gemi 0.197.0 → 0.198.0

package/dist/services/queue/work.js

@@ -1,4 +1,4 @@
 // @bun
-import{de as H,ge as _}from"../../chunk-dbe8zgyb.js";import{ok as O}from"../../chunk-g1th116z.js";import"../../chunk-mnmz8n5k.js";import"../../chunk-ng5qfkgp.js";import"../../chunk-5qaxde5h.js";import"../../chunk-htnbmbx1.js";import"../../chunk-9ky5d5js.js";import"../../chunk-a77w04sw.js";import{Hl as U,Il as V,Ml as Z}from"../../chunk-y9pzr1wc.js";import{Ql as Y}from"../../chunk-nnn2f1ew.js";import"../../chunk-fzy1z97a.js";import X from"path";function T(z){if(!z.config.get("route.channels"))return null;let C=z.config.get("broadcast",{}).driver;if(!(C===void 0||C==="memory"||C instanceof O))return null;return'[gemi] Broadcasts from this worker reach no one: the broadcast driver is "memory", which delivers to the sockets of the process that emits, and a worker has none. Set `driver: "redis"` in app/config/broadcast.ts.'}class J extends Error{name="QueueWorkerRefused"}class N{kernel;stopping;keepAlive;settings;constructor(z,C={}){this.kernel=z;this.settings={...V(),...C}}async start(){if(await this.kernel.waitForBoot(),this.stopping)return;let z=this.kernel.app;if(!z.bound(H))throw new J("[gemi] `gemi queue:work` has no queue to claim from: this application does not register QueueServiceProvider.");let C=z.make(H);if(!C.durable)throw new J('[gemi] `gemi queue:work` refuses to start: the queue uses the memory driver, which keeps each job in the process that dispatched it, so a worker never sees one. Set `driver: "database"` (or another driver every process can reach) in app/config/queue.ts, or run jobs in the server and drop the worker.');C.start(),this.keepAlive=setInterval(()=>{},1073741824),console.log(`[gemi] Queue worker started: claiming up to ${C.config.concurrency} job(s) at a time.`);let E=T(z);if(E)console.warn(E)}stop(z={}){return this.stopping??=this.drain({...this.settings,...z}),this.stopping}async drain(z){U();let C=this.kernel.app,E=C.resolved(H)?C.make(H):void 0;if(E)console.log(`[gemi] Shutting down: waiting for ${E.running} running job(s) (up to ${z.timeoutMs/1000}s).`),await E.drain(z.timeoutMs);let F=await this.kernel.shutdown({timeoutMs:z.providerTimeoutMs});clearInterval(this.keepAlive);let G=(E?.running??0)===0&&F.failed.length===0&&F.timedOut.length===0;return console.log(`[gemi] Shutdown ${G?"complete":"finished with errors"}.`),G?0:1}}async function $(){let z=Y();process.env.ROOT_DIR=z,process.env.APP_DIR=X.join(z,"app"),_();let C=X.join(z,"app/kernel/Kernel.ts"),{default:E}=await import(C);if(typeof E!=="function")return console.error(`[gemi] ${C} has no default export to boot the worker from.`),1;let F=new E;F.boot();let G=new N(F);Z(()=>G.stop());try{await G.start()}catch(L){if(!(L instanceof J))throw L;return console.error(L.message),1}return}$().then((z)=>{if(z!==void 0)process.exit(z)},(z)=>{console.error("[gemi] The queue worker failed to start:",z),process.exit(1)});
+import{de as H,ge as _}from"../../chunk-zwbpcch0.js";import{sk as O}from"../../chunk-yxge0cem.js";import"../../chunk-mddazdpt.js";import"../../chunk-bcfcwbp4.js";import"../../chunk-64hxqsqx.js";import"../../chunk-t0qs2q9j.js";import"../../chunk-jkf5kjaz.js";import"../../chunk-ha4er085.js";import{Ll as U,Ml as V,Ql as Z}from"../../chunk-1yq2b55s.js";import{Ul as Y}from"../../chunk-ahss6dcp.js";import"../../chunk-zpqcawmq.js";import X from"path";function T(z){if(!z.config.get("route.channels"))return null;let C=z.config.get("broadcast",{}).driver;if(!(C===void 0||C==="memory"||C instanceof O))return null;return'[gemi] Broadcasts from this worker reach no one: the broadcast driver is "memory", which delivers to the sockets of the process that emits, and a worker has none. Set `driver: "redis"` in app/config/broadcast.ts.'}class J extends Error{name="QueueWorkerRefused"}class N{kernel;stopping;keepAlive;settings;constructor(z,C={}){this.kernel=z;this.settings={...V(),...C}}async start(){if(await this.kernel.waitForBoot(),this.stopping)return;let z=this.kernel.app;if(!z.bound(H))throw new J("[gemi] `gemi queue:work` has no queue to claim from: this application does not register QueueServiceProvider.");let C=z.make(H);if(!C.durable)throw new J('[gemi] `gemi queue:work` refuses to start: the queue uses the memory driver, which keeps each job in the process that dispatched it, so a worker never sees one. Set `driver: "database"` (or another driver every process can reach) in app/config/queue.ts, or run jobs in the server and drop the worker.');C.start(),this.keepAlive=setInterval(()=>{},1073741824),console.log(`[gemi] Queue worker started: claiming up to ${C.config.concurrency} job(s) at a time.`);let E=T(z);if(E)console.warn(E)}stop(z={}){return this.stopping??=this.drain({...this.settings,...z}),this.stopping}async drain(z){U();let C=this.kernel.app,E=C.resolved(H)?C.make(H):void 0;if(E)console.log(`[gemi] Shutting down: waiting for ${E.running} running job(s) (up to ${z.timeoutMs/1000}s).`),await E.drain(z.timeoutMs);let F=await this.kernel.shutdown({timeoutMs:z.providerTimeoutMs});clearInterval(this.keepAlive);let G=(E?.running??0)===0&&F.failed.length===0&&F.timedOut.length===0;return console.log(`[gemi] Shutdown ${G?"complete":"finished with errors"}.`),G?0:1}}async function $(){let z=Y();process.env.ROOT_DIR=z,process.env.APP_DIR=X.join(z,"app"),_();let C=X.join(z,"app/kernel/Kernel.ts"),{default:E}=await import(C);if(typeof E!=="function")return console.error(`[gemi] ${C} has no default export to boot the worker from.`),1;let F=new E;F.boot();let G=new N(F);Z(()=>G.stop());try{await G.start()}catch(L){if(!(L instanceof J))throw L;return console.error(L.message),1}return}$().then((z)=>{if(z!==void 0)process.exit(z)},(z)=>{console.error("[gemi] The queue worker failed to start:",z),process.exit(1)});
 
