tempest-react-sdk 0.67.0 → 0.68.0

package/dist/vite/tempest-csp.cjs

@@ -0,0 +1,3 @@
+let e=require("node:crypto");var t=new Set([`frame-ancestors`,`report-uri`,`sandbox`]),n=[{module:/[\\/]forms[\\/]use-viacep\.(?:[cm]?js|tsx?)$/,origin:`https://viacep.com.br`,from:`tempest-react-sdk useViaCEP`}],r=/^(?:https?|wss?):\/\//i,i=/^((?:https?|wss?):\/\/\*\.[a-z0-9.-]+(?::\d+)?)(?:[/?#].*)?$/i;function a(e,t){let n=e.trim();if(n.startsWith(`/`)&&!n.startsWith(`//`))return;let a=i.exec(n);if(a)return a[1].toLowerCase();if(r.test(n))try{let e=new URL(n);return`${e.protocol}//${e.host}`}catch{throw Error(`tempestCsp: ${t} is not a valid URL: "${e}"`)}throw Error(`tempestCsp: ${t} must be an absolute http(s)/ws(s) URL or a root-relative path, got "${e}"`)}function o(e){let t={};for(let n of e.split(`;`)){let[e,...r]=n.trim().split(/\s+/);if(!e)continue;let i=e.toLowerCase();i in t||(t[i]=r)}return t}function s(e,n){return Object.entries(e).filter(([e])=>n===`header`||!t.has(e)).map(([e,t])=>[e,...t].join(` `)).join(`; `)}function c(e,t){let n=e.filter(e=>e!==`'none'`||t.length===0);for(let e of t)n.includes(e)||n.push(e);return n.length===0?[`'none'`]:n}function l(t){return`'sha256-${(0,e.createHash)(`sha256`).update(t,`utf8`).digest(`base64`)}'`}function u(e){return e.replace(/&#39;|&#x27;|&apos;/gi,`'`).replace(/&quot;/gi,`"`).replace(/&amp;/gi,`&`)}function d(e){let t={};for(let n of e.matchAll(/([^\s=<>/]+)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/g))t[n[1].toLowerCase()]=u(n[2]??n[3]??n[4]??``);return t}function f(e){let t=[...e.matchAll(/<meta\b[^>]*>/gi)].filter(e=>d(e[0])[`http-equiv`]?.toLowerCase()===`content-security-policy`);if(t.length===0)return{html:e};if(t.length>1)throw Error(`tempestCsp: index.html declares more than one Content-Security-Policy <meta>; merge them into one`);let n=t[0];return{html:e.slice(0,n.index)+e.slice(n.index+n[0].length).replace(/^[ \t]*\r?\n/,``),declared:o(d(n[0]).content??``)}}function p(e,t){let n=RegExp(`<${t}\\b([^>]*)>([\\s\\S]*?)</${t}>`,`gi`),r=[];for(let i of e.matchAll(n)){let e=d(`<x ${i[1]}>`);if(t===`script`&&`src`in e||i[2].length===0)continue;let n=l(i[2]);r.includes(n)||r.push(n)}return r}function m(e,t){let n=`<meta http-equiv="Content-Security-Policy" content="${t.replace(/&/g,`&amp;`).replace(/"/g,`&quot;`)}" />`,r=/<meta\b[^>]*\bcharset\s*=[^>]*>/i.exec(e),i=/<head\b[^>]*>/i.exec(e),a=r!==null&&i!==null&&/<(?:script|link|style)\b/i.test(e.slice(i.index,r.index)),o=r&&i&&r.index>i.index&&!a?r:i;if(!o)return`${n}\n${e}`;let s=o.index+o[0].length;return`${e.slice(0,s)}\n    ${n}${e.slice(s)}`}function h(e){let t=[];for(let n of Object.values(e.bundle??{}))n.type===`chunk`&&t.push(...n.moduleIds??Object.keys(n.modules??{}));return t}function g(e={}){let{connect:t=[],env:i=!0,sockets:o=!0,wasm:l=!0,inlineStyles:u=!0,directives:d={},dev:g=!0,log:_=!0,onPolicy:v}=e,y,b=[],x=``;function S(e,t,n){t===void 0||e.some(e=>e.origin===t)||e.push({origin:t,from:n})}function C(e){let n=[],o=e.env??{},s=[e.envPrefix??`VITE_`].flat();if(i===!0)for(let[e,t]of Object.entries(o))s.some(t=>e.startsWith(t))&&typeof t==`string`&&r.test(t.trim())&&S(n,a(t,`env ${e}`),`env ${e}`);else if(Array.isArray(i))for(let t of i){let r=o[t];if(typeof r!=`string`||r.trim()===``){e.logger.warn(`tempestCsp: env ${t} is empty — nothing added to connect-src`);continue}S(n,a(r,`env ${t}`),`env ${t}`)}return t.forEach((t,r)=>{if(!t||t.trim()===``){e.logger.warn(`tempestCsp: connect[${r}] is empty — skipped, nothing added to connect-src`);return}S(n,a(t,`connect[${r}]`),`connect[${r}]`)}),n}function w(e){let t=[...e];if(!o)return t;for(let{origin:n}of e){let e=n.replace(/^http(s?):/i,`ws$1:`);e!==n&&S(t,e,`sockets (${n})`)}return t}function T(e,t){let n=e?[`'self'`,e]:[`'self'`],r={"default-src":[...n],"script-src":l?[...n,`'wasm-unsafe-eval'`]:[...n],"style-src":u||t?[...n,`'unsafe-inline'`]:[...n],"img-src":[...n,`data:`,`blob:`],"font-src":[...n,`data:`],"media-src":[...n,`blob:`],"connect-src":[`'self'`,`blob:`,`data:`],"worker-src":[...n,`blob:`],"manifest-src":[...n],"object-src":[`'none'`],"base-uri":[`'self'`],"form-action":[`'self'`]};for(let[e,t]of Object.entries(d)){let n=e.toLowerCase();t===!1?delete r[n]:r[n]=c(r[n]??[],t)}return r}return{name:`tempest-csp`,configResolved(e){y=e,b=C(e)},transformIndexHtml:{order:`post`,handler(e,t){let i=y?.command===`serve`;if(i&&!g)return e;let o=w(b),l=y?.base??`/`,u=r.test(l)?a(l,`base`):void 0;u&&S(o,u,`base`);let d=i?[]:h(t);for(let e of n)(i||d.some(t=>e.module.test(t)))&&S(o,e.origin,e.from);let C=o,{html:E,declared:D={}}=f(e),O=T(u,i);`script-src`in D||(O[`script-src`]=c(O[`script-src`]??[],p(E,`script`))),!(`style-src`in D)&&!O[`style-src`]?.includes(`'unsafe-inline'`)&&(O[`style-src`]=c(O[`style-src`]??[],p(E,`style`)));let k={...O};for(let[e,t]of Object.entries(D))k[e]=t;k[`connect-src`]=c(k[`connect-src`]??[`'self'`],C.map(e=>e.origin));let A={directives:k,meta:s(k,`meta`),header:s(k,`header`),connect:C,command:i?`serve`:`build`};if(_&&y&&A.header!==x){x=A.header;let e=C.map(e=>`  ${e.origin}  ← ${e.from}`);y.logger.info([`tempest-csp: connect-src ${k[`connect-src`].join(` `)}`,...e.length>0?e:[`  (no cross-origin endpoint: only 'self')`]].join(`
+`))}return v?.(A),m(E,A.meta)}}}}exports.cspOrigin=a,exports.parseCsp=o,exports.serializeCsp=s,exports.tempestCsp=g;
+//# sourceMappingURL=tempest-csp.cjs.map

