@rimelight/security 0.0.5 → 0.0.6

package/dist/config/index.d.mts

@@ -0,0 +1,48 @@
+import { AstroUserConfig } from "astro";
+//#region src/config/security.d.ts
+type AstroSecurityConfig = NonNullable<AstroUserConfig["security"]>;
+type AstroCspConfig = Exclude<NonNullable<AstroSecurityConfig["csp"]>, boolean>;
+interface SecurityConfigOptions {
+  /**
+   * The base domain name for this project (e.g., "starter.rimelight.com") used to autoconfigure
+   * standard allowedDomains and img-src CDN targets.
+   */
+  domain: string;
+  /**
+   * Additional Allowed Domains (appended to the default wildcard subdomains of `domain`)
+   */
+  allowedDomains?: AstroSecurityConfig["allowedDomains"];
+  /**
+   * Additional sources to allow for img-src directive
+   */
+  imgSrc?: string[];
+  /**
+   * Additional sources to allow for connect-src directive
+   */
+  connectSrc?: string[];
+  /**
+   * Additional sources to allow for frame-src directive
+   */
+  frameSrc?: string[];
+  /**
+   * Additional script resources
+   */
+  scriptResources?: string[];
+  /**
+   * Additional style resources
+   */
+  styleResources?: string[];
+  /**
+   * Enables the 'require-trusted-types-for' directive
+   */
+  trustedTypes?: boolean;
+  /**
+   * Direct overrides for any security config fields
+   */
+  overrides?: Partial<Omit<AstroSecurityConfig, "csp">> & {
+    csp?: Partial<AstroCspConfig>;
+  };
+}
+declare function defineSecurity(options: SecurityConfigOptions): AstroSecurityConfig;
+//#endregion
+export { AstroCspConfig, AstroSecurityConfig, SecurityConfigOptions, defineSecurity };

package/dist/config/index.mjs

@@ -0,0 +1,109 @@
+//#region src/config/security.ts
+const normalizeDirective = (input) => {
+	if (!input) return [];
+	if (Array.isArray(input)) return input.map((item) => {
+		if (typeof item === "string") return {
+			resource: item,
+			kind: "element"
+		};
+		return item;
+	});
+	if (typeof input === "object" && "resources" in input && Array.isArray(input.resources)) return input.resources.map((res) => ({
+		resource: res,
+		kind: "element"
+	}));
+	return [];
+};
+function mergeDirective(current, incoming) {
+	if (!current && !incoming) return void 0;
+	const currentNormalized = normalizeDirective(current);
+	const incomingNormalized = normalizeDirective(incoming);
+	const mergedMap = /* @__PURE__ */ new Map();
+	for (const item of [...currentNormalized, ...incomingNormalized]) {
+		const key = `${item.resource}::${item.kind || "element"}`;
+		mergedMap.set(key, item);
+	}
+	const mergedList = Array.from(mergedMap.values());
+	if (!Array.isArray(current) && !Array.isArray(incoming) && current && typeof current === "object" && incoming && typeof incoming === "object" && !("length" in current) && !("length" in incoming)) return { resources: mergedList.map((item) => item.resource) };
+	return mergedList;
+}
+function defineSecurity(options) {
+	const { domain, overrides } = options;
+	const allowedDomains = [{
+		hostname: `**.${domain}`,
+		protocol: "https"
+	}, ...options.allowedDomains || []];
+	const imgSources = Array.from(/* @__PURE__ */ new Set([
+		"'self'",
+		"data:",
+		`https://cdn.${domain}`,
+		"https://i3.ytimg.com",
+		"https://www.youtube.com",
+		"https://www.youtube-nocookie.com",
+		...options.imgSrc || []
+	]));
+	const connectSources = Array.from(/* @__PURE__ */ new Set([
+		"'self'",
+		"https://cloudflareinsights.com",
+		...options.connectSrc || []
+	]));
+	const frameSources = Array.from(/* @__PURE__ */ new Set([
+		"https://www.youtube.com",
+		"https://www.youtube-nocookie.com",
+		...options.frameSrc || []
+	]));
+	const baseDirectives = [
+		"default-src 'none'",
+		`img-src ${imgSources.join(" ")}`,
+		"font-src 'self'",
+		`connect-src ${connectSources.join(" ")}`,
+		"frame-ancestors 'none'",
+		`frame-src ${frameSources.join(" ")}`,
+		"upgrade-insecure-requests",
+		"base-uri 'self'",
+		"form-action 'self'",
+		"object-src 'none'",
+		"manifest-src 'self'",
+		...options.trustedTypes ? ["require-trusted-types-for 'script'"] : []
+	];
+	const scriptResources = Array.from(/* @__PURE__ */ new Set([
+		"'self'",
+		"https://static.cloudflareinsights.com",
+		"https://betterlytics.io/analytics.js",
+		"'inline-speculation-rules'",
+		"'sha256-ZuMSxilKU+4KIM8LWna4lqBEKzd6WaiAjz6gamhm7zM='",
+		...options.scriptResources || []
+	]));
+	const styleResources = Array.from(/* @__PURE__ */ new Set([
+		"'self'",
+		"'sha256-SKuaOGnks7NAUq37nvw1PfGEE0lOAs5ERbiYRbGFIbw='",
+		...options.styleResources || []
+	]));
+	const securityConfig = {
+		checkOrigin: true,
+		allowedDomains,
+		csp: {
+			algorithm: "SHA-384",
+			directives: baseDirectives,
+			scriptDirective: { resources: scriptResources },
+			styleDirective: { resources: styleResources }
+		}
+	};
+	if (overrides) {
+		const { csp, ...restOverrides } = overrides;
+		Object.assign(securityConfig, restOverrides);
+		if (csp && typeof securityConfig.csp === "object" && securityConfig.csp !== null) {
+			const currentCsp = securityConfig.csp;
+			const mergedCsp = {
+				...currentCsp,
+				...csp
+			};
+			if (csp.scriptDirective || currentCsp.scriptDirective) mergedCsp.scriptDirective = mergeDirective(currentCsp.scriptDirective, csp.scriptDirective);
+			if (csp.styleDirective || currentCsp.styleDirective) mergedCsp.styleDirective = mergeDirective(currentCsp.styleDirective, csp.styleDirective);
+			securityConfig.csp = mergedCsp;
+		}
+	}
+	return securityConfig;
+}
+//#endregion
+export { defineSecurity };

