@application-kit/nestjs-vite 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @application-kit/nestjs-vite
 
+## 0.6.0
+
+### Minor Changes
+
+- e9411eb: Спеки-гейты продукта переехали в пакеты: спека теперь — вызов помощника с параметрами продукта, а нарушение приходит ошибкой со списком.
+
+  `ui/testing`: `assertTokensDeclared`. `kafka/testing` (новый вход): `assertConsumerTopicsConsistent`. `authorization/testing` (новый вход): `assertAbilityRegistryConsistent`. `nestjs-vite/static-assets-gate` (новый вход, отдельно от `/testing`, чтобы спеки с фейком рендерера не грузили `vite`): `assertStaticAssetsLayout`. `lint-config` разрешает импорт нового входа `nestjs-vite/static-assets-gate`.
+
+## 0.5.0
+
+### Minor Changes
+
+- 9909a33: HTML-страницы получают `Content-Security-Policy` с новым nonce на каждый запрос, и тот же nonce стоит на теге состояния. Режим задаёт `CONTENT_SECURITY_POLICY_MODE`: `enforce` по умолчанию, `report-only` или `off` для отката. В `peerDependencies` добавлены `@libs-for-dev/nestjs-config-module`, `class-transformer` и `class-validator`. Клиенту с `zod` нужен `z.config({ jitless: true })`, иначе его проба `eval` пишет нарушение в консоль.
+
 ## 0.4.0
 
 ### Minor Changes

package/README.md

@@ -104,17 +104,35 @@ export class ClientModule {}
 
 | Константа | В шаблоне | Чем заменяется |
 |---|---|---|
-| `STATE_PLACEHOLDER` | `<script id="state"></script>` | `<script>` с присваиваниями `window[ключ] = значение` |
+| `STATE_PLACEHOLDER` | `<script id="state"></script>` | `<script id="state" nonce="…">` с присваиваниями `window[ключ] = значение` |
 | `TEMPLATE_PLACEHOLDER` | `<div id="app"></div>` | тот же `div` с разметкой `template` внутри |
 | `LANG_ATTRIBUTE_PATTERN` | `<html lang="…">` с любым значением | `lang` страницы |
 
 Значения состояния уходят JS-литералами строки с экранированным `<`: `</script>` в данных не закроет тег, какой бы
 сериализатор ни выбрало приложение. Клиентский энтри читает их до гидрации.
 
-`renderHtmlPage(renderer, request, reply)` — один путь HTML-ответа: ставит статус рендера и `Content-Type: text/html`
-и возвращает HTML. Контроллер с `@Res({ passthrough: true })` возвращает его, фильтр — отправляет. Декоратор
+`renderHtmlPage(renderer, request, reply)` — один путь HTML-ответа: ставит статус рендера, `Content-Type: text/html` и
+заголовки рендера и возвращает HTML. Контроллер с `@Res({ passthrough: true })` возвращает его, фильтр — отправляет. Декоратор
 `@Header('Content-Type')` на маршруте страницы не нужен.
 
+### Content Security Policy
+
+Рендерер выпускает на каждый ответ новый nonce и ставит его в заголовок и на тег состояния:
+`script-src 'self' 'nonce-…'; object-src 'none'; base-uri 'self'`. Заголовок ставит пакет, потому что значение меняется
+с каждым запросом, а прокси перед приложением этого не умеют. Страницу с nonce нельзя кешировать на прокси или CDN: все
+посетители получили бы один nonce.
+
+Режим — переменная `CONTENT_SECURITY_POLICY_MODE`, проверяется при старте:
+
+| Значение | Заголовок |
+|---|---|
+| `enforce` (по умолчанию) | `Content-Security-Policy` |
+| `report-only` | `Content-Security-Policy-Report-Only` |
+| `off` | нет, и nonce на тег не ставится |
+
+`eval` и `new Function` политика запрещает, и браузер пишет нарушение в консоль, даже если код перехватывает ошибку. Так
+поступает проба `allowsEval` в `zod`: клиенту с `zod` нужен `z.config({ jitless: true })` до первой схемы.
+
 ### Фильтры
 
 - `NotFoundFilter` — регистрирует `ViteSsrModule`: `NotFoundException` отвечает отрендеренной страницей
@@ -130,6 +148,10 @@ export class ClientModule {}
 `VITE_APPLICATION_RENDERER` для спек, предмет которых не SSR (контроллеры зависят от рендерера, а настоящий поднимает
 Vite). Фейк отвечает `<div id="app">{url}</div>` со статусом 200; сам он — `fakeApplicationRenderer`. Vite вход не тянет.
 