-//# debugId=0D069D332A8FFB3D64756E2164756E21
+//# debugId=6A234CE7D068AB7364756E2164756E21

package/dist/services/queue/work.js.map

@@ -7,6 +7,6 @@
     "import type { Application, ShutdownReport } from \"../../foundation/Application\";\nimport { markShuttingDown, shutdownSettings, type ShutdownSettings } from \"../../server/shutdown\";\nimport { memoryBroadcastInWorker } from \"../broadcast/workerWarning\";\nimport { QueueManager } from \"./QueueManager\";\n\n/** The part of a `Kernel` a worker drives. */\nexport type WorkerKernel = {\n  readonly app: Application;\n  waitForBoot(): Promise<void>;\n  shutdown(options?: { timeoutMs?: number }): Promise<ShutdownReport>;\n};\n\n/**\n * A worker that was told to start in an application it cannot claim for. The\n * message is written for the operator reading the deploy's logs.\n */\nexport class QueueWorkerRefused extends Error {\n  name = \"QueueWorkerRefused\";\n}\n\n/**\n * The process `gemi queue:work` runs: the application booted as a server boots\n * it, claiming from the queue, and no `Bun.serve`. It exists so job capacity\n * can be scaled apart from request traffic, which needs a driver both kinds of\n * process can reach; see `start` for why the memory driver is refused.\n *\n * The caller marks the process as a worker (`markQueueWorker`) before the\n * kernel registers, so every claim rule that asks `claimsInThisProcess` sees a\n * process that claims, whatever `GEMI_QUEUE_CLAIM` says.\n */\nexport class QueueWorker {\n  private stopping: Promise<number> | undefined;\n  private keepAlive: ReturnType<typeof setInterval> | undefined;\n  private readonly settings: ShutdownSettings;\n\n  /**\n   * `settings` default to the `GEMI_SHUTDOWN_*` variables, read here rather\n   * than at the signal so a bad value is warned about while the deploy is\n   * being watched, as `Server.start` does.\n   */\n  constructor(\n    private readonly kernel: WorkerKernel,\n    settings: Partial<ShutdownSettings> = {},\n  ) {\n    this.settings = { ...shutdownSettings(), ...settings };\n  }\n\n  /**\n   * Boots the application and starts claiming. Rejects with\n   * `QueueWorkerRefused` when the application has no queue, or its queue uses\n   * the memory driver.\n   *\n   * Refused rather than warned about, because a memory worker can never do\n   * anything: its jobs live in a `Map` in the process that dispatched them,\n   * so a worker's is always empty. Left running, it looks like a healthy\n   * deploy — a process up, no errors — that runs nothing, and scaling it out\n   * adds no capacity. An exit the platform reports as a crash loop is a form\n   * of the mistake someone will see.\n   */\n  async start(): Promise<void> {\n    await this.kernel.waitForBoot();\n    // A signal during the boot has already drained and cleared the handle\n    // below. Going on would start the loop again and arm a handle nothing\n    // clears, holding open a worker that has finished shutting down.\n    if (this.stopping) return;\n\n    const application = this.kernel.app;\n    // `bound`, not `make` in a try: an application built without the queue\n    // provider is a configuration to name, not an unbound-token stack trace.\n    if (!application.bound(QueueManager)) {\n      throw new QueueWorkerRefused(\n        \"[gemi] `gemi queue:work` has no queue to claim from: this application \" +\n          \"does not register QueueServiceProvider.\",\n      );\n    }\n    const queue = application.make(QueueManager);\n    if (!queue.durable) {\n      throw new QueueWorkerRefused(\n        \"[gemi] `gemi queue:work` refuses to start: the queue uses the memory \" +\n          \"driver, which keeps each job in the process that dispatched it, so \" +\n          'a worker never sees one. Set `driver: \"database\"` (or another driver ' +\n          \"every process can reach) in app/config/queue.ts, or run jobs in the \" +\n          \"server and drop the worker.\",\n      );\n    }\n\n    // Idempotent: a production boot with a durable driver has already started\n    // it (`startClaimingIfServing`). Development has not, and a worker claims\n    // in either.\n    queue.start();\n    // The queue's poll timer is unref'd, so that a script's queue does not\n    // hold it open; here the queue is the process, and without a handle of its\n    // own an idle worker would exit 0 as soon as it booted.