@reckona/mreact-router 0.0.203 → 0.0.205

package/src/cache.ts

@@ -1,4 +1,5 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { responseHeadersContainCspNonce } from "./csp.js";
 
 /**
  * Describes the cache lifetime assigned to a rendered route response.
@@ -73,7 +74,6 @@ export interface MemoryRouteCacheOptions {
 
 interface AppRouterCacheState {
   activeContexts: RouteCacheContext[];
-  invalidatedPaths: Set<string>;
   memoryCache: AppRouterCache;
   storage: AsyncLocalStorage<RouteCacheContext>;
 }
@@ -82,18 +82,42 @@ interface RouteCacheContext {
   cache: AppRouterCache;
   cachePolicy?: RouteCachePolicy | undefined;
   closed?: boolean | undefined;
+  externalInvalidationOverflowed: boolean;
+  externallyInvalidatedPaths: Set<string>;
   revalidatedPaths: Set<string>;
 }
 
+interface AppRouterCacheInvalidationState {
+  activeContexts: WeakMap<AppRouterCache, Set<RouteCacheContext>>;
+  disabledCaches: WeakSet<AppRouterCache>;
+  finalizer: FinalizationRegistry<WeakRef<AppRouterCache>>;
+  liveReferences: Set<WeakRef<AppRouterCache>>;
+  pendingPaths: WeakMap<AppRouterCache, Set<string>>;
+  registeredCaches: WeakSet<AppRouterCache>;
+  running: WeakMap<AppRouterCache, Promise<void>>;
+  storesBeingInvalidated: WeakMap<AppRouterCache, number>;
+}
+
+const MAX_PENDING_ROUTE_INVALIDATIONS = 1024;
+
+const cacheInvalidationState = ((
+  globalThis as {
+    __mreactAppRouterCacheInvalidation?: AppRouterCacheInvalidationState;
+  }
+).__mreactAppRouterCacheInvalidation ??= createCacheInvalidationState());
+cacheInvalidationState.activeContexts ??= new WeakMap();
+cacheInvalidationState.disabledCaches ??= new WeakSet();
+cacheInvalidationState.storesBeingInvalidated ??= new WeakMap();
+
 const cacheState = ((
   globalThis as { __mreactAppRouterCache?: AppRouterCacheState }
 ).__mreactAppRouterCache ??= {
   activeContexts: [],
-  invalidatedPaths: new Set(),
   memoryCache: createMemoryRouteCache(),
   storage: new AsyncLocalStorage<RouteCacheContext>(),
 });
 cacheState.storage ??= new AsyncLocalStorage<RouteCacheContext>();
+registerRouteCache(cacheState.memoryCache);
 
 /**
  * Creates an in-memory route response cache for app-router rendering.
@@ -164,7 +188,7 @@ export function createMemoryRouteCache(options: MemoryRouteCacheOptions = {}): A
     }
   }
 
-  return {
+  const cache: AppRouterCache = {
     deleteByPath(path) {
       const normalizedPath = normalizeRevalidationPath(path);
       const keys = keysByPath.get(normalizedPath);
@@ -212,6 +236,8 @@ export function createMemoryRouteCache(options: MemoryRouteCacheOptions = {}): A
       }
     },
   };
+  registerRouteCache(cache);
+  return cache;
 }
 
 function positiveIntegerOrDefault(value: number | undefined, fallback: number): number {
@@ -296,6 +322,10 @@ export function cachedRouteResponse(options: {
 
     const cache = options.cache ?? cacheState.memoryCache;
 
