vike 0.4.238 → 0.4.239

package/dist/cjs/node/prerender/resolvePrerenderConfig.js

@@ -4,6 +4,7 @@ exports.resolvePrerenderConfigGlobal = resolvePrerenderConfigGlobal;
 exports.resolvePrerenderConfigLocal = resolvePrerenderConfigLocal;
 const utils_js_1 = require("./utils.js");
 const getConfigValueBuildTime_js_1 = require("../../shared/page-configs/getConfigValueBuildTime.js");
+const getConfigDefinedAt_js_1 = require("../../shared/page-configs/getConfigDefinedAt.js");
 // When setting +prerender to an object => it also enables pre-rendering
 const defaultValueForObject = true;
 function resolvePrerenderConfigGlobal(vikeConfig) {
@@ -51,9 +52,9 @@ function resolvePrerenderConfigLocal(pageConfig) {
     const values = configValue.value;
     (0, utils_js_1.assert)((0, utils_js_1.isArray)(values));
     const value = values[0];
-    // If it's set to an object in a local config then Vike considers it a global config and it's skipped from local inheritance, thus we can assume the value to be a boolean.
-    (0, utils_js_1.assert)(typeof value === 'boolean');
     (0, utils_js_1.assert)((0, utils_js_1.isArray)(configValue.definedAtData));
+    const configDefinedAt = (0, getConfigDefinedAt_js_1.getConfigDefinedAt)('Config', 'prerender', configValue.definedAtData);
+    (0, utils_js_1.assertUsage)(typeof value === 'boolean', `${configDefinedAt} must be a boolean (it isn't defined at a global location)`);
     const prerenderConfigLocal = { value };
     return prerenderConfigLocal;
 }

package/dist/cjs/node/runtime/index.js

@@ -23,10 +23,10 @@ const assert_js_1 = require("../../utils/assert.js");
 (0, assert_js_1.assert)(!(0, isBrowser_js_1.isBrowser)());
 var renderPage_js_1 = require("./renderPage.js");
 Object.defineProperty(exports, "renderPage", { enumerable: true, get: function () { return renderPage_js_1.renderPage; } });
-var renderHtml_js_1 = require("./html/renderHtml.js");
+var renderHtml_js_1 = require("./renderPage/html/renderHtml.js");
 Object.defineProperty(exports, "escapeInject", { enumerable: true, get: function () { return renderHtml_js_1.escapeInject; } });
 Object.defineProperty(exports, "dangerouslySkipEscape", { enumerable: true, get: function () { return renderHtml_js_1.dangerouslySkipEscape; } });
-var stream_js_1 = require("./html/stream.js");
+var stream_js_1 = require("./renderPage/html/stream.js");
 Object.defineProperty(exports, "pipeWebStream", { enumerable: true, get: function () { return stream_js_1.pipeWebStream; } });
 Object.defineProperty(exports, "pipeNodeStream", { enumerable: true, get: function () { return stream_js_1.pipeNodeStream; } });
 Object.defineProperty(exports, "pipeStream", { enumerable: true, get: function () { return stream_js_1.pipeStream; } });
@@ -42,7 +42,7 @@ Object.defineProperty(exports, "createDevMiddleware", { enumerable: true, get: f
 // TO-DO/next-major-release: remove
 // Deprecated exports
 __exportStar(require("../../types/index-dreprecated.js"), exports);
-var injectAssets__public_js_1 = require("./html/injectAssets/injectAssets__public.js");
+var injectAssets__public_js_1 = require("./renderPage/html/injectAssets/injectAssets__public.js");
 Object.defineProperty(exports, "_injectAssets", { enumerable: true, get: function () { return injectAssets__public_js_1.injectAssets__public; } });
 var createPageRenderer_js_1 = require("../createPageRenderer.js");
 Object.defineProperty(exports, "createPageRenderer", { enumerable: true, get: function () { return createPageRenderer_js_1.createPageRenderer; } });

package/dist/cjs/node/runtime/page-files/setup.js

@@ -1,3 +1,5 @@
 "use strict";
-// TO-DO/next-major-release: remove https://github.com/vikejs/vike/issues/2122
+// TO-DO/eventually: remove
+// - This was used by some older Vike extensions made by Joël (I believe vite-plugin-vercel)
+// - See also https://github.com/vikejs/vike/issues/2122
 // This doesn't do anything anymore. (It's kept to avoid introducing a breaking change.)

