@application-kit/nestjs-vite 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @application-kit/nestjs-vite
 
+## 0.5.0
+
+### Minor Changes
+
+- 9909a33: HTML-страницы получают `Content-Security-Policy` с новым nonce на каждый запрос, и тот же nonce стоит на теге состояния. Режим задаёт `CONTENT_SECURITY_POLICY_MODE`: `enforce` по умолчанию, `report-only` или `off` для отката. В `peerDependencies` добавлены `@libs-for-dev/nestjs-config-module`, `class-transformer` и `class-validator`. Клиенту с `zod` нужен `z.config({ jitless: true })`, иначе его проба `eval` пишет нарушение в консоль.
+
+## 0.4.0
+
+### Minor Changes
+
+- ed011f8: `defineApplicationViteConfig({ root, appPath, clientHtml, environment, plugins, buildPlugins })` во входе `/vite-plugin`
+  (и в корне) — весь `vite.config` Nest-SSR-приложения объектом. Контракт выходных имён: серверные входы `[name].mjs` и
+  чанки `[hash].mjs` в корне `dist`, клиент — `assets/[hash].js`, ассеты — `assets/[hash][extname]`, карт нет. Серверную
+  сборку отличает `--ssr` в `process.argv`; порты dev-сервера и HMR — из `environment`. Плагины клиента и плагины только
+  сборки приходят параметрами, зависимостей у пакета не прибавилось.
+
 ## 0.3.0
 
 ### Minor Changes

package/README.md

@@ -26,6 +26,49 @@ export default defineConfig({
 статическими расширениями и внутренние пути Vite уходят в Vite, остальные — в Nest; при
 горячем обновлении приложение пересоздаётся.
 
+## Vite-конфиг приложения
+
+`defineApplicationViteConfig(options)` из `@application-kit/nestjs-vite/vite-plugin` — весь `vite.config`
+Nest-SSR-приложения: dev-сервер Nest (`vitePluginNode`), серверные входы `vite build --ssr <вход>` и клиентская сборка
+в один `dist`.
+
+```ts
+// vite.config.mts
+import { defineApplicationViteConfig } from '@application-kit/nestjs-vite/vite-plugin'
+
+export default defineApplicationViteConfig({
+  appPath: path.resolve(import.meta.dirname, 'src/create-web-application.ts'),
+  buildPlugins: [cleanup()],
+  clientHtml: path.resolve(import.meta.dirname, 'src/client/index.html'),
+  environment: process.env,
+  plugins: [vue(), htmlMinifier({ minify: true })],
+  root: import.meta.dirname,
+})
+```
+
+- Конфиг — объект, а не функция: `vitest.config` приложения мержит его как объект. Серверную сборку отличает флаг
+  `--ssr` в `process.argv` в момент вызова.
+- Пресет не знает о фреймворке клиента: его плагины, обработка HTML и script-теги модулей приходят в `plugins` (после
+  плагина Nest), плагины только сборки (rolldown) — в `buildPlugins`.
+- Окружение: `PORT` (dev-сервер, 3000), `VITE_SERVER_HMR_PORT` и `VITE_SERVER_HMR_CLIENT_PORT` (HMR, 3001), `NODE_ENV=test`
+  выключает прогрев клиентского графа — в e2e браузера нет, а SSR-запросы ждали бы этот фон.
+- Алиас `@` — `<root>/src`; `optimizeDeps` — `pino` без автопоиска; логгер Vite без предупреждений «Sourcemap for …» о
+  картах зависимостей.
+
+Контракт выходных имён — на него опираются команды запуска, образ и раздача статики приложения:
+
+| Что | Имя |
+|---|---|
+| серверный вход (`web`, `cli`, `consumer`, `tracing`, `ormconfig`, …) | `dist/[name].mjs` — без хеша, запускается по имени |
+| серверный чанк | `dist/[hash].mjs` |
+| клиентский вход и чанки | `dist/assets/[hash].js` |
+| ассеты | `dist/assets/[hash][extname]` |
+| карты `*.map` | нет |
+
+Серверный код — `.mjs`: в `dist` нет `package.json` с `"type": "module"`, и `.js` Node прочёл бы как CommonJS. Клиент
+лежит только под `assets/`: каталог отдаётся наружу с вечным кешем, имена контент-адресные, серверного кода и карт в нём
+нет.
+
 ## SSR-страница
 
 ```ts
@@ -61,17 +104,35 @@ export class ClientModule {}
 
 | Константа | В шаблоне | Чем заменяется |
 |---|---|---|
-| `STATE_PLACEHOLDER` | `<script id="state"></script>` | `<script>` с присваиваниями `window[ключ] = значение` |
+| `STATE_PLACEHOLDER` | `<script id="state"></script>` | `<script id="state" nonce="…">` с присваиваниями `window[ключ] = значение` |
 | `TEMPLATE_PLACEHOLDER` | `<div id="app"></div>` | тот же `div` с разметкой `template` внутри |
 | `LANG_ATTRIBUTE_PATTERN` | `<html lang="…">` с любым значением | `lang` страницы |
 
 Значения состояния уходят JS-литералами строки с экранированным `<`: `</script>` в данных не закроет тег, какой бы
 сериализатор ни выбрало приложение. Клиентский энтри читает их до гидрации.
 
-`renderHtmlPage(renderer, request, reply)` — один путь HTML-ответа: ставит статус рендера и `Content-Type: text/html`
-и возвращает HTML. Контроллер с `@Res({ passthrough: true })` возвращает его, фильтр — отправляет. Декоратор
+`renderHtmlPage(renderer, request, reply)` — один путь HTML-ответа: ставит статус рендера, `Content-Type: text/html` и
+заголовки рендера и возвращает HTML. Контроллер с `@Res({ passthrough: true })` возвращает его, фильтр — отправляет. Декоратор
 `@Header('Content-Type')` на маршруте страницы не нужен.