\n    this.keepAlive = setInterval(() => {}, 1 << 30);\n    console.log(\n      `[gemi] Queue worker started: claiming up to ${queue.config.concurrency} job(s) at a time.`,\n    );\n    const broadcastWarning = memoryBroadcastInWorker(application);\n    if (broadcastWarning) console.warn(broadcastWarning);\n  }\n\n  /**\n   * Stops claiming, waits for the running jobs, runs every provider's\n   * `shutdown()`, and resolves with the exit code: 0 when no job was left\n   * running and every provider finished in time, 1 otherwise. Idempotent.\n   *\n   * `gemi start`'s drain, with the jobs where the requests were:\n   * `isShuttingDown()` turns true, which stops a durable queue claiming;\n   * running jobs get `timeoutMs` (`GEMI_SHUTDOWN_TIMEOUT`), which a server\n   * spends on requests; then `Application.shutdown` gets `providerTimeoutMs`,\n   * and in it the queue provider waits for whatever is still running and\n   * names it. The two budgets add up as they do for a server, so a worker\n   * fits the same grace period. `delayMs` is not waited: it is for a load\n   * balancer, and nothing routes to a worker.\n   */\n  stop(settings: Partial<ShutdownSettings> = {}): Promise<number> {\n    this.stopping ??= this.drain({ ...this.settings, ...settings });\n    return this.stopping;\n  }\n\n  private async drain(settings: ShutdownSettings): Promise<number> {\n    markShuttingDown();\n    const application = this.kernel.app;\n    // Resolving the manager now would build a driver only to stop it, which\n    // is what a signal during the boot, before the provider resolved it, finds.\n    const queue = application.resolved(QueueManager) ? application.make(QueueManager) : undefined;\n    if (queue) {\n      console.log(\n        `[gemi] Shutting down: waiting for ${queue.running} running job(s) ` +\n          `(up to ${settings.timeoutMs / 1000}s).`,\n      );\n      await queue.drain(settings.timeoutMs);\n    }\n\n    const report = await this.kernel.shutdown({ timeoutMs: settings.providerTimeoutMs });\n    clearInterval(this.keepAlive);\n    const clean =\n      (queue?.running ?? 0) === 0 && report.failed.length === 0 && report.timedOut.length === 0;\n    console.log(`[gemi] Shutdown ${clean ? \"complete\" : \"finished with errors\"}.`);\n    return clean ? 0 : 1;\n  }\n}\n"
   ],
   "mappings": ";gcAYA,kBCDO,OAAS,DAAuB,DAAC,AAAyC,DAC/E,CAAI,DAAC,AAAY,KAAO,IAAI,gBAAgB,EAAG,OAAO,KACtD,IAAM,EAAS,EAAY,OAAO,IAAqB,YAAa,CAAC,CAAC,EAAE,OAGxE,GAAI,EADF,IAAW,QAAa,IAAW,UAAY,aAAkB,GACtD,OAAO,KACpB,MACE,uNCFG,MAAM,UAA2B,KAAM,CAC5C,KAAO,oBACT,CAYO,MAAM,CAAY,CAWJ,OAVX,SACA,UACS,SAOjB,WAAW,CACQ,EACjB,EAAsC,CAAC,EACvC,CAFiB,cAGjB,KAAK,SAAW,IAAK,EAAiB,KAAM,CAAS,OAejD,MAAK,EAAkB,CAK3B,GAJA,MAAM,KAAK,OAAO,YAAY,EAI1B,KAAK,SAAU,OAEnB,IAAM,EAAc,KAAK,OAAO,IAGhC,GAAI,CAAC,EAAY,MAAM,CAAY,EACjC,MAAM,IAAI,EACR,+GAEF,EAEF,IAAM,EAAQ,EAAY,KAAK,CAAY,EAC3C,GAAI,CAAC,EAAM,QACT,MAAM,IAAI,EACR,8SAKF,EAMF,EAAM,MAAM,EAIZ,KAAK,UAAY,YAAY,IAAM,GAAI,UAAO,EAC9C,QAAQ,IACN,+CAA+C,EAAM,OAAO,+BAC9D,EACA,IAAM,EAAmB,EAAwB,CAAW,EAC5D,GAAI,EAAkB,QAAQ,KAAK,CAAgB,EAiBrD,IAAI,CAAC,EAAsC,CAAC,EAAoB,CAE9D,OADA,KAAK,WAAa,KAAK,MAAM,IAAK,KAAK,YAAa,CAAS,CAAC,EACvD,KAAK,cAGA,MAAK,CAAC,EAA6C,CAC/D,EAAiB,EACjB,IAAM,EAAc,KAAK,OAAO,IAG1B,EAAQ,EAAY,SAAS,CAAY,EAAI,EAAY,KAAK,CAAY,EAAI,OACpF,GAAI,EACF,QAAQ,IACN,qCAAqC,EAAM,iCAC/B,EAAS,UAAY,SACnC,EACA,MAAM,EAAM,MAAM,EAAS,SAAS,EAGtC,IAAM,EAAS,MAAM,KAAK,OAAO,SAAS,CAAE,UAAW,EAAS,iBAAkB,CAAC,EACnF,cAAc,KAAK,SAAS,EAC5B,IAAM,GACH,GAAO,SAAW,KAAO,GAAK,EAAO,OAAO,SAAW,GAAK,EAAO,SAAS,SAAW,EAE1F,OADA,QAAQ,IAAI,mBAAmB,EAAQ,WAAa,yBAAyB,EACtE,EAAQ,EAAI,EAEvB,CF1HA,eAAe,CAAI,EAAgC,CACjD,IAAM,EAAU,EAAY,EAI5B,QAAQ,IAAI,SAAW,EACvB,QAAQ,IAAI,QAAU,EAAK,KAAK,EAAS,KAAK,EAE9C,EAAgB,EAEhB,IAAM,EAAa,EAAK,KAAK,EAAS,sBAAsB,GACpD,QAAS,GAAY,MAAa,UAG1C,GAAI,OAAO,IAAW,WAEpB,OADA,QAAQ,MAAM,UAAU,kDAA2D,EAC5E,EAET,IAAM,EAAS,IAAI,EACnB,EAAO,KAAK,EAEZ,IAAM,EAAS,IAAI,EAAY,CAAM,EAKrC,EAAuB,IAAM,EAAO,KAAK,CAAC,EAE1C,GAAI,CACF,MAAM,EAAO,MAAM,EACnB,MAAO,EAAO,CACd,GAAI,EAAE,aAAiB,GAAqB,MAAM,EAElD,OADA,QAAQ,MAAM,EAAM,OAAO,EACpB,EAGT,OAGF,EAAK,EAAE,KACL,CAAC,IAAS,CACR,GAAI,IAAS,OAAW,QAAQ,KAAK,CAAI,GAE3C,CAAC,IAAU,CACT,QAAQ,MAAM,2CAA4C,CAAK,EAC/D,QAAQ,KAAK,CAAC,EAElB",
-  "debugId": "0D069D332A8FFB3D64756E2164756E21",
+  "debugId": "6A234CE7D068AB7364756E2164756E21",
   "names": []
 }

