@rimelight/security 0.0.5 → 0.0.7

package/README.md

@@ -14,6 +14,6 @@
 - **`@rimelight/cms`**: Enterprise content management, block rendering, and wiki engine.
 - **`@rimelight/docs`**: Documentation components and utilities.
 - **`@rimelight/i18n`**: Internationalization and localization tools.
-- **`@rimelight/security`**: Astro security integration (CSP, SRI, and more).
+- **`@rimelight/security`**: Universal security & SRI package with Vite plugin and Hono/Fetch middleware (dual SRI, CSP, and headers).
 - **`@rimelight/seo`**: SEO utilities including sitemap, robots, and meta components.
 - **`@rimelight/ui`**: Our component library used in all our web projects.

package/dist/config/index.d.mts

@@ -0,0 +1,3 @@
+import { t as SecurityOptions } from "../types-CY5GDm3Z.mjs";
+import { t as buildCspHeader } from "../csp-DM1NVenC.mjs";
+export { SecurityOptions, buildCspHeader };

package/dist/config/index.mjs

@@ -0,0 +1,2 @@
+import { t as buildCspHeader } from "../csp-DATUs3cP.mjs";
+export { buildCspHeader };

package/dist/csp-DATUs3cP.mjs

@@ -0,0 +1,63 @@
+//#region src/csp.ts
+/**
+* Builds the Content-Security-Policy header string dynamically for a given request nonce.
+*/
+function buildCspHeader(options = {}, nonce) {
+	const domain = options.domain || "";
+	const defaultDirectives = {
+		"default-src": ["'none'"],
+		"img-src": Array.from(/* @__PURE__ */ new Set([
+			"'self'",
+			"data:",
+			...domain ? [`https://cdn.${domain}`] : [],
+			"https://i3.ytimg.com",
+			"https://www.youtube.com",
+			"https://www.youtube-nocookie.com",
+			...options.imgSrc || []
+		])),
+		"font-src": ["'self'"],
+		"connect-src": Array.from(/* @__PURE__ */ new Set([
+			"'self'",
+			"https://cloudflareinsights.com",
+			...options.connectSrc || []
+		])),
+		"frame-ancestors": ["'none'"],
+		"frame-src": Array.from(/* @__PURE__ */ new Set([
+			"https://www.youtube.com",
+			"https://www.youtube-nocookie.com",
+			...options.frameSrc || []
+		])),
+		"script-src": Array.from(/* @__PURE__ */ new Set([
+			"'self'",
+			...nonce ? [`'nonce-${nonce}'`] : [],
+			"https://static.cloudflareinsights.com",
+			"https://betterlytics.io/analytics.js",
+			"'inline-speculation-rules'",
+			"'sha256-ZuMSxilKU+4KIM8LWna4lqBEKzd6WaiAjz6gamhm7zM='",
+			...options.scriptResources || []
+		])),
+		"style-src": Array.from(/* @__PURE__ */ new Set([
+			"'self'",
+			"'sha256-SKuaOGnks7NAUq37nvw1PfGEE0lOAs5ERbiYRbGFIbw='",
+			...options.styleResources || []
+		])),
+		"base-uri": ["'self'"],
+		"form-action": ["'self'"],
+		"object-src": ["'none'"],
+		"manifest-src": ["'self'"],
+		"upgrade-insecure-requests": []
+	};
+	if (options.trustedTypes) defaultDirectives["require-trusted-types-for"] = ["'script'"];
+	if (options.directives) {
+		for (const [key, value] of Object.entries(options.directives)) if (value === false) delete defaultDirectives[key];
+		else if (value === true) defaultDirectives[key] = [];
+		else if (Array.isArray(value)) defaultDirectives[key] = value;
+		else if (typeof value === "string") defaultDirectives[key] = value.split(" ").filter(Boolean);
+	}
+	return Object.entries(defaultDirectives).map(([directive, values]) => {
+		if (!values || values.length === 0) return directive;
+		return `${directive} ${values.join(" ")}`;
+	}).join("; ");
+}
+//#endregion
+export { buildCspHeader as t };

package/dist/csp-DM1NVenC.d.mts

@@ -0,0 +1,8 @@
+import { t as SecurityOptions } from "./types-CY5GDm3Z.mjs";
+//#region src/csp.d.ts
+/**
+ * Builds the Content-Security-Policy header string dynamically for a given request nonce.
+ */
+declare function buildCspHeader(options?: SecurityOptions, nonce?: string): string;
+//#endregion
+export { buildCspHeader as t };

package/dist/index.d.mts

@@ -0,0 +1,28 @@
+import { t as SecurityOptions } from "./types-CY5GDm3Z.mjs";
+import { t as buildCspHeader } from "./csp-DM1NVenC.mjs";
+//#region src/vite.d.ts
+interface RimelightSecurityPlugin {
+  name: string;
+  enforce?: "pre" | "post";
+  resolveId?: (id: string) => string | null | undefined;
+  load?: (id: string) => string | null | undefined;
+  buildStart?: () => Promise<void> | void;
+  generateBundle?: (options: any, bundle: Record<string, any>) => Promise<void> | void;
+  [key: string]: any;
+}
+interface SecurityPluginOptions extends SecurityOptions {
+  /**
+   * Additional external script/style URLs to fetch and hash for SRI at build time.
+   */
+  resources?: string[];
+}
+/**
+ * Pure Vite Security & SRI Plugin.
+ * 1. Accepts framework-agnostic security options (domain, imgSrc, etc.) and exposes virtual:rimelight-security-config.
+ * 2. Fetches and hashes external 3rd-party scripts/styles at build time.
+ * 3. Emits SRI hashes for locally bundled JS/CSS chunks (Nuxt-security style).
+ * 4. Exposes virtual:sri-manifest with a unified URL -> hash mapping.
+ */
+declare function security(options?: SecurityPluginOptions): RimelightSecurityPlugin;
+//#endregion
+export { RimelightSecurityPlugin, SecurityOptions, SecurityPluginOptions, buildCspHeader, security, security as sri };

