@rimelight/ui 0.0.15 → 0.0.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rimelight/ui",
-  "version": "0.0.15",
+  "version": "0.0.16",
   "private": false,
   "description": "Rimelight Entertainment UI Library.",
   "homepage": "https://rimelight.com/docs",
@@ -57,6 +57,7 @@
     "css-variants": "2.3.5",
     "defu": "6.1.6",
     "embla-carousel": "8.6.0",
+    "picomatch": "^4.0.4",
     "tailwind-merge": "^3.3.1",
     "tailwindcss": "^4.2.3",
     "turndown": "^7.2.4",
@@ -69,6 +70,7 @@
     "@astrojs/ts-plugin": "1.10.7",
     "@e18e/eslint-plugin": "0.3.0",
     "@types/node": "25.5.2",
+    "@types/picomatch": "^4.0.3",
     "@unocss/eslint-plugin": "66.6.8",
     "astro": "6.1.8",
     "eslint-plugin-regexp": "3.1.0",

package/src/env.d.ts

@@ -38,5 +38,8 @@ declare module "turndown-plugin-gfm" {
 declare namespace App {
   interface Locals {
     cfContext?: Record<string, unknown>
+    // Extended locals used by Starlight Addons for richer type safety
+    starlightSidebarTopics?: any
+    starlightRoute?: any
   }
 }

package/src/integrations/sri.ts

@@ -1,92 +1,92 @@
-import type { AstroIntegration } from "astro"
-import { createHash } from "node:crypto"
-
-interface SRIConfig {
-  security?: {
-    csp?: {
-      scriptDirective?: {
-        resources?: string[]
-      }
-    }
-  }
-}
-
-function assertSRIConfig(obj: unknown): asserts obj is SRIConfig {
-  if (!obj || typeof obj !== "object") throw new Error("Expected config")
-}
-
-/**
- * Astro SRI Integration Fetches external scripts at build-time and generates hashes for the SSR
- * middleware.
- */
-export function sri(): AstroIntegration {
-  const sriManifest: Record<string, string> = {}
-
-  return {
-    name: "sri",
-    hooks: {
-      "astro:config:setup": async ({ updateConfig, config, logger }) => {
-        logger.info("Initializing SRI Discovery...")
-
-        // 1. Identify External Scripts from CSP config
-        // We look into the custom 'security' block in astro.config.mjs
-        assertSRIConfig(config)
-
-        const security = config.security
-        const externalUrls: string[] = []
-
-        if (security?.csp?.scriptDirective?.resources) {
-          for (const resource of security.csp.scriptDirective.resources) {
-            if (resource.startsWith("https://")) {
-              externalUrls.push(resource)
-            }
-          }
-        }
-
-        // 2. Fetch and Hash External Scripts
-        await Promise.all(
-          externalUrls.map(async (url) => {
-            try {
-              logger.info(`Fetching ${url} for SRI hashing...`)
-              const response = await fetch(url)
-              if (!response.ok) throw new Error(`HTTP ${response.status}`)
-
-              const buffer = await response.arrayBuffer()
-              const hash = createHash("sha384").update(Buffer.from(buffer)).digest("base64")
-
-              sriManifest[url] = `sha384-${hash}`
-              logger.info(`Successfully hashed ${url}`)
-            } catch (err: unknown) {
-              const message = err instanceof Error ? err.message : String(err)
-              logger.error(`Failed to fetch SRI for ${url}: ${message}`)
-            }
-          })
-        )
-
-        // 3. Provide hashes to the runtime via Vite's virtual module
-        const virtualModuleId = "virtual:sri-manifest"
-        const resolvedVirtualModuleId = "\0" + virtualModuleId
-
-        updateConfig({
-          vite: {
-            plugins: [
-              {