+Вход `@application-kit/nestjs-vite/static-assets-gate` — `assertStaticAssetsLayout`: гейт периметра прод-образа. Читает
+`vite.config` продукта обеими сборками и падает со списком расхождений, если клиентская сборка вышла за подкаталог
+`assets` под хешем, серверные входы переименованы, появились карты исходников или нехешируемая статика в `publicDir`.
+
 ## Формат
 
 ESM и CJS. Это две копии с разными классами и токенами — в одном процессе пакет

package/dist/cjs/content-security-policy/content-security-policy.config.d.ts

@@ -0,0 +1,7 @@
+import type { ContentSecurityPolicyInterface } from './content-security-policy.interface.js';
+import { ContentSecurityPolicyEnvironment } from './content-security-policy.environment.js';
+export declare class ContentSecurityPolicyConfig {
+    private readonly environment;
+    constructor(environment: ContentSecurityPolicyEnvironment);
+    issue(): ContentSecurityPolicyInterface;
+}

package/dist/cjs/content-security-policy/content-security-policy.config.js

@@ -0,0 +1,44 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContentSecurityPolicyConfig = void 0;
+const common_1 = require("@nestjs/common");
+const node_crypto_1 = require("node:crypto");
+const content_security_policy_environment_js_1 = require("./content-security-policy.environment.js");
+const NONCE_BYTES = 16;
+const HEADER_BY_MODE = {
+    enforce: 'Content-Security-Policy',
+    'report-only': 'Content-Security-Policy-Report-Only',
+};
+const buildPolicy = (nonce) => `script-src 'self' 'nonce-${nonce}'; object-src 'none'; base-uri 'self'`;
+let ContentSecurityPolicyConfig = class ContentSecurityPolicyConfig {
+    environment;
+    constructor(environment) {
+        this.environment = environment;
+    }
+    issue() {
+        const mode = this.environment.CONTENT_SECURITY_POLICY_MODE;
+        if (mode === 'off') {
+            return { headers: {}, nonce: undefined };
+        }
+        const nonce = (0, node_crypto_1.randomBytes)(NONCE_BYTES).toBase64();
+        return { headers: { [HEADER_BY_MODE[mode]]: buildPolicy(nonce) }, nonce };
+    }
+};
+exports.ContentSecurityPolicyConfig = ContentSecurityPolicyConfig;
+exports.ContentSecurityPolicyConfig = ContentSecurityPolicyConfig = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(content_security_policy_environment_js_1.ContentSecurityPolicyEnvironment)),
+    __metadata("design:paramtypes", [content_security_policy_environment_js_1.ContentSecurityPolicyEnvironment])
+], ContentSecurityPolicyConfig);

package/dist/cjs/content-security-policy/content-security-policy.environment.d.ts

@@ -0,0 +1,5 @@
+export declare const CONTENT_SECURITY_POLICY_MODES: readonly ["enforce", "off", "report-only"];
+export type ContentSecurityPolicyMode = (typeof CONTENT_SECURITY_POLICY_MODES)[number];
+export declare class ContentSecurityPolicyEnvironment {
+    CONTENT_SECURITY_POLICY_MODE: ContentSecurityPolicyMode;
+}

package/dist/cjs/content-security-policy/content-security-policy.environment.js

@@ -0,0 +1,24 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContentSecurityPolicyEnvironment = exports.CONTENT_SECURITY_POLICY_MODES = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+exports.CONTENT_SECURITY_POLICY_MODES = ['enforce', 'off', 'report-only'];
+class ContentSecurityPolicyEnvironment {
+    CONTENT_SECURITY_POLICY_MODE = 'enforce';
+}
+exports.ContentSecurityPolicyEnvironment = ContentSecurityPolicyEnvironment;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsIn)(exports.CONTENT_SECURITY_POLICY_MODES),
+    __metadata("design:type", String)
+], ContentSecurityPolicyEnvironment.prototype, "CONTENT_SECURITY_POLICY_MODE", void 0);

package/dist/cjs/content-security-policy/content-security-policy.interface.d.ts

@@ -0,0 +1,4 @@
+export interface ContentSecurityPolicyInterface {
+    readonly headers: Readonly<Record<string, string>>;
+    readonly nonce: string | undefined;
+}

package/dist/cjs/content-security-policy/content-security-policy.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/content-security-policy/index.d.ts

