proteum 2.5.25 → 2.7.0

package/docs/client-navigation.md

@@ -0,0 +1,128 @@
+# Client Navigation
+
+A client navigation runs in one of two modes. **Blocking**, the default, waits for the page data before it swaps the page in. **Deferred** swaps the page in first, with a pending state the page renders as a skeleton, then fills in the data. SSR first loads are the same in both modes: the page arrives with its data.
+
+Deferred navigation is opt-in twice: the router must run in deferred mode, and each page must declare it. An app that sets neither compiles and behaves as before.
+
+## Router Config
+
+```ts
+public Router = new Router(this, {
+    preload: [],
+    // Pages declaring navigation: 'deferred' swap in before their data. Default: { mode: 'blocking' }
+    navigation: { mode: 'deferred' },
+    // Route paths whose chunks load at idle after the first render
+    prefetch: ['/', '/radars', '/sales'],
+    context: (context, router) => ({ ...context }),
+});
+```
+
+`preload` keeps its meanings: the router config glob list, `client/pages/preload.json` (chunks bundled with the entry) and the page option `preload?: boolean`. `prefetch` is a different, runtime list: route paths whose chunks load in the background once the first page is rendered.
+
+## Page Option
+
+```tsx
+import { definePageRoute } from '@common/router/definitions';
+
+export default definePageRoute({
+    path: '/radars',
+    options: { auth: true, navigation: 'deferred' },
+    data: ({ Radars }) => ({ radars: Radars.list() }),
+    render: ({ radars, navigation }) =>
+        radars === undefined ? (
+            <RadarsSkeleton error={navigation.error} onRetry={navigation.retry} />
+        ) : (
+            <RadarsPage radars={radars} dimmed={navigation.pending} />
+        ),
+});
+```
+
+A page defers only when all three hold: the router mode is `deferred`, the page declares `navigation: 'deferred'`, and the page has a `data` loader. Otherwise it navigates in blocking mode, including a page that declares `deferred` under a blocking router; its render then always sees `status: 'ready'`.
+
+`navigation: 'deferred'` changes the render type. `definePageRoute` picks `TDeferredFrontRenderer<T>`: every data key is `T | undefined`, and the render receives a `navigation` prop. Pages without the option keep `TFrontRenderer<T>` and receive no `navigation` prop, so a blocking page may still return a data key named `navigation`. A deferred page may not: its data loader throws if it returns that key. The blocking overload accepts `navigation: 'blocking'` or no option, never `'deferred'`: a deferred page whose render does not fit the deferred renderer (an annotated props type with defined keys) is a type error, not a blocking page in disguise.
+
+## Navigation State
+
+`navigation` is a `TPageNavigation`, discriminated on `status`:
+
+| status | pending | stale | reloading | error | Meaning |
+| --- | --- | --- | --- | --- | --- |
+| `ready` | `false` | `false` | `false` | `null` | The data of this page is on screen |
+| `pending` | `true` | `boolean` | `boolean` | `null` | The data step runs |
+| `error` | `false` | `boolean` | `boolean` | `Error` | The data step failed |
+
+- `stale: true` means the previous data is still on screen. It happens on a same-chunk navigation (the page component is kept, as in blocking mode) when the previous page showed data, and on a retry of a page that showed data. A cross-chunk navigation remounts the page component: every data key is `undefined` while pending.
+- `reloading: true` means the data step runs again for a navigation whose data already reached the screen (`api.reload`, or `retry()` after `ready`): the stale data is this page's own, for this URL. It is `false` on a navigation, even a stale one, and on a retry that recovers a failed first data step. A page whose render reads the URL beside its data can keep its stale data on screen while `reloading`, and only then.
+- `since` is the `Date.now()` timestamp of the last status change, for a delayed skeleton or a slow-network hint.
+- `retry()` re-runs the data step only: no route resolution, no swap, no loader. It does nothing once the page left the screen.
+- `error` is what the data step threw. A request that never reached the server is a `NetworkError` (`@common/errors`); an answer from the server is the error it encoded (`AuthRequired`, `Forbidden`, `Anomaly`...).
+
+`api.reload(ids?, params?)` on a deferred page goes through `navigation.retry()`: the page turns `pending` with `stale: true` and `reloading: true`, then `ready` with the reloaded data. A reload merges what it fetched into the page state, so values written with `api.set` or `page.setData` survive. The first data render of a navigation replaces the state instead, and so does a retry that recovers a failed first data step: until then the page component may still hold the previous page's data (a same-chunk navigation keeps it), which a merge would carry over. On a blocking page `api.reload` keeps its previous behavior.
+
+Layout data reaches the same render props: on a page declaring `deferred`, a layout `data` loader returning a `navigation` key throws like the page loader would.
+
+## Order Of Operations
+
+Both modes start the same way: `page.change` hook, scroll to top, loader on, route chunk load.
+
+Blocking:
+
+1. Data providers run and their data is fetched.
+2. The page swaps in with its data. The swap render releases the loader, then `page.changed` and `page.ready` fire.
+
+Deferred:
+
+1. Data providers run, without fetching. A provider that throws aborts the navigation like a blocking data failure.
+2. The page swaps in with `status: 'pending'`. `page.changed` fires; the loader stays on.
