@rimelight/security 0.0.6 → 0.0.7

package/README.md

@@ -14,6 +14,6 @@
 - **`@rimelight/cms`**: Enterprise content management, block rendering, and wiki engine.
 - **`@rimelight/docs`**: Documentation components and utilities.
 - **`@rimelight/i18n`**: Internationalization and localization tools.
-- **`@rimelight/security`**: Astro security integration (CSP, SRI, and more).
+- **`@rimelight/security`**: Universal security & SRI package with Vite plugin and Hono/Fetch middleware (dual SRI, CSP, and headers).
 - **`@rimelight/seo`**: SEO utilities including sitemap, robots, and meta components.
 - **`@rimelight/ui`**: Our component library used in all our web projects.

package/dist/config/index.d.mts

@@ -1,48 +1,3 @@
-import { AstroUserConfig } from "astro";
-//#region src/config/security.d.ts
-type AstroSecurityConfig = NonNullable<AstroUserConfig["security"]>;
-type AstroCspConfig = Exclude<NonNullable<AstroSecurityConfig["csp"]>, boolean>;
-interface SecurityConfigOptions {
-  /**
-   * The base domain name for this project (e.g., "starter.rimelight.com") used to autoconfigure
-   * standard allowedDomains and img-src CDN targets.
-   */
-  domain: string;
-  /**
-   * Additional Allowed Domains (appended to the default wildcard subdomains of `domain`)
-   */
-  allowedDomains?: AstroSecurityConfig["allowedDomains"];
-  /**
-   * Additional sources to allow for img-src directive
-   */
-  imgSrc?: string[];
-  /**
-   * Additional sources to allow for connect-src directive
-   */
-  connectSrc?: string[];
-  /**
-   * Additional sources to allow for frame-src directive
-   */
-  frameSrc?: string[];
-  /**
-   * Additional script resources
-   */
-  scriptResources?: string[];
-  /**
-   * Additional style resources
-   */
-  styleResources?: string[];
-  /**
-   * Enables the 'require-trusted-types-for' directive
-   */
-  trustedTypes?: boolean;
-  /**
-   * Direct overrides for any security config fields
-   */
-  overrides?: Partial<Omit<AstroSecurityConfig, "csp">> & {
-    csp?: Partial<AstroCspConfig>;
-  };
-}
-declare function defineSecurity(options: SecurityConfigOptions): AstroSecurityConfig;
-//#endregion
-export { AstroCspConfig, AstroSecurityConfig, SecurityConfigOptions, defineSecurity };
+import { t as SecurityOptions } from "../types-CY5GDm3Z.mjs";
+import { t as buildCspHeader } from "../csp-DM1NVenC.mjs";
+export { SecurityOptions, buildCspHeader };