+    registerRouteCache(cache);
+    if (routeCacheIsUnavailable(cache)) {
+      return undefined;
+    }
     await consumeInvalidations(cache);
     const now = options.now ?? Date.now();
     const cached = await cache.get(options.key, now);
@@ -310,6 +340,9 @@ export function cachedRouteResponse(options: {
     }
 
     const headers = new Headers(cached.headers ?? {});
+    if (responseHeadersContainCspNonce(headers)) {
+      return undefined;
+    }
     headers.set("cache-control", cached.cacheControl);
     if (!headers.has("content-type")) {
       headers.set("content-type", "text/html; charset=utf-8");
@@ -367,6 +400,10 @@ export async function cacheRouteResponse(options: {
   const cacheControl = options.policy.cacheControl;
   const status = options.response.status;
   const contentType = options.response.headers.get("content-type") ?? "text/html; charset=utf-8";
+  const cache = options.cache ?? cacheState.memoryCache;
+  const normalizedPath = normalizeRevalidationPath(options.path);
+  registerRouteCache(cache);
+  const invalidatedBeforeStore = routeCachePathWasInvalidatedDuringActiveContext(normalizedPath);
 
   // A render that read a request header only produced HTML that is correct for
   // that header value. The cache key covers the path and query alone, so the
@@ -374,15 +411,23 @@ export async function cacheRouteResponse(options: {
   // shared caches too, which are keyed the same way.
   if (
     options.headerDependent === true ||
+    invalidatedBeforeStore ||
+    routeCacheIsUnavailable(cache) ||
     requestCarriesCredentials(options.request) ||
-    options.response.headers.has("set-cookie")
+    options.response.headers.has("set-cookie") ||
+    responseHeadersContainCspNonce(options.response.headers)
   ) {
     const headers = new Headers(options.response.headers);
     headers.set("cache-control", "private, no-store");
     if (!headers.has("content-type")) {
       headers.set("content-type", contentType);
     }
-    if (options.headerDependent === true) {
+    if (
+      options.headerDependent === true ||
+      invalidatedBeforeStore ||
+      routeCacheIsUnavailable(cache) ||
+      responseHeadersContainCspNonce(options.response.headers)
+    ) {
       headers.set("x-mreact-cache", "DYNAMIC");
     }
 
@@ -410,17 +455,57 @@ export async function cacheRouteResponse(options: {
   // from every later secure visitor.
   const hsts = options.strictTransportSecurity;
 
-  await (options.cache ?? cacheState.memoryCache).set(options.key, {
+  await cache.set(options.key, {
     body,
     cacheControl,
     expiresAt: (options.now ?? Date.now()) + options.policy.revalidateSeconds * 1000,
     headers: storedHeaders,
     ...(hsts === undefined ? {} : { strictTransportSecurity: hsts }),
-    path: normalizeRevalidationPath(options.path),
+    path: normalizedPath,
     schemaVersion: ROUTE_CACHE_ENTRY_SCHEMA_VERSION,
     status,
   });
 
+  if (
+    routeCachePathWasInvalidatedDuringActiveContext(normalizedPath) ||
+    routeCacheIsUnavailable(cache)
+  ) {
+    beginRouteCacheStoreInvalidation(cache);
+    try {
+      await cache.deleteByPath(normalizedPath);
+      endRouteCacheStoreInvalidation(cache);
+    } catch (error) {
+      // The invalidation may have completed before this asynchronous set did.
+      // If deleting the late write now fails, replace its exact key with an
+      // expired entry so another adapter object backed by the same persistent
+      // store cannot replay the stale current-schema value.
+      try {
+        await cache.set(options.key, {
+          body: "",
+          cacheControl: "no-store",
+          expiresAt: 0,
+          headers: {},
+          path: normalizedPath,
+          schemaVersion: ROUTE_CACHE_ENTRY_SCHEMA_VERSION,
+          status: 500,
+        });
+      } catch {
+        // The originating cache object still fails closed below even when the
+        // persistent backend rejects both deletion and the tombstone write.
+      }
+      cacheInvalidationState.disabledCaches.add(cache);
+      endRouteCacheStoreInvalidation(cache);
+      throw error;
+    }
+    const headers = new Headers(storedHeaders);
+    headers.set("cache-control", "private, no-store");
+    headers.set("x-mreact-cache", "DYNAMIC");
+    if (!headers.has("content-type")) {
+      headers.set("content-type", contentType);
+    }
+    return new Response(body, { headers, status });
+  }
+
   const headers = new Headers(storedHeaders);
   headers.set("cache-control", cacheControl);
   if (!headers.has("content-type")) {
@@ -541,7 +626,7 @@ const PUBLIC_ROUTE_CACHE_REQUEST_HEADERS = new Set([
 /**
  * Invalidates cached route responses for a normalized app-router path.
  *
- * During a request the invalidation is scoped to that route cache context; outside a request it is queued for the next cache access.
+ * During a request the invalidation is scoped to that route cache context. Outside a request it is broadcast to every live route cache registered in this process, and later reads wait for their cache's invalidation to finish.
  */
 export function revalidatePath(path: string): void {
   const normalizedPath = normalizeRevalidationPath(path);
@@ -552,31 +637,186 @@ export function revalidatePath(path: string): void {
     return;
   }
 