@@ -0,0 +1,3 @@
+export * from './content-security-policy.config.js';
+export * from './content-security-policy.environment.js';
+export * from './content-security-policy.interface.js';

package/dist/cjs/content-security-policy/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./content-security-policy.config.js"), exports);
+__exportStar(require("./content-security-policy.environment.js"), exports);
+__exportStar(require("./content-security-policy.interface.js"), exports);

package/dist/cjs/index.d.ts

@@ -1,3 +1,4 @@
+export * from './content-security-policy/index.js';
 export * from './filters/index.js';
 export * from './html-loader/index.js';
 export * from './renderer/index.js';

package/dist/cjs/index.js

@@ -14,6 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./content-security-policy/index.js"), exports);
 __exportStar(require("./filters/index.js"), exports);
 __exportStar(require("./html-loader/index.js"), exports);
 __exportStar(require("./renderer/index.js"), exports);

package/dist/cjs/renderer/html-template.d.ts

@@ -2,4 +2,4 @@ import type { SsrPageInterface } from '../ssr-entry/ssr-entry.interface.js';
 export declare const STATE_PLACEHOLDER = "<script id=\"state\"></script>";
 export declare const TEMPLATE_PLACEHOLDER = "<div id=\"app\"></div>";
 export declare const LANG_ATTRIBUTE_PATTERN: RegExp;
-export declare const fillHtmlTemplate: (html: string, page: SsrPageInterface) => string;
+export declare const fillHtmlTemplate: (html: string, page: SsrPageInterface, nonce?: string) => string;

package/dist/cjs/renderer/html-template.js

@@ -6,13 +6,14 @@ exports.TEMPLATE_PLACEHOLDER = '<div id="app"></div>';
 exports.LANG_ATTRIBUTE_PATTERN = /<html\s+lang="[^"]*"/u;
 const toScriptLiteral = (value) => JSON.stringify(value).replaceAll('<', String.raw `\u003C`);
 const toAttributeValue = (value) => value.replaceAll('&', '&amp;').replaceAll('"', '&quot;');
-const toStateScript = (state) => {
+const toStateScript = (state, nonce) => {
     const assignments = Object.entries(state)
         .map(([key, value]) => `window[${toScriptLiteral(key)}] = ${toScriptLiteral(value)};`);
-    return `<script>${assignments.join('')}</script>`;
+    const nonceAttribute = nonce === undefined ? '' : ` nonce="${toAttributeValue(nonce)}"`;
+    return `<script id="state"${nonceAttribute}>${assignments.join('')}</script>`;
 };
-const fillHtmlTemplate = (html, page) => html
-    .replace(exports.STATE_PLACEHOLDER, () => toStateScript(page.state))
+const fillHtmlTemplate = (html, page, nonce) => html
+    .replace(exports.STATE_PLACEHOLDER, () => toStateScript(page.state, nonce))
     .replace(exports.TEMPLATE_PLACEHOLDER, () => `<div id="app">${page.template}</div>`)
     .replace(exports.LANG_ATTRIBUTE_PATTERN, () => `<html lang="${toAttributeValue(page.lang)}"`);
 exports.fillHtmlTemplate = fillHtmlTemplate;

package/dist/cjs/renderer/render-html-page.js

@@ -2,8 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderHtmlPage = void 0;
 const renderHtmlPage = async (renderer, request, reply) => {
-    const { html, statusCode } = await renderer.renderApplication(request);
+    const { headers = {}, html, statusCode } = await renderer.renderApplication(request);
     void reply.code(statusCode).header('Content-Type', 'text/html');
+    for (const [name, value] of Object.entries(headers)) {
+        void reply.header(name, value);
+    }
     return html;
 };
 exports.renderHtmlPage = renderHtmlPage;