package/dist/config/index.mjs

@@ -1,109 +1,2 @@
-//#region src/config/security.ts
-const normalizeDirective = (input) => {
-	if (!input) return [];
-	if (Array.isArray(input)) return input.map((item) => {
-		if (typeof item === "string") return {
-			resource: item,
-			kind: "element"
-		};
-		return item;
-	});
-	if (typeof input === "object" && "resources" in input && Array.isArray(input.resources)) return input.resources.map((res) => ({
-		resource: res,
-		kind: "element"
-	}));
-	return [];
-};
-function mergeDirective(current, incoming) {
-	if (!current && !incoming) return void 0;
-	const currentNormalized = normalizeDirective(current);
-	const incomingNormalized = normalizeDirective(incoming);
-	const mergedMap = /* @__PURE__ */ new Map();
-	for (const item of [...currentNormalized, ...incomingNormalized]) {
-		const key = `${item.resource}::${item.kind || "element"}`;
-		mergedMap.set(key, item);
-	}
-	const mergedList = Array.from(mergedMap.values());
-	if (!Array.isArray(current) && !Array.isArray(incoming) && current && typeof current === "object" && incoming && typeof incoming === "object" && !("length" in current) && !("length" in incoming)) return { resources: mergedList.map((item) => item.resource) };
-	return mergedList;
-}
-function defineSecurity(options) {
-	const { domain, overrides } = options;
-	const allowedDomains = [{
-		hostname: `**.${domain}`,
-		protocol: "https"
-	}, ...options.allowedDomains || []];
-	const imgSources = Array.from(/* @__PURE__ */ new Set([
-		"'self'",
-		"data:",
-		`https://cdn.${domain}`,
-		"https://i3.ytimg.com",
-		"https://www.youtube.com",
-		"https://www.youtube-nocookie.com",
-		...options.imgSrc || []
-	]));
-	const connectSources = Array.from(/* @__PURE__ */ new Set([
-		"'self'",
-		"https://cloudflareinsights.com",
-		...options.connectSrc || []
-	]));
-	const frameSources = Array.from(/* @__PURE__ */ new Set([
-		"https://www.youtube.com",
-		"https://www.youtube-nocookie.com",
-		...options.frameSrc || []
-	]));
-	const baseDirectives = [
-		"default-src 'none'",
-		`img-src ${imgSources.join(" ")}`,
-		"font-src 'self'",
-		`connect-src ${connectSources.join(" ")}`,
-		"frame-ancestors 'none'",
-		`frame-src ${frameSources.join(" ")}`,
-		"upgrade-insecure-requests",
-		"base-uri 'self'",
-		"form-action 'self'",
-		"object-src 'none'",
-		"manifest-src 'self'",
-		...options.trustedTypes ? ["require-trusted-types-for 'script'"] : []
-	];
-	const scriptResources = Array.from(/* @__PURE__ */ new Set([
-		"'self'",
-		"https://static.cloudflareinsights.com",
-		"https://betterlytics.io/analytics.js",
-		"'inline-speculation-rules'",
-		"'sha256-ZuMSxilKU+4KIM8LWna4lqBEKzd6WaiAjz6gamhm7zM='",
-		...options.scriptResources || []
-	]));
-	const styleResources = Array.from(/* @__PURE__ */ new Set([
-		"'self'",
-		"'sha256-SKuaOGnks7NAUq37nvw1PfGEE0lOAs5ERbiYRbGFIbw='",
-		...options.styleResources || []
-	]));
-	const securityConfig = {
-		checkOrigin: true,
-		allowedDomains,
-		csp: {
-			algorithm: "SHA-384",
-			directives: baseDirectives,
-			scriptDirective: { resources: scriptResources },
-			styleDirective: { resources: styleResources }
-		}
-	};
-	if (overrides) {
-		const { csp, ...restOverrides } = overrides;
-		Object.assign(securityConfig, restOverrides);
-		if (csp && typeof securityConfig.csp === "object" && securityConfig.csp !== null) {
-			const currentCsp = securityConfig.csp;
-			const mergedCsp = {
-				...currentCsp,
-				...csp
-			};
-			if (csp.scriptDirective || currentCsp.scriptDirective) mergedCsp.scriptDirective = mergeDirective(currentCsp.scriptDirective, csp.scriptDirective);
-			if (csp.styleDirective || currentCsp.styleDirective) mergedCsp.styleDirective = mergeDirective(currentCsp.styleDirective, csp.styleDirective);
-			securityConfig.csp = mergedCsp;
-		}
-	}
-	return securityConfig;
-}
-//#endregion
-export { defineSecurity };
+import { t as buildCspHeader } from "../csp-DATUs3cP.mjs";
+export { buildCspHeader };