package/dist/integrations/index.d.mts

@@ -0,0 +1,9 @@
+import { AstroIntegration } from "astro";
+//#region src/integrations/sri.d.ts
+/**
+ * Astro SRI Integration Fetches external scripts at build-time and generates hashes for the SSR
+ * middleware.
+ */
+declare function sri(): AstroIntegration;
+//#endregion
+export { sri };

package/dist/integrations/index.mjs

@@ -0,0 +1,81 @@
+import { createHash } from "node:crypto";
+//#region src/integrations/sri.ts
+function assertSRIConfig(obj) {
+	if (!obj || typeof obj !== "object") throw new Error("Expected config");
+}
+/**
+* Astro SRI Integration Fetches external scripts at build-time and generates hashes for the SSR
+* middleware.
+*/
+function sri() {
+	const sriManifest = {};
+	return {
+		name: "@rimelight/security",
+		hooks: { "astro:config:setup": async ({ updateConfig, config, command, logger }) => {
+			if (command === "dev") logger.info("Skipping SRI discovery in development mode.");
+			else {
+				assertSRIConfig(config);
+				const security = config.security;
+				const externalUrls = [];
+				if (security?.csp?.scriptDirective?.resources) {
+					for (const resource of security.csp.scriptDirective.resources) if (resource.startsWith("https://")) try {
+						const parsed = new URL(resource);
+						if (parsed.hostname.includes("*")) continue;
+						const path = parsed.pathname;
+						if (path === "/" || path === "" || path.endsWith("/")) continue;
+						externalUrls.push(resource);
+					} catch {}
+				}
+				if (externalUrls.length > 0) {
+					const results = await Promise.all(externalUrls.map(async (url) => {
+						try {
+							const response = await fetch(url);
+							if (!response.ok) throw new Error(`HTTP ${response.status}`);
+							const buffer = await response.arrayBuffer();
+							const hash = createHash("sha384").update(Buffer.from(buffer)).digest("base64");
+							sriManifest[url] = `sha384-${hash}`;
+							return {
+								url,
+								success: true
+							};
+						} catch (err) {
+							return {
+								url,
+								success: false,
+								error: err instanceof Error ? err.message : String(err)
+							};
+						}
+					}));
+					const succeeded = results.filter((r) => r.success).map((r) => r.url);
+					const failed = results.filter((r) => !r.success);
+					if (failed.length === 0) logger.info(`SRI Discovery: successfully hashed ${succeeded.length} external resource(s).\n      Succeeded:\n` + succeeded.map((url) => `      - ${url}`).join("\n"));
+					else {
+						const succeededBlock = succeeded.length > 0 ? `      Succeeded:\n` + succeeded.map((url) => `      - ${url}`).join("\n") : "";
+						const failedBlock = `      Failed:\n` + failed.map((f) => `      - ${f.url} (${f.error})`).join("\n");
+						const parts = [
+							`SRI Discovery: hashed ${succeeded.length}/${results.length} external resource(s).`,
+							succeededBlock,
+							failedBlock
+						].filter(Boolean);
+						logger.warn(parts.join("\n\n"));
+					}
+				} else logger.info("SRI Discovery: no external resources found to hash.");
+			}
+			const virtualModuleId = "virtual:sri-manifest";
+			const resolvedVirtualModuleId = "\0" + virtualModuleId;
+			updateConfig({ vite: { plugins: [{
+				name: "vite-plugin-sri-manifest",
+				resolveId(id) {
+					if (id === virtualModuleId) return resolvedVirtualModuleId;
+					return null;
+				},
+				load(id) {
+					if (id === resolvedVirtualModuleId) return `export const manifest = ${JSON.stringify(sriManifest)};`;
+					return null;
+				}
+			}] } });
+		} }
+	};
+}
+//#endregion
+export { sri };

package/{src/middleware/dev-only.ts → dist/middleware/index.d.mts}

@@ -1,3 +1,10 @@
+//#region src/middleware/security.d.ts
+/**
+ * Security Middleware: Injects SRI integrity attributes and security headers.
+ */
+declare const security: import("astro").MiddlewareHandler;
+//#endregion
+//#region src/middleware/dev-only.d.ts
 /**
  * Hono middleware that blocks any path containing `/dev/` in non-development environments. Mount
  * this early in your Hono app (before API routes and Astro pages) so it covers both `/dev/` page
@@ -8,9 +15,6 @@
  *   import { devOnly } from "@rimelight/security/middleware"
  *   app.use(devOnly)
  */
-export const devOnly = async (c: any, next: any): Promise<Response> => {
-  if (!import.meta.env.DEV && c.req.path.includes("/dev/")) {
-    return c.notFound()
-  }
-  return next()
-}
+declare const devOnly: (c: any, next: any) => Promise<Response>;
+//#endregion
+export { devOnly, security };