package/dist/vite/tempest-csp.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tempest-csp.cjs","names":[],"sources":["../../src/vite/tempest-csp.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { IndexHtmlTransformContext, Plugin, ResolvedConfig } from \"vite\";\n\nimport type { TempestVitePlugin } from \"./tempest-pwa-manifest\";\n\n/** Options for {@link tempestCsp}. */\nexport interface TempestCspOptions {\n    /**\n     * Endpoints the app calls at runtime, as full URLs. Only the origin\n     * (`scheme://host[:port]`) enters `connect-src`: a source expression with a path\n     * matches that path alone, so `https://idp/realms/x` would still block\n     * `https://idp/realms/x/protocol/openid-connect/token`.\n     *\n     * Empty entries (`undefined`, `null`, `false`, `\"\"`) are skipped with a build\n     * warning instead of leaving a hole in the directive, so passing an env var\n     * that is not set is safe. A root-relative path (`/api`) is same-origin and\n     * already covered by `'self'`. Anything else that is not an absolute\n     * `http(s)`/`ws(s)` URL throws at config time — failing the build, not\n     * production. A wildcard host (`https://*.example.com`) is kept as written.\n     */\n    connect?: ReadonlyArray<string | null | undefined | false>;\n    /**\n     * Read origins from the same environment the runtime reads. `true` (the\n     * default) adds every variable Vite exposes to `import.meta.env` (the\n     * `envPrefix` ones, `VITE_` by default) whose value is an absolute\n     * `http(s)`/`ws(s)` URL. This is the structural bridge: an origin added to\n     * `.env` for a new runtime call lands in the policy with no second list to\n     * keep in sync. Pass a list of names to include exactly those — a name that\n     * resolves to nothing is reported as a build warning — or `false` to rely on\n     * {@link TempestCspOptions.connect} alone.\n     */\n    env?: boolean | readonly string[];\n    /**\n     * Also allow the WebSocket twin of every `http(s)` origin (`https://api` →\n     * `wss://api`). Measured in Chromium (23/09/2026): `connect-src https://api`\n     * blocks `new WebSocket(\"wss://api\")`, while `'self'` does cover a same-origin\n     * `ws:` — so an app that derives its socket URL from the API URL breaks\n     * without this. Default `true`.\n     */\n    sockets?: boolean;\n    /**\n     * Add `'wasm-unsafe-eval'` to `script-src`, which `onnxruntime-web` (the\n     * `/vision` and `/tabular` subpaths) needs to compile its WebAssembly. Without\n     * it `WebAssembly.compile` throws a `CompileError` naming `script-src`.\n     * It grants WebAssembly compilation only, not `eval`. Default `true`.\n     */\n    wasm?: boolean;\n    /**\n     * Add `'unsafe-inline'` to `style-src`. React's `style` prop does **not** need\n     * it — it writes through the CSSOM, which CSP does not govern (measured in\n     * Chromium, 23/09/2026). What needs it is a `<style>` element or a `style=\"\"`\n     * attribute, and the SDK's own `applyTheme` injects a `<style>`. Pass `false`\n     * when the app never calls `applyTheme`; inline `<style>` blocks in\n     * `index.html` are then hashed instead. Always on under `vite dev`, whose CSS\n     * injection is a `<style>` element. Default `true`.\n     */\n    inlineStyles?: boolean;\n    /**\n     * Extra sources per directive, merged into the defaults (`{ \"img-src\":\n     * [\"https://tiles.example.com\"] }`), or `false` to drop a directive.\n     * `frame-ancestors`, `report-uri` and `sandbox` are ignored by browsers when\n     * delivered by `<meta>`, so they reach {@link TempestCspPolicy.header} only.\n     */\n    directives?: Readonly<Record<string, readonly string[] | false>>;\n    /**\n     * Apply the policy under `vite dev` too. Default `true`: the failure this\n     * plugin exists for is \"works in dev, blocked in production\", and a policy\n     * enforced in dev moves every missing origin to the first page load on the\n     * developer's machine. Dev differs from build only in `style-src\n     * 'unsafe-inline'` and in allowing every SDK-known origin (see\n     * {@link TempestCspPolicy.connect}), because the dev server cannot know which\n     * modules the page will load.\n     */\n    dev?: boolean;\n    /** Print the resolved `connect-src` and where each origin came from. Default `true`. */\n    log?: boolean;\n    /**\n     * Receive the resolved policy — for asserting it in a test, or for writing the\n     * same policy as an HTTP header (the only channel for `frame-ancestors`).\n     */\n    onPolicy?: (policy: TempestCspPolicy) => void;\n}\n\n/** One origin in `connect-src` and the input that put it there. */\nexport interface TempestCspSource {\n    /** The source expression, e.g. `https://api.example.com`. */\n    origin: string;\n    /** Where it came from: `env VITE_API_URL`, `connect[0]`, `sockets`, `base` or an SDK module. */\n    from: string;\n}\n\n/** The policy {@link tempestCsp} resolved for one `index.html`. */\nexport interface TempestCspPolicy {\n    /** Every directive and its sources, including the header-only ones. */\n    directives: Record<string, string[]>;\n    /** The policy as written into the `<meta http-equiv>` tag. */\n    meta: string;\n    /** The full policy for a `Content-Security-Policy` response header. */\n    header: string;\n    /** Every origin added to `connect-src`, with its provenance. */\n    connect: TempestCspSource[];\n    /** `\"serve\"` under `vite dev`, `\"build\"` under `vite build`. */\n    command: \"serve\" | \"build\";\n}\n\n/**\n * Directives a browser ignores when the policy arrives by `<meta>` (CSP3 §3.3),\n * printing a console warning for each.\n */\nconst HEADER_ONLY_DIRECTIVES: ReadonlySet<string> = new Set([\n    \"frame-ancestors\",\n    \"report-uri\",\n    \"sandbox\",\n]);\n\n/**\n * Origins the SDK itself calls, keyed by the module that calls them. In a build\n * the origin enters only when the module is in the bundle; in dev always.\n */\nconst SDK_ORIGINS: ReadonlyArray<{ module: RegExp; origin: string; from: string }> = [\n    {\n        module: /[\\\\/]forms[\\\\/]use-viacep\\.(?:[cm]?js|tsx?)$/,\n        origin: \"https://viacep.com.br\",\n        from: \"tempest-react-sdk useViaCEP\",\n    },\n];\n\nconst ABSOLUTE_URL = /^(?:https?|wss?):\\/\\//i;\nconst WILDCARD_SOURCE = /^((?:https?|wss?):\\/\\/\\*\\.[a-z0-9.-]+(?::\\d+)?)(?:[/?#].*)?$/i;\n\n/**\n * Reduce a URL to the origin a CSP source expression should carry.\n *\n * @param value - The URL as the app configured it.\n * @param from - Its provenance, quoted in the error.\n * @returns The origin, or `undefined` for a root-relative path (covered by `'self'`).\n * @throws {Error} When the value is neither an absolute `http(s)`/`ws(s)` URL nor a path.\n */\nexport function cspOrigin(value: string, from: string): string | undefined {\n    const trimmed = value.trim();\n    if (trimmed.startsWith(\"/\") && !trimmed.startsWith(\"//\")) return undefined;\n    const wildcard = WILDCARD_SOURCE.exec(trimmed);\n    if (wildcard) return wildcard[1]!.toLowerCase();\n    if (ABSOLUTE_URL.test(trimmed)) {\n        try {\n            const url = new URL(trimmed);\n            return `${url.protocol}//${url.host}`;\n        } catch {\n            throw new Error(`tempestCsp: ${from} is not a valid URL: \"${value}\"`);\n        }\n    }\n    throw new Error(\n        `tempestCsp: ${from} must be an absolute http(s)/ws(s) URL or a root-relative path, got \"${value}\"`,\n    );\n}\n\n/**\n * Parse a serialized policy into directives, lowercasing names. A repeated\n * directive keeps its first occurrence, as browsers do.\n *\n * @param policy - A `Content-Security-Policy` value.\n * @returns Directive name → sources.\n */\nexport function parseCsp(policy: string): Record<string, string[]> {\n    const out: Record<string, string[]> = {};\n    for (const part of policy.split(\";\")) {\n        const [name, ...sources] = part.trim().split(/\\s+/);\n        if (!name) continue;\n        const key = name.toLowerCase();\n        if (!(key in out)) out[key] = sources;\n    }\n    return out;\n}\n\n/**\n * Serialize directives into a policy string, dropping header-only directives\n * when the target is a `<meta>` tag.\n *\n * @param directives - Directive name → sources.\n * @param target - `\"meta\"` or `\"header\"`.\n * @returns The policy value.\n */\nexport function serializeCsp(\n    directives: Readonly<Record<string, readonly string[]>>,\n    target: \"meta\" | \"header\",\n): string {\n    return Object.entries(directives)\n        .filter(([name]) => target === \"header\" || !HEADER_ONLY_DIRECTIVES.has(name))\n        .map(([name, sources]) => [name, ...sources].join(\" \"))\n        .join(\"; \");\n}\n\nfunction union(base: readonly string[], extra: readonly string[]): string[] {\n    const out = base.filter((source) => source !== \"'none'\" || extra.length === 0);\n    for (const source of extra) if (!out.includes(source)) out.push(source);\n    return out.length === 0 ? [\"'none'\"] : out;\n}\n\nfunction sha256(content: string): string {\n    return `'sha256-${createHash(\"sha256\").update(content, \"utf8\").digest(\"base64\")}'`;\n}\n\nfunction decodeEntities(value: string): string {\n    return value\n        .replace(/&#39;|&#x27;|&apos;/gi, \"'\")\n        .replace(/&quot;/gi, '\"')\n        .replace(/&amp;/gi, \"&\");\n}\n\nfunction readAttributes(tag: string): Record<string, string> {\n    const out: Record<string, string> = {};\n    const pattern = /([^\\s=<>/]+)\\s*=\\s*(?:\"([^\"]*)\"|'([^']*)'|([^\\s>]+))/g;\n    for (const match of tag.matchAll(pattern)) {\n        out[match[1]!.toLowerCase()] = decodeEntities(match[2] ?? match[3] ?? match[4] ?? \"\");\n    }\n    return out;\n}\n\n/**\n * Find the policy `index.html` already declares and remove its tag, so the merged\n * policy replaces it instead of stacking a second one (two policies are\n * intersected by the browser, so the stricter would win silently).\n *\n * @throws {Error} When the page declares more than one CSP `<meta>`: merging an\n *   intersection into a union would weaken it, so the plugin refuses.\n */\nfunction extractMetaPolicy(html: string): { html: string; declared?: Record<string, string[]> } {\n    const tags = [...html.matchAll(/<meta\\b[^>]*>/gi)].filter(\n        (match) =>\n            readAttributes(match[0])[\"http-equiv\"]?.toLowerCase() === \"content-security-policy\",\n    );\n    if (tags.length === 0) return { html };\n    if (tags.length > 1) {\n        throw new Error(\n            \"tempestCsp: index.html declares more than one Content-Security-Policy <meta>; merge them into one\",\n        );\n    }\n    const tag = tags[0]!;\n    return {\n        html:\n            html.slice(0, tag.index) +\n            html.slice(tag.index! + tag[0].length).replace(/^[ \\t]*\\r?\\n/, \"\"),\n        declared: parseCsp(readAttributes(tag[0]).content ?? \"\"),\n    };\n}\n\nfunction inlineHashes(html: string, element: \"script\" | \"style\"): string[] {\n    const pattern = new RegExp(`<${element}\\\\b([^>]*)>([\\\\s\\\\S]*?)</${element}>`, \"gi\");\n    const hashes: string[] = [];\n    for (const match of html.matchAll(pattern)) {\n        const attributes = readAttributes(`<x ${match[1]}>`);\n        if (element === \"script\" && \"src\" in attributes) continue;\n        if (match[2]!.length === 0) continue;\n        const hash = sha256(match[2]!);\n        if (!hashes.includes(hash)) hashes.push(hash);\n    }\n    return hashes;\n}\n\n/**\n * Write the policy tag where it governs the whole page. A `<meta>` CSP applies\n * only to what follows it, so it goes right after `<meta charset>` — unless a\n * resource precedes the charset, as the React Refresh preamble does under\n * `vite dev` (`head-prepend`), in which case it goes right after `<head>`.\n */\nfunction insertMeta(html: string, policy: string): string {\n    const escaped = policy.replace(/&/g, \"&amp;\").replace(/\"/g, \"&quot;\");\n    const tag = `<meta http-equiv=\"Content-Security-Policy\" content=\"${escaped}\" />`;\n    const charset = /<meta\\b[^>]*\\bcharset\\s*=[^>]*>/i.exec(html);\n    const head = /<head\\b[^>]*>/i.exec(html);\n    const resourceFirst =\n        charset !== null &&\n        head !== null &&\n        /<(?:script|link|style)\\b/i.test(html.slice(head.index, charset.index));\n    const anchor = charset && head && charset.index > head.index && !resourceFirst ? charset : head;\n    if (!anchor) return `${tag}\\n${html}`;\n    const at = anchor.index + anchor[0].length;\n    return `${html.slice(0, at)}\\n    ${tag}${html.slice(at)}`;\n}\n\nfunction bundleModuleIds(ctx: IndexHtmlTransformContext): string[] {\n    const ids: string[] = [];\n    for (const output of Object.values(ctx.bundle ?? {})) {\n        if (output.type !== \"chunk\") continue;\n        ids.push(...(output.moduleIds ?? Object.keys(output.modules ?? {})));\n    }\n    return ids;\n}\n\n/**\n * Vite plugin that writes a Content-Security-Policy `<meta>` into `index.html`\n * and derives `connect-src` from the origins the app actually calls.\n *\n * It exists because of how a missing origin fails: the request is blocked\n * before a connection opens, so there is no entry in the Network tab, nothing in\n * the server log, `curl` succeeds, and the app sees `TypeError: Failed to\n * fetch` — indistinguishable from offline, DNS or CORS. And a hand-written CSP\n * plugin is usually `apply: \"build\"`, so it only fails in production. This\n * plugin closes both ends:\n *\n * - origins come from the same `import.meta.env` the runtime reads\n *   ({@link TempestCspOptions.env}), reduced to `scheme://host[:port]`, with\n *   empty values skipped — no second list to drift;\n * - the policy is enforced under `vite dev` as well ({@link TempestCspOptions.dev});\n * - the build prints every origin and its provenance.\n *\n * Defaults cover what the SDK's stack needs and nothing more: `'self'`\n * everywhere, `'wasm-unsafe-eval'` for ONNX Runtime, `blob:` for workers, object\n * URLs and media, `data:` for images and fonts, `object-src 'none'`,\n * `base-uri 'self'`, `form-action 'self'`. Inline `<script>` blocks left in\n * `index.html` (a `themeInitScript()` anti-flash script, say) are allowed by\n * SHA-256 hash, never by `'unsafe-inline'`.