package/dist/cjs/node/runtime/renderPage/createHttpResponse.js

@@ -12,7 +12,7 @@ const error_page_js_1 = require("../../../shared/error-page.js");
 const getHttpResponseBody_js_1 = require("./getHttpResponseBody.js");
 const getEarlyHints_js_1 = require("./getEarlyHints.js");
 const assertNoInfiniteHttpRedirect_js_1 = require("./createHttpResponse/assertNoInfiniteHttpRedirect.js");
-const getCacheControl_js_1 = require("./getCacheControl.js");
+const headersResponse_js_1 = require("./headersResponse.js");
 async function createHttpResponsePage(htmlRender, renderHook, pageContext) {
     let statusCode = pageContext.abortStatusCode;
     if (!statusCode) {
@@ -30,14 +30,7 @@ async function createHttpResponsePage(htmlRender, renderHook, pageContext) {
         }
     }
     const earlyHints = (0, getEarlyHints_js_1.getEarlyHints)(await pageContext.__getPageAssets());
-    const headers = [];
-    const headersResponse = pageContext.headersResponse || new Headers();
-    headersResponse.forEach((value, key) => {
-        headers.push([key, value]);
-    });
-    // An 5xx error page shouldn't be cached (it should be temporary)
-    if (statusCode >= 500)
-        headersResponse.set('Cache-Control', getCacheControl_js_1.cacheControlDisable);
+    const headers = (0, headersResponse_js_1.resolveHeadersResponseFinal)(pageContext, statusCode);
     return createHttpResponse(statusCode, 'text/html;charset=utf-8', headers, htmlRender, earlyHints, renderHook);
 }
 function createHttpResponse404(errMsg404) {

package/dist/cjs/node/runtime/renderPage/createPageContextServerSide.js

@@ -19,7 +19,7 @@ function createPageContextServerSide(pageContextInit, globalContext, args) {
         _urlHandler: args.ssr?.urlHandler ?? null,
         isClientSideNavigation: args.ssr?.isClientSideNavigation ?? false,
     });
-    (0, utils_js_1.objectAssign)(pageContextCreated, globalContext._vikeConfigPublicGlobal);
+    (0, utils_js_1.objectAssign)(pageContextCreated, globalContext._globalConfigPublic);
     // pageContext.urlParsed
     const pageContextUrlComputed = (0, getPageContextUrlComputed_js_1.getPageContextUrlComputed)(pageContextCreated);
     (0, utils_js_1.objectAssign)(pageContextCreated, pageContextUrlComputed);
@@ -40,7 +40,7 @@ function createPageContextServerSide(pageContextInit, globalContext, args) {
         }
         (0, utils_js_1.objectAssign)(pageContextCreated, { headers });
     }
-    const pageContextAugmented = (0, createPageContextShared_js_1.createPageContextShared)(pageContextCreated, globalContext._vikeConfigPublicGlobal);
+    const pageContextAugmented = (0, createPageContextShared_js_1.createPageContextShared)(pageContextCreated, globalContext._globalConfigPublic);
     (0, utils_js_1.updateType)(pageContextCreated, pageContextAugmented);
     return pageContextCreated;
 }

package/dist/cjs/node/runtime/renderPage/csp.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolvePageContextCspNone = resolvePageContextCspNone;
+exports.inferNonceAttr = inferNonceAttr;
+exports.addCspResponseHeader = addCspResponseHeader;
+const import_1 = require("@brillout/import");
+const utils_js_1 = require("../utils.js");
+async function resolvePageContextCspNone(pageContext) {
+    if (pageContext.cspNonce)
+        return null; // already set by user e.g. `renderPage({ cspNonce: '123456789' })`
+    const { csp } = pageContext.config;
+    const pageContextAddendum = { cspNonce: null };
+    if (csp?.nonce) {
+        if (csp.nonce === true) {
+            pageContextAddendum.cspNonce = await generateNonce();
+        }
+        else {
+            pageContextAddendum.cspNonce = await csp.nonce(pageContext);
+        }
+    }
+    return pageContextAddendum;
+}
+// Generate a cryptographically secure nonce for Content Security Policy (CSP).
+// Returns a base64url-encoded nonce string (URL-safe, no padding).
+// https://github.com/vikejs/vike/issues/1554#issuecomment-3181128304
+async function generateNonce() {
+    let cryptoModule;
+    try {
+        cryptoModule = (await (0, import_1.import_)('crypto')).default;
+    }
+    catch {
+        return Math.random().toString(36).substring(2, 18);
+    }
+    return cryptoModule.randomBytes(16).toString('base64url');
+}
+function inferNonceAttr(pageContext) {
+    const nonceAttr = pageContext.cspNonce ? ` nonce="${pageContext.cspNonce}"` : '';
+    return nonceAttr;
+}
+function addCspResponseHeader(pageContext, headersResponse) {
+    (0, utils_js_1.assert)(pageContext.cspNonce === null || typeof pageContext.cspNonce === 'string'); // ensure resolvePageContextCspNone() is called before addCspResponseHeader()
+    if (!pageContext.cspNonce)
+        return;
+    if (headersResponse.get('Content-Security-Policy'))
+        return;
+    headersResponse.set('Content-Security-Policy', `script-src 'self' 'nonce-${pageContext.cspNonce}'`);
+}