package/dist/csp-DATUs3cP.mjs

@@ -0,0 +1,63 @@
+//#region src/csp.ts
+/**
+* Builds the Content-Security-Policy header string dynamically for a given request nonce.
+*/
+function buildCspHeader(options = {}, nonce) {
+	const domain = options.domain || "";
+	const defaultDirectives = {
+		"default-src": ["'none'"],
+		"img-src": Array.from(/* @__PURE__ */ new Set([
+			"'self'",
+			"data:",
+			...domain ? [`https://cdn.${domain}`] : [],
+			"https://i3.ytimg.com",
+			"https://www.youtube.com",
+			"https://www.youtube-nocookie.com",
+			...options.imgSrc || []
+		])),
+		"font-src": ["'self'"],
+		"connect-src": Array.from(/* @__PURE__ */ new Set([
+			"'self'",
+			"https://cloudflareinsights.com",
+			...options.connectSrc || []
+		])),
+		"frame-ancestors": ["'none'"],
+		"frame-src": Array.from(/* @__PURE__ */ new Set([
+			"https://www.youtube.com",
+			"https://www.youtube-nocookie.com",
+			...options.frameSrc || []
+		])),
+		"script-src": Array.from(/* @__PURE__ */ new Set([
+			"'self'",
+			...nonce ? [`'nonce-${nonce}'`] : [],
+			"https://static.cloudflareinsights.com",
+			"https://betterlytics.io/analytics.js",
+			"'inline-speculation-rules'",
+			"'sha256-ZuMSxilKU+4KIM8LWna4lqBEKzd6WaiAjz6gamhm7zM='",
+			...options.scriptResources || []
+		])),
+		"style-src": Array.from(/* @__PURE__ */ new Set([
+			"'self'",
+			"'sha256-SKuaOGnks7NAUq37nvw1PfGEE0lOAs5ERbiYRbGFIbw='",
+			...options.styleResources || []
+		])),
+		"base-uri": ["'self'"],
+		"form-action": ["'self'"],
+		"object-src": ["'none'"],
+		"manifest-src": ["'self'"],
+		"upgrade-insecure-requests": []
+	};
+	if (options.trustedTypes) defaultDirectives["require-trusted-types-for"] = ["'script'"];
+	if (options.directives) {
+		for (const [key, value] of Object.entries(options.directives)) if (value === false) delete defaultDirectives[key];
+		else if (value === true) defaultDirectives[key] = [];
+		else if (Array.isArray(value)) defaultDirectives[key] = value;
+		else if (typeof value === "string") defaultDirectives[key] = value.split(" ").filter(Boolean);
+	}
+	return Object.entries(defaultDirectives).map(([directive, values]) => {
+		if (!values || values.length === 0) return directive;
+		return `${directive} ${values.join(" ")}`;
+	}).join("; ");
+}
+//#endregion
+export { buildCspHeader as t };

package/dist/csp-DM1NVenC.d.mts

@@ -0,0 +1,8 @@
+import { t as SecurityOptions } from "./types-CY5GDm3Z.mjs";
+//#region src/csp.d.ts
+/**
+ * Builds the Content-Security-Policy header string dynamically for a given request nonce.
+ */
+declare function buildCspHeader(options?: SecurityOptions, nonce?: string): string;
+//#endregion
+export { buildCspHeader as t };

package/dist/index.d.mts

@@ -0,0 +1,28 @@
+import { t as SecurityOptions } from "./types-CY5GDm3Z.mjs";
+import { t as buildCspHeader } from "./csp-DM1NVenC.mjs";
+//#region src/vite.d.ts
+interface RimelightSecurityPlugin {
+  name: string;
+  enforce?: "pre" | "post";
+  resolveId?: (id: string) => string | null | undefined;
+  load?: (id: string) => string | null | undefined;
+  buildStart?: () => Promise<void> | void;
+  generateBundle?: (options: any, bundle: Record<string, any>) => Promise<void> | void;
+  [key: string]: any;
+}
+interface SecurityPluginOptions extends SecurityOptions {
+  /**
+   * Additional external script/style URLs to fetch and hash for SRI at build time.
+   */
+  resources?: string[];
+}
+/**
+ * Pure Vite Security & SRI Plugin.
+ * 1. Accepts framework-agnostic security options (domain, imgSrc, etc.) and exposes virtual:rimelight-security-config.
+ * 2. Fetches and hashes external 3rd-party scripts/styles at build time.
+ * 3. Emits SRI hashes for locally bundled JS/CSS chunks (Nuxt-security style).
+ * 4. Exposes virtual:sri-manifest with a unified URL -> hash mapping.
+ */
+declare function security(options?: SecurityPluginOptions): RimelightSecurityPlugin;
+//#endregion
+export { RimelightSecurityPlugin, SecurityOptions, SecurityPluginOptions, buildCspHeader, security, security as sri };