package/dist/services/router/ViewRouteDispatcher.d.ts

@@ -84,6 +84,8 @@ export declare class ViewRouteDispatcher {
     readonly assetRoutes: boolean;
     /** See `ViewRouteConfig.translate`. */
     readonly translate: boolean | undefined;
+    /** See `ViewRouteConfig.csp`. */
+    readonly csp: ViewRouteConfig["csp"];
     /**
      * `auth` is the app's `auth` config: gemi's `/auth` view routes are mounted
      * for the features it turns on (#1040).

package/dist/services/router/ViewRouteDispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ViewRouteDispatcher.d.ts","sourceRoot":"","sources":["../../../services/router/ViewRouteDispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,KAAK,cAAc,EAAmC,MAAM,2BAA2B,CAAC;AAEjG,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,eAAe,EACrB,MAAM,UAAU,CAAC;AAYlB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAUxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAiBpD,OAAO,EAIL,KAAK,cAAc,EAEpB,MAAM,kBAAkB,CAAC;AAkH1B;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,YAAY,CAAC;AAE/C;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAY9D;AAaD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,YAQ1D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,YAM7D;AAED,qBAAa,mBAAmB;IAC9B,MAAM,CAAC,KAAK,SAAiB;IAE7B,cAAc,EAAE,cAAc,CAAM;IACpC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAM;IAC7C,0FAA0F;IAC1F,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAM;IACnD,aAAa,EAAE,aAAa,CAAM;IAClC,iBAAiB,EAAE,MAAM,EAAE,CAAM;IACjC;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM;IAC3C;;;;OAIG;IACH,YAAY,EAAE,MAAM,EAAE,CAAM;IAC5B,IAAI,EAAE,GAAG,CAAQ;IACjB;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa,CAAgC;IAErD;;;;;;;;;OASG;IACH,OAAO,CAAC,YAAY,CAGhB;IAEJ,OAAO,CAAC,QAAQ,CAAC,KAAK,CAKpB;IAEF,8CAA8C;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAEnC,2CAA2C;IAC3C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IAEtC,0CAA0C;IAC1C,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,cAAc,CAAC,CAAC;IAEvD,mCAAmC;IACnC,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,KAAK,CAAC;IAEpC,kCAAkC;IAClC,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAE9C,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC;IAE/C,yCAAyC;IACzC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAE9B,yCAAyC;IACzC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAE9B,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;IAExC;;;OAGG;gBACS,MAAM,EAAE,eAAe,EAAE,IAAI,GAAE,UAAe;IAuE1D;;;;;;OAMG;YACW,kBAAkB;IAQ1B,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO;IAY5E;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAatB,0BAA0B;IAC1B,OAAO,CAAC,kBAAkB;IA0C1B;;;;;;OAMG;YACW,YAAY;YAoJZ,MAAM;IA+gBpB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,iBAAiB;IAyBnB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,gCA3b7C;QACpB;;;;;WAKG;QACH,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,OAAO,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5F,aAAa,EAAE,GAAG,CAAC;QACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3B;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAClC;;;;;;;;;;;WAWG;QACH,WAAW,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QACpD;;;WAGG;QACH,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,wEAAwE;QACxE,aAAa,CAAC,EAAE,cAAc,CAAC;QAC/B;;;WAGG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB;CA8mCJ"}
+{"version":3,"file":"ViewRouteDispatcher.d.ts","sourceRoot":"","sources":["../../../services/router/ViewRouteDispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,KAAK,cAAc,EAAmC,MAAM,2BAA2B,CAAC;AAEjG,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,eAAe,EACrB,MAAM,UAAU,CAAC;AAYlB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAUxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAiBpD,OAAO,EAIL,KAAK,cAAc,EAEpB,MAAM,kBAAkB,CAAC;AAqH1B;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,YAAY,CAAC;AAE/C;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAY9D;AAaD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,YAQ1D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,YAM7D;AAED,qBAAa,mBAAmB;IAC9B,MAAM,CAAC,KAAK,SAAiB;IAE7B,cAAc,EAAE,cAAc,CAAM;IACpC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAM;IAC7C,0FAA0F;IAC1F,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAM;IACnD,aAAa,EAAE,aAAa,CAAM;IAClC,iBAAiB,EAAE,MAAM,EAAE,CAAM;IACjC;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM;IAC3C;;;;OAIG;IACH,YAAY,EAAE,MAAM,EAAE,CAAM;IAC5B,IAAI,EAAE,GAAG,CAAQ;IACjB;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa,CAAgC;IAErD;;;;;;;;;OASG;IACH,OAAO,CAAC,YAAY,CAGhB;IAEJ,OAAO,CAAC,QAAQ,CAAC,KAAK,CAKpB;IAEF,8CAA8C;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAEnC,2CAA2C;IAC3C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IAEtC,0CAA0C;IAC1C,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,cAAc,CAAC,CAAC;IAEvD,mCAAmC;IACnC,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,KAAK,CAAC;IAEpC,kCAAkC;IAClC,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAE9C,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC;IAE/C,yCAAyC;IACzC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAE9B,yCAAyC;IACzC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAE9B,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;IAExC,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;IAErC;;;OAGG;gBACS,MAAM,EAAE,eAAe,EAAE,IAAI,GAAE,UAAe;IAwE1D;;;;;;OAMG;YACW,kBAAkB;IAQ1B,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO;IAY5E;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAatB,0BAA0B;IAC1B,OAAO,CAAC,kBAAkB;IA0C1B;;;;;;OAMG;YACW,YAAY;YA2JZ,MAAM;IAwiBpB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,iBAAiB;IAyBnB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,gCA9c7C;QACpB;;;;;WAKG;QACH,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,OAAO,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5F,aAAa,EAAE,GAAG,CAAC;QACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3B;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAClC;;;;;;;;;;;WAWG;QACH,WAAW,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QACpD;;;WAGG;QACH,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,wEAAwE;QACxE,aAAa,CAAC,EAAE,cAAc,CAAC;QAC/B;;;WAGG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB;CA+oCJ"}

package/dist/services/router/config.d.ts

@@ -8,6 +8,7 @@ import type { McpRemoteFileOptions } from "../mcp/McpRegistry";
 import type { McpRemoteHttpConfig } from "../mcp/http/McpHttpServer";
 import type { StaticViewOptions, ViewRouter } from "../../http/ViewRouter";
 import type { StreamSummary } from "./ServerQueryStore";
+import type { StrictCspOptions } from "./contentSecurityPolicy";
 export interface ApiRouteConfig {
     rootRouter: typeof ApiRouter;
     onRequestStart?: (req: HttpRequest) => void | Promise<void>;
@@ -179,6 +180,21 @@ export interface ViewRouteConfig {
      * own. A handler's `Meta.translate(allow)` wins over it. Default: `false`.
      */
     translate?: boolean;
+    /**
+     * Sends a strict Content Security Policy with these views' documents
+     * (#1195): `script-src 'nonce-…' 'strict-dynamic' 'self' https: 'unsafe-inline'; object-src 'none';
+     * base-uri 'self'`. The nonce is the request's (`cspNonce()`), which gemi
+     * puts on every inline script it renders, so a hydrated page runs with no
+     * `'unsafe-inline'`. A static view (`.static()`) gets the hashes of the
+     * scripts gemi inlined instead of a nonce, so it stays cacheable.
+     *
+     * `{ reportOnly: true }` sends it as `Content-Security-Policy-Report-Only`,
+     * `{ reportUri }` adds a `report-uri`. A policy the app set itself (a
+     * middleware's `Content-Security-Policy` header) wins. Inline scripts of
+     * the app's own need `nonce={useCspNonce()}`. A `route.domains` group's
+     * `view` inherits it or sets its own. Default: off.
+     */
+    csp?: boolean | StrictCspOptions;
     onRequestStart?: (req: HttpRequest) => void | Promise<void>;
     onRequestEnd?: (req: HttpRequest) => void | Promise<void>;
     onRequestFail?: (req: HttpRequest, error: any) => void | Promise<void>;
@@ -402,5 +418,5 @@ export interface RouteConfig {
 }
 export declare function defineRouteConfig(config: RouteConfig): RouteConfig;
 export declare function apiRouteConfigDefaults(): Omit<Required<ApiRouteConfig>, "rootRouter">;
-export declare function viewRouteConfigDefaults(): Omit<Required<ViewRouteConfig>, "root" | "rootRouter" | "meta" | "notFound" | "translate" | "detectLocale">;
+export declare function viewRouteConfigDefaults(): Omit<Required<ViewRouteConfig>, "root" | "rootRouter" | "meta" | "notFound" | "translate" | "detectLocale" | "csp">;
 //# sourceMappingURL=config.d.ts.map

