@jk2908/solas 0.15.0 → 0.16.0

package/dist/internal/prerender.js

@@ -5,6 +5,7 @@ import { Logger } from '../utils/logger.js';
 import * as Config from '../config.js';
 import * as Solas from '../solas.js';
 import { nodeAssets } from './assets.js';
+import { addNonceToBootstrap } from './csp.js';
 import { toPathPattern } from './http-router/utils.js';
 const logger = new Logger();
 const DEFAULT_CONCURRENCY = 4;
@@ -174,7 +175,7 @@ const decoder = new TextDecoder();
  * Compose the prelude HTML and the resume stream into a single HTML stream, by injecting the resume stream
  * into the prelude at the appropriate location (before </body> or </html>).
  */
-export function composePreludeAndResume(prelude, resumeStream) {
+export function composePreludeAndResume(prelude, resumeStream, nonce) {
     // `prelude` is the static shell html as one complete string, usually shaped like
     // `<html>...<body>static shell...</body></html>` or an html fragment with no close tags
     // search both cases to avoid duplicating the full string with toLowerCase
@@ -186,7 +187,11 @@ export function composePreludeAndResume(prelude, resumeStream) {
     return new ReadableStream({
         async start(controller) {
             // send everything before the closing tags so the resume stream can be injected
-            controller.enqueue(encoder.encode(prelude.slice(0, splitAt)));
+            const head = prelude.slice(0, splitAt);
+            // the shell's scripts are hash-authorised, but the bootstrap also needs
+            // the request nonce so its dynamic import can load the module graph and
+            // so client code can read the document nonce later
+            controller.enqueue(encoder.encode(nonce ? addNonceToBootstrap(head, nonce) : head));
             // resumeStream is the html React emits when it resumes postponed work for this page. Its
             // first chunk begins with an extra `</body></html>` pair, then continues with the
             // resumed scripts and markup for the unfinished work. Strip that leading

package/dist/internal/server/headers.d.ts

@@ -1,5 +1,13 @@
+import type { HeaderEntries, HeadersInput } from '../../types.js';
 /**
  * Get the request headers as a read-only map.
  * @returns A Promise resolving to a read-only map of request headers.
  */
 export declare function headers(): Promise<ReadonlyMap<string, string>>;
+/**
+ * Resolve the configured response headers once per request.
+ *
+ * The nonce extracted from a configured CSP and the headers applied to the
+ * response must come from the same evaluation.
+ */
+export declare function createHeaderResolver(input: HeadersInput | undefined): (req: Request) => Promise<HeaderEntries>;

package/dist/internal/server/headers.js

@@ -6,7 +6,7 @@ import { dynamic } from './dynamic.js';
  */
 export async function headers() {
     await dynamic();
-    const { req, cache } = RequestContext.use();
+    const { req, cache, nonce } = RequestContext.use();
     // use request cache if possible to avoid reconstructing the map
     if (cache.headers)
         return cache.headers;
@@ -14,6 +14,34 @@ export async function headers() {
     req.headers.forEach((value, key) => {
         map.set(key, value);
     });
+    // expose the effective CSP nonce to server components under the same header
+    // name used by the proxy pattern; a request header alone is not enough
+    // because the nonce may come from the configured `headers` fallback
+    map.delete('x-solas-nonce');
+    map.delete('x-nonce');
+    if (nonce)
+        map.set('x-nonce', nonce);
     cache.headers = map;
     return map;
 }
+/**
+ * Resolve the configured response headers once per request.
+ *
+ * The nonce extracted from a configured CSP and the headers applied to the
+ * response must come from the same evaluation.
+ */
+export function createHeaderResolver(input) {
+    const cache = new WeakMap();
+    return (req) => {
+        if (!input)
+            return Promise.resolve({});
+        if (typeof input !== 'function')
+            return Promise.resolve(input);
+        let pending = cache.get(req);
+        if (!pending) {
+            pending = Promise.resolve().then(() => input(req));
+            cache.set(req, pending);
+        }
+        return pending;
+    };
+}