 
+### Content Security Policy
+
+Рендерер выпускает на каждый ответ новый nonce и ставит его в заголовок и на тег состояния:
+`script-src 'self' 'nonce-…'; object-src 'none'; base-uri 'self'`. Заголовок ставит пакет, потому что значение меняется
+с каждым запросом, а прокси перед приложением этого не умеют. Страницу с nonce нельзя кешировать на прокси или CDN: все
+посетители получили бы один nonce.
+
+Режим — переменная `CONTENT_SECURITY_POLICY_MODE`, проверяется при старте:
+
+| Значение | Заголовок |
+|---|---|
+| `enforce` (по умолчанию) | `Content-Security-Policy` |
+| `report-only` | `Content-Security-Policy-Report-Only` |
+| `off` | нет, и nonce на тег не ставится |
+
+`eval` и `new Function` политика запрещает, и браузер пишет нарушение в консоль, даже если код перехватывает ошибку. Так
+поступает проба `allowsEval` в `zod`: клиенту с `zod` нужен `z.config({ jitless: true })` до первой схемы.
+
 ### Фильтры
 
 - `NotFoundFilter` — регистрирует `ViteSsrModule`: `NotFoundException` отвечает отрендеренной страницей

package/dist/cjs/content-security-policy/content-security-policy.config.d.ts

@@ -0,0 +1,7 @@
+import type { ContentSecurityPolicyInterface } from './content-security-policy.interface.js';
+import { ContentSecurityPolicyEnvironment } from './content-security-policy.environment.js';
+export declare class ContentSecurityPolicyConfig {
+    private readonly environment;
+    constructor(environment: ContentSecurityPolicyEnvironment);
+    issue(): ContentSecurityPolicyInterface;
+}

package/dist/cjs/content-security-policy/content-security-policy.config.js

@@ -0,0 +1,44 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContentSecurityPolicyConfig = void 0;
+const common_1 = require("@nestjs/common");
+const node_crypto_1 = require("node:crypto");
+const content_security_policy_environment_js_1 = require("./content-security-policy.environment.js");
+const NONCE_BYTES = 16;
+const HEADER_BY_MODE = {
+    enforce: 'Content-Security-Policy',
+    'report-only': 'Content-Security-Policy-Report-Only',
+};
+const buildPolicy = (nonce) => `script-src 'self' 'nonce-${nonce}'; object-src 'none'; base-uri 'self'`;
+let ContentSecurityPolicyConfig = class ContentSecurityPolicyConfig {
+    environment;
+    constructor(environment) {
+        this.environment = environment;
+    }
+    issue() {
+        const mode = this.environment.CONTENT_SECURITY_POLICY_MODE;
+        if (mode === 'off') {
+            return { headers: {}, nonce: undefined };
+        }
+        const nonce = (0, node_crypto_1.randomBytes)(NONCE_BYTES).toBase64();
+        return { headers: { [HEADER_BY_MODE[mode]]: buildPolicy(nonce) }, nonce };
+    }
+};
+exports.ContentSecurityPolicyConfig = ContentSecurityPolicyConfig;
+exports.ContentSecurityPolicyConfig = ContentSecurityPolicyConfig = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(content_security_policy_environment_js_1.ContentSecurityPolicyEnvironment)),
+    __metadata("design:paramtypes", [content_security_policy_environment_js_1.ContentSecurityPolicyEnvironment])
+], ContentSecurityPolicyConfig);

package/dist/cjs/content-security-policy/content-security-policy.environment.d.ts

@@ -0,0 +1,5 @@
+export declare const CONTENT_SECURITY_POLICY_MODES: readonly ["enforce", "off", "report-only"];
+export type ContentSecurityPolicyMode = (typeof CONTENT_SECURITY_POLICY_MODES)[number];
+export declare class ContentSecurityPolicyEnvironment {
+    CONTENT_SECURITY_POLICY_MODE: ContentSecurityPolicyMode;
+}

package/dist/cjs/content-security-policy/content-security-policy.environment.js

@@ -0,0 +1,24 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContentSecurityPolicyEnvironment = exports.CONTENT_SECURITY_POLICY_MODES = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+exports.CONTENT_SECURITY_POLICY_MODES = ['enforce', 'off', 'report-only'];
+class ContentSecurityPolicyEnvironment {
+    CONTENT_SECURITY_POLICY_MODE = 'enforce';
+}
+exports.ContentSecurityPolicyEnvironment = ContentSecurityPolicyEnvironment;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsIn)(exports.CONTENT_SECURITY_POLICY_MODES),
+    __metadata("design:type", String)
+], ContentSecurityPolicyEnvironment.prototype, "CONTENT_SECURITY_POLICY_MODE", void 0);

package/dist/cjs/content-security-policy/content-security-policy.interface.d.ts

@@ -0,0 +1,4 @@
+export interface ContentSecurityPolicyInterface {
+    readonly headers: Readonly<Record<string, string>>;
+    readonly nonce: string | undefined;
+}

package/dist/cjs/content-security-policy/content-security-policy.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/content-security-policy/index.d.ts

@@ -0,0 +1,3 @@
+export * from './content-security-policy.config.js';
+export * from './content-security-policy.environment.js';
+export * from './content-security-policy.interface.js';

package/dist/cjs/content-security-policy/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./content-security-policy.config.js"), exports);
+__exportStar(require("./content-security-policy.environment.js"), exports);
+__exportStar(require("./content-security-policy.interface.js"), exports);

