@rimelight/security 0.0.8 → 0.0.9

package/dist/config/index.d.mts

@@ -1,3 +1,3 @@
-import { t as SecurityOptions } from "../types-Bg8w94Fn.mjs";
-import { t as buildCspHeader } from "../csp-ESHHTg-n.mjs";
+import { t as SecurityOptions } from "../types-t69O3m_O.mjs";
+import { buildCspHeader } from "../csp.mjs";
 export { SecurityOptions, buildCspHeader };

package/dist/config/index.mjs

@@ -1,2 +1,3 @@
-import { t as buildCspHeader } from "../csp-DATUs3cP.mjs";
+import "../types.mjs";
+import { buildCspHeader } from "../csp.mjs";
 export { buildCspHeader };

package/dist/csp.d.mts

@@ -0,0 +1,7 @@
+import { t as SecurityOptions } from "./types-t69O3m_O.mjs";
+//#region src/csp.d.ts
+/**
+ * Builds the Content-Security-Policy header string dynamically for a given request nonce.
+ */
+export declare function buildCspHeader(options?: SecurityOptions, nonce?: string): string;
+//#endregion

package/dist/{csp-DATUs3cP.mjs → csp.mjs}

@@ -36,6 +36,7 @@ function buildCspHeader(options = {}, nonce) {
 			"'sha256-ZuMSxilKU+4KIM8LWna4lqBEKzd6WaiAjz6gamhm7zM='",
 			...options.scriptResources || []
 		])),
+		"script-src-attr": ["'none'"],
 		"style-src": Array.from(/* @__PURE__ */ new Set([
 			"'self'",
 			"'sha256-SKuaOGnks7NAUq37nvw1PfGEE0lOAs5ERbiYRbGFIbw='",
@@ -60,4 +61,4 @@ function buildCspHeader(options = {}, nonce) {
 	}).join("; ");
 }
 //#endregion
-export { buildCspHeader as t };
+export { buildCspHeader };

package/dist/index.d.mts

@@ -1,27 +1,4 @@
-import { t as SecurityOptions } from "./types-Bg8w94Fn.mjs";
-import { t as buildCspHeader } from "./csp-ESHHTg-n.mjs";
-//#region src/vite.d.ts
-export interface RimelightSecurityPlugin {
-  name: string;
-  enforce?: "pre" | "post";
-  resolveId?: (id: string) => string | null | undefined;
-  load?: (id: string) => string | null | undefined;
-  buildStart?: () => Promise<void> | void;
-  generateBundle?: (options: any, bundle: Record<string, any>) => Promise<void> | void;
-  [key: string]: any;
-}
-export interface SecurityPluginOptions extends SecurityOptions {
-  /**
-   * Additional external script/style URLs to fetch and hash for SRI at build time.
-   */
-  resources?: string[];
-}
-/**
- * Pure Vite Security & SRI Plugin. 1. Accepts framework-agnostic security options (domain, imgSrc,
- * etc.) and exposes virtual:rimelight-security-config. 2. Fetches and hashes external 3rd-party
- * scripts/styles at build time. 3. Emits SRI hashes for locally bundled JS/CSS chunks
- * (Nuxt-security style). 4. Exposes virtual:sri-manifest with a unified URL -> hash mapping.
- */
-export declare function security(options?: SecurityPluginOptions): RimelightSecurityPlugin;
-//#endregion
-export { SecurityOptions, buildCspHeader, security as sri };
+import { t as SecurityOptions } from "./types-t69O3m_O.mjs";
+import { buildCspHeader } from "./csp.mjs";
+import { RimelightSecurityPlugin, SecurityPluginOptions, security } from "./vite.mjs";
+export { RimelightSecurityPlugin, SecurityOptions, SecurityPluginOptions, buildCspHeader, security, security as sri };

