@growth-labs/conformance 0.1.0 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # @growth-labs/conformance Changelog
 
+## 0.3.0 — 2026-07-17
+
+- Add `buildAstroCspConfig()` for Astro 7.1+ native SHA-256 CSP generation with
+  exact external-origin validation and no wildcard or `unsafe-*` escape hatch.
+  Its return shape is compile-checked against Astro's exported CSP config type,
+  and a real Astro build proves the attribute-only directive is emitted.
+- Allow Astro 7.1+ consumers with a proven inline-style-attribute inventory to
+  scope `'unsafe-inline'` to `style-src-attr` only. Script and style-element
+  execution remain hash-protected and fail closed. The runner requires the
+  inventory receipt to match the exact build commit. The policy API requires
+  that structured receipt rather than a boolean escape hatch, including a
+  versioned scanner identity and SHA-256 output hash.
+- Require canonical lowercase commit SHAs, SHA-256 evidence hashes, and CSP
+  hash algorithm tokens in security evidence.
+- Let consumers set `contentSecurityPolicy: false` on
+  `buildSharedPublicationHeaders()` when Astro owns the per-response hash CSP;
+  all other shared response headers remain package-owned.
+- Add an explicit per-fixture frame policy contract. The default remains
+  `frame-ancestors 'none'` plus `X-Frame-Options: DENY`; deliberately embeddable
+  routes may declare only `'self'`, `https:`, or exact HTTPS origins and must
+  omit a conflicting legacy frame header. The runner validates the CSP sources
+  exactly rather than accepting a fleet-wide relaxation.
+
+## 0.2.0 — 2026-07-16
+
+### Added
+
+- Added schema v2 security receipts for consumer-supplied enforced-CSP
+  functional probes and CSP reporting/canary evidence.
+- Added required COOP/CORP response headers, conservative shared policy
+  defaults, and documented consumer overrides for verified auth/media/embed
+  constraints.
+- Added required negative fixtures for missing COOP/CORP, HSTS below one year,
+  wildcard `default-src`, `unsafe-eval`, executable inline scripts without a
+  matching nonce or SHA-256 hash, conflicting duplicate security headers,
+  missing functional-probe receipts, and missing/failed CSP-report receipts.
+
+### Changed
+
+- HSTS validation now requires `max-age >= 31536000`.
+- `buildSharedPublicationHeaders()` now keeps `includeSubDomains` and `preload`
+  opt-in behind explicit host-inventory proof instead of emitting them by
+  default.
+- CSP validation now parses directives instead of substring-matching the raw
+  header.
+
 ## 0.1.0 — 2026-07-15
 
 ### Added

package/README.md

@@ -30,7 +30,9 @@ const fixture = {
 		status: 200,
 		headers: {
 			'content-security-policy': "default-src 'self'; script-src 'self' 'nonce-runtime'",
-			'strict-transport-security': 'max-age=31536000; includeSubDomains; preload',
+			'strict-transport-security': 'max-age=31536000',
+			'cross-origin-opener-policy': 'same-origin',
+			'cross-origin-resource-policy': 'same-origin',
 			'x-frame-options': 'DENY',
 			'x-content-type-options': 'nosniff',
 			'referrer-policy': 'strict-origin-when-cross-origin',
@@ -43,6 +45,10 @@ const fixture = {
 		canonicalUrl: 'https://fronts.co/example',
 		schemaTypes: ['NewsArticle'],
 		discoverEligible: true,
+		framePolicy: {
+			ancestors: ["'none'"],
+			legacyHeader: 'DENY',
+		},
 	},
 	publicationSurfaces: [
 		{ name: 'sitemap', status: 'present', httpStatus: 200, bodyBytes: 1024 },
@@ -53,9 +59,35 @@ const fixture = {
 		{ audience: 'public', cacheKey: 'fronts:public:/example' },
 		{ audience: 'crawler', cacheKey: 'fronts:crawler:/example' },
 	],
+	securityReceipts: {
+		functionalProbes: [
+			{ name: 'oauth', status: 'pass', evidence: 'sanitized consumer probe receipt' },
+			{ name: 'media', status: 'pass', evidence: 'sanitized consumer probe receipt' },
+			{ name: 'images', status: 'pass', evidence: 'sanitized consumer probe receipt' },
+			{ name: 'analytics', status: 'pass', evidence: 'sanitized consumer probe receipt' },
+			{ name: 'embeds', status: 'pass', evidence: 'sanitized consumer probe receipt' },
+			{ name: 'error-pages', status: 'pass', evidence: 'sanitized consumer probe receipt' },
+		],
+		cspReports: [
+			{
+				name: 'csp-report-canary',
+				status: 'pass',
+				endpoint: 'consumer-owned-report-endpoint',
+				evidence: 'sanitized CSP report or blocked-canary receipt',
+			},
+		],
+		inlineStyleAttributes: {
+			commitSha: 'bd39d718f6a5b0df9a249e11638a8b430050941e',
+			occurrenceCount: 4,
+			evidence: {
+				tool: 'platform-foundations:inline-style-inventory@1',
+				outputHash: 'sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+			},
+		},
+	},
 	buildEvidence: {
 		commitSha: 'bd39d718f6a5b0df9a249e11638a8b430050941e',
-		packageVersions: { '@growth-labs/seo': '0.9.0' },
+		packageVersions: { '@growth-labs/conformance': '0.3.0', '@growth-labs/seo': '0.9.0' },
 		staticHeaderPolicy: true,
 		ssrHeaderPolicy: true,
 	},
@@ -68,25 +100,81 @@ const fleetBundle = runFleetConformance([fixture])
 ## Shared Header Policy
 