package/dist/cjs/index.d.ts

@@ -1,3 +1,4 @@
+export * from './content-security-policy/index.js';
 export * from './filters/index.js';
 export * from './html-loader/index.js';
 export * from './renderer/index.js';

package/dist/cjs/index.js

@@ -14,6 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./content-security-policy/index.js"), exports);
 __exportStar(require("./filters/index.js"), exports);
 __exportStar(require("./html-loader/index.js"), exports);
 __exportStar(require("./renderer/index.js"), exports);

package/dist/cjs/renderer/html-template.d.ts

@@ -2,4 +2,4 @@ import type { SsrPageInterface } from '../ssr-entry/ssr-entry.interface.js';
 export declare const STATE_PLACEHOLDER = "<script id=\"state\"></script>";
 export declare const TEMPLATE_PLACEHOLDER = "<div id=\"app\"></div>";
 export declare const LANG_ATTRIBUTE_PATTERN: RegExp;
-export declare const fillHtmlTemplate: (html: string, page: SsrPageInterface) => string;
+export declare const fillHtmlTemplate: (html: string, page: SsrPageInterface, nonce?: string) => string;

package/dist/cjs/renderer/html-template.js

@@ -6,13 +6,14 @@ exports.TEMPLATE_PLACEHOLDER = '<div id="app"></div>';
 exports.LANG_ATTRIBUTE_PATTERN = /<html\s+lang="[^"]*"/u;
 const toScriptLiteral = (value) => JSON.stringify(value).replaceAll('<', String.raw `\u003C`);
 const toAttributeValue = (value) => value.replaceAll('&', '&amp;').replaceAll('"', '&quot;');
-const toStateScript = (state) => {
+const toStateScript = (state, nonce) => {
     const assignments = Object.entries(state)
         .map(([key, value]) => `window[${toScriptLiteral(key)}] = ${toScriptLiteral(value)};`);
-    return `<script>${assignments.join('')}</script>`;
+    const nonceAttribute = nonce === undefined ? '' : ` nonce="${toAttributeValue(nonce)}"`;
+    return `<script id="state"${nonceAttribute}>${assignments.join('')}</script>`;
 };
-const fillHtmlTemplate = (html, page) => html
-    .replace(exports.STATE_PLACEHOLDER, () => toStateScript(page.state))
+const fillHtmlTemplate = (html, page, nonce) => html
+    .replace(exports.STATE_PLACEHOLDER, () => toStateScript(page.state, nonce))
     .replace(exports.TEMPLATE_PLACEHOLDER, () => `<div id="app">${page.template}</div>`)
     .replace(exports.LANG_ATTRIBUTE_PATTERN, () => `<html lang="${toAttributeValue(page.lang)}"`);
 exports.fillHtmlTemplate = fillHtmlTemplate;

package/dist/cjs/renderer/render-html-page.js

@@ -2,8 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderHtmlPage = void 0;
 const renderHtmlPage = async (renderer, request, reply) => {
-    const { html, statusCode } = await renderer.renderApplication(request);
+    const { headers = {}, html, statusCode } = await renderer.renderApplication(request);
     void reply.code(statusCode).header('Content-Type', 'text/html');
+    for (const [name, value] of Object.entries(headers)) {
+        void reply.header(name, value);
+    }
     return html;
 };
 exports.renderHtmlPage = renderHtmlPage;

package/dist/cjs/renderer/vite-application-renderer.d.ts

@@ -3,10 +3,12 @@ import type { HtmlLoaderInterface } from '../html-loader/html-loader.interface.j
 import type { SsrEntryInterface } from '../ssr-entry/ssr-entry.interface.js';
 import type { ApplicationInterface, ViteApplicationRendererInterface } from '../vite-application-renderer.interface.js';
 import type { ViteSsrOptionsInterface } from '../vite-ssr-options.interface.js';
+import { ContentSecurityPolicyConfig } from '../content-security-policy/content-security-policy.config.js';
 export declare class ViteApplicationRenderer implements ViteApplicationRendererInterface {
     private readonly ssrEntry;
     private readonly htmlLoader;
     private readonly options;
-    constructor(ssrEntry: SsrEntryInterface, htmlLoader: HtmlLoaderInterface, options: Pick<ViteSsrOptionsInterface, 'buildInitialState' | 'htmlPath'>);
+    private readonly contentSecurityPolicy;
+    constructor(ssrEntry: SsrEntryInterface, htmlLoader: HtmlLoaderInterface, options: Pick<ViteSsrOptionsInterface, 'buildInitialState' | 'htmlPath'>, contentSecurityPolicy: ContentSecurityPolicyConfig);
     renderApplication(request: FastifyRequest): Promise<ApplicationInterface>;
 }

package/dist/cjs/renderer/vite-application-renderer.js

@@ -14,6 +14,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ViteApplicationRenderer = void 0;
 const common_1 = require("@nestjs/common");
+const content_security_policy_config_js_1 = require("../content-security-policy/content-security-policy.config.js");
 const html_loader_interface_js_1 = require("../html-loader/html-loader.interface.js");
 const ssr_entry_interface_js_1 = require("../ssr-entry/ssr-entry.interface.js");
 const vite_constants_js_1 = require("../vite.constants.js");
@@ -22,16 +23,19 @@ let ViteApplicationRenderer = class ViteApplicationRenderer {
     ssrEntry;
     htmlLoader;
     options;
-    constructor(ssrEntry, htmlLoader, options) {
+    contentSecurityPolicy;
+    constructor(ssrEntry, htmlLoader, options, contentSecurityPolicy) {
         this.ssrEntry = ssrEntry;
         this.htmlLoader = htmlLoader;