package/dist/services/router/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../services/router/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGxD,MAAM,WAAW,cAAc;IAI7B,UAAU,EAAE,OAAO,SAAS,CAAC;IAE7B,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAED,2CAA2C;AAC3C,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE7C,mCAAmC;AACnC,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IACtC,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAGD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC;IAClC,UAAU,EAAE,UAAU,UAAU,CAAC;IAEjC;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAE9B;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,CACb,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE;QAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,KAC3D,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAEpE;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAE5B;;;;;;;;;;;;;;;;;;OAkBG;IACH,UAAU,CAAC,EAAE,CACX,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,KACrB,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAE9E;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,iBAAiB,CAAA;KAAE,CAAC;IAEvD;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,GAAG,EAAE,WAAW,KAAK,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IAE5F;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvE;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,CACjB,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,aAAa,KACnB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAID,MAAM,WAAW,cAAc;IAG7B,MAAM,EAAE,UAAU,SAAS,CAAC,GAAG,CAAC,CAAC;IACjC,iCAAiC;IACjC,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,mBAAmB;IAC1D;;;;OAIG;IACH,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B;AAKD,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IACnE,IAAI,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,CACP,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,GAAG,EAAE,OAAO,KACT,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;;OAIG;IACH,OAAO,EAAE,CACP,IAAI,EAAE,MAAM,KACT,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAE5E,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;;;;;;;;OAaG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8GAA8G;IAC9G,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAID,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;;;;;;;;OAeG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,gBAAgB,GAAG,kBAAkB,EAAE,CAAC;IAE/D,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAE7B,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAE5B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAEpC;;;;;;;;;;;;;OAaG;IACH,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1B;AAGD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,cAAc,CAAC;IACpB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAElE;AAGD,wBAAgB,sBAAsB,IAAI,IAAI,CAC5C,QAAQ,CAAC,cAAc,CAAC,EACxB,YAAY,CACb,CAMA;AAED,wBAAgB,uBAAuB,IAAI,IAAI,CAC7C,QAAQ,CAAC,eAAe,CAAC,EACzB,MAAM,GAAG,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,cAAc,CAC3E,CAaA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../services/router/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,MAAM,WAAW,cAAc;IAI7B,UAAU,EAAE,OAAO,SAAS,CAAC;IAE7B,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAED,2CAA2C;AAC3C,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE7C,mCAAmC;AACnC,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IACtC,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAGD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC;IAClC,UAAU,EAAE,UAAU,UAAU,CAAC;IAEjC;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAE9B;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,CACb,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE;QAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,KAC3D,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAEpE;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAE5B;;;;;;;;;;;;;;;;;;OAkBG;IACH,UAAU,CAAC,EAAE,CACX,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,KACrB,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAE9E;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,iBAAiB,CAAA;KAAE,CAAC;IAEvD;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,GAAG,EAAE,WAAW,KAAK,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IAE5F;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;;;;;;;;;;;OAaG;IACH,GAAG,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAEjC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvE;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,CACjB,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,aAAa,KACnB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAID,MAAM,WAAW,cAAc;IAG7B,MAAM,EAAE,UAAU,SAAS,CAAC,GAAG,CAAC,CAAC;IACjC,iCAAiC;IACjC,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,mBAAmB;IAC1D;;;;OAIG;IACH,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B;AAKD,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IACnE,IAAI,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,CACP,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,GAAG,EAAE,OAAO,KACT,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;;OAIG;IACH,OAAO,EAAE,CACP,IAAI,EAAE,MAAM,KACT,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAE5E,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;;;;;;;;OAaG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8GAA8G;IAC9G,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAID,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;;;;;;;;OAeG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,gBAAgB,GAAG,kBAAkB,EAAE,CAAC;IAE/D,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAE7B,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAE5B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAEpC;;;;;;;;;;;;;OAaG;IACH,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1B;AAGD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,cAAc,CAAC;IACpB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAElE;AAGD,wBAAgB,sBAAsB,IAAI,IAAI,CAC5C,QAAQ,CAAC,cAAc,CAAC,EACxB,YAAY,CACb,CAMA;AAED,wBAAgB,uBAAuB,IAAI,IAAI,CAC7C,QAAQ,CAAC,eAAe,CAAC,EACzB,MAAM,GAAG,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,cAAc,GAAG,KAAK,CACnF,CAaA"}

package/dist/services/router/contentSecurityPolicy.d.ts

@@ -0,0 +1,32 @@
+/** See `ViewRouteConfig.csp`. */
+export interface StrictCspOptions {
+    /**
+     * Send the policy as `Content-Security-Policy-Report-Only`: violations are
+     * reported (and logged in the console) but nothing is blocked. For trying
+     * the policy on a live app first.
+     */
+    reportOnly?: boolean;
+    /** Where browsers report violations, as the policy's `report-uri`. */
+    reportUri?: string;
+}
+/**
+ * The strict policy (#1195): scripts run only when they carry this response's
+ * nonce (or match one of `hashes`), and `'strict-dynamic'` passes that trust on
+ * to what they load, so the client entry's `import()`s, the route chunks and
+ * island modules need no allowlist, wherever the assets are served from.
+ * `object-src 'none'` and `base-uri 'self'` close the two other ways around a
+ * script policy. Styles, images, fonts and connections are left alone.
+ */
+export declare function strictCspPolicy(sources: {
+    nonce?: string;
+    hashes?: string[];
+}, options?: StrictCspOptions): string;
+/**
+ * Sets the strict policy on a document's headers when the views opted in
+ * (`csp`), unless the app already set a policy of its own, which wins.
+ */
+export declare function applyStrictCsp(headers: Headers, csp: boolean | StrictCspOptions | undefined, sources: {
+    nonce?: string;
+    inlineScripts?: string[];
+}): void;
+//# sourceMappingURL=contentSecurityPolicy.d.ts.map

package/dist/services/router/contentSecurityPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contentSecurityPolicy.d.ts","sourceRoot":"","sources":["../../../services/router/contentSecurityPolicy.ts"],"names":[],"mappings":"AAEA,iCAAiC;AACjC,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAOD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EAC9C,OAAO,GAAE,gBAAqB,GAC7B,MAAM,CAqBR;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,OAAO,GAAG,gBAAgB,GAAG,SAAS,EAC3C,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,QAYtD"}

package/dist/services/router/staticCache.d.ts

@@ -28,5 +28,6 @@ export declare function applyStaticCacheControl(headers: Headers, staticView: St
  */
 export declare function sharedCacheable(response: Response): boolean;
 export declare function privateWhenSettingCookies(headers: Headers, routePath: string | null): void;
+export declare function privateWhenNonced(headers: Headers, routePath: string | null, staticView: boolean): void;
 export declare function dropCookiesFromSharedCacheable(response: Response, routePath: string | null): Response;
 //# sourceMappingURL=staticCache.d.ts.map