+3. The data is fetched. On success the data and `status: 'ready'` render in one batch, the loader goes off, and after that render the router refreshes the title, body classes and hash scroll, then fires `page.ready`. On failure the page renders `status: 'error'` and the loader goes off.
+
+Whether the swap render was pending is read at that render, not in its effect: data that lands within the frame between the two still fires `page.ready` after the data render, never before it.
+
+Body classes are reset twice on a deferred page: `page.updateClient()` rewrites `document.body.className` (with the body id and the title) from the page at the swap, before `page.changed`, and again after the data render, before `page.ready`. A class the app adds to the body itself is gone after each: re-add it in both `page.changed` and `page.ready`. A blocking page resets them once, before both hooks.
+
+The router context's `page` is the page on screen. It changes when a navigation swaps its page in, never when the route resolves, so a navigation that never commits (superseded, failed) leaves `api.set` and `api.reload` working on the page still shown.
+
+A hash scrolls to the element whose id it names (decoded, looked up with `getElementById`), on a same-page hash change and after the render that shows the data.
+
+Every navigation takes a new token and gives up after any await that returns to an older one: a slower chunk, an error page chunk or an older data response never replaces a newer page, and a deferred page whose provider starts another navigation (a redirect) never swaps in. A deferred data step also gives up once its page left the screen, or when a newer data step for the same page started (retry, reload). A route chunk that fails to load is logged, goes to the app error handler (the "new version" notice) and releases the loader instead of leaving it on.
+
+## Hooks
+
+`router.on(hook, callback)` returns a remover that removes this callback, by reference: a callback registered twice is removed twice by one call. A listener added while its hook runs first runs on the next call of that hook; one removed while the hook runs still runs in that pass.
+
+| Hook | When |
+| --- | --- |
+| `page.change` | A client navigation starts |
+| `page.changed` | The rendered page changed. Fires on the first load too |
+| `page.rendered` | Hydration finished (first load only) |
+| `page.ready` | The page shows its data: once after hydration, then once per navigation (with the swap on a blocking page, when the data lands on a deferred one) |
+
+Count page views on `page.ready`: it fires for the landing page and once per navigation in both modes. On a deferred page it fires the first time the data of the navigation is on screen, which includes a `retry()` that recovers a failed first data step; it never fires again for a later retry or a reload. A page replaced in the same render as its data render never reaches the screen with its data and does not fire it, as with a blocking page swapped out in the same render.
+
+## Page Data Fetchers
+
+The data step partitions what a `data` loader returns:
+
+- api fetchers (controller calls) go to the server in one `POST /api` batch;
+- other promises and thenables resolve in the browser; a rejection goes to the app error handler, like an `/api` failure, then fails the data step;
+- plain values are page data with no round trip.
+
+Values resolved in the browser go through JSON (with the circular-safe stringify SSR uses), so a client navigation sees what SSR sees: a `Date` becomes a string, `undefined` keys disappear, `toJSON()` applies, and the page gets its own copy rather than the provider's object.
+
+Only an `/api` call reaches the server. A plain value such as a parsed URL filter or a date key is never echoed through `/api`, and a promise that is not an `/api` call resolves to its value instead of serializing to `{}`.
+
+Behavior note for 2.6.0: a data loader that returns no api fetcher no longer sends any request on a client navigation. Server-side `/api` request hooks, session refresh and 401 detection therefore do not run for such a navigation; a page that relies on them needs at least one controller call in its loader.
+
+## Prefetch
+
+- `router.prefetch(path)` loads the route chunk of `path` and keeps it, without fetching data. A navigation that starts while the chunk loads joins the same load. A failure is silent; the navigation retries the load and reports it.
+- `<Link to="/radars" prefetch>` calls it on hover and focus.
+- The router config `prefetch` list loads at idle after `page.rendered`, one chunk at a time. Without `requestIdleCallback` (Safari, iOS) it starts 2 seconds after hydration instead, so the page's own requests go first. With data saver on (`navigator.connection.saveData`) the list is not loaded at all; `Link` prefetch on hover still runs, since the visitor is pointing at that page.
+
+## Contracts For Agents
+
+- Blocking stays the default at both levels. Opting a page into `deferred` means its render must handle every data key as possibly `undefined` and render `navigation.status === 'error'` with a retry.
+- A provider that throws synchronously aborts before the swap in both modes. A rejected fetch on a deferred page becomes an error state on screen (an `/api` failure still reaches the app error handler first).
+- Pages that rely on a redirect or an error page coming from their data, and public full-load pages, should stay blocking.
+- Use `page.ready`, not `page.changed`, for anything that needs the page data on screen, such as analytics page views. Read the page's URL from the request the hook passes, not from `window.location`, which may already be the next navigation's.
+- An app that adds its own classes to `document.body` re-adds them on `page.ready` as well as `page.changed`: the router resets the body classes before each.

