router.d.ts

@@ -5,7 +5,7 @@ export declare namespace HttpRouter {
     type Params = Record<string, string | string[]>;
     type Handler = (req: SolasRequest) => Response | Promise<Response>;
     type ErrorHandler = (err: Error, req: SolasRequest) => Response | Promise<Response>;
-    type Middleware = (req: SolasRequest, next: () => Promise<Response>) => Response | Promise<Response>;
+    type Middleware = (req: SolasRequest, next: (request?: Request) => Promise<Response>) => Response | Promise<Response>;
     type Token = {
         kind: 'static' | 'dynamic' | 'wildcard';
         value: string;

package/dist/internal/http-router/router.js

@@ -6,6 +6,18 @@ import { maybeAction } from '../server/actions.js';
 import { enforce } from '../server/csrf.js';
 import { getAlternatePathname, normaliseTrailingSlash, resolveRequestPath, toPathPattern, } from './utils.js';
 const BASE_PATH = normaliseBasePath(import.meta.env.BASE_URL);
+/**
+ * Copy Solas request metadata onto a request a middleware passes to `next()`.
+ * The route match was resolved before middleware ran, so the metadata must
+ * survive a request replacement.
+ */
+function withRequestMeta(request, source) {
+    if (request === source)
+        return source;
+    return Object.assign(request, {
+        [Config.REQUEST_META_KEY]: source[Config.REQUEST_META_KEY],
+    });
+}
 /**
  * Handle routing and matching for server requests.
  */
@@ -211,7 +223,7 @@ export class HttpRouter {
             enforce(request, this.opts.csrf);
             // keep global middleware outside route middleware and preserve registration order
             const stack = [...this.#middleware.global, ...matched.route.middleware];
-            return this.#run(stack, request, () => matched.route.handler?.(request) ?? new Response('Not found', { status: 404 }));
+            return this.#run(stack, request, request => matched.route.handler?.(request) ?? new Response('Not found', { status: 404 }));
         }
         catch (err) {
             // turn unknown throws into Error objects so the error hook sees one shape
@@ -232,24 +244,24 @@ export class HttpRouter {
      */
     #run(stack, req, next) {
         // build the middleware chain from the inside out
-        let run = () => Promise.resolve(next());
+        let run = (request) => Promise.resolve(next(request));
         // wrap each middleware around the current chain
         for (let i = stack.length - 1; i >= 0; i -= 1) {
             const handler = stack[i];
             const prev = run;
-            run = () => {
+            run = (request) => {
                 let called = false;
-                return Promise.resolve(handler(req, () => {
+                return Promise.resolve(handler(request, (replacement) => {
                     // next() can only be used once per middleware call
                     if (called)
                         throw new Error('next() called more than once');
                     called = true;
-                    return prev();
+                    return prev(withRequestMeta(replacement ?? request, request));
                 }));
             };
         }
         // start the middleware chain
-        return run();
+        return run(req);
     }
     /**
      * Serve a file with optional compression content negotiation.

package/dist/internal/postbuild.d.ts

@@ -1,16 +1,22 @@
+import type { CspConfig } from '../types.js';
 import * as Prerender from './prerender.js';
-export declare function setRscEntry(entry: string): void;
 type App = Parameters<typeof Prerender.run>[0];
-/** Imports the server bundle `postbuild` prerenders with. */
+/**
+ * Imports the server bundle `postbuild` prerenders with.
+ */
 export type PrerenderImport = () => Promise<{
     default: App;
 }>;
+export type PostbuildOptions = {
+    csp?: CspConfig;
+    load?: PrerenderImport;
+};
 /**
- * Set a wrapper for the import `postbuild` makes to prerender. It receives the
- * plain import and returns one that sets up and tears down platform-specific
- * module resolution around it, for example shimming a runtime module that Node
- * cannot resolve (such as `cloudflare:workers`).
+ * Prerender `full` and `ppr` routes, write their artifacts, collect inline CSP
+ * hashes, and write the runtime manifest.
+ *
+ * @param cwd - Project root. Defaults to the current working directory.
+ * @param options - Optional CSP config and RSC bundle loader.
  */
-export declare function setPrerenderImport(wrap: (next: PrerenderImport) => PrerenderImport): void;
-export declare function postbuild(cwd?: string): Promise<void>;
+export declare function postbuild(cwd?: string, options?: PostbuildOptions): Promise<void>;
 export {};