\n *\n * An existing CSP `<meta>` in `index.html` is merged, not overwritten: every\n * directive it declares is kept verbatim — the plugin never loosens a choice the\n * app wrote — except `connect-src`, which gains the resolved origins, since\n * that is the list the plugin exists to maintain. Directives it does not declare\n * come from the defaults.\n *\n * @param options - See {@link TempestCspOptions}.\n * @returns A Vite plugin, to be placed in `plugins`. It runs as a `post` HTML\n *   transform, so a plugin that rewrites inline scripts after it would\n *   invalidate the hashes.\n *\n * @example\n * // vite.config.ts\n * import { createViteConfig, tempestCsp } from \"tempest-react-sdk/vite\";\n *\n * export default createViteConfig({\n *     plugins: [tempestCsp({ connect: [\"https://sso.example.com/realms/app\"] })],\n * });\n */\nexport function tempestCsp(options: TempestCspOptions = {}): TempestVitePlugin {\n    const {\n        connect = [],\n        env = true,\n        sockets = true,\n        wasm = true,\n        inlineStyles = true,\n        directives: extra = {},\n        dev = true,\n        log = true,\n        onPolicy,\n    } = options;\n\n    let config: ResolvedConfig | undefined;\n    let resolved: TempestCspSource[] = [];\n    let lastLogged = \"\";\n\n    function add(list: TempestCspSource[], origin: string | undefined, from: string): void {\n        if (origin === undefined || list.some((source) => source.origin === origin)) return;\n        list.push({ origin, from });\n    }\n\n    function resolveSources(resolvedConfig: ResolvedConfig): TempestCspSource[] {\n        const list: TempestCspSource[] = [];\n        const values: Record<string, unknown> = resolvedConfig.env ?? {};\n        const prefixes = [resolvedConfig.envPrefix ?? \"VITE_\"].flat();\n        if (env === true) {\n            for (const [name, value] of Object.entries(values)) {\n                if (!prefixes.some((prefix) => name.startsWith(prefix))) continue;\n                if (typeof value !== \"string\" || !ABSOLUTE_URL.test(value.trim())) continue;\n                add(list, cspOrigin(value, `env ${name}`), `env ${name}`);\n            }\n        } else if (Array.isArray(env)) {\n            for (const name of env) {\n                const value = values[name];\n                if (typeof value !== \"string\" || value.trim() === \"\") {\n                    resolvedConfig.logger.warn(\n                        `tempestCsp: env ${name} is empty — nothing added to connect-src`,\n                    );\n                    continue;\n                }\n                add(list, cspOrigin(value, `env ${name}`), `env ${name}`);\n            }\n        }\n        connect.forEach((value, index) => {\n            if (!value || value.trim() === \"\") {\n                resolvedConfig.logger.warn(\n                    `tempestCsp: connect[${index}] is empty — skipped, nothing added to connect-src`,\n                );\n                return;\n            }\n            add(list, cspOrigin(value, `connect[${index}]`), `connect[${index}]`);\n        });\n        return list;\n    }\n\n    function withSockets(list: readonly TempestCspSource[]): TempestCspSource[] {\n        const out = [...list];\n        if (!sockets) return out;\n        for (const { origin } of list) {\n            const twin = origin.replace(/^http(s?):/i, \"ws$1:\");\n            if (twin !== origin) add(out, twin, `sockets (${origin})`);\n        }\n        return out;\n    }\n\n    function defaults(baseOrigin: string | undefined, serve: boolean): Record<string, string[]> {\n        const self = baseOrigin ? [\"'self'\", baseOrigin] : [\"'self'\"];\n        const policy: Record<string, string[]> = {\n            \"default-src\": [...self],\n            \"script-src\": wasm ? [...self, \"'wasm-unsafe-eval'\"] : [...self],\n            \"style-src\": inlineStyles || serve ? [...self, \"'unsafe-inline'\"] : [...self],\n            \"img-src\": [...self, \"data:\", \"blob:\"],\n            \"font-src\": [...self, \"data:\"],\n            \"media-src\": [...self, \"blob:\"],\n            \"connect-src\": [\"'self'\", \"blob:\", \"data:\"],\n            \"worker-src\": [...self, \"blob:\"],\n            \"manifest-src\": [...self],\n            \"object-src\": [\"'none'\"],\n            \"base-uri\": [\"'self'\"],\n            \"form-action\": [\"'self'\"],\n        };\n        for (const [name, sources] of Object.entries(extra)) {\n            const key = name.toLowerCase();\n            if (sources === false) delete policy[key];\n            else policy[key] = union(policy[key] ?? [], sources);\n        }\n        return policy;\n    }\n\n    const plugin: Plugin = {\n        name: \"tempest-csp\",\n        configResolved(resolvedConfig) {\n            config = resolvedConfig;\n            resolved = resolveSources(resolvedConfig);\n        },\n        transformIndexHtml: {\n            order: \"post\",\n            handler(source, ctx) {\n                const serve = config?.command === \"serve\";\n                if (serve && !dev) return source;\n\n                const connectSources = withSockets(resolved);\n                const base = config?.base ?? \"/\";\n                const baseOrigin = ABSOLUTE_URL.test(base) ? cspOrigin(base, \"base\") : undefined;\n                if (baseOrigin) add(connectSources, baseOrigin, \"base\");\n                const moduleIds = serve ? [] : bundleModuleIds(ctx);\n                for (const known of SDK_ORIGINS) {\n                    if (serve || moduleIds.some((id) => known.module.test(id))) {\n                        add(connectSources, known.origin, known.from);\n                    }\n                }\n                const allSources = connectSources;\n\n                const { html, declared = {} } = extractMetaPolicy(source);\n                const policy = defaults(baseOrigin, serve);\n                if (!(\"script-src\" in declared)) {\n                    policy[\"script-src\"] = union(\n                        policy[\"script-src\"] ?? [],\n                        inlineHashes(html, \"script\"),\n                    );\n                }\n                if (\n                    !(\"style-src\" in declared) &&\n                    !policy[\"style-src\"]?.includes(\"'unsafe-inline'\")\n                ) {\n                    policy[\"style-src\"] = union(\n                        policy[\"style-src\"] ?? [],\n                        inlineHashes(html, \"style\"),\n                    );\n                }\n                const merged: Record<string, string[]> = { ...policy };\n                for (const [name, sources] of Object.entries(declared)) merged[name] = sources;\n                merged[\"connect-src\"] = union(\n                    merged[\"connect-src\"] ?? [\"'self'\"],\n                    allSources.map((entry) => entry.origin),\n                );\n\n                const result: TempestCspPolicy = {\n                    directives: merged,\n                    meta: serializeCsp(merged, \"meta\"),\n                    header: serializeCsp(merged, \"header\"),\n                    connect: allSources,\n                    command: serve ? \"serve\" : \"build\",\n                };\n\n                if (log && config && result.header !== lastLogged) {\n                    lastLogged = result.header;\n                    const lines = allSources.map((entry) => `  ${entry.origin}  ← ${entry.from}`);\n                    config.logger.info(\n                        [\n                            `tempest-csp: connect-src ${merged[\"connect-src\"].join(\" \")}`,\n                            ...(lines.length > 0\n                                ? lines\n                                : [\"  (no cross-origin endpoint: only 'self')\"]),\n                        ].join(\"\\n\"),\n                    );\n                }\n                onPolicy?.(result);\n                return insertMeta(html, result.meta);\n            },\n        },\n    };\n\n    return plugin as TempestVitePlugin;\n}\n"],"mappings":"6BA6GA,IAAM,EAA8C,IAAI,IAAI,CACxD,kBACA,aACA,SACJ,CAAC,EAMK,EAA+E,CACjF,CACI,OAAQ,+CACR,OAAQ,wBACR,KAAM,6BACV,CACJ,EAEM,EAAe,yBACf,EAAkB,gEAUxB,SAAgB,EAAU,EAAe,EAAkC,CACvE,IAAM,EAAU,EAAM,KAAK,EAC3B,GAAI,EAAQ,WAAW,GAAG,GAAK,CAAC,EAAQ,WAAW,IAAI,EAAG,OAC1D,IAAM,EAAW,EAAgB,KAAK,CAAO,EAC7C,GAAI,EAAU,OAAO,EAAS,EAAE,CAAE,YAAY,EAC9C,GAAI,EAAa,KAAK,CAAO,EACzB,GAAI,CACA,IAAM,EAAM,IAAI,IAAI,CAAO,EAC3B,MAAO,GAAG,EAAI,SAAS,IAAI,EAAI,MACnC,MAAQ,CACJ,MAAU,MAAM,eAAe,EAAK,wBAAwB,EAAM,EAAE,CACxE,CAEJ,MAAU,MACN,eAAe,EAAK,uEAAuE,EAAM,EACrG,CACJ,CASA,SAAgB,EAAS,EAA0C,CAC/D,IAAM,EAAgC,CAAC,EACvC,IAAK,IAAM,KAAQ,EAAO,MAAM,GAAG,EAAG,CAClC,GAAM,CAAC,EAAM,GAAG,GAAW,EAAK,KAAK,CAAC,CAAC,MAAM,KAAK,EAClD,GAAI,CAAC,EAAM,SACX,IAAM,EAAM,EAAK,YAAY,EACvB,KAAO,IAAM,EAAI,GAAO,EAClC,CACA,OAAO,CACX,CAUA,SAAgB,EACZ,EACA,EACM,CACN,OAAO,OAAO,QAAQ,CAAU,CAAC,CAC5B,QAAQ,CAAC,KAAU,IAAW,UAAY,CAAC,EAAuB,IAAI,CAAI,CAAC,CAAC,CAC5E,KAAK,CAAC,EAAM,KAAa,CAAC,EAAM,GAAG,CAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CACtD,KAAK,IAAI,CAClB,CAEA,SAAS,EAAM,EAAyB,EAAoC,CACxE,IAAM,EAAM,EAAK,OAAQ,GAAW,IAAW,UAAY,EAAM,SAAW,CAAC,EAC7E,IAAK,IAAM,KAAU,EAAY,EAAI,SAAS,CAAM,GAAG,EAAI,KAAK,CAAM,EACtE,OAAO,EAAI,SAAW,EAAI,CAAC,QAAQ,EAAI,CAC3C,CAEA,SAAS,EAAO,EAAyB,CACrC,MAAO,YAAA,EAAW,EAAA,WAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,EAAS,MAAM,CAAC,CAAC,OAAO,QAAQ,EAAE,EACpF,CAEA,SAAS,EAAe,EAAuB,CAC3C,OAAO,EACF,QAAQ,wBAAyB,GAAG,CAAC,CACrC,QAAQ,WAAY,GAAG,CAAC,CACxB,QAAQ,UAAW,GAAG,CAC/B,CAEA,SAAS,EAAe,EAAqC,CACzD,IAAM,EAA8B,CAAC,EAErC,IAAK,IAAM,KAAS,EAAI,SAAS,uDAAO,EACpC,EAAI,EAAM,EAAE,CAAE,YAAY,GAAK,EAAe,EAAM,IAAM,EAAM,IAAM,EAAM,IAAM,EAAE,EAExF,OAAO,CACX,CAUA,SAAS,EAAkB,EAAqE,CAC5F,IAAM,EAAO,CAAC,GAAG,EAAK,SAAS,iBAAiB,CAAC,CAAC,CAAC,OAC9C,GACG,EAAe,EAAM,EAAE,CAAC,CAAC,aAAa,EAAE,YAAY,IAAM,yBAClE,EACA,GAAI,EAAK,SAAW,EAAG,MAAO,CAAE,MAAK,EACrC,GAAI,EAAK,OAAS,EACd,MAAU,MACN,mGACJ,EAEJ,IAAM,EAAM,EAAK,GACjB,MAAO,CACH,KACI,EAAK,MAAM,EAAG,EAAI,KAAK,EACvB,EAAK,MAAM,EAAI,MAAS,EAAI,EAAE,CAAC,MAAM,CAAC,CAAC,QAAQ,eAAgB,EAAE,EACrE,SAAU,EAAS,EAAe,EAAI,EAAE,CAAC,CAAC,SAAW,EAAE,CAC3D,CACJ,CAEA,SAAS,EAAa,EAAc,EAAuC,CACvE,IAAM,EAAc,OAAO,IAAI,EAAQ,2BAA2B,EAAQ,GAAI,IAAI,EAC5E,EAAmB,CAAC,EAC1B,IAAK,IAAM,KAAS,EAAK,SAAS,CAAO,EAAG,CACxC,IAAM,EAAa,EAAe,MAAM,EAAM,GAAG,EAAE,EAEnD,GADI,IAAY,UAAY,QAAS,GACjC,EAAM,EAAE,CAAE,SAAW,EAAG,SAC5B,IAAM,EAAO,EAAO,EAAM,EAAG,EACxB,EAAO,SAAS,CAAI,GAAG,EAAO,KAAK,CAAI,CAChD,CACA,OAAO,CACX,CAQA,SAAS,EAAW,EAAc,EAAwB,CAEtD,IAAM,EAAM,uDADI,EAAO,QAAQ,KAAM,OAAO,CAAC,CAAC,QAAQ,KAAM,QACO,EAAQ,MACrE,EAAU,mCAAmC,KAAK,CAAI,EACtD,EAAO,iBAAiB,KAAK,CAAI,EACjC,EACF,IAAY,MACZ,IAAS,MACT,4BAA4B,KAAK,EAAK,MAAM,EAAK,MAAO,EAAQ,KAAK,CAAC,EACpE,EAAS,GAAW,GAAQ,EAAQ,MAAQ,EAAK,OAAS,CAAC,EAAgB,EAAU,EAC3F,GAAI,CAAC,EAAQ,MAAO,GAAG,EAAI,IAAI,IAC/B,IAAM,EAAK,EAAO,MAAQ,EAAO,EAAE,CAAC,OACpC,MAAO,GAAG,EAAK,MAAM,EAAG,CAAE,EAAE,QAAQ,IAAM,EAAK,MAAM,CAAE,GAC3D,CAEA,SAAS,EAAgB,EAA0C,CAC/D,IAAM,EAAgB,CAAC,EACvB,IAAK,IAAM,KAAU,OAAO,OAAO,EAAI,QAAU,CAAC,CAAC,EAC3C,EAAO,OAAS,SACpB,EAAI,KAAK,GAAI,EAAO,WAAa,OAAO,KAAK,EAAO,SAAW,CAAC,CAAC,CAAE,EAEvE,OAAO,CACX,CA6CA,SAAgB,EAAW,EAA6B,CAAC,EAAsB,CAC3E,GAAM,CACF,UAAU,CAAC,EACX,MAAM,GACN,UAAU,GACV,OAAO,GACP,eAAe,GACf,WAAY,EAAQ,CAAC,EACrB,MAAM,GACN,MAAM,GACN,YACA,EAEA,EACA,EAA+B,CAAC,EAChC,EAAa,GAEjB,SAAS,EAAI,EAA0B,EAA4B,EAAoB,CAC/E,IAAW,IAAA,IAAa,EAAK,KAAM,GAAW,EAAO,SAAW,CAAM,GAC1E,EAAK,KAAK,CAAE,SAAQ,MAAK,CAAC,CAC9B,CAEA,SAAS,EAAe,EAAoD,CACxE,IAAM,EAA2B,CAAC,EAC5B,EAAkC,EAAe,KAAO,CAAC,EACzD,EAAW,CAAC,EAAe,WAAa,OAAO,CAAC,CAAC,KAAK,EAC5D,GAAI,IAAQ,GACR,IAAK,GAAM,CAAC,EAAM,KAAU,OAAO,QAAQ,CAAM,EACxC,EAAS,KAAM,GAAW,EAAK,WAAW,CAAM,CAAC,GAClD,OAAO,GAAU,UAAa,EAAa,KAAK,EAAM,KAAK,CAAC,GAChE,EAAI,EAAM,EAAU,EAAO,OAAO,GAAM,EAAG,OAAO,GAAM,OAEzD,GAAI,MAAM,QAAQ,CAAG,EACxB,IAAK,IAAM,KAAQ,EAAK,CACpB,IAAM,EAAQ,EAAO,GACrB,GAAI,OAAO,GAAU,UAAY,EAAM,KAAK,IAAM,GAAI,CAClD,EAAe,OAAO,KAClB,mBAAmB,EAAK,yCAC5B,EACA,QACJ,CACA,EAAI,EAAM,EAAU,EAAO,OAAO,GAAM,EAAG,OAAO,GAAM,CAC5D,CAWJ,OATA,EAAQ,SAAS,EAAO,IAAU,CAC9B,GAAI,CAAC,GAAS,EAAM,KAAK,IAAM,GAAI,CAC/B,EAAe,OAAO,KAClB,uBAAuB,EAAM,mDACjC,EACA,MACJ,CACA,EAAI,EAAM,EAAU,EAAO,WAAW,EAAM,EAAE,EAAG,WAAW,EAAM,EAAE,CACxE,CAAC,EACM,CACX,CAEA,SAAS,EAAY,EAAuD,CACxE,IAAM,EAAM,CAAC,GAAG,CAAI,EACpB,GAAI,CAAC,EAAS,OAAO,EACrB,IAAK,GAAM,CAAE,YAAY,EAAM,CAC3B,IAAM,EAAO,EAAO,QAAQ,cAAe,OAAO,EAC9C,IAAS,GAAQ,EAAI,EAAK,EAAM,YAAY,EAAO,EAAE,CAC7D,CACA,OAAO,CACX,CAEA,SAAS,EAAS,EAAgC,EAA0C,CACxF,IAAM,EAAO,EAAa,CAAC,SAAU,CAAU,EAAI,CAAC,QAAQ,EACtD,EAAmC,CACrC,cAAe,CAAC,GAAG,CAAI,EACvB,aAAc,EAAO,CAAC,GAAG,EAAM,oBAAoB,EAAI,CAAC,GAAG,CAAI,EAC/D,YAAa,GAAgB,EAAQ,CAAC,GAAG,EAAM,iBAAiB,EAAI,CAAC,GAAG,CAAI,EAC5E,UAAW,CAAC,GAAG,EAAM,QAAS,OAAO,EACrC,WAAY,CAAC,GAAG,EAAM,OAAO,EAC7B,YAAa,CAAC,GAAG,EAAM,OAAO,EAC9B,cAAe,CAAC,SAAU,QAAS,OAAO,EAC1C,aAAc,CAAC,GAAG,EAAM,OAAO,EAC/B,eAAgB,CAAC,GAAG,CAAI,EACxB,aAAc,CAAC,QAAQ,EACvB,WAAY,CAAC,QAAQ,EACrB,cAAe,CAAC,QAAQ,CAC5B,EACA,IAAK,GAAM,CAAC,EAAM,KAAY,OAAO,QAAQ,CAAK,EAAG,CACjD,IAAM,EAAM,EAAK,YAAY,EACzB,IAAY,GAAO,OAAO,EAAO,GAChC,EAAO,GAAO,EAAM,EAAO,IAAQ,CAAC,EAAG,CAAO,CACvD,CACA,OAAO,CACX,CA4EA,MAAO,CAzEH,KAAM,cACN,eAAe,EAAgB,CAC3B,EAAS,EACT,EAAW,EAAe,CAAc,CAC5C,EACA,mBAAoB,CAChB,MAAO,OACP,QAAQ,EAAQ,EAAK,CACjB,IAAM,EAAQ,GAAQ,UAAY,QAClC,GAAI,GAAS,CAAC,EAAK,OAAO,EAE1B,IAAM,EAAiB,EAAY,CAAQ,EACrC,EAAO,GAAQ,MAAQ,IACvB,EAAa,EAAa,KAAK,CAAI,EAAI,EAAU,EAAM,MAAM,EAAI,IAAA,GACnE,GAAY,EAAI,EAAgB,EAAY,MAAM,EACtD,IAAM,EAAY,EAAQ,CAAC,EAAI,EAAgB,CAAG,EAClD,IAAK,IAAM,KAAS,GACZ,GAAS,EAAU,KAAM,GAAO,EAAM,OAAO,KAAK,CAAE,CAAC,IACrD,EAAI,EAAgB,EAAM,OAAQ,EAAM,IAAI,EAGpD,IAAM,EAAa,EAEb,CAAE,OAAM,WAAW,CAAC,GAAM,EAAkB,CAAM,EAClD,EAAS,EAAS,EAAY,CAAK,EACnC,eAAgB,IAClB,EAAO,cAAgB,EACnB,EAAO,eAAiB,CAAC,EACzB,EAAa,EAAM,QAAQ,CAC/B,GAGA,EAAE,cAAe,IACjB,CAAC,EAAO,YAAY,EAAE,SAAS,iBAAiB,IAEhD,EAAO,aAAe,EAClB,EAAO,cAAgB,CAAC,EACxB,EAAa,EAAM,OAAO,CAC9B,GAEJ,IAAM,EAAmC,CAAE,GAAG,CAAO,EACrD,IAAK,GAAM,CAAC,EAAM,KAAY,OAAO,QAAQ,CAAQ,EAAG,EAAO,GAAQ,EACvE,EAAO,eAAiB,EACpB,EAAO,gBAAkB,CAAC,QAAQ,EAClC,EAAW,IAAK,GAAU,EAAM,MAAM,CAC1C,EAEA,IAAM,EAA2B,CAC7B,WAAY,EACZ,KAAM,EAAa,EAAQ,MAAM,EACjC,OAAQ,EAAa,EAAQ,QAAQ,EACrC,QAAS,EACT,QAAS,EAAQ,QAAU,OAC/B,EAEA,GAAI,GAAO,GAAU,EAAO,SAAW,EAAY,CAC/C,EAAa,EAAO,OACpB,IAAM,EAAQ,EAAW,IAAK,GAAU,KAAK,EAAM,OAAO,MAAM,EAAM,MAAM,EAC5E,EAAO,OAAO,KACV,CACI,4BAA4B,EAAO,cAAc,CAAC,KAAK,GAAG,IAC1D,GAAI,EAAM,OAAS,EACb,EACA,CAAC,2CAA2C,CACtD,CAAC,CAAC,KAAK;CAAI,CACf,CACJ,CAEA,OADA,IAAW,CAAM,EACV,EAAW,EAAM,EAAO,IAAI,CACvC,CACJ,CAGG,CACX"}