package/dist/index.mjs

@@ -0,0 +1,67 @@
+import { t as buildCspHeader } from "./csp-DATUs3cP.mjs";
+import { createHash } from "node:crypto";
+//#region src/vite.ts
+const DEFAULT_RESOURCES = ["https://betterlytics.io/analytics.js"];
+function hashContent(buffer) {
+	return `sha384-${createHash("sha384").update(buffer).digest("base64")}`;
+}
+/**
+* Pure Vite Security & SRI Plugin.
+* 1. Accepts framework-agnostic security options (domain, imgSrc, etc.) and exposes virtual:rimelight-security-config.
+* 2. Fetches and hashes external 3rd-party scripts/styles at build time.
+* 3. Emits SRI hashes for locally bundled JS/CSS chunks (Nuxt-security style).
+* 4. Exposes virtual:sri-manifest with a unified URL -> hash mapping.
+*/
+function security(options = {}) {
+	const sriManifest = {};
+	const externalUrls = Array.from(/* @__PURE__ */ new Set([...DEFAULT_RESOURCES, ...options.resources || []]));
+	const sriVirtualId = "virtual:sri-manifest";
+	const resolvedSriVirtualId = "\0" + sriVirtualId;
+	const configVirtualId = "virtual:rimelight-security-config";
+	const resolvedConfigVirtualId = "\0" + configVirtualId;
+	return {
+		name: "vite-plugin-rimelight-security",
+		enforce: "post",
+		async buildStart() {
+			if (process.env.NODE_ENV === "development") return;
+			await Promise.all(externalUrls.map(async (url) => {
+				if (!url.startsWith("https://")) return;
+				try {
+					const parsed = new URL(url);
+					if (parsed.hostname.includes("*")) return;
+					const pathname = parsed.pathname;
+					if (pathname === "/" || pathname === "" || pathname.endsWith("/")) return;
+					const response = await fetch(url);
+					if (!response.ok) return;
+					const buffer = await response.arrayBuffer();
+					sriManifest[url] = hashContent(buffer);
+				} catch {}
+			}));
+		},
+		generateBundle(_outputOptions, bundle) {
+			for (const [fileName, chunk] of Object.entries(bundle)) {
+				if (!fileName.endsWith(".js") && !fileName.endsWith(".css")) continue;
+				let content;
+				if (chunk.type === "chunk") content = chunk.code;
+				else if (chunk.type === "asset") content = chunk.source;
+				if (content) {
+					const hash = hashContent(content);
+					sriManifest[`/${fileName.replace(/^\/+/, "")}`] = hash;
+					sriManifest[fileName] = hash;
+				}
+			}
+		},
+		resolveId(id) {
+			if (id === sriVirtualId) return resolvedSriVirtualId;
+			if (id === configVirtualId) return resolvedConfigVirtualId;
+			return null;
+		},
+		load(id) {
+			if (id === resolvedSriVirtualId) return `export const manifest = ${JSON.stringify(sriManifest)};`;
+			if (id === resolvedConfigVirtualId) return `export const config = ${JSON.stringify(options)};`;
+			return null;
+		}
+	};
+}
+//#endregion
+export { buildCspHeader, security, security as sri };

package/dist/middleware/index.d.mts

@@ -0,0 +1,22 @@
+import { t as SecurityOptions } from "../types-CY5GDm3Z.mjs";
+//#region src/middleware/security.d.ts
+/**
+ * Universal Security Middleware for Hono and Web Standards (Fetch API).
+ * Injects security headers, CSP with per-request nonce, and SRI attributes.
+ */
+declare function security(options?: SecurityOptions): (c: any, next: any) => Promise<Response | void>;
+//#endregion
+//#region src/middleware/dev-only.d.ts
+/**
+ * Hono middleware that blocks any path containing `/dev/` in non-development environments. Mount
+ * this early in your Hono app (before API routes and Astro pages) so it covers both `/dev/` page
+ * routes and `/api/dev/` API routes in a single place.
+ *
+ * @example
+ *   // fetch.ts
+ *   import { devOnly } from "@rimelight/security/middleware"
+ *   app.use(devOnly)
+ */
+declare const devOnly: (c: any, next: any) => Promise<Response>;
+//#endregion
+export { devOnly, security };