package/dist/index.mjs

@@ -1,66 +1,4 @@
-import { t as buildCspHeader } from "./csp-DATUs3cP.mjs";
-import { createHash } from "node:crypto";
-//#region src/vite.ts
-const DEFAULT_RESOURCES = ["https://betterlytics.io/analytics.js"];
-function hashContent(buffer) {
-	return `sha384-${createHash("sha384").update(buffer).digest("base64")}`;
-}
-/**
-* Pure Vite Security & SRI Plugin. 1. Accepts framework-agnostic security options (domain, imgSrc,
-* etc.) and exposes virtual:rimelight-security-config. 2. Fetches and hashes external 3rd-party
-* scripts/styles at build time. 3. Emits SRI hashes for locally bundled JS/CSS chunks
-* (Nuxt-security style). 4. Exposes virtual:sri-manifest with a unified URL -> hash mapping.
-*/
-function security(options = {}) {
-	const sriManifest = {};
-	const externalUrls = Array.from(/* @__PURE__ */ new Set([...DEFAULT_RESOURCES, ...options.resources || []]));
-	const sriVirtualId = "virtual:sri-manifest";
-	const resolvedSriVirtualId = "\0" + sriVirtualId;
-	const configVirtualId = "virtual:rimelight-security-config";
-	const resolvedConfigVirtualId = "\0" + configVirtualId;
-	return {
-		name: "vite-plugin-rimelight-security",
-		enforce: "post",
-		async buildStart() {
-			if (process.env["NODE_ENV"] === "development") return;
-			await Promise.all(externalUrls.map(async (url) => {
-				if (!url.startsWith("https://")) return;
-				try {
-					const parsed = new URL(url);
-					if (parsed.hostname.includes("*")) return;
-					const pathname = parsed.pathname;
-					if (pathname === "/" || pathname === "" || pathname.endsWith("/")) return;
-					const response = await fetch(url);
-					if (!response.ok) return;
-					const buffer = await response.arrayBuffer();
-					sriManifest[url] = hashContent(buffer);
-				} catch {}
-			}));
-		},
-		generateBundle(_outputOptions, bundle) {
-			for (const [fileName, chunk] of Object.entries(bundle)) {
-				if (!fileName.endsWith(".js") && !fileName.endsWith(".css")) continue;
-				let content;
-				if (chunk.type === "chunk") content = chunk.code;
-				else if (chunk.type === "asset") content = chunk.source;
-				if (content) {
-					const hash = hashContent(content);
-					sriManifest[`/${fileName.replace(/^\/+/, "")}`] = hash;
-					sriManifest[fileName] = hash;
-				}
-			}
-		},
-		resolveId(id) {
-			if (id === sriVirtualId) return resolvedSriVirtualId;
-			if (id === configVirtualId) return resolvedConfigVirtualId;
-			return null;
-		},
-		load(id) {
-			if (id === resolvedSriVirtualId) return `export const manifest = ${JSON.stringify(sriManifest)};`;
-			if (id === resolvedConfigVirtualId) return `export const config = ${JSON.stringify(options)};`;
-			return null;
-		}
-	};
-}
-//#endregion
+import "./types.mjs";
+import { buildCspHeader } from "./csp.mjs";
+import { security } from "./vite.mjs";
 export { buildCspHeader, security, security as sri };

package/dist/middleware/dev-only.d.mts

@@ -0,0 +1,13 @@
+//#region src/middleware/dev-only.d.ts
+/**
+ * Hono middleware that blocks any path containing `/dev/` in non-development environments. Mount
+ * this early in your Hono app (before API routes and Astro pages) so it covers both `/dev/` page
+ * routes and `/api/dev/` API routes in a single place.
+ *
+ * @example
+ *   // fetch.ts
+ *   import { devOnly } from "@rimelight/security/middleware"
+ *   app.use(devOnly)
+ */
+export declare const devOnly: (c: any, next: any) => Promise<Response>;
+//#endregion

package/dist/middleware/dev-only.mjs

@@ -0,0 +1,17 @@
+//#region src/middleware/dev-only.ts
+/**
+* Hono middleware that blocks any path containing `/dev/` in non-development environments. Mount
+* this early in your Hono app (before API routes and Astro pages) so it covers both `/dev/` page
+* routes and `/api/dev/` API routes in a single place.
+*
+* @example
+*   // fetch.ts
+*   import { devOnly } from "@rimelight/security/middleware"
+*   app.use(devOnly)
+*/
+const devOnly = async (c, next) => {
+	if (!import.meta.env.DEV && c.req.path.includes("/dev/")) return c.notFound();
+	return next();
+};
+//#endregion
+export { devOnly };

