@speedkit/cli 4.19.0 → 4.20.1

package/CHANGELOG.md

@@ -1,3 +1,22 @@
+## [4.20.1](https://gitlab.orestes.info/baqend/speed-kit-cli/compare/v4.20.0...v4.20.1) (2026-08-07)
+
+
+### Bug Fixes
+
+* **customer-config:** marker detectDevice reads the passed doc, not document ([6f1b697](https://gitlab.orestes.info/baqend/speed-kit-cli/commit/6f1b697b52cc6786c7e975edfcbc85c52750749b))
+
+# [4.20.0](https://gitlab.orestes.info/baqend/speed-kit-cli/compare/v4.19.0...v4.20.0) (2026-08-07)
+
+
+### Bug Fixes
+
+* reuse origin nonce for forceInstall script in local mode ([dd1d4d8](https://gitlab.orestes.info/baqend/speed-kit-cli/commit/dd1d4d82e796d65708dd586ba25979c5d2dbc652))
+
+
+### Features
+
+* carry over origin security headers in onboarding local mode ([cb7e7da](https://gitlab.orestes.info/baqend/speed-kit-cli/commit/cb7e7da7165b4071449270ee2baf71989dc16636))
+
 # [4.19.0](https://gitlab.orestes.info/baqend/speed-kit-cli/compare/v4.18.0...v4.19.0) (2026-08-06)
 
 

package/README.md

@@ -21,7 +21,7 @@ $ npm install -g @speedkit/cli
 $ sk COMMAND
 running command...
 $ sk (--version)
-@speedkit/cli/4.19.0 linux-x64 node-v22.23.2
+@speedkit/cli/4.20.1 linux-x64 node-v22.23.2
 $ sk --help [COMMAND]
 USAGE
   $ sk COMMAND

package/dist/services/customer-config/templates/config_SpeedKit.js.hbs

@@ -34,14 +34,23 @@
 
 {{#if isShopify}}
 import { ShopifyPlugin } from "speed-kit-config/ShopifyPlugin";
+{{/if}}
+{{#if addSSR}}
+import { SSRPlugin } from "speed-kit-config/SSRPlugin";
+{{/if}}
 
 (function() {
+{{#if isShopify}}
   SpeedKit.configPlugins = SpeedKit.configPlugins || [];
   SpeedKit.configPlugins.push(new ShopifyPlugin());
-
-{{else}}
-(function() {
 {{/if}}
+{{#if addSSR}}
+{{#unless isShopify}}
+  SpeedKit.configPlugins = SpeedKit.configPlugins || [];
+{{/unless}}
+  SpeedKit.configPlugins.push(new SSRPlugin());
+{{/if}}
+
   var ENABLED_HOSTS_CONFIGS = [
     // Production:
     {
@@ -98,15 +107,20 @@ import { ShopifyPlugin } from "speed-kit-config/ShopifyPlugin";
     rumTracking: true,
 {{#if addDeviceDetection}}
   {{#unless addSSR}}
+    // Server-side responsive: origin returns different HTML per device (UA-keyed).
     userAgentDetection: true,
     detectDevice: function(doc) {
-      // TODO: adjust condition to your needs
+      // TODO: set a marker present only in the mobile variation. Read it from `doc`.
       return doc.querySelector('<mobile-specific-element>') ? "mobile" : "desktop";
     },
   {{/unless}}
   {{#if addSSR}}
-    customDevice: () => {
-      return customDevice();
+    // SSR: pick the device by viewport width; SSRPlugin (above) handles resize/zoom/bfcache.
+    detectDevice: function(doc) {
+      // TODO: set the real breakpoint — discover it, don't guess (tools/sk-breakpoints.mjs).
+      var width = document.documentElement.clientWidth;
+      if (!width) return null;
+      return width <= 820 ? "mobile" : "desktop";
     },
   {{/if}}
 {{/if}}
@@ -458,29 +472,6 @@ import { ShopifyPlugin } from "speed-kit-config/ShopifyPlugin";
   // Utility Functions
   //================================================================================
 