package/dist/middleware/index.mjs

@@ -0,0 +1,146 @@
+import { t as buildCspHeader } from "../csp-DATUs3cP.mjs";
+import { manifest } from "virtual:sri-manifest";
+import { config } from "virtual:rimelight-security-config";
+//#region src/middleware/security.ts
+function isManifestRecord(obj) {
+	return typeof obj === "object" && obj !== null && !Array.isArray(obj);
+}
+function isConfigRecord(obj) {
+	return typeof obj === "object" && obj !== null && !Array.isArray(obj);
+}
+const manifest$1 = isManifestRecord(manifest) ? manifest : {};
+const defaultPluginConfig = isConfigRecord(config) ? config : {};
+function applySecurityHeaders(response, options, origin, nonce) {
+	const cspHeader = buildCspHeader(options, nonce);
+	const headers = new Headers(response.headers);
+	headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+	headers.set("X-Content-Type-Options", "nosniff");
+	headers.set("X-Frame-Options", "DENY");
+	headers.set("Cross-Origin-Resource-Policy", "same-origin");
+	headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
+	headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=(), usb=()");
+	headers.set("No-Vary-Search", "except=(\"q\" \"search\" \"locale\"), params=?1");
+	if (cspHeader) headers.set("Content-Security-Policy", cspHeader);
+	if (origin) headers.set("Link", [
+		`<${origin}/sitemap-index.xml>; rel="sitemap"`,
+		`<${origin}/llms.txt>; rel="llms"`,
+		`<${origin}/.well-known/api-catalog>; rel="api-catalog"`,
+		`<${origin}/rss.xml>; rel="alternate"; type="application/rss+xml"`
+	].join(", "));
+	if (options.headers) for (const [key, value] of Object.entries(options.headers)) headers.set(key, value);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+/**
+* Universal Security Middleware for Hono and Web Standards (Fetch API).
+* Injects security headers, CSP with per-request nonce, and SRI attributes.
+*/
+function security(options = {}) {
+	const mergedOptions = {
+		...defaultPluginConfig,
+		...options,
+		allowedDomains: [...defaultPluginConfig.allowedDomains || [], ...options.allowedDomains || []],
+		imgSrc: [...defaultPluginConfig.imgSrc || [], ...options.imgSrc || []],
+		connectSrc: [...defaultPluginConfig.connectSrc || [], ...options.connectSrc || []],
+		frameSrc: [...defaultPluginConfig.frameSrc || [], ...options.frameSrc || []],
+		scriptResources: [...defaultPluginConfig.scriptResources || [], ...options.scriptResources || []],
+		styleResources: [...defaultPluginConfig.styleResources || [], ...options.styleResources || []],
+		directives: {
+			...defaultPluginConfig.directives || {},
+			...options.directives || {}
+		},
+		headers: {
+			...defaultPluginConfig.headers || {},
+			...options.headers || {}
+		}
+	};
+	return async (c, next) => {
+		const isProd = import.meta.env?.PROD ?? process.env.NODE_ENV === "production";
+		const isDev = import.meta.env?.DEV ?? process.env.NODE_ENV === "development";
+		const req = c.req?.raw || c.request || c.req;
+		const proto = req?.headers?.get("x-forwarded-proto");
+		if (isProd && proto === "http" && req?.url) {
+			const httpsUrl = req.url.replace(/^http:/, "https:");
+			return Response.redirect(httpsUrl, 301);
+		}
+		await next();
+		const response = c.res;
+		if (!response) return;
+		const contentType = response.headers.get("content-type") || "";
+		const origin = req?.url ? new URL(req.url).origin : void 0;
+		if (!contentType.includes("text/html")) {
+			c.res = applySecurityHeaders(response, mergedOptions, origin);
+			return c.res;
+		}
+		if (isDev) {
+			c.res = applySecurityHeaders(response, {
+				...mergedOptions,
+				directives: {
+					...mergedOptions.directives,
+					"default-src": false
+				}
+			}, origin);
+			return c.res;
+		}
+		const nonce = crypto.randomUUID().replace(/-/g, "");
+		if (typeof HTMLRewriter !== "undefined") {
+			let rewriter = new HTMLRewriter();
+			rewriter = rewriter.on("script[src]", { element(el) {
+				const src = el.getAttribute("src");
+				if (src && manifest$1[src]) {
+					el.setAttribute("integrity", manifest$1[src]);
+					el.setAttribute("crossorigin", "anonymous");
+				}
+			} }).on("link[rel=\"stylesheet\"][href]", { element(el) {
+				const href = el.getAttribute("href");
+				if (href && manifest$1[href]) {
+					el.setAttribute("integrity", manifest$1[href]);
+					el.setAttribute("crossorigin", "anonymous");
+				}
+			} }).on("script", { element(el) {
+				el.setAttribute("nonce", nonce);
+			} }).on("head", { element(el) {
+				el.append(`<meta name="csp-nonce" content="${nonce}">`, { html: true });
+			} });
+			c.res = applySecurityHeaders(rewriter.transform(response), mergedOptions, origin, nonce);
+			return c.res;
+		}
+		let modifiedHtml = await response.text();
+		modifiedHtml = modifiedHtml.replace(/(<head(?:\s[^>]*)?>)/i, `$1<meta name="csp-nonce" content="${nonce}">`);
+		modifiedHtml = modifiedHtml.replace(/<script(\s[^>]*)?>/gi, (_match, attrs = "") => `<script${attrs} nonce="${nonce}">`);
+		for (const [url, hash] of Object.entries(manifest$1)) {
+			if (!hash) continue;
+			const scriptRegex = new RegExp(`(<script[^>]+src=["']${url}["'][^>]*)(/?>)`, "g");
+			const linkRegex = new RegExp(`(<link[^>]+href=["']${url}["'][^>]*)(/?>)`, "g");
+			modifiedHtml = modifiedHtml.replace(scriptRegex, `$1 integrity="${hash}" crossorigin="anonymous"$2`);
+			modifiedHtml = modifiedHtml.replace(linkRegex, `$1 integrity="${hash}" crossorigin="anonymous"$2`);
+		}
+		c.res = applySecurityHeaders(new Response(modifiedHtml, {
+			status: response.status,
+			statusText: response.statusText,
+			headers: response.headers
+		}), mergedOptions, origin, nonce);
+		return c.res;
+	};
+}
+//#endregion
+//#region src/middleware/dev-only.ts
+/**
+* Hono middleware that blocks any path containing `/dev/` in non-development environments. Mount
+* this early in your Hono app (before API routes and Astro pages) so it covers both `/dev/` page
+* routes and `/api/dev/` API routes in a single place.
+*
+* @example
+*   // fetch.ts
+*   import { devOnly } from "@rimelight/security/middleware"
+*   app.use(devOnly)
+*/
+const devOnly = async (c, next) => {
+	if (!import.meta.env.DEV && c.req.path.includes("/dev/")) return c.notFound();
+	return next();
+};
+//#endregion
+export { devOnly, security };

