@growth-labs/conformance 0.2.0 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # @growth-labs/conformance Changelog
 
+## 0.3.1 — 2026-07-17
+
+- Mark the `astro` peer dependency as optional (`peerDependenciesMeta.astro.optional: true`).
+  Non-Astro tooling consumers are no longer burdened with Astro's native/tooling
+  graph during install. The compatible peer range (`^7.1.0`) is retained for Astro
+  consumers, and the sole Astro reference in source (`import type { AstroConfig }`)
+  remains a type-only import that is erased at compile time.
+
+## 0.3.0 — 2026-07-17
+
+- Add `buildAstroCspConfig()` for Astro 7.1+ native SHA-256 CSP generation with
+  exact external-origin validation and no wildcard or `unsafe-*` escape hatch.
+  Its return shape is compile-checked against Astro's exported CSP config type,
+  and a real Astro build proves the attribute-only directive is emitted.
+- Allow Astro 7.1+ consumers with a proven inline-style-attribute inventory to
+  scope `'unsafe-inline'` to `style-src-attr` only. Script and style-element
+  execution remain hash-protected and fail closed. The runner requires the
+  inventory receipt to match the exact build commit. The policy API requires
+  that structured receipt rather than a boolean escape hatch, including a
+  versioned scanner identity and SHA-256 output hash.
+- Require canonical lowercase commit SHAs, SHA-256 evidence hashes, and CSP
+  hash algorithm tokens in security evidence.
+- Let consumers set `contentSecurityPolicy: false` on
+  `buildSharedPublicationHeaders()` when Astro owns the per-response hash CSP;
+  all other shared response headers remain package-owned.
+- Add an explicit per-fixture frame policy contract. The default remains
+  `frame-ancestors 'none'` plus `X-Frame-Options: DENY`; deliberately embeddable
+  routes may declare only `'self'`, `https:`, or exact HTTPS origins and must
+  omit a conflicting legacy frame header. The runner validates the CSP sources
+  exactly rather than accepting a fleet-wide relaxation.
+
 ## 0.2.0 — 2026-07-16
 
 ### Added

package/README.md

@@ -45,6 +45,10 @@ const fixture = {
 		canonicalUrl: 'https://fronts.co/example',
 		schemaTypes: ['NewsArticle'],
 		discoverEligible: true,
+		framePolicy: {
+			ancestors: ["'none'"],
+			legacyHeader: 'DENY',
+		},
 	},
 	publicationSurfaces: [
 		{ name: 'sitemap', status: 'present', httpStatus: 200, bodyBytes: 1024 },
@@ -72,10 +76,18 @@ const fixture = {
 				evidence: 'sanitized CSP report or blocked-canary receipt',
 			},
 		],
+		inlineStyleAttributes: {
+			commitSha: 'bd39d718f6a5b0df9a249e11638a8b430050941e',
+			occurrenceCount: 4,
+			evidence: {
+				tool: 'platform-foundations:inline-style-inventory@1',
+				outputHash: 'sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+			},
+		},
 	},
 	buildEvidence: {
 		commitSha: 'bd39d718f6a5b0df9a249e11638a8b430050941e',
-		packageVersions: { '@growth-labs/conformance': '0.2.0', '@growth-labs/seo': '0.9.0' },
+		packageVersions: { '@growth-labs/conformance': '0.3.0', '@growth-labs/seo': '0.9.0' },
 		staticHeaderPolicy: true,
 		ssrHeaderPolicy: true,
 	},
@@ -88,20 +100,67 @@ const fleetBundle = runFleetConformance([fixture])
 ## Shared Header Policy
 
 Use `buildSharedPublicationHeaders()` when a site wants the package-owned
-baseline for SSR and static response headers:
+baseline for SSR and static response headers. Astro 7.1+ sites should let Astro
+own the per-route hash CSP and retain the remaining shared headers. The helper's
+peer contract is intentionally pinned to the first Astro release that supports
+attribute-scoped style resources:
 
 ```ts
-import { buildSharedPublicationHeaders } from '@growth-labs/conformance/policy'
+import {
+	buildAstroCspConfig,
+	buildSharedPublicationHeaders,
+} from '@growth-labs/conformance/policy'
+
+const csp = buildAstroCspConfig({
+	scriptSources: ['https://challenges.cloudflare.com'],
+	styleSources: ['https://fonts.googleapis.com'],
+	inlineStyleAttributes: {
+		commitSha: 'bd39d718f6a5b0df9a249e11638a8b430050941e',
+		occurrenceCount: 4,
+		evidence: {
+			tool: 'platform-foundations:inline-style-inventory@1',
+			outputHash: 'sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+		},
+	},
+})
 
 const headers = buildSharedPublicationHeaders({
 	renderMode: 'ssr',
 	audience: 'public',
-	nonce: runtimeNonce,
-	cspReportUri: 'https://example.com/api/csp-report',
+	contentSecurityPolicy: false,
 	markdownTwinUrl: 'https://example.com/article.md',
 })
 ```
 
