meno-core 1.0.50 → 1.0.52

package/build-static.ts

@@ -812,9 +812,16 @@ export async function buildStaticPages(): Promise<void> {
       const extraFonts = cspConfig.fontSrc?.join(' ') || '';
       const extraImgs = cspConfig.imgSrc?.join(' ') || '';
 
+      // Production-built pages have NO executable inline scripts: page config,
+      // component JS, form handler, and MenoFilter all live in external
+      // /_scripts/{hash}.js files (returnSeparateJS: true), and the Meno
+      // badge's hover effect is pure CSS. Only `<script type="application/json">`
+      // remains inline (used as a data island for MenoFilter), which CSP
+      // ignores because it has no executable code. So we can drop
+      // `'unsafe-inline'` entirely from script-src in the generated _headers.
       const cspDirectives = [
         "default-src 'self'",
-        `script-src 'self' 'unsafe-inline' https://f.vimeocdn.com https://player.vimeo.com https://www.youtube.com https://s.ytimg.com ${extraScripts}`.trim(),
+        `script-src 'self' https://f.vimeocdn.com https://player.vimeo.com https://www.youtube.com https://s.ytimg.com ${extraScripts}`.trim(),
         `style-src 'self' 'unsafe-inline' https://f.vimeocdn.com ${extraStyles}`.trim(),
         `img-src 'self' data: https: ${extraImgs}`.trim(),
         `connect-src 'self' https://vimeo.com https://*.vimeocdn.com ${extraConnect}`.trim(),

package/dist/bin/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   generateBuildErrorPage
-} from "../chunks/chunk-4OFZP5NQ.js";
+} from "../chunks/chunk-HNLUO36W.js";
 import {
   createRuntimeServer,
   setProjectRoot

package/dist/build-static.js

@@ -9,9 +9,9 @@ import {
   hashContent,
   injectTrackingScript,
   isCMSPage
-} from "./chunks/chunk-56EUSC6D.js";
-import "./chunks/chunk-CVLFID6V.js";
-import "./chunks/chunk-PQ2HRXDR.js";
+} from "./chunks/chunk-LHLHPYSP.js";
+import "./chunks/chunk-CXCBV2M7.js";
+import "./chunks/chunk-2MHDV5BF.js";
 import "./chunks/chunk-I7YIGZXT.js";
 import "./chunks/chunk-WQFG7PAH.js";
 import "./chunks/chunk-J23ZX5AP.js";

package/dist/chunks/{chunk-PQ2HRXDR.js → chunk-2MHDV5BF.js}

@@ -164,6 +164,16 @@ var ConfigService = class {
     }
     return this.config.icons;
   }
+  /**
+   * Get site-wide social configuration
+   * Returns empty object if not configured
+   */
+  getSocial() {
+    if (!this.config?.social || typeof this.config.social !== "object") {
+      return {};
+    }
+    return this.config.social;
+  }
   /**
    * Get libraries configuration
    * Returns empty arrays if not configured
@@ -238,4 +248,4 @@ export {
   ConfigService,
   configService
 };
-//# sourceMappingURL=chunk-PQ2HRXDR.js.map
+//# sourceMappingURL=chunk-2MHDV5BF.js.map

