catalyst-core 1.1.0 → 1.2.0-canary.1

package/dist/server/renderer/extract.d.ts

@@ -35,12 +35,14 @@ export declare const getDeferredPreloadScriptUrls: (routeKey: any, excludeUrls?:
  * React <link rel="modulepreload"> elements (deduped). Use before matching <script type="module">.
  * @param {string[]} jsUrls
  * @param {string} [keyPrefix] - Unique prefix for React keys when rendering multiple lists.
+ * @param {string} [nonce] - CSP nonce, applied when nonce-based CSP is enabled (see CSP_NONCE_ENABLE).
  */
-export declare const generateModulePreloadLinkElements: (jsUrls?: any, keyPrefix?: string) => React.DetailedReactHTMLElement<{
+export declare const generateModulePreloadLinkElements: (jsUrls?: any, keyPrefix?: string, nonce?: string) => React.DetailedReactHTMLElement<{
     key: string;
     rel: string;
     href: any;
     fetchPriority: string;
+    nonce?: string;
 }, HTMLElement>[];
 /**
  * Read CSS files from disk and return concatenated CSS string for inlining.
@@ -51,17 +53,22 @@ export declare const generateModulePreloadLinkElements: (jsUrls?: any, keyPrefix
 export declare const readCssFromDisk: (cssPaths?: any, basePath?: string) => string;
 /**
  * <script type="module"> React elements for JS assets.
+ * @param {string[]} jsUrls
+ * @param {string} [nonce] - CSP nonce, applied when nonce-based CSP is enabled (see CSP_NONCE_ENABLE).
  */
-export declare const generateScriptElements: (jsUrls?: any) => React.ReactElement<{
+export declare const generateScriptElements: (jsUrls?: any, nonce?: string) => React.DetailedReactHTMLElement<{
     key: string;
     type: string;
     src: any;
-}, string | React.JSXElementConstructor<any>>[];
+    nonce?: string;
+}, HTMLElement>[];
 /**
  * <link rel="stylesheet"> HTML strings for deferred CSS (non-blocking, after body).
  */
 export declare const generateCssLinkStrings: (cssUrls?: any) => string;
 /**
  * <link rel="modulepreload"> + <script type="module"> HTML strings.
+ * @param {string[]} jsUrls
+ * @param {string} [nonce] - CSP nonce, applied when nonce-based CSP is enabled (see CSP_NONCE_ENABLE).
  */
-export declare const generateScriptStrings: (jsUrls?: any) => string;
+export declare const generateScriptStrings: (jsUrls?: any, nonce?: string) => string;

package/dist/server/renderer/extract.js

@@ -88,12 +88,16 @@ export const getDeferredPreloadScriptUrls = (routeKey, excludeUrls = []) => {
  * React <link rel="modulepreload"> elements (deduped). Use before matching <script type="module">.
  * @param {string[]} jsUrls
  * @param {string} [keyPrefix] - Unique prefix for React keys when rendering multiple lists.
+ * @param {string} [nonce] - CSP nonce, applied when nonce-based CSP is enabled (see CSP_NONCE_ENABLE).
  */
-export const generateModulePreloadLinkElements = (jsUrls = [], keyPrefix = "modulepreload") => [...new Set(jsUrls)].map((url, i) => React.createElement("link", {
+export const generateModulePreloadLinkElements = (jsUrls = [], keyPrefix = "modulepreload", nonce) => [...new Set(jsUrls)].map((url, i) => React.createElement("link", {
   key: `${keyPrefix}-${i}`,
   rel: "modulepreload",
   href: url,
-  fetchPriority: "high"
+  fetchPriority: "high",
+  ...(nonce ? {
+    nonce
+  } : {})
 }));
 
 /**
@@ -131,11 +135,16 @@ export const readCssFromDisk = (cssPaths = [], basePath) => {
 
