npm - @mandujs/core - Versions diffs - 0.21.0 → 0.22.0 - Mend

@mandujs/core 0.21.0 → 0.22.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (122) hide show

package/package.json +94 -69
package/src/auth/__tests__/login.test.ts +419 -0
package/src/auth/__tests__/password.test.ts +122 -0
package/src/auth/__tests__/reset.test.ts +296 -0
package/src/auth/__tests__/tokens.test.ts +274 -0
package/src/auth/__tests__/verification.test.ts +274 -0
package/src/auth/index.ts +76 -0
package/src/auth/login.ts +225 -0
package/src/auth/password.ts +120 -0
package/src/auth/reset.ts +243 -0
package/src/auth/tokens.ts +612 -0
package/src/auth/verification.ts +253 -0
package/src/bundler/__tests__/cli-bench-utils.test.ts +149 -0
package/src/bundler/__tests__/cold-start.test.ts +504 -0
package/src/bundler/__tests__/csp-nonce.test.ts +278 -0
package/src/bundler/__tests__/dev-reliability.test.ts +619 -0
package/src/bundler/__tests__/extended-watch.test.ts +710 -0
package/src/bundler/__tests__/fast-refresh.test.ts +596 -0
package/src/bundler/__tests__/hdr.test.ts +353 -0
package/src/bundler/__tests__/hmr-client.test.ts +532 -0
package/src/bundler/__tests__/manifest-schema.test.ts +266 -0
package/src/bundler/__tests__/prod-smoke.test.ts +138 -0
package/src/bundler/__tests__/slot-dispatch.test.ts +573 -0
package/src/bundler/__tests__/url-cap-and-slot-regex.test.ts +286 -0
package/src/bundler/__tests__/vendor-cache.test.ts +455 -0
package/src/bundler/build.test.ts +8 -1
package/src/bundler/build.ts +310 -18
package/src/bundler/css.ts +326 -323
package/src/bundler/dev.ts +1611 -59
package/src/bundler/fast-refresh-plugin.ts +307 -0
package/src/bundler/hmr-types.ts +252 -0
package/src/bundler/manifest-schema.ts +301 -0
package/src/bundler/safe-build.test.ts +128 -0
package/src/bundler/safe-build.ts +77 -0
package/src/bundler/scenario-matrix.ts +229 -0
package/src/bundler/types.ts +11 -0
package/src/bundler/vendor-cache-types.ts +130 -0
package/src/bundler/vendor-cache.ts +526 -0
package/src/client/router.ts +214 -56
package/src/db/__tests__/db.test.ts +485 -0
package/src/db/index.ts +513 -0
package/src/db/migrations/__tests__/runner.test.ts +661 -0
package/src/db/migrations/history-table.ts +345 -0
package/src/db/migrations/lock.ts +269 -0
package/src/db/migrations/runner.ts +633 -0
package/src/desktop/__tests__/smoke.test.ts +100 -0
package/src/desktop/__tests__/window.test.ts +172 -0
package/src/desktop/__tests__/worker.test.ts +266 -0
package/src/desktop/index.ts +43 -0
package/src/desktop/types.ts +158 -0
package/src/desktop/window.ts +492 -0
package/src/desktop/worker.ts +180 -0
package/src/email/__tests__/email.test.ts +355 -0
package/src/email/index.ts +282 -0
package/src/email/resend.ts +163 -0
package/src/email/smtp.ts +64 -0
package/src/filling/__tests__/session-sqlite.test.ts +454 -0
package/src/filling/context.ts +72 -78
package/src/filling/cookie-codec.ts +299 -0
package/src/filling/deps.ts +25 -1
package/src/filling/filling.ts +28 -3
package/src/filling/session-sqlite.ts +617 -0
package/src/filling/session.ts +265 -216
package/src/guard/decision-memory.test.ts +52 -22
package/src/id/__tests__/id.test.ts +120 -0
package/src/id/index.ts +105 -0
package/src/kitchen/index.ts +2 -2
package/src/kitchen/kitchen-handler.ts +86 -0
package/src/kitchen/stream/activity-sse.ts +2 -1
package/src/middleware/csrf.ts +328 -0
package/src/middleware/index.ts +40 -0
package/src/middleware/oauth/__tests__/oauth.test.ts +574 -0
package/src/middleware/oauth/index.ts +505 -0