         this.options = options;
+        this.contentSecurityPolicy = contentSecurityPolicy;
     }
     async renderApplication(request) {
         const { url } = request;
         const html = await this.htmlLoader.loadHtml(this.options.htmlPath, url);
         const page = await this.ssrEntry.render(url, this.options.buildInitialState(request));
-        return { html: (0, html_template_js_1.fillHtmlTemplate)(html, page), statusCode: page.statusCode };
+        const { headers, nonce } = this.contentSecurityPolicy.issue();
+        return { headers, html: (0, html_template_js_1.fillHtmlTemplate)(html, page, nonce), statusCode: page.statusCode };
     }
 };
 exports.ViteApplicationRenderer = ViteApplicationRenderer;
@@ -40,5 +44,6 @@ exports.ViteApplicationRenderer = ViteApplicationRenderer = __decorate([
     __param(0, (0, common_1.Inject)(ssr_entry_interface_js_1.SSR_ENTRY_INTERFACE)),
     __param(1, (0, common_1.Inject)(html_loader_interface_js_1.HTML_LOADER_INTERFACE)),
     __param(2, (0, common_1.Inject)(vite_constants_js_1.VITE_SSR_OPTIONS)),
-    __metadata("design:paramtypes", [Object, Object, Object])
+    __param(3, (0, common_1.Inject)(content_security_policy_config_js_1.ContentSecurityPolicyConfig)),
+    __metadata("design:paramtypes", [Object, Object, Object, content_security_policy_config_js_1.ContentSecurityPolicyConfig])
 ], ViteApplicationRenderer);

package/dist/cjs/vite-application-renderer.interface.d.ts

@@ -1,6 +1,7 @@
 import type { HttpStatus } from '@nestjs/common';
 import type { FastifyRequest } from 'fastify';
 interface AppInterface {
+    headers?: Readonly<Record<string, string>>;
     html: string;
     statusCode: HttpStatus;
 }

package/dist/cjs/vite-plugin/application-vite-config-options.interface.d.ts

@@ -0,0 +1,16 @@
+import type { BuildOptions, PluginOption } from 'vite';
+export interface ApplicationViteConfigOptionsInterface {
+    appPath: string;
+    buildPlugins?: BuildPluginsType;
+    clientHtml: string;
+    environment: ApplicationViteEnvironmentInterface;
+    plugins: PluginOption[];
+    root: string;
+}
+export interface ApplicationViteEnvironmentInterface {
+    NODE_ENV?: string;
+    PORT?: string;
+    VITE_SERVER_HMR_CLIENT_PORT?: string;
+    VITE_SERVER_HMR_PORT?: string;
+}
+export type BuildPluginsType = NonNullable<NonNullable<BuildOptions['rolldownOptions']>['plugins']>;

package/dist/cjs/vite-plugin/application-vite-config-options.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/vite-plugin/define-application-vite-config.d.ts

@@ -0,0 +1,3 @@
+import type { UserConfig } from 'vite';
+import type { ApplicationViteConfigOptionsInterface } from './application-vite-config-options.interface.js';
+export declare const defineApplicationViteConfig: (options: ApplicationViteConfigOptionsInterface) => UserConfig;

package/dist/cjs/vite-plugin/define-application-vite-config.js

@@ -0,0 +1,89 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defineApplicationViteConfig = void 0;
+const node_path_1 = __importDefault(require("node:path"));
+const node_process_1 = __importDefault(require("node:process"));
+const vite_1 = require("vite");
+const vite_plugin_node_js_1 = require("./vite-plugin-node.js");
+const CLIENT_ENTRY = 'assets/main';
+const DEV_SERVER_PORT = 3000;
+const HMR_PORT = 3001;
+const SOURCEMAP_WARNING = 'Sourcemap for';
+const VENDOR_GROUP = /\/node_modules\/(?<group>[\w\-@]*)/u;
+const vendorGroupName = (moduleId) => {
+    const match = VENDOR_GROUP.exec(moduleId);
+    return match?.groups ? match.groups.group : 'unknown';
+};
+const outputOf = (isServerBuild) => ({
+    assetFileNames: 'assets/[hash][extname]',
+    chunkFileNames: isServerBuild ? '[hash].mjs' : 'assets/[hash].js',
+    codeSplitting: {
+        groups: [
+            { name: 'layout', test: /layouts/u },
+            { maxSize: 200_000, minSize: 100_000, name: vendorGroupName, priority: 10, test: /node_modules/u },
+        ],
+    },
+    comments: false,
+    dir: './dist',
+    entryFileNames: (chunk) => (chunk.name === CLIENT_ENTRY ? 'assets/[hash].js' : '[name].mjs'),
+    format: 'esm',
+    hashCharacters: 'base36',
+    minifyInternalExports: false,
+});
+const buildOf = (options, isServerBuild) => ({
+    chunkSizeWarningLimit: 400,
+    emptyOutDir: false,
+    manifest: true,
+    minify: false,
+    rolldownOptions: {
+        input: { [CLIENT_ENTRY]: options.clientHtml },
+        output: outputOf(isServerBuild),
+        plugins: options.buildPlugins ?? [],
+    },
+    sourcemap: false,
+});
+const portOf = (value, fallback) => Number(value) || fallback;
+const serverOf = (environment) => ({
+    allowedHosts: true,
+    hmr: {
+        clientPort: portOf(environment.VITE_SERVER_HMR_CLIENT_PORT, HMR_PORT),
+        port: portOf(environment.VITE_SERVER_HMR_PORT, HMR_PORT),
+    },
+    host: '0.0.0.0',
+    middlewareMode: false,
+    port: portOf(environment.PORT, DEV_SERVER_PORT),
+    preTransformRequests: environment.NODE_ENV !== 'test',
+    strictPort: true,
+    watch: {
+        ignored: ['**/*.gql', 'reports/**/*'],
+        interval: 400,
+        usePolling: true,