package/docs/http-security-headers.md

@@ -0,0 +1,114 @@
+# HTTP Security Headers
+
+Proteum's HTTP server sends the same security headers on every answer of its own stack, whatever the path, and picks the Content-Security-Policy by the path and, under `/api`, by the kind of answer at the moment the headers are written. Middleware an app mounts on the Express app before `HttpServer.start()` (a maintenance page, for example) answers before that stack and carries none of these headers, as in 2.6.
+
+Source: `server/services/router/http/index.ts` (`HttpServer.start()`) and `server/services/router/http/securityHeaders.ts`. Tests: `tests/http-server-security-headers.test.cjs`.
+
+## The Contract
+
+The rule in one sentence: outside `/api` no router answer changes its policy (every one carries the app policy, as in 2.6); under `/api`, HTML gets the app policy and everything else gets helmet's default.
+
+| Answer | Base headers | `Content-Security-Policy` | Report-only policy | `X-Powered-By` |
+|---|---|---|---|---|
+| Any answer from the router outside `/api` (pages, their 404, the error page, a cached static page, JSON, text, Markdown, feeds, a worker script a route serves) | yes | the app policy | the app's, when configured | absent |
+| HTML from the router under `/api` (pages, their 404, the error page, a cached static page) | yes | the app policy | the app's, when configured | absent |
+| Any other answer from the router under `/api` (JSON, Markdown, text, scripts, the router's redirects) | yes | helmet's default policy | none | absent |
+| A 304 Not Modified from the router under `/api` | yes | none: the browser keeps the policy its stored copy came with | none | absent |
+| A route or controller that set its own `Content-Security-Policy` | yes | the route's own, untouched | none added | absent |
+| A body-parser error under `/api`, before the router (for example a malformed JSON body) | yes | Express's own `default-src 'none'` | none | absent |
+| Static files (`/public/*`, `/robots.txt` and `/favicon.ico` when the file exists), `/ping` | yes | helmet's default policy | none | absent |
+
+When the app ships no `robots.txt` or `favicon.ico`, the request falls through to the router and its answer carries the app policy, as in 2.6. A redirect under `/api` that is typed `text/html` (one sent from the router's static page cache branch, or Express's `res.redirect` answered to a browser) counts as HTML and gets the app policy; the router's own redirects carry no `Content-Type` and keep helmet's default.
+
+"HTML" means a `Content-Type` of `text/html` or `application/xhtml+xml`. Outside `/api` the type does not matter, on purpose: a worker takes its policy from its own script's answer, so a worker served by a route (for example a map library's worker that fetches tiles from another host) must keep the app policy.
+
+"Base headers" are helmet 4.6's defaults: `Strict-Transport-Security: max-age=15552000; includeSubDomains`, `X-Frame-Options: SAMEORIGIN`, `X-Content-Type-Options: nosniff`, `Referrer-Policy: no-referrer`, `X-DNS-Prefetch-Control: off`, `Expect-CT: max-age=0`, `X-Download-Options: noopen`, `X-Permitted-Cross-Domain-Policies: none`, `X-XSS-Protection: 0`. `http.helmet` changes them (for example `referrerPolicy`). helmet 4.6 sends no `Cross-Origin-*` header, and the tests pin that.
+
+helmet's default policy is `default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests` (256 bytes). `http.helmet.contentSecurityPolicy` replaces it; with `false`, the fallback answers carry no policy, and the others still get the app policy.
+
+How it is wired:
+
+- `x-powered-by` is disabled on the Express app, and `helmet(http.helmet)` is mounted once, first in `start()`, so every answer of Proteum's stack starts with the base headers and helmet's default policy.
+- Under `/api`, a policy writer is mounted before the API fast path (the short middleware stack `/api` requests take, ahead of the static files). It runs when the headers are about to be written, so it knows the final status and `Content-Type`:
+  - when the `Content-Security-Policy` value is no longer the one helmet wrote, a route chose its own: everything is left as it is;
+  - when the status is 304: the policy header is removed, so the browser keeps the policy of the copy it stored (helmet's default there would replace a page's policy);
+  - when the answer is HTML: the app policy, plus the report-only policy when one is configured and the route did not set one;
+  - otherwise: helmet's default stays.
+- Outside `/api`, after the static files and before the router, the app policy replaces helmet's default at the start of every request, as in 2.6. When a report-only policy is configured, it is added when the headers are written, if the answer still carries the app policy.
+- Static files are mounted before that, so they keep helmet's headers byte for byte, an `.html` or `.js` file under `/public` included.
+
+Rule: a route's own policy wins. A route or controller that sets `Content-Security-Policy` itself (for example a strict policy with a nonce) keeps it, under `/api` or anywhere else, and no report-only header is added to it. A route that sets its own report-only header keeps it too.
+