package/src/middleware/oauth/providers.ts +115 -0
package/src/middleware/rate-limit/__tests__/rate-limit.test.ts +642 -0
package/src/middleware/rate-limit/index.ts +522 -0
package/src/middleware/rate-limit/sqlite-store.ts +382 -0
package/src/middleware/secure/__tests__/secure.test.ts +360 -0
package/src/middleware/secure/csp.ts +193 -0
package/src/middleware/secure/index.ts +417 -0
package/src/middleware/session.ts +174 -0
package/src/observability/event-bus.ts +81 -79
package/src/paths.ts +37 -0
package/src/perf/hmr-markers.ts +215 -0
package/src/perf/index.ts +104 -0
package/src/resource/__tests__/generator.test.ts +603 -2
package/src/resource/ddl/__tests__/diff.test.ts +639 -0
package/src/resource/ddl/__tests__/emit.test.ts +799 -0
package/src/resource/ddl/__tests__/snapshot.test.ts +499 -0
package/src/resource/ddl/diff.ts +392 -0
package/src/resource/ddl/emit.ts +548 -0
package/src/resource/ddl/persistence-types.ts +218 -0
package/src/resource/ddl/snapshot.ts +447 -0
package/src/resource/ddl/type-map.ts +223 -0
package/src/resource/ddl/types.ts +232 -0
package/src/resource/generator-repo.ts +610 -0
package/src/resource/generator-schema.ts +476 -0
package/src/resource/generator.ts +117 -1
package/src/resource/index.ts +17 -1
package/src/resource/schema.ts +30 -0
package/src/router/fs-scanner.ts +3 -0
package/src/runtime/__tests__/error-boundary-redaction.test.ts +141 -0
package/src/runtime/__tests__/hdr-client.test.ts +223 -0
package/src/runtime/__tests__/http-errors.test.ts +117 -0
package/src/runtime/__tests__/not-found.test.ts +152 -0
package/src/runtime/boundary.tsx +21 -1
package/src/runtime/fast-refresh-runtime.ts +322 -0
package/src/runtime/fast-refresh-types.ts +128 -0
package/src/runtime/hmr-client.ts +409 -0
package/src/runtime/http-errors.ts +113 -0
package/src/runtime/index.ts +6 -0
package/src/runtime/logger.ts +678 -677
package/src/runtime/not-found.ts +93 -0
package/src/runtime/redirect.ts +133 -0
package/src/runtime/server.ts +518 -20
package/src/runtime/ssr.ts +340 -10
package/src/runtime/streaming-ssr.ts +222 -19
package/src/scheduler/__tests__/scheduler.test.ts +514 -0
package/src/scheduler/index.ts +343 -0
package/src/storage/s3/__tests__/s3.test.ts +479 -0
package/src/storage/s3/index.ts +412 -0
package/src/testing/index.ts +58 -0

package/src/runtime/ssr.ts CHANGED Viewed

@@ -3,10 +3,12 @@ import { serializeProps } from "../client/serialize";
 import { createRequire } from "module";
 import type { ReactElement } from "react";
 import type { BundleManifest } from "../bundler/types";
+import { isSafeManduUrl } from "../bundler/manifest-schema";
 import type { HydrationConfig, HydrationPriority } from "../spec/schema";
 import { PORTS, TIMEOUTS } from "../constants";
 import { escapeHtmlAttr, escapeHtmlText, escapeJsonForInlineScript } from "./escape";
 import { REACT_INTERNALS_SHIM_SCRIPT } from "./shims";
+import { generateFastRefreshPreamble } from "../bundler/dev";
 // Re-export streaming SSR utilities
 export {
@@ -50,6 +52,23 @@ export interface SSROptions {
   cssPath?: string | false;
   /** Island 래핑이 이미 React 엘리먼트 레벨에서 완료됨 (중복 래핑 방지) */
   islandPreWrapped?: boolean;
+  /**
+   * Phase 7.2 R1 Agent C (H1) — Content-Security-Policy nonce for the
+   * Fast Refresh inline preamble. Three accepted shapes:
+   *   - `true`            → auto-generate a fresh 128-bit base64 nonce
+   *                         per-render and insert it as the `nonce`
+   *                         attribute on the preamble `<script>` tag.
