@rimelight/security 0.0.7 → 0.0.8

package/dist/config/index.d.mts

@@ -1,3 +1,3 @@
-import { t as SecurityOptions } from "../types-CY5GDm3Z.mjs";
-import { t as buildCspHeader } from "../csp-DM1NVenC.mjs";
+import { t as SecurityOptions } from "../types-Bg8w94Fn.mjs";
+import { t as buildCspHeader } from "../csp-ESHHTg-n.mjs";
 export { SecurityOptions, buildCspHeader };

package/dist/{csp-DM1NVenC.d.mts → csp-ESHHTg-n.d.mts}

@@ -1,4 +1,4 @@
-import { t as SecurityOptions } from "./types-CY5GDm3Z.mjs";
+import { t as SecurityOptions } from "./types-Bg8w94Fn.mjs";
 //#region src/csp.d.ts
 /**
  * Builds the Content-Security-Policy header string dynamically for a given request nonce.

package/dist/index.d.mts

@@ -1,7 +1,7 @@
-import { t as SecurityOptions } from "./types-CY5GDm3Z.mjs";
-import { t as buildCspHeader } from "./csp-DM1NVenC.mjs";
+import { t as SecurityOptions } from "./types-Bg8w94Fn.mjs";
+import { t as buildCspHeader } from "./csp-ESHHTg-n.mjs";
 //#region src/vite.d.ts
-interface RimelightSecurityPlugin {
+export interface RimelightSecurityPlugin {
   name: string;
   enforce?: "pre" | "post";
   resolveId?: (id: string) => string | null | undefined;
@@ -10,19 +10,18 @@ interface RimelightSecurityPlugin {
   generateBundle?: (options: any, bundle: Record<string, any>) => Promise<void> | void;
   [key: string]: any;
 }
-interface SecurityPluginOptions extends SecurityOptions {
+export interface SecurityPluginOptions extends SecurityOptions {
   /**
    * Additional external script/style URLs to fetch and hash for SRI at build time.
    */
   resources?: string[];
 }
 /**
- * Pure Vite Security & SRI Plugin.
- * 1. Accepts framework-agnostic security options (domain, imgSrc, etc.) and exposes virtual:rimelight-security-config.
- * 2. Fetches and hashes external 3rd-party scripts/styles at build time.
- * 3. Emits SRI hashes for locally bundled JS/CSS chunks (Nuxt-security style).
- * 4. Exposes virtual:sri-manifest with a unified URL -> hash mapping.
+ * Pure Vite Security & SRI Plugin. 1. Accepts framework-agnostic security options (domain, imgSrc,
+ * etc.) and exposes virtual:rimelight-security-config. 2. Fetches and hashes external 3rd-party
+ * scripts/styles at build time. 3. Emits SRI hashes for locally bundled JS/CSS chunks
+ * (Nuxt-security style). 4. Exposes virtual:sri-manifest with a unified URL -> hash mapping.
  */
-declare function security(options?: SecurityPluginOptions): RimelightSecurityPlugin;
+export declare function security(options?: SecurityPluginOptions): RimelightSecurityPlugin;
 //#endregion
-export { RimelightSecurityPlugin, SecurityOptions, SecurityPluginOptions, buildCspHeader, security, security as sri };
+export { SecurityOptions, buildCspHeader, security as sri };

package/dist/index.mjs

@@ -6,11 +6,10 @@ function hashContent(buffer) {
 	return `sha384-${createHash("sha384").update(buffer).digest("base64")}`;
 }
 /**
-* Pure Vite Security & SRI Plugin.
-* 1. Accepts framework-agnostic security options (domain, imgSrc, etc.) and exposes virtual:rimelight-security-config.
-* 2. Fetches and hashes external 3rd-party scripts/styles at build time.
-* 3. Emits SRI hashes for locally bundled JS/CSS chunks (Nuxt-security style).
-* 4. Exposes virtual:sri-manifest with a unified URL -> hash mapping.
+* Pure Vite Security & SRI Plugin. 1. Accepts framework-agnostic security options (domain, imgSrc,
+* etc.) and exposes virtual:rimelight-security-config. 2. Fetches and hashes external 3rd-party
+* scripts/styles at build time. 3. Emits SRI hashes for locally bundled JS/CSS chunks
+* (Nuxt-security style). 4. Exposes virtual:sri-manifest with a unified URL -> hash mapping.
 */
 function security(options = {}) {
 	const sriManifest = {};
@@ -23,7 +22,7 @@ function security(options = {}) {
 		name: "vite-plugin-rimelight-security",
 		enforce: "post",
 		async buildStart() {
-			if (process.env.NODE_ENV === "development") return;
+			if (process.env["NODE_ENV"] === "development") return;
 			await Promise.all(externalUrls.map(async (url) => {
 				if (!url.startsWith("https://")) return;
 				try {

