@cryptoguard/manifest-sveltekit

SvelteKit plugin for CryptoGuard manifest generation. Automatically generates a manifest file mapping your SvelteKit build output to served URL paths for binary transparency verification.

Installation

pnpm add @cryptoguard/manifest-sveltekit

Usage

Add the plugin to your vite.config.ts:

import { sveltekit } from '@sveltejs/kit/vite';
import { cryptoGuardManifest } from '@cryptoguard/manifest-sveltekit';
import { defineConfig } from 'vite';

export default defineConfig({
  plugins: [
    sveltekit(),
    cryptoGuardManifest()
  ]
});

Configuration

With SvelteKit Config

Pass your SvelteKit configuration to the plugin:

import { sveltekit } from '@sveltejs/kit/vite';
import { cryptoGuardManifest } from '@cryptoguard/manifest-sveltekit';
import { defineConfig } from 'vite';

const svelteKitConfig = {
  kit: {
    paths: {
      base: '/docs'
    }
  }
};

export default defineConfig({
  plugins: [
    sveltekit(),
    cryptoGuardManifest(svelteKitConfig)
  ]
});

Plugin Options

cryptoGuardManifest(svelteKitConfig, {
  verbose: true,   // Enable detailed logging
  disabled: false, // Disable manifest generation
  projectRoot: process.cwd() // Project root directory
})

Environment Variables

You can use environment variables for dynamic configuration:

const svelteKitConfig = {
  kit: {
    paths: {
      base: process.env.PUBLIC_BASE_PATH || ''
    }
  }
};

export default defineConfig({
  plugins: [
    sveltekit(),
    cryptoGuardManifest(svelteKitConfig, {
      verbose: process.env.MANIFEST_VERBOSE === 'true',
      disabled: process.env.MANIFEST_DISABLED === 'true'
    })
  ]
});

Generated Manifest

The plugin generates a manifest.json file in your project root:

{
  "version": "1.0",
  "framework": "sveltekit",
  "frameworkVersion": "2.0.0",
  "sources": [
    {
      "dir": "build/client",
      "serveAt": "/"
    }
  ]
}

With Base Path

When using kit.paths.base:

{
  "version": "1.0",
  "framework": "sveltekit",
  "frameworkVersion": "2.0.0",
  "sources": [
    {
      "dir": "build/client",
      "serveAt": "/docs"
    }
  ]
}

How It Works

1. Build Hook: Runs after SvelteKit build completes
2. Path Detection: Extracts kit.paths.base from your config
3. Manifest Generation: Maps build/client/ to the appropriate serve path
4. Smart Updates: Only updates manifest.json when content changes
5. Validation: Ensures manifest security (no path traversal, proper structure)

SvelteKit Build Output Structure

SvelteKit generates:

• build/client/ - Static assets and application code
• build/client/_app/ - Framework assets (chunks, CSS, etc.)

The plugin maps the entire build/client/ directory to your configured base path, as SvelteKit serves all assets (including _app/) from this location.

License

MIT