-  cacheState.invalidatedPaths.add(normalizedPath);
+  for (const reference of cacheInvalidationState.liveReferences) {
+    const cache = reference.deref();
+    if (cache === undefined) {
+      cacheInvalidationState.liveReferences.delete(reference);
+      continue;
+    }
+
+    const pendingPaths = cacheInvalidationState.pendingPaths.get(cache);
+    if (
+      pendingPaths !== undefined &&
+      !cacheInvalidationState.disabledCaches.has(cache) &&
+      !pendingPaths.has(normalizedPath)
+    ) {
+      if (pendingPaths.size >= MAX_PENDING_ROUTE_INVALIDATIONS) {
+        pendingPaths.clear();
+        cacheInvalidationState.disabledCaches.add(cache);
+      } else {
+        pendingPaths.add(normalizedPath);
+      }
+    }
+    markActiveRouteCacheContextsInvalidated(cache, normalizedPath);
+    void startPendingInvalidations(cache).catch(() => {});
+  }
 }
 
 export async function consumeInvalidations(
   cache: AppRouterCache = cacheState.memoryCache,
 ): Promise<void> {
-  if (cacheState.invalidatedPaths.size === 0) {
+  registerRouteCache(cache);
+  await startPendingInvalidations(cache);
+}
+
+function registerRouteCache(cache: AppRouterCache): void {
+  if (cacheInvalidationState.registeredCaches.has(cache)) {
     return;
   }
 
-  for (const path of cacheState.invalidatedPaths) {
-    await cache.deleteByPath(path);
+  cacheInvalidationState.registeredCaches.add(cache);
+  cacheInvalidationState.pendingPaths.set(cache, new Set());
+  const reference = new WeakRef(cache);
+  cacheInvalidationState.liveReferences.add(reference);
+  cacheInvalidationState.finalizer.register(cache, reference, reference);
+}
+
+function startPendingInvalidations(cache: AppRouterCache): Promise<void> {
+  const running = cacheInvalidationState.running.get(cache);
+  if (running !== undefined) {
+    return running;
   }
 
