@webjsdev/server 0.8.88 → 0.8.89

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/server",
-  "version": "0.8.88",
+  "version": "0.8.89",
   "type": "module",
   "description": "The server for WebJs, a full-stack JavaScript framework built on web components with server-side rendering and no build step. Provides the file-based router, SSR, server actions, route handlers, middleware, and live reload on Node 24+ or Bun.",
   "main": "index.js",

package/src/context.js

@@ -178,9 +178,9 @@ setCspNonceProvider(() => {
   return match ? match[1] : '';
 });
 
-// Re-export for backwards-compat: callers that imported cspNonce from
-// @webjsdev/server still work. New code should import from
-// @webjsdev/core for browser-isomorphism.
+// `cspNonce` is also reachable from @webjsdev/server for server-only modules
+// (route handlers, actions); a layout or page imports it from @webjsdev/core
+// so the module stays browser-isomorphic.
 export { cspNonce };
 
 /**

package/src/importmap.js

@@ -296,11 +296,9 @@ export function vendorIntegrityFor(url) {
  * Initialized to the two minimum-safe defaults (the bare specifier
  * pointing at the browser source-mode entry and the catch-all prefix
  * pointing at `src/`) so any consumer that calls `buildImportMap()`
- * before `setCoreInstall` runs still gets a usable map. Pre-#118 the
- * legacy `coreMappings` were always derived from a boolean and so
- * could not be empty; this keeps that fail-open posture for embedded
- * SSR test helpers and one-shot tooling that imports `importmap.js`
- * without booting `dev.js`.
+ * before `setCoreInstall` runs still gets a usable map: a fail-open
+ * posture for embedded SSR test helpers and one-shot tooling that
+ * imports `importmap.js` without booting `dev.js`.
  *
  * @type {Record<string, string>}
  */
@@ -329,9 +327,7 @@ let _coreEntries = {
  * rebuilds today; if `@webjsdev/core/package.json` is edited in a
  * long-running dev session (e.g. workspace dev that runs a fresh
  * `npm run build:dist`), the derivation is refreshed on next server
- * restart, not on the watcher tick. Pre-#118 the legacy
- * `setCoreDistMode` had the same behaviour: only the dist-presence
- * boolean was watched, not the package.json itself.
+ * restart, not on the watcher tick.
  *
  * Like `setVendorEntries`, the importmap-hash is recomputed eagerly
  * so `importMapHash()` stays synchronous on the per-request SSR

package/src/rate-limit.js

@@ -313,9 +313,3 @@ export function parseWindow(w) {
   const mult = { ms: 1, s: 1000, m: 60_000, h: 3_600_000 }[unit];
   return n * (mult || 1);
 }
-
-/** Testing hook: reset the default store (for unit tests). */
-export function _resetRateLimits() {
-  // With the cache store, there's nothing to reset here: the store
-  // handles its own state. This function exists for API compatibility.
-}

package/src/session.js

@@ -235,7 +235,7 @@ export function storeSessionStorage(opts = {}) {
   };
 }
 
-// Backwards-compatible aliases
+// Short aliases
 export const cookieSession = cookieSessionStorage;
 export const storeSession = storeSessionStorage;
 

package/src/ssr/head.js

@@ -457,9 +457,9 @@ export function wrapHead(opts) {
 
   if (m.description) metaTags.push(`<meta name="description" content="${escapeAttr(m.description)}">`);
 
-  // viewport: support string form (legacy), `metadata.viewport` object form,
-  // and the new Next.js 14+ `export const viewport = { … }` shape captured
-  // into `_viewport` by collectMetadata.
+  // viewport: the `metadata.viewport` string or object form, or the Next.js
+  // 14+ `export const viewport = { … }` shape captured into `_viewport` by
+  // collectMetadata.
   let viewportStr = '';
   if (typeof m.viewport === 'string') {
     viewportStr = m.viewport;

package/src/ssr/render.js

@@ -830,7 +830,7 @@ async function ssrBoundaryHtml(file, heading, opts) {
       moduleUrls = [];
     }
   }
-  const nonce = opts.req ? getNonce(opts.req) : undefined;
+  const nonce = getNonce();
   return wrapInDocument(body, {
     metadata: { title: heading.replace(/^\d+:\s*/, '') },
     moduleUrls,
@@ -900,7 +900,7 @@ async function ssrNotFoundHtml(notFoundFile, opts) {
       moduleUrls = [];
     }
   }
-  const nonce = opts.req ? getNonce(opts.req) : undefined;
+  const nonce = getNonce();
   return wrapInDocument(body, {
     metadata: { title: 'Not found' },
     moduleUrls,
@@ -1194,7 +1194,7 @@ export async function ssrPage(route, params, url, opts) {
       ),
     );
     // Extract CSP nonce from request headers (if present).
-    const nonce = opts.req ? getNonce(opts.req) : undefined;
+    const nonce = getNonce();
     const wrapOpts = {
       metadata,
       moduleUrls,
@@ -1342,7 +1342,7 @@ export async function ssrPage(route, params, url, opts) {
     // Error paths still need to honor the request's CSP nonce so the
     // error page's boot scripts (when moduleUrls is non-empty) and
     // the meta csp-nonce tag both pass strict-CSP enforcement.
-    const errNonce = opts.req ? getNonce(opts.req) : undefined;
+    const errNonce = getNonce();
     // One dedup set for the whole 500 path: the walk below and the
     // global-error attempt after it collapse REPEATS of the same cause (a
     // shared layout that fails every attempt) while still reporting a

package/src/ssr/responses.js

@@ -16,19 +16,15 @@ import { escapeAttr, escapeHtml } from './escape.js';
  * scope. Delegates to `cspNonce()`, which returns the per-request nonce
  * the handler MINTED when CSP is enabled (issue #233), or, as a fallback,
  * the nonce parsed from an inbound `Content-Security-Policy` request
- * header (the legacy consume-only path). Using the same source as the
+ * header (a proxy that mints its own). Using the same source as the
  * `Content-Security-Policy` response header is what guarantees the inline
  * boot script, the importmap, the modulepreload hints, and the header all
- * carry the EXACT same nonce: one minted value, no drift.
+ * carry the EXACT same nonce: one minted value, no drift. The value comes
+ * from the request-scoped AsyncLocalStorage store, so it takes no request.
  *
- * `req` is accepted (and ignored) so existing call sites stay unchanged;
- * the value comes from the request-scoped AsyncLocalStorage store, not
- * the argument.
- *
- * @param {Request} [_req]
  * @returns {string | undefined}
  */
-export function getNonce(_req) {
+export function getNonce() {
   return cspNonce() || undefined;
 }