package/dist/middleware/index.d.mts

@@ -1,21 +1,3 @@
-import { t as SecurityOptions } from "../types-Bg8w94Fn.mjs";
-//#region src/middleware/security.d.ts
-/**
- * Universal Security Middleware for Hono and Web Standards (Fetch API). Injects security headers,
- * CSP with per-request nonce, and SRI attributes.
- */
-export declare function security(options?: SecurityOptions): (c: any, next: any) => Promise<Response | void>;
-//#endregion
-//#region src/middleware/dev-only.d.ts
-/**
- * Hono middleware that blocks any path containing `/dev/` in non-development environments. Mount
- * this early in your Hono app (before API routes and Astro pages) so it covers both `/dev/` page
- * routes and `/api/dev/` API routes in a single place.
- *
- * @example
- *   // fetch.ts
- *   import { devOnly } from "@rimelight/security/middleware"
- *   app.use(devOnly)
- */
-export declare const devOnly: (c: any, next: any) => Promise<Response>;
-//#endregion
+import { devOnly } from "./dev-only.mjs";
+import { security } from "./security.mjs";
+export { devOnly, security };

package/dist/middleware/index.mjs

@@ -1,196 +1,3 @@
-import { t as buildCspHeader } from "../csp-DATUs3cP.mjs";
-import { manifest } from "virtual:sri-manifest";
-import { config } from "virtual:rimelight-security-config";
-//#region src/middleware/security.ts
-function isManifestRecord(obj) {
-	return typeof obj === "object" && obj !== null && !Array.isArray(obj);
-}
-function isConfigRecord(obj) {
-	return typeof obj === "object" && obj !== null && !Array.isArray(obj);
-}
-const manifest$1 = isManifestRecord(manifest) ? manifest : {};
-const defaultPluginConfig = isConfigRecord(config) ? config : {};
-function applySecurityHeaders(response, options, origin, nonce, reportOnlyOptions) {
-	const cspHeader = buildCspHeader(options, nonce);
-	const reportOnlyHeader = reportOnlyOptions ? buildCspHeader({
-		...reportOnlyOptions,
-		directives: {
-			...reportOnlyOptions.directives,
-			"upgrade-insecure-requests": false
-		}
-	}, nonce) : void 0;
-	const headers = new Headers(response.headers);
-	headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-	headers.set("X-Content-Type-Options", "nosniff");
-	headers.set("X-Frame-Options", "DENY");
-	headers.set("Cross-Origin-Resource-Policy", "same-origin");
-	headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
-	headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=(), usb=()");
-	headers.set("No-Vary-Search", "except=(\"q\" \"search\" \"locale\"), params=?1");
-	if (cspHeader) headers.set("Content-Security-Policy", cspHeader);
-	if (reportOnlyHeader) headers.set("Content-Security-Policy-Report-Only", reportOnlyHeader);
-	if (origin) headers.set("Link", [
-		`<${origin}/sitemap-index.xml>; rel="sitemap"`,
-		`<${origin}/llms.txt>; rel="llms"`,
-		`<${origin}/.well-known/api-catalog>; rel="api-catalog"`,
-		`<${origin}/rss.xml>; rel="alternate"; type="application/rss+xml"`
-	].join(", "));
-	if (options.headers) for (const [key, value] of Object.entries(options.headers)) headers.set(key, value);
-	return new Response(response.body, {
-		status: response.status,
-		statusText: response.statusText,
-		headers
-	});
-}
-/**
-* Universal Security Middleware for Hono and Web Standards (Fetch API). Injects security headers,
-* CSP with per-request nonce, and SRI attributes.
-*/
-function security(options = {}) {
-	const mergedOptions = {
-		...defaultPluginConfig,
-		...options,
-		allowedDomains: [...defaultPluginConfig.allowedDomains || [], ...options.allowedDomains || []],
-		imgSrc: [...defaultPluginConfig.imgSrc || [], ...options.imgSrc || []],
-		connectSrc: [...defaultPluginConfig.connectSrc || [], ...options.connectSrc || []],
-		frameSrc: [...defaultPluginConfig.frameSrc || [], ...options.frameSrc || []],
-		scriptResources: [...defaultPluginConfig.scriptResources || [], ...options.scriptResources || []],
-		styleResources: [...defaultPluginConfig.styleResources || [], ...options.styleResources || []],
-		directives: {
-			...defaultPluginConfig.directives,
-			...options.directives
-		},
-		headers: {
-			...defaultPluginConfig.headers,
-			...options.headers
-		}
-	};
-	return async (c, next) => {
-		const isProd = import.meta.env?.PROD ?? process.env["NODE_ENV"] === "production";
