@stnd/modules 0.7.0 → 0.8.1

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @stnd/folios
 
+## 0.8.1
+
+### Patch Changes
+
+- Updated dependencies
+  - @stnd/server@0.9.0
+
+## 0.8.0
+
+### Minor Changes
+
+- Auto-bumped @stnd/modules due to modified code.
+
 ## 0.7.0
 
 ### Minor Changes

package/headers/index.module.js

@@ -6,12 +6,15 @@
  *    Policy lives in `@stnd/server/security`; an app extends it with
  *    `standard({ security: { csp: { extend: { "script-src": [...] } } } })`.
  *  - `/api/csp-report`: where the policy's violations are sent.
+ *  - Build: the same headers appended to `_headers` for prerendered files.
  *  - `/_headers`: the same basics as a Cloudflare headers file.
  */
 export default {
   id: "stnd-headers",
   name: "Stnd :: Headers",
   description: "Security headers on every response, and the CSP violation report endpoint.",
+  // Prerendered pages never reach the Worker: they get the same headers from the build's _headers file.
+  hooks: { "astro:build:done": [{ action: "./static-headers.js" }] },
   middleware: [{ entrypoint: "./middleware.js", order: -1000 }],
   routes: [
     {

package/headers/static-headers.js

@@ -0,0 +1,39 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import Log from "@stnd/log";
+
+const log = Log({ scope: "Headers" });
+const MARKER = "# stnd:security-headers";
+
+/**
+ * astro:build:done — the middleware only sees responses the Worker produces.
+ * Prerendered pages are static files served straight from Cloudflare's asset
+ * store, never reaching it, so they get the same headers through the build's
+ * `_headers` file. Headers the app's own `_headers` already sets are left alone
+ * (Cloudflare would otherwise send both values).
+ */
+export default async function writeStaticHeaders({ dir }) {
+  const options = globalThis.__STANDARD_CONFIG__?.security || {};
+  if (options.enabled === false) return;
+
+  const { securityHeaders } = await import("@stnd/server/security");
+  const wanted = securityHeaders(new URL("https://static.invalid/"), "text/html", options);
+
+  const outDir = fileURLToPath(dir);
+  const file = path.join(outDir, "_headers");
+  const existing = fs.existsSync(file) ? fs.readFileSync(file, "utf8") : "";
+  if (existing.includes(MARKER)) return;
+
+  const declared = new Set(
+    [...existing.matchAll(/^[ \t]+([A-Za-z0-9-]+):/gm)].map((m) => m[1].toLowerCase()),
+  );
+  const lines = Object.entries(wanted)
+    .filter(([name]) => !declared.has(name.toLowerCase()))
+    .map(([name, value]) => `  ${name}: ${value}`);
+  if (!lines.length) return;
+
+  const block = `${existing && !existing.endsWith("\n") ? "\n" : ""}\n${MARKER}\n/*\n${lines.join("\n")}\n`;
+  fs.writeFileSync(file, existing + block);
+  log.info(`Security headers added to ${path.relative(process.cwd(), file) || file} for prerendered files`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stnd/modules",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "type": "module",
   "svelte": "./stripe/views/CheckoutView.svelte",
   "author": "Francis Fontaine",
@@ -21,7 +21,7 @@
     "@stnd/icon": "0.7.0",
     "@stnd/layout": "0.7.7",
     "@stnd/log": "0.5.2",
-    "@stnd/server": "0.8.0",
+    "@stnd/server": "0.9.0",
     "@stnd/styles": "0.13.0",
     "@stnd/utils": "0.7.3"
   },