package/dist/middleware/index.mjs

@@ -0,0 +1,149 @@
+import { defineMiddleware } from "astro:middleware";
+import { manifest } from "virtual:sri-manifest";
+//#region src/middleware/security.ts
+function isManifestRecord(obj) {
+	return typeof obj === "object" && obj !== null && !Array.isArray(obj);
+}
+const manifest$1 = isManifestRecord(manifest) ? manifest : {};
+function assertManifest(obj) {
+	if (!obj || typeof obj !== "object") throw new Error("Expected manifest");
+}
+assertManifest(manifest$1);
+const manifestRegexes = Object.entries(manifest$1).map(([url, hash]) => ({
+	hash,
+	scriptRegex: new RegExp(`(<script[^>]+src=["']${url}["'][^>]*)(/?>)`, "g"),
+	linkRegex: new RegExp(`(<link[^>]+href=["']${url}["'][^>]*)(/?>)`, "g")
+}));
+function addSecurityHeaders(response, origin) {
+	try {
+		response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+		response.headers.set("X-Content-Type-Options", "nosniff");
+		response.headers.set("X-Frame-Options", "DENY");
+		response.headers.set("Cross-Origin-Resource-Policy", "same-origin");
+		response.headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
+		response.headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=(), usb=()");
+		response.headers.set("No-Vary-Search", "except=(\"q\" \"search\" \"locale\"), params=?1");
+		if (origin) response.headers.set("Link", [
+			`<${origin}/sitemap-index.xml>; rel="sitemap"`,
+			`<${origin}/llms.txt>; rel="llms"`,
+			`<${origin}/.well-known/api-catalog>; rel="api-catalog"`,
+			`<${origin}/rss.xml>; rel="alternate"; type="application/rss+xml"`
+		].join(", "));
+		return response;
+	} catch {
+		const headers = new Headers(response.headers);
+		headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+		headers.set("X-Content-Type-Options", "nosniff");
+		headers.set("X-Frame-Options", "DENY");
+		headers.set("Cross-Origin-Resource-Policy", "same-origin");
+		headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
+		headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=(), usb=()");
+		headers.set("No-Vary-Search", "except=(\"q\" \"search\" \"locale\"), params=?1");
+		if (origin) headers.set("Link", [
+			`<${origin}/sitemap-index.xml>; rel="sitemap"`,
+			`<${origin}/llms.txt>; rel="llms"`,
+			`<${origin}/.well-known/api-catalog>; rel="api-catalog"`,
+			`<${origin}/rss.xml>; rel="alternate"; type="application/rss+xml"`
+		].join(", "));
+		return new Response(response.body, {
+			status: response.status,
+			statusText: response.statusText,
+			headers
+		});
+	}
+}
+/**
+* Security Middleware: Injects SRI integrity attributes and security headers.
+*/
+const security = defineMiddleware(async (context, next) => {
+	const isProd = import.meta.env.PROD;
+	const isDev = import.meta.env.DEV;
+	const proto = context.request.headers.get("x-forwarded-proto");
+	if (isProd && proto === "http") {
+		const httpsUrl = context.request.url.replace(/^http:/, "https:");
+		return Response.redirect(httpsUrl, 301);
+	}
+	const response = await next();
+	if (!(response.headers.get("content-type") || "").includes("text/html")) return addSecurityHeaders(response, context.url.origin);
+	if (isDev) {
+		const cleanHeaders = new Headers(response.headers);
+		cleanHeaders.delete("content-security-policy");
+		let modifiedHtml = await response.text();
+		modifiedHtml = modifiedHtml.replace(/<meta\s[^>]*http-equiv\s*=\s*["']?content-security-policy[^>]*>/gi, "");
+		return addSecurityHeaders(new Response(modifiedHtml, {
+			status: response.status,
+			statusText: response.statusText,
+			headers: cleanHeaders
+		}), context.url.origin);
+	}
+	const nonce = crypto.randomUUID().replace(/-/g, "");
+	let cspHeader = response.headers.get("content-security-policy");
+	const newHeaders = new Headers(response.headers);
+	if (cspHeader) {
+		cspHeader = cspHeader.replace(/&#0*39;/g, "'").replace(/&#x0*27;/gi, "'").replace(/&quot;/g, "\"").replace(/&amp;/g, "&");
+		cspHeader = cspHeader.replace(/(script-src\s)/i, `$1'nonce-${nonce}' `);
+		newHeaders.set("content-security-policy", cspHeader);
+	}
+	if (typeof HTMLRewriter !== "undefined") {
+		let rewriter = new HTMLRewriter();
+		if (manifestRegexes.length > 0) rewriter = rewriter.on("script[src]", { element(el) {
+			const src = el.getAttribute("src");
+			if (src && manifest$1[src]) {
+				el.setAttribute("integrity", manifest$1[src]);
+				el.setAttribute("crossorigin", "anonymous");
+			}
+		} }).on("link[rel=\"stylesheet\"][href]", { element(el) {
+			const href = el.getAttribute("href");
+			if (href && manifest$1[href]) {
+				el.setAttribute("integrity", manifest$1[href]);
+				el.setAttribute("crossorigin", "anonymous");
+			}
+		} });
+		rewriter = rewriter.on("script", { element(el) {
+			el.setAttribute("nonce", nonce);
+		} });
+		rewriter = rewriter.on("head", { element(el) {
+			el.append(`<meta name="csp-nonce" content="${nonce}">`, { html: true });
+		} });
+		rewriter = rewriter.on("meta[http-equiv=\"content-security-policy\" i]", { element(el) {
+			el.remove();
+		} });
+		return addSecurityHeaders(rewriter.transform(new Response(response.body, {
+			status: response.status,
+			statusText: response.statusText,
+			headers: newHeaders
+		})), context.url.origin);
+	}
+	let modifiedHtml = await response.text();
+	modifiedHtml = modifiedHtml.replace(/<meta\s[^>]*http-equiv\s*=\s*["']?content-security-policy[^>]*>/gi, "");
+	modifiedHtml = modifiedHtml.replace(/(<head(?:\s[^>]*)?>)/i, `$1<meta name="csp-nonce" content="${nonce}">`);
+	modifiedHtml = modifiedHtml.replace(/<script(\s[^>]*)?>/gi, (_match, attrs = "") => `<script${attrs} nonce="${nonce}">`);
+	for (const { hash, scriptRegex, linkRegex } of manifestRegexes) {
+		if (!hash) continue;
+		modifiedHtml = modifiedHtml.replace(scriptRegex, `$1 integrity="${hash}" crossorigin="anonymous"$2`);
+		modifiedHtml = modifiedHtml.replace(linkRegex, `$1 integrity="${hash}" crossorigin="anonymous"$2`);
+	}
+	return addSecurityHeaders(new Response(modifiedHtml, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: newHeaders
+	}), context.url.origin);
+});
+//#endregion
+//#region src/middleware/dev-only.ts
+/**
+* Hono middleware that blocks any path containing `/dev/` in non-development environments. Mount
+* this early in your Hono app (before API routes and Astro pages) so it covers both `/dev/` page
+* routes and `/api/dev/` API routes in a single place.
+*
+* @example
+*   // fetch.ts
+*   import { devOnly } from "@rimelight/security/middleware"
+*   app.use(devOnly)
+*/
+const devOnly = async (c, next) => {
+	if (!import.meta.env.DEV && c.req.path.includes("/dev/")) return c.notFound();
+	return next();
+};
+//#endregion
+export { devOnly, security };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rimelight/security",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "private": false,
   "description": "Rimelight Entertainment's Security Package",
   "homepage": "https://rimelight.com/docs",
@@ -16,13 +16,23 @@
     "url": "git+https://github.com/Rimelight-Entertainment/rimelight.git"
   },
   "files": [
-    "src"
+    "dist",
+    "src/components"
   ],
   "type": "module",
   "exports": {
-    ".": "./src/integrations/index.ts",
-    "./middleware": "./src/middleware/index.ts",
-    "./config": "./src/config/index.ts",
+    ".": {
+      "types": "./dist/integrations/index.d.mts",
+      "import": "./dist/integrations/index.mjs"
+    },
+    "./middleware": {
+      "types": "./dist/middleware/index.d.mts",
+      "import": "./dist/middleware/index.mjs"
+    },
+    "./config": {
+      "types": "./dist/config/index.d.mts",
+      "import": "./dist/config/index.mjs"
+    },
     "./*": "./src/*"
   },
   "publishConfig": {
@@ -30,8 +40,8 @@
   },
   "devDependencies": {
     "@astrojs/check": "0.9.10",
-    "@rimelight/config": "0.0.3",
-    "astro": "7.2.7",
+    "@rimelight/config": "0.0.4",
+    "astro": "7.3.1",
     "typescript": "6.0.3"
   },
   "peerDependencies": {
@@ -41,6 +51,7 @@
     "node": ">=26.7.0"
   },
   "scripts": {
+    "build": "vp pack",
     "check": "vp check --fix && astro check"
   }
 }