package/dist/internal/postbuild.js

@@ -4,28 +4,20 @@ import * as Compress from '../utils/compress.js';
 import { Logger } from '../utils/logger.js';
 import * as Config from '../config.js';
 import * as Manifest from '../manifest.js';
+import { buildPolicy } from './csp.js';
+import { hashInlineAssets } from './hash-inline-assets.js';
 import * as Prerender from './prerender.js';
 const logger = new Logger();
+const CSP_HEADER_SIZE_LIMIT = 8 * 1024;
 /**
- * Overrides the RSC bundle that postbuild imports to prerender routes. Defaults
- * to `dist/rsc/index.js`; platform adapters that relocate the server bundle (for
- * example Cloudflare, whose Worker bundle lives under `.cloudflare`) set this.
+ * Prerender `full` and `ppr` routes, write their artifacts, collect inline CSP
+ * hashes, and write the runtime manifest.
+ *
+ * @param cwd - Project root. Defaults to the current working directory.
+ * @param options - Optional CSP config and RSC bundle loader.
  */
-let rscEntryOverride;
-export function setRscEntry(entry) {
-    rscEntryOverride = entry;
-}
-let prerenderImport;
-/**
- * Set a wrapper for the import `postbuild` makes to prerender. It receives the
- * plain import and returns one that sets up and tears down platform-specific
- * module resolution around it, for example shimming a runtime module that Node
- * cannot resolve (such as `cloudflare:workers`).
- */
-export function setPrerenderImport(wrap) {
-    prerenderImport = wrap;
-}
-export async function postbuild(cwd = process.cwd()) {
+export async function postbuild(cwd = process.cwd(), options = {}) {
+    const { csp, load: customLoad } = options;
     const manifestPath = path.join(cwd, Config.GENERATED_DIR, 'build.json');
     let manifest;
     try {
@@ -52,11 +44,8 @@ export async function postbuild(cwd = process.cwd()) {
         const concurrency = Prerender.getConcurrency();
         const pendingWrites = new Set();
         logger.info('[prerender]', `prerendering ${manifest.prerenderRoutes.length} routes (concurrency: ${concurrency})...`);
-        const rscEntry = rscEntryOverride ?? path.join(rscDir, 'index.js');
-        rscEntryOverride = undefined;
-        const base = () => import(/* @vite-ignore */ rscEntry);
-        const load = prerenderImport ? prerenderImport(base) : base;
-        prerenderImport = undefined;
+        const entry = path.join(rscDir, 'index.js');
+        const load = customLoad ?? (() => import(/* @vite-ignore */ entry));
         const { default: app } = await load();
         async function enqueueWrite(task) {
             const write = task().finally(() => {
@@ -83,6 +72,8 @@ export async function postbuild(cwd = process.cwd()) {
             }
             const artifact = result.artifact;
             const artifactDir = Prerender.getArtifactPath(outDir, route);
+            const csp = hashInlineAssets(artifact.html);
+            const hashes = csp.script.length > 0 || csp.style.length > 0 ? { csp } : {};
             await enqueueWrite(async () => {
                 try {
                     if (artifact.mode === 'ppr') {
@@ -105,6 +96,7 @@ export async function postbuild(cwd = process.cwd()) {
                             files: artifact.postponed !== undefined
                                 ? ['metadata', 'prelude', 'postponed']
                                 : ['metadata', 'prelude'],
+                            ...hashes,
                         };
                         logger.info('[prerender]', `${route} (ppr)`);
                         return;
@@ -125,6 +117,7 @@ export async function postbuild(cwd = process.cwd()) {
                     artfifactManifest[route] = {
                         mode: artifact.mode,
                         files: ['html'],
+                        ...hashes,
                     };
                     logger.info(`[prerender]: ${route} (full)`);
                 }
@@ -135,6 +128,29 @@ export async function postbuild(cwd = process.cwd()) {
         }
         await Promise.all(pendingWrites);
     }
+    if (csp) {
+        const styleHashes = [
+            ...new Set(Object.values(artfifactManifest).flatMap(artifact => artifact.csp?.style ?? [])),
+        ];
+        let largestRoute = '';
+        let largestSize = 0;
+        for (const [route, artifact] of Object.entries(artfifactManifest)) {
+            const policy = buildPolicy(csp.directives, {
+                nonce: artifact.mode === 'ppr' ? 'x'.repeat(36) : undefined,
+                hashes: {
+                    script: artifact.csp?.script ?? [],
+                    style: styleHashes,
+                },
+            });
+            if (policy.length > largestSize) {
+                largestRoute = route;
+                largestSize = policy.length;
+            }
+        }
+        if (largestSize > CSP_HEADER_SIZE_LIMIT) {
+            logger.warn('[csp]', `Generated CSP header for ${largestRoute} is about ${largestSize} bytes. ${CSP_HEADER_SIZE_LIMIT} bytes is a conservative warning threshold; check the response-header limit of your server or proxy. Reduce prerendered style hashes or raise that limit if needed.`);
+        }
+    }
     await fs.mkdir(artifactRoot, { recursive: true });
     // generated files served at the root: written to the output root (for the
     // asset layer) and into the client output (for the Node server), then listed
@@ -173,6 +189,8 @@ export async function postbuild(cwd = process.cwd()) {
     const runtimeManifest = {
         artifacts: artfifactManifest,
         publicFiles: [...manifest.publicFiles, ...generatedPublicFiles],
+        csp,
+        trailingSlash: manifest.trailingSlash,
     };
     await fs.writeFile(Manifest.getManifestPath(outDir), JSON.stringify(runtimeManifest));
     if (manifest.precompress) {

package/dist/internal/prerender.d.ts

@@ -1,5 +1,6 @@
 import type { BuildContext } from '../types.js';
 import type { Assets } from './assets.js';
+import type { CspHashes } from './csp.js';
 export type Mode = 'full' | 'ppr';
 export type File = 'html' | 'prelude' | 'postponed' | 'metadata';
 export type Value = {
@@ -14,6 +15,7 @@ export type Metadata = Pick<Value, 'schema' | 'route' | 'createdAt' | 'mode'>;
 export type Artifact = {
     mode: Mode;
     files?: readonly File[];
+    csp?: CspHashes;
 };
 export type ArtifactManifest = Record<string, Artifact>;
 /**
@@ -61,7 +63,7 @@ export declare function isCompatible(artifactMetadata: Metadata, pathname: strin
  * Compose the prelude HTML and the resume stream into a single HTML stream, by injecting the resume stream
  * into the prelude at the appropriate location (before </body> or </html>).
  */
-export declare function composePreludeAndResume(prelude: string, resumeStream: ReadableStream<Uint8Array>): ReadableStream<Uint8Array<ArrayBufferLike>>;
+export declare function composePreludeAndResume(prelude: string, resumeStream: ReadableStream<Uint8Array>, nonce?: string): ReadableStream<Uint8Array<ArrayBufferLike>>;
 export type Result = {
     route: string;
     artifact: Value;