@dintero/sri-to-dist 1.0.3 → 1.0.5

package/README.md

@@ -1,6 +1,6 @@
 # sri-to-dist
 
-[![Actions Status](https://github.com/Dintero/sri-to-dist/workflows/CI/badge.svg?branch=master)](https://github.com/Dintero/sri-to-dist/actions?query=branch%3Amaster+workflow%3ACI+) [![npm latest version](https://img.shields.io/npm/v/@dintero/sri-to-dist/latest.svg)](https://www.npmjs.com/package/@dintero/sri-to-dist)
+[![Actions Status](https://github.com/Dintero/sri-to-dist/workflows/Release/badge.svg)](https://github.com/Dintero/sri-to-dist/actions)[![Actions Status](https://github.com/Dintero/sri-to-dist/workflows/CI/badge.svg)](https://github.com/Dintero/sri-to-dist/actions)[![npm latest version](https://img.shields.io/npm/v/@dintero/sri-to-dist/latest.svg)](https://www.npmjs.com/package/@dintero/sri-to-dist)
 
 A tool to add subresource integrity (SRI) hashes to HTML files.
 

package/dist/{src/lib.d.ts → lib.d.ts}

@@ -1,5 +1,25 @@
 declare const extractLinkRel: (scriptOrLinkTag: string) => string | undefined;
 declare const isSriTag: (scriptOrLinkTag: string) => boolean;
+export declare const isImportMapTag: (scriptOrLinkTag: string) => boolean;
+type ImportMapJson = {
+    imports: {
+        [key: string]: string;
+    };
+    integrity?: {
+        [src: string]: string;
+    };
+    scopes?: {
+        [scope: string]: {
+            [key: string]: string;
+        };
+    };
+};
+export declare const parseImportMap: (scriptOrLinkTag: string) => ImportMapJson;
+export declare const extractImports: (importMapJson: ImportMapJson) => {
+    src: string;
+    oldHash: string | undefined;
+}[];
+export declare const toSriImportMap: (tag: string, importMapJson: ImportMapJson, newIntegrityMap: ImportMapJson["integrity"]) => string;
 declare const toHtmlWithSri: (htmlContent: string, baseDir: string, baseUrl?: string, noRemote?: boolean, verify?: boolean) => Promise<string>;
 declare const getContent: (src: string, baseDir: string, baseUrl?: string, noRemote?: boolean) => Promise<Buffer>;
 declare const fetchRemoteContent: (src: string) => Promise<Buffer>;