package/src/components/SecurityHead.astro

@@ -10,11 +10,17 @@
   (function() {
     const w = window as any;
     if (w.trustedTypes && w.trustedTypes.createPolicy) {
-      w.trustedTypes.createPolicy('default', {
-        createHTML: function(input: string) { return input; },
-        createScript: function(input: string) { return input; },
-        createScriptURL: function(input: string) { return input; }
-      });
+      try {
+        if (!w.trustedTypes.defaultPolicy) {
+          w.trustedTypes.createPolicy('default', {
+            createHTML: function(input: string) { return input; },
+            createScript: function(input: string) { return input; },
+            createScriptURL: function(input: string) { return input; }
+          });
+        }
+      } catch {
+        // Policy already exists or cannot be created
+      }
     }
   })();
 </script>

package/src/config/index.ts

@@ -1 +0,0 @@
-export * from "./security"

package/src/config/security.ts

@@ -1,263 +0,0 @@
-import type { AstroUserConfig } from "astro"
-
-export type AstroSecurityConfig = NonNullable<AstroUserConfig["security"]>
-export type AstroCspConfig = Exclude<NonNullable<AstroSecurityConfig["csp"]>, boolean>
-
-export interface SecurityConfigOptions {
-  /**
-   * The base domain name for this project (e.g., "starter.rimelight.com") used to autoconfigure
-   * standard allowedDomains and img-src CDN targets.
-   */
-  domain: string
-  /**
-   * Additional Allowed Domains (appended to the default wildcard subdomains of `domain`)
-   */
-  allowedDomains?: AstroSecurityConfig["allowedDomains"]
-  /**
-   * Additional sources to allow for img-src directive
-   */
-  imgSrc?: string[]
-  /**
-   * Additional sources to allow for connect-src directive
-   */
-  connectSrc?: string[]
-  /**
-   * Additional sources to allow for frame-src directive
-   */
-  frameSrc?: string[]
-  /**
-   * Additional script resources
-   */
-  scriptResources?: string[]
-  /**
-   * Additional style resources
-   */
-  styleResources?: string[]
-  /**
-   * Enables the 'require-trusted-types-for' directive
-   */
-  trustedTypes?: boolean
-  /**
-   * Direct overrides for any security config fields
-   */
-  overrides?: Partial<Omit<AstroSecurityConfig, "csp">> & {
-    csp?: Partial<AstroCspConfig>
-  }
-}
-
-/**
- * Generates a standard, strictly configured Security/CSP object for Astro configurations with
- * support for easy customization and additions per project.
- *
- * @example
- *   ;```ts
- *   // Default returned shape:
- *   {
- *   checkOrigin: true,
- *   allowedDomains: [
- *   {
- *   hostname: "**.domain.com",
- *   protocol: "https"
- *   }
- *   ],
- *   csp: {
- *   algorithm: "SHA-384",
- *   directives: [
- *   "default-src 'none'",
- *   "img-src 'self' data: https://cdn.domain.com https://i3.ytimg.com https://www.youtube.com https://www.youtube-nocookie.com",
- *   "font-src 'self'",
- *   "connect-src 'self' https://cloudflareinsights.com",
- *   "frame-ancestors 'none'",
- *   "frame-src https://www.youtube.com https://www.youtube-nocookie.com",
- *   "upgrade-insecure-requests",
- *   "base-uri 'self'",
- *   "form-action 'self'"
- *   ],
- *   scriptDirective: {
- *   resources: [
- *   "'self'",
- *   "https://static.cloudflareinsights.com",
- *   "https://betterlytics.io/analytics.js",
- *   "'inline-speculation-rules'"
- *   ]
- *   },
- *   styleDirective: {
- *   resources: [
- *   "'self'",
- *   "'sha256-SKuaOGnks7NAUq37nvw1PfGEE0lOAs5ERbiYRbGFIbw='"
- *   ]
- *   }
- *   }
- *   }
- *   ```
- */
-type DirectiveItem = { resource: string; kind?: "element" | "attribute" }
-type DirectiveInput = string[] | DirectiveItem[] | { resources?: string[] } | null | undefined
-
-const normalizeDirective = (input: DirectiveInput): DirectiveItem[] => {
-  if (!input) return []
-  if (Array.isArray(input)) {
-    return input.map((item) => {
-      if (typeof item === "string") {
-        return { resource: item, kind: "element" }
-      }
-      return item
-    })
-  }
-  if (typeof input === "object" && "resources" in input && Array.isArray(input.resources)) {
-    return input.resources.map((res) => ({ resource: res, kind: "element" }))
-  }
-  return []
-}
-
