void 0.7.5 → 0.7.7

package/dist/pages/protocol.mjs

@@ -3,6 +3,7 @@ import { i as ValidationError, r as separateDeferred, t as DEFERRED } from "../d
 import { resolveHead } from "./head.mjs";
 //#region src/pages/protocol.ts
 const POWERED_BY = { "X-Powered-By": "Void" };
+const RENDER_ERROR_ASSET_TAGS_KEY = "__voidPageAssetTags";
 /** Escape characters that are unsafe inside inline <script> tags to prevent XSS. */
 function safeJsonStringify(value) {
 	return (JSON.stringify(value) ?? "null").replaceAll("<", "\\u003c").replaceAll(">", "\\u003e").replaceAll("&", "\\u0026").replaceAll("\u2028", "\\u2028").replaceAll("\u2029", "\\u2029");
@@ -15,6 +16,85 @@ function pageResponseHeaders(c, headers) {
 	for (const [key, value] of Object.entries(headers)) out.set(key, value);
 	return out;
 }
+function escapeHtmlAttr(value) {
+	return value.replaceAll("&", "&amp;").replaceAll("\"", "&quot;").replaceAll("<", "&lt;");
+}
+function serializeStyleCss(css) {
+	return css.replace(/<\/style/gi, "<\\/style");
+}
+function serializeDevCssAssets(assets, nonce) {
+	return assets.map((asset) => `<style data-vite-dev-id="${escapeHtmlAttr(asset.id ?? asset.url)}" nonce="${escapeHtmlAttr(nonce)}">${serializeStyleCss(asset.css)}</style>`).join("\n");
+}
+function hasCompatibleStyleSource(value, nonceSource) {
+	return value === "'unsafe-inline'" || value === nonceSource;
+}
+function adjustCspValue(value, nonce) {
+	const nonceSource = `'nonce-${nonce}'`;
+	const parsed = value.split(";").map((part) => part.trim()).filter(Boolean).map((directive) => {
+		const [name = "", ...sources] = directive.split(/\s+/);
+		return {
+			name: name.toLowerCase(),
+			originalName: name,
+			sources
+		};
+	});
+	const styleElem = parsed.find((directive) => directive.name === "style-src-elem");
+	if (styleElem) {
+		if (!styleElem.sources.some((source) => hasCompatibleStyleSource(source, nonceSource))) styleElem.sources.push(nonceSource);
+		return parsed.map((directive) => [directive.originalName, ...directive.sources].join(" ")).join("; ");
+	}
+	const style = parsed.find((directive) => directive.name === "style-src");
+	if (style) {
+		if (!style.sources.some((source) => hasCompatibleStyleSource(source, nonceSource))) style.sources.push(nonceSource);
+		return parsed.map((directive) => [directive.originalName, ...directive.sources].join(" ")).join("; ");
+	}
+	const defaultSrc = parsed.find((directive) => directive.name === "default-src");
+	if (defaultSrc) {
+		parsed.push({
+			name: "style-src",
+			originalName: "style-src",
+			sources: [...defaultSrc.sources, nonceSource]
+		});
+		return parsed.map((directive) => [directive.originalName, ...directive.sources].join(" ")).join("; ");
+	}
+	parsed.push({
+		name: "style-src",
+		originalName: "style-src",
+		sources: [nonceSource]
+	});
+	return parsed.map((directive) => [directive.originalName, ...directive.sources].join(" ")).join("; ");
+}
+function adjustDevCssCsp(headers, nonce) {
+	if (!nonce) return headers;
+	const csp = headers.get("content-security-policy");
+	if (csp) headers.set("content-security-policy", adjustCspValue(csp, nonce));
+	const cspReportOnly = headers.get("content-security-policy-report-only");
+	if (cspReportOnly) headers.set("content-security-policy-report-only", adjustCspValue(cspReportOnly, nonce));
+	return headers;
+}
+function prepareAssetTags(assetTags) {
+	if (!assetTags.devCss || assetTags.devCss.length === 0) return assetTags;
+	const nonce = crypto.randomUUID().replaceAll("-", "");