+The fixture default is the non-embeddable policy above. For a deliberately
+embeddable route, declare its exact response class and omit a conflicting
+`X-Frame-Options` header:
+
+```ts
+expected: {
+	framePolicy: {
+		ancestors: ['https://trusted.example'],
+		legacyHeader: 'omit',
+	},
+}
+```
+
+Accepted ancestors are `'none'`, `'self'`, `https:`, and exact HTTPS origins;
+wildcards, paths, credentials, query strings, and fragments are rejected.
+`DENY` is valid only with `'none'`, and `SAMEORIGIN` only with `'self'`; broader
+embeddable policies must use `legacyHeader: 'omit'` to avoid contradictory
+browser behavior.
+
+Astro 7.1+ consumers that prove they still emit HTML `style` attributes may set
+`inlineStyleAttributes` to the validated inventory receipt. There is no boolean
+escape hatch. The helper then scopes `'unsafe-inline'` to `style-src-attr`
+while preserving hash protection for scripts and `<style>` elements. The
+receipt requires the exact lowercase 40-character build commit SHA, a positive
+occurrence count, the versioned scanner identity, and the lowercase SHA-256
+content hash of its machine output. The same receipt must appear in the
+conformance fixture and its commit must match `buildEvidence.commitSha`. Do not
+enable this option as a generic compatibility fix.
+
 The policy emits CSP, HSTS, frame protection, MIME sniffing protection,
 COOP, CORP, referrer policy, permissions policy, cache semantics, and optional
 markdown twin `Link` metadata. Private audiences use `private, no-store`;

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { buildCacheControl, buildContentSecurityPolicy, buildSharedPublicationHeaders, buildStrictTransportSecurity, type CachePolicyOptions, type ContentSecurityPolicyOptions, type CrossOriginOpenerPolicy, type CrossOriginResourcePolicy, collectHeaders, type HeaderPolicyOptions, isPrivateAudience, normalizeHeaders, REQUIRED_SECURITY_HEADERS, type StrictTransportSecurityOptions, } from './policy.js';
+export { type AstroCspConfig, type AstroCspPolicyOptions, type AstroCspResource, buildAstroCspConfig, buildCacheControl, buildContentSecurityPolicy, buildSharedPublicationHeaders, buildStrictTransportSecurity, type CachePolicyOptions, type ContentSecurityPolicyOptions, type CrossOriginOpenerPolicy, type CrossOriginResourcePolicy, collectHeaders, type HeaderPolicyOptions, isPrivateAudience, normalizeHeaders, REQUIRED_SECURITY_HEADERS, type StrictTransportSecurityOptions, } from './policy.js';
 export { type RunConformanceOptions, runFleetConformance, runSiteConformance } from './runner.js';
-export { type Audience, audienceSchema, type BuildEvidence, buildEvidenceSchema, type CacheVariant, type ConformanceCheckReceipt, type ConformanceFinding, type ConformanceFixture, type ConformanceFixtureInput, type CspReportReceipt, cacheVariantSchema, checkStatusSchema, conformanceCheckReceiptSchema, conformanceExpectedSchema, conformanceFindingSchema, conformanceFixtureSchema, cspReportReceiptSchema, EVIDENCE_SCHEMA_VERSION, type EvidenceSummary, evidenceSummarySchema, type FleetEvidenceBundle, findingSeveritySchema, fleetEvidenceBundleSchema, type HeaderMap, headerMapSchema, headerValueSchema, type PublicationSurfaceEvidence, parseConformanceFixture, publicationSurfaceSchema, REQUIRED_FUNCTIONAL_PROBE_NAMES, REQUIRED_NEGATIVE_FIXTURE_CODES, type RenderMode, type RequiredNegativeFindingCode, type RequiredNegativeFixtureId, renderModeSchema, type SecurityFunctionalProbeReceipt, type SecurityReceipts, type SiteEvidenceBundle, type SurfaceResponse, securityFunctionalProbeReceiptSchema, securityReceiptsSchema, siteEvidenceBundleSchema, surfaceResponseSchema, validateFleetEvidenceBundle, validateSiteEvidenceBundle, } from './schema.js';
+export { type Audience, audienceSchema, type BuildEvidence, buildEvidenceSchema, type CacheVariant, type ConformanceCheckReceipt, type ConformanceFinding, type ConformanceFixture, type ConformanceFixtureInput, type CspReportReceipt, cacheVariantSchema, checkStatusSchema, conformanceCheckReceiptSchema, conformanceExpectedSchema, conformanceFindingSchema, conformanceFixtureSchema, cspReportReceiptSchema, EVIDENCE_SCHEMA_VERSION, type EvidenceSummary, evidenceSummarySchema, type FleetEvidenceBundle, findingSeveritySchema, fleetEvidenceBundleSchema, type HeaderMap, headerMapSchema, headerValueSchema, type InlineStyleAttributeInventory, inlineStyleAttributeInventorySchema, type PublicationSurfaceEvidence, parseConformanceFixture, publicationSurfaceSchema, REQUIRED_FUNCTIONAL_PROBE_NAMES, REQUIRED_NEGATIVE_FIXTURE_CODES, type RenderMode, type RequiredNegativeFindingCode, type RequiredNegativeFixtureId, renderModeSchema, type SecurityFunctionalProbeReceipt, type SecurityReceipts, type SiteEvidenceBundle, type SurfaceResponse, securityFunctionalProbeReceiptSchema, securityReceiptsSchema, siteEvidenceBundleSchema, surfaceResponseSchema, validateFleetEvidenceBundle, validateSiteEvidenceBundle, } from './schema.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,EAC5B,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,cAAc,EACd,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,EACzB,KAAK,8BAA8B,GACnC,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,KAAK,qBAAqB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EACN,KAAK,QAAQ,EACb,cAAc,EACd,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,yBAAyB,EACzB,KAAK,SAAS,EACd,eAAe,EACf,iBAAiB,EACjB,KAAK,0BAA0B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,+BAA+B,EAC/B,KAAK,UAAU,EACf,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC9B,gBAAgB,EAChB,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,oCAAoC,EACpC,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,GAC1B,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,EAC5B,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,cAAc,EACd,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,EACzB,KAAK,8BAA8B,GACnC,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,KAAK,qBAAqB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EACN,KAAK,QAAQ,EACb,cAAc,EACd,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,yBAAyB,EACzB,KAAK,SAAS,EACd,eAAe,EACf,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,mCAAmC,EACnC,KAAK,0BAA0B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,+BAA+B,EAC/B,KAAK,UAAU,EACf,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC9B,gBAAgB,EAChB,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,oCAAoC,EACpC,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,GAC1B,MAAM,aAAa,CAAA"}