+    },
+});
+const createApplicationLogger = () => {
+    const logger = (0, vite_1.createLogger)();
+    const warnOnce = logger.warnOnce.bind(logger);
+    logger.warnOnce = (message, options) => {
+        if (!message.includes(SOURCEMAP_WARNING)) {
+            warnOnce(message, options);
+        }
+    };
+    return logger;
+};
+const defineApplicationViteConfig = (options) => {
+    const isServerBuild = node_process_1.default.argv.includes('--ssr');
+    return {
+        appType: 'custom',
+        build: buildOf(options, isServerBuild),
+        customLogger: createApplicationLogger(),
+        optimizeDeps: { include: ['pino'], noDiscovery: true },
+        plugins: [...(0, vite_plugin_node_js_1.vitePluginNode)({ appPath: options.appPath }), ...options.plugins],
+        resolve: { alias: { '@': node_path_1.default.resolve(options.root, 'src') } },
+        root: node_path_1.default.resolve(options.root),
+        server: serverOf(options.environment),
+    };
+};
+exports.defineApplicationViteConfig = defineApplicationViteConfig;

package/dist/cjs/vite-plugin/index.d.ts

@@ -1,4 +1,6 @@
+export * from './application-vite-config-options.interface.js';
 export * from './create-middleware.js';
+export * from './define-application-vite-config.js';
 export * from './nest-handler.js';
 export * from './plugin-config.interface.js';
 export * from './vite-plugin-node.js';

package/dist/cjs/vite-plugin/index.js

@@ -14,7 +14,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./application-vite-config-options.interface.js"), exports);
 __exportStar(require("./create-middleware.js"), exports);
+__exportStar(require("./define-application-vite-config.js"), exports);
 __exportStar(require("./nest-handler.js"), exports);
 __exportStar(require("./plugin-config.interface.js"), exports);
 __exportStar(require("./vite-plugin-node.js"), exports);

package/dist/cjs/vite-ssr.module.js

@@ -7,8 +7,11 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ViteSsrModule = void 0;
+const nestjs_config_module_1 = require("@libs-for-dev/nestjs-config-module");
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
+const content_security_policy_config_js_1 = require("./content-security-policy/content-security-policy.config.js");
+const content_security_policy_environment_js_1 = require("./content-security-policy/content-security-policy.environment.js");
 const not_found_filter_js_1 = require("./filters/not-found.filter.js");
 const html_loader_with_vite_js_1 = require("./html-loader/html-loader-with-vite.js");
 const html_loader_interface_js_1 = require("./html-loader/html-loader.interface.js");
@@ -37,7 +40,10 @@ let ViteSsrModule = class ViteSsrModule {
         return {
             exports: [vite_application_renderer_interface_js_1.VITE_APPLICATION_RENDERER],
             global: true,
-            imports: isProduction ? [] : [vite_module_js_1.ViteModule],
+            imports: [
+                nestjs_config_module_1.ConfigsModule.forFeature([content_security_policy_config_js_1.ContentSecurityPolicyConfig], [content_security_policy_environment_js_1.ContentSecurityPolicyEnvironment]),
+                ...isProduction ? [] : [vite_module_js_1.ViteModule],
+            ],
             module: this,
             providers: [
                 { provide: vite_constants_js_1.VITE_SSR_OPTIONS, useValue: options },

package/dist/esm/content-security-policy/content-security-policy.config.d.ts

@@ -0,0 +1,7 @@
+import type { ContentSecurityPolicyInterface } from './content-security-policy.interface.js';
+import { ContentSecurityPolicyEnvironment } from './content-security-policy.environment.js';
+export declare class ContentSecurityPolicyConfig {
+    private readonly environment;
+    constructor(environment: ContentSecurityPolicyEnvironment);
+    issue(): ContentSecurityPolicyInterface;
+}

package/dist/esm/content-security-policy/content-security-policy.config.js

@@ -0,0 +1,41 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from '@nestjs/common';
+import { randomBytes } from 'node:crypto';
+import { ContentSecurityPolicyEnvironment } from './content-security-policy.environment.js';
+const NONCE_BYTES = 16;
+const HEADER_BY_MODE = {
+    enforce: 'Content-Security-Policy',
+    'report-only': 'Content-Security-Policy-Report-Only',
+};
+const buildPolicy = (nonce) => `script-src 'self' 'nonce-${nonce}'; object-src 'none'; base-uri 'self'`;
+let ContentSecurityPolicyConfig = class ContentSecurityPolicyConfig {
+    environment;
+    constructor(environment) {
+        this.environment = environment;
+    }
+    issue() {
+        const mode = this.environment.CONTENT_SECURITY_POLICY_MODE;
+        if (mode === 'off') {
+            return { headers: {}, nonce: undefined };
+        }
+        const nonce = randomBytes(NONCE_BYTES).toBase64();
+        return { headers: { [HEADER_BY_MODE[mode]]: buildPolicy(nonce) }, nonce };
+    }
+};
+ContentSecurityPolicyConfig = __decorate([
+    Injectable(),
+    __param(0, Inject(ContentSecurityPolicyEnvironment)),
+    __metadata("design:paramtypes", [ContentSecurityPolicyEnvironment])