+The writers tell a route's own policy by its value, which leaves two edge cases no app has today: under `/api`, a route whose policy equals helmet's default byte for byte is treated as untouched, so an HTML answer gets the app policy; and with `http.helmet.contentSecurityPolicy: false`, a route under `/api` that removed the header gets the app policy back on HTML. Outside `/api`, a route whose policy equals the app policy byte for byte also gets the report-only header.
+
+## Config
+
+`http.csp` in the app's router config, required. All header strings are built once, at boot: a config the checks below refuse fails the boot with an `[http.csp]` error, never a broken header on a response.
+
+The list form (`scripts` is required, an empty array is fine):
+
+```ts
+csp: {
+    // The four historical lists, unchanged. Proteum adds `'unsafe-inline' 'self' 'unsafe-eval'` to the scripts,
+    // and sends no `default-src` when `default` is empty.
+    scripts: ['cdn.example.com'],
+    styles: ["'self'", "'unsafe-inline'"],
+    images: ["'self'", 'data:', 'https:'],
+    default: [],
+
+    // More enforced directives, by their real names, appended after the lists.
+    directives: {
+        'frame-ancestors': ["'self'"],
+        'object-src': ["'none'"],
+        'base-uri': ["'self'"],
+    },
+
+    // A second complete policy, sent as Content-Security-Policy-Report-Only wherever the app policy goes.
+    reportOnly: {
+        policy: { 'default-src': ["'self'"], 'connect-src': ["'self'", 'api.example.com'] },
+        reportUri: '/csp-report',
+    },
+},
+```
+
+Or a complete enforced policy, written in full by the app (Proteum adds nothing, so no silent `'unsafe-eval'`):
+
+```ts
+csp: {
+    policy: {
+        'default-src': ["'self'"],
+        'script-src': ["'self'", "'unsafe-inline'"],
+        'style-src': ["'self'", "'unsafe-inline'"],
+        'frame-ancestors': ["'self'"],
+    },
+    reportOnly: { policy: { 'default-src': ["'self'"] }, reportUri: '/csp-report' },
+},
+```
+
+`reportUri` is appended to the report-only policy only, as `report-uri <value>`. The enforced policy gets a report address only from a `report-uri` entry in `directives` or `policy`.
+
+In dev, Proteum's client build uses eval source maps and its reload channel listens on another port: when you write `policy`, or a `default-src` or `connect-src`, add `'unsafe-eval'` to `script-src` and the dev event address (`http://localhost:<port>`) to `connect-src` in the dev profile.
+
+Boot errors:
+
+- `csp` absent or not an object; the list form without `scripts`; a key `csp` or `csp.reportOnly` does not know (`reportonly`, `directive`, `reporturi`), which would otherwise boot and send nothing;
+- `policy` together with `scripts`, `styles`, `images`, `default` or `directives`;
+- `directives` naming `default-src`, `script-src`, `style-src` or `img-src` (the lists own them, filled or not);
+- a directive name that is not a CSP 3 directive (`frameAncestors` and `frame-ancestor` are refused, write `'frame-ancestors'`);
+- a directive with no source, except `upgrade-insecure-requests` and `block-all-mixed-content` (which take none and refuse any), `sandbox` and `trusted-types` (which may be empty);
+- a source that is not a string, is empty, or holds anything but printable ASCII with no whitespace, `;` or `,` (write international hosts in punycode; Latin-1 is refused too, though Node would send it, because browsers drop it);
+- in `directives`, `policy` and `reportOnly.policy`: a bare keyword (`self`, `none`, `unsafe-inline`, `unsafe-eval`, `unsafe-hashes`, `strict-dynamic`, `report-sample`, `wasm-unsafe-eval`) that would name a host, and a source with unbalanced single quotes;
+- an empty `policy`, a `reportOnly` without `policy` or with an empty one, a `reportUri` that is empty or not printable ASCII, and `reportUri` together with a `report-uri` entry in `reportOnly.policy`.
+
+The four lists keep most of their 2.6 leniency: an entry holding several sources separated by spaces is kept exactly as written (each source is still checked), so it writes the same bytes; and bare keywords are not checked there. An empty entry (`''` or only spaces) is refused: 2.6 sent it as an empty source list, which blocks everything.
+
+## Migration From 2.6
+
+Nothing to change to keep today's policy: for every config the checks accept, the four lists produce the same header as 2.6, byte for byte, and every router answer outside `/api` keeps it. What changes by itself:
+
+- answers under `/api` now carry the base headers and no `X-Powered-By`; HTML there gets the app policy, other answers helmet's default policy (256 bytes on each API answer), and a 304 there carries none;
+- connected-project answers (`/api/__proteum/connected/*`) are under `/api` and follow the same rule;
+- in the four lists, these entries booted in 2.6 and now stop the boot: an entry that is not a string (`undefined`, `null`, a number); an empty entry; any character outside printable ASCII (a typographic quote, a non-ASCII or Latin-1 host, a tab), which either failed each response or was dropped by browsers;
+- a key `csp` does not know now stops the boot.
+
+To add `frame-ancestors`, `object-src` and `base-uri`, add `csp.directives`. To trial a stricter policy, add `csp.reportOnly`; to enforce it, move it to `csp.policy`.