-		const isDev = import.meta.env?.DEV ?? process.env["NODE_ENV"] === "development";
-		const req = c.req?.raw || c.request || c.req;
-		const proto = req?.headers?.get("x-forwarded-proto");
-		if (isProd && proto === "http" && req?.url) {
-			const httpsUrl = req.url.replace(/^http:/, "https:");
-			return Response.redirect(httpsUrl, 301);
-		}
-		await next();
-		const response = c.res;
-		if (!response) return;
-		const contentType = response.headers.get("content-type") || "";
-		const origin = req?.url ? new URL(req.url).origin : void 0;
-		if (!contentType.includes("text/html")) {
-			c.res = applySecurityHeaders(response, mergedOptions, origin);
-			return c.res;
-		}
-		if (isDev) {
-			const devDirectives = {
-				...mergedOptions.directives,
-				"default-src": false,
-				"script-src": [
-					"'self'",
-					"'unsafe-inline'",
-					"'unsafe-eval'",
-					"https:",
-					"http:",
-					"ws:",
-					"wss:"
-				],
-				"style-src": [
-					"'self'",
-					"'unsafe-inline'",
-					"https:",
-					"http:"
-				],
-				"connect-src": [
-					"'self'",
-					"ws:",
-					"wss:",
-					"http:",
-					"https:"
-				],
-				"img-src": [
-					"'self'",
-					"data:",
-					"blob:",
-					"https:",
-					"http:"
-				]
-			};
-			const reportOnlySimulation = {
-				...mergedOptions,
-				directives: {
-					...mergedOptions.directives,
-					"style-src": ["'self'", "'unsafe-inline'"],
-					"script-src": [
-						"'self'",
-						"'unsafe-inline'",
-						"'unsafe-eval'"
-					]
-				}
-			};
-			c.res = applySecurityHeaders(response, {
-				...mergedOptions,
-				directives: devDirectives
-			}, origin, void 0, reportOnlySimulation);
-			return c.res;
-		}
-		const nonce = crypto.randomUUID().replace(/-/g, "");
-		if (typeof HTMLRewriter !== "undefined") {
-			let rewriter = new HTMLRewriter();
-			rewriter = rewriter.on("script[src]", { element(el) {
-				const src = el.getAttribute("src");
-				if (src && manifest$1[src]) {
-					el.setAttribute("integrity", manifest$1[src]);
-					el.setAttribute("crossorigin", "anonymous");
-				}
-			} }).on("link[rel=\"stylesheet\"][href]", { element(el) {
-				const href = el.getAttribute("href");
-				if (href && manifest$1[href]) {
-					el.setAttribute("integrity", manifest$1[href]);
-					el.setAttribute("crossorigin", "anonymous");
-				}
-			} }).on("script", { element(el) {
-				el.setAttribute("nonce", nonce);
-			} }).on("head", { element(el) {
-				el.append(`<meta name="csp-nonce" content="${nonce}">`, { html: true });
-			} });
-			c.res = applySecurityHeaders(rewriter.transform(response), mergedOptions, origin, nonce);
-			return c.res;
-		}
-		let modifiedHtml = await response.text();
-		modifiedHtml = modifiedHtml.replace(/(<head(?:\s[^>]*)?>)/i, `$1<meta name="csp-nonce" content="${nonce}">`);
-		modifiedHtml = modifiedHtml.replace(/<script(\s[^>]*)?>/gi, (_match, attrs = "") => `<script${attrs} nonce="${nonce}">`);
-		for (const [url, hash] of Object.entries(manifest$1)) {
-			if (!hash) continue;
-			const scriptRegex = new RegExp(`(<script[^>]+src=["']${url}["'][^>]*)(/?>)`, "g");
-			const linkRegex = new RegExp(`(<link[^>]+href=["']${url}["'][^>]*)(/?>)`, "g");
-			modifiedHtml = modifiedHtml.replace(scriptRegex, `$1 integrity="${hash}" crossorigin="anonymous"$2`);
-			modifiedHtml = modifiedHtml.replace(linkRegex, `$1 integrity="${hash}" crossorigin="anonymous"$2`);
-		}
-		c.res = applySecurityHeaders(new Response(modifiedHtml, {
-			status: response.status,
-			statusText: response.statusText,
-			headers: response.headers
-		}), mergedOptions, origin, nonce);
-		return c.res;
-	};
-}
-//#endregion
-//#region src/middleware/dev-only.ts
-/**
-* Hono middleware that blocks any path containing `/dev/` in non-development environments. Mount
-* this early in your Hono app (before API routes and Astro pages) so it covers both `/dev/` page
-* routes and `/api/dev/` API routes in a single place.
-*
-* @example
-*   // fetch.ts
-*   import { devOnly } from "@rimelight/security/middleware"
-*   app.use(devOnly)
-*/
-const devOnly = async (c, next) => {
-	if (!import.meta.env.DEV && c.req.path.includes("/dev/")) return c.notFound();
-	return next();
-};
-//#endregion
+import { devOnly } from "./dev-only.mjs";
+import { security } from "./security.mjs";
 export { devOnly, security };