+], ContentSecurityPolicyConfig);
+export { ContentSecurityPolicyConfig };

package/dist/esm/content-security-policy/content-security-policy.environment.d.ts

@@ -0,0 +1,5 @@
+export declare const CONTENT_SECURITY_POLICY_MODES: readonly ["enforce", "off", "report-only"];
+export type ContentSecurityPolicyMode = (typeof CONTENT_SECURITY_POLICY_MODES)[number];
+export declare class ContentSecurityPolicyEnvironment {
+    CONTENT_SECURITY_POLICY_MODE: ContentSecurityPolicyMode;
+}

package/dist/esm/content-security-policy/content-security-policy.environment.js

@@ -0,0 +1,20 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Expose } from 'class-transformer';
+import { IsIn } from 'class-validator';
+export const CONTENT_SECURITY_POLICY_MODES = ['enforce', 'off', 'report-only'];
+export class ContentSecurityPolicyEnvironment {
+    CONTENT_SECURITY_POLICY_MODE = 'enforce';
+}
+__decorate([
+    Expose(),
+    IsIn(CONTENT_SECURITY_POLICY_MODES),
+    __metadata("design:type", String)
+], ContentSecurityPolicyEnvironment.prototype, "CONTENT_SECURITY_POLICY_MODE", void 0);

package/dist/esm/content-security-policy/content-security-policy.interface.d.ts

@@ -0,0 +1,4 @@
+export interface ContentSecurityPolicyInterface {
+    readonly headers: Readonly<Record<string, string>>;
+    readonly nonce: string | undefined;
+}

package/dist/esm/content-security-policy/content-security-policy.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/content-security-policy/index.d.ts

@@ -0,0 +1,3 @@
+export * from './content-security-policy.config.js';
+export * from './content-security-policy.environment.js';
+export * from './content-security-policy.interface.js';

package/dist/esm/content-security-policy/index.js

@@ -0,0 +1,3 @@
+export * from './content-security-policy.config.js';
+export * from './content-security-policy.environment.js';
+export * from './content-security-policy.interface.js';

package/dist/esm/index.d.ts

@@ -1,3 +1,4 @@
+export * from './content-security-policy/index.js';
 export * from './filters/index.js';
 export * from './html-loader/index.js';
 export * from './renderer/index.js';

package/dist/esm/index.js

@@ -1,3 +1,4 @@
+export * from './content-security-policy/index.js';
 export * from './filters/index.js';
 export * from './html-loader/index.js';
 export * from './renderer/index.js';

package/dist/esm/renderer/html-template.d.ts

@@ -2,4 +2,4 @@ import type { SsrPageInterface } from '../ssr-entry/ssr-entry.interface.js';
 export declare const STATE_PLACEHOLDER = "<script id=\"state\"></script>";
 export declare const TEMPLATE_PLACEHOLDER = "<div id=\"app\"></div>";
 export declare const LANG_ATTRIBUTE_PATTERN: RegExp;
-export declare const fillHtmlTemplate: (html: string, page: SsrPageInterface) => string;
+export declare const fillHtmlTemplate: (html: string, page: SsrPageInterface, nonce?: string) => string;

package/dist/esm/renderer/html-template.js

@@ -3,12 +3,13 @@ export const TEMPLATE_PLACEHOLDER = '<div id="app"></div>';
 export const LANG_ATTRIBUTE_PATTERN = /<html\s+lang="[^"]*"/u;
 const toScriptLiteral = (value) => JSON.stringify(value).replaceAll('<', String.raw `\u003C`);
 const toAttributeValue = (value) => value.replaceAll('&', '&amp;').replaceAll('"', '&quot;');
-const toStateScript = (state) => {
+const toStateScript = (state, nonce) => {
     const assignments = Object.entries(state)
         .map(([key, value]) => `window[${toScriptLiteral(key)}] = ${toScriptLiteral(value)};`);
-    return `<script>${assignments.join('')}</script>`;
+    const nonceAttribute = nonce === undefined ? '' : ` nonce="${toAttributeValue(nonce)}"`;
+    return `<script id="state"${nonceAttribute}>${assignments.join('')}</script>`;
 };
-export const fillHtmlTemplate = (html, page) => html
-    .replace(STATE_PLACEHOLDER, () => toStateScript(page.state))
+export const fillHtmlTemplate = (html, page, nonce) => html
+    .replace(STATE_PLACEHOLDER, () => toStateScript(page.state, nonce))
     .replace(TEMPLATE_PLACEHOLDER, () => `<div id="app">${page.template}</div>`)
     .replace(LANG_ATTRIBUTE_PATTERN, () => `<html lang="${toAttributeValue(page.lang)}"`);

package/dist/esm/renderer/render-html-page.js

@@ -1,5 +1,8 @@
 export const renderHtmlPage = async (renderer, request, reply) => {
-    const { html, statusCode } = await renderer.renderApplication(request);
+    const { headers = {}, html, statusCode } = await renderer.renderApplication(request);
     void reply.code(statusCode).header('Content-Type', 'text/html');
+    for (const [name, value] of Object.entries(headers)) {
+        void reply.header(name, value);
+    }
     return html;
 };

package/dist/esm/renderer/vite-application-renderer.d.ts

@@ -3,10 +3,12 @@ import type { HtmlLoaderInterface } from '../html-loader/html-loader.interface.j
 import type { SsrEntryInterface } from '../ssr-entry/ssr-entry.interface.js';
 import type { ApplicationInterface, ViteApplicationRendererInterface } from '../vite-application-renderer.interface.js';
 import type { ViteSsrOptionsInterface } from '../vite-ssr-options.interface.js';