-                name: "vite-plugin-sri-manifest",
-                resolveId(id: string) {
-                  if (id === virtualModuleId) return resolvedVirtualModuleId
-                  return null
-                },
-                load(id: string) {
-                  if (id === resolvedVirtualModuleId) {
-                    return `export const manifest = ${JSON.stringify(sriManifest)};`
-                  }
-                  return null
-                }
-              }
-            ]
-          }
-        })
-      }
-    }
-  }
-}
+import type { AstroIntegration } from "astro"
+import { createHash } from "node:crypto"
+
+interface SRIConfig {
+  security?: {
+    csp?: {
+      scriptDirective?: {
+        resources?: string[]
+      }
+    }
+  }
+}
+
+function assertSRIConfig(obj: unknown): asserts obj is SRIConfig {
+  if (!obj || typeof obj !== "object") throw new Error("Expected config")
+}
+
+/**
+ * Astro SRI Integration Fetches external scripts at build-time and generates hashes for the SSR
+ * middleware.
+ */
+export function sri(): AstroIntegration {
+  const sriManifest: Record<string, string> = {}
+
+  return {
+    name: "sri",
+    hooks: {
+      "astro:config:setup": async ({ updateConfig, config, logger }) => {
+        logger.info("Initializing SRI Discovery...")
+
+        // 1. Identify External Scripts from CSP config
+        // We look into the custom 'security' block in astro.config.mjs
+        assertSRIConfig(config)
+
+        const security = config.security
+        const externalUrls: string[] = []
+
+        if (security?.csp?.scriptDirective?.resources) {
+          for (const resource of security.csp.scriptDirective.resources) {
+            if (resource.startsWith("https://")) {
+              externalUrls.push(resource)
+            }
+          }
+        }
+
+        // 2. Fetch and Hash External Scripts
+        await Promise.all(
+          externalUrls.map(async (url) => {
+            try {
+              logger.info(`Fetching ${url} for SRI hashing...`)
+              const response = await fetch(url)
+              if (!response.ok) throw new Error(`HTTP ${response.status}`)
+
+              const buffer = await response.arrayBuffer()
+              const hash = createHash("sha384").update(Buffer.from(buffer)).digest("base64")
+
+              sriManifest[url] = `sha384-${hash}`
+              logger.info(`Successfully hashed ${url}`)
+            } catch (err: unknown) {
+              const message = err instanceof Error ? err.message : String(err)
+              logger.error(`Failed to fetch SRI for ${url}: ${message}`)
+            }
+          })
+        )
+
+        // 3. Provide hashes to the runtime via Vite's virtual module
+        const virtualModuleId = "virtual:sri-manifest"
+        const resolvedVirtualModuleId = "\0" + virtualModuleId
+
+        updateConfig({
+          vite: {
+            plugins: [
+              {
+                name: "vite-plugin-sri-manifest",
+                resolveId(id: string) {
+                  if (id === virtualModuleId) return resolvedVirtualModuleId
+                  return null
+                },
+                load(id: string) {
+                  if (id === resolvedVirtualModuleId) {
+                    return `export const manifest = ${JSON.stringify(sriManifest)};`
+                  }
+                  return null
+                }
+              }
+            ]
+          }
+        })
+      }
+    }
+  }
+}