 Use `buildSharedPublicationHeaders()` when a site wants the package-owned
-baseline for SSR and static response headers:
+baseline for SSR and static response headers. Astro 7.1+ sites should let Astro
+own the per-route hash CSP and retain the remaining shared headers. The helper's
+peer contract is intentionally pinned to the first Astro release that supports
+attribute-scoped style resources:
 
 ```ts
-import { buildSharedPublicationHeaders } from '@growth-labs/conformance/policy'
+import {
+	buildAstroCspConfig,
+	buildSharedPublicationHeaders,
+} from '@growth-labs/conformance/policy'
+
+const csp = buildAstroCspConfig({
+	scriptSources: ['https://challenges.cloudflare.com'],
+	styleSources: ['https://fonts.googleapis.com'],
+	inlineStyleAttributes: {
+		commitSha: 'bd39d718f6a5b0df9a249e11638a8b430050941e',
+		occurrenceCount: 4,
+		evidence: {
+			tool: 'platform-foundations:inline-style-inventory@1',
+			outputHash: 'sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+		},
+	},
+})
 
 const headers = buildSharedPublicationHeaders({
 	renderMode: 'ssr',
 	audience: 'public',
-	nonce: runtimeNonce,
+	contentSecurityPolicy: false,
 	markdownTwinUrl: 'https://example.com/article.md',
 })
 ```
 
+The fixture default is the non-embeddable policy above. For a deliberately
+embeddable route, declare its exact response class and omit a conflicting
+`X-Frame-Options` header:
+
+```ts
+expected: {
+	framePolicy: {
+		ancestors: ['https://trusted.example'],
+		legacyHeader: 'omit',
+	},
+}
+```
+
+Accepted ancestors are `'none'`, `'self'`, `https:`, and exact HTTPS origins;
+wildcards, paths, credentials, query strings, and fragments are rejected.
+`DENY` is valid only with `'none'`, and `SAMEORIGIN` only with `'self'`; broader
+embeddable policies must use `legacyHeader: 'omit'` to avoid contradictory
+browser behavior.
+
+Astro 7.1+ consumers that prove they still emit HTML `style` attributes may set
+`inlineStyleAttributes` to the validated inventory receipt. There is no boolean
+escape hatch. The helper then scopes `'unsafe-inline'` to `style-src-attr`
+while preserving hash protection for scripts and `<style>` elements. The
+receipt requires the exact lowercase 40-character build commit SHA, a positive
+occurrence count, the versioned scanner identity, and the lowercase SHA-256
+content hash of its machine output. The same receipt must appear in the
+conformance fixture and its commit must match `buildEvidence.commitSha`. Do not
+enable this option as a generic compatibility fix.
+
 The policy emits CSP, HSTS, frame protection, MIME sniffing protection,
-referrer policy, permissions policy, cache semantics, and optional markdown
-twin `Link` metadata. Private audiences use `private, no-store`; public SSR
-uses short shared-cache semantics; public static surfaces get longer
+COOP, CORP, referrer policy, permissions policy, cache semantics, and optional
+markdown twin `Link` metadata. Private audiences use `private, no-store`;
+public SSR uses short shared-cache semantics; public static surfaces get longer
 shared-cache semantics.
 
+HSTS defaults to `max-age=31536000` only. Add `includeSubDomains` and `preload`
+through `strictTransportSecurity: { includeSubDomains: true, preload: true }`
+only after the consumer has separately verified the full host inventory can
+enforce HTTPS. COOP defaults to `same-origin` and CORP defaults to
+`same-origin`; consumers may override them only when verified OAuth popup,
+media, or embed constraints require a looser policy and the receipt proves the
+result under enforced CSP.
+
 ## Fixture Commands
 
 The root repo exposes:
@@ -100,6 +188,16 @@ The fixture command proves the required negative fixtures fail loudly with
 stable finding codes:
 
 - `csp-unsafe-inline`
+- `missing-coop`
+- `missing-corp`
+- `hsts-below-one-year`
+- `csp-wildcard-default-src`
+- `csp-unsafe-eval`
+- `csp-inline-executable-without-nonce-or-hash`
+- `conflicting-duplicate-security-header`
+- `missing-functional-probe-receipt`
+- `missing-csp-report-receipt`
+- `failed-csp-report-receipt`
 - `headers-static-only-while-ssr-missing`
 - `undeclared-na`
 - `stringified-is-accessible-for-free`
@@ -114,5 +212,11 @@ stable finding codes:
 
 `runSiteConformance()` returns a `SiteEvidenceBundle`; `runFleetConformance()`
 returns a `FleetEvidenceBundle`. Both are validated by exported Zod schemas
-and carry `schemaVersion: "growth-labs.conformance.v1"` so downstream jobs can
+and carry `schemaVersion: "growth-labs.conformance.v2"` so downstream jobs can
 parse them without relying on console text.
+
+Schema v2 adds `securityReceipts` to fixtures and site evidence bundles. Existing
+v1 fixtures must add explicit functional-probe receipts for `oauth`, `media`,
+`images`, `analytics`, `embeds`, and `error-pages`, plus at least one passing CSP
+reporting/canary receipt. The package does not perform those live probes itself;
+consumer CI supplies sanitized pass/fail/NA receipts.