package/dist/chunks/chunk-2MHDV5BF.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../lib/server/services/configService.ts"],
+  "sourcesContent": ["/**\n * Config Service\n * Centralized configuration loading and access\n *\n * Consolidates multiple config loaders into a single service that loads\n * the project.config.json file once and exposes typed sections.\n */\n\nimport type { BreakpointConfig, BreakpointConfigInput, BreakpointEntry } from '../../shared/breakpoints';\nimport { DEFAULT_BREAKPOINTS, normalizeBreakpointConfig } from '../../shared/breakpoints';\nimport type { ResponsiveScales, BreakpointScales } from '../../shared/responsiveScaling';\nimport { DEFAULT_RESPONSIVE_SCALES } from '../../shared/responsiveScaling';\nimport type { I18nConfig } from '../../shared/types/components';\nimport type { LibrariesConfig, JSLibraryConfig, CSSLibraryConfig } from '../../shared/types/libraries';\nimport type { CSPConfig } from '../../shared/types/config';\nimport type { CustomCodeConfig } from '../../shared/types/api';\nimport type { RemConversionConfig } from '../../shared/pxToRem';\nimport { DEFAULT_REM_CONFIG } from '../../shared/pxToRem';\nimport { DEFAULT_I18N_CONFIG, migrateI18nConfig } from '../../shared/i18n';\nimport { projectPaths } from '../projectContext';\nimport { readTextFile, fileExists } from '../runtime';\n\n/**\n * Icons configuration\n */\nexport interface IconsConfig {\n  favicon?: string;\n  faviconDark?: string;\n  appleTouchIcon?: string;\n}\n\n/**\n * Site-wide social configuration\n */\nexport interface SocialConfig {\n  twitterHandle?: string;\n}\n\n/**\n * Raw project config structure from project.config.json\n */\nexport type ImageFormat = 'webp' | 'avif';\n\ninterface RawProjectConfig {\n  breakpoints?: BreakpointConfigInput;\n  responsiveScales?: Partial<ResponsiveScales>;\n  i18n?: unknown;\n  icons?: IconsConfig;\n  social?: SocialConfig;\n  libraries?: LibrariesConfig;\n  csp?: CSPConfig;\n  baseComponent?: string;\n  imageFormat?: ImageFormat;\n  remConversion?: Partial<RemConversionConfig>;\n  customCode?: CustomCodeConfig;\n  showMenoBadge?: boolean;\n}\n\n/**\n * ConfigService\n * Loads project configuration once and provides typed access to sections\n */\nexport class ConfigService {\n  private config: RawProjectConfig | null = null;\n  private loaded = false;\n\n  /**\n   * Load configuration from project.config.json\n   * Safe to call multiple times - only loads once\n   */\n  async load(): Promise<void> {\n    if (this.loaded) {\n      return;\n    }\n\n    try {\n      if (await fileExists(projectPaths.config())) {\n        const content = await readTextFile(projectPaths.config());\n        this.config = JSON.parse(content);\n      }\n    } catch {\n      // Fall through to defaults\n      this.config = null;\n    }\n\n    this.loaded = true;\n  }\n\n  /**\n   * Check if configuration has been loaded\n   */\n  isLoaded(): boolean {\n    return this.loaded;\n  }\n\n  /**\n   * Reset the service (for testing)\n   */\n  reset(): void {\n    this.config = null;\n    this.loaded = false;\n  }\n\n  /**\n   * Get breakpoint configuration\n   * Returns validated and normalized breakpoints (always object format)\n   * Supports both legacy format { tablet: 1024 } and new format { tablet: { breakpoint: 1024, previewPoint: 768 } }\n   */\n  getBreakpoints(): BreakpointConfig {\n    if (!this.config?.breakpoints || typeof this.config.breakpoints !== 'object') {\n      return { ...DEFAULT_BREAKPOINTS };\n    }\n\n    // Validate breakpoint values before normalization\n    const validInput: BreakpointConfigInput = {};\n    for (const [key, value] of Object.entries(this.config.breakpoints)) {\n      if (typeof value === 'number' && value > 0) {\n        // Legacy format: number\n        validInput[key] = value;\n      } else if (typeof value === 'object' && value !