-  cacheState.invalidatedPaths.clear();
+  const paths = cacheInvalidationState.pendingPaths.get(cache);
+  if (paths === undefined || paths.size === 0) {
+    return Promise.resolve();
+  }
+
+  const task = drainPendingInvalidations(cache, paths);
+  cacheInvalidationState.running.set(cache, task);
+  void task
+    .finally(() => {
+      if (cacheInvalidationState.running.get(cache) === task) {
+        cacheInvalidationState.running.delete(cache);
+      }
+    })
+    .catch(() => {});
+  return task;
+}
+
+function createCacheInvalidationState(): AppRouterCacheInvalidationState {
+  const liveReferences = new Set<WeakRef<AppRouterCache>>();
+  return {
+    activeContexts: new WeakMap(),
+    disabledCaches: new WeakSet(),
+    finalizer: new FinalizationRegistry((reference) => {
+      liveReferences.delete(reference);
+    }),
+    liveReferences,
+    pendingPaths: new WeakMap(),
+    registeredCaches: new WeakSet(),
+    running: new WeakMap(),
+    storesBeingInvalidated: new WeakMap(),
+  };
+}
+
+function routeCacheIsUnavailable(cache: AppRouterCache): boolean {
+  return (
+    cacheInvalidationState.disabledCaches.has(cache) ||
+    (cacheInvalidationState.storesBeingInvalidated.get(cache) ?? 0) > 0
+  );
+}
+
+function beginRouteCacheStoreInvalidation(cache: AppRouterCache): void {
+  cacheInvalidationState.storesBeingInvalidated.set(
+    cache,
+    (cacheInvalidationState.storesBeingInvalidated.get(cache) ?? 0) + 1,
+  );
+}
+
+function endRouteCacheStoreInvalidation(cache: AppRouterCache): void {
+  const remaining = (cacheInvalidationState.storesBeingInvalidated.get(cache) ?? 1) - 1;
+  if (remaining <= 0) {
+    cacheInvalidationState.storesBeingInvalidated.delete(cache);
+  } else {
+    cacheInvalidationState.storesBeingInvalidated.set(cache, remaining);
+  }
+}
+
+function routeCachePathWasInvalidatedDuringActiveContext(path: string): boolean {
+  const context = activeRouteCacheContext();
+  return (
+    context !== undefined &&
+    (context.externalInvalidationOverflowed || context.externallyInvalidatedPaths.has(path))
+  );
+}
+
+function markActiveRouteCacheContextsInvalidated(
+  cache: AppRouterCache,
+  normalizedPath: string,
+): void {
+  for (const context of cacheInvalidationState.activeContexts.get(cache) ?? []) {
+    if (cacheInvalidationState.disabledCaches.has(cache)) {
+      context.externalInvalidationOverflowed = true;
+      context.externallyInvalidatedPaths.clear();
+    } else if (
+      !context.externallyInvalidatedPaths.has(normalizedPath) &&
+      context.externallyInvalidatedPaths.size >= MAX_PENDING_ROUTE_INVALIDATIONS
+    ) {
+      context.externalInvalidationOverflowed = true;
+      context.externallyInvalidatedPaths.clear();
+    } else {
+      context.externallyInvalidatedPaths.add(normalizedPath);
+    }
+  }
+}
+
+function registerActiveRouteCacheContext(context: RouteCacheContext): void {
+  const contexts = cacheInvalidationState.activeContexts.get(context.cache);
+  if (contexts === undefined) {
+    cacheInvalidationState.activeContexts.set(context.cache, new Set([context]));
+    return;
+  }
+
+  contexts.add(context);
+}
+
+function unregisterActiveRouteCacheContext(context: RouteCacheContext): void {
+  const contexts = cacheInvalidationState.activeContexts.get(context.cache);
+  contexts?.delete(context);
+  if (contexts?.size === 0) {
+    cacheInvalidationState.activeContexts.delete(context.cache);
+  }
+}
+
+async function drainPendingInvalidations(
+  cache: AppRouterCache,
+  paths: Set<string>,
+): Promise<void> {
+  while (paths.size > 0) {
+    const path = paths.values().next().value;
+    if (path === undefined) {
+      return;
+    }
+
+    await cache.deleteByPath(path);
+    paths.delete(path);
+  }
 }
 
 export async function withRouteCacheContext<T>(
   cache: AppRouterCache | undefined,
   fn: () => T | Promise<T>,
 ): Promise<{ cachePolicy: RouteCachePolicy | undefined; revalidatedPaths: string[]; value: T }> {
+  const routeCache = cache ?? cacheState.memoryCache;
+  registerRouteCache(routeCache);
   const context: RouteCacheContext = {
-    cache: cache ?? cacheState.memoryCache,
+    cache: routeCache,
+    externalInvalidationOverflowed: false,
+    externallyInvalidatedPaths: new Set(),
     revalidatedPaths: new Set(),
   };
+  registerActiveRouteCacheContext(context);
 
   return cacheState.storage.run(context, async () => {
     try {
@@ -592,6 +832,7 @@ export async function withRouteCacheContext<T>(
       return { cachePolicy, revalidatedPaths, value };
     } finally {
       context.closed = true;
+      unregisterActiveRouteCacheContext(context);
     }
   });
 }
@@ -600,12 +841,17 @@ export function beginRouteCacheContext(cache: AppRouterCache | undefined): {
   readonly cachePolicy: RouteCachePolicy | undefined;
   dispose(): Promise<{ revalidatedPaths: string[] }>;
 } {
+  const routeCache = cache ?? cacheState.memoryCache;
+  registerRouteCache(routeCache);
   const context: RouteCacheContext = {
-    cache: cache ?? cacheState.memoryCache,
+    cache: routeCache,
+    externalInvalidationOverflowed: false,
+    externallyInvalidatedPaths: new Set(),
     revalidatedPaths: new Set(),
   };
 
