chore: integrate improve-integration

apps/server/package.json

@@ -17,24 +17,33 @@
 		"#react-pdf-renderer": "@react-pdf/renderer"
 	},
 	"dependencies": {
-		"@ai-sdk/anthropic": "^4.0.8",
-		"@ai-sdk/google": "^4.0.8",
-		"@ai-sdk/openai": "^4.0.7",
-		"@ai-sdk/openai-compatible": "^3.0.5",
-		"@aws-sdk/client-s3": "^3.1079.0",
+		"@ai-sdk/anthropic": "^4.0.10",
+		"@ai-sdk/cerebras": "^3.0.6",
+		"@ai-sdk/cohere": "^4.0.6",
+		"@ai-sdk/deepseek": "^3.0.6",
+		"@ai-sdk/fireworks": "^3.0.7",
+		"@ai-sdk/google": "^4.0.10",
+		"@ai-sdk/groq": "^4.0.6",
+		"@ai-sdk/mistral": "^4.0.7",
+		"@ai-sdk/openai": "^4.0.9",
+		"@ai-sdk/openai-compatible": "^3.0.6",
+		"@ai-sdk/perplexity": "^4.0.7",
+		"@ai-sdk/togetherai": "^3.0.7",
+		"@ai-sdk/xai": "^4.0.9",
+		"@aws-sdk/client-s3": "^3.1081.0",
 		"@better-auth/api-key": "^1.6.23",
 		"@better-auth/drizzle-adapter": "^1.6.23",
-		"@better-auth/infra": "^0.3.4",
+		"@better-auth/infra": "^0.3.5",
 		"@better-auth/oauth-provider": "^1.6.23",
 		"@better-auth/passkey": "^1.6.23",
 		"@hono/node-server": "^2.0.8",
 		"@modelcontextprotocol/sdk": "^1.29.0",
-		"@orpc/client": "^1.14.6",
-		"@orpc/experimental-ratelimit": "^1.14.6",
-		"@orpc/json-schema": "^1.14.6",
-		"@orpc/openapi": "^1.14.6",
-		"@orpc/server": "^1.14.6",
-		"@orpc/zod": "^1.14.6",
+		"@orpc/client": "^1.14.7",
+		"@orpc/experimental-ratelimit": "^1.14.7",
+		"@orpc/json-schema": "^1.14.7",
+		"@orpc/openapi": "^1.14.7",
+		"@orpc/server": "^1.14.7",
+		"@orpc/zod": "^1.14.7",
 		"@react-pdf/renderer": "^4.5.1",
 		"@reactive-resume/api": "workspace:*",
 		"@reactive-resume/auth": "workspace:*",
@@ -46,7 +55,7 @@
 		"@sindresorhus/slugify": "^3.0.0",
 		"@t3-oss/env-core": "^0.13.11",
 		"@uiw/color-convert": "^2.10.3",
-		"ai": "^7.0.15",
+		"ai": "^7.0.18",
 		"bcrypt": "^6.0.0",
 		"better-auth": "1.6.23",
 		"cjk-regex": "^3.4.0",
@@ -55,15 +64,15 @@
 		"drizzle-zod": "1.0.0-beta.14-a36c63d",
 		"es-toolkit": "^1.49.0",
 		"fast-json-patch": "^3.1.1",
-		"hono": "^4.12.27",
+		"hono": "^4.12.28",
 		"jsonrepair": "^3.15.0",
-		"node-html-parser": "^8.0.4",
+		"node-html-parser": "^9.0.0",
 		"nodemailer": "^9.0.3",
-		"ollama-ai-provider-v2": "^3.6.0",
+		"ollama-ai-provider-v2": "^4.0.1",
 		"pg": "^8.22.0",
 		"phosphor-icons-react-pdf": "^0.1.3",
 		"react": "^19.2.7",
-		"react-email": "^6.6.6",
+		"react-email": "^6.6.8",
 		"react-pdf-html": "^2.1.5",
 		"resumable-stream": "^2.2.12",
 		"sharp": "^0.35.3",
@@ -74,13 +83,13 @@
 	},
 	"devDependencies": {
 		"@reactive-resume/config": "workspace:*",
-		"@types/node": "^26.1.0",
+		"@types/node": "^26.1.1",
 		"@types/pg": "^8.20.0",
 		"@types/react": "^19.2.17",
-		"@typescript/native-preview": "7.0.0-dev.20260705.1",
-		"tsdown": "^0.22.3",
+		"@typescript/native-preview": "7.0.0-dev.20260707.2",
+		"tsdown": "^0.22.4",
 		"tsx": "^4.23.0",
-		"typescript": "^6.0.3",
-		"vitest": "^4.1.9"
+		"typescript": "^7.0.2",
+		"vitest": "^4.1.10"
 	}
 }