package/dist/vite/tempest-csp.js

@@ -0,0 +1,189 @@
+import { createHash as e } from "node:crypto";
+//#region src/vite/tempest-csp.ts
+var t = /* @__PURE__ */ new Set([
+	"frame-ancestors",
+	"report-uri",
+	"sandbox"
+]), n = [{
+	module: /[\\/]forms[\\/]use-viacep\.(?:[cm]?js|tsx?)$/,
+	origin: "https://viacep.com.br",
+	from: "tempest-react-sdk useViaCEP"
+}], r = /^(?:https?|wss?):\/\//i, i = /^((?:https?|wss?):\/\/\*\.[a-z0-9.-]+(?::\d+)?)(?:[/?#].*)?$/i;
+function a(e, t) {
+	let n = e.trim();
+	if (n.startsWith("/") && !n.startsWith("//")) return;
+	let a = i.exec(n);
+	if (a) return a[1].toLowerCase();
+	if (r.test(n)) try {
+		let e = new URL(n);
+		return `${e.protocol}//${e.host}`;
+	} catch {
+		throw Error(`tempestCsp: ${t} is not a valid URL: "${e}"`);
+	}
+	throw Error(`tempestCsp: ${t} must be an absolute http(s)/ws(s) URL or a root-relative path, got "${e}"`);
+}
+function o(e) {
+	let t = {};
+	for (let n of e.split(";")) {
+		let [e, ...r] = n.trim().split(/\s+/);
+		if (!e) continue;
+		let i = e.toLowerCase();
+		i in t || (t[i] = r);
+	}
+	return t;
+}
+function s(e, n) {
+	return Object.entries(e).filter(([e]) => n === "header" || !t.has(e)).map(([e, t]) => [e, ...t].join(" ")).join("; ");
+}
+function c(e, t) {
+	let n = e.filter((e) => e !== "'none'" || t.length === 0);
+	for (let e of t) n.includes(e) || n.push(e);
+	return n.length === 0 ? ["'none'"] : n;
+}
+function l(t) {
+	return `'sha256-${e("sha256").update(t, "utf8").digest("base64")}'`;
+}
+function u(e) {
+	return e.replace(/'|'|'/gi, "'").replace(/"/gi, "\"").replace(/&/gi, "&");
+}
+function d(e) {
+	let t = {};
+	for (let n of e.matchAll(/([^\s=<>/]+)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/g)) t[n[1].toLowerCase()] = u(n[2] ?? n[3] ?? n[4] ?? "");
+	return t;
+}
+function f(e) {
+	let t = [...e.matchAll(/<meta\b[^>]*>/gi)].filter((e) => d(e[0])["http-equiv"]?.toLowerCase() === "content-security-policy");
+	if (t.length === 0) return { html: e };
+	if (t.length > 1) throw Error("tempestCsp: index.html declares more than one Content-Security-Policy <meta>; merge them into one");
+	let n = t[0];
+	return {
+		html: e.slice(0, n.index) + e.slice(n.index + n[0].length).replace(/^[ \t]*\r?\n/, ""),
+		declared: o(d(n[0]).content ?? "")
+	};
+}
+function p(e, t) {
+	let n = RegExp(`<${t}\\b([^>]*)>([\\s\\S]*?)</${t}>`, "gi"), r = [];
+	for (let i of e.matchAll(n)) {
+		let e = d(`<x ${i[1]}>`);
+		if (t === "script" && "src" in e || i[2].length === 0) continue;
+		let n = l(i[2]);
+		r.includes(n) || r.push(n);
+	}
+	return r;
+}
+function m(e, t) {
+	let n = `<meta http-equiv="Content-Security-Policy" content="${t.replace(/&/g, "&amp;").replace(/"/g, "&quot;")}" />`, r = /<meta\b[^>]*\bcharset\s*=[^>]*>/i.exec(e), i = /<head\b[^>]*>/i.exec(e), a = r !== null && i !== null && /<(?:script|link|style)\b/i.test(e.slice(i.index, r.index)), o = r && i && r.index > i.index && !a ? r : i;
+	if (!o) return `${n}\n${e}`;
+	let s = o.index + o[0].length;
+	return `${e.slice(0, s)}\n    ${n}${e.slice(s)}`;
+}
+function h(e) {
+	let t = [];
+	for (let n of Object.values(e.bundle ?? {})) n.type === "chunk" && t.push(...n.moduleIds ?? Object.keys(n.modules ?? {}));
+	return t;
+}
+function g(e = {}) {
+	let { connect: t = [], env: i = !0, sockets: o = !0, wasm: l = !0, inlineStyles: u = !0, directives: d = {}, dev: g = !0, log: _ = !0, onPolicy: v } = e, y, b = [], x = "";
+	function S(e, t, n) {
+		t === void 0 || e.some((e) => e.origin === t) || e.push({
+			origin: t,
+			from: n
+		});
+	}
+	function C(e) {
+		let n = [], o = e.env ?? {}, s = [e.envPrefix ?? "VITE_"].flat();
+		if (i === !0) for (let [e, t] of Object.entries(o)) s.some((t) => e.startsWith(t)) && typeof t == "string" && r.test(t.trim()) && S(n, a(t, `env ${e}`), `env ${e}`);
+		else if (Array.isArray(i)) for (let t of i) {
+			let r = o[t];
+			if (typeof r != "string" || r.trim() === "") {
+				e.logger.warn(`tempestCsp: env ${t} is empty — nothing added to connect-src`);
+				continue;
+			}
+			S(n, a(r, `env ${t}`), `env ${t}`);
+		}
+		return t.forEach((t, r) => {
+			if (!t || t.trim() === "") {
+				e.logger.warn(`tempestCsp: connect[${r}] is empty — skipped, nothing added to connect-src`);
+				return;
+			}
+			S(n, a(t, `connect[${r}]`), `connect[${r}]`);
+		}), n;
+	}
+	function w(e) {
+		let t = [...e];
+		if (!o) return t;
+		for (let { origin: n } of e) {
+			let e = n.replace(/^http(s?):/i, "ws$1:");
+			e !== n && S(t, e, `sockets (${n})`);
+		}
+		return t;
+	}
+	function T(e, t) {
+		let n = e ? ["'self'", e] : ["'self'"], r = {
+			"default-src": [...n],
+			"script-src": l ? [...n, "'wasm-unsafe-eval'"] : [...n],
+			"style-src": u || t ? [...n, "'unsafe-inline'"] : [...n],
+			"img-src": [
+				...n,
+				"data:",
+				"blob:"
+			],
+			"font-src": [...n, "data:"],
+			"media-src": [...n, "blob:"],
+			"connect-src": [
+				"'self'",
+				"blob:",
+				"data:"
+			],
+			"worker-src": [...n, "blob:"],
+			"manifest-src": [...n],
+			"object-src": ["'none'"],
+			"base-uri": ["'self'"],
+			"form-action": ["'self'"]
+		};
+		for (let [e, t] of Object.entries(d)) {
+			let n = e.toLowerCase();
+			t === !1 ? delete r[n] : r[n] = c(r[n] ?? [], t);
+		}
+		return r;
+	}
+	return {
+		name: "tempest-csp",
+		configResolved(e) {
+			y = e, b = C(e);
+		},
+		transformIndexHtml: {
+			order: "post",
+			handler(e, t) {
+				let i = y?.command === "serve";
+				if (i && !g) return e;
+				let o = w(b), l = y?.base ?? "/", u = r.test(l) ? a(l, "base") : void 0;
+				u && S(o, u, "base");
+				let d = i ? [] : h(t);
+				for (let e of n) (i || d.some((t) => e.module.test(t))) && S(o, e.origin, e.from);
+				let C = o, { html: E, declared: D = {} } = f(e), O = T(u, i);
+				"script-src" in D || (O["script-src"] = c(O["script-src"] ?? [], p(E, "script"))), !("style-src" in D) && !O["style-src"]?.includes("'unsafe-inline'") && (O["style-src"] = c(O["style-src"] ?? [], p(E, "style")));
+				let k = { ...O };
+				for (let [e, t] of Object.entries(D)) k[e] = t;
+				k["connect-src"] = c(k["connect-src"] ?? ["'self'"], C.map((e) => e.origin));
+				let A = {
+					directives: k,
+					meta: s(k, "meta"),
+					header: s(k, "header"),
+					connect: C,
+					command: i ? "serve" : "build"
+				};
+				if (_ && y && A.header !== x) {
+					x = A.header;
+					let e = C.map((e) => `  ${e.origin}  ← ${e.from}`);
+					y.logger.info([`tempest-csp: connect-src ${k["connect-src"].join(" ")}`, ...e.length > 0 ? e : ["  (no cross-origin endpoint: only 'self')"]].join("\n"));
+				}
+				return v?.(A), m(E, A.meta);
+			}
+		}
+	};
+}
+//#endregion
+export { a as cspOrigin, o as parseCsp, s as serializeCsp, g as tempestCsp };
+
+//# sourceMappingURL=tempest-csp.js.map

