tova 0.5.0 → 0.7.0

package/src/parser/parser.js

@@ -1,8 +1,7 @@
-import { TokenType } from '../lexer/tokens.js';
+import { TokenType, Keywords } from '../lexer/tokens.js';
 import * as AST from './ast.js';
-import { installServerParser } from './server-parser.js';
-import { installClientParser } from './client-parser.js';
-import { installSecurityParser } from './security-parser.js';
+import { FormValidator } from './form-ast.js';
+import { BlockRegistry } from '../registry/register-all.js';
 
 export class Parser {
   static MAX_EXPRESSION_DEPTH = 200;
@@ -77,6 +76,16 @@ export class Parser {
     this.error(message || `Expected ${type}, got ${this.current().type}`);
   }
 
+  // Accept IDENTIFIER or any keyword token as a property name (e.g., obj.field, obj.state).
+  // Keywords are valid property names after '.' and '?.' just like in JavaScript.
+  expectPropertyName(message) {
+    const tok = this.current();
+    if (tok.type === TokenType.IDENTIFIER || (typeof tok.value === 'string' && tok.type !== TokenType.EOF && tok.type !== TokenType.NUMBER && tok.type !== TokenType.STRING && /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(tok.value))) {
+      return this.advance();
+    }
+    this.error(message || `Expected property name, got ${tok.type}`);
+  }
+
   loc() {
     const tok = this.current();
     return { line: tok.line, column: tok.column, file: this.filename };
@@ -97,7 +106,7 @@ export class Parser {
           tok.type === TokenType.WHILE || tok.type === TokenType.RETURN ||
           tok.type === TokenType.IMPORT || tok.type === TokenType.MATCH ||
           tok.type === TokenType.TRY || tok.type === TokenType.SERVER ||
-          tok.type === TokenType.CLIENT || tok.type === TokenType.SHARED ||
+          tok.type === TokenType.BROWSER || tok.type === TokenType.SHARED ||
           tok.type === TokenType.GUARD || tok.type === TokenType.INTERFACE ||
           tok.type === TokenType.IMPL || tok.type === TokenType.TRAIT ||
           tok.type === TokenType.PUB || tok.type === TokenType.DEFER ||
@@ -146,7 +155,7 @@ export class Parser {
           tok.type === TokenType.WHILE || tok.type === TokenType.RETURN ||
           tok.type === TokenType.IMPORT || tok.type === TokenType.MATCH ||
           tok.type === TokenType.TRY || tok.type === TokenType.SERVER ||
-          tok.type === TokenType.CLIENT || tok.type === TokenType.SHARED ||
+          tok.type === TokenType.BROWSER || tok.type === TokenType.SHARED ||
           tok.type === TokenType.GUARD || tok.type === TokenType.INTERFACE ||
           tok.type === TokenType.IMPL || tok.type === TokenType.TRAIT ||
           tok.type === TokenType.PUB || tok.type === TokenType.DEFER ||
@@ -165,7 +174,8 @@ export class Parser {
     const next = this.peek(1);
     // Fragment: <>
     if (next.type === TokenType.GREATER) return true;
-    if (next.type !== TokenType.IDENTIFIER) return false;
+    // Accept identifiers and keywords as JSX tag names (e.g., <form>, <label>, <field>)
+    if (next.type !== TokenType.IDENTIFIER && !(next.value in Keywords)) return false;
     // Uppercase tag is always a component reference, never a comparison variable
     if (/^[A-Z]/.test(next.value)) return true;
     const afterIdent = this.peek(2);
@@ -263,10 +273,11 @@ export class Parser {
           const doc = docsByEndLine.get(node.loc.line - 1);
           if (doc) node.docstring = doc;
         }
-        // Walk into blocks
-        if (node.body && Array.isArray(node.body)) walk(node.body);
-        if (node.type === 'ServerBlock' || node.type === 'ClientBlock' || node.type === 'SharedBlock') {
-          if (node.body) walk(node.body);
+        // Walk into block bodies (arrays) and block nodes with body properties
+        if (node.body && Array.isArray(node.body)) {
+          walk(node.body);
+        } else if (BlockRegistry.getByAstType(node.type) && node.body) {
+          walk(node.body);
         }
       }
     };
@@ -274,46 +285,30 @@ export class Parser {
   }
 