package/dist/cjs/renderer/vite-application-renderer.d.ts

@@ -3,10 +3,12 @@ import type { HtmlLoaderInterface } from '../html-loader/html-loader.interface.j
 import type { SsrEntryInterface } from '../ssr-entry/ssr-entry.interface.js';
 import type { ApplicationInterface, ViteApplicationRendererInterface } from '../vite-application-renderer.interface.js';
 import type { ViteSsrOptionsInterface } from '../vite-ssr-options.interface.js';
+import { ContentSecurityPolicyConfig } from '../content-security-policy/content-security-policy.config.js';
 export declare class ViteApplicationRenderer implements ViteApplicationRendererInterface {
     private readonly ssrEntry;
     private readonly htmlLoader;
     private readonly options;
-    constructor(ssrEntry: SsrEntryInterface, htmlLoader: HtmlLoaderInterface, options: Pick<ViteSsrOptionsInterface, 'buildInitialState' | 'htmlPath'>);
+    private readonly contentSecurityPolicy;
+    constructor(ssrEntry: SsrEntryInterface, htmlLoader: HtmlLoaderInterface, options: Pick<ViteSsrOptionsInterface, 'buildInitialState' | 'htmlPath'>, contentSecurityPolicy: ContentSecurityPolicyConfig);
     renderApplication(request: FastifyRequest): Promise<ApplicationInterface>;
 }

package/dist/cjs/renderer/vite-application-renderer.js

@@ -14,6 +14,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ViteApplicationRenderer = void 0;
 const common_1 = require("@nestjs/common");
+const content_security_policy_config_js_1 = require("../content-security-policy/content-security-policy.config.js");
 const html_loader_interface_js_1 = require("../html-loader/html-loader.interface.js");
 const ssr_entry_interface_js_1 = require("../ssr-entry/ssr-entry.interface.js");
 const vite_constants_js_1 = require("../vite.constants.js");
@@ -22,16 +23,19 @@ let ViteApplicationRenderer = class ViteApplicationRenderer {
     ssrEntry;
     htmlLoader;
     options;
-    constructor(ssrEntry, htmlLoader, options) {
+    contentSecurityPolicy;
+    constructor(ssrEntry, htmlLoader, options, contentSecurityPolicy) {
         this.ssrEntry = ssrEntry;
         this.htmlLoader = htmlLoader;
         this.options = options;
+        this.contentSecurityPolicy = contentSecurityPolicy;
     }
     async renderApplication(request) {
         const { url } = request;
         const html = await this.htmlLoader.loadHtml(this.options.htmlPath, url);
         const page = await this.ssrEntry.render(url, this.options.buildInitialState(request));
-        return { html: (0, html_template_js_1.fillHtmlTemplate)(html, page), statusCode: page.statusCode };
+        const { headers, nonce } = this.contentSecurityPolicy.issue();
+        return { headers, html: (0, html_template_js_1.fillHtmlTemplate)(html, page, nonce), statusCode: page.statusCode };
     }
 };
 exports.ViteApplicationRenderer = ViteApplicationRenderer;
@@ -40,5 +44,6 @@ exports.ViteApplicationRenderer = ViteApplicationRenderer = __decorate([
     __param(0, (0, common_1.Inject)(ssr_entry_interface_js_1.SSR_ENTRY_INTERFACE)),
     __param(1, (0, common_1.Inject)(html_loader_interface_js_1.HTML_LOADER_INTERFACE)),
     __param(2, (0, common_1.Inject)(vite_constants_js_1.VITE_SSR_OPTIONS)),
-    __metadata("design:paramtypes", [Object, Object, Object])
+    __param(3, (0, common_1.Inject)(content_security_policy_config_js_1.ContentSecurityPolicyConfig)),
+    __metadata("design:paramtypes", [Object, Object, Object, content_security_policy_config_js_1.ContentSecurityPolicyConfig])
 ], ViteApplicationRenderer);

package/dist/cjs/static-assets-gate/assert-static-assets-layout.d.ts

@@ -0,0 +1,10 @@
+export interface StaticAssetsLayoutOptionsInterface {
+    readonly clientModuleFile: string;
+    readonly iconFile: string;
+    readonly indexHtmlFile: string;
+    readonly rootDirectory: string;
+    readonly serverEntries: readonly string[];
+    readonly tsconfigBuildFile: string;
+    readonly viteConfigFile: string;
+}
+export declare const assertStaticAssetsLayout: (options: StaticAssetsLayoutOptionsInterface) => Promise<void>;