-function mergeDirective(current: any, incoming: any): any {
-  if (!current && !incoming) return undefined
-
-  const currentNormalized = normalizeDirective(current)
-  const incomingNormalized = normalizeDirective(incoming)
-
-  const mergedMap = new Map<string, DirectiveItem>()
-  for (const item of [...currentNormalized, ...incomingNormalized]) {
-    const key = `${item.resource}::${item.kind || "element"}`
-    mergedMap.set(key, item)
-  }
-
-  const mergedList = Array.from(mergedMap.values())
-
-  const currentWasArray = Array.isArray(current)
-  const incomingWasArray = Array.isArray(incoming)
-
-  if (
-    !currentWasArray &&
-    !incomingWasArray &&
-    current &&
-    typeof current === "object" &&
-    incoming &&
-    typeof incoming === "object" &&
-    !("length" in current) &&
-    !("length" in incoming)
-  ) {
-    return {
-      resources: mergedList.map((item) => item.resource)
-    }
-  }
-
-  return mergedList
-}
-
-export function defineSecurity(options: SecurityConfigOptions): AstroSecurityConfig {
-  const { domain, overrides } = options
-  const domainWithWildcard = `**.${domain}`
-
-  // 1. Build default allowed domains
-  const allowedDomains = [
-    {
-      hostname: domainWithWildcard,
-      protocol: "https" as const
-    },
-    ...(options.allowedDomains || [])
-  ]
-
-  // 2. Build CSP directives
-  const imgSources = Array.from(
-    new Set([
-      "'self'",
-      "data:",
-      `https://cdn.${domain}`,
-      "https://i3.ytimg.com",
-      "https://www.youtube.com",
-      "https://www.youtube-nocookie.com",
-      ...(options.imgSrc || [])
-    ])
-  )
-
-  const connectSources = Array.from(
-    new Set(["'self'", "https://cloudflareinsights.com", ...(options.connectSrc || [])])
-  )
-
-  const frameSources = Array.from(
-    new Set([
-      "https://www.youtube.com",
-      "https://www.youtube-nocookie.com",
-      ...(options.frameSrc || [])
-    ])
-  )
-
-  const baseDirectives: AstroCspConfig["directives"] = [
-    "default-src 'none'",
-    `img-src ${imgSources.join(" ")}`,
-    "font-src 'self'",
-    `connect-src ${connectSources.join(" ")}`,
-    "frame-ancestors 'none'",
-    `frame-src ${frameSources.join(" ")}`,
-    "upgrade-insecure-requests",
-    "base-uri 'self'",
-    "form-action 'self'",
-    "object-src 'none'",
-    "manifest-src 'self'",
-    ...(options.trustedTypes ? ["require-trusted-types-for 'script'" as const] : [])
-  ]
-
-  // 3. Build script & style directives
-  const scriptResources = Array.from(
-    new Set([
-      "'self'",
-      "https://static.cloudflareinsights.com",
-      "https://betterlytics.io/analytics.js",
-      "'inline-speculation-rules'",
-      // Astro ClientRouter (View Transitions)
-      "'sha256-ZuMSxilKU+4KIM8LWna4lqBEKzd6WaiAjz6gamhm7zM='",
-      ...(options.scriptResources || [])
-    ])
-  )
-
-  const styleResources = Array.from(
-    new Set([
-      "'self'",
-      // Astro ClientRouter (View Transitions)
-      "'sha256-SKuaOGnks7NAUq37nvw1PfGEE0lOAs5ERbiYRbGFIbw='",
-      ...(options.styleResources || [])
-    ])
-  )
-
-  // 4. Build base SecurityConfig
-  const securityConfig: AstroSecurityConfig = {
-    checkOrigin: true,
-    allowedDomains,
-    csp: {
-      algorithm: "SHA-384",
-      directives: baseDirectives,
-      scriptDirective: {
-        resources: scriptResources
-      },
-      styleDirective: {
-        resources: styleResources
-      }
-    }
-  }
-
-  // 5. Merge overrides
-  if (overrides) {
-    const { csp, ...restOverrides } = overrides
-    Object.assign(securityConfig, restOverrides)
-    if (csp && typeof securityConfig.csp === "object" && securityConfig.csp !== null) {
-      const currentCsp = securityConfig.csp
-      const mergedCsp: AstroCspConfig = {
-        ...currentCsp,
-        ...csp
-      }
-
-      if (csp.scriptDirective || currentCsp.scriptDirective) {
-        mergedCsp.scriptDirective = mergeDirective(currentCsp.scriptDirective, csp.scriptDirective)
-      }
-
-      if (csp.styleDirective || currentCsp.styleDirective) {
-        mergedCsp.styleDirective = mergeDirective(currentCsp.styleDirective, csp.styleDirective)
-      }
-
-      securityConfig.csp = mergedCsp
-    }
-  }
-
-  return securityConfig
-}