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { buildCacheControl, buildContentSecurityPolicy, buildSharedPublicationHeaders, type CachePolicyOptions, type HeaderPolicyOptions, isPrivateAudience, normalizeHeaders, REQUIRED_SECURITY_HEADERS, } from './policy.js';
+export { type AstroCspConfig, type AstroCspPolicyOptions, type AstroCspResource, buildAstroCspConfig, buildCacheControl, buildContentSecurityPolicy, buildSharedPublicationHeaders, buildStrictTransportSecurity, type CachePolicyOptions, type ContentSecurityPolicyOptions, type CrossOriginOpenerPolicy, type CrossOriginResourcePolicy, collectHeaders, type HeaderPolicyOptions, isPrivateAudience, normalizeHeaders, REQUIRED_SECURITY_HEADERS, type StrictTransportSecurityOptions, } from './policy.js';
 export { type RunConformanceOptions, runFleetConformance, runSiteConformance } from './runner.js';
-export { type Audience, audienceSchema, type BuildEvidence, buildEvidenceSchema, type CacheVariant, type ConformanceCheckReceipt, type ConformanceFinding, type ConformanceFixture, type ConformanceFixtureInput, cacheVariantSchema, checkStatusSchema, conformanceCheckReceiptSchema, conformanceExpectedSchema, conformanceFindingSchema, conformanceFixtureSchema, EVIDENCE_SCHEMA_VERSION, type EvidenceSummary, evidenceSummarySchema, type FleetEvidenceBundle, findingSeveritySchema, fleetEvidenceBundleSchema, type HeaderMap, headerMapSchema, headerValueSchema, type PublicationSurfaceEvidence, parseConformanceFixture, publicationSurfaceSchema, REQUIRED_NEGATIVE_FIXTURE_CODES, type RenderMode, type RequiredNegativeFindingCode, type RequiredNegativeFixtureId, renderModeSchema, type SiteEvidenceBundle, type SurfaceResponse, siteEvidenceBundleSchema, surfaceResponseSchema, validateFleetEvidenceBundle, validateSiteEvidenceBundle, } from './schema.js';
+export { type Audience, audienceSchema, type BuildEvidence, buildEvidenceSchema, type CacheVariant, type ConformanceCheckReceipt, type ConformanceFinding, type ConformanceFixture, type ConformanceFixtureInput, type CspReportReceipt, cacheVariantSchema, checkStatusSchema, conformanceCheckReceiptSchema, conformanceExpectedSchema, conformanceFindingSchema, conformanceFixtureSchema, cspReportReceiptSchema, EVIDENCE_SCHEMA_VERSION, type EvidenceSummary, evidenceSummarySchema, type FleetEvidenceBundle, findingSeveritySchema, fleetEvidenceBundleSchema, type HeaderMap, headerMapSchema, headerValueSchema, type InlineStyleAttributeInventory, inlineStyleAttributeInventorySchema, type PublicationSurfaceEvidence, parseConformanceFixture, publicationSurfaceSchema, REQUIRED_FUNCTIONAL_PROBE_NAMES, REQUIRED_NEGATIVE_FIXTURE_CODES, type RenderMode, type RequiredNegativeFindingCode, type RequiredNegativeFixtureId, renderModeSchema, type SecurityFunctionalProbeReceipt, type SecurityReceipts, type SiteEvidenceBundle, type SurfaceResponse, securityFunctionalProbeReceiptSchema, securityReceiptsSchema, siteEvidenceBundleSchema, surfaceResponseSchema, validateFleetEvidenceBundle, validateSiteEvidenceBundle, } from './schema.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,GACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,KAAK,qBAAqB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EACN,KAAK,QAAQ,EACb,cAAc,EACd,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,yBAAyB,EACzB,KAAK,SAAS,EACd,eAAe,EACf,iBAAiB,EACjB,KAAK,0BAA0B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,KAAK,UAAU,EACf,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC9B,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,GAC1B,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,EAC5B,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,cAAc,EACd,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,EACzB,KAAK,8BAA8B,GACnC,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,KAAK,qBAAqB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EACN,KAAK,QAAQ,EACb,cAAc,EACd,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,yBAAyB,EACzB,KAAK,SAAS,EACd,eAAe,EACf,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,mCAAmC,EACnC,KAAK,0BAA0B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,+BAA+B,EAC/B,KAAK,UAAU,EACf,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC9B,gBAAgB,EAChB,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,oCAAoC,EACpC,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,GAC1B,MAAM,aAAa,CAAA"}