+	return {
+		...assetTags,
+		css: [assetTags.css, serializeDevCssAssets(assetTags.devCss, nonce)].filter(Boolean).join("\n"),
+		devCssNonce: nonce
+	};
+}
+function attachRenderErrorAssetTags(error, assetTags) {
+	if ((typeof error === "object" || typeof error === "function") && error !== null) Object.defineProperty(error, RENDER_ERROR_ASSET_TAGS_KEY, {
+		configurable: true,
+		value: assetTags
+	});
+	throw error;
+}
+async function renderWithAssetTags(renderFn, pageObj, assetTags) {
+	try {
+		return await renderFn(pageObj, assetTags);
+	} catch (error) {
+		attachRenderErrorAssetTags(error, assetTags);
+	}
+}
 function pageJsonResponse(c, pageObj) {
 	return Response.json(pageObj, { headers: pageResponseHeaders(c, {
 		"X-VoidPages": "true",
@@ -65,14 +145,14 @@ async function writeRenderResult(writer, encoder, result) {
 		await writer.write(value);
 	}
 }
-function renderedResponse(c, result, contentType) {
-	return new Response(result, { headers: pageResponseHeaders(c, {
+function renderedResponse(c, result, contentType, assetTags) {
+	return new Response(result, { headers: adjustDevCssCsp(pageResponseHeaders(c, {
 		"content-type": contentType,
 		...POWERED_BY
-	}) });
+	}), assetTags?.devCssNonce) });
 }
 /** Build a streaming response that sends an initial chunk then streams deferred results. */
-function streamDeferredResponse(initialChunk, deferredMap, c, contentType, formatResolved, formatRejected) {
+function streamDeferredResponse(initialChunk, deferredMap, c, contentType, formatResolved, formatRejected, assetTags) {
 	const encoder = new TextEncoder();
 	const { readable, writable } = new TransformStream();
 	const writer = writable.getWriter();
@@ -84,10 +164,10 @@ function streamDeferredResponse(initialChunk, deferredMap, c, contentType, forma
 	})().catch((error) => {
 		writer.abort(error).catch(() => {});
 	});
-	return new Response(readable, { headers: pageResponseHeaders(c, {
+	return new Response(readable, { headers: adjustDevCssCsp(pageResponseHeaders(c, {
 		"content-type": contentType,
 		...POWERED_BY
-	}) });
+	}), assetTags?.devCssNonce) });
 }
 /** Handle GET page request — run handler, return page object or SSR HTML */
 async function handlePageGet(handler, headFn, c, componentId, renderFn, getAssetTags, configHead, island) {
@@ -96,8 +176,8 @@ async function handlePageGet(handler, headFn, c, componentId, renderFn, getAsset
 	if (handler) {
 		const result = await handler(c);
 		if (result instanceof Response && !isConvertedResponse(result)) {
-			const ct = result.headers.get("content-type") || "";
-			if (result.status >= 300 || !ct.includes("application/json")) return result;
+			const contentType = result.headers.get("content-type") || "";
+			if (result.status >= 300 || !contentType.includes("application/json")) return result;
 		}
 		props = await extractProps(result);
 	}
@@ -150,9 +230,10 @@ async function handlePageGet(handler, headFn, c, componentId, renderFn, getAsset
 			error
 		}) + "\n");
 	}
-	const html = await renderFn(pageObj, await getAssetTags(c.req.raw, c.env, componentId));
-	if (!hasDeferred) return renderedResponse(c, html, "text/html; charset=utf-8");
-	return streamDeferredResponse(html, deferredMap, c, "text/html; charset=utf-8", (group, data) => `\n<script>window.__resolveDeferred?window.__resolveDeferred(${safeJsonStringify(group)},${safeJsonStringify(data)}):(window.__deferredQueue??=[]).push([${safeJsonStringify(group)},${safeJsonStringify(data)}])<\/script>`, (group, error) => `\n<script>window.__rejectDeferred?window.__rejectDeferred(${safeJsonStringify(group)},${safeJsonStringify(error)}):(window.__deferredQueue??=[]).push([${safeJsonStringify(group)},0,${safeJsonStringify(error)}])<\/script>`);