package/dist/index.mjs

@@ -0,0 +1,67 @@
+import { t as buildCspHeader } from "./csp-DATUs3cP.mjs";
+import { createHash } from "node:crypto";
+//#region src/vite.ts
+const DEFAULT_RESOURCES = ["https://betterlytics.io/analytics.js"];
+function hashContent(buffer) {
+	return `sha384-${createHash("sha384").update(buffer).digest("base64")}`;
+}
+/**
+* Pure Vite Security & SRI Plugin.
+* 1. Accepts framework-agnostic security options (domain, imgSrc, etc.) and exposes virtual:rimelight-security-config.
+* 2. Fetches and hashes external 3rd-party scripts/styles at build time.
+* 3. Emits SRI hashes for locally bundled JS/CSS chunks (Nuxt-security style).
+* 4. Exposes virtual:sri-manifest with a unified URL -> hash mapping.
+*/
+function security(options = {}) {
+	const sriManifest = {};
+	const externalUrls = Array.from(/* @__PURE__ */ new Set([...DEFAULT_RESOURCES, ...options.resources || []]));
+	const sriVirtualId = "virtual:sri-manifest";
+	const resolvedSriVirtualId = "\0" + sriVirtualId;
+	const configVirtualId = "virtual:rimelight-security-config";
+	const resolvedConfigVirtualId = "\0" + configVirtualId;
+	return {
+		name: "vite-plugin-rimelight-security",
+		enforce: "post",
+		async buildStart() {
+			if (process.env.NODE_ENV === "development") return;
+			await Promise.all(externalUrls.map(async (url) => {
+				if (!url.startsWith("https://")) return;
+				try {
+					const parsed = new URL(url);
+					if (parsed.hostname.includes("*")) return;
+					const pathname = parsed.pathname;
+					if (pathname === "/" || pathname === "" || pathname.endsWith("/")) return;
+					const response = await fetch(url);
+					if (!response.ok) return;
+					const buffer = await response.arrayBuffer();
+					sriManifest[url] = hashContent(buffer);
+				} catch {}
+			}));
+		},
+		generateBundle(_outputOptions, bundle) {
+			for (const [fileName, chunk] of Object.entries(bundle)) {
+				if (!fileName.endsWith(".js") && !fileName.endsWith(".css")) continue;
+				let content;
+				if (chunk.type === "chunk") content = chunk.code;
+				else if (chunk.type === "asset") content = chunk.source;
+				if (content) {
+					const hash = hashContent(content);
+					sriManifest[`/${fileName.replace(/^\/+/, "")}`] = hash;
+					sriManifest[fileName] = hash;
+				}
+			}
+		},
+		resolveId(id) {
+			if (id === sriVirtualId) return resolvedSriVirtualId;
+			if (id === configVirtualId) return resolvedConfigVirtualId;
+			return null;
+		},
+		load(id) {
+			if (id === resolvedSriVirtualId) return `export const manifest = ${JSON.stringify(sriManifest)};`;
+			if (id === resolvedConfigVirtualId) return `export const config = ${JSON.stringify(options)};`;
+			return null;
+		}
+	};
+}
+//#endregion
+export { buildCspHeader, security, security as sri };

package/dist/middleware/index.d.mts

@@ -1,8 +1,10 @@
+import { t as SecurityOptions } from "../types-CY5GDm3Z.mjs";
 //#region src/middleware/security.d.ts
 /**
- * Security Middleware: Injects SRI integrity attributes and security headers.
+ * Universal Security Middleware for Hono and Web Standards (Fetch API).
+ * Injects security headers, CSP with per-request nonce, and SRI attributes.
  */
-declare const security: import("astro").MiddlewareHandler;
+declare function security(options?: SecurityOptions): (c: any, next: any) => Promise<Response | void>;
 //#endregion
 //#region src/middleware/dev-only.d.ts
 /**