+   *   - non-empty string  → use the caller-provided nonce verbatim
+   *                         (e.g. one already produced by the
+   *                         `secure()` middleware and stashed on
+   *                         `ctx.get('csp-nonce')`).
+   *   - `false` / unset   → legacy behavior; no nonce attribute, no
+   *                         CSP header emitted. Also the effective
+   *                         behavior when env `MANDU_CSP_NONCE=0`.
+   * Only takes effect in dev mode with a populated `shared.fastRefresh`
+   * manifest entry — prod builds never emit the preamble at all.
+   */
+  cspNonce?: string | boolean;
 }
 let projectRenderToString: ((element: ReactElement) => string) | null | undefined;
@@ -181,6 +200,184 @@ export function wrapWithIsland(
   return `<div data-mandu-island="${escapeHtmlAttr(routeId)}"${srcAttr} data-mandu-priority="${escapeHtmlAttr(priority)}" style="display:contents">${content}</div>`;
 }
+/**
+ * Phase 7.1 R2 Agent D — Fast Refresh preamble emission helper.
+ * Phase 7.2 R1 Agent C (H1) — optional CSP nonce injection.
+ *
+ * Emits the `<script>` block returned by `generateFastRefreshPreamble`
+ * ONLY when all three preconditions hold:
+ *
+ *   1. `isDev === true` — the preamble and its glue import rely on the
+ *      `_fast-refresh-runtime.js` / `_vendor-react-refresh.js` assets
+ *      which are only emitted by the dev bundler path.
+ *   2. `manifest.shared.fastRefresh` is populated — which happens only
+ *      in dev mode (see `build.ts:1548`). Missing here implies either a
+ *      prod manifest, a failed vendor shim build, or a unit test that
+ *      stubbed the manifest. All three short-circuit to empty output.
+ *   3. Both the `glue` and `runtime` fields are non-empty strings —
+ *      `generateFastRefreshPreamble` itself re-checks and emits a
+ *      defensive stub comment if either is missing.
+ *
+ * Returned as a string so the caller can position it inside `<head>`
+ * BEFORE any `<script type="module">` runs. This matters because
+ * `reactFastRefresh: true`-transformed islands call `$RefreshReg$` at
+ * the top of the module; the stubs installed inside the preamble must
+ * exist before those calls execute, otherwise the island throws a
+ * `ReferenceError` during evaluation and never hydrates.
+ *
+ * Production builds see `fastRefresh` as `undefined` on the manifest
+ * (build.ts omits it), so this function returns `""` and the HTML
+ * remains byte-identical to pre-7.1 prod output.
+ *
+ * When `nonce` is a non-empty string, the returned `<script>` opening
+ * tag is rewritten to `<script nonce="...">`. This is the single
+ * modification point for CSP compliance — the inner body comes verbatim
+ * from `generateFastRefreshPreamble` (owned by dev.ts) so the bundler
+ * and SSR sides stay decoupled.
+ */
+function generateFastRefreshPreambleTag(
+  isDev: boolean,
+  manifest: BundleManifest | undefined,
+  nonce?: string,
+): string {
+  if (!isDev) return "";
+  const fr = manifest?.shared?.fastRefresh;
+  if (!fr) return "";
+  if (!fr.glue || !fr.runtime) return "";
+  // Phase 7.2.R3 M-01 — manifest wire-up. `isSafeManduUrl` rejects
+  // tampered entries (protocol, traversal, non-/.mandu paths, >2KB).
+  // Fail closed: if either URL is suspect, skip the preamble entirely
+  // — dev refresh breaks loudly instead of injecting an attacker-
+  // controlled <script src> via a tampered manifest.
