@fabrika/proxy-core 0.7.0 → 0.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/proxy-core",
-	"version": "0.7.0",
+	"version": "0.8.1",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -37,9 +37,9 @@
 	},
 	"dependencies": {
 		"zod": "^3.25.76",
-		"@fabrika/auth-core": "0.7.0",
-		"@fabrika/jwks": "0.7.0",
+		"@fabrika/auth-core": "0.8.1",
+		"@fabrika/jwks": "0.8.1",
 		"jose": "^5.9.0",
-		"@fabrika/platform": "0.7.0"
+		"@fabrika/platform": "0.8.1"
 	}
 }

package/src/headers.ts

@@ -54,8 +54,17 @@ export interface CspOrigins {
 	readonly frameSrc: readonly string[]
 	readonly styleSrc: readonly string[]
 	readonly fontSrc: readonly string[]
+	/**
+	 * `worker-src 'self' blob:` is emitted only when it holds `blob:`, its one source (a challenge widget that starts its
+	 * workers from `Blob` URLs); without it workers fall back to `script-src`. Absent from every manifest without it, so a
+	 * proxy that does not know the directive still parses those.
+	 */
+	readonly workerSrc?: readonly string[]
 }
 
+/** The one source a contract's `workerSrc` holds: a worker the page's own script built from a `Blob`. */
+export const WORKER_BLOB_SOURCE = 'blob:'
+
 const HOSTNAME = /^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/
 
 /**
@@ -93,6 +102,7 @@ export function cspOrigins(csp: CspExtensions): CspOrigins {
 		frameSrc: (csp.frameSrc ?? []).map((source) => source.origin),
 		styleSrc: (csp.styleSrc ?? []).map((source) => source.origin),
 		fontSrc: (csp.fontSrc ?? []).map((source) => source.origin),
+		...(csp.workerSrc === undefined ? {} : { workerSrc: csp.workerSrc.map((source) => source.origin) }),
 	}
 }
 
@@ -116,6 +126,7 @@ export function headerPolicy(origins: CspOrigins, operationsOrigin: string | nul
 		`frame-ancestors ${frameAncestors.join(' ')}`,
 		// Without it frames fall back to `default-src 'self'`; a declared origin only extends that, so `'self'` stays.
 		...(origins.frameSrc.length === 0 ? [] : [`frame-src ${["'self'", ...origins.frameSrc].join(' ')}`]),
+		...(origins.workerSrc?.includes(WORKER_BLOB_SOURCE) === true ? [`worker-src 'self' ${WORKER_BLOB_SOURCE}`] : []),
 	]
 	return Object.freeze([
 		['Content-Security-Policy', directives.join('; ')],

package/src/manifest.ts

@@ -21,7 +21,7 @@ import {
 	requirementDigest,
 } from '@fabrika/auth-core'
 import { z } from 'zod'
-import { type CspOrigins, cspOrigins, isCrossOrigin, isPolicyOrigin, MAX_CROSS_ORIGINS, MAX_CSP_ORIGINS } from './headers'
+import { type CspOrigins, cspOrigins, isCrossOrigin, isPolicyOrigin, MAX_CROSS_ORIGINS, MAX_CSP_ORIGINS, WORKER_BLOB_SOURCE } from './headers'
 import { type OAuthProtectedResource, oauthProtectedResourceSchema, oauthScopesSchema } from './oauth-resource'
 
 export * from './oauth-resource'
@@ -267,6 +267,8 @@ const cspOriginsSchema = z.object({
 	frameSrc: cspDirectiveSchema.default([]),
 	styleSrc: cspDirectiveSchema.default([]),
 	fontSrc: cspDirectiveSchema.default([]),
+	// Only a challenge widget's workers need it, and its one source is `blob:`; absent everywhere else.
+	workerSrc: z.tuple([z.literal(WORKER_BLOB_SOURCE)]).optional(),
 }).strict() satisfies z.ZodType<CspOrigins, z.ZodTypeDef, unknown>
 
 // Strict: a key the proxy does not read (`gates`, or an installation entry's field) is refused, never ignored.