package/src/integrations/index.ts

@@ -1 +0,0 @@
-export * from "./sri"

package/src/integrations/sri.ts

@@ -1,137 +0,0 @@
-import type { AstroIntegration } from "astro"
-import { createHash } from "node:crypto"
-
-interface SRIConfig {
-  security?: {
-    csp?: {
-      scriptDirective?: {
-        resources?: string[]
-      }
-    }
-  }
-}
-
-function assertSRIConfig(obj: unknown): asserts obj is SRIConfig {
-  if (!obj || typeof obj !== "object") throw new Error("Expected config")
-}
-
-/**
- * Astro SRI Integration Fetches external scripts at build-time and generates hashes for the SSR
- * middleware.
- */
-export function sri(): AstroIntegration {
-  const sriManifest: Record<string, string> = {}
-
-  return {
-    name: "@rimelight/security",
-    hooks: {
-      "astro:config:setup": async ({ updateConfig, config, command, logger }) => {
-        const isDev = command === "dev"
-
-        if (isDev) {
-          logger.info("Skipping SRI discovery in development mode.")
-        } else {
-          // 1. Identify External Scripts from CSP config
-          // We look into the custom 'security' block in astro.config.mjs
-          assertSRIConfig(config)
-
-          const security = config.security
-          const externalUrls: string[] = []
-
-          if (security?.csp?.scriptDirective?.resources) {
-            for (const resource of security.csp.scriptDirective.resources) {
-              if (resource.startsWith("https://")) {
-                try {
-                  const parsed = new URL(resource)
-                  // Skip wildcard domains
-                  if (parsed.hostname.includes("*")) continue
-
-                  // Skip root domains or directories (no actual script/style file)
-                  const path = parsed.pathname
-                  if (path === "/" || path === "" || path.endsWith("/")) continue
-
-                  externalUrls.push(resource)
-                } catch {
-                  // Skip invalid URLs
-                }
-              }
-            }
-          }
-
-          if (externalUrls.length > 0) {
-            // 2. Fetch and Hash External Scripts
-            const results = await Promise.all(
-              externalUrls.map(async (url) => {
-                try {
-                  const response = await fetch(url)
-                  if (!response.ok) throw new Error(`HTTP ${response.status}`)
-
-                  const buffer = await response.arrayBuffer()
-                  const hash = createHash("sha384").update(Buffer.from(buffer)).digest("base64")
-
-                  sriManifest[url] = `sha384-${hash}`
-                  return { url, success: true }
-                } catch (err: unknown) {
-                  const message = err instanceof Error ? err.message : String(err)
-                  return { url, success: false, error: message }
-                }
-              })
-            )
-
-            const succeeded = results.filter((r) => r.success).map((r) => r.url)
-            const failed = results.filter((r) => !r.success)
-
-            if (failed.length === 0) {
-              logger.info(
-                `SRI Discovery: successfully hashed ${succeeded.length} external resource(s).\n` +
-                  `      Succeeded:\n` +
-                  succeeded.map((url) => `      - ${url}`).join("\n")
-              )
-            } else {
-              const succeededBlock =
-                succeeded.length > 0
-                  ? `      Succeeded:\n` + succeeded.map((url) => `      - ${url}`).join("\n")
-                  : ""
-              const failedBlock =
-                `      Failed:\n` + failed.map((f) => `      - ${f.url} (${f.error})`).join("\n")
-
-              const parts = [
-                `SRI Discovery: hashed ${succeeded.length}/${results.length} external resource(s).`,
-                succeededBlock,
-                failedBlock
-              ].filter(Boolean)
-
-              logger.warn(parts.join("\n\n"))
-            }
-          } else {
-            logger.info("SRI Discovery: no external resources found to hash.")
-          }
-        }
-
-        // 3. Provide hashes to the runtime via Vite's virtual module
-        const virtualModuleId = "virtual:sri-manifest"
-        const resolvedVirtualModuleId = "\0" + virtualModuleId
-
-        updateConfig({
-          vite: {
-            plugins: [
-              {
-                name: "vite-plugin-sri-manifest",
-                resolveId(id: string) {
-                  if (id === virtualModuleId) return resolvedVirtualModuleId
-                  return null
-                },
-                load(id: string) {
-                  if (id === resolvedVirtualModuleId) {
-                    return `export const manifest = ${JSON.stringify(sriManifest)};`
-                  }
-                  return null
-                }
-              }
-            ]
-          }
-        })
-      }
-    }
-  }
-}