package/dist/types-CY5GDm3Z.d.mts

@@ -0,0 +1,47 @@
+//#region src/types.d.ts
+interface SecurityOptions {
+  /**
+   * The base domain name for this project (e.g. "idantity.me") used to autoconfigure
+   * standard allowed domains and img-src CDN targets.
+   */
+  domain?: string;
+  /**
+   * Additional Allowed Domains for origin checking or cross-domain rules
+   */
+  allowedDomains?: string[];
+  /**
+   * Additional sources to allow for img-src directive
+   */
+  imgSrc?: string[];
+  /**
+   * Additional sources to allow for connect-src directive
+   */
+  connectSrc?: string[];
+  /**
+   * Additional sources to allow for frame-src directive
+   */
+  frameSrc?: string[];
+  /**
+   * Additional script resources / origins (e.g. "https://betterlytics.io")
+   */
+  scriptResources?: string[];
+  /**
+   * Additional style resources / origins
+   */
+  styleResources?: string[];
+  /**
+   * Enables the 'require-trusted-types-for' directive
+   */
+  trustedTypes?: boolean;
+  /**
+   * Granular CSP directive overrides. Values are arrays of directive tokens, e.g.:
+   * { "frame-ancestors": ["'self'"] }
+   */
+  directives?: Record<string, string[] | string | boolean>;
+  /**
+   * Custom headers to set on every response or overrides
+   */
+  headers?: Record<string, string>;
+}
+//#endregion
+export { SecurityOptions as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rimelight/security",
-  "version": "0.0.5",
+  "version": "0.0.7",
   "private": false,
   "description": "Rimelight Entertainment's Security Package",
   "homepage": "https://rimelight.com/docs",
@@ -16,13 +16,23 @@
     "url": "git+https://github.com/Rimelight-Entertainment/rimelight.git"
   },
   "files": [
-    "src"
+    "dist",
+    "src/components"
   ],
   "type": "module",
   "exports": {
-    ".": "./src/integrations/index.ts",
-    "./middleware": "./src/middleware/index.ts",
-    "./config": "./src/config/index.ts",
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs"
+    },
+    "./middleware": {
+      "types": "./dist/middleware/index.d.mts",
+      "import": "./dist/middleware/index.mjs"
+    },
+    "./config": {
+      "types": "./dist/config/index.d.mts",
+      "import": "./dist/config/index.mjs"
+    },
     "./*": "./src/*"
   },
   "publishConfig": {
@@ -30,8 +40,8 @@
   },
   "devDependencies": {
     "@astrojs/check": "0.9.10",
-    "@rimelight/config": "0.0.3",
-    "astro": "7.2.7",
+    "@rimelight/config": "0.0.4",
+    "astro": "7.3.1",
     "typescript": "6.0.3"
   },
   "peerDependencies": {
@@ -41,6 +51,7 @@
     "node": ">=26.7.0"
   },
   "scripts": {
+    "build": "vp pack",
     "check": "vp check --fix && astro check"
   }
 }

package/src/components/SecurityHead.astro

@@ -10,11 +10,17 @@
   (function() {
     const w = window as any;
     if (w.trustedTypes && w.trustedTypes.createPolicy) {
-      w.trustedTypes.createPolicy('default', {
-        createHTML: function(input: string) { return input; },
-        createScript: function(input: string) { return input; },
-        createScriptURL: function(input: string) { return input; }
-      });
+      try {
+        if (!w.trustedTypes.defaultPolicy) {
+          w.trustedTypes.createPolicy('default', {
+            createHTML: function(input: string) { return input; },
+            createScript: function(input: string) { return input; },
+            createScriptURL: function(input: string) { return input; }
+          });
+        }
+      } catch {
+        // Policy already exists or cannot be created
+      }
     }
   })();
 </script>

package/src/config/index.ts

@@ -1 +0,0 @@
-export * from "./security"