package/dist/cjs/node/runtime/renderPage/execHookOnRenderHtml.js

@@ -4,10 +4,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.execHookOnRenderHtml = execHookOnRenderHtml;
-const renderHtml_js_1 = require("../html/renderHtml.js");
+const renderHtml_js_1 = require("./html/renderHtml.js");
 const getHook_js_1 = require("../../../shared/hooks/getHook.js");
 const utils_js_1 = require("../utils.js");
-const stream_js_1 = require("../html/stream.js");
+const stream_js_1 = require("./html/stream.js");
 const assertPageContextProvidedByUser_js_1 = require("../../../shared/assertPageContextProvidedByUser.js");
 const preparePageContextForPublicUsageServer_js_1 = require("./preparePageContextForPublicUsageServer.js");
 const assertHookReturnedObject_js_1 = require("../../../shared/assertHookReturnedObject.js");

package/dist/cjs/node/runtime/renderPage/getEarlyHints.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getEarlyHints = getEarlyHints;
 const isFontFallback_js_1 = require("./isFontFallback.js");
-const inferHtmlTags_js_1 = require("../html/injectAssets/inferHtmlTags.js");
+const inferHtmlTags_js_1 = require("./html/injectAssets/inferHtmlTags.js");
 function getEarlyHints(assets) {
     const earlyHints = [];
     {

package/dist/cjs/node/runtime/renderPage/getHttpResponseBody.js

@@ -5,9 +5,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getHttpResponseBody = getHttpResponseBody;
 exports.getHttpResponseBodyStreamHandlers = getHttpResponseBodyStreamHandlers;
-const stream_js_1 = require("../html/stream.js");
+const stream_js_1 = require("./html/stream.js");
 const utils_js_1 = require("../utils.js");
-const renderHtml_js_1 = require("../html/renderHtml.js");
+const renderHtml_js_1 = require("./html/renderHtml.js");
 const picocolors_1 = __importDefault(require("@brillout/picocolors"));
 const streamDocs = 'See https://vike.dev/streaming for more information.';
 function getHttpResponseBody(htmlRender, renderHook) {

package/dist/cjs/node/runtime/renderPage/headersResponse.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveHeadersResponseEarly = resolveHeadersResponseEarly;
+exports.resolveHeadersResponseFinal = resolveHeadersResponseFinal;
+const csp_js_1 = require("./csp.js");
+const utils_js_1 = require("../utils.js");
+const getCacheControl_js_1 = require("./getCacheControl.js");
+function resolveHeadersResponseFinal(pageContext, statusCode) {
+    const headersResponse = pageContext.headersResponse || new Headers();
+    // 5xx error pages are temporary and shouldn't be cached.
+    // This overrides any previously set Cache-Control value.
+    if (statusCode >= 500)
+        headersResponse.set('Cache-Control', getCacheControl_js_1.cacheControlDisable);
+    const headers = [];
+    headersResponse.forEach((value, key) => {
+        headers.push([key, value]);
+    });
+    return headers;
+}
+async function resolveHeadersResponseEarly(pageContext) {
+    const headersResponse = await resolveHeadersResponseConfig(pageContext);
+    if (!headersResponse.get('Cache-Control')) {
+        const cacheControl = (0, getCacheControl_js_1.getCacheControl)(pageContext.pageId, pageContext._globalContext._pageConfigs);
+        if (cacheControl)
+            headersResponse.set('Cache-Control', cacheControl);
+    }
+    (0, csp_js_1.addCspResponseHeader)(pageContext, headersResponse);
+    const pageContextAddendum = {
+        headersResponse,
+    };
+    return pageContextAddendum;
+}
+async function resolveHeadersResponseConfig(pageContext) {
+    const headersMerged = new Headers();
+    await Promise.all((pageContext.config.headersResponse ?? []).map(async (headers) => {
+        let headersInit;
+        if ((0, utils_js_1.isCallable)(headers)) {
+            headersInit = await headers(pageContext);
+        }
+        else {
+            headersInit = headers;
+        }
+        new Headers(headersInit).forEach((value, key) => {
+            headersMerged.append(key, value);
+        });
+    }));
+    return headersMerged;
+}

package/dist/cjs/node/runtime/{html → renderPage/html}/injectAssets/getHtmlTags.js