package/src/middleware/index.ts

@@ -1,2 +0,0 @@
-export * from "./security"
-export * from "./dev-only"

package/src/middleware/security.ts

@@ -1,250 +0,0 @@
-import type { APIContext, MiddlewareNext } from "astro"
-import { defineMiddleware } from "astro:middleware"
-
-// @ts-ignore virtual module resolved by SRI Vite plugin
-import { manifest as sriManifest } from "virtual:sri-manifest"
-
-function isManifestRecord(obj: unknown): obj is Record<string, string> {
-  return typeof obj === "object" && obj !== null && !Array.isArray(obj)
-}
-
-const manifest: Record<string, string> = isManifestRecord(sriManifest) ? sriManifest : {}
-
-declare const HTMLRewriter: any
-
-function assertManifest(obj: unknown): asserts obj is Record<string, string> {
-  if (!obj || typeof obj !== "object") throw new Error("Expected manifest")
-}
-
-// Assert and pre-compile regular expressions once at startup
-assertManifest(manifest)
-
-const manifestRegexes = Object.entries(manifest).map(([url, hash]) => ({
-  hash,
-  scriptRegex: new RegExp(`(<script[^>]+src=["']${url}["'][^>]*)(/?>)`, "g"),
-  linkRegex: new RegExp(`(<link[^>]+href=["']${url}["'][^>]*)(/?>)`, "g")
-}))
-
-function addSecurityHeaders(response: Response, origin?: string): Response {
-  try {
-    response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin")
-    response.headers.set("X-Content-Type-Options", "nosniff")
-    response.headers.set("X-Frame-Options", "DENY")
-    response.headers.set("Cross-Origin-Resource-Policy", "same-origin")
-    response.headers.set(
-      "Strict-Transport-Security",
-      "max-age=31536000; includeSubDomains; preload"
-    )
-    response.headers.set(
-      "Permissions-Policy",
-      "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
-    )
-    response.headers.set("No-Vary-Search", 'except=("q" "search" "locale"), params=?1')
-    if (origin) {
-      response.headers.set(
-        "Link",
-        [
-          `<${origin}/sitemap-index.xml>; rel="sitemap"`,
-          `<${origin}/llms.txt>; rel="llms"`,
-          `<${origin}/.well-known/api-catalog>; rel="api-catalog"`,
-          `<${origin}/rss.xml>; rel="alternate"; type="application/rss+xml"`
-        ].join(", ")
-      )
-    }
-    return response
-  } catch {
-    const headers = new Headers(response.headers)
-    headers.set("Referrer-Policy", "strict-origin-when-cross-origin")
-    headers.set("X-Content-Type-Options", "nosniff")
-    headers.set("X-Frame-Options", "DENY")
-    headers.set("Cross-Origin-Resource-Policy", "same-origin")
-    headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")
-    headers.set(
-      "Permissions-Policy",
-      "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
-    )
-    headers.set("No-Vary-Search", 'except=("q" "search" "locale"), params=?1')
-    if (origin) {
-      headers.set(
-        "Link",
-        [
-          `<${origin}/sitemap-index.xml>; rel="sitemap"`,
-          `<${origin}/llms.txt>; rel="llms"`,
-          `<${origin}/.well-known/api-catalog>; rel="api-catalog"`,
-          `<${origin}/rss.xml>; rel="alternate"; type="application/rss+xml"`
-        ].join(", ")
-      )
-    }
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
-    })
-  }
-}
-
-/**
- * Security Middleware: Injects SRI integrity attributes and security headers.
- */
-export const security = defineMiddleware(async (context: APIContext, next: MiddlewareNext) => {
-  // HTTP to HTTPS redirect only in production based on x-forwarded-proto
-  const isProd = import.meta.env.PROD
-  const isDev = import.meta.env.DEV
-  const proto = context.request.headers.get("x-forwarded-proto")
-  if (isProd && proto === "http") {
-    const httpsUrl = context.request.url.replace(/^http:/, "https:")
-    return Response.redirect(httpsUrl, 301)
-  }
-
-  const response = await next()
-  const contentType = response.headers.get("content-type") || ""
-
-  // Early return for non-HTML responses (avoid body parsing/corruption/overhead)
-  if (!contentType.includes("text/html")) {
-    return addSecurityHeaders(response, context.url.origin)
-  }
-
-  if (isDev) {
-    const cleanHeaders = new Headers(response.headers)
-    cleanHeaders.delete("content-security-policy")
-    let modifiedHtml = await response.text()
-    modifiedHtml = modifiedHtml.replace(
-      /<meta\s[^>]*http-equiv\s*=\s*["']?content-security-policy[^>]*>/gi,