package/dist/middleware/security.d.mts

@@ -0,0 +1,8 @@
+import { t as SecurityOptions } from "../types-t69O3m_O.mjs";
+//#region src/middleware/security.d.ts
+/**
+ * Universal Security Middleware for Hono and Web Standards (Fetch API). Injects security headers,
+ * CSP with per-request nonce, and SRI attributes.
+ */
+export declare function security(options?: SecurityOptions): (c: any, next: any) => Promise<Response | void>;
+//#endregion

package/dist/middleware/security.mjs

@@ -0,0 +1,184 @@
+import { buildCspHeader } from "../csp.mjs";
+import { manifest } from "virtual:sri-manifest";
+import { config } from "virtual:rimelight-security-config";
+//#region src/middleware/security.ts
+function isManifestRecord(obj) {
+	return typeof obj === "object" && obj !== null && !Array.isArray(obj);
+}
+function isConfigRecord(obj) {
+	return typeof obj === "object" && obj !== null && !Array.isArray(obj);
+}
+const manifest$1 = isManifestRecord(manifest) ? manifest : {};
+const defaultPluginConfig = isConfigRecord(config) ? config : {};
+function applySecurityHeaders(response, options, origin, nonce, reportOnlyOptions) {
+	const cspHeader = buildCspHeader(options, nonce);
+	const reportOnlyHeader = reportOnlyOptions ? buildCspHeader({
+		...reportOnlyOptions,
+		directives: {
+			...reportOnlyOptions.directives,
+			"upgrade-insecure-requests": false
+		}
+	}, nonce) : void 0;
+	const headers = new Headers(response.headers);
+	headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+	headers.set("X-Content-Type-Options", "nosniff");
+	headers.set("X-Frame-Options", "DENY");
+	if (options.crossOriginResourcePolicy !== false) headers.set("Cross-Origin-Resource-Policy", typeof options.crossOriginResourcePolicy === "string" ? options.crossOriginResourcePolicy : "same-origin");
+	if (options.crossOriginOpenerPolicy !== false) headers.set("Cross-Origin-Opener-Policy", typeof options.crossOriginOpenerPolicy === "string" ? options.crossOriginOpenerPolicy : "same-origin");
+	if (options.crossOriginEmbedderPolicy !== false) headers.set("Cross-Origin-Embedder-Policy", typeof options.crossOriginEmbedderPolicy === "string" ? options.crossOriginEmbedderPolicy : "credentialless");
+	headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
+	headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=()");
+	headers.set("No-Vary-Search", "except=(\"q\" \"search\" \"locale\"), params=?1");
+	if (cspHeader) headers.set("Content-Security-Policy", cspHeader);
+	if (reportOnlyHeader) headers.set("Content-Security-Policy-Report-Only", reportOnlyHeader);
+	if (origin) headers.set("Link", [
+		`<${origin}/sitemap-index.xml>; rel="sitemap"`,
+		`<${origin}/llms.txt>; rel="llms"`,
+		`<${origin}/.well-known/api-catalog>; rel="api-catalog"`,
+		`<${origin}/rss.xml>; rel="alternate"; type="application/rss+xml"`
+	].join(", "));
+	if (options.headers) for (const [key, value] of Object.entries(options.headers)) headers.set(key, value);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+/**
+* Universal Security Middleware for Hono and Web Standards (Fetch API). Injects security headers,
+* CSP with per-request nonce, and SRI attributes.
+*/
+function security(options = {}) {
+	const mergedOptions = {
+		...defaultPluginConfig,
+		...options,
+		allowedDomains: [...defaultPluginConfig.allowedDomains || [], ...options.allowedDomains || []],
+		imgSrc: [...defaultPluginConfig.imgSrc || [], ...options.imgSrc || []],
+		connectSrc: [...defaultPluginConfig.connectSrc || [], ...options.connectSrc || []],
+		frameSrc: [...defaultPluginConfig.frameSrc || [], ...options.frameSrc || []],
+		scriptResources: [...defaultPluginConfig.scriptResources || [], ...options.scriptResources || []],
+		styleResources: [...defaultPluginConfig.styleResources || [], ...options.styleResources || []],
+		directives: {
+			...defaultPluginConfig.directives,
+			...options.directives
+		},
+		headers: {