-  {{#if addSSR}}
-      function customDevice() {
-        var width = window.innerWidth || 1025;
-        // TODO: adjust devices + breakpoints to your needs
-        if (width <= 820) {
-          return "mobile";
-        }
-        return "desktop";
-      }
-
-      // Re-evaluate device on orientation change and push to service worker
-      window.addEventListener("orientationchange", function () {
-        if (typeof SpeedKit !== "undefined" && SpeedKit.updateDevice) {
-          SpeedKit.updateDevice(customDevice());
-        }
-      });
-      window.addEventListener("resize", function () {
-        if (typeof SpeedKit !== "undefined" && SpeedKit.updateDevice) {
-          SpeedKit.updateDevice(customDevice());
-        }
-      });
-  {{/if}}
-
   function getEnabledHosts(enabledHostsConfigs) {
     var allHosts = [];
     enabledHostsConfigs.forEach(function (enabledHostsConfig) {

package/dist/services/customer-config/templates/config_dynamicBlocks.es6.hbs

@@ -7,12 +7,19 @@
 {{#if addDeviceDetection}}
   {{#unless addSSR}}
     detectDevice: (doc) => {
-      // keep only if you need to check the DOM – for screen width checks the SK config's detectDevice is sufficient
-
-      // TODO: adjust condition to your needs
+      // Only if you need a DOM marker; for width checks the SK config's detectDevice suffices.
+      // TODO: set a marker present only in the mobile variation. Read it from `doc`.
       return doc.querySelector('<mobile-specific-element>') ? "mobile" : "desktop";
     },
   {{/unless}}
+  {{#if addSSR}}
+    // Mirror config_SpeedKit.js detectDevice — keep the breakpoint identical.
+    detectDevice: (doc) => {
+      let width = document.documentElement.clientWidth;
+      if (!width) return null;
+      return width <= 820 ? "mobile" : "desktop";
+    },
+  {{/if}}
 {{/if}}
     blocks: [
       // TODO: adjust/replace this exemplary list

package/dist/services/onboarding/fetch-events/customer-domain-document-response.d.ts

@@ -19,7 +19,6 @@ export declare class CustomerDomainDocumentResponse implements FetchRequestPause
     private isHtmlContentHeader;
     private getHtmlContent;
     private isSpeedKitResponse;
-    private rewriteInstallResource;
     private rewriteHtmlToLocalConfig;
     /**
      * Removes content policy headers from the given array of headers.
@@ -28,11 +27,4 @@ export declare class CustomerDomainDocumentResponse implements FetchRequestPause
      * @returns {Protocol.Fetch.HeaderEntry[]} - The modified array of header entries with content policy headers removed.
      */
     private removeContentSecurityHeaderFromResponse;
-    /**
-     * Removes the content security meta tag from the provided HTML content.
-     *
-     * @param {string} htmlContent - The HTML content from which to remove the meta tag.
-     * @returns {string} - The HTML content without the content security meta tag.
-     */
-    private removeContentSecurityMetaTag;
 }

package/dist/services/onboarding/fetch-events/customer-domain-document-response.js