package/dist/middleware/index.mjs

@@ -1,134 +1,131 @@
-import { defineMiddleware } from "astro:middleware";
+import { t as buildCspHeader } from "../csp-DATUs3cP.mjs";
 import { manifest } from "virtual:sri-manifest";
+import { config } from "virtual:rimelight-security-config";
 //#region src/middleware/security.ts
 function isManifestRecord(obj) {
 	return typeof obj === "object" && obj !== null && !Array.isArray(obj);
 }
-const manifest$1 = isManifestRecord(manifest) ? manifest : {};
-function assertManifest(obj) {
-	if (!obj || typeof obj !== "object") throw new Error("Expected manifest");
+function isConfigRecord(obj) {
+	return typeof obj === "object" && obj !== null && !Array.isArray(obj);
 }
-assertManifest(manifest$1);
-const manifestRegexes = Object.entries(manifest$1).map(([url, hash]) => ({
-	hash,
-	scriptRegex: new RegExp(`(<script[^>]+src=["']${url}["'][^>]*)(/?>)`, "g"),
-	linkRegex: new RegExp(`(<link[^>]+href=["']${url}["'][^>]*)(/?>)`, "g")
-}));
-function addSecurityHeaders(response, origin) {
-	try {
-		response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-		response.headers.set("X-Content-Type-Options", "nosniff");
-		response.headers.set("X-Frame-Options", "DENY");
-		response.headers.set("Cross-Origin-Resource-Policy", "same-origin");
-		response.headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
-		response.headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=(), usb=()");
-		response.headers.set("No-Vary-Search", "except=(\"q\" \"search\" \"locale\"), params=?1");
-		if (origin) response.headers.set("Link", [
-			`<${origin}/sitemap-index.xml>; rel="sitemap"`,
-			`<${origin}/llms.txt>; rel="llms"`,
-			`<${origin}/.well-known/api-catalog>; rel="api-catalog"`,
-			`<${origin}/rss.xml>; rel="alternate"; type="application/rss+xml"`
-		].join(", "));
-		return response;
-	} catch {
-		const headers = new Headers(response.headers);
-		headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-		headers.set("X-Content-Type-Options", "nosniff");
-		headers.set("X-Frame-Options", "DENY");
-		headers.set("Cross-Origin-Resource-Policy", "same-origin");
-		headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
-		headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=(), usb=()");
-		headers.set("No-Vary-Search", "except=(\"q\" \"search\" \"locale\"), params=?1");
-		if (origin) headers.set("Link", [
-			`<${origin}/sitemap-index.xml>; rel="sitemap"`,
-			`<${origin}/llms.txt>; rel="llms"`,
-			`<${origin}/.well-known/api-catalog>; rel="api-catalog"`,
-			`<${origin}/rss.xml>; rel="alternate"; type="application/rss+xml"`
-		].join(", "));
-		return new Response(response.body, {
-			status: response.status,
-			statusText: response.statusText,
-			headers
-		});
-	}
+const manifest$1 = isManifestRecord(manifest) ? manifest : {};
+const defaultPluginConfig = isConfigRecord(config) ? config : {};
+function applySecurityHeaders(response, options, origin, nonce) {
+	const cspHeader = buildCspHeader(options, nonce);
+	const headers = new Headers(response.headers);
+	headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+	headers.set("X-Content-Type-Options", "nosniff");
+	headers.set("X-Frame-Options", "DENY");
+	headers.set("Cross-Origin-Resource-Policy", "same-origin");
+	headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
+	headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=(), usb=()");
+	headers.set("No-Vary-Search", "except=(\"q\" \"search\" \"locale\"), params=?1");
+	if (cspHeader) headers.set("Content-Security-Policy", cspHeader);
+	if (origin) headers.set("Link", [
+		`<${origin}/sitemap-index.xml>; rel="sitemap"`,
+		`<${origin}/llms.txt>; rel="llms"`,
+		`<${origin}/.well-known/api-catalog>; rel="api-catalog"`,
+		`<${origin}/rss.xml>; rel="alternate"; type="application/rss+xml"`
+	].join(", "));
+	if (options.headers) for (const [key, value] of Object.entries(options.headers)) headers.set(key, value);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
 }
 /**
-* Security Middleware: Injects SRI integrity attributes and security headers.
+* Universal Security Middleware for Hono and Web Standards (Fetch API).
+* Injects security headers, CSP with per-request nonce, and SRI attributes.
 */
-const security = defineMiddleware(async (context, next) => {
-	const isProd = import.meta.env.PROD;
-	const isDev = import.meta.env.DEV;
-	const proto = context.request.headers.get("x-forwarded-proto");
-	if (isProd && proto === "http") {
-		const httpsUrl = context.request.url.replace(/^http:/, "https:");
-		return Response.redirect(httpsUrl, 301);
-	}
-	const response = await next();
-	if (!(response.headers.get("content-type") || "").includes("text/html")) return addSecurityHeaders(response, context.url.origin);
-	if (isDev) {
-		const cleanHeaders = new Headers(response.headers);
-		cleanHeaders.delete("content-security-policy");
+function security(options = {}) {
+	const mergedOptions = {
+		...defaultPluginConfig,
+		...options,
+		allowedDomains: [...defaultPluginConfig.allowedDomains || [], ...options.allowedDomains || []],
+		imgSrc: [...defaultPluginConfig.imgSrc || [], ...options.imgSrc || []],
+		connectSrc: [...defaultPluginConfig.connectSrc || [], ...options.connectSrc || []],
+		frameSrc: [...defaultPluginConfig.frameSrc || [], ...options.frameSrc || []],
+		scriptResources: [...defaultPluginConfig.scriptResources || [], ...options.scriptResources || []],
+		styleResources: [...defaultPluginConfig.styleResources || [], ...options.styleResources || []],
+		directives: {
+			...defaultPluginConfig.directives || {},
+			...options.directives || {}
+		},
+		headers: {
+			...defaultPluginConfig.headers || {},
+			...options.headers || {}
+		}
+	};