package/dist/middleware/index.d.mts

@@ -1,10 +1,10 @@
-import { t as SecurityOptions } from "../types-CY5GDm3Z.mjs";
+import { t as SecurityOptions } from "../types-Bg8w94Fn.mjs";
 //#region src/middleware/security.d.ts
 /**
- * Universal Security Middleware for Hono and Web Standards (Fetch API).
- * Injects security headers, CSP with per-request nonce, and SRI attributes.
+ * Universal Security Middleware for Hono and Web Standards (Fetch API). Injects security headers,
+ * CSP with per-request nonce, and SRI attributes.
  */
-declare function security(options?: SecurityOptions): (c: any, next: any) => Promise<Response | void>;
+export declare function security(options?: SecurityOptions): (c: any, next: any) => Promise<Response | void>;
 //#endregion
 //#region src/middleware/dev-only.d.ts
 /**
@@ -17,6 +17,5 @@ declare function security(options?: SecurityOptions): (c: any, next: any) => Pro
  *   import { devOnly } from "@rimelight/security/middleware"
  *   app.use(devOnly)
  */
-declare const devOnly: (c: any, next: any) => Promise<Response>;
-//#endregion
-export { devOnly, security };
+export declare const devOnly: (c: any, next: any) => Promise<Response>;
+//#endregion

package/dist/middleware/index.mjs

@@ -10,8 +10,15 @@ function isConfigRecord(obj) {
 }
 const manifest$1 = isManifestRecord(manifest) ? manifest : {};
 const defaultPluginConfig = isConfigRecord(config) ? config : {};
-function applySecurityHeaders(response, options, origin, nonce) {
+function applySecurityHeaders(response, options, origin, nonce, reportOnlyOptions) {
 	const cspHeader = buildCspHeader(options, nonce);
+	const reportOnlyHeader = reportOnlyOptions ? buildCspHeader({
+		...reportOnlyOptions,
+		directives: {
+			...reportOnlyOptions.directives,
+			"upgrade-insecure-requests": false
+		}
+	}, nonce) : void 0;
 	const headers = new Headers(response.headers);
 	headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
 	headers.set("X-Content-Type-Options", "nosniff");
@@ -21,6 +28,7 @@ function applySecurityHeaders(response, options, origin, nonce) {
 	headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=(), usb=()");
 	headers.set("No-Vary-Search", "except=(\"q\" \"search\" \"locale\"), params=?1");
 	if (cspHeader) headers.set("Content-Security-Policy", cspHeader);
+	if (reportOnlyHeader) headers.set("Content-Security-Policy-Report-Only", reportOnlyHeader);
 	if (origin) headers.set("Link", [
 		`<${origin}/sitemap-index.xml>; rel="sitemap"`,
 		`<${origin}/llms.txt>; rel="llms"`,
@@ -35,8 +43,8 @@ function applySecurityHeaders(response, options, origin, nonce) {
 	});
 }
 /**
-* Universal Security Middleware for Hono and Web Standards (Fetch API).
-* Injects security headers, CSP with per-request nonce, and SRI attributes.
+* Universal Security Middleware for Hono and Web Standards (Fetch API). Injects security headers,
+* CSP with per-request nonce, and SRI attributes.
 */
 function security(options = {}) {
 	const mergedOptions = {
@@ -49,17 +57,17 @@ function security(options = {}) {
 		scriptResources: [...defaultPluginConfig.scriptResources || [], ...options.scriptResources || []],
 		styleResources: [...defaultPluginConfig.styleResources || [], ...options.styleResources || []],
 		directives: {
-			...defaultPluginConfig.directives || {},
-			...options.directives || {}
+			...defaultPluginConfig.directives,
+			...options.directives
 		},
 		headers: {
-			...defaultPluginConfig.headers || {},
-			...options.headers || {}
+			...defaultPluginConfig.headers,
+			...options.headers
 		}
 	};
 	return async (c, next) => {
-		const isProd = import.meta.env?.PROD ?? process.env.NODE_ENV === "production";
-		const isDev = import.meta.env?.DEV ?? process.env.NODE_ENV === "development";
+		const isProd = import.meta.env?.PROD ?? process.env["NODE_ENV"] === "production";
+		const isDev = import.meta.env?.DEV ?? process.env["NODE_ENV"] === "development";
 		const req = c.req?.raw || c.request || c.req;
 		const proto = req?.headers?.get("x-forwarded-proto");
 		if (isProd && proto === "http" && req?.url) {
@@ -76,13 +84,55 @@ function security(options = {}) {
 			return c.res;
 		}
 		if (isDev) {
-			c.res = applySecurityHeaders(response, {
+			const devDirectives = {
+				...mergedOptions.directives,
+				"default-src": false,
+				"script-src": [
+					"'self'",
+					"'unsafe-inline'",
+					"'unsafe-eval'",
+					"https:",
+					"http:",
+					"ws:",
+					"wss:"
+				],
+				"style-src": [
+					"'self'",
+					"'unsafe-inline'",
+					"https:",
+					"http:"
+				],
+				"connect-src": [
+					"'self'",
+					"ws:",
+					"wss:",
+					"http:",
+					"https:"
+				],
+				"img-src": [
+					"'self'",
+					"data:",
+					"blob:",
+					"https:",
+					"http:"
+				]
+			};
+			const reportOnlySimulation = {
 				...mergedOptions,
 				directives: {
 					...mergedOptions.directives,
-					"default-src": false
+					"style-src": ["'self'", "'unsafe-inline'"],
+					"script-src": [
+						"'self'",
+						"'unsafe-inline'",
+						"'unsafe-eval'"
+					]
 				}
-			}, origin);
+			};
+			c.res = applySecurityHeaders(response, {
+				...mergedOptions,
+				directives: devDirectives
+			}, origin, void 0, reportOnlySimulation);
 			return c.res;
 		}
 		const nonce = crypto.randomUUID().replace(/-/g, "");