apps/server/src/static/uploads.test.ts

@@ -33,6 +33,8 @@ describe("handleUpload", () => {
 		expect(response.status).toBe(200);
 		expect(readMock).toHaveBeenCalledWith("uploads/user-1/pictures/photo.jpeg");
 		expect(response.headers.get("Content-Type")).toBe("image/jpeg");
+		expect(response.headers.get("Cross-Origin-Resource-Policy")).toBe("same-site");
+		expect(response.headers.get("Access-Control-Allow-Origin")).toBeNull();
 	});
 
 	it("does not serve private agent attachment keys through the public uploads route", async () => {

apps/server/src/static/uploads.ts

@@ -1,7 +1,6 @@
 import { createHash } from "node:crypto";
 import { basename, extname, normalize } from "node:path";
 import { getStorageService, inferContentType } from "@reactive-resume/api/features/storage";
-import { env } from "@reactive-resume/env/server";
 
 export async function handleUpload(request: Request) {
 	const { userId, filePath } = parseRouteParams(request.url);
@@ -41,7 +40,6 @@ export async function handleUpload(request: Request) {
 	headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
 	headers.set("X-Frame-Options", "DENY");
 	headers.set("X-Download-Options", "noopen");
-	headers.set("Access-Control-Allow-Origin", env.APP_URL);
 
 	return new Response(toArrayBuffer(storedFile.data), { headers });
 }

apps/server/src/static/web.test.ts

@@ -32,6 +32,15 @@ describe("web app fallback classification", () => {
 		expect(await response.text()).toBe("<html>app</html>");
 	});
 
+	it.each(["/", "/alice/resume"])("sets framing and report-only CSP security headers on %s", async (pathname) => {
+		const response = await handleWebApp(new Request(`https://example.com${pathname}`));
+
+		expect(response.status).toBe(200);
+		expect(response.headers.get("X-Frame-Options")).toBe("DENY");
+		expect(response.headers.get("X-Content-Type-Options")).toBe("nosniff");
+		expect(response.headers.get("Content-Security-Policy-Report-Only")).toContain("frame-ancestors 'none'");
+	});
+
 	it.each([
 		"/auth/login",
 		"/dashboard",

apps/server/src/static/web.ts

@@ -52,12 +52,21 @@ function isPublicResumePath(pathname: string): boolean {
 	return segments.length === 2 && firstSegment !== undefined && !reservedPublicResumeSegments.has(firstSegment);
 }
 
+const BASE_SECURITY_HEADERS = {
+	"X-Frame-Options": "DENY",
+	"X-Content-Type-Options": "nosniff",
+	"Referrer-Policy": "strict-origin-when-cross-origin",
+	"Content-Security-Policy-Report-Only":
+		"default-src 'self'; img-src 'self' data: blob:; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; object-src 'none'",
+};
+
 function getFallbackResponseHeaders(pathname: string) {
-	if (pathname === "/") return { "Content-Type": "text/html; charset=UTF-8" };
+	if (pathname === "/") return { "Content-Type": "text/html; charset=UTF-8", ...BASE_SECURITY_HEADERS };
 	if (isNoindexShellPath(pathname) || isPublicResumePath(pathname)) {
 		return {
 			"Content-Type": "text/html; charset=UTF-8",
 			"X-Robots-Tag": "noindex, follow",
+			...BASE_SECURITY_HEADERS,
 		};
 	}