== null) {\n        // New format: object with breakpoint and optional previewPoint\n        const entry = value as BreakpointEntry;\n        if (typeof entry.breakpoint === 'number' && entry.breakpoint > 0) {\n          validInput[key] = {\n            breakpoint: entry.breakpoint,\n            previewPoint: typeof entry.previewPoint === 'number' && entry.previewPoint > 0\n              ? entry.previewPoint\n              : entry.breakpoint,\n          };\n        }\n      }\n    }\n\n    // Return normalized breakpoints or defaults if none valid\n    if (Object.keys(validInput).length === 0) {\n      return { ...DEFAULT_BREAKPOINTS };\n    }\n\n    return normalizeBreakpointConfig(validInput);\n  }\n\n  /**\n   * Get i18n configuration\n   * Automatically migrates old string[] format to LocaleConfig[] format\n   */\n  getI18n(): I18nConfig {\n    if (!this.config?.i18n) {\n      return { ...DEFAULT_I18N_CONFIG };\n    }\n\n    return migrateI18nConfig(this.config.i18n);\n  }\n\n  /**\n   * Deep merge scale categories, preserving user-defined breakpoints\n   * while filling in missing values from defaults\n   */\n  private mergeScaleCategory(\n    userScales: BreakpointScales | undefined,\n    defaultScales: BreakpointScales | undefined\n  ): BreakpointScales | undefined {\n    if (!userScales && !defaultScales) return undefined;\n    if (!userScales) return defaultScales ? { ...defaultScales } : undefined;\n    if (!defaultScales) return { ...userScales };\n\n    // User scales take precedence, but include defaults for breakpoints not specified\n    return {\n      ...defaultScales,\n      ...userScales,\n    };\n  }\n\n  /**\n   * Get responsive scales configuration\n   * Supports dynamic breakpoints - scales are keyed by breakpoint name\n   * Deep merges scale categories to preserve user breakpoint definitions\n   */\n  getResponsiveScales(): ResponsiveScales {\n    if (!this.config?.responsiveScales || typeof this.config.responsiveScales !== 'object') {\n      return { ...DEFAULT_RESPONSIVE_SCALES };\n    }\n\n    const userScales = this.config.responsiveScales;\n\n    return {\n      enabled: userScales.enabled ?? DEFAULT_RESPONSIVE_SCALES.enabled,\n      mode: (userScales as { mode?: 'breakpoints' | 'fluid' }).mode ?? DEFAULT_RESPONSIVE_SCALES.mode,\n      baseReference: userScales.baseReference ?? DEFAULT_RESPONSIVE_SCALES.baseReference,\n      fluidRange: (userScales as { fluidRange?: { min: number; max: number } }).fluidRange\n        ?? (DEFAULT_RESPONSIVE_SCALES.fluidRange ? { ...DEFAULT_RESPONSIVE_SCALES.fluidRange } : undefined),\n      siteMargin: (userScales as { siteMargin?: { min: number; max: number } }).siteMargin\n        ?? (DEFAULT_RESPONSIVE_SCALES.siteMargin ? { ...DEFAULT_RESPONSIVE_SCALES.siteMargin } : undefined),\n      fontSize: this.mergeScaleCategory(\n        userScales.fontSize as BreakpointScales | undefined,\n        DEFAULT_RESPONSIVE_SCALES.fontSize\n      ),\n      padding: this.mergeScaleCategory(\n        userScales.padding as BreakpointScales | undefined,\n        DEFAULT_RESPONSIVE_SCALES.padding\n      ),\n      margin: this.mergeScaleCategory(\n        userScales.margin as BreakpointScales | undefined,\n        DEFAULT_RESPONSIVE_SCALES.margin\n      ),\n      gap: this.mergeScaleCategory(\n        userScales.gap as BreakpointScales | undefined,\n        DEFAULT_RESPONSIVE_SCALES.gap\n      ),\n      borderRadius: this.mergeScaleCategory(\n        userScales.borderRadius as BreakpointScales | undefined,\n        DEFAULT_RESPONSIVE_SCALES.borderRadius\n      ),\n      size: this.mergeScaleCategory(\n        userScales.size as BreakpointScales | undefined,\n        DEFAULT_RESPONSIVE_SCALES.size\n      ),\n    };\n  }\n\n  /**\n   * Get rem conversion configuration\n   */\n  getRemConversion(): RemConversionConfig {\n    if (!this.config?.remConversion || typeof this.config.remConversion !