   cacheState.activeContexts.push(context);
+  registerActiveRouteCacheContext(context);
 
   return {
     get cachePolicy() {
@@ -623,6 +869,7 @@ export function beginRouteCacheContext(cache: AppRouterCache | undefined): {
         if (index !== -1) {
           cacheState.activeContexts.splice(index, 1);
         }
+        unregisterActiveRouteCacheContext(context);
       }
 
       return { revalidatedPaths };

package/src/cli.ts

@@ -64,7 +64,16 @@ if (parsed !== undefined) {
         const loaded =
           routeArg === undefined
             ? await loadMreactRouterViteConfigDetails({ command: "build", cwd: process.cwd() })
-            : { project: { appDir: resolve(routeArg) }, viteConfig: undefined };
+            : {
+                dehydrateOptions: undefined,
+                project: { appDir: resolve(routeArg) },
+                viteConfig: undefined,
+              };
+        if (loaded.dehydrateOptions !== undefined) {
+          throw new Error(
+            "Production builds must configure dehydratePolicyModule instead of an inline dehydrateOptions callback so generated runtimes use the same policy as prerendering.",
+          );
+        }
         try {
           const result = await buildApp({
             ...loaded.project,
@@ -151,12 +160,16 @@ if (parsed !== undefined) {
           routeArg === undefined
             ? await loadMreactRouterViteConfigDetails({ command: "serve", cwd: process.cwd() })
             : {
+                dehydrateOptions: undefined,
                 project: { appDir: resolve(routeArg) },
                 serverPort: undefined,
                 viteConfig: undefined,
               };
         const server = await startDevServer({
           ...loaded.project,
+          ...(loaded.dehydrateOptions === undefined
+            ? {}
+            : { dehydrateOptions: loaded.dehydrateOptions }),
           hostname: resolveCliHost(parsed.host, process.env),
           logger,
           port: resolveCliDevPort(parsed.port, process.env, loaded.serverPort),

package/src/client.ts

@@ -3937,7 +3937,7 @@ function __mreactFetchNavigationHtml(href) {
     ? { "x-mreact-navigation": "1", "x-mreact-navigation-cache": "reload" }
     : { "x-mreact-navigation": "1" };
 
-  return fetch(href, {
+  return fetch(__mreactStaticNavigationRequestHref(href), {
     headers,
   }).then((response) => {
     __mreactApplyRevalidationHeader(response);
@@ -3949,6 +3949,37 @@ function __mreactFetchNavigationHtml(href) {
   });
 }
 
+function __mreactStaticNavigationRequestHref(href) {
+  if (typeof document === "undefined" || typeof location === "undefined") {
+    return href;
+  }
+
+  const base = document
+    .querySelector('meta[name="mreact-static-navigation"]')
+    ?.getAttribute("content")
+    ?.trim();
+  if (base === undefined || base === "") {
+    return href;
+  }
+
+  try {
+    const destination = new URL(href, location.href);
+    if (destination.origin !== location.origin) {
+      return href;
+    }
+    const routePath = destination.pathname.replace(/^\\/+|\\/+$/g, "");
+    const artifactPath = routePath === "" ? "index.html" : routePath + "/index.html";
+    const artifact = new URL(
+      base.replace(/\\/+$/g, "") + "/" + artifactPath,
+      location.origin,
+    );
+    artifact.search = destination.search;
+    return artifact.href;
+  } catch {
+    return href;
+  }
+}
+
 function __mreactNavigationResponseRequiresDocumentReload(response) {
   return response.status === 204 || response.headers.get("x-mreact-navigation") === "reload";
 }