+import { ContentSecurityPolicyConfig } from '../content-security-policy/content-security-policy.config.js';
 export declare class ViteApplicationRenderer implements ViteApplicationRendererInterface {
     private readonly ssrEntry;
     private readonly htmlLoader;
     private readonly options;
-    constructor(ssrEntry: SsrEntryInterface, htmlLoader: HtmlLoaderInterface, options: Pick<ViteSsrOptionsInterface, 'buildInitialState' | 'htmlPath'>);
+    private readonly contentSecurityPolicy;
+    constructor(ssrEntry: SsrEntryInterface, htmlLoader: HtmlLoaderInterface, options: Pick<ViteSsrOptionsInterface, 'buildInitialState' | 'htmlPath'>, contentSecurityPolicy: ContentSecurityPolicyConfig);
     renderApplication(request: FastifyRequest): Promise<ApplicationInterface>;
 }

package/dist/esm/renderer/vite-application-renderer.js

@@ -11,6 +11,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Inject, Injectable } from '@nestjs/common';
+import { ContentSecurityPolicyConfig } from '../content-security-policy/content-security-policy.config.js';
 import { HTML_LOADER_INTERFACE } from '../html-loader/html-loader.interface.js';
 import { SSR_ENTRY_INTERFACE } from '../ssr-entry/ssr-entry.interface.js';
 import { VITE_SSR_OPTIONS } from '../vite.constants.js';
@@ -19,16 +20,19 @@ let ViteApplicationRenderer = class ViteApplicationRenderer {
     ssrEntry;
     htmlLoader;
     options;
-    constructor(ssrEntry, htmlLoader, options) {
+    contentSecurityPolicy;
+    constructor(ssrEntry, htmlLoader, options, contentSecurityPolicy) {
         this.ssrEntry = ssrEntry;
         this.htmlLoader = htmlLoader;
         this.options = options;
+        this.contentSecurityPolicy = contentSecurityPolicy;
     }
     async renderApplication(request) {
         const { url } = request;
         const html = await this.htmlLoader.loadHtml(this.options.htmlPath, url);
         const page = await this.ssrEntry.render(url, this.options.buildInitialState(request));
-        return { html: fillHtmlTemplate(html, page), statusCode: page.statusCode };
+        const { headers, nonce } = this.contentSecurityPolicy.issue();
+        return { headers, html: fillHtmlTemplate(html, page, nonce), statusCode: page.statusCode };
     }
 };
 ViteApplicationRenderer = __decorate([
@@ -36,6 +40,7 @@ ViteApplicationRenderer = __decorate([
     __param(0, Inject(SSR_ENTRY_INTERFACE)),
     __param(1, Inject(HTML_LOADER_INTERFACE)),
     __param(2, Inject(VITE_SSR_OPTIONS)),
-    __metadata("design:paramtypes", [Object, Object, Object])
+    __param(3, Inject(ContentSecurityPolicyConfig)),
+    __metadata("design:paramtypes", [Object, Object, Object, ContentSecurityPolicyConfig])
 ], ViteApplicationRenderer);
 export { ViteApplicationRenderer };

package/dist/esm/vite-application-renderer.interface.d.ts

@@ -1,6 +1,7 @@
 import type { HttpStatus } from '@nestjs/common';
 import type { FastifyRequest } from 'fastify';
 interface AppInterface {
+    headers?: Readonly<Record<string, string>>;
     html: string;
     statusCode: HttpStatus;
 }

package/dist/esm/vite-plugin/application-vite-config-options.interface.d.ts

@@ -0,0 +1,16 @@
+import type { BuildOptions, PluginOption } from 'vite';
+export interface ApplicationViteConfigOptionsInterface {
+    appPath: string;
+    buildPlugins?: BuildPluginsType;
+    clientHtml: string;
+    environment: ApplicationViteEnvironmentInterface;
+    plugins: PluginOption[];
+    root: string;
+}
+export interface ApplicationViteEnvironmentInterface {
+    NODE_ENV?: string;
+    PORT?: string;
+    VITE_SERVER_HMR_CLIENT_PORT?: string;
+    VITE_SERVER_HMR_PORT?: string;
+}
+export type BuildPluginsType = NonNullable<NonNullable<BuildOptions['rolldownOptions']>['plugins']>;

package/dist/esm/vite-plugin/application-vite-config-options.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/vite-plugin/define-application-vite-config.d.ts

@@ -0,0 +1,3 @@
+import type { UserConfig } from 'vite';
+import type { ApplicationViteConfigOptionsInterface } from './application-vite-config-options.interface.js';
+export declare const defineApplicationViteConfig: (options: ApplicationViteConfigOptionsInterface) => UserConfig;

package/dist/esm/vite-plugin/define-application-vite-config.js

@@ -0,0 +1,82 @@
+import path from 'node:path';
+import process from 'node:process';
+import { createLogger } from 'vite';
+import { vitePluginNode } from './vite-plugin-node.js';
+const CLIENT_ENTRY = 'assets/main';
+const DEV_SERVER_PORT = 3000;
+const HMR_PORT = 3001;
+const SOURCEMAP_WARNING = 'Sourcemap for';
+const VENDOR_GROUP = /\/node_modules\/(?<group>[\w\-@]*)/u;
+const vendorGroupName = (moduleId) => {
+    const match = VENDOR_GROUP.exec(moduleId);
+    return match?.groups ? match.groups.group : 'unknown';
+};
+const outputOf = (isServerBuild) => ({
+    assetFileNames: 'assets/[hash][extname]',
+    chunkFileNames: isServerBuild ? '[hash].mjs' : 'assets/[hash].js',
+    codeSplitting: {
+        groups: [
+            { name: 'layout', test: /layouts/u },
+            { maxSize: 200_000, minSize: 100_000, name: vendorGroupName, priority: 10, test: /node_modules/u },
+        ],
+    },