package/dist/index.js

@@ -1,4 +1,4 @@
-export { buildCacheControl, buildContentSecurityPolicy, buildSharedPublicationHeaders, isPrivateAudience, normalizeHeaders, REQUIRED_SECURITY_HEADERS, } from './policy.js';
+export { buildAstroCspConfig, buildCacheControl, buildContentSecurityPolicy, buildSharedPublicationHeaders, buildStrictTransportSecurity, collectHeaders, isPrivateAudience, normalizeHeaders, REQUIRED_SECURITY_HEADERS, } from './policy.js';
 export { runFleetConformance, runSiteConformance } from './runner.js';
-export { audienceSchema, buildEvidenceSchema, cacheVariantSchema, checkStatusSchema, conformanceCheckReceiptSchema, conformanceExpectedSchema, conformanceFindingSchema, conformanceFixtureSchema, EVIDENCE_SCHEMA_VERSION, evidenceSummarySchema, findingSeveritySchema, fleetEvidenceBundleSchema, headerMapSchema, headerValueSchema, parseConformanceFixture, publicationSurfaceSchema, REQUIRED_NEGATIVE_FIXTURE_CODES, renderModeSchema, siteEvidenceBundleSchema, surfaceResponseSchema, validateFleetEvidenceBundle, validateSiteEvidenceBundle, } from './schema.js';
+export { audienceSchema, buildEvidenceSchema, cacheVariantSchema, checkStatusSchema, conformanceCheckReceiptSchema, conformanceExpectedSchema, conformanceFindingSchema, conformanceFixtureSchema, cspReportReceiptSchema, EVIDENCE_SCHEMA_VERSION, evidenceSummarySchema, findingSeveritySchema, fleetEvidenceBundleSchema, headerMapSchema, headerValueSchema, inlineStyleAttributeInventorySchema, parseConformanceFixture, publicationSurfaceSchema, REQUIRED_FUNCTIONAL_PROBE_NAMES, REQUIRED_NEGATIVE_FIXTURE_CODES, renderModeSchema, securityFunctionalProbeReceiptSchema, securityReceiptsSchema, siteEvidenceBundleSchema, surfaceResponseSchema, validateFleetEvidenceBundle, validateSiteEvidenceBundle, } from './schema.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAG7B,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,GACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAA8B,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EAEN,cAAc,EAEd,mBAAmB,EAMnB,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EAEvB,qBAAqB,EAErB,qBAAqB,EACrB,yBAAyB,EAEzB,eAAe,EACf,iBAAiB,EAEjB,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAI/B,gBAAgB,EAGhB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,GAC1B,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,EAK5B,cAAc,EAEd,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,GAEzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAA8B,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EAEN,cAAc,EAEd,mBAAmB,EAOnB,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EAEvB,qBAAqB,EAErB,qBAAqB,EACrB,yBAAyB,EAEzB,eAAe,EACf,iBAAiB,EAEjB,mCAAmC,EAEnC,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,+BAA+B,EAI/B,gBAAgB,EAKhB,oCAAoC,EACpC,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,GAC1B,MAAM,aAAa,CAAA"}