package/dist/services/router/staticCache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"staticCache.d.ts","sourceRoot":"","sources":["../../../services/router/staticCache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,iBAAiB,GAAG,SAAS;;;;EAS3E;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,QAatF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,WAGjD;AAiBD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,QAwBnF;AAUD,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,YAuB1F"}
+{"version":3,"file":"staticCache.d.ts","sourceRoot":"","sources":["../../../services/router/staticCache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,iBAAiB,GAAG,SAAS;;;;EAS3E;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,iBAAiB,QAatF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,WAGjD;AAiBD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,QAiBnF;AAyBD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,OAAO,QAahG;AAUD,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,YAuB1F"}

package/dist/services/router/staticDocument.d.ts

@@ -85,8 +85,12 @@ export interface DocumentScript {
  * module script, whatever else the page has. The navigation runtime leaves
  * the head's scripts alone when it swaps a page in, so it runs once per
  * document.
+ *
+ * `inlineScripts`, when given, receives the text of each inline script added
+ * that the browser runs (not the JSON blocks), so a strict CSP can allow them
+ * by hash (#1195).
  */
-export declare function injectIslands(html: string, collector: StaticRenderCollector, resolveIsland: IslandResolver | undefined, dev: boolean, navigation?: StaticNavigationMarker, script?: DocumentScript): string;
+export declare function injectIslands(html: string, collector: StaticRenderCollector, resolveIsland: IslandResolver | undefined, dev: boolean, navigation?: StaticNavigationMarker, script?: DocumentScript, inlineScripts?: string[]): string;
 /**
  * Moves each island's children into its slot.
  *

package/dist/services/router/staticDocument.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"staticDocument.d.ts","sourceRoot":"","sources":["../../../services/router/staticDocument.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAGlF,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAExF,qFAAqF;AACrF,MAAM,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAC;AAE5E,uEAAuE;AACvE,eAAO,MAAM,cAAc,iBAAiB,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAEb,CAAC;AAgBvB;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,QAEjB,CAAC;AAWvB,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,gBAAgB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC7B;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,qBAAqB,EAChC,aAAa,EAAE,cAAc,GAAG,SAAS,EACzC,GAAG,EAAE,OAAO,EACZ,UAAU,CAAC,EAAE,sBAAsB,EACnC,MAAM,CAAC,EAAE,cAAc,GACtB,MAAM,CA2DR;AAcD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBtD"}
+{"version":3,"file":"staticDocument.d.ts","sourceRoot":"","sources":["../../../services/router/staticDocument.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAGlF,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAExF,qFAAqF;AACrF,MAAM,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAC;AAE5E,uEAAuE;AACvE,eAAO,MAAM,cAAc,iBAAiB,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAEb,CAAC;AAgBvB;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,QAEjB,CAAC;AAWvB,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,gBAAgB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC7B;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,qBAAqB,EAChC,aAAa,EAAE,cAAc,GAAG,SAAS,EACzC,GAAG,EAAE,OAAO,EACZ,UAAU,CAAC,EAAE,sBAAsB,EACnC,MAAM,CAAC,EAAE,cAAc,EACvB,aAAa,CAAC,EAAE,MAAM,EAAE,GACvB,MAAM,CA+DR;AAcD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBtD"}

package/dist/services/router/streamQueryInjection.d.ts

@@ -6,14 +6,14 @@ import type { ServerQueryEntry, ServerQueryStore } from "./ServerQueryStore";
  * tag and inject markup.
  */
 export declare function htmlSafeJson(value: unknown): string;
-export declare function queryPayloadScript(entry: ServerQueryEntry): string;
+export declare function queryPayloadScript(entry: ServerQueryEntry, nonce?: string): string;
 /**
  * The same trick for a `defineDictionary` dictionary a segment just rendered
  * with. It rides the same queue as query payloads, so it lands ahead of the
  * reveal chunk for the segment that used it and hydration never re-fetches
  * strings the document already carries.
  */
-export declare function dictionaryPayloadScript(use: DictionaryUse): string;
+export declare function dictionaryPayloadScript(use: DictionaryUse, nonce?: string): string;
 /**
  * The injector sits at the end of the response pipe, so it is the one place
  * that knows when the body's first byte goes out and when the body actually
@@ -69,7 +69,9 @@ export interface StreamLifecycleHooks {
  *    keeps guarantee 1: the reveal script cannot precede the payload, because
  *    the earliest safe offset is at worst the end of the one tag straddling
  *    the boundary.
+ *
+ * `nonce` is the response's CSP nonce, put on every script injected (#1195).
  */
-export declare function injectQueryPayloads(source: ReadableStream<Uint8Array>, store: ServerQueryStore, hooks?: StreamLifecycleHooks, dictionaries?: DictionarySink): ReadableStream<Uint8Array>;
+export declare function injectQueryPayloads(source: ReadableStream<Uint8Array>, store: ServerQueryStore, hooks?: StreamLifecycleHooks, dictionaries?: DictionarySink, nonce?: string): ReadableStream<Uint8Array>;
 export declare function isBotUserAgent(userAgent: string | null): boolean;
 //# sourceMappingURL=streamQueryInjection.d.ts.map

package/dist/services/router/streamQueryInjection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"streamQueryInjection.d.ts","sourceRoot":"","sources":["../../../services/router/streamQueryInjection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE7E;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAcnD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAKlE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAGlE;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,EAClC,KAAK,EAAE,gBAAgB,EACvB,KAAK,GAAE,oBAAyB,EAChC,YAAY,CAAC,EAAE,cAAc,GAC5B,cAAc,CAAC,UAAU,CAAC,CAsH5B;AAUD,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAGhE"}
+{"version":3,"file":"streamQueryInjection.d.ts","sourceRoot":"","sources":["../../../services/router/streamQueryInjection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE7E;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAcnD;AAOD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAKlF;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAGlF;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC,EAClC,KAAK,EAAE,gBAAgB,EACvB,KAAK,GAAE,oBAAyB,EAChC,YAAY,CAAC,EAAE,cAAc,EAC7B,KAAK,CAAC,EAAE,MAAM,GACb,cAAc,CAAC,UAAU,CAAC,CAsH5B;AAUD,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAGhE"}