package/src/config/security.ts

@@ -1,263 +0,0 @@
-import type { AstroUserConfig } from "astro"
-
-export type AstroSecurityConfig = NonNullable<AstroUserConfig["security"]>
-export type AstroCspConfig = Exclude<NonNullable<AstroSecurityConfig["csp"]>, boolean>
-
-export interface SecurityConfigOptions {
-  /**
-   * The base domain name for this project (e.g., "starter.rimelight.com") used to autoconfigure
-   * standard allowedDomains and img-src CDN targets.
-   */
-  domain: string
-  /**
-   * Additional Allowed Domains (appended to the default wildcard subdomains of `domain`)
-   */
-  allowedDomains?: AstroSecurityConfig["allowedDomains"]
-  /**
-   * Additional sources to allow for img-src directive
-   */
-  imgSrc?: string[]
-  /**
-   * Additional sources to allow for connect-src directive
-   */
-  connectSrc?: string[]
-  /**
-   * Additional sources to allow for frame-src directive
-   */
-  frameSrc?: string[]
-  /**
-   * Additional script resources
-   */
-  scriptResources?: string[]
-  /**
-   * Additional style resources
-   */
-  styleResources?: string[]
-  /**
-   * Enables the 'require-trusted-types-for' directive
-   */
-  trustedTypes?: boolean
-  /**
-   * Direct overrides for any security config fields
-   */
-  overrides?: Partial<Omit<AstroSecurityConfig, "csp">> & {
-    csp?: Partial<AstroCspConfig>
-  }
-}
-
-/**
- * Generates a standard, strictly configured Security/CSP object for Astro configurations with
- * support for easy customization and additions per project.
- *
- * @example
- *   ;```ts
- *   // Default returned shape:
- *   {
- *   checkOrigin: true,
- *   allowedDomains: [
- *   {
- *   hostname: "**.domain.com",
- *   protocol: "https"
- *   }
- *   ],
- *   csp: {
- *   algorithm: "SHA-384",
- *   directives: [
- *   "default-src 'none'",
- *   "img-src 'self' data: https://cdn.domain.com https://i3.ytimg.com https://www.youtube.com https://www.youtube-nocookie.com",
- *   "font-src 'self'",
- *   "connect-src 'self' https://cloudflareinsights.com",
- *   "frame-ancestors 'none'",
- *   "frame-src https://www.youtube.com https://www.youtube-nocookie.com",
- *   "upgrade-insecure-requests",
- *   "base-uri 'self'",
- *   "form-action 'self'"
- *   ],
- *   scriptDirective: {
- *   resources: [
- *   "'self'",
- *   "https://static.cloudflareinsights.com",
- *   "https://betterlytics.io/analytics.js",
- *   "'inline-speculation-rules'"
- *   ]
- *   },
- *   styleDirective: {
- *   resources: [
- *   "'self'",
- *   "'sha256-SKuaOGnks7NAUq37nvw1PfGEE0lOAs5ERbiYRbGFIbw='"
- *   ]
- *   }
- *   }
- *   }
- *   ```
- */
-type DirectiveItem = { resource: string; kind?: "element" | "attribute" }
-type DirectiveInput = string[] | DirectiveItem[] | { resources?: string[] } | null | undefined
-
-const normalizeDirective = (input: DirectiveInput): DirectiveItem[] => {
-  if (!input) return []
-  if (Array.isArray(input)) {
-    return input.map((item) => {
-      if (typeof item === "string") {
-        return { resource: item, kind: "element" }
-      }
-      return item
-    })
-  }
-  if (typeof input === "object" && "resources" in input && Array.isArray(input.resources)) {
-    return input.resources.map((res) => ({ resource: res, kind: "element" }))
-  }
-  return []
-}
-
-function mergeDirective(current: any, incoming: any): any {
-  if (!current && !incoming) return undefined
-
-  const currentNormalized = normalizeDirective(current)
-  const incomingNormalized = normalizeDirective(incoming)
-
-  const mergedMap = new Map<string, DirectiveItem>()
-  for (const item of [...currentNormalized, ...incomingNormalized]) {
-    const key = `${item.resource}::${item.kind || "element"}`
-    mergedMap.set(key, item)
-  }
-
-  const mergedList = Array.from(mergedMap.values())
-
-  const currentWasArray = Array.isArray(current)
-  const incomingWasArray = Array.isArray(incoming)
-
-  if (
-    !currentWasArray &&
-    !incomingWasArray &&
-    current &&
-    typeof current === "object" &&
-    incoming &&
-    typeof incoming === "object" &&
-    !("length" in current) &&
-    !("length" in incoming)
-  ) {
-    return {
-      resources: mergedList.map((item) => item.resource)
-    }
-  }
-
-  return mergedList
-}
-
-export function defineSecurity(options: SecurityConfigOptions): AstroSecurityConfig {
-  const { domain, overrides } = options
-  const domainWithWildcard = `**.${domain}`
-
-  // 1. Build default allowed domains
-  const allowedDomains = [
-    {
-      hostname: domainWithWildcard,
-      protocol: "https" as const
-    },
-    ...(options.allowedDomains || [])
-  ]
-
-  // 2. Build CSP directives
-  const imgSources = Array.from(
-    new Set([
-      "'self'",
-      "data:",
-      `https://cdn.${domain}`,
-      "https://i3.ytimg.com",
-      "https://www.youtube.com",
-      "https://www.youtube-nocookie.com",
-      ...(options.imgSrc || [])
-    ])
-  )
-
-  const connectSources = Array.from(
-    new Set(["'self'", "https://cloudflareinsights.com", ...(options.connectSrc || [])])
-  )
-
-  const frameSources = Array.from(
-    new Set([
-      "https://www.youtube.com",
-      "https://www.youtube-nocookie.com",
-      ...(options.frameSrc || [])
-    ])
-  )
-
-  const baseDirectives: AstroCspConfig["directives"] = [
-    "default-src 'none'",
-    `img-src ${imgSources.join(" ")}`,
-    "font-src 'self'",
-    `connect-src ${connectSources.join(" ")}`,
-    "frame-ancestors 'none'",
-    `frame-src ${frameSources.join(" ")}`,
-    "upgrade-insecure-requests",
-    "base-uri 'self'",
-    "form-action 'self'",
-    "object-src 'none'",
-    "manifest-src 'self'",
-    ...(options.trustedTypes ? ["require-trusted-types-for 'script'" as const] : [])
-  ]
-
-  // 3. Build script & style directives
-  const scriptResources = Array.from(
-    new Set([
-      "'self'",
-      "https://static.cloudflareinsights.com",
-      "https://betterlytics.io/analytics.js",
-      "'inline-speculation-rules'",
-      // Astro ClientRouter (View Transitions)
-      "'sha256-ZuMSxilKU+4KIM8LWna4lqBEKzd6WaiAjz6gamhm7zM='",
-      ...(options.scriptResources || [])
-    ])
-  )
-
-  const styleResources = Array.from(
-    new Set([
-      "'self'",
-      // Astro ClientRouter (View Transitions)
-      "'sha256-SKuaOGnks7NAUq37nvw1PfGEE0lOAs5ERbiYRbGFIbw='",
-      ...(options.styleResources || [])
-    ])
-  )
-
-  // 4. Build base SecurityConfig
-  const securityConfig: AstroSecurityConfig = {
-    checkOrigin: true,
-    allowedDomains,
-    csp: {
-      algorithm: "SHA-384",
-      directives: baseDirectives,
-      scriptDirective: {
-        resources: scriptResources
-      },
-      styleDirective: {
-        resources: styleResources
-      }
-    }
-  }
-
-  // 5. Merge overrides
-  if (overrides) {
-    const { csp, ...restOverrides } = overrides
-    Object.assign(securityConfig, restOverrides)
-    if (csp && typeof securityConfig.csp === "object" && securityConfig.csp !== null) {
-      const currentCsp = securityConfig.csp
-      const mergedCsp: AstroCspConfig = {
-        ...currentCsp,
-        ...csp
-      }
-
-      if (csp.scriptDirective || currentCsp.scriptDirective) {
-        mergedCsp.scriptDirective = mergeDirective(currentCsp.scriptDirective, csp.scriptDirective)
-      }
-
-      if (csp.styleDirective || currentCsp.styleDirective) {
-        mergedCsp.styleDirective = mergeDirective(currentCsp.styleDirective, csp.styleDirective)
-      }
-
-      securityConfig.csp = mergedCsp
-    }
-  }
-
-  return securityConfig
-}