 /**
  * <script type="module"> React elements for JS assets.
+ * @param {string[]} jsUrls
+ * @param {string} [nonce] - CSP nonce, applied when nonce-based CSP is enabled (see CSP_NONCE_ENABLE).
  */
-export const generateScriptElements = (jsUrls = []) => [...new Set(jsUrls)].map((url, i) => React.createElement("script", {
+export const generateScriptElements = (jsUrls = [], nonce) => [...new Set(jsUrls)].map((url, i) => React.createElement("script", {
   key: `js-${i}`,
   type: "module",
-  src: url
+  src: url,
+  ...(nonce ? {
+    nonce
+  } : {})
 }));
 
 // ── HTML strings (for streaming injection after body via res.write) ────
@@ -147,7 +156,12 @@ export const generateCssLinkStrings = (cssUrls = []) => [...new Set(cssUrls)].ma
 
 /**
  * <link rel="modulepreload"> + <script type="module"> HTML strings.
+ * @param {string[]} jsUrls
+ * @param {string} [nonce] - CSP nonce, applied when nonce-based CSP is enabled (see CSP_NONCE_ENABLE).
  */
-export const generateScriptStrings = (jsUrls = []) => [...new Set(jsUrls)].map(url => {
-  return `<script type="module" src="${url}"></script>`;
-}).join("");
+export const generateScriptStrings = (jsUrls = [], nonce) => {
+  const nonceAttr = nonce ? ` nonce="${nonce}"` : "";
+  return [...new Set(jsUrls)].map(url => {
+    return `<script type="module"${nonceAttr} src="${url}"></script>`;
+  }).join("");
+};

package/dist/server/renderer/handler.jsx

@@ -14,6 +14,7 @@ import { validateConfigureStore, validateGetRoutes, validateCustomDocument, hand
 import { ChunkExtractor } from "./ChunkExtractor.js";
 import { readCssFromDisk, generateScriptElements, generateScriptStrings, getDeferredRouteKey, getCachedDeferredCssPathsForRoute, registerDeferredAssetsForRoute, getDeferredPreloadScriptUrls, generateModulePreloadLinkElements } from "./extract.js";
 import path from "path";
+import crypto from "node:crypto";
 import { Transform } from "node:stream";
 import CustomDocument from "@catalyst/template/server/document";
 import App from "@catalyst/template/src/js/containers/App/index";
@@ -185,6 +186,13 @@ if (process.env.OTEL_ENABLE === true) {
   }
 }
 const SSR_SERVICE = process.env.SERVICE_NAME || `pwa-${process.env.APPLICATION}-node-server`;
+
+// Config-driven (config.json → CSP_NONCE_ENABLE): when on, every script Catalyst injects
+// carries a per-request nonce so the app can serve a nonce-based CSP without opening up
+// 'unsafe-inline'. Off by default — no behavior change unless explicitly enabled.
+// Same boolean contract as OTEL_ENABLE above.
+const CSP_NONCE_ENABLE = process.env.CSP_NONCE_ENABLE === true;
+const generateNonce = () => crypto.randomBytes(16).toString("base64");
 const traceHook = (fn, spanName) => typeof fn === "function" ? withSyncObservability(SSR_SERVICE, fn, spanName) : fn;
 const onRouteMatch = traceHook(_onRouteMatch, "onRouteMatch");
 const onFetcherSuccess = traceHook(_onFetcherSuccess, "onFetcherSuccess");
@@ -235,7 +243,7 @@ const getComponent = (store, context, req, fetcherData, isBot) => <div id="app">
     </div>;
 