package/dist/manifest.d.ts

@@ -1,11 +1,17 @@
 import type { Assets } from './internal/assets.js';
+import type { CspConfig } from './types.js';
+import * as Config from './config.js';
 import * as Prerender from './internal/prerender.js';
 export type Manifest = {
     artifacts: Prerender.ArtifactManifest;
     publicFiles: ReadonlySet<string>;
+    csp?: CspConfig;
+    trailingSlash?: (typeof Config.TRAILING_SLASH_MODES)[number];
 };
 export declare function getManifestPath(outDir: string): string;
 export declare function loadManifest(assets?: Assets): Promise<{
     artifacts: Prerender.ArtifactManifest;
     publicFiles: Set<string>;
+    csp: CspConfig | undefined;
+    trailingSlash: "always" | "ignore" | "never" | undefined;
 } | null>;

package/dist/manifest.js

@@ -1,3 +1,4 @@
+import { isRecord, isStringArray } from './utils/validation.js';
 import * as Config from './config.js';
 import { nodeAssets } from './internal/assets.js';
 export function getManifestPath(outDir) {
@@ -24,38 +25,80 @@ export async function loadManifest(assets = nodeAssets) {
             return null;
         if (publicFiles !== undefined && !Array.isArray(publicFiles))
             return null;
-        for (const entry of Object.values(artifacts)) {
+        let trailingSlash;
+        const rawTrailingSlash = value.trailingSlash;
+        if (rawTrailingSlash !== undefined) {
+            if (rawTrailingSlash === 'always' ||
+                rawTrailingSlash === 'never' ||
+                rawTrailingSlash === 'ignore') {
+                trailingSlash = rawTrailingSlash;
+            }
+            else {
+                return null;
+            }
+        }
+        let cspConfig;
+        if (value.csp !== undefined) {
+            if (!isRecord(value.csp))
+                return null;
+            if (!isRecord(value.csp.directives))
+                return null;
+            const directives = {};
+            for (const [name, values] of Object.entries(value.csp.directives)) {
+                if (!isStringArray(values))
+                    return null;
+                directives[name] = values;
+            }
+            cspConfig = { directives };
+        }
+        const parsedArtifacts = {};
+        for (const [route, entry] of Object.entries(artifacts)) {
             if (!isRecord(entry))
                 return null;
-            const { mode, files } = entry;
+            const { mode, files, csp } = entry;
             if (mode !== 'full' && mode !== 'ppr')
                 return null;
+            const artifact = { mode };
             if (files !== undefined) {
                 if (!Array.isArray(files))
                     return null;
+                const parsedFiles = [];
                 for (const file of files) {
-                    if (file !== 'html' &&
-                        file !== 'prelude' &&
-                        file !== 'postponed' &&
-                        file !== 'metadata') {
+                    if (!isArtifactFile(file))
                         return null;
-                    }
+                    parsedFiles.push(file);
                 }
+                artifact.files = parsedFiles;
+            }
+            if (csp !== undefined) {
+                if (!isRecord(csp))
+                    return null;
+                if (!isStringArray(csp.script) || !isStringArray(csp.style))
+                    return null;
+                artifact.csp = { script: csp.script, style: csp.style };
             }
+            parsedArtifacts[route] = artifact;
         }
-        for (const entry of publicFiles ?? []) {
-            if (typeof entry !== 'string' || !entry.startsWith('/'))
+        const parsedPublicFiles = new Set();
+        for (const file of publicFiles ?? []) {
+            if (typeof file !== 'string' || !file.startsWith('/'))
                 return null;
+            parsedPublicFiles.add(file);
         }
         return {
-            artifacts: artifacts,
-            publicFiles: new Set(publicFiles ?? []),
+            artifacts: parsedArtifacts,
+            publicFiles: parsedPublicFiles,
+            csp: cspConfig,
+            trailingSlash,
         };
     }
     catch {
         return null;
     }
 }
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
+function isArtifactFile(value) {
+    return (value === 'html' ||
+        value === 'prelude' ||
+        value === 'postponed' ||
+        value === 'metadata');
 }