package/src/integrations/index.ts

@@ -1 +0,0 @@
-export * from "./sri"

package/src/integrations/sri.ts

@@ -1,137 +0,0 @@
-import type { AstroIntegration } from "astro"
-import { createHash } from "node:crypto"
-
-interface SRIConfig {
-  security?: {
-    csp?: {
-      scriptDirective?: {
-        resources?: string[]
-      }
-    }
-  }
-}
-
-function assertSRIConfig(obj: unknown): asserts obj is SRIConfig {
-  if (!obj || typeof obj !== "object") throw new Error("Expected config")
-}
-
-/**
- * Astro SRI Integration Fetches external scripts at build-time and generates hashes for the SSR
- * middleware.
- */
-export function sri(): AstroIntegration {
-  const sriManifest: Record<string, string> = {}
-
-  return {
-    name: "@rimelight/security",
-    hooks: {
-      "astro:config:setup": async ({ updateConfig, config, command, logger }) => {
-        const isDev = command === "dev"
-
-        if (isDev) {
-          logger.info("Skipping SRI discovery in development mode.")
-        } else {
-          // 1. Identify External Scripts from CSP config
-          // We look into the custom 'security' block in astro.config.mjs
-          assertSRIConfig(config)
-
-          const security = config.security
-          const externalUrls: string[] = []
-
-          if (security?.csp?.scriptDirective?.resources) {
-            for (const resource of security.csp.scriptDirective.resources) {
-              if (resource.startsWith("https://")) {
-                try {
-                  const parsed = new URL(resource)
-                  // Skip wildcard domains
-                  if (parsed.hostname.includes("*")) continue
-
-                  // Skip root domains or directories (no actual script/style file)
-                  const path = parsed.pathname
-                  if (path === "/" || path === "" || path.endsWith("/")) continue
-
-                  externalUrls.push(resource)
-                } catch {
-                  // Skip invalid URLs
-                }
-              }
-            }
-          }
-
-          if (externalUrls.length > 0) {
-            // 2. Fetch and Hash External Scripts
-            const results = await Promise.all(
-              externalUrls.map(async (url) => {
-                try {
-                  const response = await fetch(url)
-                  if (!response.ok) throw new Error(`HTTP ${response.status}`)
-
-                  const buffer = await response.arrayBuffer()
-                  const hash = createHash("sha384").update(Buffer.from(buffer)).digest("base64")
-
-                  sriManifest[url] = `sha384-${hash}`
-                  return { url, success: true }
-                } catch (err: unknown) {
-                  const message = err instanceof Error ? err.message : String(err)
-                  return { url, success: false, error: message }
-                }
-              })
-            )
-
-            const succeeded = results.filter((r) => r.success).map((r) => r.url)
-            const failed = results.filter((r) => !r.success)
-
-            if (failed.length === 0) {
-              logger.info(
-                `SRI Discovery: successfully hashed ${succeeded.length} external resource(s).\n` +
-                  `      Succeeded:\n` +
-                  succeeded.map((url) => `      - ${url}`).join("\n")
-              )
-            } else {
-              const succeededBlock =
-                succeeded.length > 0
-                  ? `      Succeeded:\n` + succeeded.map((url) => `      - ${url}`).join("\n")
-                  : ""
-              const failedBlock =
-                `      Failed:\n` + failed.map((f) => `      - ${f.url} (${f.error})`).join("\n")
-
-              const parts = [
-                `SRI Discovery: hashed ${succeeded.length}/${results.length} external resource(s).`,
-                succeededBlock,
-                failedBlock
-              ].filter(Boolean)
-
-              logger.warn(parts.join("\n\n"))
-            }
-          } else {
-            logger.info("SRI Discovery: no external resources found to hash.")
-          }
-        }
-
-        // 3. Provide hashes to the runtime via Vite's virtual module
-        const virtualModuleId = "virtual:sri-manifest"
-        const resolvedVirtualModuleId = "\0" + virtualModuleId
-
-        updateConfig({
-          vite: {
-            plugins: [
-              {
-                name: "vite-plugin-sri-manifest",
-                resolveId(id: string) {
-                  if (id === virtualModuleId) return resolvedVirtualModuleId
-                  return null
-                },
-                load(id: string) {
-                  if (id === resolvedVirtualModuleId) {
-                    return `export const manifest = ${JSON.stringify(sriManifest)};`
-                  }
-                  return null
-                }
-              }
-            ]
-          }
-        })
-      }
-    }
-  }
-}