@@ -1,5 +1,6 @@
-import { META_CONTENT_TYPE_REGEX, SpeedKitInstallRegex, } from "../onboarding-model.js";
+import { META_CONTENT_TYPE_REGEX, } from "../onboarding-model.js";
 import { OriginResponse } from "../browser/origin-response.js";
+import { removeContentSecurityMetaTag, rewriteInstallResource, } from "../html-rewrites.js";
 import iconv from "iconv-lite";
 import Encoding from "encoding-japanese";
 import { UnsupportedEncodingError } from "../error/unsupported-encoding-error.js";
@@ -67,13 +68,13 @@ export class CustomerDomainDocumentResponse {
             ? this.removeContentSecurityHeaderFromResponse(event.responseHeaders)
             : event.responseHeaders;
         if (this.customerConfig.forceInstall) {
-            text = this.rewriteInstallResource(text);
+            text = rewriteInstallResource(text, this.customerConfig);
         }
         if (this.isSpeedKitResponse(text)) {
             text = this.rewriteHtmlToLocalConfig(text);
         }
         const content = this.removeContentSecurityPolicy
-            ? this.removeContentSecurityMetaTag(text)
+            ? removeContentSecurityMetaTag(text)
             : text;
         // replace origin contentTypeCharset with utf-8 as this is what it's converted to now
         let detectedEncoding = "utf-8";
@@ -140,23 +141,6 @@ export class CustomerDomainDocumentResponse {
     isSpeedKitResponse(text) {
         return text.includes("speed-kit-dynamic");
     }
-    rewriteInstallResource(text) {
-        text = text.replace(SpeedKitInstallRegex, "");
-        const matchOpeningHead = /<\s*head\b[^>]*>/;
-        const matchClosingHead = /<\/\s*head\s*>/;
-        const nonceMatch = text.match(/<script\s(?:[^>]*?\s)?nonce\s*=\s*["']?([^\s"'>]*)/i);
-        if (matchOpeningHead.test(text)) {
-            return text.replace(matchOpeningHead, (head) => {
-                return `${head}\n<script ${nonceMatch ? 'nonce="' + nonceMatch[1] + '"' : ""} src="${this.customerConfig.installPath}" ${this.customerConfig.installParams}></script>`;
-            });
-        }
-        if (matchClosingHead.test(text)) {
-            return text.replace(matchClosingHead, (head) => {
-                return `<script ${nonceMatch ? 'nonce="' + nonceMatch[1] + '"' : ""} src="${this.customerConfig.installPath}" ${this.customerConfig.installParams}></script>${head}\n`;
-            });
-        }
-        return text;
-    }
     rewriteHtmlToLocalConfig(html) {
         const DF_CONFIG_PATTERN = /(<script[^>]* id="speed-kit-df-config"[^>]*>)([\S\s]*?)(<\/script>)/g;
         const DF_STYLES_PATTERN = /(<style[^>]* id="speed-kit-df-styles"[^>]*>)(?:(?!<\/style>)[\S\s])*(<\/style>)/g;
@@ -178,13 +162,4 @@ export class CustomerDomainDocumentResponse {
             return !header.name.toLowerCase().includes("content-security-policy");
         });
     }
-    /**
-     * Removes the content security meta tag from the provided HTML content.
-     *
-     * @param {string} htmlContent - The HTML content from which to remove the meta tag.
-     * @returns {string} - The HTML content without the content security meta tag.
-     */
-    removeContentSecurityMetaTag(htmlContent) {
-        return htmlContent.replace(/<meta[^>]*http-equiv=["']content-security-policy[^>]*>/is, "");
-    }
 }

package/dist/services/onboarding/html-rewrites.d.ts

@@ -0,0 +1,19 @@
+import { CustomerConfig } from "../integration-api/index.js";
+/**
+ * Injects the Speed Kit install script into the given HTML, after removing any
+ * existing install snippet. The origin's script nonce is reused so a
+ * nonce-based CSP does not block the injected script. Injection prefers the
+ * opening `<head>`, falling back to before the closing `</head>`.
+ *
+ * @param {string} text - the HTML to rewrite
+ * @param {CustomerConfig} customerConfig - provides the install path/params
+ * @returns {string} - the HTML with the install script injected
+ */
+export declare function rewriteInstallResource(text: string, customerConfig: CustomerConfig): string;
+/**
+ * Removes the content security meta tag from the provided HTML content.
+ *
+ * @param {string} htmlContent - The HTML content from which to remove the meta tag.
+ * @returns {string} - The HTML content without the content security meta tag.
+ */
+export declare function removeContentSecurityMetaTag(htmlContent: string): string;

package/dist/services/onboarding/html-rewrites.js

@@ -0,0 +1,34 @@
+import { SpeedKitInstallRegex } from "./onboarding-model.js";
+/**
+ * Injects the Speed Kit install script into the given HTML, after removing any
+ * existing install snippet. The origin's script nonce is reused so a
+ * nonce-based CSP does not block the injected script. Injection prefers the
+ * opening `<head>`, falling back to before the closing `</head>`.
+ *
+ * @param {string} text - the HTML to rewrite
+ * @param {CustomerConfig} customerConfig - provides the install path/params
+ * @returns {string} - the HTML with the install script injected
+ */
+export function rewriteInstallResource(text, customerConfig) {
+    text = text.replace(SpeedKitInstallRegex, "");
+    const matchOpeningHead = /<\s*head\b[^>]*>/;
+    const matchClosingHead = /<\/\s*head\s*>/;
+    const nonceMatch = text.match(/<script\s(?:[^>]*?\s)?nonce\s*=\s*["']?([^\s"'>]*)/i);
+    const installScript = `<script ${nonceMatch ? 'nonce="' + nonceMatch[1] + '"' : ""} src="${customerConfig.installPath}" ${customerConfig.installParams}></script>`;
+    if (matchOpeningHead.test(text)) {
+        return text.replace(matchOpeningHead, (head) => `${head}\n${installScript}`);
+    }
+    if (matchClosingHead.test(text)) {
+        return text.replace(matchClosingHead, (head) => `${installScript}${head}\n`);
+    }
+    return text;
+}
+/**
+ * Removes the content security meta tag from the provided HTML content.
+ *
+ * @param {string} htmlContent - The HTML content from which to remove the meta tag.
+ * @returns {string} - The HTML content without the content security meta tag.
+ */
+export function removeContentSecurityMetaTag(htmlContent) {
+    return htmlContent.replace(/<meta[^>]*http-equiv=["']content-security-policy[^>]*>/is, "");
+}