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "proteum",
 	"description": "LLM-first Opinionated Typescript Framework for web applications.",
-	"version": "2.5.25",
+	"version": "2.7.0",
 	"author": "Gaetan Le Gac (https://github.com/gaetanlegac)",
 	"repository": "git://github.com/gaetanlegac/proteum.git",
 	"license": "MIT",
@@ -77,6 +77,7 @@
 		"mysql2": "^2.3.0",
 		"node-cmd": "^5.0.0",
 		"null-loader": "^4.0.1",
+		"on-headers": "^1.1.0",
 		"path-to-regexp": "^6.2.0",
 		"pg": "^8.21.0",
 		"postcss-loader": "^8.2.0",

package/server/services/router/http/cache.ts

@@ -69,7 +69,10 @@ type TPublicAssetResponse = {
     req?: TPublicAssetRequest;
 };
 
-const hashedPublicAssetPattern = /(^|[-_.])[a-f0-9]{6,}(?=(\.[^.]+)+$)/i;
+// `name.<hex hash>.ext`: async chunks, and since 2.6.1 the production entry files, CSS and fonts too
+// (cli/compiler/client/outputNames.ts), so every file the HTML names is served immutable.
+// `<hex hash>-<width>.ext` is responsive-loader's default name for each image size: hashed as well.
+const hashedPublicAssetPattern = /(^|[-_.])[a-f0-9]{6,}(-\d+)?(?=(\.[^.]+)+$)/i;
 
 export const resolveHttpCacheConfig = (config?: THttpCacheConfig): TResolvedHttpCacheConfig => ({
     html: {

package/server/services/router/http/index.ts

@@ -56,6 +56,12 @@ import {
     resolvePublicAssetCacheControl,
     type THttpCacheConfig,
 } from './cache';
+import {
+    buildContentSecurityPolicyHeaders,
+    createApiContentSecurityPolicyWriter,
+    createAppContentSecurityPolicy,
+    type TCspConfig,
+} from './securityHeaders';
 