package/dist/cjs/static-assets-gate/assert-static-assets-layout.js

@@ -0,0 +1,105 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertStaticAssetsLayout = void 0;
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const node_util_1 = require("node:util");
+const vite_1 = require("vite");
+const ASSETS_DIRECTORY = 'assets';
+const CLIENT_ENTRY = `${ASSETS_DIRECTORY}/main`;
+const CHUNK_NAME = 'chunk';
+const isPresent = async (file) => {
+    try {
+        await (0, promises_1.access)(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+const loadBuildConfig = async ({ rootDirectory, viteConfigFile }, isSsrBuild) => {
+    const { argv } = process;
+    process.argv = isSsrBuild ? [...argv, '--ssr'] : argv;
+    try {
+        const loaded = await (0, vite_1.loadConfigFromFile)({ command: 'build', isSsrBuild, mode: 'production' }, node_path_1.default.join(rootDirectory, viteConfigFile), rootDirectory, 'silent');
+        if (loaded === null) {
+            throw new Error(`${viteConfigFile} не найден`);
+        }
+        return loaded.config;
+    }
+    finally {
+        process.argv = argv;
+    }
+};
+const buildOf = (config) => config.build ?? {};
+const outputOf = (config, viteConfigFile) => {
+    const output = buildOf(config).rolldownOptions?.output;
+    if (output === undefined || Array.isArray(output)) {
+        throw new TypeError(`${viteConfigFile}: ожидается один набор output`);
+    }
+    return output;
+};
+const fileNameOf = (pattern, name) => (typeof pattern === 'function'
+    ? pattern({ exports: [], facadeModuleId: null, isDynamicEntry: false, isEntry: true, moduleIds: [], name })
+    : pattern);
+const violationIf = (isViolated, message) => (isViolated ? [message] : []);
+const mismatch = (what, actual, expected) => ((0, node_util_1.isDeepStrictEqual)(actual, expected)
+    ? []
+    : [`${what}: ${JSON.stringify(actual)}, ожидается ${JSON.stringify(expected)}`]);
+const clientOutputViolations = (output) => [
+    ...mismatch('клиентские ассеты', output.assetFileNames, `${ASSETS_DIRECTORY}/[hash][extname]`),
+    ...mismatch('клиентские чанки', fileNameOf(output.chunkFileNames, CHUNK_NAME), `${ASSETS_DIRECTORY}/[hash].js`),
+    ...mismatch('клиентский вход', fileNameOf(output.entryFileNames, CLIENT_ENTRY), `${ASSETS_DIRECTORY}/[hash].js`),
+];
+const serverOutputViolations = (output, serverEntries) => [
+    ...mismatch('серверные чанки', fileNameOf(output.chunkFileNames, CHUNK_NAME), '[hash].mjs'),
+    ...serverEntries.flatMap((entry) => mismatch(`серверный вход ${entry}`, fileNameOf(output.entryFileNames, entry), '[name].mjs')),
+];
+const listPublicAssets = async (rootDirectory) => {
+    try {
+        return await (0, promises_1.readdir)(node_path_1.default.join(rootDirectory, 'public', ASSETS_DIRECTORY));
+    }
+    catch {
+        return [];
+    }
+};
+const placementViolations = async ({ iconFile, indexHtmlFile, rootDirectory }, input) => {
+    const [html, iconPresent, publicAssets] = await Promise.all([
+        (0, promises_1.readFile)(node_path_1.default.join(rootDirectory, indexHtmlFile), 'utf8'),
+        isPresent(node_path_1.default.join(rootDirectory, iconFile)),
+        listPublicAssets(rootDirectory),
+    ]);
+    const iconHref = `href="./${ASSETS_DIRECTORY}/${node_path_1.default.basename(iconFile)}"`;
+    return [
+        ...mismatch('клиентский вход сборки', input, { [CLIENT_ENTRY]: node_path_1.default.join(rootDirectory, indexHtmlFile) }),
+        ...violationIf(!html.includes(iconHref), `${indexHtmlFile} не содержит ${iconHref}`),
+        ...violationIf(!iconPresent, `нет иконки ${iconFile}`),
+        ...publicAssets.map((file) => `нехешируемая статика под вечным кешем: public/${ASSETS_DIRECTORY}/${file}`),
+    ];
+};
+const assertStaticAssetsLayout = async (options) => {
+    const { clientModuleFile, rootDirectory, serverEntries, tsconfigBuildFile, viteConfigFile } = options;
+    const clientConfig = await loadBuildConfig(options, false);
+    const serverConfig = await loadBuildConfig(options, true);
+    const [clientModule, tsconfig, placement] = await Promise.all([
+        (0, promises_1.readFile)(node_path_1.default.join(rootDirectory, clientModuleFile), 'utf8'),
+        (0, promises_1.readFile)(node_path_1.default.join(rootDirectory, tsconfigBuildFile), 'utf8'),
+        placementViolations(options, buildOf(clientConfig).rolldownOptions?.input),
+    ]);
+    const violations = [
+        ...violationIf(clientModule.includes('useStaticAssets'), `${clientModuleFile} раздаёт статику приложением`),
+        ...clientOutputViolations(outputOf(clientConfig, viteConfigFile)),
+        ...serverOutputViolations(outputOf(serverConfig, viteConfigFile), serverEntries),
+        ...placement,
+        ...mismatch('карта клиентской сборки', buildOf(clientConfig).sourcemap, false),
+        ...mismatch('карта серверной сборки', buildOf(serverConfig).sourcemap, false),
+        ...violationIf(!tsconfig.includes('"sourceMap": false'), `${tsconfigBuildFile}: нужен "sourceMap": false`),
+    ];
+    if (violations.length > 0) {
+        throw new Error(`Гейт статики прод-сборки:\n${violations.join('\n')}`);
+    }
+};
+exports.assertStaticAssetsLayout = assertStaticAssetsLayout;