@@ -4,17 +4,18 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getHtmlTags = getHtmlTags;
-const utils_js_1 = require("../../utils.js");
+const utils_js_1 = require("../../../utils.js");
 const serializeContext_js_1 = require("../serializeContext.js");
 const sanitizeJson_js_1 = require("./sanitizeJson.js");
 const inferHtmlTags_js_1 = require("./inferHtmlTags.js");
 const mergeScriptTags_js_1 = require("./mergeScriptTags.js");
-const helpers_js_1 = require("../../../../shared/page-configs/helpers.js");
-const getConfigValueRuntime_js_1 = require("../../../../shared/page-configs/getConfigValueRuntime.js");
+const helpers_js_1 = require("../../../../../shared/page-configs/helpers.js");
+const getConfigValueRuntime_js_1 = require("../../../../../shared/page-configs/getConfigValueRuntime.js");
 const picocolors_1 = __importDefault(require("@brillout/picocolors"));
-const getConfigDefinedAt_js_1 = require("../../../../shared/page-configs/getConfigDefinedAt.js");
-const htmlElementIds_js_1 = require("../../../../shared/htmlElementIds.js");
-const isFontFallback_js_1 = require("../../renderPage/isFontFallback.js");
+const getConfigDefinedAt_js_1 = require("../../../../../shared/page-configs/getConfigDefinedAt.js");
+const htmlElementIds_js_1 = require("../../../../../shared/htmlElementIds.js");
+const isFontFallback_js_1 = require("../../isFontFallback.js");
+const csp_js_1 = require("../../csp.js");
 const stamp = '__injectFilterEntry';
 async function getHtmlTags(pageContext, streamFromReactStreamingPackage, injectFilter, pageAssets, viteDevScript, isStream) {
     (0, utils_js_1.assert)([true, false].includes(pageContext._isHtmlOnly));
@@ -81,7 +82,7 @@ async function getHtmlTags(pageContext, streamFromReactStreamingPackage, injectF
         .forEach((asset) => {
         if (!asset.inject)
             return;
-        const htmlTag = asset.isEntry ? (0, inferHtmlTags_js_1.inferAssetTag)(asset) : (0, inferHtmlTags_js_1.inferPreloadTag)(asset);
+        const htmlTag = asset.isEntry ? (0, inferHtmlTags_js_1.inferAssetTag)(asset, pageContext) : (0, inferHtmlTags_js_1.inferPreloadTag)(asset);
         htmlTags.push({ htmlTag, position: asset.inject });
     });
     // ==========
@@ -142,7 +143,7 @@ async function getHtmlTags(pageContext, streamFromReactStreamingPackage, injectF
         });
     }
     // The JavaScript entry <script> tag
-    const scriptEntry = mergeScriptEntries(pageAssets, viteDevScript);
+    const scriptEntry = mergeScriptEntries(pageAssets, viteDevScript, pageContext);
     if (scriptEntry) {
         htmlTags.push({
             htmlTag: scriptEntry,
@@ -163,9 +164,9 @@ async function getHtmlTags(pageContext, streamFromReactStreamingPackage, injectF
     });
     return htmlTags;
 }
-function mergeScriptEntries(pageAssets, viteDevScript) {
+function mergeScriptEntries(pageAssets, viteDevScript, pageContext) {
     const scriptEntries = pageAssets.filter((pageAsset) => pageAsset.isEntry && pageAsset.assetType === 'script');
-    let scriptEntry = `${viteDevScript}${scriptEntries.map((asset) => (0, inferHtmlTags_js_1.inferAssetTag)(asset)).join('')}`;
+    let scriptEntry = `${viteDevScript}${scriptEntries.map((asset) => (0, inferHtmlTags_js_1.inferAssetTag)(asset, pageContext)).join('')}`;
     // We merge scripts to avoid the infamous HMR preamble error.
     // - Infamous HMR preamble error:
     //   ```browser-console
@@ -183,12 +184,13 @@ function mergeScriptEntries(pageAssets, viteDevScript) {
     //   ```
     // - Maybe an alternative would be to make Vike's client runtime entry <script> tag non-async. Would that work? Would it be a performance issue?
     //   - The entry <script> shouldn't be `<script defer>` upon HTML streaming, otherwise progressive hydration while SSR streaming won't work.
-    scriptEntry = (0, mergeScriptTags_js_1.mergeScriptTags)(scriptEntry);
+    scriptEntry = (0, mergeScriptTags_js_1.mergeScriptTags)(scriptEntry, pageContext);
     return scriptEntry;
 }
 function getPageContextJsonScriptTag(pageContext) {
     const pageContextClientSerialized = (0, sanitizeJson_js_1.sanitizeJson)((0, serializeContext_js_1.getPageContextClientSerialized)(pageContext, true));
-    const htmlTag = `<script id="${htmlElementIds_js_1.htmlElementId_pageContext}" type="application/json">${pageContextClientSerialized}</script>`;
+    const nonceAttr = (0, csp_js_1.inferNonceAttr)(pageContext);
+    const htmlTag = `<script id="${htmlElementIds_js_1.htmlElementId_pageContext}" type="application/json"${nonceAttr}>${pageContextClientSerialized}</script>`;
     // Used by contra.com https://github.com/gajus
     // @ts-expect-error
     pageContext._pageContextHtmlTag = htmlTag;
@@ -196,7 +198,8 @@ function getPageContextJsonScriptTag(pageContext) {
 }
 function getGlobalContextJsonScriptTag(pageContext) {
     const globalContextClientSerialized = (0, sanitizeJson_js_1.sanitizeJson)((0, serializeContext_js_1.getGlobalContextClientSerialized)(pageContext, true));
-    const htmlTag = `<script id="${htmlElementIds_js_1.htmlElementId_globalContext}" type="application/json">${globalContextClientSerialized}</script>`;
+    const nonceAttr = (0, csp_js_1.inferNonceAttr)(pageContext);
+    const htmlTag = `<script id="${htmlElementIds_js_1.htmlElementId_globalContext}" type="application/json"${nonceAttr}>${globalContextClientSerialized}</script>`;
     return htmlTag;
 }
 function assertInjectFilterEntries(injectFilterEntries) {

package/dist/cjs/node/runtime/{html → renderPage/html}/injectAssets/getViteDevScript.js