package/dist/policy.d.ts

@@ -1,18 +1,69 @@
-import type { Audience, HeaderMap, RenderMode } from './schema.js';
-export declare const REQUIRED_SECURITY_HEADERS: readonly ["content-security-policy", "strict-transport-security", "x-frame-options", "x-content-type-options", "referrer-policy", "permissions-policy"];
+import type { AstroConfig } from 'astro';
+import { type Audience, type HeaderMap, type InlineStyleAttributeInventory, type RenderMode } from './schema.js';
+export declare const REQUIRED_SECURITY_HEADERS: readonly ["content-security-policy", "strict-transport-security", "cross-origin-opener-policy", "cross-origin-resource-policy", "x-frame-options", "x-content-type-options", "referrer-policy", "permissions-policy"];
+export type CrossOriginOpenerPolicy = 'same-origin' | 'same-origin-allow-popups' | 'unsafe-none';
+export type CrossOriginResourcePolicy = 'same-origin' | 'same-site' | 'cross-origin';
+export interface StrictTransportSecurityOptions {
+    maxAgeSeconds?: number;
+    includeSubDomains?: boolean;
+    preload?: boolean;
+}
+export interface ContentSecurityPolicyOptions {
+    nonce?: string;
+    reportUri?: string;
+    reportTo?: string;
+}
 export interface HeaderPolicyOptions {
     renderMode: RenderMode;
     audience: Audience;
     nonce?: string;
+    cspReportUri?: string;
+    cspReportTo?: string;
+    contentSecurityPolicy?: false | ContentSecurityPolicyOptions;
+    strictTransportSecurity?: StrictTransportSecurityOptions;
+    crossOriginOpenerPolicy?: CrossOriginOpenerPolicy;
+    crossOriginResourcePolicy?: CrossOriginResourcePolicy;
     markdownTwinUrl?: string;
 }
+export interface AstroCspPolicyOptions {
+    scriptSources?: readonly string[];
+    styleSources?: readonly string[];
+    inlineStyleAttributes?: InlineStyleAttributeInventory;
+    imgSources?: readonly string[];
+    fontSources?: readonly string[];
+    connectSources?: readonly string[];
+    mediaSources?: readonly string[];
+    frameSources?: readonly string[];
+}
+type AstroNativeCspConfig = Exclude<NonNullable<NonNullable<AstroConfig['security']>['csp']>, boolean>;
+type AstroCspDirective = NonNullable<AstroNativeCspConfig['directives']>[number];
+export type AstroCspResource = NonNullable<NonNullable<AstroNativeCspConfig['styleDirective']>['resources']>[number];
+export interface AstroCspConfig {
+    algorithm: 'SHA-256';
+    directives: AstroCspDirective[];
+    scriptDirective: {
+        resources: string[];
+    };
+    styleDirective: {
+        resources: AstroCspResource[];
+    };
+}
 export interface CachePolicyOptions {
     renderMode: RenderMode;
     audience: Audience;
 }
 export declare function buildSharedPublicationHeaders(options: HeaderPolicyOptions): Record<string, string>;
-export declare function buildContentSecurityPolicy(nonce?: string): string;
+/**
+ * Build framework-owned CSP configuration for Astro 7.1+.
+ * Astro hashes every script and style it emits, while this helper keeps the
+ * consumer's external source inventory exact and fail-closed.
+ */
+export declare function buildAstroCspConfig(options?: AstroCspPolicyOptions): AstroCspConfig;
+export declare function buildContentSecurityPolicy(input?: string | ContentSecurityPolicyOptions): string;
+export declare function buildStrictTransportSecurity(options?: StrictTransportSecurityOptions): string;
 export declare function buildCacheControl({ renderMode, audience }: CachePolicyOptions): string;
 export declare function normalizeHeaders(headers: HeaderMap | undefined): Record<string, string>;
+export declare function collectHeaders(headers: HeaderMap | undefined): Record<string, string[]>;
 export declare function isPrivateAudience(audience: Audience): boolean;
+export {};
 //# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAElE,eAAO,MAAM,yBAAyB,yJAO5B,CAAA;AAEV,MAAM,WAAW,mBAAmB;IACnC,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,eAAe,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB;IAClC,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;CAClB;AAED,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE,mBAAmB,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBxB;AAED,wBAAgB,0BAA0B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAoBjE;AAED,wBAAgB,iBAAiB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,kBAAkB,GAAG,MAAM,CAMtF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAavF;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAO7D"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,OAAO,CAAA;AACxC,OAAO,EACN,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,6BAA6B,EAElC,KAAK,UAAU,EACf,MAAM,aAAa,CAAA;AAEpB,eAAO,MAAM,yBAAyB,uNAS5B,CAAA;AAEV,MAAM,MAAM,uBAAuB,GAAG,aAAa,GAAG,0BAA0B,GAAG,aAAa,CAAA;AAChG,MAAM,MAAM,yBAAyB,GAAG,aAAa,GAAG,WAAW,GAAG,cAAc,CAAA;AAEpF,MAAM,WAAW,8BAA8B;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,mBAAmB;IACnC,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qBAAqB,CAAC,EAAE,KAAK,GAAG,4BAA4B,CAAA;IAC5D,uBAAuB,CAAC,EAAE,8BAA8B,CAAA;IACxD,uBAAuB,CAAC,EAAE,uBAAuB,CAAA;IACjD,yBAAyB,CAAC,EAAE,yBAAyB,CAAA;IACrD,eAAe,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,qBAAqB;IACrC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,qBAAqB,CAAC,EAAE,6BAA6B,CAAA;IACrD,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED,KAAK,oBAAoB,GAAG,OAAO,CAClC,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EACxD,OAAO,CACP,CAAA;AAED,KAAK,iBAAiB,GAAG,WAAW,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAEhF,MAAM,MAAM,gBAAgB,GAAG,WAAW,CACzC,WAAW,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC,CAChE,CAAC,MAAM,CAAC,CAAA;AAET,MAAM,WAAW,cAAc;IAC9B,SAAS,EAAE,SAAS,CAAA;IACpB,UAAU,EAAE,iBAAiB,EAAE,CAAA;IAC/B,eAAe,EAAE;QAAE,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACxC,cAAc,EAAE;QAAE,SAAS,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAA;CACjD;AAED,MAAM,WAAW,kBAAkB;IAClC,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;CAClB;AAED,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE,mBAAmB,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA2BxB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,qBAA0B,GAAG,cAAc,CA0CvF;AA4CD,wBAAgB,0BAA0B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,4BAA4B,GAAG,MAAM,CAyBhG;AAED,wBAAgB,4BAA4B,CAAC,OAAO,GAAE,8BAAmC,GAAG,MAAM,CAejG;AAED,wBAAgB,iBAAiB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,kBAAkB,GAAG,MAAM,CAMtF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOvF;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAavF;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAO7D"}