+	return async (c, next) => {
+		const isProd = import.meta.env?.PROD ?? process.env.NODE_ENV === "production";
+		const isDev = import.meta.env?.DEV ?? process.env.NODE_ENV === "development";
+		const req = c.req?.raw || c.request || c.req;
+		const proto = req?.headers?.get("x-forwarded-proto");
+		if (isProd && proto === "http" && req?.url) {
+			const httpsUrl = req.url.replace(/^http:/, "https:");
+			return Response.redirect(httpsUrl, 301);
+		}
+		await next();
+		const response = c.res;
+		if (!response) return;
+		const contentType = response.headers.get("content-type") || "";
+		const origin = req?.url ? new URL(req.url).origin : void 0;
+		if (!contentType.includes("text/html")) {
+			c.res = applySecurityHeaders(response, mergedOptions, origin);
+			return c.res;
+		}
+		if (isDev) {
+			c.res = applySecurityHeaders(response, {
+				...mergedOptions,
+				directives: {
+					...mergedOptions.directives,
+					"default-src": false
+				}
+			}, origin);
+			return c.res;
+		}
+		const nonce = crypto.randomUUID().replace(/-/g, "");
+		if (typeof HTMLRewriter !== "undefined") {
+			let rewriter = new HTMLRewriter();
+			rewriter = rewriter.on("script[src]", { element(el) {
+				const src = el.getAttribute("src");
+				if (src && manifest$1[src]) {
+					el.setAttribute("integrity", manifest$1[src]);
+					el.setAttribute("crossorigin", "anonymous");
+				}
+			} }).on("link[rel=\"stylesheet\"][href]", { element(el) {
+				const href = el.getAttribute("href");
+				if (href && manifest$1[href]) {
+					el.setAttribute("integrity", manifest$1[href]);
+					el.setAttribute("crossorigin", "anonymous");
+				}
+			} }).on("script", { element(el) {
+				el.setAttribute("nonce", nonce);
+			} }).on("head", { element(el) {
+				el.append(`<meta name="csp-nonce" content="${nonce}">`, { html: true });
+			} });
+			c.res = applySecurityHeaders(rewriter.transform(response), mergedOptions, origin, nonce);
+			return c.res;
+		}
 		let modifiedHtml = await response.text();
-		modifiedHtml = modifiedHtml.replace(/<meta\s[^>]*http-equiv\s*=\s*["']?content-security-policy[^>]*>/gi, "");
-		return addSecurityHeaders(new Response(modifiedHtml, {
-			status: response.status,
-			statusText: response.statusText,
-			headers: cleanHeaders
-		}), context.url.origin);
-	}
-	const nonce = crypto.randomUUID().replace(/-/g, "");
-	let cspHeader = response.headers.get("content-security-policy");
-	const newHeaders = new Headers(response.headers);
-	if (cspHeader) {
-		cspHeader = cspHeader.replace(/&#0*39;/g, "'").replace(/&#x0*27;/gi, "'").replace(/&quot;/g, "\"").replace(/&amp;/g, "&");
-		cspHeader = cspHeader.replace(/(script-src\s)/i, `$1'nonce-${nonce}' `);
-		newHeaders.set("content-security-policy", cspHeader);
-	}
-	if (typeof HTMLRewriter !== "undefined") {
-		let rewriter = new HTMLRewriter();
-		if (manifestRegexes.length > 0) rewriter = rewriter.on("script[src]", { element(el) {
-			const src = el.getAttribute("src");
-			if (src && manifest$1[src]) {
-				el.setAttribute("integrity", manifest$1[src]);
-				el.setAttribute("crossorigin", "anonymous");
-			}
-		} }).on("link[rel=\"stylesheet\"][href]", { element(el) {
-			const href = el.getAttribute("href");
-			if (href && manifest$1[href]) {
-				el.setAttribute("integrity", manifest$1[href]);
-				el.setAttribute("crossorigin", "anonymous");
-			}
-		} });
-		rewriter = rewriter.on("script", { element(el) {
-			el.setAttribute("nonce", nonce);
-		} });
-		rewriter = rewriter.on("head", { element(el) {
-			el.append(`<meta name="csp-nonce" content="${nonce}">`, { html: true });
-		} });
-		rewriter = rewriter.on("meta[http-equiv=\"content-security-policy\" i]", { element(el) {
-			el.remove();
-		} });
-		return addSecurityHeaders(rewriter.transform(new Response(response.body, {
+		modifiedHtml = modifiedHtml.replace(/(<head(?:\s[^>]*)?>)/i, `$1<meta name="csp-nonce" content="${nonce}">`);
+		modifiedHtml = modifiedHtml.replace(/<script(\s[^>]*)?>/gi, (_match, attrs = "") => `<script${attrs} nonce="${nonce}">`);
+		for (const [url, hash] of Object.entries(manifest$1)) {
+			if (!hash) continue;
+			const scriptRegex = new RegExp(`(<script[^>]+src=["']${url}["'][^>]*)(/?>)`, "g");
+			const linkRegex = new RegExp(`(<link[^>]+href=["']${url}["'][^>]*)(/?>)`, "g");
+			modifiedHtml = modifiedHtml.replace(scriptRegex, `$1 integrity="${hash}" crossorigin="anonymous"$2`);
+			modifiedHtml = modifiedHtml.replace(linkRegex, `$1 integrity="${hash}" crossorigin="anonymous"$2`);
+		}
+		c.res = applySecurityHeaders(new Response(modifiedHtml, {
 			status: response.status,
 			statusText: response.statusText,
-			headers: newHeaders
-		})), context.url.origin);
-	}
-	let modifiedHtml = await response.text();
-	modifiedHtml = modifiedHtml.replace(/<meta\s[^>]*http-equiv\s*=\s*["']?content-security-policy[^>]*>/gi, "");
-	modifiedHtml = modifiedHtml.replace(/(<head(?:\s[^>]*)?>)/i, `$1<meta name="csp-nonce" content="${nonce}">`);
-	modifiedHtml = modifiedHtml.replace(/<script(\s[^>]*)?>/gi, (_match, attrs = "") => `<script${attrs} nonce="${nonce}">`);
-	for (const { hash, scriptRegex, linkRegex } of manifestRegexes) {
-		if (!hash) continue;
-		modifiedHtml = modifiedHtml.replace(scriptRegex, `$1 integrity="${hash}" crossorigin="anonymous"$2`);
-		modifiedHtml = modifiedHtml.replace(linkRegex, `$1 integrity="${hash}" crossorigin="anonymous"$2`);
-	}
-	return addSecurityHeaders(new Response(modifiedHtml, {
-		status: response.status,
-		statusText: response.statusText,
-		headers: newHeaders
-	}), context.url.origin);
-});
+			headers: response.headers
+		}), mergedOptions, origin, nonce);
+		return c.res;
+	};
+}
 //#endregion
 //#region src/middleware/dev-only.ts
 /**