@@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getViteDevScript = getViteDevScript;
-const utils_js_1 = require("../../utils.js");
+const utils_js_1 = require("../../../utils.js");
 const picocolors_1 = __importDefault(require("@brillout/picocolors"));
 const reachOutCTA = 'Create a new GitHub issue to discuss a solution.';
 async function getViteDevScript(pageContext) {

package/dist/cjs/node/runtime/{html → renderPage/html}/injectAssets/inferHtmlTags.js

@@ -1,13 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.scriptAttrs = void 0;
+exports.scriptCommonAttrs = void 0;
 exports.inferAssetTag = inferAssetTag;
 exports.inferPreloadTag = inferPreloadTag;
 exports.inferEarlyHintLink = inferEarlyHintLink;
-const utils_js_1 = require("../../utils.js");
+const utils_js_1 = require("../../../utils.js");
+const csp_js_1 = require("../../csp.js");
 // We can't use `defer` here. With `defer`, the entry script won't start before `</body>` has been parsed, preventing progressive hydration during SSR streaming, see https://github.com/vikejs/vike/pull/1271
-const scriptAttrs = 'type="module" async';
-exports.scriptAttrs = scriptAttrs;
+const scriptCommonAttrs = 'type="module" async';
+exports.scriptCommonAttrs = scriptCommonAttrs;
 function inferPreloadTag(pageAsset) {
     const { src, assetType, mediaType } = pageAsset;
     const rel = getRel(pageAsset);
@@ -23,11 +24,12 @@ function inferPreloadTag(pageAsset) {
         .join(' ');
     return `<link ${attributes}>`;
 }
-function inferAssetTag(pageAsset) {
+function inferAssetTag(pageAsset, pageContext) {
     const { src, assetType, mediaType } = pageAsset;
     if (assetType === 'script') {
         (0, utils_js_1.assert)(mediaType === 'text/javascript');
-        return `<script src="${src}" ${scriptAttrs}></script>`;
+        const nonceAttr = (0, csp_js_1.inferNonceAttr)(pageContext);
+        return `<script src="${src}" ${scriptCommonAttrs}${nonceAttr}></script>`;
     }
     if (assetType === 'style') {
         // WARNING: if changing following line, then also update https://github.com/vikejs/vike/blob/fae90a15d88e5e87ca9fcbb54cf2dc8773d2f229/vike/client/shared/removeFoucBuster.ts#L29

package/dist/cjs/node/runtime/{html → renderPage/html}/injectAssets/injectAssets__public.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.injectAssets__public = injectAssets__public;
-const utils_js_1 = require("../../utils.js");
+const utils_js_1 = require("../../../utils.js");
 const injectAssets_js_1 = require("../injectAssets.js");
 // TO-DO/next-major-release: remove
 async function injectAssets__public(htmlString, pageContext) {

package/dist/cjs/node/runtime/{html → renderPage/html}/injectAssets/injectHtmlTags.js

@@ -7,7 +7,7 @@ exports.createHtmlHeadIfMissing = createHtmlHeadIfMissing;
 exports.joinHtmlTags = joinHtmlTags;
 exports.injectAtOpeningTag = injectAtOpeningTag;
 exports.injectAtClosingTag = injectAtClosingTag;
-const utils_js_1 = require("../../utils.js");
+const utils_js_1 = require("../../../utils.js");
 function injectHtmlTags(htmlString, htmlTags, position) {
     const htmlFragment = joinHtmlTags(htmlTags.filter((h) => h.position === position));
     if (htmlFragment) {

package/dist/cjs/node/runtime/{html → renderPage/html}/injectAssets/mergeScriptTags.js

@@ -1,12 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.mergeScriptTags = mergeScriptTags;
-const utils_js_1 = require("../../utils.js");
+const csp_js_1 = require("../../csp.js");
+const utils_js_1 = require("../../../utils.js");
 const inferHtmlTags_js_1 = require("./inferHtmlTags.js");
 const scriptRE = /(<script\b(?:\s[^>]*>|>))(.*?)<\/script>/gims;
 const srcRE = /\bsrc\s*=\s*(?:"([^"]+)"|'([^']+)'|([^\s'">]+))/im;
 const typeRE = /\btype\s*=\s*(?:"([^"]+)"|'([^']+)'|([^\s'">]+))/im;
-function mergeScriptTags(scriptTagsHtml) {
+function mergeScriptTags(scriptTagsHtml, pageContext) {
     let scriptTag = '';
     const scripts = parseScripts(scriptTagsHtml);
     // We need to merge module scripts to ensure execution order
@@ -35,7 +36,8 @@ function mergeScriptTags(scriptTagsHtml) {
                 }
             });
             if (contents.length > 0) {
-                scriptTag += `<script ${inferHtmlTags_js_1.scriptAttrs}>\n${contents.join('\n')}\n</script>`;
+                const nonceAttr = (0, csp_js_1.inferNonceAttr)(pageContext);
+                scriptTag += `<script ${inferHtmlTags_js_1.scriptCommonAttrs}${nonceAttr}>\n${contents.join('\n')}\n</script>`;
             }
         }
     }