package/dist/policy.js

@@ -1,6 +1,9 @@
+import { inlineStyleAttributeInventorySchema, } from './schema.js';
 export const REQUIRED_SECURITY_HEADERS = [
     'content-security-policy',
     'strict-transport-security',
+    'cross-origin-opener-policy',
+    'cross-origin-resource-policy',
     'x-frame-options',
     'x-content-type-options',
     'referrer-policy',
@@ -8,27 +11,119 @@ export const REQUIRED_SECURITY_HEADERS = [
 ];
 export function buildSharedPublicationHeaders(options) {
     const headers = {
-        'Content-Security-Policy': buildContentSecurityPolicy(options.nonce),
-        'Strict-Transport-Security': 'max-age=31536000; includeSubDomains; preload',
+        'Strict-Transport-Security': buildStrictTransportSecurity(options.strictTransportSecurity),
+        'Cross-Origin-Opener-Policy': options.crossOriginOpenerPolicy ?? 'same-origin',
+        'Cross-Origin-Resource-Policy': options.crossOriginResourcePolicy ?? 'same-origin',
         'X-Frame-Options': 'DENY',
         'X-Content-Type-Options': 'nosniff',
         'Referrer-Policy': 'strict-origin-when-cross-origin',
         'Permissions-Policy': 'accelerometer=(), camera=(), geolocation=(), gyroscope=(), microphone=(), payment=(), usb=()',
         'Cache-Control': buildCacheControl(options),
     };
+    if (options.contentSecurityPolicy !== false) {
+        headers['Content-Security-Policy'] = buildContentSecurityPolicy(options.contentSecurityPolicy ?? {
+            nonce: options.nonce,
+            reportUri: options.cspReportUri,
+            reportTo: options.cspReportTo,
+        });
+    }
     if (options.markdownTwinUrl) {
         headers.Link = `<${options.markdownTwinUrl}>; rel="alternate"; type="text/markdown"`;
     }
     return headers;
 }
-export function buildContentSecurityPolicy(nonce) {
+/**
+ * Build framework-owned CSP configuration for Astro 7.1+.
+ * Astro hashes every script and style it emits, while this helper keeps the
+ * consumer's external source inventory exact and fail-closed.
+ */
+export function buildAstroCspConfig(options = {}) {
+    const inlineStyleAttributes = options.inlineStyleAttributes
+        ? inlineStyleAttributeInventorySchema.parse(options.inlineStyleAttributes)
+        : undefined;
+    const scriptSources = exactCspSources(options.scriptSources);
+    const styleSources = exactCspSources(options.styleSources);
+    const imgSources = exactCspSources(options.imgSources);
+    const fontSources = exactCspSources(options.fontSources);
+    const connectSources = exactCspSources(options.connectSources);
+    const mediaSources = exactCspSources(options.mediaSources);
+    const frameSources = exactCspSources(options.frameSources);
+    return {
+        algorithm: 'SHA-256',
+        directives: [
+            "default-src 'self'",
+            cspDirective('img-src', ["'self'", 'data:', 'blob:', ...imgSources]),
+            cspDirective('font-src', ["'self'", 'data:', ...fontSources]),
+            cspDirective('connect-src', ["'self'", ...connectSources]),
+            cspDirective('media-src', ["'self'", 'blob:', ...mediaSources]),
+            cspDirective('frame-src', ["'self'", ...frameSources]),
+            "object-src 'none'",
+            "base-uri 'self'",
+            "frame-ancestors 'none'",
+            "form-action 'self'",
+            'upgrade-insecure-requests',
+        ],
+        scriptDirective: {
+            resources: uniqueCspSources(["'self'", ...scriptSources]),
+        },
+        styleDirective: {
+            resources: inlineStyleAttributes
+                ? [
+                    ...uniqueCspSources(["'self'", ...styleSources]).map((resource) => ({
+                        resource,
+                        kind: 'element',
+                    })),
+                    { resource: "'unsafe-inline'", kind: 'attribute' },
+                ]
+                : uniqueCspSources(["'self'", ...styleSources]),
+        },
+    };
+}
+function uniqueCspSources(sources) {
+    return [...new Set(sources)];
+}
+function cspDirective(name, sources) {
+    return `${name} ${[...new Set(sources)].join(' ')}`;
+}
+function exactCspSources(sources) {
+    return [...new Set(sources ?? [])].map((source) => {
+        const normalized = source.trim();
+        if (normalized === "'self'")
+            return normalized;
+        if (normalized === '' ||
+            normalized.includes('*') ||
+            normalized === 'https:' ||
+            normalized === 'http:' ||
+            normalized.startsWith("'unsafe-")) {
+            throw new Error(`Astro CSP sources must be exact and cannot use ${source}`);
+        }
+        let parsed;
+        try {
+            parsed = new URL(normalized);
+        }
+        catch {
+            throw new Error(`Astro CSP sources must be exact HTTPS/WSS origins: ${source}`);
+        }
+        if ((parsed.protocol !== 'https:' && parsed.protocol !== 'wss:') ||
+            parsed.username !== '' ||
+            parsed.password !== '' ||
+            parsed.search !== '' ||
+            parsed.hash !== '' ||
+            (parsed.pathname !== '' && parsed.pathname !== '/')) {
+            throw new Error(`Astro CSP sources must be exact HTTPS/WSS origins: ${source}`);
+        }
+        return parsed.origin;
+    });
+}
+export function buildContentSecurityPolicy(input) {
+    const options = typeof input === 'string' ? { nonce: input } : (input ?? {});
     const scriptSources = ["'self'"];
     const styleSources = ["'self'"];
-    if (nonce) {
-        scriptSources.push(`'nonce-${nonce}'`);
-        styleSources.push(`'nonce-${nonce}'`);
+    if (options.nonce) {
+        scriptSources.push(`'nonce-${options.nonce}'`);
+        styleSources.push(`'nonce-${options.nonce}'`);
     }
-    return [
+    const directives = [
         "default-src 'self'",
         `script-src ${scriptSources.join(' ')}`,
         `style-src ${styleSources.join(' ')}`,
@@ -39,7 +134,27 @@ export function buildContentSecurityPolicy(nonce) {
         "base-uri 'self'",
         "frame-ancestors 'none'",
         'upgrade-insecure-requests',
-    ].join('; ');
+    ];
+    if (options.reportTo)
+        directives.push(`report-to ${options.reportTo}`);
+    if (options.reportUri)
+        directives.push(`report-uri ${options.reportUri}`);
+    return directives.join('; ');
+}
+export function buildStrictTransportSecurity(options = {}) {
+    const maxAgeSeconds = options.maxAgeSeconds ?? 31536000;
+    if (!Number.isInteger(maxAgeSeconds) || maxAgeSeconds < 31536000) {
+        throw new Error('Strict-Transport-Security maxAgeSeconds must be at least 31536000');
+    }
+    if (options.preload === true && options.includeSubDomains !== true) {
+        throw new Error('Strict-Transport-Security preload requires includeSubDomains after host inventory proof');
+    }
+    const directives = [`max-age=${maxAgeSeconds}`];
+    if (options.includeSubDomains === true)
+        directives.push('includeSubDomains');
+    if (options.preload === true)
+        directives.push('preload');
+    return directives.join('; ');
 }
 export function buildCacheControl({ renderMode, audience }) {
     if (isPrivateAudience(audience))
@@ -50,15 +165,24 @@ export function buildCacheControl({ renderMode, audience }) {
     return 'public, max-age=0, s-maxage=300, stale-while-revalidate=86400';
 }
 export function normalizeHeaders(headers) {
+    const entries = collectHeaders(headers);
+    const normalized = {};
+    for (const [name, values] of Object.entries(entries)) {
+        normalized[name] = values.join(', ');
+    }
+    return normalized;
+}
+export function collectHeaders(headers) {
     const normalized = {};
     if (!headers)
         return normalized;
     for (const [name, value] of Object.entries(headers)) {
+        const normalizedName = name.toLowerCase();
         if (typeof value === 'string') {
-            normalized[name.toLowerCase()] = value;
+            normalized[normalizedName] = [...(normalized[normalizedName] ?? []), value];
         }
         else if (Array.isArray(value)) {
-            normalized[name.toLowerCase()] = value.join(', ');
+            normalized[normalizedName] = [...(normalized[normalizedName] ?? []), ...value];
         }
     }
     return normalized;