+			...defaultPluginConfig.headers,
+			...options.headers
+		}
+	};
+	return async (c, next) => {
+		const isProd = import.meta.env?.PROD ?? process.env["NODE_ENV"] === "production";
+		const isDev = import.meta.env?.DEV ?? process.env["NODE_ENV"] === "development";
+		const req = c.req?.raw || c.request || c.req;
+		const proto = req?.headers?.get("x-forwarded-proto");
+		if (isProd && proto === "http" && req?.url) {
+			const httpsUrl = req.url.replace(/^http:/, "https:");
+			return Response.redirect(httpsUrl, 301);
+		}
+		await next();
+		const response = c.res;
+		if (!response) return;
+		const contentType = response.headers.get("content-type") || "";
+		const origin = req?.url ? new URL(req.url).origin : void 0;
+		if (!contentType.includes("text/html")) {
+			c.res = applySecurityHeaders(response, mergedOptions, origin);
+			return c.res;
+		}
+		if (isDev) {
+			const devDirectives = {
+				...mergedOptions.directives,
+				"default-src": false,
+				"script-src": [
+					"'self'",
+					"'unsafe-inline'",
+					"'unsafe-eval'",
+					"https:",
+					"http:",
+					"ws:",
+					"wss:"
+				],
+				"script-src-attr": ["'unsafe-inline'"],
+				"style-src": [
+					"'self'",
+					"'unsafe-inline'",
+					"https:",
+					"http:"
+				],
+				"connect-src": [
+					"'self'",
+					"ws:",
+					"wss:",
+					"http:",
+					"https:"
+				],
+				"img-src": [
+					"'self'",
+					"data:",
+					"blob:",
+					"https:",
+					"http:"
+				]
+			};
+			const reportOnlySimulation = {
+				...mergedOptions,
+				directives: {
+					...mergedOptions.directives,
+					"script-src-attr": ["'none'"],
+					"style-src": ["'self'", "'unsafe-inline'"],
+					"script-src": [
+						"'self'",
+						"'unsafe-inline'",
+						"'unsafe-eval'"
+					]
+				}
+			};
+			c.res = applySecurityHeaders(response, {
+				...mergedOptions,
+				directives: devDirectives
+			}, origin, void 0, reportOnlySimulation);
+			return c.res;
+		}
+		const nonce = crypto.randomUUID().replace(/-/g, "");
+		if (typeof HTMLRewriter !== "undefined") {
+			let rewriter = new HTMLRewriter();
+			rewriter = rewriter.on("script[src]", { element(el) {
+				const src = el.getAttribute("src");
+				if (src && manifest$1[src]) {
+					el.setAttribute("integrity", manifest$1[src]);
+					el.setAttribute("crossorigin", "anonymous");
+				}
+			} }).on("link[rel=\"stylesheet\"][href]", { element(el) {
+				const href = el.getAttribute("href");
+				if (href && manifest$1[href]) {
+					el.setAttribute("integrity", manifest$1[href]);
+					el.setAttribute("crossorigin", "anonymous");
+				}
+			} }).on("script", { element(el) {
+				el.setAttribute("nonce", nonce);
+			} }).on("head", { element(el) {
+				el.append(`<meta name="csp-nonce" content="${nonce}">`, { html: true });
+			} });
+			c.res = applySecurityHeaders(rewriter.transform(response), mergedOptions, origin, nonce);
+			return c.res;
+		}
+		let modifiedHtml = await response.text();
+		modifiedHtml = modifiedHtml.replace(/(<head(?:\s[^>]*)?>)/i, `$1<meta name="csp-nonce" content="${nonce}">`);
+		modifiedHtml = modifiedHtml.replace(/<script(\s[^>]*)?>/gi, (_match, attrs = "") => `<script${attrs} nonce="${nonce}">`);
+		for (const [url, hash] of Object.entries(manifest$1)) {
+			if (!hash) continue;
+			const scriptRegex = new RegExp(`(<script[^>]+src=["']${url}["'][^>]*)(/?>)`, "g");
+			const linkRegex = new RegExp(`(<link[^>]+href=["']${url}["'][^>]*)(/?>)`, "g");
+			modifiedHtml = modifiedHtml.replace(scriptRegex, `$1 integrity="${hash}" crossorigin="anonymous"$2`);
+			modifiedHtml = modifiedHtml.replace(linkRegex, `$1 integrity="${hash}" crossorigin="anonymous"$2`);
+		}
+		c.res = applySecurityHeaders(new Response(modifiedHtml, {
+			status: response.status,
+			statusText: response.statusText,
+			headers: response.headers
+		}), mergedOptions, origin, nonce);
+		return c.res;
+	};
+}
+//#endregion
+export { security };