+  if (!isSafeManduUrl(fr.glue) || !isSafeManduUrl(fr.runtime)) return "";
+  const raw = generateFastRefreshPreamble(fr.glue, fr.runtime);
+  if (!nonce) return raw;
+  // Inject nonce attribute onto the first <script> tag ONLY. Matches
+  // exactly `<script>` (the shape emitted by `generateFastRefreshPreamble`)
+  // to avoid accidentally nonce-ing a `<script src=...>` or malformed
+  // variant. If the upstream function changes shape, the regex still
+  // fails closed (returns raw) — unit-tested.
+  const nonceEscaped = escapeHtmlAttr(nonce);
+  return raw.replace(/<script>/, `<script nonce="${nonceEscaped}">`);
+}
+/**
+ * Phase 7.2 R1 Agent C (H1) — Resolve the CSP nonce to use for the Fast
+ * Refresh preamble. Three layered precedences (highest first):
+ *
+ *   1. `MANDU_CSP_NONCE=0` env var forces off (opt-out escape hatch for
+ *      projects with an existing Content-Security-Policy pipeline that
+ *      would collide with ours).
+ *   2. Explicit `options.cspNonce`:
+ *        - string  → use verbatim
+ *        - true    → auto-generate
+ *        - false   → off
+ *   3. No option → off (preserves legacy behavior byte-identical).
+ *
+ * Auto-generation uses `crypto.getRandomValues` with 16 bytes → 128 bits
+ * of entropy, matching OWASP guidance and the existing
+ * `@mandujs/core/middleware/secure` CSP nonce generator.
+ *
+ * Only invoked when we actually intend to emit a preamble (i.e. dev mode
+ * + `needsHydration` + populated `shared.fastRefresh`). Returns
+ * `undefined` when CSP nonce emission is disabled; the caller short-
+ * circuits the `nonce=` attribute and skips the response CSP header.
+ */
+function resolveFastRefreshCspNonce(
+  opt: SSROptions["cspNonce"],
+): string | undefined {
+  // Opt-out: env var takes absolute precedence. Read lazily because
+  // process is not available in some edge runtimes.
+  try {
+    if (typeof process !== "undefined" && process.env && process.env.MANDU_CSP_NONCE === "0") {
+      return undefined;
+    }
+  } catch {
+    /* some runtimes lock down `process` access — treat as unset */
+  }
+  if (opt === false || opt === undefined) return undefined;
+  if (typeof opt === "string" && opt.length > 0) return opt;
+  if (opt === true) return generateCspNonce();
+  return undefined;
+}
+/**
+ * Phase 7.2 R1 Agent C (H1) — Generate a fresh CSP nonce.
+ *
+ * 16 bytes (128 bits) of cryptographic entropy, base64-encoded. Matches
+ * `packages/core/src/middleware/secure/csp.ts#resolveNonce`. The same
+ * encoding keeps the nonce attribute short (≤24 base64 chars) and
+ * compatible with OWASP CSP3 guidance.
+ *
+ * Exported as `_testOnly_generateCspNonce` below for tests to verify
+ * entropy and encoding without depending on the specific platform.
+ */
+function generateCspNonce(): string {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  // Bun / Node 20+ both expose btoa + String.fromCharCode; avoid the
+  // Buffer dependency for portability. Node has `btoa` since v16.
+  let bin = "";
+  for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);
+  return btoa(bin);
+}
+/**
+ * Phase 7.2 R1 Agent C (H1) — Build the `Content-Security-Policy`
+ * header value to pair with a nonce-bearing preamble.
+ *
+ * Minimal and permissive by design — we are specifically writing a
+ * DEV-mode header that lets the Fast Refresh preamble + dynamic
+ * imports execute. We deliberately do NOT emit a blanket CSP for the
+ * entire page; that is the job of `@mandujs/core/middleware/secure` or
+ * the project's edge. Our sole concern here is: the inline preamble
+ * MUST be authorized without forcing the user to hand-write
+ * `'unsafe-inline'` in their policy.