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACxC,yBAAyB;IACzB,2BAA2B;IAC3B,iBAAiB;IACjB,wBAAwB;IACxB,iBAAiB;IACjB,oBAAoB;CACX,CAAA;AAcV,MAAM,UAAU,6BAA6B,CAC5C,OAA4B;IAE5B,MAAM,OAAO,GAA2B;QACvC,yBAAyB,EAAE,0BAA0B,CAAC,OAAO,CAAC,KAAK,CAAC;QACpE,2BAA2B,EAAE,8CAA8C;QAC3E,iBAAiB,EAAE,MAAM;QACzB,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,iCAAiC;QACpD,oBAAoB,EACnB,8FAA8F;QAC/F,eAAe,EAAE,iBAAiB,CAAC,OAAO,CAAC;KAC3C,CAAA;IAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,eAAe,0CAA0C,CAAA;IACrF,CAAC;IAED,OAAO,OAAO,CAAA;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACxD,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,CAAA;IAChC,MAAM,YAAY,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC/B,IAAI,KAAK,EAAE,CAAC;QACX,aAAa,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAA;QACtC,YAAY,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAA;IACtC,CAAC;IAED,OAAO;QACN,oBAAoB;QACpB,cAAc,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACvC,aAAa,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrC,6BAA6B;QAC7B,uBAAuB;QACvB,2BAA2B;QAC3B,mBAAmB;QACnB,iBAAiB;QACjB,wBAAwB;QACxB,2BAA2B;KAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAsB;IAC7E,IAAI,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,mBAAmB,CAAA;IAC3D,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,oEAAoE,CAAA;IAC5E,CAAC;IACD,OAAO,+DAA+D,CAAA;AACvE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA8B;IAC9D,MAAM,UAAU,GAA2B,EAAE,CAAA;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAA;IAE/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAA;QACvC,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClD,CAAC;IACF,CAAC;IAED,OAAO,UAAU,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAkB;IACnD,OAAO,CACN,QAAQ,KAAK,YAAY;QACzB,QAAQ,KAAK,QAAQ;QACrB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,SAAS,CACtB,CAAA;AACF,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AACA,OAAO,EAIN,mCAAmC,GAEnC,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACxC,yBAAyB;IACzB,2BAA2B;IAC3B,4BAA4B;IAC5B,8BAA8B;IAC9B,iBAAiB;IACjB,wBAAwB;IACxB,iBAAiB;IACjB,oBAAoB;CACX,CAAA;AAgEV,MAAM,UAAU,6BAA6B,CAC5C,OAA4B;IAE5B,MAAM,OAAO,GAA2B;QACvC,2BAA2B,EAAE,4BAA4B,CAAC,OAAO,CAAC,uBAAuB,CAAC;QAC1F,4BAA4B,EAAE,OAAO,CAAC,uBAAuB,IAAI,aAAa;QAC9E,8BAA8B,EAAE,OAAO,CAAC,yBAAyB,IAAI,aAAa;QAClF,iBAAiB,EAAE,MAAM;QACzB,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,iCAAiC;QACpD,oBAAoB,EACnB,8FAA8F;QAC/F,eAAe,EAAE,iBAAiB,CAAC,OAAO,CAAC;KAC3C,CAAA;IACD,IAAI,OAAO,CAAC,qBAAqB,KAAK,KAAK,EAAE,CAAC;QAC7C,OAAO,CAAC,yBAAyB,CAAC,GAAG,0BAA0B,CAC9D,OAAO,CAAC,qBAAqB,IAAI;YAChC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,YAAY;YAC/B,QAAQ,EAAE,OAAO,CAAC,WAAW;SAC7B,CACD,CAAA;IACF,CAAC;IAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,eAAe,0CAA0C,CAAA;IACrF,CAAC;IAED,OAAO,OAAO,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAiC,EAAE;IACtE,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB;QAC1D,CAAC,CAAC,mCAAmC,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC;QAC1E,CAAC,CAAC,SAAS,CAAA;IACZ,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAC5D,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACtD,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACxD,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IAC9D,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAE1D,OAAO;QACN,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE;YACX,oBAAoB;YACpB,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC;YACpE,YAAY,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC;YAC7D,YAAY,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,GAAG,cAAc,CAAC,CAAC;YAC1D,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC;YAC/D,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,CAAC;YACtD,mBAAmB;YACnB,iBAAiB;YACjB,wBAAwB;YACxB,oBAAoB;YACpB,2BAA2B;SAC3B;QACD,eAAe,EAAE;YAChB,SAAS,EAAE,gBAAgB,CAAC,CAAC,QAAQ,EAAE,GAAG,aAAa,CAAC,CAAC;SACzD;QACD,cAAc,EAAE;YACf,SAAS,EAAE,qBAAqB;gBAC/B,CAAC,CAAC;oBACA,GAAG,gBAAgB,CAAC,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;wBACnE,QAAQ;wBACR,IAAI,EAAE,SAAkB;qBACxB,CAAC,CAAC;oBACH,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAoB,EAAE;iBAC3D;gBACF,CAAC,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,CAAC;SAChD;KAC8B,CAAA;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA0B;IACnD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;AAC7B,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,OAA0B;IAC7D,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAuB,CAAA;AACzE,CAAC;AAED,SAAS,eAAe,CAAC,OAAsC;IAC9D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;QAChC,IAAI,UAAU,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAA;QAC9C,IACC,UAAU,KAAK,EAAE;YACjB,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;YACxB,UAAU,KAAK,QAAQ;YACvB,UAAU,KAAK,OAAO;YACtB,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,EAChC,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,EAAE,CAAC,CAAA;QAC5E,CAAC;QAED,IAAI,MAAW,CAAA;QACf,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;QAC7B,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,EAAE,CAAC,CAAA;QAChF,CAAC;QACD,IACC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC;YAC5D,MAAM,CAAC,QAAQ,KAAK,EAAE;YACtB,MAAM,CAAC,QAAQ,KAAK,EAAE;YACtB,MAAM,CAAC,MAAM,KAAK,EAAE;YACpB,MAAM,CAAC,IAAI,KAAK,EAAE;YAClB,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,EAClD,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,EAAE,CAAC,CAAA;QAChF,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAA;IACrB,CAAC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAA6C;IACvF,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IAC5E,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,CAAA;IAChC,MAAM,YAAY,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC/B,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,aAAa,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,KAAK,GAAG,CAAC,CAAA;QAC9C,YAAY,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,KAAK,GAAG,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,UAAU,GAAG;QAClB,oBAAoB;QACpB,cAAc,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACvC,aAAa,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrC,6BAA6B;QAC7B,uBAAuB;QACvB,2BAA2B;QAC3B,mBAAmB;QACnB,iBAAiB;QACjB,wBAAwB;QACxB,2BAA2B;KAC3B,CAAA;IACD,IAAI,OAAO,CAAC,QAAQ;QAAE,UAAU,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IACtE,IAAI,OAAO,CAAC,SAAS;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAEzE,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,UAA0C,EAAE;IACxF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAA;IACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,QAAQ,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACd,yFAAyF,CACzF,CAAA;IACF,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,WAAW,aAAa,EAAE,CAAC,CAAA;IAC/C,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC5E,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACxD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAsB;IAC7E,IAAI,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,mBAAmB,CAAA;IAC3D,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,oEAAoE,CAAA;IAC5E,CAAC;IACD,OAAO,+DAA+D,CAAA;AACvE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA8B;IAC9D,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,UAAU,GAA2B,EAAE,CAAA;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,UAAU,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC5D,MAAM,UAAU,GAA6B,EAAE,CAAA;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;QAC5E,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAA;QAC/E,CAAC;IACF,CAAC;IAED,OAAO,UAAU,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAkB;IACnD,OAAO,CACN,QAAQ,KAAK,YAAY;QACzB,QAAQ,KAAK,QAAQ;QACrB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,SAAS,CACtB,CAAA;AACF,CAAC"}