package/dist/cjs/node/runtime/{html → renderPage/html}/injectAssets.js

@@ -2,8 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.injectHtmlTagsToString = injectHtmlTagsToString;
 exports.injectHtmlTagsToStream = injectHtmlTagsToStream;
-const utils_js_1 = require("../utils.js");
-const assertPageContextProvidedByUser_js_1 = require("../../../shared/assertPageContextProvidedByUser.js");
+const utils_js_1 = require("../../utils.js");
+const assertPageContextProvidedByUser_js_1 = require("../../../../shared/assertPageContextProvidedByUser.js");
 const injectHtmlTags_js_1 = require("./injectAssets/injectHtmlTags.js");
 const getHtmlTags_js_1 = require("./injectAssets/getHtmlTags.js");
 const getViteDevScript_js_1 = require("./injectAssets/getViteDevScript.js");

package/dist/cjs/node/runtime/{html → renderPage/html}/propKeys.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getPropVal = getPropVal;
 exports.setPropVal = setPropVal;
 exports.getPropKeys = getPropKeys;
-const utils_js_1 = require("../utils.js");
+const utils_js_1 = require("../../utils.js");
 // Get a nested property from an object using a dot-separated path such as 'user.id'
 function getPropVal(obj, prop) {
     const keys = getPropKeys(prop);

package/dist/cjs/node/runtime/{html → renderPage/html}/renderHtml.js

@@ -8,7 +8,7 @@ exports.dangerouslySkipEscape = dangerouslySkipEscape;
 exports.renderDocumentHtml = renderDocumentHtml;
 exports.isDocumentHtml = isDocumentHtml;
 exports.getHtmlString = getHtmlString;
-const utils_js_1 = require("../utils.js");
+const utils_js_1 = require("../../utils.js");
 const injectAssets_js_1 = require("./injectAssets.js");
 const stream_js_1 = require("./stream.js");
 const react_streaming_js_1 = require("./stream/react-streaming.js");

package/dist/cjs/node/runtime/{html → renderPage/html}/serializeContext.js

@@ -7,13 +7,13 @@ exports.getPageContextClientSerialized = getPageContextClientSerialized;
 exports.getPageContextClientSerializedAbort = getPageContextClientSerializedAbort;
 exports.getGlobalContextClientSerialized = getGlobalContextClientSerialized;
 const stringify_1 = require("@brillout/json-serializer/stringify");
-const utils_js_1 = require("../utils.js");
-const error_page_js_1 = require("../../../shared/error-page.js");
-const addIs404ToPageProps_js_1 = require("../../../shared/addIs404ToPageProps.js");
+const utils_js_1 = require("../../utils.js");
+const error_page_js_1 = require("../../../../shared/error-page.js");
+const addIs404ToPageProps_js_1 = require("../../../../shared/addIs404ToPageProps.js");
 const picocolors_1 = __importDefault(require("@brillout/picocolors"));
-const NOT_SERIALIZABLE_js_1 = require("../../../shared/NOT_SERIALIZABLE.js");
-const pageContextInitIsPassedToClient_js_1 = require("../../../shared/misc/pageContextInitIsPassedToClient.js");
-const isServerSideError_js_1 = require("../../../shared/misc/isServerSideError.js");
+const NOT_SERIALIZABLE_js_1 = require("../../../../shared/NOT_SERIALIZABLE.js");
+const pageContextInitIsPassedToClient_js_1 = require("../../../../shared/misc/pageContextInitIsPassedToClient.js");
+const isServerSideError_js_1 = require("../../../../shared/misc/isServerSideError.js");
 const propKeys_js_1 = require("./propKeys.js");
 const passToClientBuiltInPageContext = [
     'abortReason',

package/dist/cjs/node/runtime/{html → renderPage/html}/stream/react-streaming.js

@@ -4,7 +4,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.isStreamFromReactStreamingPackage = isStreamFromReactStreamingPackage;
 exports.streamFromReactStreamingPackageToString = streamFromReactStreamingPackageToString;
 exports.getStreamOfReactStreamingPackage = getStreamOfReactStreamingPackage;
-const utils_js_1 = require("../../utils.js");
+const utils_js_1 = require("../../../utils.js");
 const stream_js_1 = require("../stream.js");
 function streamFromReactStreamingPackageToString(stream) {
     if (stream.pipe) {