+ *
+ * Header shape:
+ *   `script-src 'self' 'nonce-<n>' 'strict-dynamic'`
+ *
+ * Why `'strict-dynamic'`: once the nonced preamble runs, it loads the
+ * Fast Refresh runtime via `import('/.mandu/client/...')`. Without
+ * `'strict-dynamic'` the module graph would need to be nonce-tagged
+ * end-to-end, which Bun.build does not support today.
+ */
+function buildFastRefreshCspHeader(nonce: string): string {
+  // Nonces are already URL-safe / base64 but we defensively strip any
+  // stray quotes — should be impossible given the generator, but this
+  // closes the door on a caller-supplied nonce that slipped a quote in.
+  const safe = nonce.replace(/["\\\r\n]/g, "");
+  return `script-src 'self' 'nonce-${safe}' 'strict-dynamic'`;
+}
+/** @internal test helper — exposed only so unit tests can inspect the generator. */
+export const _testOnly_generateCspNonce = generateCspNonce;
+/** @internal test helper — exposed only so unit tests can inspect the resolver. */
+export const _testOnly_resolveFastRefreshCspNonce = resolveFastRefreshCspNonce;
+/** @internal test helper — exposed only so unit tests can inspect the header builder. */
+export const _testOnly_buildFastRefreshCspHeader = buildFastRefreshCspHeader;
+/** @internal test helper — exposed only so unit tests can inspect the preamble tag emitter. */
+export const _testOnly_generateFastRefreshPreambleTag = generateFastRefreshPreambleTag;
+/**
+ * Phase 7.2 R1 Agent C (H1) — Internal WeakMap that ferries the
+ * CSP nonce chosen during a `renderToHTML` call back to the caller
+ * (`renderSSR` / `renderWithHydration`) so they can emit the matching
+ * `Content-Security-Policy` response header.
+ *
+ * Keyed by the `options` object identity — the only caller that cares
+ * reuses the same options instance it handed in. External consumers
+ * of `renderToHTML` (tests, advanced users) are unaffected: they
+ * simply never look up the map and no memory accumulates because
+ * WeakMap entries collect when their key reference dies.
+ */
+const OPTIONS_TO_NONCE = new WeakMap<object, string>();
+/** @internal surface for unit tests — do not use in application code. */
+export function _testOnly_getAttachedCspNonce(options: SSROptions): string | undefined {
+  return OPTIONS_TO_NONCE.get(options as object);
+}
 export function renderToHTML(element: ReactElement, options: SSROptions = {}): string {
   const {
     title = "Mandu App",
@@ -276,6 +473,25 @@ export function renderToHTML(element: ReactElement, options: SSROptions = {}): s
     hmrScript = generateHMRScript(hmrPort);
   }
+  // Phase 7.1 R2 Agent D: Fast Refresh preamble. Must land in <head>
+  // BEFORE any island `<script type="module">` evaluates — the stubs it
+  // installs for `$RefreshReg$` / `$RefreshSig$` are required by every
+  // module the bundler transformed with `reactFastRefresh: true`. Dev
+  // mode only; prod manifests omit `shared.fastRefresh` so the helper
+  // returns "".
+  // Phase 7.2 R1 Agent C (H1): resolve nonce up-front so the same
+  // value is reused for the <script> tag AND surfaced to the caller
+  // (via `renderToHTMLWithMeta`) for the response CSP header.
+  const resolvedCspNonce = needsHydration && isDev
+    ? resolveFastRefreshCspNonce(options.cspNonce)
+    : undefined;
+  if (resolvedCspNonce) {
+    OPTIONS_TO_NONCE.set(options as object, resolvedCspNonce);
+  }
+  const fastRefreshPreamble = needsHydration
+    ? generateFastRefreshPreambleTag(isDev, bundleManifest, resolvedCspNonce)
+    : "";
   // DevTools 번들 로드 (개발 모드)
   let devtoolsScript = "";
   if (isDev) {
@@ -303,6 +519,7 @@ export function renderToHTML(element: ReactElement, options: SSROptions = {}): s
   ${hoistedLinkTags}
   ${headTags}
   ${collectedHeadTags}
+  ${fastRefreshPreamble}
 </head>
 <body>
   <div id="root">${bodyContent}</div>
@@ -363,6 +580,17 @@ function generateClientRouterScript(manifest: BundleManifest): string {
 /**
  * HMR 스크립트 생성
+ *
+ * Phase 7.2 Agent B — HDR (Hot Data Revalidation) extension.