package/dist/services/onboarding/onboarding-service-factory.js

@@ -166,7 +166,7 @@ export class OnboardingServiceFactory {
             new DashboardRequest(new Dashboard(customerConfig, parameterQueryBuilder, athenaClient, requestDiffService, new DiffAgainstCurrentPage(DiffService, documentHandler, crawler, cli), cache)),
         ];
         if (this.context.local) {
-            const orestesApp = new VirtualOrestesApp(customerConfig, crawler, documentHandler, cache, cli, messageHandler);
+            const orestesApp = new VirtualOrestesApp(customerConfig, crawler, documentHandler, cache, cli, messageHandler, this.context.ignoreContentSecurityPolicy);
             // let config-file changes re-warm the dh-cache in the background
             fileWatcher.setCacheRefresher(orestesApp);
             handlers.push(new SpeedKitAssetRequest(customerConfig, orestesApp), new SpeedKitRumPiRequest(customerConfig, orestesApp));

package/dist/services/onboarding/virtual-orestes-app/index.d.ts

@@ -13,8 +13,9 @@ export declare class VirtualOrestesApp {
     private cache;
     private cli;
     private developmentToolsMessages;
+    private removeContentSecurityPolicy;
     private localCacheErrors;
-    constructor(customerConfig: CustomerConfig, crawler: Crawler, documentHandler: DocumentHandlerServer, cache: Cache, cli: CliService, developmentToolsMessages: DevtoolsExtensionApi);
+    constructor(customerConfig: CustomerConfig, crawler: Crawler, documentHandler: DocumentHandlerServer, cache: Cache, cli: CliService, developmentToolsMessages: DevtoolsExtensionApi, removeContentSecurityPolicy?: boolean);
     fetchAssetResponse(event: Protocol.Fetch.RequestPausedEvent): Promise<Partial<Protocol.Fetch.FulfillRequestRequest> | AbortResponse>;
     /**
      * Re-warm all cached entries for the given origin url in the background.
@@ -60,5 +61,14 @@ export declare class VirtualOrestesApp {
     private prepareCustomHeaders;
     private isHtmlContentHeader;
     private isValidHtmlContent;
-    private rewriteInstallResource;
+    /**
+     * Carries over the origin response's security headers onto the accelerated
+     * response, mirroring the Orestes server. The origin value wins over any
+     * default set in `prepareCustomHeaders`. Content-Security-Policy headers are
+     * skipped when `--ignoreContentSecurityPolicy` is set.
+     *
+     * @param {Response} response - the origin fetch response
+     * @param {{ name: string; value: string }[]} customHeaders - headers being built for the response (mutated in place)
+     */
+    private carryOverSecurityHeaders;
 }