package/dist/vite/tempest-csp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tempest-csp.js","names":[],"sources":["../../src/vite/tempest-csp.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { IndexHtmlTransformContext, Plugin, ResolvedConfig } from \"vite\";\n\nimport type { TempestVitePlugin } from \"./tempest-pwa-manifest\";\n\n/** Options for {@link tempestCsp}. */\nexport interface TempestCspOptions {\n    /**\n     * Endpoints the app calls at runtime, as full URLs. Only the origin\n     * (`scheme://host[:port]`) enters `connect-src`: a source expression with a path\n     * matches that path alone, so `https://idp/realms/x` would still block\n     * `https://idp/realms/x/protocol/openid-connect/token`.\n     *\n     * Empty entries (`undefined`, `null`, `false`, `\"\"`) are skipped with a build\n     * warning instead of leaving a hole in the directive, so passing an env var\n     * that is not set is safe. A root-relative path (`/api`) is same-origin and\n     * already covered by `'self'`. Anything else that is not an absolute\n     * `http(s)`/`ws(s)` URL throws at config time — failing the build, not\n     * production. A wildcard host (`https://*.example.com`) is kept as written.\n     */\n    connect?: ReadonlyArray<string | null | undefined | false>;\n    /**\n     * Read origins from the same environment the runtime reads. `true` (the\n     * default) adds every variable Vite exposes to `import.meta.env` (the\n     * `envPrefix` ones, `VITE_` by default) whose value is an absolute\n     * `http(s)`/`ws(s)` URL. This is the structural bridge: an origin added to\n     * `.env` for a new runtime call lands in the policy with no second list to\n     * keep in sync. Pass a list of names to include exactly those — a name that\n     * resolves to nothing is reported as a build warning — or `false` to rely on\n     * {@link TempestCspOptions.connect} alone.\n     */\n    env?: boolean | readonly string[];\n    /**\n     * Also allow the WebSocket twin of every `http(s)` origin (`https://api` →\n     * `wss://api`). Measured in Chromium (23/09/2026): `connect-src https://api`\n     * blocks `new WebSocket(\"wss://api\")`, while `'self'` does cover a same-origin\n     * `ws:` — so an app that derives its socket URL from the API URL breaks\n     * without this. Default `true`.\n     */\n    sockets?: boolean;\n    /**\n     * Add `'wasm-unsafe-eval'` to `script-src`, which `onnxruntime-web` (the\n     * `/vision` and `/tabular` subpaths) needs to compile its WebAssembly. Without\n     * it `WebAssembly.compile` throws a `CompileError` naming `script-src`.\n     * It grants WebAssembly compilation only, not `eval`. Default `true`.\n     */\n    wasm?: boolean;\n    /**\n     * Add `'unsafe-inline'` to `style-src`. React's `style` prop does **not** need\n     * it — it writes through the CSSOM, which CSP does not govern (measured in\n     * Chromium, 23/09/2026). What needs it is a `<style>` element or a `style=\"\"`\n     * attribute, and the SDK's own `applyTheme` injects a `<style>`. Pass `false`\n     * when the app never calls `applyTheme`; inline `<style>` blocks in\n     * `index.html` are then hashed instead. Always on under `vite dev`, whose CSS\n     * injection is a `<style>` element. Default `true`.\n     */\n    inlineStyles?: boolean;\n    /**\n     * Extra sources per directive, merged into the defaults (`{ \"img-src\":\n     * [\"https://tiles.example.com\"] }`), or `false` to drop a directive.\n     * `frame-ancestors`, `report-uri` and `sandbox` are ignored by browsers when\n     * delivered by `<meta>`, so they reach {@link TempestCspPolicy.header} only.\n     */\n    directives?: Readonly<Record<string, readonly string[] | false>>;\n    /**\n     * Apply the policy under `vite dev` too. Default `true`: the failure this\n     * plugin exists for is \"works in dev, blocked in production\", and a policy\n     * enforced in dev moves every missing origin to the first page load on the\n     * developer's machine. Dev differs from build only in `style-src\n     * 'unsafe-inline'` and in allowing every SDK-known origin (see\n     * {@link TempestCspPolicy.connect}), because the dev server cannot know which\n     * modules the page will load.\n     */\n    dev?: boolean;\n    /** Print the resolved `connect-src` and where each origin came from. Default `true`. */\n    log?: boolean;\n    /**\n     * Receive the resolved policy — for asserting it in a test, or for writing the\n     * same policy as an HTTP header (the only channel for `frame-ancestors`).\n     */\n    onPolicy?: (policy: TempestCspPolicy) => void;\n}\n\n/** One origin in `connect-src` and the input that put it there. */\nexport interface TempestCspSource {\n    /** The source expression, e.g. `https://api.example.com`. */\n    origin: string;\n    /** Where it came from: `env VITE_API_URL`, `connect[0]`, `sockets`, `base` or an SDK module. */\n    from: string;\n}\n\n/** The policy {@link tempestCsp} resolved for one `index.html`. */\nexport interface TempestCspPolicy {\n    /** Every directive and its sources, including the header-only ones. */\n    directives: Record<string, string[]>;\n    /** The policy as written into the `<meta http-equiv>` tag. */\n    meta: string;\n    /** The full policy for a `Content-Security-Policy` response header. */\n    header: string;\n    /** Every origin added to `connect-src`, with its provenance. */\n    connect: TempestCspSource[];\n    /** `\"serve\"` under `vite dev`, `\"build\"` under `vite build`. */\n    command: \"serve\" | \"build\";\n}\n\n/**\n * Directives a browser ignores when the policy arrives by `<meta>` (CSP3 §3.3),\n * printing a console warning for each.\n */\nconst HEADER_ONLY_DIRECTIVES: ReadonlySet<string> = new Set([\n    \"frame-ancestors\",\n    \"report-uri\",\n    \"sandbox\",\n]);\n\n/**\n * Origins the SDK itself calls, keyed by the module that calls them. In a build\n * the origin enters only when the module is in the bundle; in dev always.\n */\nconst SDK_ORIGINS: ReadonlyArray<{ module: RegExp; origin: string; from: string }> = [\n    {\n        module: /[\\\\/]forms[\\\\/]use-viacep\\.(?:[cm]?js|tsx?)$/,\n        origin: \"https://viacep.com.br\",\n        from: \"tempest-react-sdk useViaCEP\",\n    },\n];\n\nconst ABSOLUTE_URL = /^(?:https?|wss?):\\/\\//i;\nconst WILDCARD_SOURCE = /^((?:https?|wss?):\\/\\/\\*\\.[a-z0-9.-]+(?::\\d+)?)(?:[/?#].*)?$/i;\n\n/**\n * Reduce a URL to the origin a CSP source expression should carry.\n *\n * @param value - The URL as the app configured it.\n * @param from - Its provenance, quoted in the error.\n * @returns The origin, or `undefined` for a root-relative path (covered by `'self'`).\n * @throws {Error} When the value is neither an absolute `http(s)`/`ws(s)` URL nor a path.\n */\nexport function cspOrigin(value: string, from: string): string | undefined {\n    const trimmed = value.trim();\n    if (trimmed.startsWith(\"/\") && !trimmed.startsWith(\"//\")) return undefined;\n    const wildcard = WILDCARD_SOURCE.exec(trimmed);\n    if (wildcard) return wildcard[1]!.toLowerCase();\n    if (ABSOLUTE_URL.test(trimmed)) {\n        try {\n            const url = new URL(trimmed);\n            return `${url.protocol}//${url.host}`;\n        } catch {\n            throw new Error(`tempestCsp: ${from} is not a valid URL: \"${value}\"`);\n        }\n    }\n    throw new Error(\n        `tempestCsp: ${from} must be an absolute http(s)/ws(s) URL or a root-relative path, got \"${value}\"`,\n    );\n}\n\n/**\n * Parse a serialized policy into directives, lowercasing names. A repeated\n * directive keeps its first occurrence, as browsers do.\n *\n * @param policy - A `Content-Security-Policy` value.\n * @returns Directive name → sources.\n */\nexport function parseCsp(policy: string): Record<string, string[]> {\n    const out: Record<string, string[]> = {};\n    for (const part of policy.split(\";\")) {\n        const [name, ...sources] = part.trim().split(/\\s+/);\n        if (!name) continue;\n        const key = name.toLowerCase();\n        if (!(key in out)) out[key] = sources;\n    }\n    return out;\n}\n\n/**\n * Serialize directives into a policy string, dropping header-only directives\n * when the target is a `<meta>` tag.\n *\n * @param directives - Directive name → sources.\n * @param target - `\"meta\"` or `\"header\"`.\n * @returns The policy value.\n */\nexport function serializeCsp(\n    directives: Readonly<Record<string, readonly string[]>>,\n    target: \"meta\" | \"header\",\n): string {\n    return Object.entries(directives)\n        .filter(([name]) => target === \"header\" || !HEADER_ONLY_DIRECTIVES.has(name))\n        .map(([name, sources]) => [name, ...sources].join(\" \"))\n        .join(\"; \");\n}\n\nfunction union(base: readonly string[], extra: readonly string[]): string[] {\n    const out = base.filter((source) => source !== \"'none'\" || extra.length === 0);\n    for (const source of extra) if (!out.includes(source)) out.push(source);\n    return out.length === 0 ? [\"'none'\"] : out;\n}\n\nfunction sha256(content: string): string {\n    return `'sha256-${createHash(\"sha256\").update(content, \"utf8\").digest(\"base64\")}'`;\n}\n\nfunction decodeEntities(value: string): string {\n    return value\n        .replace(/&#39;|&#x27;|&apos;/gi, \"'\")\n        .replace(/&quot;/gi, '\"')\n        .replace(/&amp;/gi, \"&\");\n}\n\nfunction readAttributes(tag: string): Record<string, string> {\n    const out: Record<string, string> = {};\n    const pattern = /([^\\s=<>/]+)\\s*=\\s*(?:\"([^\"]*)\"|'([^']*)'|([^\\s>]+))/g;\n    for (const match of tag.matchAll(pattern)) {\n        out[match[1]!.toLowerCase()] = decodeEntities(match[2] ?? match[3] ?? match[4] ?? \"\");\n    }\n    return out;\n}\n\n/**\n * Find the policy `index.html` already declares and remove its tag, so the merged\n * policy replaces it instead of stacking a second one (two policies are\n * intersected by the browser, so the stricter would win silently).\n *\n * @throws {Error} When the page declares more than one CSP `<meta>`: merging an\n *   intersection into a union would weaken it, so the plugin refuses.\n */\nfunction extractMetaPolicy(html: string): { html: string; declared?: Record<string, string[]> } {\n    const tags = [...html.matchAll(/<meta\\b[^>]*>/gi)].filter(\n        (match) =>\n            readAttributes(match[0])[\"http-equiv\"]?.toLowerCase() === \"content-security-policy\",\n    );\n    if (tags.length === 0) return { html };\n    if (tags.length > 1) {\n        throw new Error(\n            \"tempestCsp: index.html declares more than one Content-Security-Policy <meta>; merge them into one\",\n        );\n    }\n    const tag = tags[0]!;\n    return {\n        html:\n            html.slice(0, tag.index) +\n            html.slice(tag.index! + tag[0].length).replace(/^[ \\t]*\\r?\\n/, \"\"),\n        declared: parseCsp(readAttributes(tag[0]).content ?? \"\"),\n    };\n}\n\nfunction inlineHashes(html: string, element: \"script\" | \"style\"): string[] {\n    const pattern = new RegExp(`<${element}\\\\b([^>]*)>([\\\\s\\\\S]*?)</${element}>`, \"gi\");\n    const hashes: string[] = [];\n    for (const match of html.matchAll(pattern)) {\n        const attributes = readAttributes(`<x ${match[1]}>`);\n        if (element === \"script\" && \"src\" in attributes) continue;\n        if (match[2]!.length === 0) continue;\n        const hash = sha256(match[2]!);\n        if (!hashes.includes(hash)) hashes.push(hash);\n    }\n    return hashes;\n}\n\n/**\n * Write the policy tag where it governs the whole page. A `<meta>` CSP applies\n * only to what follows it, so it goes right after `<meta charset>` — unless a\n * resource precedes the charset, as the React Refresh preamble does under\n * `vite dev` (`head-prepend`), in which case it goes right after `<head>`.\n */\nfunction insertMeta(html: string, policy: string): string {\n    const escaped = policy.replace(/&/g, \"&amp;\").replace(/\"/g, \"&quot;\");\n    const tag = `<meta http-equiv=\"Content-Security-Policy\" content=\"${escaped}\" />`;\n    const charset = /<meta\\b[^>]*\\bcharset\\s*=[^>]*>/i.exec(html);\n    const head = /<head\\b[^>]*>/i.exec(html);\n    const resourceFirst =\n        charset !== null &&\n        head !== null &&\n        /<(?:script|link|style)\\b/i.test(html.slice(head.index, charset.index));\n    const anchor = charset && head && charset.index > head.index && !resourceFirst ? charset : head;\n    if (!anchor) return `${tag}\\n${html}`;\n    const at = anchor.index + anchor[0].length;\n    return `${html.slice(0, at)}\\n    ${tag}${html.slice(at)}`;\n}\n\nfunction bundleModuleIds(ctx: IndexHtmlTransformContext): string[] {\n    const ids: string[] = [];\n    for (const output of Object.values(ctx.bundle ?? {})) {\n        if (output.type !== \"chunk\") continue;\n        ids.push(...(output.moduleIds ?? Object.keys(output.modules ?? {})));\n    }\n    return ids;\n}\n\n/**\n * Vite plugin that writes a Content-Security-Policy `<meta>` into `index.html`\n * and derives `connect-src` from the origins the app actually calls.\n *\n * It exists because of how a missing origin fails: the request is blocked\n * before a connection opens, so there is no entry in the Network tab, nothing in\n * the server log, `curl` succeeds, and the app sees `TypeError: Failed to\n * fetch` — indistinguishable from offline, DNS or CORS. And a hand-written CSP\n * plugin is usually `apply: \"build\"`, so it only fails in production. This\n * plugin closes both ends:\n *\n * - origins come from the same `import.meta.env` the runtime reads\n *   ({@link TempestCspOptions.env}), reduced to `scheme://host[:port]`, with\n *   empty values skipped — no second list to drift;\n * - the policy is enforced under `vite dev` as well ({@link TempestCspOptions.dev});\n * - the build prints every origin and its provenance.\n *\n * Defaults cover what the SDK's stack needs and nothing more: `'self'`\n * everywhere, `'wasm-unsafe-eval'` for ONNX Runtime, `blob:` for workers, object\n * URLs and media, `data:` for images and fonts, `object-src 'none'`,\n * `base-uri 'self'`, `form-action 'self'`. Inline `<script>` blocks left in\n * `index.html` (a `themeInitScript()` anti-flash script, say) are allowed by\n * SHA-256 hash, never by `'unsafe-inline'`.