== 'object') {\n      return { ...DEFAULT_REM_CONFIG };\n    }\n    return {\n      enabled: this.config.remConversion.enabled ?? DEFAULT_REM_CONFIG.enabled,\n      baseFontSize: this.config.remConversion.baseFontSize ?? DEFAULT_REM_CONFIG.baseFontSize,\n    };\n  }\n\n  /**\n   * Get icons configuration\n   * Returns empty object if not configured\n   */\n  getIcons(): IconsConfig {\n    if (!this.config?.icons || typeof this.config.icons !== 'object') {\n      return {};\n    }\n\n    return this.config.icons;\n  }\n\n  /**\n   * Get site-wide social configuration\n   * Returns empty object if not configured\n   */\n  getSocial(): SocialConfig {\n    if (!this.config?.social || typeof this.config.social !== 'object') {\n      return {};\n    }\n\n    return this.config.social;\n  }\n\n  /**\n   * Get libraries configuration\n   * Returns empty arrays if not configured\n   * Normalizes string URLs to object format for backwards compatibility\n   */\n  getLibraries(): LibrariesConfig {\n    if (!this.config?.libraries || typeof this.config.libraries !== 'object') {\n      return { js: [], css: [] };\n    }\n\n    const libs = this.config.libraries;\n\n    // Normalize JS libraries: support both string URLs and object format\n    const normalizedJs = Array.isArray(libs.js)\n      ? libs.js.map((lib) =>\n          typeof lib === 'string' ? { url: lib } : lib\n        ) as JSLibraryConfig[]\n      : [];\n\n    // Normalize CSS libraries: support both string URLs and object format\n    const normalizedCss = Array.isArray(libs.css)\n      ? libs.css.map((lib) =>\n          typeof lib === 'string' ? { url: lib } : lib\n        ) as CSSLibraryConfig[]\n      : [];\n\n    return {\n      js: normalizedJs,\n      css: normalizedCss,\n    };\n  }\n\n  /**\n   * Get CSP configuration\n   * Returns empty object if not configured\n   */\n  getCSP(): CSPConfig {\n    if (!this.config?.csp || typeof this.config.csp !== 'object') {\n      return {};\n    }\n\n    return this.config.csp;\n  }\n\n  /**\n   * Get base component name for new pages\n   * Returns undefined if not configured\n   */\n  getBaseComponent(): string | undefined {\n    if (!this.config?.baseComponent || typeof this.config.baseComponent !== 'string') {\n      return undefined;\n    }\n    return this.config.baseComponent;\n  }\n\n  /**\n   * Get image format setting\n   * Returns 'webp' (default) or 'avif'\n   */\n  getCustomCode(): CustomCodeConfig {\n    if (!this.config?.customCode || typeof this.config.customCode !== 'object') {\n      return {};\n    }\n    return this.config.customCode;\n  }\n\n  getShowMenoBadge(): boolean {\n    return this.config?.showMenoBadge === true;\n  }\n\n  getImageFormat(): ImageFormat {\n    if (this.config?.imageFormat === 'avif') return 'avif';\n    return 'webp';\n  }\n\n  /**\n   * Get raw config value by key (for extension)\n   */\n  getRaw<T>(key: string): T | undefined {\n    if (!this.config) {\n      return undefined;\n    }\n    return (this.config as Record<string, unknown>)[key] as T | undefined;\n  }\n}\n\n/**\n * Singleton instance for global access\n * Use this for convenience, or create your own instance for testing\n */\nexport const configService = new