+ * When the CLI broadcasts `{type: "vite", payload: {type: "custom",
+ * event: "mandu:slot-refetch", data: {routeId, slotPath, ...}}}` (via
+ * `hmrServer.broadcastVite`) we handle it here without remounting
+ * the React tree: fetch the current URL with `X-Mandu-HDR: 1`,
+ * receive JSON loader data, and hand it to the router's
+ * `applyHDRUpdate` hook (installed by `initializeRouter`). If the
+ * route doesn't match, the router hook is missing, or the fetch
+ * fails — we fall back to `location.reload()`. See the detailed
+ * design notes in `bundler/dev.ts:generateHMRClientScript` docstring.
  */
 function generateHMRScript(port: number): string {
   const hmrPort = port + PORTS.HMR_OFFSET;
@@ -382,6 +610,66 @@ window.__MANDU_HMR_PORT__ = ${hmrPort};
     }
   }
+  function hdrCurrentRouteId() {
+    var rs = window.__MANDU_ROUTER_STATE__;
+    if (rs && rs.currentRoute && rs.currentRoute.id) return String(rs.currentRoute.id);
+    var r = window.__MANDU_ROUTE__;
+    if (r && r.id) return String(r.id);
+    return null;
+  }
+  function hdrFallback(reason) {
+    console.log('[Mandu HDR] Fallback full reload' + (reason ? ' (' + reason + ')' : ''));
+    location.reload();
+  }
+  function hdrMark(name, data) {
+    try {
+      if (window.__MANDU_HDR__ && typeof window.__MANDU_HDR__.perfMark === 'function') {
+        window.__MANDU_HDR__.perfMark(name, data);
+      }
+    } catch (_) {}
+  }
+  function handleSlotRefetch(data) {
+    var routeId = data && typeof data.routeId === 'string' ? data.routeId : null;
+    if (!routeId) { hdrFallback('no-routeId'); return; }
+    if (window.__MANDU_HDR_DISABLED__ === true) { hdrFallback('disabled'); return; }
+    var currentId = hdrCurrentRouteId();
+    if (currentId !== routeId) {
+      console.log('[Mandu HDR] slot-refetch for ' + routeId + ' ignored (current route: ' + currentId + ')');
+      return;
+    }
+    var started = typeof performance !== 'undefined' && performance.now ? performance.now() : Date.now();
+    hdrMark('hdr:refetch-start', { routeId: routeId, slotPath: data.slotPath });
+    var url = window.location.pathname + window.location.search;
+    var sep = url.indexOf('?') >= 0 ? '&' : '?';
+    var dataUrl = url + sep + '_data=1';
+    fetch(dataUrl, { credentials: 'same-origin', headers: { 'X-Mandu-HDR': '1' } })
+      .then(function (res) {
+        if (!res.ok) { hdrFallback('status-' + res.status); return null; }
+        return res.json();
+      })
+      .then(function (payload) {
+        if (!payload) return;
+        var revalidate = window.__MANDU_ROUTER_REVALIDATE__;
+        if (typeof revalidate !== 'function') { hdrFallback('no-router'); return; }
+        try {
+          revalidate(routeId, payload.loaderData);
+          var elapsed = (typeof performance !== 'undefined' && performance.now ? performance.now() : Date.now()) - started;
+          console.log('[Mandu HDR] Applied loader data for ' + routeId + ' in ' + elapsed.toFixed(0) + 'ms');
+          hdrMark('hdr:refetch', { routeId: routeId, slotPath: data.slotPath, elapsed: elapsed });
+        } catch (err) {
+          console.error('[Mandu HDR] Revalidate threw:', err);
+          hdrFallback('revalidate-throw');
+        }
+      })
+      .catch(function (err) {
+        console.error('[Mandu HDR] Fetch failed:', err);
+        hdrFallback('fetch-failed');
+      });
+  }
   function connect() {
     try {
       ws = new WebSocket('ws://' + window.location.hostname + ':${hmrPort}');
@@ -392,9 +680,26 @@ window.__MANDU_HMR_PORT__ = ${hmrPort};
       ws.onmessage = function(e) {
         try {
           var msg = JSON.parse(e.data);
-          if (msg.type === 'reload' || msg.type === 'island-update') {
+          // Vite-compat envelope: custom event for HDR.