 // ── Render and stream ──────────────────────────────────────────────────
-const _renderMarkUp = async (errorCode, req, res, metaTags, fetcherData, store, allMatches, context, chunkExtractor) => {
+const _renderMarkUp = async (errorCode, req, res, metaTags, fetcherData, store, allMatches, context, chunkExtractor, nonce) => {
   const deviceDetails = getUserAgentDetails(req.headers["user-agent"] || "");
   // Match mweb's wider definition: synthetic monitors (StatusCake) and AI crawlers
   // also need the bot code path — no JS, and split(... ssr: false ...) widgets that
@@ -265,10 +273,10 @@ const _renderMarkUp = async (errorCode, req, res, metaTags, fetcherData, store,
   const inlineCss = readCssFromDisk(criticalAssets.css, buildDir);
   const deferredRouteKey = getDeferredRouteKey(req, allMatches);
   const deferredRouteInlineCss = readCssFromDisk(getCachedDeferredCssPathsForRoute(deferredRouteKey), buildDir);
-  const jsScripts = generateScriptElements(criticalAssets.js);
-  const criticalPreloadLinks = generateModulePreloadLinkElements(criticalAssets.js, "critical-js");
+  const jsScripts = generateScriptElements(criticalAssets.js, nonce);
+  const criticalPreloadLinks = generateModulePreloadLinkElements(criticalAssets.js, "critical-js", nonce);
   const deferredPreloadUrls = getDeferredPreloadScriptUrls(deferredRouteKey, criticalAssets.js);
-  const deferredPreloadLinks = generateModulePreloadLinkElements(deferredPreloadUrls, "deferred-js");
+  const deferredPreloadLinks = generateModulePreloadLinkElements(deferredPreloadUrls, "deferred-js", nonce);
 
   // Build Head props
   const shellStart = renderStart({
@@ -295,7 +303,8 @@ const _renderMarkUp = async (errorCode, req, res, metaTags, fetcherData, store,
     req,
     res,
     safeArea,
-    statusCode: status
+    statusCode: status,
+    nonce
   };
   const CompleteDocument = () => {
     // CustomDocument is an OPTIONAL export (server/document.js) — its
@@ -307,8 +316,8 @@ const _renderMarkUp = async (errorCode, req, res, metaTags, fetcherData, store,
       if (customDocErr) handleError(customDocErr);else return CustomDocument(finalProps);
     }
     return <html lang={finalProps.lang}>
-                <Head isBot={finalProps.isBot} inlineCss={finalProps.inlineCss} deferredRouteInlineCss={finalProps.deferredRouteInlineCss} jsScripts={finalProps.jsScripts} criticalPreloadLinks={finalProps.criticalPreloadLinks} deferredPreloadLinks={finalProps.deferredPreloadLinks} fetcherData={finalProps.fetcherData} metaTags={finalProps.metaTags} publicAssetPath={finalProps.publicAssetPath} />
-                <Body initialState={finalProps.initialState} jsx={finalProps.jsx} statusCode={finalProps.statusCode} fetcherData={finalProps.fetcherData} safeArea={finalProps.safeArea} />
+                <Head isBot={finalProps.isBot} inlineCss={finalProps.inlineCss} deferredRouteInlineCss={finalProps.deferredRouteInlineCss} jsScripts={finalProps.jsScripts} criticalPreloadLinks={finalProps.criticalPreloadLinks} deferredPreloadLinks={finalProps.deferredPreloadLinks} fetcherData={finalProps.fetcherData} metaTags={finalProps.metaTags} publicAssetPath={finalProps.publicAssetPath} nonce={finalProps.nonce} />
+                <Body initialState={finalProps.initialState} jsx={finalProps.jsx} statusCode={finalProps.statusCode} fetcherData={finalProps.fetcherData} safeArea={finalProps.safeArea} nonce={finalProps.nonce} />
             </html>;
   };
   try {
@@ -333,15 +342,16 @@ const _renderMarkUp = async (errorCode, req, res, metaTags, fetcherData, store,
             js: [],
             css: []
           };
+          const nonceAttr = nonce ? ` nonce="${nonce}"` : "";
 