package/dist/cjs/static-assets-gate/index.d.ts

@@ -0,0 +1 @@
+export * from './assert-static-assets-layout.js';

package/dist/cjs/static-assets-gate/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./assert-static-assets-layout.js"), exports);

package/dist/cjs/vite-application-renderer.interface.d.ts

@@ -1,6 +1,7 @@
 import type { HttpStatus } from '@nestjs/common';
 import type { FastifyRequest } from 'fastify';
 interface AppInterface {
+    headers?: Readonly<Record<string, string>>;
     html: string;
     statusCode: HttpStatus;
 }

package/dist/cjs/vite-ssr.module.js

@@ -7,8 +7,11 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ViteSsrModule = void 0;
+const nestjs_config_module_1 = require("@libs-for-dev/nestjs-config-module");
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
+const content_security_policy_config_js_1 = require("./content-security-policy/content-security-policy.config.js");
+const content_security_policy_environment_js_1 = require("./content-security-policy/content-security-policy.environment.js");
 const not_found_filter_js_1 = require("./filters/not-found.filter.js");
 const html_loader_with_vite_js_1 = require("./html-loader/html-loader-with-vite.js");
 const html_loader_interface_js_1 = require("./html-loader/html-loader.interface.js");
@@ -37,7 +40,10 @@ let ViteSsrModule = class ViteSsrModule {
         return {
             exports: [vite_application_renderer_interface_js_1.VITE_APPLICATION_RENDERER],
             global: true,
-            imports: isProduction ? [] : [vite_module_js_1.ViteModule],
+            imports: [
+                nestjs_config_module_1.ConfigsModule.forFeature([content_security_policy_config_js_1.ContentSecurityPolicyConfig], [content_security_policy_environment_js_1.ContentSecurityPolicyEnvironment]),
+                ...isProduction ? [] : [vite_module_js_1.ViteModule],
+            ],
             module: this,
             providers: [
                 { provide: vite_constants_js_1.VITE_SSR_OPTIONS, useValue: options },

package/dist/esm/content-security-policy/content-security-policy.config.d.ts

@@ -0,0 +1,7 @@
+import type { ContentSecurityPolicyInterface } from './content-security-policy.interface.js';
+import { ContentSecurityPolicyEnvironment } from './content-security-policy.environment.js';
+export declare class ContentSecurityPolicyConfig {
+    private readonly environment;
+    constructor(environment: ContentSecurityPolicyEnvironment);
+    issue(): ContentSecurityPolicyInterface;
+}