package/dist/{types-Bg8w94Fn.d.mts → types-t69O3m_O.d.mts}

@@ -33,6 +33,22 @@ interface SecurityOptions {
    * Enables the 'require-trusted-types-for' directive
    */
   trustedTypes?: boolean;
+  /**
+   * Cross-Origin-Embedder-Policy header value. Allowed values: "require-corp", "credentialless",
+   * "unsafe-none" or false to disable. Defaults to "credentialless".
+   */
+  crossOriginEmbedderPolicy?: "require-corp" | "credentialless" | "unsafe-none" | (string & {}) | false;
+  /**
+   * Cross-Origin-Opener-Policy header value. Allowed values: "same-origin",
+   * "same-origin-allow-popups", "noopener-allow-popups", "unsafe-none" or false to disable.
+   * Defaults to "same-origin".
+   */
+  crossOriginOpenerPolicy?: "same-origin" | "same-origin-allow-popups" | "noopener-allow-popups" | "unsafe-none" | (string & {}) | false;
+  /**
+   * Cross-Origin-Resource-Policy header value. Allowed values: "same-origin", "same-site",
+   * "cross-origin" or false to disable. Defaults to "same-origin".
+   */
+  crossOriginResourcePolicy?: "same-origin" | "same-site" | "cross-origin" | (string & {}) | false;
   /**
    * Granular CSP directive overrides. Values are arrays of directive tokens, e.g.: {
    * "frame-ancestors": ["'self'"] }

package/dist/types.d.mts

@@ -0,0 +1,2 @@
+import { t as SecurityOptions } from "./types-t69O3m_O.mjs";
+export { SecurityOptions };

package/dist/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/vite.d.mts

@@ -0,0 +1,26 @@
+import { t as SecurityOptions } from "./types-t69O3m_O.mjs";
+//#region src/vite.d.ts
+export interface RimelightSecurityPlugin {
+  name: string;
+  enforce?: "pre" | "post";
+  resolveId?: (id: string) => string | null | undefined;
+  load?: (id: string) => string | null | undefined;
+  buildStart?: () => Promise<void> | void;
+  generateBundle?: (options: any, bundle: Record<string, any>) => Promise<void> | void;
+  [key: string]: any;
+}
+export interface SecurityPluginOptions extends SecurityOptions {
+  /**
+   * Additional external script/style URLs to fetch and hash for SRI at build time.
+   */
+  resources?: string[];
+}
+/**
+ * Pure Vite Security & SRI Plugin. 1. Accepts framework-agnostic security options (domain, imgSrc,
+ * etc.) and exposes virtual:rimelight-security-config. 2. Fetches and hashes external 3rd-party
+ * scripts/styles at build time. 3. Emits SRI hashes for locally bundled JS/CSS chunks
+ * (Nuxt-security style). 4. Exposes virtual:sri-manifest with a unified URL -> hash mapping.
+ */
+export declare function security(options?: SecurityPluginOptions): RimelightSecurityPlugin;
+//#endregion
+export { security as sri };