   parseTopLevel() {
-    if (this.check(TokenType.SERVER)) {
-      if (!Parser.prototype._serverParserInstalled) {
-        installServerParser(Parser);
-      }
-      return this.parseServerBlock();
-    }
-    if (this.check(TokenType.CLIENT)) {
-      if (!Parser.prototype._clientParserInstalled) {
-        installClientParser(Parser);
+    // Registry-driven block dispatch
+    for (const plugin of BlockRegistry.all()) {
+      if (this._matchesBlock(plugin)) {
+        const p = plugin.parser;
+        if (p.install && p.installedFlag && !Parser.prototype[p.installedFlag]) {
+          p.install(Parser);
+        }
+        return this[p.method]();
       }
-      return this.parseClientBlock();
     }
-    if (this.check(TokenType.SHARED)) return this.parseSharedBlock();
     if (this.check(TokenType.IMPORT)) return this.parseImport();
-    // data block: data { ... }
-    if (this.check(TokenType.IDENTIFIER) && this.current().value === 'data' && this.peek(1).type === TokenType.LBRACE) {
-      return this.parseDataBlock();
-    }
-    // security block: security { ... }
-    if (this.check(TokenType.IDENTIFIER) && this.current().value === 'security' && this.peek(1).type === TokenType.LBRACE) {
-      if (!Parser.prototype._securityParserInstalled) {
-        installSecurityParser(Parser);
-      }
-      return this.parseSecurityBlock();
-    }
-    // test block: test "name" { ... } or test { ... }
-    if (this.check(TokenType.IDENTIFIER) && this.current().value === 'test') {
-      const next = this.peek(1);
-      if (next.type === TokenType.LBRACE || next.type === TokenType.STRING) {
-        return this.parseTestBlock();
-      }
+    return this.parseStatement();
+  }
+
+  _matchesBlock(plugin) {
+    const d = plugin.detection;
+    if (d.strategy === 'keyword') {
+      return this.check(TokenType[d.tokenType]);
     }
-    // bench block: bench "name" { ... } or bench { ... }
-    if (this.check(TokenType.IDENTIFIER) && this.current().value === 'bench') {
-      const next = this.peek(1);
-      if (next.type === TokenType.LBRACE || next.type === TokenType.STRING) {
-        return this.parseBenchBlock();
-      }
+    if (d.strategy === 'identifier') {
+      if (!this.check(TokenType.IDENTIFIER) || this.current().value !== d.identifierValue) return false;
+      return d.lookahead ? d.lookahead(this) : this.peek(1).type === TokenType.LBRACE;
     }
-    return this.parseStatement();
+    return false;
   }
 
   parseTestBlock() {
@@ -395,7 +390,7 @@ export class Parser {
   }
 
   // ─── Full-stack blocks ────────────────────────────────────
-  // parseClientBlock() and client-specific methods are in client-parser.js (lazy-loaded)
+  // parseBrowserBlock() and browser-specific methods are in browser-parser.js (lazy-loaded)
 
   parseSharedBlock() {
     const l = this.loc();
@@ -538,7 +533,7 @@ export class Parser {
     return new AST.RefreshPolicy(sourceName, { value, unit }, l);
   }
 
-  // Client-specific statements and JSX parsing are in client-parser.js (lazy-loaded)
+  // Browser-specific statements and JSX parsing are in browser-parser.js (lazy-loaded)
 
   // ─── Statements ───────────────────────────────────────────
 
@@ -997,6 +992,43 @@ export class Parser {
     return new AST.TypeAnnotation(name, typeParams, l);
   }
 