-      ""
-    )
-    return addSecurityHeaders(
-      new Response(modifiedHtml, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: cleanHeaders
-      }),
-      context.url.origin
-    )
-  }
-
-  // Generate a per-request nonce. Cloudflare reads 'nonce-*' from the CSP header and
-  // automatically applies it to any scripts it injects (e.g. challenge-platform).
-  // The nonce is also stamped on every <script> tag so Astro's own scripts still load.
-  const nonce = crypto.randomUUID().replace(/-/g, "")
-
-  let cspHeader = response.headers.get("content-security-policy")
-  const newHeaders = new Headers(response.headers)
-
-  if (cspHeader) {
-    // Unescape HTML entities (like &#39; or &#x27; to ') that Astro's native CSP generation mistakenly puts in the header
-    cspHeader = cspHeader
-      .replace(/&#0*39;/g, "'")
-      .replace(/&#x0*27;/gi, "'")
-      .replace(/&quot;/g, '"')
-      .replace(/&amp;/g, "&")
-
-    // Inject the nonce into script-src (additive alongside existing hashes)
-    cspHeader = cspHeader.replace(/(script-src\s)/i, `$1'nonce-${nonce}' `)
-
-    newHeaders.set("content-security-policy", cspHeader)
-  }
-
-  if (typeof HTMLRewriter !== "undefined") {
-    let rewriter = new HTMLRewriter()
-
-    // Only register handlers if there are items to hash
-    if (manifestRegexes.length > 0) {
-      rewriter = rewriter
-        .on("script[src]", {
-          element(el: any) {
-            const src = el.getAttribute("src")
-            if (src && manifest[src]) {
-              el.setAttribute("integrity", manifest[src])
-              el.setAttribute("crossorigin", "anonymous")
-            }
-          }
-        })
-        .on('link[rel="stylesheet"][href]', {
-          element(el: any) {
-            const href = el.getAttribute("href")
-            if (href && manifest[href]) {
-              el.setAttribute("integrity", manifest[href])
-              el.setAttribute("crossorigin", "anonymous")
-            }
-          }
-        })
-    }
-
-    // Stamp nonce on every <script> tag so Astro's own scripts are still allowed
-    rewriter = rewriter.on("script", {
-      element(el: any) {
-        el.setAttribute("nonce", nonce)
-      }
-    })
-
-    // Inject a <meta name="csp-nonce"> so client JS can reliably read the
-    // current page's nonce (especially after View Transition navigations).
-    rewriter = rewriter.on("head", {
-      element(el: any) {
-        el.append(`<meta name="csp-nonce" content="${nonce}">`, { html: true })
-      }
-    })
-
-    rewriter = rewriter.on('meta[http-equiv="content-security-policy" i]', {
-      element(el: any) {
-        el.remove()
-      }
-    })
-
-    return addSecurityHeaders(
-      rewriter.transform(
-        new Response(response.body, {
-          status: response.status,
-          statusText: response.statusText,
-          headers: newHeaders
-        })
-      ),
-      context.url.origin
-    )
-  }
-
-  let modifiedHtml = await response.text()
-
-  // Remove Astro-injected CSP meta tag to prevent duplicate CSP headers and HTML escaping errors
-  modifiedHtml = modifiedHtml.replace(
-    /<meta\s[^>]*http-equiv\s*=\s*["']?content-security-policy[^>]*>/gi,
-    ""
-  )
-
-  // Inject a <meta name="csp-nonce"> into <head> so client JS can reliably
-  // read the current page's nonce after View Transition navigations.
-  modifiedHtml = modifiedHtml.replace(
-    /(<head(?:\s[^>]*)?>)/i,
-    `$1<meta name="csp-nonce" content="${nonce}">`
-  )
-
-  // Stamp nonce on every <script> tag (regex fallback path)
-  modifiedHtml = modifiedHtml.replace(
-    /<script(\s[^>]*)?>/gi,
-    (_match, attrs = "") => `<script${attrs} nonce="${nonce}">`
-  )
-
-  // Use pre-compiled regexes
-  for (const { hash, scriptRegex, linkRegex } of manifestRegexes) {
-    if (!hash) continue
-
-    modifiedHtml = modifiedHtml.replace(
-      scriptRegex,
-      `$1 integrity="${hash}" crossorigin="anonymous"$2`
-    )
-
-    modifiedHtml = modifiedHtml.replace(
-      linkRegex,
-      `$1 integrity="${hash}" crossorigin="anonymous"$2`
-    )
-  }
-
-  return addSecurityHeaders(
-    new Response(modifiedHtml, {
-      status: response.status,
-      statusText: response.statusText,
-      headers: newHeaders
-    }),
-    context.url.origin
-  )
-})