package/src/config.ts

@@ -37,6 +37,8 @@ export interface AppRouterProjectOptions {
   buildConcurrency?: number | undefined;
   buildTargets?: readonly AppRouterBuildTarget[] | undefined;
   clientSourceMaps?: AppRouterClientSourceMapOption | undefined;
+  /** Project-local server module exporting a named `dehydrateOptions` policy. */
+  dehydratePolicyModule?: string | undefined;
   /**
    * Legacy route root. When provided without routesDir/projectRoot, this keeps
    * the historical "appDir is the whole app boundary" behavior.
@@ -61,6 +63,7 @@ export interface ResolvedAppRouterProject {
   buildTargets: readonly AppRouterBuildTarget[];
   clientSourceMaps: AppRouterClientSourceMapMode;
   clientConsolePureFunctions?: readonly string[] | undefined;
+  dehydratePolicyModule?: string | undefined;
   projectRoot: string;
   publicAssetBaseUrl?: string | undefined;
   publicDir: string;
@@ -80,11 +83,12 @@ export function resolveAppRouterProjectOptions(
     options.routesDir === undefined
   ) {
     const appDir = resolve(options.appDir);
+    const allowedSourceDirs = (options.allowedSourceDirs ?? [appDir]).map((directory) =>
+      resolveProjectPath(appDir, directory, "allowedSourceDirs"),
+    );
 
     return {
-      allowedSourceDirs: (options.allowedSourceDirs ?? [appDir]).map((directory) =>
-        resolveProjectPath(appDir, directory, "allowedSourceDirs"),
-      ),
+      allowedSourceDirs,
       ...(options.assetBaseUrl === undefined ? {} : { assetBaseUrl: options.assetBaseUrl }),
       ...(options.buildConcurrency === undefined
         ? {}
@@ -92,6 +96,15 @@ export function resolveAppRouterProjectOptions(
       buildTargets: resolveBuildTargets(options.buildTargets),
       clientSourceMaps: resolveClientSourceMapMode(options.clientSourceMaps),
       ...(clientConsolePureFunctions === undefined ? {} : { clientConsolePureFunctions }),
+      ...(options.dehydratePolicyModule === undefined
+        ? {}
+        : {
+            dehydratePolicyModule: resolvePolicyModule(
+              appDir,
+              options.dehydratePolicyModule,
+              allowedSourceDirs,
+            ),
+          }),
       projectRoot: appDir,
       ...(options.publicAssetBaseUrl === undefined
         ? {}
@@ -105,11 +118,12 @@ export function resolveAppRouterProjectOptions(
   const routesDir = resolveProjectPath(projectRoot, options.routesDir ?? "src/app", "routesDir");
   const defaultAllowedSourceDirs =
     options.routesDir === undefined ? ["src"] : [defaultAllowedSourceDir(projectRoot, routesDir)];
+  const allowedSourceDirs = (options.allowedSourceDirs ?? defaultAllowedSourceDirs).map(
+    (directory) => resolveProjectPath(projectRoot, directory, "allowedSourceDirs"),
+  );
 
   return {
-    allowedSourceDirs: (options.allowedSourceDirs ?? defaultAllowedSourceDirs).map((directory) =>
-      resolveProjectPath(projectRoot, directory, "allowedSourceDirs"),
-    ),
+    allowedSourceDirs,
     ...(options.assetBaseUrl === undefined ? {} : { assetBaseUrl: options.assetBaseUrl }),
     ...(options.buildConcurrency === undefined
       ? {}
@@ -117,6 +131,15 @@ export function resolveAppRouterProjectOptions(
     buildTargets: resolveBuildTargets(options.buildTargets),
     clientSourceMaps: resolveClientSourceMapMode(options.clientSourceMaps),
     ...(clientConsolePureFunctions === undefined ? {} : { clientConsolePureFunctions }),
+    ...(options.dehydratePolicyModule === undefined
+      ? {}
+      : {
+          dehydratePolicyModule: resolvePolicyModule(
+            projectRoot,
+            options.dehydratePolicyModule,
+            allowedSourceDirs,
+          ),
+        }),
     projectRoot,
     ...(options.publicAssetBaseUrl === undefined
       ? {}
@@ -126,6 +149,20 @@ export function resolveAppRouterProjectOptions(
   };
 }
 