package/dist/esm/content-security-policy/content-security-policy.config.js

@@ -0,0 +1,41 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from '@nestjs/common';
+import { randomBytes } from 'node:crypto';
+import { ContentSecurityPolicyEnvironment } from './content-security-policy.environment.js';
+const NONCE_BYTES = 16;
+const HEADER_BY_MODE = {
+    enforce: 'Content-Security-Policy',
+    'report-only': 'Content-Security-Policy-Report-Only',
+};
+const buildPolicy = (nonce) => `script-src 'self' 'nonce-${nonce}'; object-src 'none'; base-uri 'self'`;
+let ContentSecurityPolicyConfig = class ContentSecurityPolicyConfig {
+    environment;
+    constructor(environment) {
+        this.environment = environment;
+    }
+    issue() {
+        const mode = this.environment.CONTENT_SECURITY_POLICY_MODE;
+        if (mode === 'off') {
+            return { headers: {}, nonce: undefined };
+        }
+        const nonce = randomBytes(NONCE_BYTES).toBase64();
+        return { headers: { [HEADER_BY_MODE[mode]]: buildPolicy(nonce) }, nonce };
+    }
+};
+ContentSecurityPolicyConfig = __decorate([
+    Injectable(),
+    __param(0, Inject(ContentSecurityPolicyEnvironment)),
+    __metadata("design:paramtypes", [ContentSecurityPolicyEnvironment])
+], ContentSecurityPolicyConfig);
+export { ContentSecurityPolicyConfig };

package/dist/esm/content-security-policy/content-security-policy.environment.d.ts

@@ -0,0 +1,5 @@
+export declare const CONTENT_SECURITY_POLICY_MODES: readonly ["enforce", "off", "report-only"];
+export type ContentSecurityPolicyMode = (typeof CONTENT_SECURITY_POLICY_MODES)[number];
+export declare class ContentSecurityPolicyEnvironment {
+    CONTENT_SECURITY_POLICY_MODE: ContentSecurityPolicyMode;
+}

package/dist/esm/content-security-policy/content-security-policy.environment.js

@@ -0,0 +1,20 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Expose } from 'class-transformer';
+import { IsIn } from 'class-validator';
+export const CONTENT_SECURITY_POLICY_MODES = ['enforce', 'off', 'report-only'];
+export class ContentSecurityPolicyEnvironment {
+    CONTENT_SECURITY_POLICY_MODE = 'enforce';
+}
+__decorate([
+    Expose(),
+    IsIn(CONTENT_SECURITY_POLICY_MODES),
+    __metadata("design:type", String)
+], ContentSecurityPolicyEnvironment.prototype, "CONTENT_SECURITY_POLICY_MODE", void 0);

package/dist/esm/content-security-policy/content-security-policy.interface.d.ts

@@ -0,0 +1,4 @@
+export interface ContentSecurityPolicyInterface {
+    readonly headers: Readonly<Record<string, string>>;
+    readonly nonce: string | undefined;
+}

package/dist/esm/content-security-policy/content-security-policy.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/content-security-policy/index.d.ts

@@ -0,0 +1,3 @@
+export * from './content-security-policy.config.js';
+export * from './content-security-policy.environment.js';
+export * from './content-security-policy.interface.js';

package/dist/esm/content-security-policy/index.js

@@ -0,0 +1,3 @@
+export * from './content-security-policy.config.js';
+export * from './content-security-policy.environment.js';
+export * from './content-security-policy.interface.js';

package/dist/esm/index.d.ts

@@ -1,3 +1,4 @@
+export * from './content-security-policy/index.js';
 export * from './filters/index.js';
 export * from './html-loader/index.js';
 export * from './renderer/index.js';

package/dist/esm/index.js

@@ -1,3 +1,4 @@
+export * from './content-security-policy/index.js';
 export * from './filters/index.js';
 export * from './html-loader/index.js';
 export * from './renderer/index.js';

package/dist/esm/renderer/html-template.d.ts

@@ -2,4 +2,4 @@ import type { SsrPageInterface } from '../ssr-entry/ssr-entry.interface.js';
 export declare const STATE_PLACEHOLDER = "<script id=\"state\"></script>";
 export declare const TEMPLATE_PLACEHOLDER = "<div id=\"app\"></div>";
 export declare const LANG_ATTRIBUTE_PATTERN: RegExp;
-export declare const fillHtmlTemplate: (html: string, page: SsrPageInterface) => string;
+export declare const fillHtmlTemplate: (html: string, page: SsrPageInterface, nonce?: string) => string;

