veryfront 0.1.763 → 0.1.764

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.763",
+    "version": "0.1.764",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "minimumDependencyAge": "P2D",

package/esm/src/security/http/response/security-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/security-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAQjD,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAyED,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,EAC1B,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CAef;AAED,wBAAgB,QAAQ,CACtB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,MAAM,CAiBR;AAED,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CAMR;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,IAAI,CAqEN"}
+{"version":3,"file":"security-handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/security-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAQjD,wBAAgB,aAAa,IAAI,MAAM,CAItC;AA8ED,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,EAC1B,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CAef;AAED,wBAAgB,QAAQ,CACtB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,MAAM,CAiBR;AAED,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CAMR;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,IAAI,CAqEN"}

package/esm/src/security/http/response/security-handler.js

@@ -36,15 +36,19 @@ const VERYFRONT_FRAME_ANCESTORS = [
  *   html2canvas, legacy/browser ESM hydration)
  * - Styles:
  *   - style-src: 'self' + 'unsafe-inline' + Google Fonts + cdn.veryfront.com
- *     so React style="" attributes and framework inline styles remain
- *     compatible. Do not include a nonce in style-src here: browsers ignore
- *     'unsafe-inline' when a nonce/hash is present on the directive, which
- *     breaks React style attributes.
- *   - style-src-elem: nonce-based + Google Fonts + cdn.veryfront.com for
- *     inline <style> tags and stylesheet elements
+ *     + Video.js CDN so React style="" attributes, framework inline styles,
+ *     and common media-player stylesheets remain compatible. Do not include a
+ *     nonce in style directives here: browsers ignore 'unsafe-inline' when a
+ *     nonce/hash is present, which breaks runtime-created style attributes and
+ *     style elements.
+ *   - style-src-elem: 'unsafe-inline' + Google Fonts + cdn.veryfront.com +
+ *     Video.js CDN for runtime-created <style> tags and stylesheet elements
  *   - style-src-attr: 'unsafe-inline' for modern browsers with directive-level
  *     style attribute support
- * - Images/media/fonts: 'self' + data: + https: + cdn.veryfront.com
+ * - Images/fonts: 'self' + data: + https: + cdn.veryfront.com
+ * - Media: 'self' + https: + blob: where browser media pipelines require
+ *   object URLs
+ * - Workers: 'self' + blob: for browser libraries that create blob workers
  * - Connections: 'self' + wss: + https: (WebSocket for HMR/live reload, API calls)
  * - Objects: 'none' (block Flash/plugins)
  * - Frames: 'self' (allows same-origin iframes; apps embedding external
@@ -63,13 +67,14 @@ function buildDefaultCSP(nonce, isVeryfrontDomain) {
     return [
         `default-src 'self'`,
         `script-src 'self' 'nonce-${nonce}' https://cdn.jsdelivr.net https://esm.sh`,
-        `style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.veryfront.com`,
-        `style-src-elem 'self' 'nonce-${nonce}' https://fonts.googleapis.com https://cdn.veryfront.com`,
+        `style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.veryfront.com https://vjs.zencdn.net`,
+        `style-src-elem 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.veryfront.com https://vjs.zencdn.net`,
         `style-src-attr 'unsafe-inline'`,
         `img-src 'self' data: https:`,
         `font-src 'self' data: https://fonts.gstatic.com https://cdn.veryfront.com`,
         `connect-src 'self' wss: https:`,
-        `media-src 'self' https:`,
+        `media-src 'self' https: blob:`,
+        `worker-src 'self' blob:`,
         `object-src 'none'`,
         `frame-src 'self'`,
         frameAncestors,

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.763";
+export declare const VERSION = "0.1.764";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.763";
+export const VERSION = "0.1.764";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.763",
+  "version": "0.1.764",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",