package/dist/{src/lib.js → lib.js}

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.handleUpdatedHtml = exports.toSriScriptTag = exports.ensureCrossoriginAnonymous = exports.calculateSha384 = exports.fetchRemoteContent = exports.readLocalContent = exports.getContent = exports.toHtmlWithSri = exports.isSriTag = exports.extractLinkRel = void 0;
+exports.handleUpdatedHtml = exports.toSriScriptTag = exports.ensureCrossoriginAnonymous = exports.calculateSha384 = exports.fetchRemoteContent = exports.readLocalContent = exports.getContent = exports.toHtmlWithSri = exports.isSriTag = exports.extractLinkRel = exports.toSriImportMap = exports.extractImports = exports.parseImportMap = exports.isImportMapTag = void 0;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const node_crypto_1 = require("node:crypto");
@@ -93,18 +93,88 @@ const isSriTag = (scriptOrLinkTag) => {
     return false;
 };
 exports.isSriTag = isSriTag;
+const isImportMapTag = (scriptOrLinkTag) => {
+    return scriptOrLinkTag.startsWith("<script ") && scriptOrLinkTag.includes('type="importmap"');
+};
+exports.isImportMapTag = isImportMapTag;
+const parseImportMap = (scriptOrLinkTag) => {
+    // Extract content between script tags
+    const contentRegex = /<script[^>]*>([\s\S]*?)<\/script>/;
+    const contentMatch = scriptOrLinkTag.match(contentRegex);
+    if (!contentMatch || !contentMatch[1]) {
+        throw new Error(`Failed to parse import map for tag ${scriptOrLinkTag}`);
+    }
+    try {
+        const content = contentMatch[1].trim();
+        // Parse the import map JSON
+        const importMapJson = JSON.parse(content);
+        if (typeof importMapJson !== 'object' || Array.isArray(importMapJson)) {
+            throw new Error(`Failed to parse import map for tag ${scriptOrLinkTag}`);
+        }
+        return importMapJson;
+    }
+    catch (error) {
+        throw new Error(`Failed to parse import map for tag ${scriptOrLinkTag}`);
+    }
+};
+exports.parseImportMap = parseImportMap;
+const extractImports = (importMapJson) => {
+    const imports = importMapJson.imports ?
+        Object.keys(importMapJson.imports).map(key => {
+            const src = importMapJson.imports[key];
+            return {
+                src,
+                oldHash: importMapJson.integrity?.[src]
+            };
+        }) : [];
+    return imports;
+};
+exports.extractImports = extractImports;
+const toSriImportMap = (tag, importMapJson, newIntegrityMap) => {
+    const newImportMap = JSON.stringify({
+        ...importMapJson,
+        integrity: newIntegrityMap,
+    });
+    return tag.replace(/<script([^>]*)>([\s\S]*?)<\/script>/, (_, attributes, _content) => {
+        return `<script${attributes}>${newImportMap}</script>`;
+    });
+};
+exports.toSriImportMap = toSriImportMap;
 const toHtmlWithSri = async (htmlContent, baseDir, baseUrl, noRemote, verify) => {
     // Find all script and link tags that should have integrity hashes
-    const re = /<(script|link)\s+[^>]*(?:src|href)="([^"]+)"[^>]*>/g;
+    const re = /<(script|link)\s+[^>]*(?:src|href)="?([^"]+)?"?[^>]*>(?:(.*?)<\/\1>)?|<script\s+[^>]*type="importmap"[^>]*>([\s\S]*?)<\/script>/g;
     let updatedHtml = htmlContent;
     const matches = htmlContent.matchAll(re);
-    for (const [scriptOrLinkTag, _, src] of matches) {
+    for (const match of matches) {
+        const [scriptOrLinkTag, _, src] = match;
         // Skip non supported resources
         if (!isSriTag(scriptOrLinkTag)) {
             continue;
         }
         // Get content of script or link
         try {
+            if ((0, exports.isImportMapTag)(scriptOrLinkTag)) {
+                const importMapJson = (0, exports.parseImportMap)(scriptOrLinkTag);
+                const imports = (0, exports.extractImports)(importMapJson);
+                const newIntegrityMap = {};
+                for (const { src, oldHash } of imports) {
+                    const content = await getContent(src, baseDir, baseUrl, noRemote);
+                    const hashHex = calculateSha384(content);
+                    const integrity = `sha384-${hashHex}`;
+                    if (verify) {
+                        if (!oldHash) {
+                            throw new Error(`Missing hash for ${src}, expected ${integrity}`);
+                        }
+                        if (oldHash !== integrity) {
+                            throw new Error(`Invalid hash ${oldHash} for ${src}, expected ${integrity}`);
+                        }
+                    }
+                    newIntegrityMap[src] = integrity;
+                }
+                const sriImportMapTag = (0, exports.toSriImportMap)(scriptOrLinkTag, importMapJson, newIntegrityMap);
+                updatedHtml = updatedHtml.replace(scriptOrLinkTag, sriImportMapTag);
+                continue;
+            }
             const content = await getContent(src, baseDir, baseUrl, noRemote);
             // Calculate SHA-384 hash and create integrity attribute value
             const hashHex = calculateSha384(content);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@dintero/sri-to-dist",
-    "version": "1.0.3",
+    "version": "1.0.5",
     "description": "HTML tool for adding subresource integrity hashes",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",
@@ -37,7 +37,7 @@
         "@types/temp": "0.9.4",
         "semantic-release": "24.2.3",
         "temp": "0.9.4",
-        "typescript": "5.8.2",
+        "typescript": "5.8.3",
         "vitest": "3.1.1"
     },
     "dependencies": {

package/dist/package.json

@@ -1,57 +0,0 @@
-{
-    "name": "@dintero/sri-to-dist",
-    "version": "1.0.3",
-    "description": "HTML tool for adding subresource integrity hashes",
-    "main": "dist/index.js",
-    "types": "dist/index.d.ts",
-    "bin": {
-        "sri-to-dist": "bin/sri-to-dist.js"
-    },
-    "files": [
-        "dist",
-        "bin"
-    ],
-    "scripts": {
-        "build": "tsc",
-        "prepare": "npm run build",
-        "start": "node bin/sri-to-dist.js",
-        "test": "vitest run",
-        "test:watch": "vitest",
-        "lint": "biome lint .",
-        "format": "biome format . --write",
-        "prepublishOnly": "yarn run build"
-    },
-    "keywords": [
-        "subresource",
-        "integrity",
-        "sri",
-        "html",
-        "security"
-    ],
-    "homepage": "https://github.com/Dintero/sri-to-dist?tab=readme-ov-file#sri-to-dist",
-    "author": "Sven Nicolai Viig <sven@dintero.com> (http://dintero.com)",
-    "license": "MIT",
-    "devDependencies": {
-        "@biomejs/biome": "1.9.4",
-        "@types/node": "22.14.0",
-        "@types/temp": "0.9.4",
-        "semantic-release": "24.2.3",
-        "temp": "0.9.4",
-        "typescript": "5.8.2",
-        "vitest": "3.1.1"
-    },
-    "dependencies": {
-        "commander": "13.1.0"
-    },
-    "bugs": {
-        "url": "https://github.com/Dintero/sri-to-dist/issues"
-    },
-    "private": false,
-    "publishConfig": {
-        "access": "public"
-    },
-    "repository": {
-        "type": "git",
-        "url": "https://github.com/Dintero/sri-to-dist.git"
-    }
-}