@wells-nelson/build-tools 1.0.2 → 1.0.3

package/README.md

@@ -36,6 +36,17 @@ export default defineConfig(({ mode, command }) => ({
 }));
 ```
 
+### Content Security Policy
+
+`contentSecurityPolicy({ supabaseUrl })` returns SvelteKit `csp` options: hashes for SvelteKit's inline
+scripts and no other scripts, network access only to the app and its Supabase project (REST and
+Realtime), images from the app, `data:`/`blob:` and Google profile pictures. Pass `connect` / `img` for
+more sources.
+
+```js
+sveltekit({ csp: contentSecurityPolicy({ supabaseUrl: env.VITE_SUPABASE_URL }), ... })
+```
+
 ## Service worker (`@wells-nelson/build-tools/service-worker`)
 
 ```ts
@@ -53,6 +64,10 @@ offline they fall back to the cached shell. A new worker skips waiting and takes
 pages. `networkOnly` paths are never cached (default: SvelteKit's `_app/version.json`, so
 `updated` from `$app/state` notices new deploys). `dev` caches nothing.
 
+On activate a worker deletes only its own older caches (`<cachePrefix>-cache-*`). Give each app
+on an origin its own `cachePrefix`: GitHub Pages project sites of one user all share
+`https://<user>.github.io`.
+
 ## Templates
 
 `templates/deploy-pages.yml` (replace `__REPO__`) and `templates/manifest.webmanifest`.

package/dist/service-worker.d.ts

@@ -29,13 +29,16 @@ export interface ServiceWorkerScopeLike {
 }
 export interface AppShellCacheOptions {
     sw: ServiceWorkerScopeLike;
-    /** Build version; each deploy gets a fresh cache and old ones are deleted. */
+    /** Build version; each deploy gets a fresh cache and this app's old ones are deleted. */
     version: string;
     /** Files to precache, relative to the scope (SvelteKit's `immutable` and `assets`). */
     files: Array<string | {
         path: string;
     }>;
-    /** Cache name prefix (default 'app'). */
+    /**
+     * Cache name prefix (default 'app'). Give every app on the same origin its own prefix: a worker
+     * only deletes caches named `<cachePrefix>-cache-*`, so apps sharing an origin keep each other's.
+     */
     cachePrefix?: string;
     /**
      * Development: cache nothing and delete what an earlier worker cached, so every code change

package/dist/service-worker.js

@@ -44,9 +44,12 @@ export function registerAppShellCache({ sw, version, files, cachePrefix = 'app',
     });
     sw.addEventListener('activate', (event) => {
         event.waitUntil((async () => {
-            for (const key of await caches.keys())
-                if (key !== CACHE)
+            // Only this app's older caches: other apps on the same origin (e.g. two GitHub Pages
+            // project sites under one user) keep theirs.
+            for (const key of await caches.keys()) {
+                if (key !== CACHE && key.startsWith(`${cachePrefix}-cache-`))
                     await caches.delete(key);
+            }
             await sw.clients.claim();
         })());
     });

package/dist/vite.d.ts

@@ -44,3 +44,25 @@ export declare function devJsonModule({ id, file, enabled }: {
     file: string;
     enabled: boolean;
 }): Plugin;
+/**
+ * SvelteKit `csp` options for an offline-first app on static hosting. SvelteKit adds a
+ * `<meta http-equiv="content-security-policy">` with hashes of its own inline scripts, so only
+ * the app's bundled scripts run: injected markup can't load or run other scripts. Network access
+ * is limited to the app's origin and its Supabase project (REST and Realtime); images also allow
+ * data/blob URLs and Google profile pictures. Styles allow inline (Svelte transitions use them).
+ *
+ * ```js
+ * sveltekit({ csp: contentSecurityPolicy({ supabaseUrl: env.VITE_SUPABASE_URL }), ... })
+ * ```
+ */
+export declare function contentSecurityPolicy({ supabaseUrl, connect, img }?: {
+    /** The project URL (`VITE_SUPABASE_URL`); without it any `*.supabase.co` project is allowed. */
+    supabaseUrl?: string;
+    /** Extra `connect-src` sources. */
+    connect?: string[];
+    /** Extra `img-src` sources. */
+    img?: string[];
+}): {
+    mode: "hash";
+    directives: Record<string, any[]>;
+};

package/dist/vite.js

@@ -80,3 +80,41 @@ export function devJsonModule({ id, file, enabled }) {
         }
     };
 }
+/**
+ * SvelteKit `csp` options for an offline-first app on static hosting. SvelteKit adds a
+ * `<meta http-equiv="content-security-policy">` with hashes of its own inline scripts, so only
+ * the app's bundled scripts run: injected markup can't load or run other scripts. Network access
+ * is limited to the app's origin and its Supabase project (REST and Realtime); images also allow
+ * data/blob URLs and Google profile pictures. Styles allow inline (Svelte transitions use them).
+ *
+ * ```js
+ * sveltekit({ csp: contentSecurityPolicy({ supabaseUrl: env.VITE_SUPABASE_URL }), ... })
+ * ```
+ */
+export function contentSecurityPolicy({ supabaseUrl, connect = [], img = [] } = {}) {
+    let supabase = ['https://*.supabase.co', 'wss://*.supabase.co'];
+    if (supabaseUrl) {
+        try {
+            const { host, protocol } = new URL(supabaseUrl);
+            supabase = [`${protocol}//${host}`, `${protocol === 'http:' ? 'ws' : 'wss'}://${host}`];
+        }
+        catch {
+            /* keep the wildcard */
+        }
+    }
+    // Typed loosely (`any[]`) so it fits SvelteKit's `CspDirectives` without depending on SvelteKit.
+    const directives = {
+        'default-src': ['self'],
+        'script-src': ['self'],
+        'style-src': ['self', 'unsafe-inline'],
+        'img-src': ['self', 'data:', 'blob:', 'https://*.googleusercontent.com', ...img],
+        'font-src': ['self'],
+        'connect-src': ['self', ...supabase, ...connect],
+        'worker-src': ['self'],
+        'manifest-src': ['self'],
+        'object-src': ['none'],
+        'base-uri': ['self'],
+        'form-action': ['self']
+    };
+    return { mode: 'hash', directives };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wells-nelson/build-tools",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Build and deployment tooling for Wells Nelson SvelteKit PWAs: postbuild, PWA icon generator, Vite config pieces, service worker, and templates.",
   "license": "MIT",
   "repository": {

package/templates/deploy-pages.yml

@@ -26,6 +26,9 @@ jobs:
           node-version: 24
           cache: npm
       - run: npm ci
+      # Nothing ships unless it type-checks and its tests pass.
+      - run: npm run check --if-present
+      - run: npm test --if-present
       - run: npm run build
         env:
           # Repository variables (Settings > Secrets and variables > Actions > Variables).