package/dist/index.js

@@ -1,4 +1,4 @@
-export { buildCacheControl, buildContentSecurityPolicy, buildSharedPublicationHeaders, buildStrictTransportSecurity, collectHeaders, isPrivateAudience, normalizeHeaders, REQUIRED_SECURITY_HEADERS, } from './policy.js';
+export { buildAstroCspConfig, buildCacheControl, buildContentSecurityPolicy, buildSharedPublicationHeaders, buildStrictTransportSecurity, collectHeaders, isPrivateAudience, normalizeHeaders, REQUIRED_SECURITY_HEADERS, } from './policy.js';
 export { runFleetConformance, runSiteConformance } from './runner.js';
-export { audienceSchema, buildEvidenceSchema, cacheVariantSchema, checkStatusSchema, conformanceCheckReceiptSchema, conformanceExpectedSchema, conformanceFindingSchema, conformanceFixtureSchema, cspReportReceiptSchema, EVIDENCE_SCHEMA_VERSION, evidenceSummarySchema, findingSeveritySchema, fleetEvidenceBundleSchema, headerMapSchema, headerValueSchema, parseConformanceFixture, publicationSurfaceSchema, REQUIRED_FUNCTIONAL_PROBE_NAMES, REQUIRED_NEGATIVE_FIXTURE_CODES, renderModeSchema, securityFunctionalProbeReceiptSchema, securityReceiptsSchema, siteEvidenceBundleSchema, surfaceResponseSchema, validateFleetEvidenceBundle, validateSiteEvidenceBundle, } from './schema.js';
+export { audienceSchema, buildEvidenceSchema, cacheVariantSchema, checkStatusSchema, conformanceCheckReceiptSchema, conformanceExpectedSchema, conformanceFindingSchema, conformanceFixtureSchema, cspReportReceiptSchema, EVIDENCE_SCHEMA_VERSION, evidenceSummarySchema, findingSeveritySchema, fleetEvidenceBundleSchema, headerMapSchema, headerValueSchema, inlineStyleAttributeInventorySchema, parseConformanceFixture, publicationSurfaceSchema, REQUIRED_FUNCTIONAL_PROBE_NAMES, REQUIRED_NEGATIVE_FIXTURE_CODES, renderModeSchema, securityFunctionalProbeReceiptSchema, securityReceiptsSchema, siteEvidenceBundleSchema, surfaceResponseSchema, validateFleetEvidenceBundle, validateSiteEvidenceBundle, } from './schema.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,EAK5B,cAAc,EAEd,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,GAEzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAA8B,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EAEN,cAAc,EAEd,mBAAmB,EAOnB,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EAEvB,qBAAqB,EAErB,qBAAqB,EACrB,yBAAyB,EAEzB,eAAe,EACf,iBAAiB,EAEjB,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,+BAA+B,EAI/B,gBAAgB,EAKhB,oCAAoC,EACpC,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,GAC1B,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,EAK5B,cAAc,EAEd,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,GAEzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAA8B,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EAEN,cAAc,EAEd,mBAAmB,EAOnB,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EAEvB,qBAAqB,EAErB,qBAAqB,EACrB,yBAAyB,EAEzB,eAAe,EACf,iBAAiB,EAEjB,mCAAmC,EAEnC,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,+BAA+B,EAI/B,gBAAgB,EAKhB,oCAAoC,EACpC,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,GAC1B,MAAM,aAAa,CAAA"}

