@jk2908/solas 0.16.0 → 0.16.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.16.1
+
+### Fixes
+
+- The build warns when `script-src` uses `'strict-dynamic'` and the build contains full prerendered routes. Their hashed bootstrap cannot load its dynamic import under `'strict-dynamic'`, so those routes need `'self'`, dynamic rendering, or PPR.
+
 ## 0.16.0
 
 ### Breaking

package/dist/internal/postbuild.js

@@ -129,6 +129,14 @@ export async function postbuild(cwd = process.cwd(), options = {}) {
         await Promise.all(pendingWrites);
     }
     if (csp) {
+        const scriptSources = ['script-src-elem', 'script-src', 'default-src']
+            .map(name => Object.entries(csp.directives).find(([key]) => key.toLowerCase() === name)?.[1])
+            .find(Boolean);
+        const hasStrictDynamic = scriptSources?.some(value => value.trim().toLowerCase().replace(/^'|'$/g, '') === 'strict-dynamic');
+        const hasFullPrerender = Object.values(artfifactManifest).some(artifact => artifact.mode === 'full');
+        if (hasFullPrerender && hasStrictDynamic) {
+            logger.warn('[csp]', `'strict-dynamic' is set, but this build has full prerendered routes. Full pages use hashed bootstrap scripts, which cannot load their dynamic imports under 'strict-dynamic'. Use 'self' for those routes or make them dynamic or PPR.`);
+        }
         const styleHashes = [
             ...new Set(Object.values(artfifactManifest).flatMap(artifact => artifact.csp?.style ?? [])),
         ];

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@jk2908/solas",
-	"version": "0.16.0",
+	"version": "0.16.1",
 	"description": "A Vite + React meta-framework exploring streaming, Server Components, and partial prerendering. Designed for simplicity and lightness",
 	"keywords": [
 		"framework",