package/dist/stats/route-table.js

@@ -1,4 +1,4 @@
 // @bun
-import"../chunk-fzy1z97a.js";import M from"path";import{writeFileSync as Q}from"fs";var L=new Set(["FILE","REDIRECT"]);function H(j){return j.run(()=>{let x=[];for(let{group:z,view:D}of j.domains().viewGroups())for(let[G,B]of Object.entries(D.flatViewRoutes)){let C=D.routeManifest[G]??B.segments.map((K)=>K.viewPath);if(C.length===0||L.has(C.at(-1)))continue;x.push({path:G,group:z,views:C,...B.static?{static:{...B.static.layout?{layout:B.static.layout}:{},...B.static.navigation?{navigation:!0}:{}}}:{}})}return x})}var J=process.argv[2];async function U(){if(!J)throw Error("usage: route-table <out.json>");let j=M.resolve(process.cwd(),"app/kernel/Kernel.ts"),x=await import(j);if(typeof x.default!=="function")throw Error(`${j} has no default export (the Kernel subclass).`);let z=new x.default;z.boot();try{Q(J,JSON.stringify(H(z)))}finally{z.destroy()}}U().then(()=>process.exit(0),(j)=>{console.error(j?.stack??String(j)),process.exit(1)});
+import"../chunk-zpqcawmq.js";import M from"path";import{writeFileSync as Q}from"fs";var L=new Set(["FILE","REDIRECT"]);function H(j){return j.run(()=>{let x=[];for(let{group:z,view:D}of j.domains().viewGroups())for(let[G,B]of Object.entries(D.flatViewRoutes)){let C=D.routeManifest[G]??B.segments.map((K)=>K.viewPath);if(C.length===0||L.has(C.at(-1)))continue;x.push({path:G,group:z,views:C,...B.static?{static:{...B.static.layout?{layout:B.static.layout}:{},...B.static.navigation?{navigation:!0}:{}}}:{}})}return x})}var J=process.argv[2];async function U(){if(!J)throw Error("usage: route-table <out.json>");let j=M.resolve(process.cwd(),"app/kernel/Kernel.ts"),x=await import(j);if(typeof x.default!=="function")throw Error(`${j} has no default export (the Kernel subclass).`);let z=new x.default;z.boot();try{Q(J,JSON.stringify(H(z)))}finally{z.destroy()}}U().then(()=>process.exit(0),(j)=>{console.error(j?.stack??String(j)),process.exit(1)});
 
 //# debugId=05EB0087C5A2060D64756E2164756E21

package/dist/support/index.js

@@ -1,4 +1,4 @@
 // @bun
-import{le as Y}from"../chunk-vqq0z746.js";import{tk as M}from"../chunk-ng5qfkgp.js";import{vl as P,xl as R}from"../chunk-9ky5d5js.js";import"../chunk-a77w04sw.js";import{Nl as Q,Ol as U,Pl as V,Ql as W}from"../chunk-nnn2f1ew.js";import"../chunk-fzy1z97a.js";class S{static token;async boot(){}static inject(){if(!this.token)throw Error(`Service [${this.name}] does not declare a \`static token\`, so the container has no key to resolve it by.`);try{return R(this)}catch(x){throw Error(`Could not inject [${this.name}]. Services are constructed when the kernel boots, so `+"inject() only works from code that runs after that \u2014 a constructor default or a method "+`body, never module top level. Check that [${this.name}] is listed in \`services\` on your Kernel.`,{cause:x})}}static with(x){let f=new this;for(let[C,g]of Object.entries(x))if(g!==void 0)f[C]=g;return f}}import{readdir as z}from"fs/promises";import{join as B,parse as j}from"path";var H=[".ts",".tsx",".js",".mjs",".jsx"];function J(x={}){let f={};for(let[C,g]of Object.entries(x))f[C]=q(g);return new P(f)}async function L(x,f=new P){let C=[];try{C=await z(x)}catch(D){return f}let g=C.filter((D)=>{let{ext:v,name:F}=j(D);return H.includes(v)&&!F.startsWith(".")}).sort();for(let D of g){let{name:v}=j(D),F=await import(B(x,D));f.set(v,q(F))}return f}function q(x){if(x&&typeof x==="object"&&"default"in x)return x.default;return x}export{M as withDefaults,Q as sourceFiles,W as projectRoot,L as loadConfigFrom,V as discoverClasses,J as createConfigRepository,Y as ServiceProvider,S as Service,P as Repository,U as DiscoveryError};
+import{le as Y}from"../chunk-vqq0z746.js";import{xk as M}from"../chunk-bcfcwbp4.js";import{Bl as R,zl as P}from"../chunk-jkf5kjaz.js";import"../chunk-ha4er085.js";import{Rl as Q,Sl as U,Tl as V,Ul as W}from"../chunk-ahss6dcp.js";import"../chunk-zpqcawmq.js";class S{static token;async boot(){}static inject(){if(!this.token)throw Error(`Service [${this.name}] does not declare a \`static token\`, so the container has no key to resolve it by.`);try{return R(this)}catch(x){throw Error(`Could not inject [${this.name}]. Services are constructed when the kernel boots, so `+"inject() only works from code that runs after that \u2014 a constructor default or a method "+`body, never module top level. Check that [${this.name}] is listed in \`services\` on your Kernel.`,{cause:x})}}static with(x){let f=new this;for(let[C,g]of Object.entries(x))if(g!==void 0)f[C]=g;return f}}import{readdir as z}from"fs/promises";import{join as B,parse as j}from"path";var H=[".ts",".tsx",".js",".mjs",".jsx"];function J(x={}){let f={};for(let[C,g]of Object.entries(x))f[C]=q(g);return new P(f)}async function L(x,f=new P){let C=[];try{C=await z(x)}catch(D){return f}let g=C.filter((D)=>{let{ext:v,name:F}=j(D);return H.includes(v)&&!F.startsWith(".")}).sort();for(let D of g){let{name:v}=j(D),F=await import(B(x,D));f.set(v,q(F))}return f}function q(x){if(x&&typeof x==="object"&&"default"in x)return x.default;return x}export{M as withDefaults,Q as sourceFiles,W as projectRoot,L as loadConfigFrom,V as discoverClasses,J as createConfigRepository,Y as ServiceProvider,S as Service,P as Repository,U as DiscoveryError};
 