package/dist/policy.d.ts

@@ -1,4 +1,5 @@
-import type { Audience, HeaderMap, RenderMode } from './schema.js';
+import type { AstroConfig } from 'astro';
+import { type Audience, type HeaderMap, type InlineStyleAttributeInventory, type RenderMode } from './schema.js';
 export declare const REQUIRED_SECURITY_HEADERS: readonly ["content-security-policy", "strict-transport-security", "cross-origin-opener-policy", "cross-origin-resource-policy", "x-frame-options", "x-content-type-options", "referrer-policy", "permissions-policy"];
 export type CrossOriginOpenerPolicy = 'same-origin' | 'same-origin-allow-popups' | 'unsafe-none';
 export type CrossOriginResourcePolicy = 'same-origin' | 'same-site' | 'cross-origin';
@@ -18,20 +19,51 @@ export interface HeaderPolicyOptions {
     nonce?: string;
     cspReportUri?: string;
     cspReportTo?: string;
+    contentSecurityPolicy?: false | ContentSecurityPolicyOptions;
     strictTransportSecurity?: StrictTransportSecurityOptions;
     crossOriginOpenerPolicy?: CrossOriginOpenerPolicy;
     crossOriginResourcePolicy?: CrossOriginResourcePolicy;
     markdownTwinUrl?: string;
 }
+export interface AstroCspPolicyOptions {
+    scriptSources?: readonly string[];
+    styleSources?: readonly string[];
+    inlineStyleAttributes?: InlineStyleAttributeInventory;
+    imgSources?: readonly string[];
+    fontSources?: readonly string[];
+    connectSources?: readonly string[];
+    mediaSources?: readonly string[];
+    frameSources?: readonly string[];
+}
+type AstroNativeCspConfig = Exclude<NonNullable<NonNullable<AstroConfig['security']>['csp']>, boolean>;
+type AstroCspDirective = NonNullable<AstroNativeCspConfig['directives']>[number];
+export type AstroCspResource = NonNullable<NonNullable<AstroNativeCspConfig['styleDirective']>['resources']>[number];
+export interface AstroCspConfig {
+    algorithm: 'SHA-256';
+    directives: AstroCspDirective[];
+    scriptDirective: {
+        resources: string[];
+    };
+    styleDirective: {
+        resources: AstroCspResource[];
+    };
+}
 export interface CachePolicyOptions {
     renderMode: RenderMode;
     audience: Audience;
 }
 export declare function buildSharedPublicationHeaders(options: HeaderPolicyOptions): Record<string, string>;
+/**
+ * Build framework-owned CSP configuration for Astro 7.1+.
+ * Astro hashes every script and style it emits, while this helper keeps the
+ * consumer's external source inventory exact and fail-closed.
+ */
+export declare function buildAstroCspConfig(options?: AstroCspPolicyOptions): AstroCspConfig;
 export declare function buildContentSecurityPolicy(input?: string | ContentSecurityPolicyOptions): string;
 export declare function buildStrictTransportSecurity(options?: StrictTransportSecurityOptions): string;
 export declare function buildCacheControl({ renderMode, audience }: CachePolicyOptions): string;
 export declare function normalizeHeaders(headers: HeaderMap | undefined): Record<string, string>;
 export declare function collectHeaders(headers: HeaderMap | undefined): Record<string, string[]>;
 export declare function isPrivateAudience(audience: Audience): boolean;
+export {};
 //# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAElE,eAAO,MAAM,yBAAyB,uNAS5B,CAAA;AAEV,MAAM,MAAM,uBAAuB,GAAG,aAAa,GAAG,0BAA0B,GAAG,aAAa,CAAA;AAChG,MAAM,MAAM,yBAAyB,GAAG,aAAa,GAAG,WAAW,GAAG,cAAc,CAAA;AAEpF,MAAM,WAAW,8BAA8B;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,mBAAmB;IACnC,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,uBAAuB,CAAC,EAAE,8BAA8B,CAAA;IACxD,uBAAuB,CAAC,EAAE,uBAAuB,CAAA;IACjD,yBAAyB,CAAC,EAAE,yBAAyB,CAAA;IACrD,eAAe,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB;IAClC,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;CAClB;AAED,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE,mBAAmB,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAuBxB;AAED,wBAAgB,0BAA0B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,4BAA4B,GAAG,MAAM,CAyBhG;AAED,wBAAgB,4BAA4B,CAAC,OAAO,GAAE,8BAAmC,GAAG,MAAM,CAejG;AAED,wBAAgB,iBAAiB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,kBAAkB,GAAG,MAAM,CAMtF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOvF;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAavF;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAO7D"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,OAAO,CAAA;AACxC,OAAO,EACN,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,6BAA6B,EAElC,KAAK,UAAU,EACf,MAAM,aAAa,CAAA;AAEpB,eAAO,MAAM,yBAAyB,uNAS5B,CAAA;AAEV,MAAM,MAAM,uBAAuB,GAAG,aAAa,GAAG,0BAA0B,GAAG,aAAa,CAAA;AAChG,MAAM,MAAM,yBAAyB,GAAG,aAAa,GAAG,WAAW,GAAG,cAAc,CAAA;AAEpF,MAAM,WAAW,8BAA8B;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,mBAAmB;IACnC,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qBAAqB,CAAC,EAAE,KAAK,GAAG,4BAA4B,CAAA;IAC5D,uBAAuB,CAAC,EAAE,8BAA8B,CAAA;IACxD,uBAAuB,CAAC,EAAE,uBAAuB,CAAA;IACjD,yBAAyB,CAAC,EAAE,yBAAyB,CAAA;IACrD,eAAe,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,qBAAqB;IACrC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,qBAAqB,CAAC,EAAE,6BAA6B,CAAA;IACrD,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED,KAAK,oBAAoB,GAAG,OAAO,CAClC,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EACxD,OAAO,CACP,CAAA;AAED,KAAK,iBAAiB,GAAG,WAAW,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAEhF,MAAM,MAAM,gBAAgB,GAAG,WAAW,CACzC,WAAW,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC,CAChE,CAAC,MAAM,CAAC,CAAA;AAET,MAAM,WAAW,cAAc;IAC9B,SAAS,EAAE,SAAS,CAAA;IACpB,UAAU,EAAE,iBAAiB,EAAE,CAAA;IAC/B,eAAe,EAAE;QAAE,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACxC,cAAc,EAAE;QAAE,SAAS,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAA;CACjD;AAED,MAAM,WAAW,kBAAkB;IAClC,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;CAClB;AAED,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE,mBAAmB,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA2BxB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,qBAA0B,GAAG,cAAc,CA0CvF;AA4CD,wBAAgB,0BAA0B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,4BAA4B,GAAG,MAAM,CAyBhG;AAED,wBAAgB,4BAA4B,CAAC,OAAO,GAAE,8BAAmC,GAAG,MAAM,CAejG;AAED,wBAAgB,iBAAiB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,kBAAkB,GAAG,MAAM,CAMtF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOvF;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAavF;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAO7D"}