package/dist/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAEA,OAAO,EAKN,KAAK,uBAAuB,EAG5B,KAAK,mBAAmB,EAExB,KAAK,kBAAkB,EAEvB,MAAM,aAAa,CAAA;AAKpB,MAAM,WAAW,qBAAqB;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAClB;AAED,wBAAgB,kBAAkB,CACjC,KAAK,EAAE,uBAAuB,EAC9B,OAAO,GAAE,qBAA0B,GACjC,kBAAkB,CA6BpB;AAED,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,uBAAuB,EAAE,EACjC,OAAO,GAAE,qBAA0B,GACjC,mBAAmB,CAuBrB"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAOA,OAAO,EAKN,KAAK,uBAAuB,EAG5B,KAAK,mBAAmB,EAGxB,KAAK,kBAAkB,EAEvB,MAAM,aAAa,CAAA;AAuBpB,MAAM,WAAW,qBAAqB;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAClB;AAED,wBAAgB,kBAAkB,CACjC,KAAK,EAAE,uBAAuB,EAC9B,OAAO,GAAE,qBAA0B,GACjC,kBAAkB,CA+BpB;AAED,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,uBAAuB,EAAE,EACjC,OAAO,GAAE,qBAA0B,GACjC,mBAAmB,CAuBrB"}