package/dist/types.d.ts

@@ -1,12 +1,10 @@
-type BunRequest = Request & {
-    params?: Record<string, string | string[]>;
-};
-import type { PluginOption } from 'vite';
+import type { PluginOption, ResolvedConfig } from 'vite';
 import { ExportReader } from './utils/export-reader.js';
 import type * as BrowserRouter from './internal/browser-router/shared.js';
 import type { HttpRouter } from './internal/http-router/router.js';
 import type { Metadata } from './internal/metadata.js';
 import type { HttpException } from './internal/navigation/http-exception.js';
+import type { PrerenderImport } from './internal/postbuild.js';
 import * as Config from './config.js';
 import * as Build from './internal/build.js';
 export type LogLevel = (typeof Config.LOG_LEVELS)[number];
@@ -18,6 +16,18 @@ export type Origin = `http://${string}` | `https://${string}`;
  */
 export type HeaderEntries = Record<string, string>;
 export type HeadersInput = HeaderEntries | ((req: Request) => HeaderEntries | Promise<HeaderEntries>);
+/**
+ * CSP directives. Keywords such as `self` and `none` may be written without
+ * their surrounding quotes.
+ */
+export type CspDirectives = Record<string, readonly string[]>;
+/**
+ * Structured CSP configuration. Solas uses nonces for dynamic responses,
+ * hashes for prerendered responses, and both for PPR.
+ */
+export type CspConfig = {
+    directives: CspDirectives;
+};
 /**
  * A platform deployment adapter. Solas registers `plugins` alongside its own,
  * so adapters are configured here instead of being spread into the Vite plugins
@@ -31,6 +41,7 @@ export type Adapter = {
      * option. A static host has no server, so it needs `'full'`.
      */
     prerender?: Route.PrerenderMode | false;
+    postbuild?: (config: ResolvedConfig) => PrerenderImport | undefined | Promise<PrerenderImport | undefined>;
 };
 type PluginConfigBase = {
     precompress?: boolean;
@@ -39,6 +50,7 @@ type PluginConfigBase = {
     trailingSlash?: (typeof Config.TRAILING_SLASH_MODES)[number];
     trustedOrigins?: readonly string[];
     headers?: HeadersInput;
+    csp?: CspConfig;
     adapter?: Adapter;
     readonly logger?: {
         level?: LogLevel;
@@ -116,7 +128,7 @@ export type MapEntry = {
     '500s'?: readonly (DynamicImport | null)[];
     loaders?: readonly (DynamicImport | null)[];
     middlewares?: readonly (HttpRouter.Middleware | null)[];
-    endpoint?: (req?: BunRequest) => unknown;
+    endpoint?: (req?: Request) => unknown;
 };
 export type ImportMap = Record<string, MapEntry>;
 export type HttpMethod = 'GET' | 'HEAD' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'OPTIONS';

package/dist/utils/get-document-nonce.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The CSP nonce for the current document.
+ *
+ * RSC navigations are part of the same document as the initial page load, so
+ * they must render with the same nonce. Read it from a framework script or
+ * style tag that already carries it.
+ *
+ * Use the `.nonce` property rather than a normal attribute: browsers hide the
+ * nonce content attribute after parsing so CSS cannot read it.
+ */
+export declare function getDocumentNonce(): string | undefined;

package/dist/utils/get-document-nonce.js

@@ -0,0 +1,16 @@
+/**
+ * The CSP nonce for the current document.
+ *
+ * RSC navigations are part of the same document as the initial page load, so
+ * they must render with the same nonce. Read it from a framework script or
+ * style tag that already carries it.
+ *
+ * Use the `.nonce` property rather than a normal attribute: browsers hide the
+ * nonce content attribute after parsing so CSS cannot read it.
+ */
+export function getDocumentNonce() {
+    if (typeof document === 'undefined')
+        return;
+    const element = document.querySelector('script[nonce], style[nonce]');
+    return element?.nonce || element?.getAttribute('nonce') || undefined;
+}

package/dist/utils/validation.d.ts

@@ -0,0 +1,2 @@
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function isStringArray(value: unknown): value is string[];

package/dist/utils/validation.js

@@ -0,0 +1,6 @@
+export function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+export function isStringArray(value) {
+    return Array.isArray(value) && value.every(item => typeof item === 'string');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@jk2908/solas",
-	"version": "0.15.0",
+	"version": "0.16.0",
 	"description": "A Vite + React meta-framework exploring streaming, Server Components, and partial prerendering. Designed for simplicity and lightness",
 	"keywords": [
 		"framework",
@@ -140,6 +140,6 @@
 		}
 	},
 	"engines": {
-		"node": "^20.19.0 || >=22.12.0"
+		"node": "^22.23.4 || >=24.22.1"
 	}
 }