+  // Parse inline validators for type fields: { required, email, min(18) }
+  // Uses comma-separated validator names, supports args in parens
+  _parseTypeFieldValidators() {
+    const validators = [];
+    if (this.check(TokenType.LBRACE)) {
+      this.advance(); // consume {
+      while (!this.check(TokenType.RBRACE) && !this.isAtEnd()) {
+        validators.push(this._parseInlineValidator());
+        this.match(TokenType.COMMA); // optional comma separator
+      }
+      this.expect(TokenType.RBRACE, "Expected '}' to close validator block");
+    }
+    return validators;
+  }
+
+  // Parse a single inline validator: name or name(args...)
+  _parseInlineValidator() {
+    const l = this.loc();
+    let isAsync = false;
+    if (this.check(TokenType.ASYNC)) {
+      isAsync = true;
+      this.advance();
+    }
+    const name = this.expect(TokenType.IDENTIFIER, "Expected validator name").value;
+    const args = [];
+    if (this.match(TokenType.LPAREN)) {
+      if (!this.check(TokenType.RPAREN)) {
+        args.push(this.parseExpression());
+        while (this.match(TokenType.COMMA)) {
+          args.push(this.parseExpression());
+        }
+      }
+      this.expect(TokenType.RPAREN, "Expected ')' after validator arguments");
+    }
+    return new FormValidator(name, args, isAsync, l);
+  }
+
   parseTypeDeclaration() {
     const l = this.loc();
     this.expect(TokenType.TYPE);
@@ -1083,9 +1115,10 @@ export class Parser {
         this.expect(TokenType.RPAREN, "Expected ')' after variant fields");
         variants.push(new AST.TypeVariant(vname, fields, vl));
       } else if (this.match(TokenType.COLON)) {
-        // Simple field: name: String
+        // Simple field: name: String  or  name: String { required, email }
         const ftype = this.parseTypeAnnotation();
-        variants.push(new AST.TypeField(vname, ftype, vl));
+        const validators = this._parseTypeFieldValidators();
+        variants.push(new AST.TypeField(vname, ftype, vl, validators));
       } else {
         // Bare variant: None
         variants.push(new AST.TypeVariant(vname, [], vl));
@@ -1761,7 +1794,7 @@ export class Parser {
           expr = new AST.MemberExpression(expr, new AST.NumberLiteral(idx, l), true, l);
           continue;
         }
-        const prop = this.expect(TokenType.IDENTIFIER, "Expected property name after '.'").value;
+        const prop = this.expectPropertyName("Expected property name after '.'").value;
         expr = new AST.MemberExpression(expr, prop, false, l);
         continue;
       }
@@ -1769,7 +1802,7 @@ export class Parser {
       if (this.check(TokenType.QUESTION_DOT)) {
         const l = this.loc();
         this.advance();
-        const prop = this.expect(TokenType.IDENTIFIER, "Expected property name after '?.'").value;
+        const prop = this.expectPropertyName("Expected property name after '?.'").value;
         expr = new AST.OptionalChain(expr, prop, false, l);
         continue;
       }
@@ -1967,7 +2000,7 @@ export class Parser {
         return this.parseParenOrArrowLambda();
 
       case TokenType.SERVER:
-      case TokenType.CLIENT:
+      case TokenType.BROWSER:
       case TokenType.SHARED:
       case TokenType.DERIVE:
         return new AST.Identifier(this.advance().value, l);

package/src/registry/block-registry.js

@@ -0,0 +1,56 @@
+// Block Registry — central registry for block-type plugins.
+// Each plugin describes how to detect, parse, analyze, and codegen a block type.
+
+const _plugins = new Map();       // name → plugin
+const _astTypeMap = new Map();    // astNodeType → plugin | _NOOP_SENTINEL
+const _order = [];                // registration order
+
+// Sentinel value for noop AST types (returned by getByAstType to avoid a second lookup)
+const _NOOP_SENTINEL = Object.freeze({ __noop: true });
+
+export const BlockRegistry = {
+  NOOP: _NOOP_SENTINEL,
+
+  register(plugin) {
+    if (_plugins.has(plugin.name)) {
+      throw new Error(`Block plugin "${plugin.name}" already registered`);
+    }
+    _plugins.set(plugin.name, plugin);
+    _order.push(plugin);
+
+    // Map primary AST node type
+    if (plugin.astNodeType) {
+      _astTypeMap.set(plugin.astNodeType, plugin);
+    }
+
+    // Map child AST node types (for analyzer dispatch)
+    if (plugin.analyzer?.childNodeTypes) {
+      for (const t of plugin.analyzer.childNodeTypes) {
+        _astTypeMap.set(t, plugin);
+      }
+    }
+
+    // Register no-op leaf types as sentinel in the same map
+    if (plugin.analyzer?.noopNodeTypes) {
+      for (const t of plugin.analyzer.noopNodeTypes) {
+        _astTypeMap.set(t, _NOOP_SENTINEL);
+      }
+    }
+  },
+
+  get(name) {
+    return _plugins.get(name) || null;
+  },
+
+  getByAstType(type) {
+    return _astTypeMap.get(type) || null;
+  },
+
+  isNoopType(type) {
+    return _astTypeMap.get(type) === _NOOP_SENTINEL;
+  },
+
+  all() {
+    return _order; // callers must not mutate; treated as read-only
+  },
+};