+    comments: false,
+    dir: './dist',
+    entryFileNames: (chunk) => (chunk.name === CLIENT_ENTRY ? 'assets/[hash].js' : '[name].mjs'),
+    format: 'esm',
+    hashCharacters: 'base36',
+    minifyInternalExports: false,
+});
+const buildOf = (options, isServerBuild) => ({
+    chunkSizeWarningLimit: 400,
+    emptyOutDir: false,
+    manifest: true,
+    minify: false,
+    rolldownOptions: {
+        input: { [CLIENT_ENTRY]: options.clientHtml },
+        output: outputOf(isServerBuild),
+        plugins: options.buildPlugins ?? [],
+    },
+    sourcemap: false,
+});
+const portOf = (value, fallback) => Number(value) || fallback;
+const serverOf = (environment) => ({
+    allowedHosts: true,
+    hmr: {
+        clientPort: portOf(environment.VITE_SERVER_HMR_CLIENT_PORT, HMR_PORT),
+        port: portOf(environment.VITE_SERVER_HMR_PORT, HMR_PORT),
+    },
+    host: '0.0.0.0',
+    middlewareMode: false,
+    port: portOf(environment.PORT, DEV_SERVER_PORT),
+    preTransformRequests: environment.NODE_ENV !== 'test',
+    strictPort: true,
+    watch: {
+        ignored: ['**/*.gql', 'reports/**/*'],
+        interval: 400,
+        usePolling: true,
+    },
+});
+const createApplicationLogger = () => {
+    const logger = createLogger();
+    const warnOnce = logger.warnOnce.bind(logger);
+    logger.warnOnce = (message, options) => {
+        if (!message.includes(SOURCEMAP_WARNING)) {
+            warnOnce(message, options);
+        }
+    };
+    return logger;
+};
+export const defineApplicationViteConfig = (options) => {
+    const isServerBuild = process.argv.includes('--ssr');
+    return {
+        appType: 'custom',
+        build: buildOf(options, isServerBuild),
+        customLogger: createApplicationLogger(),
+        optimizeDeps: { include: ['pino'], noDiscovery: true },
+        plugins: [...vitePluginNode({ appPath: options.appPath }), ...options.plugins],
+        resolve: { alias: { '@': path.resolve(options.root, 'src') } },
+        root: path.resolve(options.root),
+        server: serverOf(options.environment),
+    };
+};

package/dist/esm/vite-plugin/index.d.ts

@@ -1,4 +1,6 @@
+export * from './application-vite-config-options.interface.js';
 export * from './create-middleware.js';
+export * from './define-application-vite-config.js';
 export * from './nest-handler.js';
 export * from './plugin-config.interface.js';
 export * from './vite-plugin-node.js';

package/dist/esm/vite-plugin/index.js

@@ -1,4 +1,6 @@
+export * from './application-vite-config-options.interface.js';
 export * from './create-middleware.js';
+export * from './define-application-vite-config.js';
 export * from './nest-handler.js';
 export * from './plugin-config.interface.js';
 export * from './vite-plugin-node.js';

package/dist/esm/vite-ssr.module.js

@@ -4,8 +4,11 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+import { ConfigsModule } from '@libs-for-dev/nestjs-config-module';
 import { Module } from '@nestjs/common';
 import { APP_FILTER } from '@nestjs/core';
+import { ContentSecurityPolicyConfig } from './content-security-policy/content-security-policy.config.js';
+import { ContentSecurityPolicyEnvironment } from './content-security-policy/content-security-policy.environment.js';
 import { NotFoundFilter } from './filters/not-found.filter.js';
 import { HtmlLoaderWithVite } from './html-loader/html-loader-with-vite.js';
 import { HTML_LOADER_INTERFACE } from './html-loader/html-loader.interface.js';
@@ -34,7 +37,10 @@ let ViteSsrModule = class ViteSsrModule {
         return {
             exports: [VITE_APPLICATION_RENDERER],
             global: true,
-            imports: isProduction ? [] : [ViteModule],
+            imports: [
+                ConfigsModule.forFeature([ContentSecurityPolicyConfig], [ContentSecurityPolicyEnvironment]),
+                ...isProduction ? [] : [ViteModule],
+            ],
             module: this,
             providers: [
                 { provide: VITE_SSR_OPTIONS, useValue: options },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@application-kit/nestjs-vite",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Мост Vite ↔ NestJS для SSR: dev-обвязка, загрузка HTML и ssr-entry",
   "keywords": [
     "nestjs",
@@ -66,6 +66,7 @@
     "test:unit": "vitest run"
   },
   "devDependencies": {
+    "@libs-for-dev/nestjs-config-module": "3.0.0",
     "@nestjs/common": "^11.2.1",
     "@nestjs/core": "^11.2.1",
     "@nestjs/platform-fastify": "^11.2.1",
@@ -73,6 +74,8 @@
     "@stryker-mutator/core": "^10.0.0",
     "@stryker-mutator/vitest-runner": "^10.0.0",
     "@types/node": "^26.2.0",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.15.1",
     "fastify": "^5.12.1",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2",
@@ -81,9 +84,12 @@
     "vitest": "^4.1.11"
   },
   "peerDependencies": {
+    "@libs-for-dev/nestjs-config-module": "^3.0.0",
     "@nestjs/common": "^11.0.0",
     "@nestjs/core": "^11.0.0",
     "@nestjs/platform-fastify": "^11.0.0",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.15.1",
     "fastify": "^5.0.0",
     "vite": "^8.0.0"
   },