\n *\n * An existing CSP `<meta>` in `index.html` is merged, not overwritten: every\n * directive it declares is kept verbatim — the plugin never loosens a choice the\n * app wrote — except `connect-src`, which gains the resolved origins, since\n * that is the list the plugin exists to maintain. Directives it does not declare\n * come from the defaults.\n *\n * @param options - See {@link TempestCspOptions}.\n * @returns A Vite plugin, to be placed in `plugins`. It runs as a `post` HTML\n *   transform, so a plugin that rewrites inline scripts after it would\n *   invalidate the hashes.\n *\n * @example\n * // vite.config.ts\n * import { createViteConfig, tempestCsp } from \"tempest-react-sdk/vite\";\n *\n * export default createViteConfig({\n *     plugins: [tempestCsp({ connect: [\"https://sso.example.com/realms/app\"] })],\n * });\n */\nexport function tempestCsp(options: TempestCspOptions = {}): TempestVitePlugin {\n    const {\n        connect = [],\n        env = true,\n        sockets = true,\n        wasm = true,\n        inlineStyles = true,\n        directives: extra = {},\n        dev = true,\n        log = true,\n        onPolicy,\n    } = options;\n\n    let config: ResolvedConfig | undefined;\n    let resolved: TempestCspSource[] = [];\n    let lastLogged = \"\";\n\n    function add(list: TempestCspSource[], origin: string | undefined, from: string): void {\n        if (origin === undefined || list.some((source) => source.origin === origin)) return;\n        list.push({ origin, from });\n    }\n\n    function resolveSources(resolvedConfig: ResolvedConfig): TempestCspSource[] {\n        const list: TempestCspSource[] = [];\n        const values: Record<string, unknown> = resolvedConfig.env ?? {};\n        const prefixes = [resolvedConfig.envPrefix ?? \"VITE_\"].flat();\n        if (env === true) {\n            for (const [name, value] of Object.entries(values)) {\n                if (!prefixes.some((prefix) => name.startsWith(prefix))) continue;\n                if (typeof value !== \"string\" || !ABSOLUTE_URL.test(value.trim())) continue;\n                add(list, cspOrigin(value, `env ${name}`), `env ${name}`);\n            }\n        } else if (Array.isArray(env)) {\n            for (const name of env) {\n                const value = values[name];\n                if (typeof value !== \"string\" || value.trim() === \"\") {\n                    resolvedConfig.logger.warn(\n                        `tempestCsp: env ${name} is empty — nothing added to connect-src`,\n                    );\n                    continue;\n                }\n                add(list, cspOrigin(value, `env ${name}`), `env ${name}`);\n            }\n        }\n        connect.forEach((value, index) => {\n            if (!value || value.trim() === \"\") {\n                resolvedConfig.logger.warn(\n                    `tempestCsp: connect[${index}] is empty — skipped, nothing added to connect-src`,\n                );\n                return;\n            }\n            add(list, cspOrigin(value, `connect[${index}]`), `connect[${index}]`);\n        });\n        return list;\n    }\n\n    function withSockets(list: readonly TempestCspSource[]): TempestCspSource[] {\n        const out = [...list];\n        if (!sockets) return out;\n        for (const { origin } of list) {\n            const twin = origin.replace(/^http(s?):/i, \"ws$1:\");\n            if (twin !== origin) add(out, twin, `sockets (${origin})`);\n        }\n        return out;\n    }\n\n    function defaults(baseOrigin: string | undefined, serve: boolean): Record<string, string[]> {\n        const self = baseOrigin ? [\"'self'\", baseOrigin] : [\"'self'\"];\n        const policy: Record<string, string[]> = {\n            \"default-src\": [...self],\n            \"script-src\": wasm ? [...self, \"'wasm-unsafe-eval'\"] : [...self],\n            \"style-src\": inlineStyles || serve ? [...self, \"'unsafe-inline'\"] : [...self],\n            \"img-src\": [...self, \"data:\", \"blob:\"],\n            \"font-src\": [...self, \"data:\"],\n            \"media-src\": [...self, \"blob:\"],\n            \"connect-src\": [\"'self'\", \"blob:\", \"data:\"],\n            \"worker-src\": [...self, \"blob:\"],\n            \"manifest-src\": [...self],\n            \"object-src\": [\"'none'\"],\n            \"base-uri\": [\"'self'\"],\n            \"form-action\": [\"'self'\"],\n        };\n        for (const [name, sources] of Object.entries(extra)) {\n            const key = name.toLowerCase();\n            if (sources === false) delete policy[key];\n            else policy[key] = union(policy[key] ?? [], sources);\n        }\n        return policy;\n    }\n\n    const plugin: Plugin = {\n        name: \"tempest-csp\",\n        configResolved(resolvedConfig) {\n            config = resolvedConfig;\n            resolved = resolveSources(resolvedConfig);\n        },\n        transformIndexHtml: {\n            order: \"post\",\n            handler(source, ctx) {\n                const serve = config?.command === \"serve\";\n                if (serve && !dev) return source;\n\n                const connectSources = withSockets(resolved);\n                const base = config?.base ?? \"/\";\n                const baseOrigin = ABSOLUTE_URL.test(base) ? cspOrigin(base, \"base\") : undefined;\n                if (baseOrigin) add(connectSources, baseOrigin, \"base\");\n                const moduleIds = serve ? [] : bundleModuleIds(ctx);\n                for (const known of SDK_ORIGINS) {\n                    if (serve || moduleIds.some((id) => known.module.test(id))) {\n                        add(connectSources, known.origin, known.from);\n                    }\n                }\n                const allSources = connectSources;\n\n                const { html, declared = {} } = extractMetaPolicy(source);\n                const policy = defaults(baseOrigin, serve);\n                if (!(\"script-src\" in declared)) {\n                    policy[\"script-src\"] = union(\n                        policy[\"script-src\"] ?? [],\n                        inlineHashes(html, \"script\"),\n                    );\n                }\n                if (\n                    !(\"style-src\" in declared) &&\n                    !policy[\"style-src\"]?.includes(\"'unsafe-inline'\")\n                ) {\n                    policy[\"style-src\"] = union(\n                        policy[\"style-src\"] ?? [],\n                        inlineHashes(html, \"style\"),\n                    );\n                }\n                const merged: Record<string, string[]> = { ...policy };\n                for (const [name, sources] of Object.entries(declared)) merged[name] = sources;\n                merged[\"connect-src\"] = union(\n                    merged[\"connect-src\"] ?? [\"'self'\"],\n                    allSources.map((entry) => entry.origin),\n                );\n\n                const result: TempestCspPolicy = {\n                    directives: merged,\n                    meta: serializeCsp(merged, \"meta\"),\n                    header: serializeCsp(merged, \"header\"),\n                    connect: allSources,\n                    command: serve ? \"serve\" : \"build\",\n                };\n\n                if (log && config && result.header !== lastLogged) {\n                    lastLogged = result.header;\n                    const lines = allSources.map((entry) => `  ${entry.origin}  ← ${entry.from}`);\n                    config.logger.info(\n                        [\n                            `tempest-csp: connect-src ${merged[\"connect-src\"].join(\" \")}`,\n                            ...(lines.length > 0\n                                ? lines\n                                : [\"  (no cross-origin endpoint: only 'self')\"]),\n                        ].join(\"\\n\"),\n                    );\n                }\n                onPolicy?.(result);\n                return insertMeta(html, result.meta);\n            },\n        },\n    };\n\n    return plugin as TempestVitePlugin;\n}\n"],"mappings":";;AA6GA,IAAM,oBAA8C,IAAI,IAAI;CACxD;CACA;CACA;AACJ,CAAC,GAMK,IAA+E,CACjF;CACI,QAAQ;CACR,QAAQ;CACR,MAAM;AACV,CACJ,GAEM,IAAe,0BACf,IAAkB;AAUxB,SAAgB,EAAU,GAAe,GAAkC;CACvE,IAAM,IAAU,EAAM,KAAK;CAC3B,IAAI,EAAQ,WAAW,GAAG,KAAK,CAAC,EAAQ,WAAW,IAAI,GAAG;CAC1D,IAAM,IAAW,EAAgB,KAAK,CAAO;CAC7C,IAAI,GAAU,OAAO,EAAS,EAAE,CAAE,YAAY;CAC9C,IAAI,EAAa,KAAK,CAAO,GACzB,IAAI;EACA,IAAM,IAAM,IAAI,IAAI,CAAO;EAC3B,OAAO,GAAG,EAAI,SAAS,IAAI,EAAI;CACnC,QAAQ;EACJ,MAAU,MAAM,eAAe,EAAK,wBAAwB,EAAM,EAAE;CACxE;CAEJ,MAAU,MACN,eAAe,EAAK,uEAAuE,EAAM,EACrG;AACJ;AASA,SAAgB,EAAS,GAA0C;CAC/D,IAAM,IAAgC,CAAC;CACvC,KAAK,IAAM,KAAQ,EAAO,MAAM,GAAG,GAAG;EAClC,IAAM,CAAC,GAAM,GAAG,KAAW,EAAK,KAAK,CAAC,CAAC,MAAM,KAAK;EAClD,IAAI,CAAC,GAAM;EACX,IAAM,IAAM,EAAK,YAAY;EAC7B,AAAM,KAAO,MAAM,EAAI,KAAO;CAClC;CACA,OAAO;AACX;AAUA,SAAgB,EACZ,GACA,GACM;CACN,OAAO,OAAO,QAAQ,CAAU,CAAC,CAC5B,QAAQ,CAAC,OAAU,MAAW,YAAY,CAAC,EAAuB,IAAI,CAAI,CAAC,CAAC,CAC5E,KAAK,CAAC,GAAM,OAAa,CAAC,GAAM,GAAG,CAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CACtD,KAAK,IAAI;AAClB;AAEA,SAAS,EAAM,GAAyB,GAAoC;CACxE,IAAM,IAAM,EAAK,QAAQ,MAAW,MAAW,YAAY,EAAM,WAAW,CAAC;CAC7E,KAAK,IAAM,KAAU,GAAO,AAAK,EAAI,SAAS,CAAM,KAAG,EAAI,KAAK,CAAM;CACtE,OAAO,EAAI,WAAW,IAAI,CAAC,QAAQ,IAAI;AAC3C;AAEA,SAAS,EAAO,GAAyB;CACrC,OAAO,WAAW,EAAW,QAAQ,CAAC,CAAC,OAAO,GAAS,MAAM,CAAC,CAAC,OAAO,QAAQ,EAAE;AACpF;AAEA,SAAS,EAAe,GAAuB;CAC3C,OAAO,EACF,QAAQ,yBAAyB,GAAG,CAAC,CACrC,QAAQ,YAAY,IAAG,CAAC,CACxB,QAAQ,WAAW,GAAG;AAC/B;AAEA,SAAS,EAAe,GAAqC;CACzD,IAAM,IAA8B,CAAC;CAErC,KAAK,IAAM,KAAS,EAAI,SAAS,uDAAO,GACpC,EAAI,EAAM,EAAE,CAAE,YAAY,KAAK,EAAe,EAAM,MAAM,EAAM,MAAM,EAAM,MAAM,EAAE;CAExF,OAAO;AACX;AAUA,SAAS,EAAkB,GAAqE;CAC5F,IAAM,IAAO,CAAC,GAAG,EAAK,SAAS,iBAAiB,CAAC,CAAC,CAAC,QAC9C,MACG,EAAe,EAAM,EAAE,CAAC,CAAC,aAAa,EAAE,YAAY,MAAM,yBAClE;CACA,IAAI,EAAK,WAAW,GAAG,OAAO,EAAE,QAAK;CACrC,IAAI,EAAK,SAAS,GACd,MAAU,MACN,mGACJ;CAEJ,IAAM,IAAM,EAAK;CACjB,OAAO;EACH,MACI,EAAK,MAAM,GAAG,EAAI,KAAK,IACvB,EAAK,MAAM,EAAI,QAAS,EAAI,EAAE,CAAC,MAAM,CAAC,CAAC,QAAQ,gBAAgB,EAAE;EACrE,UAAU,EAAS,EAAe,EAAI,EAAE,CAAC,CAAC,WAAW,EAAE;CAC3D;AACJ;AAEA,SAAS,EAAa,GAAc,GAAuC;CACvE,IAAM,IAAc,OAAO,IAAI,EAAQ,2BAA2B,EAAQ,IAAI,IAAI,GAC5E,IAAmB,CAAC;CAC1B,KAAK,IAAM,KAAS,EAAK,SAAS,CAAO,GAAG;EACxC,IAAM,IAAa,EAAe,MAAM,EAAM,GAAG,EAAE;EAEnD,IADI,MAAY,YAAY,SAAS,KACjC,EAAM,EAAE,CAAE,WAAW,GAAG;EAC5B,IAAM,IAAO,EAAO,EAAM,EAAG;EAC7B,AAAK,EAAO,SAAS,CAAI,KAAG,EAAO,KAAK,CAAI;CAChD;CACA,OAAO;AACX;AAQA,SAAS,EAAW,GAAc,GAAwB;CAEtD,IAAM,IAAM,uDADI,EAAO,QAAQ,MAAM,OAAO,CAAC,CAAC,QAAQ,MAAM,QACO,EAAQ,OACrE,IAAU,mCAAmC,KAAK,CAAI,GACtD,IAAO,iBAAiB,KAAK,CAAI,GACjC,IACF,MAAY,QACZ,MAAS,QACT,4BAA4B,KAAK,EAAK,MAAM,EAAK,OAAO,EAAQ,KAAK,CAAC,GACpE,IAAS,KAAW,KAAQ,EAAQ,QAAQ,EAAK,SAAS,CAAC,IAAgB,IAAU;CAC3F,IAAI,CAAC,GAAQ,OAAO,GAAG,EAAI,IAAI;CAC/B,IAAM,IAAK,EAAO,QAAQ,EAAO,EAAE,CAAC;CACpC,OAAO,GAAG,EAAK,MAAM,GAAG,CAAE,EAAE,QAAQ,IAAM,EAAK,MAAM,CAAE;AAC3D;AAEA,SAAS,EAAgB,GAA0C;CAC/D,IAAM,IAAgB,CAAC;CACvB,KAAK,IAAM,KAAU,OAAO,OAAO,EAAI,UAAU,CAAC,CAAC,GAC3C,EAAO,SAAS,WACpB,EAAI,KAAK,GAAI,EAAO,aAAa,OAAO,KAAK,EAAO,WAAW,CAAC,CAAC,CAAE;CAEvE,OAAO;AACX;AA6CA,SAAgB,EAAW,IAA6B,CAAC,GAAsB;CAC3E,IAAM,EACF,aAAU,CAAC,GACX,SAAM,IACN,aAAU,IACV,UAAO,IACP,kBAAe,IACf,YAAY,IAAQ,CAAC,GACrB,SAAM,IACN,SAAM,IACN,gBACA,GAEA,GACA,IAA+B,CAAC,GAChC,IAAa;CAEjB,SAAS,EAAI,GAA0B,GAA4B,GAAoB;EAC/E,MAAW,KAAA,KAAa,EAAK,MAAM,MAAW,EAAO,WAAW,CAAM,KAC1E,EAAK,KAAK;GAAE;GAAQ;EAAK,CAAC;CAC9B;CAEA,SAAS,EAAe,GAAoD;EACxE,IAAM,IAA2B,CAAC,GAC5B,IAAkC,EAAe,OAAO,CAAC,GACzD,IAAW,CAAC,EAAe,aAAa,OAAO,CAAC,CAAC,KAAK;EAC5D,IAAI,MAAQ,IACR,KAAK,IAAM,CAAC,GAAM,MAAU,OAAO,QAAQ,CAAM,GACxC,EAAS,MAAM,MAAW,EAAK,WAAW,CAAM,CAAC,KAClD,OAAO,KAAU,YAAa,EAAa,KAAK,EAAM,KAAK,CAAC,KAChE,EAAI,GAAM,EAAU,GAAO,OAAO,GAAM,GAAG,OAAO,GAAM;OAEzD,IAAI,MAAM,QAAQ,CAAG,GACxB,KAAK,IAAM,KAAQ,GAAK;GACpB,IAAM,IAAQ,EAAO;GACrB,IAAI,OAAO,KAAU,YAAY,EAAM,KAAK,MAAM,IAAI;IAClD,EAAe,OAAO,KAClB,mBAAmB,EAAK,yCAC5B;IACA;GACJ;GACA,EAAI,GAAM,EAAU,GAAO,OAAO,GAAM,GAAG,OAAO,GAAM;EAC5D;EAWJ,OATA,EAAQ,SAAS,GAAO,MAAU;GAC9B,IAAI,CAAC,KAAS,EAAM,KAAK,MAAM,IAAI;IAC/B,EAAe,OAAO,KAClB,uBAAuB,EAAM,mDACjC;IACA;GACJ;GACA,EAAI,GAAM,EAAU,GAAO,WAAW,EAAM,EAAE,GAAG,WAAW,EAAM,EAAE;EACxE,CAAC,GACM;CACX;CAEA,SAAS,EAAY,GAAuD;EACxE,IAAM,IAAM,CAAC,GAAG,CAAI;EACpB,IAAI,CAAC,GAAS,OAAO;EACrB,KAAK,IAAM,EAAE,eAAY,GAAM;GAC3B,IAAM,IAAO,EAAO,QAAQ,eAAe,OAAO;GAClD,AAAI,MAAS,KAAQ,EAAI,GAAK,GAAM,YAAY,EAAO,EAAE;EAC7D;EACA,OAAO;CACX;CAEA,SAAS,EAAS,GAAgC,GAA0C;EACxF,IAAM,IAAO,IAAa,CAAC,UAAU,CAAU,IAAI,CAAC,QAAQ,GACtD,IAAmC;GACrC,eAAe,CAAC,GAAG,CAAI;GACvB,cAAc,IAAO,CAAC,GAAG,GAAM,oBAAoB,IAAI,CAAC,GAAG,CAAI;GAC/D,aAAa,KAAgB,IAAQ,CAAC,GAAG,GAAM,iBAAiB,IAAI,CAAC,GAAG,CAAI;GAC5E,WAAW;IAAC,GAAG;IAAM;IAAS;GAAO;GACrC,YAAY,CAAC,GAAG,GAAM,OAAO;GAC7B,aAAa,CAAC,GAAG,GAAM,OAAO;GAC9B,eAAe;IAAC;IAAU;IAAS;GAAO;GAC1C,cAAc,CAAC,GAAG,GAAM,OAAO;GAC/B,gBAAgB,CAAC,GAAG,CAAI;GACxB,cAAc,CAAC,QAAQ;GACvB,YAAY,CAAC,QAAQ;GACrB,eAAe,CAAC,QAAQ;EAC5B;EACA,KAAK,IAAM,CAAC,GAAM,MAAY,OAAO,QAAQ,CAAK,GAAG;GACjD,IAAM,IAAM,EAAK,YAAY;GAC7B,AAAI,MAAY,KAAO,OAAO,EAAO,KAChC,EAAO,KAAO,EAAM,EAAO,MAAQ,CAAC,GAAG,CAAO;EACvD;EACA,OAAO;CACX;CA4EA,OAAO;EAzEH,MAAM;EACN,eAAe,GAAgB;GAE3B,AADA,IAAS,GACT,IAAW,EAAe,CAAc;EAC5C;EACA,oBAAoB;GAChB,OAAO;GACP,QAAQ,GAAQ,GAAK;IACjB,IAAM,IAAQ,GAAQ,YAAY;IAClC,IAAI,KAAS,CAAC,GAAK,OAAO;IAE1B,IAAM,IAAiB,EAAY,CAAQ,GACrC,IAAO,GAAQ,QAAQ,KACvB,IAAa,EAAa,KAAK,CAAI,IAAI,EAAU,GAAM,MAAM,IAAI,KAAA;IACvE,AAAI,KAAY,EAAI,GAAgB,GAAY,MAAM;IACtD,IAAM,IAAY,IAAQ,CAAC,IAAI,EAAgB,CAAG;IAClD,KAAK,IAAM,KAAS,GAChB,CAAI,KAAS,EAAU,MAAM,MAAO,EAAM,OAAO,KAAK,CAAE,CAAC,MACrD,EAAI,GAAgB,EAAM,QAAQ,EAAM,IAAI;IAGpD,IAAM,IAAa,GAEb,EAAE,SAAM,cAAW,CAAC,MAAM,EAAkB,CAAM,GAClD,IAAS,EAAS,GAAY,CAAK;IAOzC,AANM,gBAAgB,MAClB,EAAO,gBAAgB,EACnB,EAAO,iBAAiB,CAAC,GACzB,EAAa,GAAM,QAAQ,CAC/B,IAGA,EAAE,eAAe,MACjB,CAAC,EAAO,YAAY,EAAE,SAAS,iBAAiB,MAEhD,EAAO,eAAe,EAClB,EAAO,gBAAgB,CAAC,GACxB,EAAa,GAAM,OAAO,CAC9B;IAEJ,IAAM,IAAmC,EAAE,GAAG,EAAO;IACrD,KAAK,IAAM,CAAC,GAAM,MAAY,OAAO,QAAQ,CAAQ,GAAG,EAAO,KAAQ;IACvE,EAAO,iBAAiB,EACpB,EAAO,kBAAkB,CAAC,QAAQ,GAClC,EAAW,KAAK,MAAU,EAAM,MAAM,CAC1C;IAEA,IAAM,IAA2B;KAC7B,YAAY;KACZ,MAAM,EAAa,GAAQ,MAAM;KACjC,QAAQ,EAAa,GAAQ,QAAQ;KACrC,SAAS;KACT,SAAS,IAAQ,UAAU;IAC/B;IAEA,IAAI,KAAO,KAAU,EAAO,WAAW,GAAY;KAC/C,IAAa,EAAO;KACpB,IAAM,IAAQ,EAAW,KAAK,MAAU,KAAK,EAAM,OAAO,MAAM,EAAM,MAAM;KAC5E,EAAO,OAAO,KACV,CACI,4BAA4B,EAAO,cAAc,CAAC,KAAK,GAAG,KAC1D,GAAI,EAAM,SAAS,IACb,IACA,CAAC,2CAA2C,CACtD,CAAC,CAAC,KAAK,IAAI,CACf;IACJ;IAEA,OADA,IAAW,CAAM,GACV,EAAW,GAAM,EAAO,IAAI;GACvC;EACJ;CAGG;AACX"}