-//# debugId=3B0E43640C3FEE9D64756E2164756E21
+//# debugId=83095AE06B5E838764756E2164756E21

package/dist/support/index.js.map

@@ -6,6 +6,6 @@
     "import { readdir } from \"node:fs/promises\";\nimport { join, parse } from \"node:path\";\n\nimport { Repository } from \"./Repository\";\n\nconst CONFIG_EXTENSIONS = [\".ts\", \".tsx\", \".js\", \".mjs\", \".jsx\"];\n\n// Builds a Repository from an already-imported map of config modules. The map\n// key becomes the top-level config key, so `{ mail: mailModule }` is readable\n// as `config.get(\"mail.driver\")`. Each entry may be either the module namespace\n// (its `default` export is unwrapped) or the config object itself.\nexport function createConfigRepository(\n  modules: Record<string, any> = {},\n): Repository {\n  const items: Record<string, any> = {};\n\n  for (const [key, mod] of Object.entries(modules)) {\n    items[key] = unwrap(mod);\n  }\n\n  return new Repository(items);\n}\n\n// Reads every config module in an app's `app/config` directory into a\n// Repository. The file's basename is the top-level key: `app/config/mail.ts`\n// populates `mail.*`. A missing directory yields an empty Repository so apps\n// that declare no config still boot.\nexport async function loadConfigFrom(\n  directory: string,\n  repository = new Repository(),\n): Promise<Repository> {\n  let entries: string[] = [];\n\n  try {\n    entries = await readdir(directory);\n  } catch (err) {\n    return repository;\n  }\n\n  const files = entries\n    .filter((entry) => {\n      const { ext, name } = parse(entry);\n      return CONFIG_EXTENSIONS.includes(ext) && !name.startsWith(\".\");\n    })\n    .sort();\n\n  for (const file of files) {\n    const { name } = parse(file);\n    const mod = await import(join(directory, file));\n    repository.set(name, unwrap(mod));\n  }\n\n  return repository;\n}\n\nfunction unwrap(mod: any) {\n  if (mod && typeof mod === \"object\" && \"default\" in mod) {\n    return mod.default;\n  }\n  return mod;\n}\n"
   ],
   "mappings": ";2RAgCO,CAAe,JAAQ,EAOrB,OAMD,AAAI,EAAkB,QAmBrB,OAAS,EAKX,CACH,GAAI,CAAC,KAAK,MACR,MAAU,MACR,YAAY,KAAK,0FACnB,EAGF,GAAI,CACF,OAAO,EAAI,IAAuB,EAClC,MAAO,EAAO,CACd,MAAU,MACR,qBAAqB,KAAK,6DACxB,+FACA,6CAA6C,KAAK,kDAEpD,CAAE,OAAM,CACV,SAoBG,KAAuB,CAAoB,EAA0B,CAC1E,IAAM,EAAW,IAAI,KACrB,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAS,EACjD,GAAI,IAAU,OAAW,EAAS,GAAO,EAE3C,OAAO,EAEX,CChHA,kBAAS,oBACT,eAAS,WAAM,aAIf,IAAM,EAAoB,CAAC,MAAO,OAAQ,MAAO,OAAQ,MAAM,EAMxD,SAAS,CAAsB,CACpC,EAA+B,CAAC,EACpB,CACZ,IAAM,EAA6B,CAAC,EAEpC,QAAY,EAAK,KAAQ,OAAO,QAAQ,CAAO,EAC7C,EAAM,GAAO,EAAO,CAAG,EAGzB,OAAO,IAAI,EAAW,CAAK,EAO7B,eAAsB,CAAc,CAClC,EACA,EAAa,IAAI,EACI,CACrB,IAAI,EAAoB,CAAC,EAEzB,GAAI,CACF,EAAU,MAAM,EAAQ,CAAS,EACjC,MAAO,EAAK,CACZ,OAAO,EAGT,IAAM,EAAQ,EACX,OAAO,CAAC,IAAU,CACjB,IAAQ,MAAK,QAAS,EAAM,CAAK,EACjC,OAAO,EAAkB,SAAS,CAAG,GAAK,CAAC,EAAK,WAAW,GAAG,EAC/D,EACA,KAAK,EAER,QAAW,KAAQ,EAAO,CACxB,IAAQ,QAAS,EAAM,CAAI,EACrB,EAAM,MAAa,SAAK,EAAW,CAAI,GAC7C,EAAW,IAAI,EAAM,EAAO,CAAG,CAAC,EAGlC,OAAO,EAGT,SAAS,CAAM,CAAC,EAAU,CACxB,GAAI,GAAO,OAAO,IAAQ,UAAY,YAAa,EACjD,OAAO,EAAI,QAEb,OAAO",
-  "debugId": "3B0E43640C3FEE9D64756E2164756E21",
+  "debugId": "83095AE06B5E838764756E2164756E21",
   "names": []
 }

package/dist/testing/index.js

@@ -1,5 +1,5 @@
-import { t as followLive } from "../chunks/live-C2Sck5PO.js";
-import { $ as QueryManagerProvider, B as createMemoryHistory, M as I18nProvider, N as ServerDataContext, Q as QueryManagerContext, R as ProgressManager, V as RealtimeContext, W as liveModule, X as applyParams, Y as toVariantKey, _t as Subject, c as ClientRouterContext, i as RouteTransitionProvider, r as m, t as ThemeProvider, z as Action } from "../chunks/ThemeProvider-G2g5Z1ZS.js";
+import { t as followLive } from "../chunks/live-D08wnrrZ.js";
+import { $ as applyParams, B as createMemoryHistory, M as I18nProvider, N as ServerDataContext, Q as toVariantKey, R as ProgressManager, W as RealtimeContext, bt as Subject, c as ClientRouterContext, i as RouteTransitionProvider, nt as QueryManagerProvider, q as liveModule, r as m, t as ThemeProvider, tt as QueryManagerContext, z as Action } from "../chunks/ThemeProvider-D33bPpf8.js";
 import { r as RouteStateProvider } from "../chunks/useParams-BN3XXfmG.js";
 import { t as channelKey } from "../chunks/channelKey-CIhHpX6x.js";
 import { Suspense, createElement, useContext, useMemo, useRef, useState } from "react";

package/dist/vitest/index.js

@@ -1,4 +1,4 @@
 // @bun
-import{ga as B,ha as D}from"../chunk-8mmskn4g.js";import"../chunk-6nj9xjsm.js";import"../chunk-zv55h4x9.js";import{Ba as J}from"../chunk-4ftk3z34.js";import"../chunk-qw6aa9fy.js";import"../chunk-fzy1z97a.js";function N(){return{name:"gemi-custom-request",enforce:"pre",async transform(G,H){let j=H.split("?",1)[0];if(j.includes("/node_modules/")||!B.test(j))return null;return{code:await D(G),map:null}}}}export{N as gemiRequestPlugin,J as gemiIslandPlugin};
+import{ga as B,ha as D}from"../chunk-n3p16jpb.js";import"../chunk-206n0q1f.js";import"../chunk-ct1vh28z.js";import{Ba as J}from"../chunk-5zjw41cv.js";import"../chunk-by0afyps.js";import"../chunk-zpqcawmq.js";function N(){return{name:"gemi-custom-request",enforce:"pre",async transform(G,H){let j=H.split("?",1)[0];if(j.includes("/node_modules/")||!B.test(j))return null;return{code:await D(G),map:null}}}}export{N as gemiRequestPlugin,J as gemiIslandPlugin};
 
 //# debugId=CE19A4044ADA908764756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gemi",
-  "version": "0.197.0",
+  "version": "0.198.0",
   "private": false,
   "license": "MIT",
   "author": "Enes Tufekci <enes@gemijs.dev>",