package/dist/types-CY5GDm3Z.d.mts

@@ -0,0 +1,47 @@
+//#region src/types.d.ts
+interface SecurityOptions {
+  /**
+   * The base domain name for this project (e.g. "idantity.me") used to autoconfigure
+   * standard allowed domains and img-src CDN targets.
+   */
+  domain?: string;
+  /**
+   * Additional Allowed Domains for origin checking or cross-domain rules
+   */
+  allowedDomains?: string[];
+  /**
+   * Additional sources to allow for img-src directive
+   */
+  imgSrc?: string[];
+  /**
+   * Additional sources to allow for connect-src directive
+   */
+  connectSrc?: string[];
+  /**
+   * Additional sources to allow for frame-src directive
+   */
+  frameSrc?: string[];
+  /**
+   * Additional script resources / origins (e.g. "https://betterlytics.io")
+   */
+  scriptResources?: string[];
+  /**
+   * Additional style resources / origins
+   */
+  styleResources?: string[];
+  /**
+   * Enables the 'require-trusted-types-for' directive
+   */
+  trustedTypes?: boolean;
+  /**
+   * Granular CSP directive overrides. Values are arrays of directive tokens, e.g.:
+   * { "frame-ancestors": ["'self'"] }
+   */
+  directives?: Record<string, string[] | string | boolean>;
+  /**
+   * Custom headers to set on every response or overrides
+   */
+  headers?: Record<string, string>;
+}
+//#endregion
+export { SecurityOptions as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rimelight/security",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "private": false,
   "description": "Rimelight Entertainment's Security Package",
   "homepage": "https://rimelight.com/docs",
@@ -22,8 +22,8 @@
   "type": "module",
   "exports": {
     ".": {
-      "types": "./dist/integrations/index.d.mts",
-      "import": "./dist/integrations/index.mjs"
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs"
     },
     "./middleware": {
       "types": "./dist/middleware/index.d.mts",