           // Tell client which components were SSR'd so split() can
           // eagerly import them (prevents Suspense fallback flash)
-          this.push(`<script>window.__CATALYST_IS_BOT__=${isBot ? "true" : "false"};</script>`);
+          this.push(`<script${nonceAttr}>window.__CATALYST_IS_BOT__=${isBot ? "true" : "false"};</script>`);
           if (chunkExtractor) {
             const renderedKeys = chunkExtractor.getRenderedComponentKeys();
             this.push(
             // nosemgrep: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag - renderedKeys are internal bundler component-module keys tracked by ChunkExtractor, never request/user input, and are JSON.stringify-escaped before embedding.
-            `<script>window.__SSR_RENDERED_COMPONENTS__=new Set(${JSON.stringify(renderedKeys)})</script>`);
+            `<script${nonceAttr}>window.__SSR_RENDERED_COMPONENTS__=new Set(${JSON.stringify(renderedKeys)})</script>`);
           }
           const {
             newCssPaths
@@ -350,7 +360,7 @@ const _renderMarkUp = async (errorCode, req, res, metaTags, fetcherData, store,
             this.push(`<style>${readCssFromDisk(newCssPaths, buildDir)}</style>`);
           }
           if (!isBot) {
-            this.push(generateScriptStrings(deferredAssets.js));
+            this.push(generateScriptStrings(deferredAssets.js, nonce));
           }
           cb();
         }
@@ -363,6 +373,8 @@ const _renderMarkUp = async (errorCode, req, res, metaTags, fetcherData, store,
       const {
         pipe
       } = renderToPipeableStream(<CompleteDocument />, {
+        // Nonces React's own streamed inline scripts (Suspense boundary swaps)
+        nonce,
         onShellReady() {
           res.setHeader("content-type", "text/html");
           pipe(tail);
@@ -430,6 +442,12 @@ async function _handler(req, res) {
       return;
     }
     const store = await createStore({}, req, res);
+
+    // If app-level middleware already generated a nonce for its CSP header
+    // (res.locals.cspNonce), reuse it so the header and the script tags match.
+    // Otherwise generate one here and expose it the same way.
+    const nonce = CSP_NONCE_ENABLE ? res.locals.cspNonce || generateNonce() : undefined;
+    if (nonce) res.locals.cspNonce = nonce;
     const cachedRoutes = getCachedRoutes();
     const allMatches = cachedRoutes ? NestedMatchRoutes(cachedRoutes, req.originalUrl) || [] : [];
     let allTags = [];
@@ -474,7 +492,7 @@ async function _handler(req, res) {
           });
           if (res.headersSent) return;
           const statusCode = err.status_code || 404;
-          await tracedRenderMarkUp(statusCode, req, res, allTags, fetcherData, store, allMatches, context, chunkExtractor);
+          await tracedRenderMarkUp(statusCode, req, res, allTags, fetcherData, store, allMatches, context, chunkExtractor, nonce);
         } else {
           safeCall(onFetcherSuccess, {
             req,
@@ -482,7 +500,7 @@ async function _handler(req, res) {
             store
           });
           if (res.headersSent) return;
-          await tracedRenderMarkUp(null, req, res, allTags, fetcherData, store, allMatches, context, chunkExtractor);
+          await tracedRenderMarkUp(null, req, res, allTags, fetcherData, store, allMatches, context, chunkExtractor, nonce);
         }
       } catch (error) {
         if (isRenderFailure(error)) throw error;
@@ -495,7 +513,7 @@ async function _handler(req, res) {
         });
         if (res.headersSent) return;
         const chunkExtractor = collectAssets(req, allMatches);
-        await tracedRenderMarkUp(404, req, res, allTags, fetcherData, store, allMatches, context, chunkExtractor);
+        await tracedRenderMarkUp(404, req, res, allTags, fetcherData, store, allMatches, context, chunkExtractor, nonce);
       }
     } catch (error) {
       if (isRenderFailure(error)) throw error;
@@ -508,7 +526,7 @@ async function _handler(req, res) {
       });
       if (res.headersSent) return;
       const chunkExtractor = collectAssets(req, allMatches);
-      await tracedRenderMarkUp(error.status_code, req, res, allTags, fetcherData, store, allMatches, context, chunkExtractor);
+      await tracedRenderMarkUp(error.status_code, req, res, allTags, fetcherData, store, allMatches, context, chunkExtractor, nonce);
     }
   } catch (error) {
     logSSRError("REQUEST_HANDLING", error, req);

package/dist/vite/FastRefresh.jsx

@@ -1,9 +1,10 @@
 import React from "react"
 