package/dist/policy.js

@@ -1,3 +1,4 @@
+import { inlineStyleAttributeInventorySchema, } from './schema.js';
 export const REQUIRED_SECURITY_HEADERS = [
     'content-security-policy',
     'strict-transport-security',
@@ -10,11 +11,6 @@ export const REQUIRED_SECURITY_HEADERS = [
 ];
 export function buildSharedPublicationHeaders(options) {
     const headers = {
-        'Content-Security-Policy': buildContentSecurityPolicy({
-            nonce: options.nonce,
-            reportUri: options.cspReportUri,
-            reportTo: options.cspReportTo,
-        }),
         'Strict-Transport-Security': buildStrictTransportSecurity(options.strictTransportSecurity),
         'Cross-Origin-Opener-Policy': options.crossOriginOpenerPolicy ?? 'same-origin',
         'Cross-Origin-Resource-Policy': options.crossOriginResourcePolicy ?? 'same-origin',
@@ -24,11 +20,101 @@ export function buildSharedPublicationHeaders(options) {
         'Permissions-Policy': 'accelerometer=(), camera=(), geolocation=(), gyroscope=(), microphone=(), payment=(), usb=()',
         'Cache-Control': buildCacheControl(options),
     };
+    if (options.contentSecurityPolicy !== false) {
+        headers['Content-Security-Policy'] = buildContentSecurityPolicy(options.contentSecurityPolicy ?? {
+            nonce: options.nonce,
+            reportUri: options.cspReportUri,
+            reportTo: options.cspReportTo,
+        });
+    }
     if (options.markdownTwinUrl) {
         headers.Link = `<${options.markdownTwinUrl}>; rel="alternate"; type="text/markdown"`;
     }
     return headers;
 }
+/**
+ * Build framework-owned CSP configuration for Astro 7.1+.
+ * Astro hashes every script and style it emits, while this helper keeps the
+ * consumer's external source inventory exact and fail-closed.
+ */
+export function buildAstroCspConfig(options = {}) {
+    const inlineStyleAttributes = options.inlineStyleAttributes
+        ? inlineStyleAttributeInventorySchema.parse(options.inlineStyleAttributes)
+        : undefined;
+    const scriptSources = exactCspSources(options.scriptSources);
+    const styleSources = exactCspSources(options.styleSources);
+    const imgSources = exactCspSources(options.imgSources);
+    const fontSources = exactCspSources(options.fontSources);
+    const connectSources = exactCspSources(options.connectSources);
+    const mediaSources = exactCspSources(options.mediaSources);
+    const frameSources = exactCspSources(options.frameSources);
+    return {
+        algorithm: 'SHA-256',
+        directives: [
+            "default-src 'self'",
+            cspDirective('img-src', ["'self'", 'data:', 'blob:', ...imgSources]),
+            cspDirective('font-src', ["'self'", 'data:', ...fontSources]),
+            cspDirective('connect-src', ["'self'", ...connectSources]),
+            cspDirective('media-src', ["'self'", 'blob:', ...mediaSources]),
+            cspDirective('frame-src', ["'self'", ...frameSources]),
+            "object-src 'none'",
+            "base-uri 'self'",
+            "frame-ancestors 'none'",
+            "form-action 'self'",
+            'upgrade-insecure-requests',
+        ],
+        scriptDirective: {
+            resources: uniqueCspSources(["'self'", ...scriptSources]),
+        },
+        styleDirective: {
+            resources: inlineStyleAttributes
+                ? [
+                    ...uniqueCspSources(["'self'", ...styleSources]).map((resource) => ({
+                        resource,
+                        kind: 'element',
+                    })),
+                    { resource: "'unsafe-inline'", kind: 'attribute' },
+                ]
+                : uniqueCspSources(["'self'", ...styleSources]),
+        },
+    };
+}
+function uniqueCspSources(sources) {
+    return [...new Set(sources)];
+}
+function cspDirective(name, sources) {
+    return `${name} ${[...new Set(sources)].join(' ')}`;
+}
+function exactCspSources(sources) {
+    return [...new Set(sources ?? [])].map((source) => {
+        const normalized = source.trim();
+        if (normalized === "'self'")
+            return normalized;
+        if (normalized === '' ||
+            normalized.includes('*') ||
+            normalized === 'https:' ||
+            normalized === 'http:' ||
+            normalized.startsWith("'unsafe-")) {
+            throw new Error(`Astro CSP sources must be exact and cannot use ${source}`);
+        }
+        let parsed;
+        try {
+            parsed = new URL(normalized);
+        }
+        catch {
+            throw new Error(`Astro CSP sources must be exact HTTPS/WSS origins: ${source}`);
+        }
+        if ((parsed.protocol !== 'https:' && parsed.protocol !== 'wss:') ||
+            parsed.username !== '' ||
+            parsed.password !== '' ||
+            parsed.search !== '' ||
+            parsed.hash !== '' ||
+            (parsed.pathname !== '' && parsed.pathname !== '/')) {
+            throw new Error(`Astro CSP sources must be exact HTTPS/WSS origins: ${source}`);
+        }
+        return parsed.origin;
+    });
+}
 export function buildContentSecurityPolicy(input) {
     const options = typeof input === 'string' ? { nonce: input } : (input ?? {});
     const scriptSources = ["'self'"];