package/dist/cjs/node/runtime/{html → renderPage/html}/stream.js

@@ -24,7 +24,7 @@ exports.streamReadableWebToString = streamReadableWebToString;
 exports.streamPipeNodeToString = streamPipeNodeToString;
 exports.isStreamWritableWeb = isStreamWritableWeb;
 exports.isStreamWritableNode = isStreamWritableNode;
-const utils_js_1 = require("../utils.js");
+const utils_js_1 = require("../../utils.js");
 const react_streaming_js_1 = require("./stream/react-streaming.js");
 const import_1 = require("@brillout/import");
 const picocolors_1 = __importDefault(require("@brillout/picocolors"));

package/dist/cjs/node/runtime/renderPage/loadPageConfigsLazyServerSide.js

@@ -10,13 +10,14 @@ const findPageConfig_js_1 = require("../../../shared/page-configs/findPageConfig
 const analyzePage_js_1 = require("./analyzePage.js");
 const loadAndParseVirtualFilePageEntry_js_1 = require("../../../shared/page-configs/loadAndParseVirtualFilePageEntry.js");
 const execHookServer_js_1 = require("./execHookServer.js");
-const getCacheControl_js_1 = require("./getCacheControl.js");
+const headersResponse_js_1 = require("./headersResponse.js");
+const csp_js_1 = require("./csp.js");
 async function loadPageConfigsLazyServerSide(pageContext) {
     (0, utils_js_1.objectAssign)(pageContext, {
         _pageConfig: (0, findPageConfig_js_1.findPageConfig)(pageContext._globalContext._pageConfigs, pageContext.pageId),
     });
     // Load the page's + files
-    (0, utils_js_1.updateType)(pageContext, await loadPageUserFiles(pageContext));
+    (0, utils_js_1.objectAssign)(pageContext, await loadPageUserFiles(pageContext));
     // Resolve new computed pageContext properties
     (0, utils_js_1.updateType)(pageContext, await resolvePageContext(pageContext));
     // Execute +onCreatePageContext
@@ -55,12 +56,13 @@ async function resolvePageContext(pageContext) {
             passToClient.push(...valS);
         });
     }
+    (0, utils_js_1.objectAssign)(pageContext, await (0, csp_js_1.resolvePageContextCspNone)(pageContext));
     (0, utils_js_1.objectAssign)(pageContext, {
         Page: pageContext.exports.Page,
         _isHtmlOnly: isHtmlOnly,
         _passToClient: passToClient,
-        headersResponse: resolveHeadersResponse(pageContext),
     });
+    (0, utils_js_1.objectAssign)(pageContext, await (0, headersResponse_js_1.resolveHeadersResponseEarly)(pageContext));
     (0, utils_js_1.objectAssign)(pageContext, {
         __getPageAssets: async () => {
             if ('_pageAssets' in pageContext) {
@@ -103,43 +105,20 @@ async function resolvePageContext(pageContext) {
     return pageContext;
 }
 async function loadPageUserFiles(pageContext) {
-    const [{ configPublicPageLazy }] = await Promise.all([
-        loadPageUserFiles_v1Design(pageContext),
+    const [{ pageContextAddendum }] = await Promise.all([
+        (async () => {
+            const pageFilesServerSide = (0, getPageFiles_js_1.getPageFilesServerSide)(pageContext._pageFilesAll, pageContext.pageId);
+            const isDev = !pageContext._globalContext._isProduction;
+            const pageConfigLoaded = !pageContext._pageConfig
+                ? null
+                : await (0, loadAndParseVirtualFilePageEntry_js_1.loadAndParseVirtualFilePageEntry)(pageContext._pageConfig, isDev);
+            await Promise.all(pageFilesServerSide.map((p) => p.loadFile?.()));
+            const pageContextAddendum = (0, resolveVikeConfigPublic_js_1.resolvePageContextConfig)(pageFilesServerSide, pageConfigLoaded, pageContext._globalContext._pageConfigGlobal);
+            return { pageContextAddendum };
+        })(),
         (0, analyzePageClientSide_js_1.analyzePageClientSideInit)(pageContext._globalContext._pageFilesAll, pageContext.pageId, {
             sharedPageFilesAlreadyLoaded: true,
         }),
     ]);
-    (0, utils_js_1.objectAssign)(pageContext, configPublicPageLazy);
-    return pageContext;
-}
-async function loadPageUserFiles_v1Design(pageContext) {
-    const pageFilesServerSide = (0, getPageFiles_js_1.getPageFilesServerSide)(pageContext._pageFilesAll, pageContext.pageId);
-    const isDev = !pageContext._globalContext._isProduction;
-    const pageConfigLoaded = !pageContext._pageConfig
-        ? null
-        : await (0, loadAndParseVirtualFilePageEntry_js_1.loadAndParseVirtualFilePageEntry)(pageContext._pageConfig, isDev);
-    await Promise.all(pageFilesServerSide.map((p) => p.loadFile?.()));
-    const configPublicPageLazy = (0, resolveVikeConfigPublic_js_1.resolveVikeConfigPublicPageLazyLoaded)(pageFilesServerSide, pageConfigLoaded, pageContext._globalContext._pageConfigGlobal);
-    return {
-        configPublicPageLazy,
-        pageFilesLoaded: pageFilesServerSide,
-    };
-}
-function resolveHeadersResponse(pageContext) {
-    const headersResponse = mergeHeaders(pageContext.config.headersResponse);
-    if (!headersResponse.get('Cache-Control')) {
-        const cacheControl = (0, getCacheControl_js_1.getCacheControl)(pageContext.pageId, pageContext._globalContext._pageConfigs);
-        if (cacheControl)
-            headersResponse.set('Cache-Control', cacheControl);
-    }
-    return headersResponse;
-}
-function mergeHeaders(headersList = []) {
-    const headersMerged = new Headers();
-    headersList.forEach((headers) => {
-        new Headers(headers).forEach((value, key) => {
-            headersMerged.append(key, value);
-        });
-    });
-    return headersMerged;
+    return pageContextAddendum;
 }