package/src/registry/plugins/bench-plugin.js

@@ -0,0 +1,23 @@
+import { TokenType } from '../../lexer/tokens.js';
+
+export const benchPlugin = {
+  name: 'bench',
+  astNodeType: 'BenchBlock',
+  detection: {
+    strategy: 'identifier',
+    identifierValue: 'bench',
+    lookahead: (parser) => {
+      const next = parser.peek(1);
+      return next.type === TokenType.LBRACE || next.type === TokenType.STRING;
+    },
+  },
+  parser: {
+    install: null,
+    installedFlag: null,
+    method: 'parseBenchBlock',
+  },
+  analyzer: {
+    visit: (analyzer, node) => analyzer.visitTestBlock(node), // reuses test visitor
+  },
+  codegen: {},
+};

package/src/registry/plugins/browser-plugin.js

@@ -0,0 +1,30 @@
+import { installBrowserParser } from '../../parser/browser-parser.js';
+import { installBrowserAnalyzer } from '../../analyzer/browser-analyzer.js';
+
+export const browserPlugin = {
+  name: 'browser',
+  astNodeType: 'BrowserBlock',
+  detection: {
+    strategy: 'keyword',
+    tokenType: 'BROWSER',
+  },
+  parser: {
+    install: installBrowserParser,
+    installedFlag: '_browserParserInstalled',
+    method: 'parseBrowserBlock',
+  },
+  analyzer: {
+    visit: (analyzer, node) => {
+      if (!analyzer.constructor.prototype._browserAnalyzerInstalled) {
+        installBrowserAnalyzer(analyzer.constructor);
+      }
+      const methodName = 'visit' + node.type;
+      return analyzer[methodName](node);
+    },
+    childNodeTypes: [
+      'StateDeclaration', 'ComputedDeclaration', 'EffectDeclaration',
+      'ComponentDeclaration', 'StoreDeclaration', 'FormDeclaration',
+    ],
+  },
+  codegen: {},
+};

package/src/registry/plugins/cli-plugin.js

@@ -0,0 +1,24 @@
+import { installCliParser } from '../../parser/cli-parser.js';
+
+export const cliPlugin = {
+  name: 'cli',
+  astNodeType: 'CliBlock',
+  detection: {
+    strategy: 'identifier',
+    identifierValue: 'cli',
+  },
+  parser: {
+    install: installCliParser,
+    installedFlag: '_cliParserInstalled',
+    method: 'parseCliBlock',
+  },
+  analyzer: {
+    visit: (analyzer, node) => analyzer.visitCliBlock(node),
+    noopNodeTypes: ['CliConfigField', 'CliCommandDeclaration', 'CliParam'],
+    crossBlockValidate: (analyzer) => analyzer._validateCliCrossBlock(),
+  },
+  codegen: {
+    earlyReturn: true,
+    earlyReturnMethod: '_generateCli',
+  },
+};

package/src/registry/plugins/data-plugin.js

@@ -0,0 +1,21 @@
+export const dataPlugin = {
+  name: 'data',
+  astNodeType: 'DataBlock',
+  detection: {
+    strategy: 'identifier',
+    identifierValue: 'data',
+  },
+  parser: {
+    install: null,
+    installedFlag: null,
+    method: 'parseDataBlock',
+  },
+  analyzer: {
+    visit: (analyzer, node) => analyzer.visitDataBlock(node),
+    noopNodeTypes: [
+      'SourceDeclaration', 'PipelineDeclaration',
+      'ValidateBlock', 'RefreshPolicy',
+    ],
+  },
+  codegen: {},
+};