package/dist/vite.mjs

@@ -0,0 +1,65 @@
+import { createHash } from "node:crypto";
+//#region src/vite.ts
+const DEFAULT_RESOURCES = ["https://betterlytics.io/analytics.js"];
+function hashContent(buffer) {
+	return `sha384-${createHash("sha384").update(buffer).digest("base64")}`;
+}
+/**
+* Pure Vite Security & SRI Plugin. 1. Accepts framework-agnostic security options (domain, imgSrc,
+* etc.) and exposes virtual:rimelight-security-config. 2. Fetches and hashes external 3rd-party
+* scripts/styles at build time. 3. Emits SRI hashes for locally bundled JS/CSS chunks
+* (Nuxt-security style). 4. Exposes virtual:sri-manifest with a unified URL -> hash mapping.
+*/
+function security(options = {}) {
+	const sriManifest = {};
+	const externalUrls = Array.from(/* @__PURE__ */ new Set([...DEFAULT_RESOURCES, ...options.resources || []]));
+	const sriVirtualId = "virtual:sri-manifest";
+	const resolvedSriVirtualId = "\0" + sriVirtualId;
+	const configVirtualId = "virtual:rimelight-security-config";
+	const resolvedConfigVirtualId = "\0" + configVirtualId;
+	return {
+		name: "vite-plugin-rimelight-security",
+		enforce: "post",
+		async buildStart() {
+			if (process.env["NODE_ENV"] === "development") return;
+			await Promise.all(externalUrls.map(async (url) => {
+				if (!url.startsWith("https://")) return;
+				try {
+					const parsed = new URL(url);
+					if (parsed.hostname.includes("*")) return;
+					const pathname = parsed.pathname;
+					if (pathname === "/" || pathname === "" || pathname.endsWith("/")) return;
+					const response = await fetch(url);
+					if (!response.ok) return;
+					const buffer = await response.arrayBuffer();
+					sriManifest[url] = hashContent(buffer);
+				} catch {}
+			}));
+		},
+		generateBundle(_outputOptions, bundle) {
+			for (const [fileName, chunk] of Object.entries(bundle)) {
+				if (!fileName.endsWith(".js") && !fileName.endsWith(".css")) continue;
+				let content;
+				if (chunk.type === "chunk") content = chunk.code;
+				else if (chunk.type === "asset") content = chunk.source;
+				if (content) {
+					const hash = hashContent(content);
+					sriManifest[`/${fileName.replace(/^\/+/, "")}`] = hash;
+					sriManifest[fileName] = hash;
+				}
+			}
+		},
+		resolveId(id) {
+			if (id === sriVirtualId) return resolvedSriVirtualId;
+			if (id === configVirtualId) return resolvedConfigVirtualId;
+			return null;
+		},
+		load(id) {
+			if (id === resolvedSriVirtualId) return `export const manifest = ${JSON.stringify(sriManifest)};`;
+			if (id === resolvedConfigVirtualId) return `export const config = ${JSON.stringify(options)};`;
+			return null;
+		}
+	};
+}
+//#endregion
+export { security, security as sri };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rimelight/security",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "private": false,
   "description": "Rimelight Entertainment's Security Package",
   "homepage": "https://rimelight.com/docs",
@@ -40,7 +40,7 @@
   },
   "devDependencies": {
     "@astrojs/check": "0.9.10",
-    "@rimelight/config": "0.0.5",
+    "@rimelight/config": "0.0.6",
     "astro": "7.3.2",
     "typescript": "6.0.3"
   },
@@ -48,7 +48,7 @@
     "astro": ">=7.0.0"
   },
   "engines": {
-    "node": ">=26.7.0"
+    "node": ">=26.8.2"
   },
   "scripts": {
     "build": "vp pack",

package/dist/csp-ESHHTg-n.d.mts

@@ -1,8 +0,0 @@
-import { t as SecurityOptions } from "./types-Bg8w94Fn.mjs";
-//#region src/csp.d.ts
-/**
- * Builds the Content-Security-Policy header string dynamically for a given request nonce.
- */
-declare function buildCspHeader(options?: SecurityOptions, nonce?: string): string;
-//#endregion
-export { buildCspHeader as t };