-const FastRefresh = () => {
+const FastRefresh = ({ nonce }) => {
     return (
         <script
             type="module"
+            nonce={nonce}
             // eslint-disable-next-line risxss/catch-potential-xss-react
             dangerouslySetInnerHTML={{
                 // Base-prefixed so the preamble resolves under a sub-path; otherwise

package/dist/vite/vite.config.js

@@ -1,4 +1,4 @@
-import { defineConfig, transformWithEsbuild } from "vite"
+import { defineConfig, transformWithEsbuild, defaultServerConditions } from "vite"
 import react from "@vitejs/plugin-react"
 import svgr from "vite-plugin-svgr"
 import { builtinModules, createRequire } from "node:module"
@@ -192,18 +192,31 @@ const alias = () => {
     }, {})
 }
 
+/**
+ * Route offline snapshots (catalyst-sw.js + offline manifest) are on unless
+ * config.json sets OFFLINE_SNAPSHOTS_ENABLE to false, e.g. for apps that ship
+ * their own service worker at the same scope.
+ */
+export const isOfflineSnapshotsEnabled = (value) => value !== false && value !== "false"
+
 export const getClientEnvVariables = () => {
     const clientEnvVars = process.env.CLIENT_ENV_VARIABLES
+    // Always defined so the service worker registration can read it in the browser.
+    const offlineSnapshotsDefinition = {
+        "process.env.OFFLINE_SNAPSHOTS_ENABLE": JSON.stringify(
+            isOfflineSnapshotsEnabled(process.env.OFFLINE_SNAPSHOTS_ENABLE)
+        ),
+    }
 
     if (!clientEnvVars) {
-        return {}
+        return offlineSnapshotsDefinition
     }
 
     // Parse CLIENT_ENV_VARIABLES if it's a JSON string
     const allowedVars = typeof clientEnvVars === "string" ? JSON.parse(clientEnvVars) : clientEnvVars
 
     // Create define object with only allowed environment variables
-    const envVarDefinitions = {}
+    const envVarDefinitions = { ...offlineSnapshotsDefinition }
 
     allowedVars.forEach((varName) => {
         if (process.env[varName] !== undefined) {
@@ -334,6 +347,7 @@ const candidateBrowserDeps = [
     "react-detect-offline",
     "react-async-script",
     "normalize.css",
+    "sanitize-html",
 ]
 
 // Node-only / instrumentation dependencies that must never be bundled into the
@@ -387,6 +401,22 @@ export const sharedViteConfig = {
     ssr: {
         // Keep selected React-side packages bundled for SSR (transformed by Vite, NOT pre-bundled)
         // noExternal: ["@tata1mg/slowboi-react"],
+        resolve: {
+            // react-router/react-router-dom v7 ship dual CJS/ESM builds selected via the
+            // "module-sync" exports condition. Node 20.19+/22 understands this condition
+            // and resolves to the real ESM build even via require() — but Vite's SSR
+            // resolver does not know "module-sync" and falls back to the CJS build,
+            // including for packages Vite treats as external and hands off to Node's own
+            // loader (e.g. a consumer dependency that itself imports react-router-dom).
+            // When Vite and Node disagree on which build to load, the app ends up with
+            // two separate react-router module instances — each with its own React
+            // Context — so hooks like useLocation() throw "may be used only in the
+            // context of a <Router>" even though a Router is mounted, because the
+            // Provider populated one Context instance and the consumer read the other.
+            // Adding "module-sync" here makes Vite's resolution agree with Node's.
+            conditions: ["module-sync", ...defaultServerConditions],
+            externalConditions: ["module-sync", ...defaultServerConditions],
+        },
         // Ensure Node-only instrumentation and low-level Node deps stay external so
         // the bundler never tries to resolve the optional (opt-in) OTEL packages.
         external: nodeOnlyExternalDeps,