+	const assetTags = prepareAssetTags(await getAssetTags(c.req.raw, c.env, componentId));
+	const html = await renderWithAssetTags(renderFn, pageObj, assetTags);
+	if (!hasDeferred) return renderedResponse(c, html, "text/html; charset=utf-8", assetTags);
+	return streamDeferredResponse(html, deferredMap, c, "text/html; charset=utf-8", (group, data) => `\n<script>window.__resolveDeferred?window.__resolveDeferred(${safeJsonStringify(group)},${safeJsonStringify(data)}):(window.__deferredQueue??=[]).push([${safeJsonStringify(group)},${safeJsonStringify(data)}])<\/script>`, (group, error) => `\n<script>window.__rejectDeferred?window.__rejectDeferred(${safeJsonStringify(group)},${safeJsonStringify(error)}):(window.__deferredQueue??=[]).push([${safeJsonStringify(group)},0,${safeJsonStringify(error)}])<\/script>`, assetTags);
 }
 /** Handle POST/PUT/DELETE page request — run mutation, then re-run GET or redirect */
 async function handlePageMutation(mutationHandler, getHandler, headFn, c, componentId, renderFn, getAssetTags, configHead, island) {
@@ -178,7 +259,8 @@ async function handlePageMutation(mutationHandler, getHandler, headFn, c, compon
 			if (island) return Response.json({ errors: e.errors }, { status: 422 });
 			const pageObj = buildMutationPageObj(stripDeferred(getHandler ? await extractProps(await getHandler(c)) : {}), e.errors);
 			if (isPagesRequest(c)) return pageJsonResponse(c, pageObj);
-			return renderedResponse(c, await renderFn(pageObj, await getAssetTags(c.req.raw, c.env, componentId)), "text/html; charset=utf-8");
+			const assetTags = prepareAssetTags(await getAssetTags(c.req.raw, c.env, componentId));
+			return renderedResponse(c, await renderWithAssetTags(renderFn, pageObj, assetTags), "text/html; charset=utf-8", assetTags);
 		}
 		throw e;
 	}
@@ -190,14 +272,16 @@ async function handlePageMutation(mutationHandler, getHandler, headFn, c, compon
 			if (island) return Response.json({ errors }, { status: 422 });
 			const pageObj = buildMutationPageObj(stripDeferred(getHandler ? await extractProps(await getHandler(c)) : {}), errors);
 			if (isPagesRequest(c)) return pageJsonResponse(c, pageObj);
-			return renderedResponse(c, await renderFn(pageObj, await getAssetTags(c.req.raw, c.env, componentId)), "text/html; charset=utf-8");
+			const assetTags = prepareAssetTags(await getAssetTags(c.req.raw, c.env, componentId));
+			return renderedResponse(c, await renderWithAssetTags(renderFn, pageObj, assetTags), "text/html; charset=utf-8", assetTags);
 		}
 		if (status !== 204) return result;
 	}
 	if (island) return Response.json({ success: true });
 	const pageObj = buildMutationPageObj(stripDeferred(getHandler ? await extractProps(await getHandler(c)) : {}), null);
 	if (isPagesRequest(c)) return pageJsonResponse(c, pageObj);
-	return renderedResponse(c, await renderFn(pageObj, await getAssetTags(c.req.raw, c.env, componentId)), "text/html; charset=utf-8");
+	const assetTags = prepareAssetTags(await getAssetTags(c.req.raw, c.env, componentId));
+	return renderedResponse(c, await renderWithAssetTags(renderFn, pageObj, assetTags), "text/html; charset=utf-8", assetTags);
 }
 //#endregion
 export { ValidationError, flattenValidationErrors, handlePageGet, handlePageMutation, safeJsonStringify };