package/src/middleware/security.ts

@@ -1,6 +1,12 @@
 import { defineMiddleware } from "astro:middleware"
 
-export const security = defineMiddleware(async (_, next) => {
+export const security = defineMiddleware(async (context, next) => {
+  // HTTP to HTTPS redirect
+  if (context.request.url.startsWith("http://")) {
+    const httpsUrl = context.request.url.replace(/^http:/, "https:")
+    return Response.redirect(httpsUrl, 301)
+  }
+
   const response = await next()
 
   const newResponse = new Response(response.body, response)
@@ -10,6 +16,7 @@ export const security = defineMiddleware(async (_, next) => {
   newResponse.headers.set("X-Content-Type-Options", "nosniff")
   newResponse.headers.set("X-Frame-Options", "DENY")
   newResponse.headers.set("Cross-Origin-Resource-Policy", "same-origin")
+  newResponse.headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
 
   return newResponse
-})
+})

package/src/middleware/sri.ts

@@ -1,78 +1,78 @@
-import { defineMiddleware } from "astro:middleware"
-// @ts-ignore - virtual module generated by the SRI integration
-import { manifest } from "virtual:sri-manifest"
-
-declare const HTMLRewriter: any
-
-function assertManifest(obj: unknown): asserts obj is Record<string, string> {
-  if (!obj || typeof obj !== "object") throw new Error("Expected manifest")
-}
-
-/**
- * SRI Middleware Injects integrity attributes into script tags based on the pre-generated manifest.
- * Handles both SSR streaming (via HTMLRewriter) and post-rendering fallback.
- */
-export const sri = defineMiddleware(async (_, next) => {
-  const response = await next()
-  const contentType = response.headers.get("content-type") || ""
-
-  // Only process HTML responses
-  if (!contentType.includes("text/html")) {
-    return response
-  }
-
-  // Use Cloudflare's HTMLRewriter if available (SSR Production/Preview)
-  if (typeof HTMLRewriter !== "undefined") {
-    return new HTMLRewriter()
-      .on("script[src]", {
-        element(el: any) {
-          const src = el.getAttribute("src")
-          if (src && manifest[src]) {
-            el.setAttribute("integrity", manifest[src])
-            el.setAttribute("crossorigin", "anonymous")
-          }
-        }
-      })
-      .on('link[rel="stylesheet"][href]', {
-        element(el: any) {
-          const href = el.getAttribute("href")
-          if (href && manifest[href]) {
-            el.setAttribute("integrity", manifest[href])
-            el.setAttribute("crossorigin", "anonymous")
-          }
-        }
-      })
-      .transform(response)
-  }
-
-  // Fallback for Dev
-  let modifiedHtml = await response.text()
-
-  // Simple RegEx replacement for Dev inspection
-  assertManifest(manifest)
-
-  const entries = Object.entries(manifest)
-  for (const [url, hash] of entries) {
-    if (!hash) continue
-
-    // Look for script tags with the specific URL
-    const scriptRegex = new RegExp(`(<script[^>]+src=["']${url}["'][^>]*)(/?>)`, "g")
-    modifiedHtml = modifiedHtml.replace(
-      scriptRegex,
-      `$1 integrity="${hash}" crossorigin="anonymous"$2`
-    )
-
-    // Look for link tags with the specific URL
-    const linkRegex = new RegExp(`(<link[^>]+href=["']${url}["'][^>]*)(/?>)`, "g")
-    modifiedHtml = modifiedHtml.replace(
-      linkRegex,
-      `$1 integrity="${hash}" crossorigin="anonymous"$2`
-    )
-  }
-
-  return new Response(modifiedHtml, {
-    status: response.status,
-    statusText: response.statusText,
-    headers: response.headers
-  })
-})
+import { defineMiddleware } from "astro:middleware"
+// @ts-ignore - virtual module generated by the SRI integration
+import { manifest } from "virtual:sri-manifest"
+
+declare const HTMLRewriter: any
+
+function assertManifest(obj: unknown): asserts obj is Record<string, string> {
+  if (!obj || typeof obj !== "object") throw new Error("Expected manifest")
+}
+
+/**
+ * SRI Middleware Injects integrity attributes into script tags based on the pre-generated manifest.
+ * Handles both SSR streaming (via HTMLRewriter) and post-rendering fallback.
+ */
+export const sri = defineMiddleware(async (_, next) => {
+  const response = await next()
+  const contentType = response.headers.get("content-type") || ""
+
+  // Only process HTML responses
+  if (!contentType.includes("text/html")) {
+    return response
+  }
+
+  // Use Cloudflare's HTMLRewriter if available (SSR Production/Preview)
+  if (typeof HTMLRewriter !== "undefined") {
+    return new HTMLRewriter()
+      .on("script[src]", {
+        element(el: any) {
+          const src = el.getAttribute("src")
+          if (src && manifest[src]) {
+            el.setAttribute("integrity", manifest[src])
+            el.setAttribute("crossorigin", "anonymous")
+          }
+        }
+      })
+      .on('link[rel="stylesheet"][href]', {
+        element(el: any) {
+          const href = el.getAttribute("href")
+          if (href && manifest[href]) {
+            el.setAttribute("integrity", manifest[href])
+            el.setAttribute("crossorigin", "anonymous")
+          }
+        }
+      })
+      .transform(response)
+  }
+
+  // Fallback for Dev
+  let modifiedHtml = await response.text()
+
+  // Simple RegEx replacement for Dev inspection
+  assertManifest(manifest)
+
+  const entries = Object.entries(manifest)
+  for (const [url, hash] of entries) {
+    if (!hash) continue
+
+    // Look for script tags with the specific URL
+    const scriptRegex = new RegExp(`(<script[^>]+src=["']${url}["'][^>]*)(/?>)`, "g")
+    modifiedHtml = modifiedHtml.replace(
+      scriptRegex,
+      `$1 integrity="${hash}" crossorigin="anonymous"$2`
+    )
+
+    // Look for link tags with the specific URL
+    const linkRegex = new RegExp(`(<link[^>]+href=["']${url}["'][^>]*)(/?>)`, "g")
+    modifiedHtml = modifiedHtml.replace(
+      linkRegex,
+      `$1 integrity="${hash}" crossorigin="anonymous"$2`
+    )
+  }
+
+  return new Response(modifiedHtml, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  })
+})