+          if ((msg.type === 'vite' || msg.type === 'vite-replay') && msg.payload) {
+            if (msg.payload.type === 'custom' && msg.payload.event === 'mandu:slot-refetch') {
+              handleSlotRefetch(msg.payload.data || {});
+              return;
+            }
+            // Other Vite payloads fall through to the legacy branches
+            // when possible.
+            if (msg.payload.type === 'full-reload') {
+              location.reload();
+              return;
+            }
+          }
+          if (msg.type === 'reload' || msg.type === 'island-update' || msg.type === 'full-reload' || msg.type === 'layout-update' || msg.type === 'invalidate') {
             console.log('[Mandu HMR] Reloading...');
             location.reload();
+          } else if (msg.type === 'slot-refetch') {
+            // Legacy Mandu-internal path (not yet used by the server — kept
+            // for forward-compat).
+            handleSlotRefetch(msg.data || {});
           } else if (msg.type === 'css-update') {
             var cssPath = (msg.data && msg.data.cssPath) || '/.mandu/client/globals.css';
             var links = document.querySelectorAll('link[rel="stylesheet"]');
@@ -431,18 +736,38 @@ function generateDevtoolsScript(): string {
   return `<script type="module" src="/.mandu/client/_devtools.js"></script>`;
 }
-export function createHTMLResponse(html: string, status: number = 200): Response {
-  return new Response(html, {
-    status,
-    headers: {
-      "Content-Type": "text/html; charset=utf-8",
-    },
-  });
+export function createHTMLResponse(
+  html: string,
+  status: number = 200,
+  /**
+   * Phase 7.2 R1 Agent C (H1) — extra headers to merge in alongside
+   * the default `Content-Type`. Used for the Fast Refresh CSP header
+   * when a nonce was produced; can be repurposed for future
+   * per-response metadata without changing callsites.
+   */
+  extraHeaders?: Record<string, string>,
+): Response {
+  const headers: Record<string, string> = {
+    "Content-Type": "text/html; charset=utf-8",
+  };
+  if (extraHeaders) {
+    for (const [k, v] of Object.entries(extraHeaders)) {
+      headers[k] = v;
+    }
+  }
+  return new Response(html, { status, headers });
 }
 export function renderSSR(element: ReactElement, options: SSROptions = {}): Response {
   const html = renderToHTML(element, options);
-  return createHTMLResponse(html);
+  // Phase 7.2 R1 Agent C (H1): if a CSP nonce was produced during
+  // rendering (dev + fast-refresh path), emit the matching header so
+  // the inline preamble is authorized under strict CSP.
+  const nonce = _testOnly_getAttachedCspNonce(options);
+  const extra = nonce
+    ? { "Content-Security-Policy": buildFastRefreshCspHeader(nonce) }
+    : undefined;
+  return createHTMLResponse(html, 200, extra);
 }
 /**
@@ -472,5 +797,10 @@ export async function renderWithHydration(
   }
 ): Promise<Response> {
   const html = renderToHTML(element, options);
-  return createHTMLResponse(html);
+  // Phase 7.2 R1 Agent C (H1) — same CSP header logic as renderSSR.
+  const nonce = _testOnly_getAttachedCspNonce(options);
+  const extra = nonce
+    ? { "Content-Security-Policy": buildFastRefreshCspHeader(nonce) }
+    : undefined;
+  return createHTMLResponse(html, 200, extra);
 }