package/src/middleware/dev-only.ts

@@ -1,16 +0,0 @@
-/**
- * Hono middleware that blocks any path containing `/dev/` in non-development environments. Mount
- * this early in your Hono app (before API routes and Astro pages) so it covers both `/dev/` page
- * routes and `/api/dev/` API routes in a single place.
- *
- * @example
- *   // fetch.ts
- *   import { devOnly } from "@rimelight/security/middleware"
- *   app.use(devOnly)
- */
-export const devOnly = async (c: any, next: any): Promise<Response> => {
-  if (!import.meta.env.DEV && c.req.path.includes("/dev/")) {
-    return c.notFound()
-  }
-  return next()
-}

package/src/middleware/index.ts

@@ -1,2 +0,0 @@
-export * from "./security"
-export * from "./dev-only"

package/src/middleware/security.ts

@@ -1,250 +0,0 @@
-import type { APIContext, MiddlewareNext } from "astro"
-import { defineMiddleware } from "astro:middleware"
-
-// @ts-ignore virtual module resolved by SRI Vite plugin
-import { manifest as sriManifest } from "virtual:sri-manifest"
-
-function isManifestRecord(obj: unknown): obj is Record<string, string> {
-  return typeof obj === "object" && obj !== null && !Array.isArray(obj)
-}
-
-const manifest: Record<string, string> = isManifestRecord(sriManifest) ? sriManifest : {}
-
-declare const HTMLRewriter: any
-
-function assertManifest(obj: unknown): asserts obj is Record<string, string> {
-  if (!obj || typeof obj !== "object") throw new Error("Expected manifest")
-}
-
-// Assert and pre-compile regular expressions once at startup
-assertManifest(manifest)
-
-const manifestRegexes = Object.entries(manifest).map(([url, hash]) => ({
-  hash,
-  scriptRegex: new RegExp(`(<script[^>]+src=["']${url}["'][^>]*)(/?>)`, "g"),
-  linkRegex: new RegExp(`(<link[^>]+href=["']${url}["'][^>]*)(/?>)`, "g")
-}))
-
-function addSecurityHeaders(response: Response, origin?: string): Response {
-  try {
-    response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin")
-    response.headers.set("X-Content-Type-Options", "nosniff")
-    response.headers.set("X-Frame-Options", "DENY")
-    response.headers.set("Cross-Origin-Resource-Policy", "same-origin")
-    response.headers.set(
-      "Strict-Transport-Security",
-      "max-age=31536000; includeSubDomains; preload"
-    )
-    response.headers.set(
-      "Permissions-Policy",
-      "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
-    )
-    response.headers.set("No-Vary-Search", 'except=("q" "search" "locale"), params=?1')
-    if (origin) {
-      response.headers.set(
-        "Link",
-        [
-          `<${origin}/sitemap-index.xml>; rel="sitemap"`,
-          `<${origin}/llms.txt>; rel="llms"`,
-          `<${origin}/.well-known/api-catalog>; rel="api-catalog"`,
-          `<${origin}/rss.xml>; rel="alternate"; type="application/rss+xml"`
-        ].join(", ")
-      )
-    }
-    return response
-  } catch {
-    const headers = new Headers(response.headers)
-    headers.set("Referrer-Policy", "strict-origin-when-cross-origin")
-    headers.set("X-Content-Type-Options", "nosniff")
-    headers.set("X-Frame-Options", "DENY")
-    headers.set("Cross-Origin-Resource-Policy", "same-origin")
-    headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")
-    headers.set(
-      "Permissions-Policy",
-      "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
-    )
-    headers.set("No-Vary-Search", 'except=("q" "search" "locale"), params=?1')
-    if (origin) {
-      headers.set(
-        "Link",
-        [
-          `<${origin}/sitemap-index.xml>; rel="sitemap"`,
-          `<${origin}/llms.txt>; rel="llms"`,
-          `<${origin}/.well-known/api-catalog>; rel="api-catalog"`,
-          `<${origin}/rss.xml>; rel="alternate"; type="application/rss+xml"`
-        ].join(", ")
-      )
-    }
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
-    })
-  }
-}
-
-/**
- * Security Middleware: Injects SRI integrity attributes and security headers.
- */
-export const security = defineMiddleware(async (context: APIContext, next: MiddlewareNext) => {
-  // HTTP to HTTPS redirect only in production based on x-forwarded-proto
-  const isProd = import.meta.env.PROD
-  const isDev = import.meta.env.DEV
-  const proto = context.request.headers.get("x-forwarded-proto")
-  if (isProd && proto === "http") {
-    const httpsUrl = context.request.url.replace(/^http:/, "https:")
-    return Response.redirect(httpsUrl, 301)
-  }
-
-  const response = await next()
-  const contentType = response.headers.get("content-type") || ""
-
-  // Early return for non-HTML responses (avoid body parsing/corruption/overhead)
-  if (!contentType.includes("text/html")) {