package/dist/integrations/index.d.mts

@@ -1,9 +0,0 @@
-import { AstroIntegration } from "astro";
-//#region src/integrations/sri.d.ts
-/**
- * Astro SRI Integration Fetches external scripts at build-time and generates hashes for the SSR
- * middleware.
- */
-declare function sri(): AstroIntegration;
-//#endregion
-export { sri };

package/dist/integrations/index.mjs

@@ -1,81 +0,0 @@
-import { createHash } from "node:crypto";
-//#region src/integrations/sri.ts
-function assertSRIConfig(obj) {
-	if (!obj || typeof obj !== "object") throw new Error("Expected config");
-}
-/**
-* Astro SRI Integration Fetches external scripts at build-time and generates hashes for the SSR
-* middleware.
-*/
-function sri() {
-	const sriManifest = {};
-	return {
-		name: "@rimelight/security",
-		hooks: { "astro:config:setup": async ({ updateConfig, config, command, logger }) => {
-			if (command === "dev") logger.info("Skipping SRI discovery in development mode.");
-			else {
-				assertSRIConfig(config);
-				const security = config.security;
-				const externalUrls = [];
-				if (security?.csp?.scriptDirective?.resources) {
-					for (const resource of security.csp.scriptDirective.resources) if (resource.startsWith("https://")) try {
-						const parsed = new URL(resource);
-						if (parsed.hostname.includes("*")) continue;
-						const path = parsed.pathname;
-						if (path === "/" || path === "" || path.endsWith("/")) continue;
-						externalUrls.push(resource);
-					} catch {}
-				}
-				if (externalUrls.length > 0) {
-					const results = await Promise.all(externalUrls.map(async (url) => {
-						try {
-							const response = await fetch(url);
-							if (!response.ok) throw new Error(`HTTP ${response.status}`);
-							const buffer = await response.arrayBuffer();
-							const hash = createHash("sha384").update(Buffer.from(buffer)).digest("base64");
-							sriManifest[url] = `sha384-${hash}`;
-							return {
-								url,
-								success: true
-							};
-						} catch (err) {
-							return {
-								url,
-								success: false,
-								error: err instanceof Error ? err.message : String(err)
-							};
-						}
-					}));
-					const succeeded = results.filter((r) => r.success).map((r) => r.url);
-					const failed = results.filter((r) => !r.success);
-					if (failed.length === 0) logger.info(`SRI Discovery: successfully hashed ${succeeded.length} external resource(s).\n      Succeeded:\n` + succeeded.map((url) => `      - ${url}`).join("\n"));
-					else {
-						const succeededBlock = succeeded.length > 0 ? `      Succeeded:\n` + succeeded.map((url) => `      - ${url}`).join("\n") : "";
-						const failedBlock = `      Failed:\n` + failed.map((f) => `      - ${f.url} (${f.error})`).join("\n");
-						const parts = [
-							`SRI Discovery: hashed ${succeeded.length}/${results.length} external resource(s).`,
-							succeededBlock,
-							failedBlock
-						].filter(Boolean);
-						logger.warn(parts.join("\n\n"));
-					}
-				} else logger.info("SRI Discovery: no external resources found to hash.");
-			}
-			const virtualModuleId = "virtual:sri-manifest";
-			const resolvedVirtualModuleId = "\0" + virtualModuleId;
-			updateConfig({ vite: { plugins: [{
-				name: "vite-plugin-sri-manifest",
-				resolveId(id) {
-					if (id === virtualModuleId) return resolvedVirtualModuleId;
-					return null;
-				},
-				load(id) {
-					if (id === resolvedVirtualModuleId) return `export const manifest = ${JSON.stringify(sriManifest)};`;
-					return null;
-				}
-			}] } });
-		} }
-	};
-}
-//#endregion
-export { sri };