+function resolvePolicyModule(
+  projectRoot: string,
+  modulePath: string,
+  allowedSourceDirs: readonly string[],
+): string {
+  const resolvedModule = resolveProjectPath(projectRoot, modulePath, "dehydratePolicyModule");
+  if (!allowedSourceDirs.some((directory) => isInsideDirectory(directory, resolvedModule))) {
+    throw new Error(
+      `mreactRouter dehydratePolicyModule must resolve inside allowedSourceDirs: ${resolvedModule}`,
+    );
+  }
+  return resolvedModule;
+}
+
 function defaultAllowedSourceDir(projectRoot: string, routesDir: string): string {
   const sourceRoot = dirname(routesDir);
   return basename(routesDir) === "app" && sourceRoot !== projectRoot ? sourceRoot : routesDir;

package/src/csp.ts

@@ -18,6 +18,17 @@ export interface ContentSecurityPolicyInput {
   replace?: Record<string, readonly string[] | string>;
 }
 
+export function responseHeadersContainCspNonce(headers: Headers): boolean {
+  for (const name of ["content-security-policy", "content-security-policy-report-only"]) {
+    const value = headers.get(name);
+    if (value !== null && /(?:^|[\s;,])'nonce-[^']+'(?=$|[\s;,])/i.test(value)) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
 const VALID_NONCE = /^[A-Za-z0-9+/=_-]+$/;
 const VALID_DIRECTIVE_NAME = /^[a-z][a-z0-9-]*$/i;
 // One CSP "source expression". Reject anything containing `;`, quote,
@@ -46,13 +57,7 @@ function isValidDirectiveValue(value: string): boolean {
   for (let index = 0; index < value.length; index += 1) {
     const code = value.charCodeAt(index);
 
-    if (
-      code <= 0x20 ||
-      code === 0x22 ||
-      code === 0x27 ||
-      code === 0x3b ||
-      code === 0x7f
-    ) {
+    if (code <= 0x20 || code === 0x22 || code === 0x27 || code === 0x3b || code === 0x7f) {
       return false;
     }
   }
@@ -84,9 +89,7 @@ export function contentSecurityPolicy(
 
     for (const rawValue of rawValues) {
       if (typeof rawValue !== "string" || !isValidDirectiveValue(rawValue)) {
-        throw new TypeError(
-          `invalid CSP directive value for ${name}: ${JSON.stringify(rawValue)}`,
-        );
+        throw new TypeError(`invalid CSP directive value for ${name}: ${JSON.stringify(rawValue)}`);
       }
     }
 
@@ -99,5 +102,5 @@ export function contentSecurityPolicy(
     serialized.push(`${name} ${values.join(" ")}`);
   }
 
-  return serialized.join("; ");
+  return serialized.length === 0 ? undefined : serialized.join("; ");
 }

package/src/dehydrate-policy.ts

@@ -0,0 +1,23 @@
+import type { DehydrateOptions } from "@reckona/mreact-query";
+
+export function dehydrateOptionsFromModule(
+  module: unknown,
+  label: string,
+): DehydrateOptions {
+  if (module === null || typeof module !== "object" || !("dehydrateOptions" in module)) {
+    throw new Error(`${label} must export a named dehydrateOptions object.`);
+  }
+
+  const dehydrateOptions = (module as { dehydrateOptions?: unknown }).dehydrateOptions;
+  if (dehydrateOptions === null || typeof dehydrateOptions !== "object") {
+    throw new Error(`${label} must export a named dehydrateOptions object.`);
+  }
+
+  const shouldDehydrateQuery = (dehydrateOptions as { shouldDehydrateQuery?: unknown })
+    .shouldDehydrateQuery;
+  if (shouldDehydrateQuery !== undefined && typeof shouldDehydrateQuery !== "function") {
+    throw new Error(`${label} dehydrateOptions.shouldDehydrateQuery must be a function.`);
+  }
+
+  return dehydrateOptions as DehydrateOptions;
+}