@lolyjs/core 0.2.0-alpha.10 → 0.2.0-alpha.11

package/dist/cli.cjs

@@ -4900,7 +4900,11 @@ var setupApplication = async ({
       helmetConfig.contentSecurityPolicy = {
         directives: {
           defaultSrc: ["'self'"],
-          styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
+          styleSrc: [
+            "'self'",
+            "'unsafe-inline'",
+            "https://fonts.googleapis.com"
+          ],
           scriptSrc: ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
           imgSrc: ["'self'", "data:", "https:"],
           // Allow fetch/XHR to any HTTPS endpoint - users can restrict in their config if needed
@@ -4917,7 +4921,11 @@ var setupApplication = async ({
       const defaultCSP = {
         directives: {
           defaultSrc: ["'self'"],
-          styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
+          styleSrc: [
+            "'self'",
+            "'unsafe-inline'",
+            "https://fonts.googleapis.com"
+          ],
           scriptSrc: ["'self'", nonceFunction],
           imgSrc: ["'self'", "data:", "https:"],
           // Allow fetch/XHR to any HTTPS endpoint - users can restrict in their config if needed
@@ -4940,10 +4948,7 @@ var setupApplication = async ({
             (src) => typeof src === "function"
           );
           if (!hasNonceSupport) {
-            mergedDirectives.scriptSrc = [
-              ...userScriptSrc,
-              nonceFunction
-            ];
+            mergedDirectives.scriptSrc = [...userScriptSrc, nonceFunction];
           } else {
             mergedDirectives.scriptSrc = userScriptSrc;
           }
@@ -4951,19 +4956,25 @@ var setupApplication = async ({
         const userConnectSrc = userDirectives.connectSrc;
         if (userConnectSrc && Array.isArray(userConnectSrc)) {
           const defaultConnectSrc = defaultCSP.directives.connectSrc || [];
-          const mergedConnectSrc = [.../* @__PURE__ */ new Set([...defaultConnectSrc, ...userConnectSrc])];
+          const mergedConnectSrc = [
+            .../* @__PURE__ */ new Set([...defaultConnectSrc, ...userConnectSrc])
+          ];
           mergedDirectives.connectSrc = mergedConnectSrc;
         }
         const userStyleSrc = userDirectives.styleSrc;
         if (userStyleSrc && Array.isArray(userStyleSrc)) {
           const defaultStyleSrc = defaultCSP.directives.styleSrc || [];
-          const mergedStyleSrc = [.../* @__PURE__ */ new Set([...defaultStyleSrc, ...userStyleSrc])];
+          const mergedStyleSrc = [
+            .../* @__PURE__ */ new Set([...defaultStyleSrc, ...userStyleSrc])
+          ];
           mergedDirectives.styleSrc = mergedStyleSrc;
         }
         const userFontSrc = userDirectives.fontSrc;
         if (userFontSrc && Array.isArray(userFontSrc)) {
           const defaultFontSrc = defaultCSP.directives.fontSrc || [];
-          const mergedFontSrc = [.../* @__PURE__ */ new Set([...defaultFontSrc, ...userFontSrc])];
+          const mergedFontSrc = [
+            .../* @__PURE__ */ new Set([...defaultFontSrc, ...userFontSrc])
+          ];
           mergedDirectives.fontSrc = mergedFontSrc;
         }
         helmetConfig.contentSecurityPolicy = {
@@ -4983,23 +4994,27 @@ var setupApplication = async ({
     helmetConfig.hsts = false;
   }
   if (process.env.NODE_ENV !== "development" && security?.contentSecurityPolicy !== false) {
-    app.use((req, res, next) => {
-      const nonce = import_crypto.default.randomBytes(16).toString("base64");
-      res.locals.nonce = nonce;
-      next();
-    });
+    app.use(
+      (req, res, next) => {
+        const nonce = import_crypto.default.randomBytes(16).toString("base64");
+        res.locals.nonce = nonce;
+        next();
+      }
+    );
   }
   app.use((0, import_helmet.default)(helmetConfig));
   const appLogger = createModuleLogger("framework");
-  app.use(requestLoggerMiddleware({
-    logger: appLogger.child({ component: "server" }),
-    logRequests: process.env.LOG_REQUESTS === "true",
-    // Default to false (only errors/warnings)
-    logResponses: process.env.LOG_RESPONSES !== "false",
-    // Default to true (but filtered)
-    logStaticAssets: process.env.LOG_STATIC_ASSETS === "true"
-    // Default to false
-  }));
+  app.use(
+    requestLoggerMiddleware({
+      logger: appLogger.child({ component: "server" }),
+      logRequests: process.env.LOG_REQUESTS === "true",
+      // Default to false (only errors/warnings)
+      logResponses: process.env.LOG_RESPONSES !== "false",
+      // Default to true (but filtered)
+      logStaticAssets: process.env.LOG_STATIC_ASSETS === "true"
+      // Default to false
+    })
+  );
   const corsOptions = {
     credentials: true
   };
@@ -5015,7 +5030,7 @@ var setupApplication = async ({
     corsOptions.origin = process.env.NODE_ENV === "development";
   }
   app.use((0, import_cors.default)(corsOptions));
-  if (rateLimit2) {
+  if (rateLimit2 && process.env.NODE_ENV !== "development") {
     const generalLimiter = createRateLimiter({
       windowMs: rateLimit2.windowMs,
       max: rateLimit2.max