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACxC,yBAAyB;IACzB,2BAA2B;IAC3B,4BAA4B;IAC5B,8BAA8B;IAC9B,iBAAiB;IACjB,wBAAwB;IACxB,iBAAiB;IACjB,oBAAoB;CACX,CAAA;AAkCV,MAAM,UAAU,6BAA6B,CAC5C,OAA4B;IAE5B,MAAM,OAAO,GAA2B;QACvC,yBAAyB,EAAE,0BAA0B,CAAC;YACrD,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,YAAY;YAC/B,QAAQ,EAAE,OAAO,CAAC,WAAW;SAC7B,CAAC;QACF,2BAA2B,EAAE,4BAA4B,CAAC,OAAO,CAAC,uBAAuB,CAAC;QAC1F,4BAA4B,EAAE,OAAO,CAAC,uBAAuB,IAAI,aAAa;QAC9E,8BAA8B,EAAE,OAAO,CAAC,yBAAyB,IAAI,aAAa;QAClF,iBAAiB,EAAE,MAAM;QACzB,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,iCAAiC;QACpD,oBAAoB,EACnB,8FAA8F;QAC/F,eAAe,EAAE,iBAAiB,CAAC,OAAO,CAAC;KAC3C,CAAA;IAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,eAAe,0CAA0C,CAAA;IACrF,CAAC;IAED,OAAO,OAAO,CAAA;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAA6C;IACvF,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IAC5E,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,CAAA;IAChC,MAAM,YAAY,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC/B,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,aAAa,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,KAAK,GAAG,CAAC,CAAA;QAC9C,YAAY,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,KAAK,GAAG,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,UAAU,GAAG;QAClB,oBAAoB;QACpB,cAAc,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACvC,aAAa,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrC,6BAA6B;QAC7B,uBAAuB;QACvB,2BAA2B;QAC3B,mBAAmB;QACnB,iBAAiB;QACjB,wBAAwB;QACxB,2BAA2B;KAC3B,CAAA;IACD,IAAI,OAAO,CAAC,QAAQ;QAAE,UAAU,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IACtE,IAAI,OAAO,CAAC,SAAS;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAEzE,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,UAA0C,EAAE;IACxF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAA;IACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,QAAQ,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACd,yFAAyF,CACzF,CAAA;IACF,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,WAAW,aAAa,EAAE,CAAC,CAAA;IAC/C,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC5E,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACxD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAsB;IAC7E,IAAI,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,mBAAmB,CAAA;IAC3D,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,oEAAoE,CAAA;IAC5E,CAAC;IACD,OAAO,+DAA+D,CAAA;AACvE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA8B;IAC9D,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,UAAU,GAA2B,EAAE,CAAA;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,UAAU,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC5D,MAAM,UAAU,GAA6B,EAAE,CAAA;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;QAC5E,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAA;QAC/E,CAAC;IACF,CAAC;IAED,OAAO,UAAU,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAkB;IACnD,OAAO,CACN,QAAQ,KAAK,YAAY;QACzB,QAAQ,KAAK,QAAQ;QACrB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,SAAS,CACtB,CAAA;AACF,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AACA,OAAO,EAIN,mCAAmC,GAEnC,MAAM,aAAa,CAAA;AAEpB,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACxC,yBAAyB;IACzB,2BAA2B;IAC3B,4BAA4B;IAC5B,8BAA8B;IAC9B,iBAAiB;IACjB,wBAAwB;IACxB,iBAAiB;IACjB,oBAAoB;CACX,CAAA;AAgEV,MAAM,UAAU,6BAA6B,CAC5C,OAA4B;IAE5B,MAAM,OAAO,GAA2B;QACvC,2BAA2B,EAAE,4BAA4B,CAAC,OAAO,CAAC,uBAAuB,CAAC;QAC1F,4BAA4B,EAAE,OAAO,CAAC,uBAAuB,IAAI,aAAa;QAC9E,8BAA8B,EAAE,OAAO,CAAC,yBAAyB,IAAI,aAAa;QAClF,iBAAiB,EAAE,MAAM;QACzB,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,iCAAiC;QACpD,oBAAoB,EACnB,8FAA8F;QAC/F,eAAe,EAAE,iBAAiB,CAAC,OAAO,CAAC;KAC3C,CAAA;IACD,IAAI,OAAO,CAAC,qBAAqB,KAAK,KAAK,EAAE,CAAC;QAC7C,OAAO,CAAC,yBAAyB,CAAC,GAAG,0BAA0B,CAC9D,OAAO,CAAC,qBAAqB,IAAI;YAChC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,YAAY;YAC/B,QAAQ,EAAE,OAAO,CAAC,WAAW;SAC7B,CACD,CAAA;IACF,CAAC;IAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,eAAe,0CAA0C,CAAA;IACrF,CAAC;IAED,OAAO,OAAO,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAiC,EAAE;IACtE,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB;QAC1D,CAAC,CAAC,mCAAmC,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC;QAC1E,CAAC,CAAC,SAAS,CAAA;IACZ,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAC5D,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACtD,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACxD,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IAC9D,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAC1D,