ConfigService();\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AA8DO,IAAM,gBAAN,MAAoB;AAAA,EACjB,SAAkC;AAAA,EAClC,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjB,MAAM,OAAsB;AAC1B,QAAI,KAAK,QAAQ;AACf;AAAA,IACF;AAEA,QAAI;AACF,UAAI,MAAM,WAAW,aAAa,OAAO,CAAC,GAAG;AAC3C,cAAM,UAAU,MAAM,aAAa,aAAa,OAAO,CAAC;AACxD,aAAK,SAAS,KAAK,MAAM,OAAO;AAAA,MAClC;AAAA,IACF,QAAQ;AAEN,WAAK,SAAS;AAAA,IAChB;AAEA,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,WAAoB;AAClB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,QAAc;AACZ,SAAK,SAAS;AACd,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,iBAAmC;AACjC,QAAI,CAAC,KAAK,QAAQ,eAAe,OAAO,KAAK,OAAO,gBAAgB,UAAU;AAC5E,aAAO,EAAE,GAAG,oBAAoB;AAAA,IAClC;AAGA,UAAM,aAAoC,CAAC;AAC3C,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,OAAO,WAAW,GAAG;AAClE,UAAI,OAAO,UAAU,YAAY,QAAQ,GAAG;AAE1C,mBAAW,GAAG,IAAI;AAAA,MACpB,WAAW,OAAO,UAAU,YAAY,UAAU,MAAM;AAEtD,cAAM,QAAQ;AACd,YAAI,OAAO,MAAM,eAAe,YAAY,MAAM,aAAa,GAAG;AAChE,qBAAW,GAAG,IAAI;AAAA,YAChB,YAAY,MAAM;AAAA,YAClB,cAAc,OAAO,MAAM,iBAAiB,YAAY,MAAM,eAAe,IACzE,MAAM,eACN,MAAM;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,OAAO,KAAK,UAAU,EAAE,WAAW,GAAG;AACxC,aAAO,EAAE,GAAG,oBAAoB;AAAA,IAClC;AAEA,WAAO,0BAA0B,UAAU;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,UAAsB;AACpB,QAAI,CAAC,KAAK,QAAQ,MAAM;AACtB,aAAO,EAAE,GAAG,oBAAoB;AAAA,IAClC;AAEA,WAAO,kBAAkB,KAAK,OAAO,IAAI;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,mBACN,YACA,eAC8B;AAC9B,QAAI,CAAC,cAAc,CAAC,cAAe,QAAO;AAC1C,QAAI,CAAC,WAAY,QAAO,gBAAgB,EAAE,GAAG,cAAc,IAAI;AAC/D,QAAI,CAAC,cAAe,QAAO,EAAE,GAAG,WAAW;AAG3C,WAAO;AAAA,MACL,GAAG;AAAA,MACH,GAAG;AAAA,IACL;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,sBAAwC;AACtC,QAAI,CAAC,KAAK,QAAQ,oBAAoB,OAAO,KAAK,OAAO,qBAAqB,UAAU;AACtF,aAAO,EAAE,GAAG,0BAA0B;AAAA,IACxC;AAEA,UAAM,aAAa,KAAK,OAAO;AAE/B,WAAO;AAAA,MACL,SAAS,WAAW,WAAW,0BAA0B;AAAA,MACzD,MAAO,WAAkD,QAAQ,0BAA0B;AAAA,MAC3F,eAAe,WAAW,iBAAiB,0BAA0B;AAAA,MACrE,YAAa,WAA6D,eACpE,0BAA0B,aAAa,EAAE,GAAG,0BAA0B,WAAW,IAAI;AAAA,MAC3F,YAAa,WAA6D,eACpE,0BAA0B,aAAa,EAAE,GAAG,0BAA0B,WAAW,IAAI;AAAA,MAC3F,UAAU,KAAK;AAAA,QACb,WAAW;AAAA,QACX,0BAA0B;AAAA,MAC5B;AAAA,MACA,SAAS,KAAK;AAAA,QACZ,WAAW;AAAA,QACX,0BAA0B;AAAA,MAC5B;AAAA,MACA,QAAQ,KAAK;AAAA,QACX,WAAW;AAAA,QACX,0BAA0B;AAAA,MAC5B;AAAA,MACA,KAAK,KAAK;AAAA,QACR,WAAW;AAAA,QACX,0BAA0B;AAAA,MAC5B;AAAA,MACA,cAAc,KAAK;AAAA,QACjB,WAAW;AAAA,QACX,0BAA0B;AAAA,MAC5B;AAAA,MACA,MAAM,KAAK;AAAA,QACT,WAAW;AAAA,QACX,0BAA0B;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,mBAAwC;AACtC,QAAI,CAAC,KAAK,QAAQ,iBAAiB,OAAO,KAAK,OAAO,kBAAkB,UAAU;AAChF,aAAO,EAAE,GAAG,mBAAmB;AAAA,IACjC;AACA,WAAO;AAAA,MACL,SAAS,KAAK,OAAO,cAAc,WAAW,mBAAmB;AAAA,MACjE,cAAc,KAAK,OAAO,cAAc,gBAAgB,mBAAmB;AAAA,IAC7E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAwB;AACtB,QAAI,CAAC,KAAK,QAAQ,SAAS,OAAO,KAAK,OAAO,UAAU,UAAU;AAChE,aAAO,CAAC;AAAA,IACV;AAEA,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAA0B;AACxB,QAAI,CAAC,KAAK,QAAQ,UAAU,OAAO,KAAK,OAAO,WAAW,UAAU;AAClE,aAAO,CAAC;AAAA,IACV;AAEA,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAgC;AAC9B,QAAI,CAAC,KAAK,QAAQ,aAAa,OAAO,KAAK,OAAO,cAAc,UAAU;AACxE,aAAO,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE;AAAA,IAC3B;AAEA,UAAM,OAAO,KAAK,OAAO;AAGzB,UAAM,eAAe,MAAM,QAAQ,KAAK,EAAE,IACtC,KAAK,GAAG;AAAA,MAAI,CAAC,QACX,OAAO,QAAQ,WAAW,EAAE,KAAK,IAAI,IAAI;AAAA,IAC3C,IACA,CAAC;AAGL,UAAM,gBAAgB,MAAM,QAAQ,KAAK,GAAG,IACxC,KAAK,IAAI;AAAA,MAAI,CAAC,QACZ,OAAO,QAAQ,WAAW,EAAE,KAAK,IAAI,IAAI;AAAA,IAC3C,IACA,CAAC;AAEL,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAoB;AAClB,QAAI,CAAC,KAAK,QAAQ,OAAO,OAAO,KAAK,OAAO,QAAQ,UAAU;AAC5D,aAAO,CAAC;AAAA,IACV;AAEA,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,mBAAuC;AACrC,QAAI,CAAC,KAAK,QAAQ,iBAAiB,OAAO,KAAK,OAAO,kBAAkB,UAAU;AAChF,aAAO;AAAA,IACT;AACA,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,gBAAkC;AAChC,QAAI,CAAC,KAAK,QAAQ,cAAc,OAAO,KAAK,OAAO,eAAe,UAAU;AAC1E,aAAO,CAAC;AAAA,IACV;AACA,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,mBAA4B;AAC1B,WAAO,KAAK,QAAQ,kBAAkB;AAAA,EACxC;AAAA,EAEA,iBAA8B;AAC5B,QAAI,KAAK,QAAQ,gBAAgB,OAAQ,QAAO;AAChD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,OAAU,KAA4B;AACpC,QAAI,CAAC,KAAK,QAAQ;AAChB,aAAO;AAAA,IACT;AACA,WAAQ,KAAK,OAAmC,GAAG;AAAA,EACrD;AACF;AAMO,IAAM,gBAAgB,IAAI,cAAc;",
+  "names": []
+}

