Hwaro::Core::Build::Csp

Header lines longer than this are dropped by Cloudflare Pages.

Rules beyond which Cloudflare Pages stops reading a _headers file.

<script type> values the browser executes (and so checks against script-src): the JavaScript MIME types, module, and the two inline-only JSON types the HTML spec runs through CSP. Every other type (application/ld+json, text/template, …) is a data block.

Sources a feature Hwaro itself emits needs, keyed by markers the feature leaves in the page: its URL, and for an embed whose script [privacy] can localize while it still loads more from its host, the shortcode's own markup. A page gets a row's sources only when its final HTML contains a marker, so a CDN that [privacy] fully localized, or a shortcode the page does not use, adds nothing.

Directives a <meta> policy cannot carry (CSP3 §6.1).

Elements whose content the parser does not read as markup, skipped without hashing. Not <noscript>: with scripting off its content is markup, and a <style> in it is checked against the policy.

Hash every HTML page under output_dir (except the excluded absolute paths: verbatim copies of user files) and emit the policies. Returns what each page got, for the post-hook check.

Pages (output-relative) whose inline bytes a [build] hooks.post command changed after their policy was emitted.

An attribute value as the HTML parser decodes it: a named reference without ; stays literal when = or an alphanumeric follows it (url(a?x=1&copy=2) keeps its &copy), which HTML.unescape alone would decode.

'sha256-…' of body as the browser hashes it: after the input stream's newline normalization (CRLF and lone CR become LF).

The headers file: the user's own file verbatim, then one block per page. A user block that already sets header for a path wins.

html with its policy <meta> as the first child of <head> — after a leading <meta charset>, which must stay within the first 1024 bytes. A meta a previous build injected is replaced. Unchanged when the page has no <head>.

The policy for one page. meta drops what a <meta> cannot carry.

The _headers path line for a page file: its URL encoded exactly as the sitemap <loc> is (# → %23 and ? → %3F as Page#url= does, then encode_url_path), so the rule matches what the browser requests. Nil when no path line can match the page: hosts read : and * as a placeholder and a splat, a control character breaks the file, and a % in the file name cannot be traced back to one URL (a%b is published for /a%b/ and /a%25b/ alike).

html without the policy <meta> a previous build injected. Hwaro reads a --cache hit's HTML back from disk before Finalize (the AMP converter, the PWA cache name); stripping it there keeps those outputs identical to a cold build's.

The URL path a page file is served at (blog/x/index.html → /blog/x/), before base_path.