package/dist/cjs/node/runtime/renderPage/renderPageAfterRoute.js

@@ -6,9 +6,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderPageAfterRoute = renderPageAfterRoute;
 exports.prerenderPage = prerenderPage;
 const error_page_js_1 = require("../../../shared/error-page.js");
-const renderHtml_js_1 = require("../html/renderHtml.js");
+const renderHtml_js_1 = require("./html/renderHtml.js");
 const utils_js_1 = require("../utils.js");
-const serializeContext_js_1 = require("../html/serializeContext.js");
+const serializeContext_js_1 = require("./html/serializeContext.js");
 const createHttpResponse_js_1 = require("./createHttpResponse.js");
 const loadPageConfigsLazyServerSide_js_1 = require("./loadPageConfigsLazyServerSide.js");
 const execHookOnRenderHtml_js_1 = require("./execHookOnRenderHtml.js");

package/dist/cjs/node/runtime/renderPage.js

@@ -18,7 +18,7 @@ const isNewError_js_1 = require("./renderPage/isNewError.js");
 const assertArguments_js_1 = require("./renderPage/assertArguments.js");
 const index_js_2 = require("./renderPage/log404/index.js");
 const picocolors_1 = __importDefault(require("@brillout/picocolors"));
-const serializeContext_js_1 = require("./html/serializeContext.js");
+const serializeContext_js_1 = require("./renderPage/html/serializeContext.js");
 const error_page_js_1 = require("../../shared/error-page.js");
 const handleErrorWithoutErrorPage_js_1 = require("./renderPage/handleErrorWithoutErrorPage.js");
 const loadPageConfigsLazyServerSide_js_1 = require("./renderPage/loadPageConfigsLazyServerSide.js");

package/dist/cjs/node/vite/onLoad.js

@@ -15,7 +15,7 @@ function onLoad() {
     // TO-DO/eventually: let's also use this.meta.viteVersion
     // - https://github.com/vitejs/vite/pull/20088
     // - https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md#700-2025-06-24
-    (0, assertVersion_js_1.assertVersion)('Vite', vite_1.version, '6.0.0');
+    (0, assertVersion_js_1.assertVersion)('Vite', vite_1.version, ['6.0.0']);
     // Ensure we don't bloat the server runtime with heavy dependencies such Vite and esbuild
     (0, assertSetup_js_1.assertIsNotProductionRuntime)();
 }

package/dist/cjs/node/vite/plugins/pluginBuild/handleAssetsManifest.js

@@ -24,7 +24,7 @@ const getManifestFilePathRelative_js_1 = require("../../shared/getManifestFilePa
 const globalObject = (0, utils_js_1.getGlobalObject)('build/handleAssetsManifest.ts', {
     assetsJsonFilePath: undefined,
 });
-// true  => use workaround config.build.ssrEmitAssets
+// yes  => use workaround config.build.ssrEmitAssets
 // false => use workaround extractAssets plugin
 function handleAssetsManifest_isFixEnabled() {
     // Allow user to toggle between the two workarounds? E.g. based on https://vike.dev/includeAssetsImportedByServer.

package/dist/cjs/node/vite/plugins/pluginCommon.js

@@ -112,7 +112,7 @@ function setDefault(setting, value, configFromUser, configFromVike) {
 /*
 import { version } from 'vite'
 function overrideViteDefaultSsrExternal(config: ResolvedConfig) {
-  if (!isVersionOrAbove(version, '5.0.12')) return
+  if (!isVersionMatch(version, ['5.0.12'])) return
   // @ts-ignore Not released yet: https://github.com/vitejs/vite/pull/10939/files#diff-5a3d42620df2c6b17e25f440ffdb67683dee7ef57317674d19f41d5f30502310L5
   config.ssr.external ??= true
 }