package/dist/chunks/{chunk-YWJJD5D6.js → chunk-A725KYFK.js}

@@ -15,10 +15,10 @@ import {
   parseJSON,
   resolveSlugToPageId,
   variableService
-} from "./chunk-CVLFID6V.js";
+} from "./chunk-CXCBV2M7.js";
 import {
   configService
-} from "./chunk-PQ2HRXDR.js";
+} from "./chunk-2MHDV5BF.js";
 import {
   bundleFile,
   createRuntimeServer,
@@ -2469,6 +2469,9 @@ async function handleApiRoutes(req, url, pageService, componentService, cmsConte
   }
 }
 
+// lib/server/routes/pages.ts
+import { randomBytes } from "crypto";
+
 // lib/shared/pathUtils.ts
 function getStaticFilePath(pagePath, distDir = "./dist") {
   if (pagePath === "/") {
@@ -2498,10 +2501,11 @@ function escapeHtml(str) {
 function safeJsonForScript(data) {
   return JSON.stringify(data).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026");
 }
-function generateErrorPage(error, context) {
+function generateErrorPage(error, context, cspNonce) {
   const errorInfo = extractErrorInfo(error);
   const errorMessage = escapeHtml(errorInfo.message);
   const errorStack = errorInfo.stack ? escapeHtml(errorInfo.stack) : "";
+  const nonceAttr = cspNonce ? ` nonce="${cspNonce}"` : "";
   const errorDataJson = safeJsonForScript({
     type: "PREVIEW_ERROR",
     error: {
@@ -2661,7 +2665,7 @@ function generateErrorPage(error, context) {
       </button>
     </div>
   </div>
-  <script>
+  <script${nonceAttr}>
     (function() {
       // Send error to parent editor
       if (window.parent && window.parent !== window) {
@@ -2718,10 +2722,15 @@ function hashContent2(content) {
 