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAE1D,OAAO;QACN,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE;YACX,oBAAoB;YACpB,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC;YACpE,YAAY,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC;YAC7D,YAAY,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,GAAG,cAAc,CAAC,CAAC;YAC1D,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,CAAC;YAC/D,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,CAAC;YACtD,mBAAmB;YACnB,iBAAiB;YACjB,wBAAwB;YACxB,oBAAoB;YACpB,2BAA2B;SAC3B;QACD,eAAe,EAAE;YAChB,SAAS,EAAE,gBAAgB,CAAC,CAAC,QAAQ,EAAE,GAAG,aAAa,CAAC,CAAC;SACzD;QACD,cAAc,EAAE;YACf,SAAS,EAAE,qBAAqB;gBAC/B,CAAC,CAAC;oBACA,GAAG,gBAAgB,CAAC,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;wBACnE,QAAQ;wBACR,IAAI,EAAE,SAAkB;qBACxB,CAAC,CAAC;oBACH,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAoB,EAAE;iBAC3D;gBACF,CAAC,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,CAAC;SAChD;KAC8B,CAAA;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA0B;IACnD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;AAC7B,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,OAA0B;IAC7D,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAuB,CAAA;AACzE,CAAC;AAED,SAAS,eAAe,CAAC,OAAsC;IAC9D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;QAChC,IAAI,UAAU,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAA;QAC9C,IACC,UAAU,KAAK,EAAE;YACjB,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;YACxB,UAAU,KAAK,QAAQ;YACvB,UAAU,KAAK,OAAO;YACtB,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,EAChC,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,EAAE,CAAC,CAAA;QAC5E,CAAC;QAED,IAAI,MAAW,CAAA;QACf,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;QAC7B,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,EAAE,CAAC,CAAA;QAChF,CAAC;QACD,IACC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC;YAC5D,MAAM,CAAC,QAAQ,KAAK,EAAE;YACtB,MAAM,CAAC,QAAQ,KAAK,EAAE;YACtB,MAAM,CAAC,MAAM,KAAK,EAAE;YACpB,MAAM,CAAC,IAAI,KAAK,EAAE;YAClB,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,EAClD,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,EAAE,CAAC,CAAA;QAChF,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAA;IACrB,CAAC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAA6C;IACvF,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IAC5E,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,CAAA;IAChC,MAAM,YAAY,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC/B,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,aAAa,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,KAAK,GAAG,CAAC,CAAA;QAC9C,YAAY,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,KAAK,GAAG,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM,UAAU,GAAG;QAClB,oBAAoB;QACpB,cAAc,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACvC,aAAa,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrC,6BAA6B;QAC7B,uBAAuB;QACvB,2BAA2B;QAC3B,mBAAmB;QACnB,iBAAiB;QACjB,wBAAwB;QACxB,2BAA2B;KAC3B,CAAA;IACD,IAAI,OAAO,CAAC,QAAQ;QAAE,UAAU,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IACtE,IAAI,OAAO,CAAC,SAAS;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAEzE,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,UAA0C,EAAE;IACxF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAA;IACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,QAAQ,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACd,yFAAyF,CACzF,CAAA;IACF,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,WAAW,aAAa,EAAE,CAAC,CAAA;IAC/C,IAAI,OAAO,CAAC,iBAAiB,KAAK,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC5E,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACxD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAsB;IAC7E,IAAI,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,mBAAmB,CAAA;IAC3D,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,oEAAoE,CAAA;IAC5E,CAAC;IACD,OAAO,+DAA+D,CAAA;AACvE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA8B;IAC9D,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,UAAU,GAA2B,EAAE,CAAA;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,UAAU,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC5D,MAAM,UAAU,GAA6B,EAAE,CAAA;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;QAC5E,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAA;QAC/E,CAAC;IACF,CAAC;IAED,OAAO,UAAU,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAkB;IACnD,OAAO,CACN,QAAQ,KAAK,YAAY;QACzB,QAAQ,KAAK,QAAQ;QACrB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,SAAS,CACtB,CAAA;AACF,CAAC"}