package/dist/services/onboarding/virtual-orestes-app/index.js

@@ -1,12 +1,24 @@
 import { BaqendResponse } from "../browser/baqend-response.js";
 import { safe } from "../../../helpers/safe.js";
-import { META_CONTENT_TYPE_REGEX, SpeedKitInstallRegex, } from "../onboarding-model.js";
+import { META_CONTENT_TYPE_REGEX, } from "../onboarding-model.js";
 import iconv from "iconv-lite";
 import { UnsupportedEncodingError } from "../error/unsupported-encoding-error.js";
+import { removeContentSecurityMetaTag, rewriteInstallResource, } from "../html-rewrites.js";
 // for none encodable chars use a space, so the broken char is invisible.
 // We are using the same trick in our node.js server
 iconv.defaultCharSingleByte = " ";
 iconv.defaultCharUnicode = " ";
+// Security headers the Orestes server carries over from the origin response
+// onto the accelerated response. Kept in sync with the server's fixed lists.
+const CONTENT_SECURITY_POLICY_HEADERS = [
+    "content-security-policy",
+    "content-security-policy-report-only",
+];
+const SECURITY_HEADERS = [
+    "x-content-type-options",
+    "strict-transport-security",
+    "x-frame-options",
+];
 export class VirtualOrestesApp {
     customerConfig;
     crawler;
@@ -14,18 +26,20 @@ export class VirtualOrestesApp {
     cache;
     cli;
     developmentToolsMessages;
+    removeContentSecurityPolicy;
     // Local-mode transform errors keyed by `${url}|${variation}`. Emitted to
     // the devtools panel via DevtoolsExtensionApi.upsertMessage so the panel
     // can surface an "error for this URL" affordance in the Causes & sources
     // card. Cleared per-URL on the next successful transform.
     localCacheErrors = new Map();
-    constructor(customerConfig, crawler, documentHandler, cache, cli, developmentToolsMessages) {
+    constructor(customerConfig, crawler, documentHandler, cache, cli, developmentToolsMessages, removeContentSecurityPolicy = false) {
         this.customerConfig = customerConfig;
         this.crawler = crawler;
         this.documentHandler = documentHandler;
         this.cache = cache;
         this.cli = cli;
         this.developmentToolsMessages = developmentToolsMessages;
+        this.removeContentSecurityPolicy = removeContentSecurityPolicy;
     }
     async fetchAssetResponse(event) {
         const cachedResponse = this.getCachedResponse(event.request.url);
@@ -131,7 +145,10 @@ export class VirtualOrestesApp {
         this.clearLocalCacheError(originUrl, variation);
         const skResponse = customResponse.data;
         if (!Buffer.isBuffer(skResponse.body) && this.customerConfig.forceInstall) {
-            skResponse.body = this.rewriteInstallResource(skResponse.body);
+            skResponse.body = rewriteInstallResource(skResponse.body, this.customerConfig);
+        }
+        if (!Buffer.isBuffer(skResponse.body) && this.removeContentSecurityPolicy) {
+            skResponse.body = removeContentSecurityMetaTag(skResponse.body);
         }
         for (const key in skResponse?.headers) {
             customHeaders.push({
@@ -139,6 +156,11 @@ export class VirtualOrestesApp {
                 value: skResponse?.headers[key],
             });
         }
+        // The document handler does not emit the origin's security headers, so —
+        // like the Orestes server — carry them over from the origin response onto
+        // the accelerated response. Content-Security-Policy is only carried over
+        // when `--ignoreContentSecurityPolicy` is not set.
+        this.carryOverSecurityHeaders(response, customHeaders);
         const originHeaders = [];
         response?.headers.forEach((value, key) => {
             originHeaders.push({ name: `x-origin-${key}`, value: value });
@@ -309,10 +331,31 @@ export class VirtualOrestesApp {
     isValidHtmlContent(text) {
         return text.includes("<html");
     }
-    rewriteInstallResource(text) {
-        text = text.replace(SpeedKitInstallRegex, "");
-        return text.replace(/<\s*head\b[^>]*>/, (head) => {
-            return `${head}\n<script src="${this.customerConfig.installPath}" ${this.customerConfig.installParams}></script>`;
-        });
+    /**
+     * Carries over the origin response's security headers onto the accelerated
+     * response, mirroring the Orestes server. The origin value wins over any
+     * default set in `prepareCustomHeaders`. Content-Security-Policy headers are
+     * skipped when `--ignoreContentSecurityPolicy` is set.
+     *
+     * @param {Response} response - the origin fetch response
+     * @param {{ name: string; value: string }[]} customHeaders - headers being built for the response (mutated in place)
+     */
+    carryOverSecurityHeaders(response, customHeaders) {
+        const headersToCarryOver = this.removeContentSecurityPolicy
+            ? SECURITY_HEADERS
+            : [...CONTENT_SECURITY_POLICY_HEADERS, ...SECURITY_HEADERS];
+        for (const name of headersToCarryOver) {
+            const value = response?.headers?.get(name);
+            if (value == null) {
+                continue;
+            }
+            const existing = customHeaders.findIndex((header) => header.name.toLowerCase() === name);
+            if (existing === -1) {
+                customHeaders.push({ name, value });
+            }
+            else {
+                customHeaders[existing] = { name, value };
+            }
+        }
     }
 }

package/oclif.manifest.json

@@ -1001,5 +1001,5 @@
       ]
     }
   },
-  "version": "4.19.0"
+  "version": "4.20.1"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@speedkit/cli",
   "description": "Speed Kit CLI",
-  "version": "4.19.0",
+  "version": "4.20.1",
   "author": {
     "name": "Baqend.com",
     "email": "info@baqend.com"