 // lib/server/routes/pages.ts
 var EDITOR_HEADER = "x-meno-editor";
+var CSP_NONCE_HEADER = "x-meno-csp-nonce";
+function generateCspNonce() {
+  return randomBytes(16).toString("base64");
+}
 async function handlePageRoute(url, context, req) {
   const { pageService, componentService, cmsService, injectLiveReload, isEditor, serverPort } = context;
   const pagePath = url.pathname;
   const injectEditorAttrs = req?.headers.get(EDITOR_HEADER) === "1";
+  const cspNonce = generateCspNonce();
   const i18nConfig = await loadI18nConfig();
   const { locale, pathWithoutLocale } = parseLocaleFromPath(pagePath, i18nConfig);
   const slugMappings = pageService.getSlugMappings();
@@ -2762,7 +2771,8 @@ async function handlePageRoute(url, context, req) {
               injectEditorAttrs,
               isEditor,
               serverPort,
-              returnSeparateJS: true
+              returnSeparateJS: true,
+              cspNonce
             });
             let finalHtml = result.html;
             if (result.javascript) {
@@ -2776,7 +2786,8 @@ async function handlePageRoute(url, context, req) {
                 "Content-Type": "text/html; charset=utf-8",
                 "Cache-Control": "no-store, max-age=0",
                 "Pragma": "no-cache",
-                "Expires": "0"
+                "Expires": "0",
+                [CSP_NONCE_HEADER]: cspNonce
               }
             });
           }
@@ -2794,22 +2805,25 @@ async function handlePageRoute(url, context, req) {
             pageLibraries: typedPageData.meta?.libraries,
             pageCustomCode: typedPageData.meta?.customCode,
             injectEditorAttrs,
-            isEditor
+            isEditor,
+            cspNonce
           });
           return new Response(ssrHTML, {
             headers: {
               "Content-Type": "text/html; charset=utf-8",
               "Cache-Control": "no-store, max-age=0",
               "Pragma": "no-cache",
-              "Expires": "0"
+              "Expires": "0",
+              [CSP_NONCE_HEADER]: cspNonce
             }
           });
         } catch (error) {
           console.error("Error rendering CMS page:", error);
-          return new Response(generateErrorPage(error, `Error rendering template: ${cmsTemplatePath}`), {
+          return new Response(generateErrorPage(error, `Error rendering template: ${cmsTemplatePath}`, cspNonce), {
             headers: {
               "Content-Type": "text/html; charset=utf-8",
-              "Cache-Control": "no-store"
+              "Cache-Control": "no-store",
+              [CSP_NONCE_HEADER]: cspNonce
             }
           });
         }
@@ -2857,7 +2871,8 @@ async function handlePageRoute(url, context, req) {
           injectEditorAttrs,
           isEditor,
           serverPort,
-          returnSeparateJS: true
+          returnSeparateJS: true,
+          cspNonce
         });
         let finalHtml = result.html;
         if (result.javascript) {
@@ -2871,7 +2886,8 @@ async function handlePageRoute(url, context, req) {
             "Content-Type": "text/html; charset=utf-8",
             "Cache-Control": "no-store, max-age=0",
             "Pragma": "no-cache",
-            "Expires": "0"
+            "Expires": "0",
+            [CSP_NONCE_HEADER]: cspNonce
           }
         });
       }
@@ -2887,22 +2903,25 @@ async function handlePageRoute(url, context, req) {
         pageLibraries: pageData.meta?.libraries,
         pageCustomCode: pageData.meta?.customCode,
         injectEditorAttrs,
-        isEditor
+        isEditor,
+        cspNonce
       });
       return new Response(ssrHTML, {
         headers: {
           "Content-Type": "text/html; charset=utf-8",
           "Cache-Control": "no-store, max-age=0",
           "Pragma": "no-cache",
-          "Expires": "0"
+          "Expires": "0",
+          [CSP_NONCE_HEADER]: cspNonce
         }
       });
     } catch (error) {
       console.error("Error rendering page:", error);
-      return new Response(generateErrorPage(error, `Error rendering page: ${lookupPath}`), {
+      return new Response(generateErrorPage(error, `Error rendering page: ${lookupPath}`, cspNonce), {
         headers: {
           "Content-Type": "text/html; charset=utf-8",
-          "Cache-Control": "no-store"
+          "Cache-Control": "no-store",
+          [CSP_NONCE_HEADER]: cspNonce
         }
       });
     }
@@ -3350,4 +3369,4 @@ export {
   createServer,
   FileSystemPageProvider
 };
-//# sourceMappingURL=chunk-YWJJD5D6.js.map
+//# sourceMappingURL=chunk-A725KYFK.js.map