package/dist/web-router/components/RouterDataProvider.jsx

@@ -1,7 +1,7 @@
 import React, { useEffect, useState, createContext, useContext, useMemo, useRef } from "react";
 import { useLocation, useMatch, useNavigate, useParams, useSearchParams, UNSAFE_RouteContext, matchRoutes } from "react-router";
 import { OneMgRouterContext } from "../context.jsx";
-// import sanitizeHtml from "sanitize-html"
+import sanitizeHtml from "sanitize-html";
 
 /**
  * Data a route fetcher produced, as exposed by useCurrentRouteData / useRouterData.
@@ -148,8 +148,10 @@ const generateRouteKey = (match, searchParamsString = "") => {
     pathname,
     route
   } = match;
-  const sanitizedPathname = pathname;
-  const sanitizedParams = searchParamsString;
+  // The key ends up JSON-serialized into an inline SSR <script> (fetcherData),
+  // so strip markup from the request-controlled pathname and query string.
+  const sanitizedPathname = sanitizeHtml(pathname);
+  const sanitizedParams = sanitizeHtml(searchParamsString);
   if (route.children) {
     return `index${sanitizedPathname}${sanitizedParams}`;
   }

package/dist/web-router/components/RouterDataProvider.server.test.jsx

@@ -93,6 +93,21 @@ describe("serverDataFetcher (node environment — serverFetcher branch)", () =>
         const req = { query: { a: "1", b: "2" } }
 
         const result = await serverDataFetcher({ routes, url: "/page", req }, {})
-        expect(Object.keys(result)[0]).toBe("/page?a=1&b=2")
+        // sanitizeHtml entity-encodes "&"; the client key goes through the same
+        // function, so server and client keys still match.
+        expect(Object.keys(result)[0]).toBe("/page?a=1&b=2")
+    })
+    it("strips markup from a request-controlled query value before it becomes a route key", async () => {
+        // The key is serialized into the inline SSR <script> as part of
+        // window.__ROUTER_INITIAL_DATA__ (#471).
+        const routes = [{ path: "/page", component: loadableComponent({ default: {} }) }]
+        const req = { query: { lang: '"></script><script>alert(document.domain)</script>' } }
+
+        const result = await serverDataFetcher({ routes, url: "/page", req }, {})
+        const key = Object.keys(result)[0]
+
+        expect(key.startsWith("/page?lang=")).toBe(true)
+        expect(key).not.toContain("<script")
+        expect(key).not.toContain("</script")
     })
 })

package/dist/web-router/components/RouterDataProvider.test.jsx

@@ -89,7 +89,9 @@ describe("serverDataFetcher", () => {
         const routes = [{ path: "/page", component: { default: {} } }]
         const req = { query: { a: "1", b: "2" } }
         const result = await serverDataFetcher({ routes, url: "/page", req }, {})
-        expect(Object.keys(result)[0]).toBe("/page?a=1&b=2")
+        // sanitizeHtml entity-encodes "&"; the client key goes through the same
+        // function, so server and client keys still match.
+        expect(Object.keys(result)[0]).toBe("/page?a=1&b=2")
     })
 })
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "catalyst-core",
-    "version": "1.1.0",
+    "version": "1.2.0-canary.1",
     "type": "module",
     "main": "./dist/index.jsx",
     "description": "Web framework that provides great performance out of the box",