package/src/plugins/starlightAddons/Sidebar.astro

@@ -0,0 +1,89 @@
+---
+import { Badge, Icon } from '@astrojs/starlight/components'
+
+const { hasSidebar } = Astro.locals.starlightRoute
+const { isPageWithTopic, topics } = Astro.locals.starlightSidebarTopics
+---
+
+{hasSidebar && isPageWithTopic && (
+  <ul class="starlight-sidebar-topics">
+    {topics.map((topic, index) => (
+      <li key={index}>
+        <a href={topic.link} class:list={{ 'starlight-sidebar-topics-current': topic.isCurrent }}>
+          {topic.icon && (
+            <div class="starlight-sidebar-topics-icon">
+              <Icon name={topic.icon} />
+            </div>
+          )}
+          <div>
+            {topic.label}
+            {topic.badge && (
+              <Badge class="starlight-sidebar-topics-badge" text={topic.badge.text} variant={topic.badge.variant} />
+            )}
+          </div>
+        </a>
+      </li>
+    ))}
+  </ul>
+)}
+<style>
+  ul {
+    list-style: none;
+    padding: 0;
+  }
+
+  ul::after {
+    content: '';
+    display: block;
+    margin-top: 1rem;
+    height: 1px;
+    border-top: 1px solid var(--sl-color-hairline-light);
+  }
+
+  li {
+    overflow-wrap: anywhere;
+  }
+
+  li + li {
+    margin-top: 0.25rem;
+  }
+
+  a {
+    align-items: center;
+    color: var(--sl-color-white);
+    display: flex;
+    font-size: var(--sl-text-base);
+    font-weight: 600;
+    gap: 0.5rem;
+    line-height: 1.5;
+    padding: 0.3em 0.5rem;
+    text-decoration: none;
+  }
+
+  a:is(.starlight-sidebar-topics-current, :hover, :focus-visible) {
+    color: var(--sl-color-accent-high);
+  }
+
+  :global([data-theme='light']) a.starlight-sidebar-topics-current {
+    color: var(--sl-color-accent);
+  }
+
+  .starlight-sidebar-topics-icon {
+    align-items: center;
+    border-radius: 0.25rem;
+    border: 1px solid var(--sl-color-gray-4);
+    display: flex;
+    justify-content: center;
+    padding: 0.25rem;
+  }
+
+  a:is(.starlight-sidebar-topics-current, :hover, :focus-visible) .starlight-sidebar-topics-icon {
+    background-color: var(--sl-color-text-accent);
+    border-color: var(--sl-color-text-accent);
+    color: var(--sl-color-text-invert);
+  }
+
+  .starlight-sidebar-topics-badge {
+    margin-inline-start: 0.25em;
+  }
+</style>

package/src/plugins/starlightAddons/data.ts

@@ -0,0 +1,39 @@
+import type { StarlightIcon } from "@astrojs/starlight/types"
+
+import type { SidebarTopicBadge } from "./libs/config"
+
+export interface StarlightSidebarTopicsRouteData {
+  /**
+   * Indicates if the current page is associated with a topic or not.
+   */
+  isPageWithTopic: boolean
+  /**
+   * A list of all configured topics.
+   */
+  topics: {
+    /**
+     * The optional badge associated with the topic.
+     */
+    badge?: {
+      text: string
+      variant: SidebarTopicBadge["variant"]
+    }
+    /**
+     * The name of an optional icon associated with the topic set to one of Starlight’s built-in
+     * icons.
+     */
+    icon?: StarlightIcon
+    /**
+     * Indicates if the current page is part of the topic.
+     */
+    isCurrent: boolean
+    /**
+     * The label of the topic.
+     */
+    label: string
+    /**
+     * The link to the topic’s content.
+     */
+    link: string
+  }[]
+}