 /*----------------------------------
 - CONFIG
@@ -73,7 +79,8 @@ export type Config = {
     upload: {
         maxSize: string; // Expression package bytes
     };
-    csp: { default?: string[]; styles?: string[]; images?: string[]; scripts: string[] };
+    /** See docs/http-security-headers.md: on every router answer outside `/api`, and on HTML under `/api`. */
+    csp: TCspConfig;
     cache?: THttpCacheConfig;
     cors?: CorsOptions;
     helmet?: Parameters<typeof helmet>[0];
@@ -82,9 +89,8 @@ export type Config = {
 export type Hooks = {};
 
 export { resolveHttpCacheConfig, type THttpCacheConfig } from './cache';
+export type { TCspConfig, TCspDirectives, TCspReportOnly } from './securityHeaders';
 
-type TContentSecurityPolicyOptions = NonNullable<Parameters<typeof helmet.contentSecurityPolicy>[0]>;
-type TContentSecurityPolicyDirectives = NonNullable<TContentSecurityPolicyOptions['directives']>;
 type TDevSessionAuthService = {
     config: {
         jwt: {
@@ -105,24 +111,6 @@ type TDevSessionResult =
           statusCode: number;
       };
 
-const createContentSecurityPolicy = (config: Config['csp']): TContentSecurityPolicyOptions => {
-    const directives: TContentSecurityPolicyDirectives = {
-        defaultSrc:
-            config.default && config.default.length > 0
-                ? [...config.default]
-                : helmet.contentSecurityPolicy.dangerouslyDisableDefaultSrc,
-        scriptSrc: ["'unsafe-inline'", "'self'", "'unsafe-eval'", ...config.scripts],
-    };
-
-    if (config.styles && config.styles.length > 0) directives.styleSrc = [...config.styles];
-    if (config.images && config.images.length > 0) directives.imgSrc = [...config.images];
-
-    return {
-        useDefaults: false,
-        directives,
-    };
-};
-
 const connectedProjectBootRetryCount = 10;
 const connectedProjectBootRetryDelayMs = 5_000;
 /**
@@ -452,10 +440,21 @@ export default class HttpServer<TRouter extends TServerRouter = TServerRouter> {
 
         // Config
         routes.set('trust proxy', 1); // Indique qu'on est sous le proxy apache
+        routes.disable('x-powered-by');
+
+        // Built once: a malformed policy fails the boot, never a response.
+        const contentSecurityPolicyHeaders = buildContentSecurityPolicyHeaders(this.config.csp);
+
+        // Base headers on every answer, `/api` included (docs/http-security-headers.md).
+        routes.use(helmet(this.config.helmet));
+
         /*----------------------------------
         - FAST PATH: API
         ----------------------------------*/
 
+        // HTML under /api (pages, their 404) gets the app policy; other /api answers keep helmet's default.
+        routes.use(apiOnly(createApiContentSecurityPolicyWriter(contentSecurityPolicyHeaders)));
+
         // Keep /api requests off the heavier page middleware stack below.
         routes.use(apiOnly(hpp()));
         routes.use(apiOnly(cookieParser()));
@@ -473,9 +472,6 @@ export default class HttpServer<TRouter extends TServerRouter = TServerRouter> {
         this.registerConnectedProjectRoutes(routes);
         routes.use(apiOnly(routeRequest));
 
-        // Diverses protections (dont le disable x-powered-by)
-        routes.use(helmet(this.config.helmet));
-
         /*----------------------------------
         - FICHIERS STATIQUES
         ----------------------------------*/
@@ -513,6 +509,10 @@ export default class HttpServer<TRouter extends TServerRouter = TServerRouter> {
                 },
             }),
             (req, res) => {
+                // Never cacheable: during a deploy an instance of the previous build can answer for a
+                // file the new build serves, and a CDN that kept that 404 broke every page naming the
+                // file until its TTL ran out (21 Oct 2026, a Cloudflare HIT on a chunk 404).
+                res.setHeader('Cache-Control', 'no-store');
                 res.status(404).send();
             },
         );
@@ -570,7 +570,8 @@ export default class HttpServer<TRouter extends TServerRouter = TServerRouter> {
 
         if (this.config.cors !== undefined) routes.use(cors(this.config.cors));
 
-        routes.use(helmet.contentSecurityPolicy(createContentSecurityPolicy(this.config.csp)));
+        // Every router answer outside /api keeps the app policy, as in 2.6; static files above keep helmet's.
+        routes.use(createAppContentSecurityPolicy(contentSecurityPolicyHeaders));
 
         this.registerDevTraceRoutes(routes);
         routes.use(routeRequest);