package/test/native/locationPermissions.test.js

@@ -0,0 +1,56 @@
+import test from "node:test"
+import assert from "node:assert/strict"
+import fs from "fs"
+import os from "os"
+import path from "path"
+import { createRequire } from "module"
+import { fileURLToPath } from "url"
+
+// src/native is a CommonJS subtree (see its package.json); load it with require from this ESM test.
+const require = createRequire(import.meta.url)
+const createAssetsPhase = require("../../src/native/buildAndroid/assets.js")
+
+const here = path.dirname(fileURLToPath(import.meta.url))
+const templateManifest = path.resolve(
+    here,
+    "../../src/native/androidProject/app/src/main/AndroidManifest.xml"
+)
+
+const LOCATION_LINES =
+    /<uses-permission android:name="android\.permission\.ACCESS_(FINE|COARSE)_LOCATION" \/>/g
+
+function fakeAndroidProject() {
+    const pwd = fs.mkdtempSync(path.join(os.tmpdir(), "catalyst-location-"))
+    const manifestDir = path.join(pwd, "androidProject", "app", "src", "main")
+    fs.mkdirSync(manifestDir, { recursive: true })
+    const manifestPath = path.join(manifestDir, "AndroidManifest.xml")
+    fs.copyFileSync(templateManifest, manifestPath)
+    const { processLocation } = createAssetsPhase({ pwd, progress: { log: () => {} } })
+    const readManifest = () => fs.readFileSync(manifestPath, "utf8")
+    return { processLocation, readManifest }
+}
+
+test("the template manifest declares no location permissions", () => {
+    assert.equal((fs.readFileSync(templateManifest, "utf8").match(LOCATION_LINES) || []).length, 0)
+})
+
+test("location.enabled adds fine and coarse location permissions once, across repeated builds", async () => {
+    const { processLocation, readManifest } = fakeAndroidProject()
+
+    await processLocation({ location: { enabled: true } })
+    await processLocation({ location: { enabled: true } })
+
+    const manifest = readManifest()
+    assert.equal((manifest.match(LOCATION_LINES) || []).length, 2)
+    // Inserted with the other permissions, ahead of <uses-feature>
+    assert.ok(manifest.indexOf("ACCESS_FINE_LOCATION") < manifest.indexOf("<uses-feature"))
+})
+
+test("location off (or missing) removes permissions a previous build added", async () => {
+    const { processLocation, readManifest } = fakeAndroidProject()
+
+    await processLocation({ location: { enabled: true } })
+    await processLocation({})
+
+    assert.equal((readManifest().match(LOCATION_LINES) || []).length, 0)
+})