package/dist/{types-CY5GDm3Z.d.mts → types-Bg8w94Fn.d.mts}

@@ -1,8 +1,8 @@
 //#region src/types.d.ts
 interface SecurityOptions {
   /**
-   * The base domain name for this project (e.g. "idantity.me") used to autoconfigure
-   * standard allowed domains and img-src CDN targets.
+   * The base domain name for this project (e.g. "idantity.me") used to autoconfigure standard
+   * allowed domains and img-src CDN targets.
    */
   domain?: string;
   /**
@@ -34,8 +34,8 @@ interface SecurityOptions {
    */
   trustedTypes?: boolean;
   /**
-   * Granular CSP directive overrides. Values are arrays of directive tokens, e.g.:
-   * { "frame-ancestors": ["'self'"] }
+   * Granular CSP directive overrides. Values are arrays of directive tokens, e.g.: {
+   * "frame-ancestors": ["'self'"] }
    */
   directives?: Record<string, string[] | string | boolean>;
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rimelight/security",
-  "version": "0.0.7",
+  "version": "0.0.8",
   "private": false,
   "description": "Rimelight Entertainment's Security Package",
   "homepage": "https://rimelight.com/docs",
@@ -40,8 +40,8 @@
   },
   "devDependencies": {
     "@astrojs/check": "0.9.10",
-    "@rimelight/config": "0.0.4",
-    "astro": "7.3.1",
+    "@rimelight/config": "0.0.5",
+    "astro": "7.3.2",
     "typescript": "6.0.3"
   },
   "peerDependencies": {

package/src/components/SecurityHead.astro

@@ -121,3 +121,46 @@
     });
   })();
 </script>
+
+<!-- Development CSP Violation Reporter -->
+{import.meta.env.DEV && (
+  <script>
+    (function() {
+      // Ignore known internal dev-only tooling noise
+      function isDevInternal(e: SecurityPolicyViolationEvent): boolean {
+        const file = e.sourceFile || "";
+        const sample = e.sample || "";
+        const blockedUri = e.blockedURI || "";
+
+        if (file.includes("dev-toolbar") || file.includes("toolbar-") || file.includes("astro_runtime_client")) return true;
+        if (file.includes("vite/client") || file.includes("@vite/client") || file.includes("/@fs/") || file.includes("/@id/")) return true;
+        if (file.includes("node_modules/.vite") || file.includes("client:")) return true;
+        if (blockedUri.startsWith("ws://") || blockedUri.startsWith("wss://")) return true;
+        if (sample.includes("--astro-dev-toolbar") || sample.includes("astro-dev-toolbar")) return true;
+        return false;
+      }
+
+      const reported = new Set<string>();
+
+      window.addEventListener("securitypolicyviolation", function(e) {
+        if (e.disposition !== "report") return; // Only notify on report-only (prod violation simulation)
+        if (isDevInternal(e)) return;
+
+        const key = `${e.effectiveDirective}:${e.blockedURI || e.sample || ""}`;
+        if (reported.has(key)) return;
+        reported.add(key);
+
+        console.warn(
+          `%c[Rimelight Security]%c Allowed in DEV, but will fail in PRODUCTION:\n` +
+          `Directive: ${e.effectiveDirective}\n` +
+          (e.blockedURI ? `Blocked URI: ${e.blockedURI}\n` : "") +
+          (e.sourceFile ? `Source: ${e.sourceFile}:${e.lineNumber || 0}\n` : "") +
+          (e.sample ? `Sample: ${e.sample.slice(0, 100)}\n` : "") +
+          `Fix: Add to imgSrc, scriptResources, styleResources or use nonces in astro.config.ts`,
+          "background: #e11d48; color: white; padding: 2px 6px; border-radius: 4px; font-weight: bold;",
+          "color: inherit; font-weight: normal;"
+        );
+      });
+    })();
+  </script>
+)}