package/src/registry/plugins/edge-plugin.js

@@ -0,0 +1,32 @@
+import { installEdgeParser } from '../../parser/edge-parser.js';
+import { TokenType } from '../../lexer/tokens.js';
+
+export const edgePlugin = {
+  name: 'edge',
+  astNodeType: 'EdgeBlock',
+  detection: {
+    strategy: 'identifier',
+    identifierValue: 'edge',
+    lookahead: (parser) => {
+      const next = parser.peek(1);
+      // edge {} or edge "name" {}
+      return next.type === TokenType.LBRACE || next.type === TokenType.STRING;
+    },
+  },
+  parser: {
+    install: installEdgeParser,
+    installedFlag: '_edgeParserInstalled',
+    method: 'parseEdgeBlock',
+  },
+  analyzer: {
+    visit: (analyzer, node) => analyzer.visitEdgeBlock(node),
+    childNodeTypes: [],
+    noopNodeTypes: [
+      'EdgeKVDeclaration', 'EdgeSQLDeclaration', 'EdgeStorageDeclaration',
+      'EdgeQueueDeclaration', 'EdgeEnvDeclaration', 'EdgeSecretDeclaration',
+      'EdgeScheduleDeclaration', 'EdgeConsumeDeclaration', 'EdgeConfigField',
+    ],
+    crossBlockValidate: (analyzer) => analyzer._validateEdgeCrossBlock(),
+  },
+  codegen: {},
+};

package/src/registry/plugins/security-plugin.js

@@ -0,0 +1,27 @@
+import { installSecurityParser } from '../../parser/security-parser.js';
+
+export const securityPlugin = {
+  name: 'security',
+  astNodeType: 'SecurityBlock',
+  detection: {
+    strategy: 'identifier',
+    identifierValue: 'security',
+  },
+  parser: {
+    install: installSecurityParser,
+    installedFlag: '_securityParserInstalled',
+    method: 'parseSecurityBlock',
+  },
+  analyzer: {
+    visit: (analyzer, node) => analyzer.visitSecurityBlock(node),
+    noopNodeTypes: [
+      'SecurityAuthDeclaration', 'SecurityRoleDeclaration',
+      'SecurityProtectDeclaration', 'SecuritySensitiveDeclaration',
+      'SecurityCorsDeclaration', 'SecurityCspDeclaration',
+      'SecurityRateLimitDeclaration', 'SecurityCsrfDeclaration',
+      'SecurityAuditDeclaration',
+    ],
+    crossBlockValidate: (analyzer) => analyzer._validateSecurityCrossBlock(),
+  },
+  codegen: {},
+};

package/src/registry/plugins/server-plugin.js

@@ -0,0 +1,46 @@
+import { installServerParser } from '../../parser/server-parser.js';
+import { collectServerBlockFunctions, installServerAnalyzer } from '../../analyzer/server-analyzer.js';
+
+export const serverPlugin = {
+  name: 'server',
+  astNodeType: 'ServerBlock',
+  detection: {
+    strategy: 'keyword',
+    tokenType: 'SERVER',
+  },
+  parser: {
+    install: installServerParser,
+    installedFlag: '_serverParserInstalled',
+    method: 'parseServerBlock',
+  },
+  analyzer: {
+    visit: (analyzer, node) => {
+      if (!analyzer.constructor.prototype._serverAnalyzerInstalled) {
+        installServerAnalyzer(analyzer.constructor);
+      }
+      return analyzer._visitServerNode(node);
+    },
+    childNodeTypes: [
+      'RouteDeclaration', 'MiddlewareDeclaration', 'HealthCheckDeclaration',
+      'CorsDeclaration', 'ErrorHandlerDeclaration', 'WebSocketDeclaration',
+      'StaticDeclaration', 'DiscoverDeclaration', 'AuthDeclaration',
+      'MaxBodyDeclaration', 'RouteGroupDeclaration', 'RateLimitDeclaration',
+      'LifecycleHookDeclaration', 'SubscribeDeclaration', 'EnvDeclaration',
+      'ScheduleDeclaration', 'UploadDeclaration', 'SessionDeclaration',
+      'DbDeclaration', 'TlsDeclaration', 'CompressionDeclaration',
+      'BackgroundJobDeclaration', 'CacheDeclaration', 'SseDeclaration',
+      'ModelDeclaration',
+    ],
+    noopNodeTypes: ['AiConfigDeclaration'],
+    prePass: (analyzer) => {
+      const has = analyzer.ast.body.some(n => n.type === 'ServerBlock');
+      if (has) {
+        installServerAnalyzer(analyzer.constructor);
+        analyzer.serverBlockFunctions = collectServerBlockFunctions(analyzer.ast);
+      } else {
+        analyzer.serverBlockFunctions = new Map();
+      }
+    },
+  },
+  codegen: {},
+};

