veryfront 0.1.124 → 0.1.126

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/esm/deno.js +1 -1
  2. package/esm/src/security/http/response/security-handler.d.ts.map +1 -1
  3. package/esm/src/security/http/response/security-handler.js +12 -4
  4. package/esm/src/utils/version-constant.d.ts +1 -1
  5. package/esm/src/utils/version-constant.js +1 -1
  6. package/package.json +1 -1
  7. package/src/deno.js +1 -1
  8. package/src/src/security/http/response/security-handler.ts +12 -4
  9. package/src/src/utils/version-constant.ts +1 -1
package/esm/deno.js CHANGED
@@ -1,6 +1,6 @@
1
1
  export default {
2
2
  "name": "veryfront",
3
- "version": "0.1.124",
3
+ "version": "0.1.126",
4
4
  "license": "Apache-2.0",
5
5
  "nodeModulesDir": "auto",
6
6
  "exclude": [
package/esm/src/security/http/response/security-handler.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"security-handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/security-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAQjD,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAmCD,wBAAgB,QAAQ,CACtB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CA4BR;AAED,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CAMR;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,CAAC,OAAO,EACxB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,IAAI,CA6DN"}
1
+ {"version":3,"file":"security-handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/security-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAQjD,wBAAgB,aAAa,IAAI,MAAM,CAItC;AA2CD,wBAAgB,QAAQ,CACtB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CA4BR;AAED,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CAMR;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,CAAC,OAAO,EACxB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,IAAI,CA6DN"}
package/esm/src/security/http/response/security-handler.js CHANGED
@@ -14,9 +14,16 @@ export function generateNonce() {
14
14
  *
15
15
  * - Scripts: nonce-based + cdn.jsdelivr.net + esm.sh (Scalar API docs,
16
16
  * html2canvas, legacy/browser ESM hydration)
17
- * - Styles: 'self' + 'unsafe-inline' + nonce + Google Fonts + cdn.veryfront.com
18
- * plus style-src-attr 'unsafe-inline' so React style="" attributes remain
19
- * compatible while inline <style> tags continue to use the nonce
17
+ * - Styles:
18
+ * - style-src: 'self' + 'unsafe-inline' + Google Fonts + cdn.veryfront.com
19
+ * so React style="" attributes and framework inline styles remain
20
+ * compatible. Do not include a nonce in style-src here: browsers ignore
21
+ * 'unsafe-inline' when a nonce/hash is present on the directive, which
22
+ * breaks React style attributes.
23
+ * - style-src-elem: nonce-based + Google Fonts + cdn.veryfront.com for
24
+ * inline <style> tags and stylesheet elements
25
+ * - style-src-attr: 'unsafe-inline' for modern browsers with directive-level
26
+ * style attribute support
20
27
  * - Images/media/fonts: 'self' + data: + https: + cdn.veryfront.com
21
28
  * - Connections: 'self' + wss: + https: (WebSocket for HMR/live reload, API calls)
22
29
  * - Objects: 'none' (block Flash/plugins)
@@ -29,7 +36,8 @@ function buildDefaultCSP(nonce) {
29
36
  return [
30
37
  `default-src 'self'`,
31
38
  `script-src 'self' 'nonce-${nonce}' https://cdn.jsdelivr.net https://esm.sh`,
32
- `style-src 'self' 'unsafe-inline' 'nonce-${nonce}' https://fonts.googleapis.com https://cdn.veryfront.com`,
39
+ `style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.veryfront.com`,
40
+ `style-src-elem 'self' 'nonce-${nonce}' https://fonts.googleapis.com https://cdn.veryfront.com`,
33
41
  `style-src-attr 'unsafe-inline'`,
34
42
  `img-src 'self' data: https:`,
35
43
  `font-src 'self' data: https://fonts.gstatic.com https://cdn.veryfront.com`,
package/esm/src/utils/version-constant.d.ts CHANGED
@@ -1,2 +1,2 @@
1
- export declare const VERSION = "0.1.124";
1
+ export declare const VERSION = "0.1.126";
2
2
  //# sourceMappingURL=version-constant.d.ts.map
package/esm/src/utils/version-constant.js CHANGED
@@ -1,3 +1,3 @@
1
1
  // Keep in sync with deno.json version.
2
2
  // scripts/release.ts updates this constant during releases.
3
- export const VERSION = "0.1.124";
3
+ export const VERSION = "0.1.126";
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "veryfront",
3
- "version": "0.1.124",
3
+ "version": "0.1.126",
4
4
  "description": "The simplest way to build AI-powered apps",
5
5
  "keywords": [
6
6
  "react",
package/src/deno.js CHANGED
@@ -1,6 +1,6 @@
1
1
  export default {
2
2
  "name": "veryfront",
3
- "version": "0.1.124",
3
+ "version": "0.1.126",
4
4
  "license": "Apache-2.0",
5
5
  "nodeModulesDir": "auto",
6
6
  "exclude": [
package/src/src/security/http/response/security-handler.ts CHANGED
@@ -20,9 +20,16 @@ export function generateNonce(): string {
20
20
  *
21
21
  * - Scripts: nonce-based + cdn.jsdelivr.net + esm.sh (Scalar API docs,
22
22
  * html2canvas, legacy/browser ESM hydration)
23
- * - Styles: 'self' + 'unsafe-inline' + nonce + Google Fonts + cdn.veryfront.com
24
- * plus style-src-attr 'unsafe-inline' so React style="" attributes remain
25
- * compatible while inline <style> tags continue to use the nonce
23
+ * - Styles:
24
+ * - style-src: 'self' + 'unsafe-inline' + Google Fonts + cdn.veryfront.com
25
+ * so React style="" attributes and framework inline styles remain
26
+ * compatible. Do not include a nonce in style-src here: browsers ignore
27
+ * 'unsafe-inline' when a nonce/hash is present on the directive, which
28
+ * breaks React style attributes.
29
+ * - style-src-elem: nonce-based + Google Fonts + cdn.veryfront.com for
30
+ * inline <style> tags and stylesheet elements
31
+ * - style-src-attr: 'unsafe-inline' for modern browsers with directive-level
32
+ * style attribute support
26
33
  * - Images/media/fonts: 'self' + data: + https: + cdn.veryfront.com
27
34
  * - Connections: 'self' + wss: + https: (WebSocket for HMR/live reload, API calls)
28
35
  * - Objects: 'none' (block Flash/plugins)
@@ -35,7 +42,8 @@ function buildDefaultCSP(nonce: string): string {
35
42
  return [
36
43
  `default-src 'self'`,
37
44
  `script-src 'self' 'nonce-${nonce}' https://cdn.jsdelivr.net https://esm.sh`,
38
- `style-src 'self' 'unsafe-inline' 'nonce-${nonce}' https://fonts.googleapis.com https://cdn.veryfront.com`,
45
+ `style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.veryfront.com`,
46
+ `style-src-elem 'self' 'nonce-${nonce}' https://fonts.googleapis.com https://cdn.veryfront.com`,
39
47
  `style-src-attr 'unsafe-inline'`,
40
48
  `img-src 'self' data: https:`,
41
49
  `font-src 'self' data: https://fonts.gstatic.com https://cdn.veryfront.com`,
package/src/src/utils/version-constant.ts CHANGED
@@ -1,3 +1,3 @@
1
1
  // Keep in sync with deno.json version.
2
2
  // scripts/release.ts updates this constant during releases.
3
- export const VERSION = "0.1.124";
3
+ export const VERSION = "0.1.126";