-    return addSecurityHeaders(response, context.url.origin)
-  }
-
-  if (isDev) {
-    const cleanHeaders = new Headers(response.headers)
-    cleanHeaders.delete("content-security-policy")
-    let modifiedHtml = await response.text()
-    modifiedHtml = modifiedHtml.replace(
-      /<meta\s[^>]*http-equiv\s*=\s*["']?content-security-policy[^>]*>/gi,
-      ""
-    )
-    return addSecurityHeaders(
-      new Response(modifiedHtml, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: cleanHeaders
-      }),
-      context.url.origin
-    )
-  }
-
-  // Generate a per-request nonce. Cloudflare reads 'nonce-*' from the CSP header and
-  // automatically applies it to any scripts it injects (e.g. challenge-platform).
-  // The nonce is also stamped on every <script> tag so Astro's own scripts still load.
-  const nonce = crypto.randomUUID().replace(/-/g, "")
-
-  let cspHeader = response.headers.get("content-security-policy")
-  const newHeaders = new Headers(response.headers)
-
-  if (cspHeader) {
-    // Unescape HTML entities (like &#39; or &#x27; to ') that Astro's native CSP generation mistakenly puts in the header
-    cspHeader = cspHeader
-      .replace(/&#0*39;/g, "'")
-      .replace(/&#x0*27;/gi, "'")
-      .replace(/&quot;/g, '"')
-      .replace(/&amp;/g, "&")
-
-    // Inject the nonce into script-src (additive alongside existing hashes)
-    cspHeader = cspHeader.replace(/(script-src\s)/i, `$1'nonce-${nonce}' `)
-
-    newHeaders.set("content-security-policy", cspHeader)
-  }
-
-  if (typeof HTMLRewriter !== "undefined") {
-    let rewriter = new HTMLRewriter()
-
-    // Only register handlers if there are items to hash
-    if (manifestRegexes.length > 0) {
-      rewriter = rewriter
-        .on("script[src]", {
-          element(el: any) {
-            const src = el.getAttribute("src")
-            if (src && manifest[src]) {
-              el.setAttribute("integrity", manifest[src])
-              el.setAttribute("crossorigin", "anonymous")
-            }
-          }
-        })
-        .on('link[rel="stylesheet"][href]', {
-          element(el: any) {
-            const href = el.getAttribute("href")
-            if (href && manifest[href]) {
-              el.setAttribute("integrity", manifest[href])
-              el.setAttribute("crossorigin", "anonymous")
-            }
-          }
-        })
-    }
-
-    // Stamp nonce on every <script> tag so Astro's own scripts are still allowed
-    rewriter = rewriter.on("script", {
-      element(el: any) {
-        el.setAttribute("nonce", nonce)
-      }
-    })
-
-    // Inject a <meta name="csp-nonce"> so client JS can reliably read the
-    // current page's nonce (especially after View Transition navigations).
-    rewriter = rewriter.on("head", {
-      element(el: any) {
-        el.append(`<meta name="csp-nonce" content="${nonce}">`, { html: true })
-      }
-    })
-
-    rewriter = rewriter.on('meta[http-equiv="content-security-policy" i]', {
-      element(el: any) {
-        el.remove()
-      }
-    })
-
-    return addSecurityHeaders(
-      rewriter.transform(
-        new Response(response.body, {
-          status: response.status,
-          statusText: response.statusText,
-          headers: newHeaders
-        })
-      ),
-      context.url.origin
-    )
-  }
-
-  let modifiedHtml = await response.text()
-
-  // Remove Astro-injected CSP meta tag to prevent duplicate CSP headers and HTML escaping errors
-  modifiedHtml = modifiedHtml.replace(
-    /<meta\s[^>]*http-equiv\s*=\s*["']?content-security-policy[^>]*>/gi,
-    ""
-  )
-
-  // Inject a <meta name="csp-nonce"> into <head> so client JS can reliably
-  // read the current page's nonce after View Transition navigations.
-  modifiedHtml = modifiedHtml.replace(
-    /(<head(?:\s[^>]*)?>)/i,
-    `$1<meta name="csp-nonce" content="${nonce}">`
-  )
-
-  // Stamp nonce on every <script> tag (regex fallback path)
-  modifiedHtml = modifiedHtml.replace(
-    /<script(\s[^>]*)?>/gi,
-    (_match, attrs = "") => `<script${attrs} nonce="${nonce}">`
-  )
-
-  // Use pre-compiled regexes
-  for (const { hash, scriptRegex, linkRegex } of manifestRegexes) {
-    if (!hash) continue
-
-    modifiedHtml = modifiedHtml.replace(
-      scriptRegex,
-      `$1 integrity="${hash}" crossorigin="anonymous"$2`
-    )
-
-    modifiedHtml = modifiedHtml.replace(
-      linkRegex,
-      `$1 integrity="${hash}" crossorigin="anonymous"$2`
-    )
-  }
-
-  return addSecurityHeaders(
-    new Response(modifiedHtml, {
-      status: response.status,
-      statusText: response.statusText,
-      headers: newHeaders
-    }),
-    context.url.origin
-  )
-})