package/dist/vite.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./vite/tempest-icons.cjs"),t=require("./vite/create-vite-config.cjs"),n=require("./vite/tempest-pwa-manifest.cjs"),r=require("./vite/tempest-pwa-icons.cjs"),i=require("./vite/tempest-pwa-dev-sw.cjs"),a=require("./vite/tempest-styles.cjs");exports.createViteConfig=t.createViteConfig,exports.tempestIcons=e.tempestIcons,exports.tempestPwaDevSw=i.tempestPwaDevSw,exports.tempestPwaIcons=r.tempestPwaIcons,exports.tempestPwaManifest=n.tempestPwaManifest,exports.tempestStyles=a.tempestStyles;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./vite/tempest-icons.cjs"),t=require("./vite/create-vite-config.cjs"),n=require("./vite/tempest-pwa-manifest.cjs"),r=require("./vite/tempest-pwa-icons.cjs"),i=require("./vite/tempest-pwa-dev-sw.cjs"),a=require("./vite/tempest-styles.cjs"),o=require("./vite/tempest-csp.cjs");exports.createViteConfig=t.createViteConfig,exports.tempestCsp=o.tempestCsp,exports.tempestIcons=e.tempestIcons,exports.tempestPwaDevSw=i.tempestPwaDevSw,exports.tempestPwaIcons=r.tempestPwaIcons,exports.tempestPwaManifest=n.tempestPwaManifest,exports.tempestStyles=a.tempestStyles;