package/dist/runner.js

@@ -75,7 +75,8 @@ function checkSecurityHeaders(fixture, html) {
     const headerEntries = collectHeaders(fixture.response.headers);
     const headers = normalizeHeaders(fixture.response.headers);
     const findings = [];
-    const missingSecurityHeaders = REQUIRED_SECURITY_HEADERS.filter((name) => {
+    const requiredSecurityHeaders = REQUIRED_SECURITY_HEADERS.filter((name) => name !== 'x-frame-options' || fixture.expected.framePolicy.legacyHeader !== 'omit');
+    const missingSecurityHeaders = requiredSecurityHeaders.filter((name) => {
         const values = headerEntries[name] ?? [];
         return !values.some((value) => value.trim().length > 0);
     });
@@ -116,7 +117,30 @@ function checkSecurityHeaders(fixture, html) {
     }
     const csp = headers['content-security-policy'];
     if (csp)
-        findings.push(...validateContentSecurityPolicy(csp, html));
+        findings.push(...validateContentSecurityPolicy(csp, html, fixture));
+    const xFrameOptions = headers['x-frame-options'];
+    const expectedLegacyFrameHeader = fixture.expected.framePolicy.legacyHeader;
+    if (expectedLegacyFrameHeader === 'omit' && xFrameOptions) {
+        findings.push({
+            code: 'security.frame_legacy_conflict',
+            severity: 'error',
+            message: 'X-Frame-Options conflicts with the declared embeddable frame-ancestors policy.',
+            path: 'response.headers.x-frame-options',
+            evidence: xFrameOptions,
+            remediation: 'Omit the legacy header only on the explicitly declared embeddable route and retain the exact CSP frame-ancestors directive.',
+        });
+    }
+    else if (expectedLegacyFrameHeader !== 'omit' &&
+        xFrameOptions &&
+        xFrameOptions.toUpperCase() !== expectedLegacyFrameHeader) {
+        findings.push({
+            code: 'security.header.invalid',
+            severity: 'error',
+            message: `X-Frame-Options must be ${expectedLegacyFrameHeader} for this response class.`,
+            path: 'response.headers.x-frame-options',
+            evidence: xFrameOptions,
+        });
+    }
     const coop = headers['cross-origin-opener-policy'];
     if (coop && !VALID_COOP_VALUES.has(coop.toLowerCase())) {
         findings.push({
@@ -310,10 +334,30 @@ function checkSecurityReceipts(fixture) {
     }
     return receipt('security-receipts', findings);
 }
-function validateContentSecurityPolicy(csp, html) {
+function validateContentSecurityPolicy(csp, html, fixture) {
     const findings = [];
     const { directives, findings: parseFindings } = parseContentSecurityPolicy(csp);
     findings.push(...parseFindings);
+    const frameAncestors = directives.get('frame-ancestors');
+    const expectedFrameAncestors = fixture.expected.framePolicy.ancestors;
+    if (!frameAncestors) {
+        findings.push({
+            code: 'security.csp.frame_ancestors_missing',
+            severity: 'error',
+            message: 'Content-Security-Policy must declare frame-ancestors.',
+            path: 'response.headers.content-security-policy.frame-ancestors',
+        });
+    }
+    else if (normalizeCspSources(frameAncestors.sources) !== normalizeCspSources(expectedFrameAncestors)) {
+        findings.push({
+            code: 'security.csp.frame_ancestors_mismatch',
+            severity: 'error',
+            message: 'Content-Security-Policy frame-ancestors does not match the declared response class.',
+            path: 'response.headers.content-security-policy.frame-ancestors',
+            evidence: frameAncestors.raw,
+            remediation: 'Emit only the exact declared frame ancestors and keep embeddable routes explicitly bounded.',
+        });
+    }
     const defaultSources = lowerSources(directives.get('default-src')?.sources ?? []);
     if (defaultSources.includes('*')) {
         findings.push({
@@ -345,6 +389,32 @@ function validateContentSecurityPolicy(csp, html) {
         if (!directive)
             continue;
         if (lowerSources(directive.sources).includes("'unsafe-inline'")) {
+            if (directiveName === 'style-src-attr') {
+                const inventory = fixture.securityReceipts.inlineStyleAttributes;
+                if (!inventory) {
+                    findings.push({
+                        code: 'security.csp.style_attr_inline_inventory_missing',
+                        severity: 'error',
+                        message: "style-src-attr 'unsafe-inline' requires a commit-bound inline-style-attribute inventory receipt.",
+                        path: 'securityReceipts.inlineStyleAttributes',
+                        evidence: directive.raw,
+                        remediation: 'Remove the allowance or attach the exact consumer commit SHA, positive occurrence count, and scan evidence.',
+                    });
+                    continue;
+                }
+                if (!fixture.buildEvidence?.commitSha ||
+                    fixture.buildEvidence.commitSha !== inventory.commitSha) {
+                    findings.push({
+                        code: 'security.csp.style_attr_inline_inventory_stale',
+                        severity: 'error',
+                        message: 'The inline-style-attribute inventory must match the exact commit in build evidence.',
+                        path: 'securityReceipts.inlineStyleAttributes.commitSha',
+                        evidence: `inventory=${inventory.commitSha}; build=${fixture.buildEvidence?.commitSha ?? 'missing'}`,
+                        remediation: 'Rescan the exact build commit before retaining the style attribute allowance.',
+                    });
+                }
+                continue;
+            }
             findings.push({
                 code: 'security.csp.unsafe_inline',
                 severity: 'error',
@@ -437,7 +507,7 @@ function inlineExecutableScriptAllowed(script, sources) {
     return sources.some((source) => hashSourceMatchesInlineScript(source, script.content));
 }
 function hashSourceMatchesInlineScript(source, content) {
-    const match = /^'(sha256|sha384|sha512)-([^']+)'$/i.exec(source);
+    const match = /^'(sha256|sha384|sha512)-([^']+)'$/.exec(source);
     if (!match)
         return false;
     const algorithm = match[1]?.toLowerCase();