package/src/registry/plugins/shared-plugin.js

@@ -0,0 +1,17 @@
+export const sharedPlugin = {
+  name: 'shared',
+  astNodeType: 'SharedBlock',
+  detection: {
+    strategy: 'keyword',
+    tokenType: 'SHARED',
+  },
+  parser: {
+    install: null,
+    installedFlag: null,
+    method: 'parseSharedBlock',
+  },
+  analyzer: {
+    visit: (analyzer, node) => analyzer.visitSharedBlock(node),
+  },
+  codegen: {},
+};

package/src/registry/plugins/test-plugin.js

@@ -0,0 +1,23 @@
+import { TokenType } from '../../lexer/tokens.js';
+
+export const testPlugin = {
+  name: 'test',
+  astNodeType: 'TestBlock',
+  detection: {
+    strategy: 'identifier',
+    identifierValue: 'test',
+    lookahead: (parser) => {
+      const next = parser.peek(1);
+      return next.type === TokenType.LBRACE || next.type === TokenType.STRING;
+    },
+  },
+  parser: {
+    install: null,
+    installedFlag: null,
+    method: 'parseTestBlock',
+  },
+  analyzer: {
+    visit: (analyzer, node) => analyzer.visitTestBlock(node),
+  },
+  codegen: {},
+};

package/src/registry/register-all.js

@@ -0,0 +1,25 @@
+// Registers all built-in block plugins and re-exports BlockRegistry.
+// Import this module (instead of block-registry.js directly) to ensure all plugins are loaded.
+
+import { BlockRegistry } from './block-registry.js';
+import { serverPlugin } from './plugins/server-plugin.js';
+import { browserPlugin } from './plugins/browser-plugin.js';
+import { sharedPlugin } from './plugins/shared-plugin.js';
+import { securityPlugin } from './plugins/security-plugin.js';
+import { cliPlugin } from './plugins/cli-plugin.js';
+import { dataPlugin } from './plugins/data-plugin.js';
+import { testPlugin } from './plugins/test-plugin.js';
+import { benchPlugin } from './plugins/bench-plugin.js';
+import { edgePlugin } from './plugins/edge-plugin.js';
+
+BlockRegistry.register(serverPlugin);
+BlockRegistry.register(browserPlugin);
+BlockRegistry.register(sharedPlugin);
+BlockRegistry.register(securityPlugin);
+BlockRegistry.register(cliPlugin);
+BlockRegistry.register(dataPlugin);
+BlockRegistry.register(testPlugin);
+BlockRegistry.register(benchPlugin);
+BlockRegistry.register(edgePlugin);
+
+export { BlockRegistry };

package/src/runtime/ssr.js

@@ -243,7 +243,7 @@ export function renderHeadTags(tags) {
 // of tag descriptors for safe rendering: [{ tag: 'meta', attrs: { name: 'desc', content: '...' } }]
 // SECURITY: Raw string `head` must contain only developer-authored content — never user input.
 // Use the array form or renderHeadTags() for safe user-controlled head content.
-export function renderPage(component, { title = 'Tova App', head = '', scriptSrc = '/client.js', cspNonce } = {}) {
+export function renderPage(component, { title = 'Tova App', head = '', scriptSrc = '/browser.js', cspNonce } = {}) {
   const appHtml = renderToString(typeof component === 'function' ? component() : component);
   const headHtml = Array.isArray(head) ? renderHeadTags(head) : head;
   const nonceAttr = cspNonce ? ` nonce="${escapeAttr(cspNonce)}"` : '';
@@ -403,7 +403,7 @@ export function renderToReadableStream(vnode, options = {}) {
 
 // Render a full HTML page as a stream
 export function renderPageToStream(component, options = {}) {
-  const { title = 'Tova App', head = '', scriptSrc = '/client.js', onError, bufferSize, cspNonce } = options;
+  const { title = 'Tova App', head = '', scriptSrc = '/browser.js', onError, bufferSize, cspNonce } = options;
   const headHtml = Array.isArray(head) ? renderHeadTags(head) : head;
   const nonceAttr = cspNonce ? ` nonce="${escapeAttr(cspNonce)}"` : '';