package/dist/vite.d.ts

@@ -88,6 +88,151 @@ export declare interface StyleManifest {
     components: Record<string, readonly string[]>;
 }
 
+/**
+ * Vite plugin that writes a Content-Security-Policy `<meta>` into `index.html`
+ * and derives `connect-src` from the origins the app actually calls.
+ *
+ * It exists because of how a missing origin fails: the request is blocked
+ * before a connection opens, so there is no entry in the Network tab, nothing in
+ * the server log, `curl` succeeds, and the app sees `TypeError: Failed to
+ * fetch` — indistinguishable from offline, DNS or CORS. And a hand-written CSP
+ * plugin is usually `apply: "build"`, so it only fails in production. This
+ * plugin closes both ends:
+ *
+ * - origins come from the same `import.meta.env` the runtime reads
+ *   ({@link TempestCspOptions.env}), reduced to `scheme://host[:port]`, with
+ *   empty values skipped — no second list to drift;
+ * - the policy is enforced under `vite dev` as well ({@link TempestCspOptions.dev});
+ * - the build prints every origin and its provenance.
+ *
+ * Defaults cover what the SDK's stack needs and nothing more: `'self'`
+ * everywhere, `'wasm-unsafe-eval'` for ONNX Runtime, `blob:` for workers, object
+ * URLs and media, `data:` for images and fonts, `object-src 'none'`,
+ * `base-uri 'self'`, `form-action 'self'`. Inline `<script>` blocks left in
+ * `index.html` (a `themeInitScript()` anti-flash script, say) are allowed by
+ * SHA-256 hash, never by `'unsafe-inline'`.
+ *
+ * An existing CSP `<meta>` in `index.html` is merged, not overwritten: every
+ * directive it declares is kept verbatim — the plugin never loosens a choice the
+ * app wrote — except `connect-src`, which gains the resolved origins, since
+ * that is the list the plugin exists to maintain. Directives it does not declare
+ * come from the defaults.
+ *
+ * @param options - See {@link TempestCspOptions}.
+ * @returns A Vite plugin, to be placed in `plugins`. It runs as a `post` HTML
+ *   transform, so a plugin that rewrites inline scripts after it would
+ *   invalidate the hashes.
+ *
+ * @example
+ * // vite.config.ts
+ * import { createViteConfig, tempestCsp } from "tempest-react-sdk/vite";
+ *
+ * export default createViteConfig({
+ *     plugins: [tempestCsp({ connect: ["https://sso.example.com/realms/app"] })],
+ * });
+ */
+export declare function tempestCsp(options?: TempestCspOptions): TempestVitePlugin;
+
+/** Options for {@link tempestCsp}. */
+export declare interface TempestCspOptions {
+    /**
+     * Endpoints the app calls at runtime, as full URLs. Only the origin
+     * (`scheme://host[:port]`) enters `connect-src`: a source expression with a path
+     * matches that path alone, so `https://idp/realms/x` would still block
+     * `https://idp/realms/x/protocol/openid-connect/token`.
+     *
+     * Empty entries (`undefined`, `null`, `false`, `""`) are skipped with a build
+     * warning instead of leaving a hole in the directive, so passing an env var
+     * that is not set is safe. A root-relative path (`/api`) is same-origin and
+     * already covered by `'self'`. Anything else that is not an absolute
+     * `http(s)`/`ws(s)` URL throws at config time — failing the build, not
+     * production. A wildcard host (`https://*.example.com`) is kept as written.
+     */
+    connect?: ReadonlyArray<string | null | undefined | false>;
+    /**
+     * Read origins from the same environment the runtime reads. `true` (the
+     * default) adds every variable Vite exposes to `import.meta.env` (the
+     * `envPrefix` ones, `VITE_` by default) whose value is an absolute
+     * `http(s)`/`ws(s)` URL. This is the structural bridge: an origin added to
+     * `.env` for a new runtime call lands in the policy with no second list to
+     * keep in sync. Pass a list of names to include exactly those — a name that
+     * resolves to nothing is reported as a build warning — or `false` to rely on
+     * {@link TempestCspOptions.connect} alone.
+     */
+    env?: boolean | readonly string[];
+    /**
+     * Also allow the WebSocket twin of every `http(s)` origin (`https://api` →
+     * `wss://api`). Measured in Chromium (23/09/2026): `connect-src https://api`
+     * blocks `new WebSocket("wss://api")`, while `'self'` does cover a same-origin
+     * `ws:` — so an app that derives its socket URL from the API URL breaks
+     * without this. Default `true`.
+     */
+    sockets?: boolean;
+    /**
+     * Add `'wasm-unsafe-eval'` to `script-src`, which `onnxruntime-web` (the
+     * `/vision` and `/tabular` subpaths) needs to compile its WebAssembly. Without
+     * it `WebAssembly.compile` throws a `CompileError` naming `script-src`.
+     * It grants WebAssembly compilation only, not `eval`. Default `true`.
+     */
+    wasm?: boolean;
+    /**
+     * Add `'unsafe-inline'` to `style-src`. React's `style` prop does **not** need
+     * it — it writes through the CSSOM, which CSP does not govern (measured in
+     * Chromium, 23/09/2026). What needs it is a `<style>` element or a `style=""`
+     * attribute, and the SDK's own `applyTheme` injects a `<style>`. Pass `false`
+     * when the app never calls `applyTheme`; inline `<style>` blocks in
+     * `index.html` are then hashed instead. Always on under `vite dev`, whose CSS
+     * injection is a `<style>` element. Default `true`.
+     */
+    inlineStyles?: boolean;
+    /**
+     * Extra sources per directive, merged into the defaults (`{ "img-src":
+     * ["https://tiles.example.com"] }`), or `false` to drop a directive.
+     * `frame-ancestors`, `report-uri` and `sandbox` are ignored by browsers when
+     * delivered by `<meta>`, so they reach {@link TempestCspPolicy.header} only.
+     */
+    directives?: Readonly<Record<string, readonly string[] | false>>;
+    /**
+     * Apply the policy under `vite dev` too. Default `true`: the failure this
+     * plugin exists for is "works in dev, blocked in production", and a policy
+     * enforced in dev moves every missing origin to the first page load on the
+     * developer's machine. Dev differs from build only in `style-src
+     * 'unsafe-inline'` and in allowing every SDK-known origin (see
+     * {@link TempestCspPolicy.connect}), because the dev server cannot know which
+     * modules the page will load.
+     */
+    dev?: boolean;
+    /** Print the resolved `connect-src` and where each origin came from. Default `true`. */
+    log?: boolean;
+    /**
+     * Receive the resolved policy — for asserting it in a test, or for writing the
+     * same policy as an HTTP header (the only channel for `frame-ancestors`).
+     */
+    onPolicy?: (policy: TempestCspPolicy) => void;
+}
+
+/** The policy {@link tempestCsp} resolved for one `index.html`. */
+export declare interface TempestCspPolicy {
+    /** Every directive and its sources, including the header-only ones. */
+    directives: Record<string, string[]>;
+    /** The policy as written into the `<meta http-equiv>` tag. */
+    meta: string;
+    /** The full policy for a `Content-Security-Policy` response header. */
+    header: string;
+    /** Every origin added to `connect-src`, with its provenance. */
+    connect: TempestCspSource[];
+    /** `"serve"` under `vite dev`, `"build"` under `vite build`. */
+    command: "serve" | "build";
+}
+
+/** One origin in `connect-src` and the input that put it there. */
+export declare interface TempestCspSource {
+    /** The source expression, e.g. `https://api.example.com`. */
+    origin: string;
+    /** Where it came from: `env VITE_API_URL`, `connect[0]`, `sockets`, `base` or an SDK module. */
+    from: string;
+}
+
 /**
  * Generate a static icon registry from the slugs your source mentions.
  *

package/dist/vite.js

@@ -4,4 +4,5 @@ import { tempestPwaManifest as n } from "./vite/tempest-pwa-manifest.js";
 import { tempestPwaIcons as r } from "./vite/tempest-pwa-icons.js";
 import { tempestPwaDevSw as i } from "./vite/tempest-pwa-dev-sw.js";
 import { tempestStyles as a } from "./vite/tempest-styles.js";
-export { t as createViteConfig, e as tempestIcons, i as tempestPwaDevSw, r as tempestPwaIcons, n as tempestPwaManifest, a as tempestStyles };
+import { tempestCsp as o } from "./vite/tempest-csp.js";
+export { t as createViteConfig, o as tempestCsp, e as tempestIcons, i as tempestPwaDevSw, r as tempestPwaIcons, n as tempestPwaManifest, a as tempestStyles };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tempest-react-sdk",
-  "version": "0.67.0",
+  "version": "0.68.0",
   "description": "SDK público da Tempest com componentes, hooks e integrações para projetos React.",
   "type": "module",
   "license": "MIT",
@@ -110,7 +110,7 @@
   },
   "scripts": {
     "dev": "vite build --watch",
-    "build": "node scripts/gen-scoped-reset.mjs && tsc -b tsconfig.build.json && node --max-old-space-size=6144 ./node_modules/vite/bin/vite.js build && node scripts/split-css.mjs && node scripts/gen-style-manifest.mjs && node scripts/copy-css-assets.mjs && node scripts/link-component-css.mjs",
+    "build": "node scripts/gen-scoped-reset.mjs && tsc -b tsconfig.build.json && node --max-old-space-size=8192 ./node_modules/vite/bin/vite.js build && node scripts/split-css.mjs && node scripts/gen-style-manifest.mjs && node scripts/copy-css-assets.mjs && node scripts/link-component-css.mjs",
     "postbuild": "node scripts/check-dist-guards.mjs",
     "typecheck": "tsc -b tsconfig.json --noEmit",
     "lint": "eslint .",

package/template/vite.config.ts

@@ -1,7 +1,14 @@
-import { createViteConfig } from "tempest-react-sdk/vite";
+import { createViteConfig, tempestCsp } from "tempest-react-sdk/vite";
 
 // One call wires `@vitejs/plugin-react`, the `@` → `src` alias and dev-server
 // defaults. Override anything (proxy, port, build target) inline.
+//
+// `tempestCsp()` writes a Content-Security-Policy into index.html, in dev and in
+// the build alike. Its `connect-src` comes from every URL-valued VITE_* variable
+// (VITE_API_URL, …), so an origin you call at runtime has to live in `.env` or
+// in `tempestCsp({ connect: [...] })` — a missing one fails as
+// `TypeError: Failed to fetch`, with a CSP error in the browser console.
 export default createViteConfig({
     // proxy: { "/api": "http://127.0.0.1:8000" },
+    plugins: [tempestCsp()],
 });

package/template-pwa/vite.config.ts

@@ -1,5 +1,6 @@
 import {
     createViteConfig,
+    tempestCsp,
     tempestPwaDevSw,
     tempestPwaIcons,
     tempestPwaManifest,
@@ -11,11 +12,16 @@ import {
 //  - tempestPwaManifest — emits dist/precache-manifest.json (it sees the icons
 //    above because they're emitted first), for offline app-shell precaching.
 //  - tempestPwaDevSw   — serves /sw.js (and an empty manifest) under `npm run dev`.
+//  - tempestCsp        — writes the Content-Security-Policy into index.html, in dev
+//    and build alike; `connect-src` comes from every URL-valued VITE_* variable, so
+//    an origin the app calls at runtime has to live in `.env` or in
+//    `tempestCsp({ connect: [...] })`.
 export default createViteConfig({
     // proxy: { "/api": "http://127.0.0.1:8000" },
     plugins: [
         tempestPwaIcons({ source: "public/icon.svg", appleSplash: true }),
         tempestPwaManifest({ additionalUrls: ["/manifest.webmanifest", "/icon.svg"] }),
         tempestPwaDevSw(),
+        tempestCsp(),
     ],
 });