package/test/server/handler.assets.test.ts

@@ -328,3 +328,80 @@ describe("SSR handler — deferred assets discovered during render", () => {
         expect(html).not.toContain("widget.def456.js")
     })
 })
+
+describe("SSR handler — CSP nonce (CSP_NONCE_ENABLE)", () => {
+    let realEnv: NodeJS.ProcessEnv
+
+    beforeEach(() => {
+        realEnv = process.env
+    })
+
+    afterEach(() => {
+        process.env = realEnv
+    })
+
+    async function renderWithNonce(url: string, presetNonce?: string) {
+        // config.json booleans reach process.env as real booleans because
+        // loadEnvironmentVariables reassigns process.env with a plain object
+        // (assigning through the real process.env would coerce to "true").
+        // The handler reads the flag at import time.
+        process.env = { ...process.env, CSP_NONCE_ENABLE: true as any }
+        vi.doMock(TEMPLATE_DOC, () => ({ default: undefined }))
+        mockManifest()
+
+        const { default: handler } = await import("../../src/server/renderer/handler.jsx")
+        const { req, res } = makeReqRes(url)
+        res.locals = presetNonce ? { cspNonce: presetNonce } : {}
+
+        await handler(req, res)
+        await res.waitForEnd()
+        return { html: res.getHtml() as string, res }
+    }
+
+    it("stamps one per-request nonce on every script and modulepreload in the document, but not on <style>", async () => {
+        const { html, res } = await renderWithNonce("/")
+
+        const nonce = res.locals.cspNonce
+        expect(nonce).toMatch(/^[A-Za-z0-9+/]+=*$/)
+
+        const scripts = html.match(/<script\b[^>]*>/g) || []
+        expect(scripts.length).toBeGreaterThan(0)
+        for (const tag of scripts) expect(tag).toContain(`nonce="${nonce}"`)
+
+        const preloads = html.match(/<link rel="modulepreload"[^>]*>/g) || []
+        expect(preloads.length).toBeGreaterThan(0)
+        for (const tag of preloads) expect(tag).toContain(`nonce="${nonce}"`)
+
+        expect(html).toContain("<style>.home{color:red}</style>")
+        expect(html).not.toMatch(/<style[^>]*nonce=/)
+    })
+
+    it("reuses res.locals.cspNonce set by app middleware, including on the scripts flushed after the document", async () => {
+        const { html, res } = await renderWithNonce("/widget", "app-nonce-123")
+
+        expect(res.locals.cspNonce).toBe("app-nonce-123")
+        const htmlEnd = html.indexOf("</html>")
+        const tail = html.slice(htmlEnd)
+        expect(tail).toContain('<script nonce="app-nonce-123">window.__CATALYST_IS_BOT__=false;</script>')
+        expect(tail).toContain('<script nonce="app-nonce-123">window.__SSR_RENDERED_COMPONENTS__=')
+        expect(tail).toContain(
+            '<script type="module" nonce="app-nonce-123" src="http://localhost/assets/widget.def456.js"></script>',
+        )
+        expect(tail).toContain("<style>.widget{color:blue}</style>")
+    })
+
+    it("renders no nonce attributes when the flag is off", async () => {
+        vi.doMock(TEMPLATE_DOC, () => ({ default: undefined }))
+        mockManifest()
+
+        const { default: handler } = await import("../../src/server/renderer/handler.jsx")
+        const { req, res } = makeReqRes("/widget")
+        res.locals = {}
+
+        await handler(req, res)
+        await res.waitForEnd()
+
+        expect(res.getHtml()).not.toContain("nonce=")
+        expect(res.locals.cspNonce).toBeUndefined()
+    })
+})

package/test/server/otel.test.ts

@@ -120,6 +120,7 @@ vi.mock("@opentelemetry/sdk-trace-node", () => ({
     TraceIdRatioBasedSampler: fake.record("TraceIdRatioBasedSampler"),
     ParentBasedSampler: fake.record("ParentBasedSampler"),
 }))
+vi.mock("@opentelemetry/core", () => ({ setGlobalErrorHandler: vi.fn() }))
 vi.mock("@opentelemetry/sdk-metrics", () => ({
     PeriodicExportingMetricReader: fake.record("PeriodicExportingMetricReader"),
 }))
@@ -350,7 +351,7 @@ describe("otel init()", () => {
 
         addedListener("SIGTERM")()
         expect(console.info).toHaveBeenCalledWith(
-            "📡 Received SIGTERM, shutting down OpenTelemetry gracefully..."
+            expect.stringContaining("Received SIGTERM, shutting down OpenTelemetry gracefully...")
         )
         await vi.waitFor(() => expect(exit).toHaveBeenCalledTimes(1))
         expect(sdk.shutdown).toHaveBeenCalledTimes(1)
@@ -358,7 +359,7 @@ describe("otel init()", () => {
 
         addedListener("SIGINT")()
         expect(console.info).toHaveBeenCalledWith(
-            "📡 Received SIGINT, shutting down OpenTelemetry gracefully..."
+            expect.stringContaining("Received SIGINT, shutting down OpenTelemetry gracefully...")
         )
         await vi.waitFor(() => expect(exit).toHaveBeenCalledTimes(2))
     })