package/dist/esm/renderer/html-template.js

@@ -3,12 +3,13 @@ export const TEMPLATE_PLACEHOLDER = '<div id="app"></div>';
 export const LANG_ATTRIBUTE_PATTERN = /<html\s+lang="[^"]*"/u;
 const toScriptLiteral = (value) => JSON.stringify(value).replaceAll('<', String.raw `\u003C`);
 const toAttributeValue = (value) => value.replaceAll('&', '&amp;').replaceAll('"', '&quot;');
-const toStateScript = (state) => {
+const toStateScript = (state, nonce) => {
     const assignments = Object.entries(state)
         .map(([key, value]) => `window[${toScriptLiteral(key)}] = ${toScriptLiteral(value)};`);
-    return `<script>${assignments.join('')}</script>`;
+    const nonceAttribute = nonce === undefined ? '' : ` nonce="${toAttributeValue(nonce)}"`;
+    return `<script id="state"${nonceAttribute}>${assignments.join('')}</script>`;
 };
-export const fillHtmlTemplate = (html, page) => html
-    .replace(STATE_PLACEHOLDER, () => toStateScript(page.state))
+export const fillHtmlTemplate = (html, page, nonce) => html
+    .replace(STATE_PLACEHOLDER, () => toStateScript(page.state, nonce))
     .replace(TEMPLATE_PLACEHOLDER, () => `<div id="app">${page.template}</div>`)
     .replace(LANG_ATTRIBUTE_PATTERN, () => `<html lang="${toAttributeValue(page.lang)}"`);

package/dist/esm/renderer/render-html-page.js

@@ -1,5 +1,8 @@
 export const renderHtmlPage = async (renderer, request, reply) => {
-    const { html, statusCode } = await renderer.renderApplication(request);
+    const { headers = {}, html, statusCode } = await renderer.renderApplication(request);
     void reply.code(statusCode).header('Content-Type', 'text/html');
+    for (const [name, value] of Object.entries(headers)) {
+        void reply.header(name, value);
+    }
     return html;
 };

package/dist/esm/renderer/vite-application-renderer.d.ts

@@ -3,10 +3,12 @@ import type { HtmlLoaderInterface } from '../html-loader/html-loader.interface.j
 import type { SsrEntryInterface } from '../ssr-entry/ssr-entry.interface.js';
 import type { ApplicationInterface, ViteApplicationRendererInterface } from '../vite-application-renderer.interface.js';
 import type { ViteSsrOptionsInterface } from '../vite-ssr-options.interface.js';
+import { ContentSecurityPolicyConfig } from '../content-security-policy/content-security-policy.config.js';
 export declare class ViteApplicationRenderer implements ViteApplicationRendererInterface {
     private readonly ssrEntry;
     private readonly htmlLoader;
     private readonly options;
-    constructor(ssrEntry: SsrEntryInterface, htmlLoader: HtmlLoaderInterface, options: Pick<ViteSsrOptionsInterface, 'buildInitialState' | 'htmlPath'>);
+    private readonly contentSecurityPolicy;
+    constructor(ssrEntry: SsrEntryInterface, htmlLoader: HtmlLoaderInterface, options: Pick<ViteSsrOptionsInterface, 'buildInitialState' | 'htmlPath'>, contentSecurityPolicy: ContentSecurityPolicyConfig);
     renderApplication(request: FastifyRequest): Promise<ApplicationInterface>;
 }

package/dist/esm/renderer/vite-application-renderer.js

@@ -11,6 +11,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Inject, Injectable } from '@nestjs/common';
+import { ContentSecurityPolicyConfig } from '../content-security-policy/content-security-policy.config.js';
 import { HTML_LOADER_INTERFACE } from '../html-loader/html-loader.interface.js';
 import { SSR_ENTRY_INTERFACE } from '../ssr-entry/ssr-entry.interface.js';
 import { VITE_SSR_OPTIONS } from '../vite.constants.js';
@@ -19,16 +20,19 @@ let ViteApplicationRenderer = class ViteApplicationRenderer {
     ssrEntry;
     htmlLoader;
     options;
-    constructor(ssrEntry, htmlLoader, options) {
+    contentSecurityPolicy;
+    constructor(ssrEntry, htmlLoader, options, contentSecurityPolicy) {
         this.ssrEntry = ssrEntry;
         this.htmlLoader = htmlLoader;
         this.options = options;
+        this.contentSecurityPolicy = contentSecurityPolicy;
     }
     async renderApplication(request) {
         const { url } = request;
         const html = await this.htmlLoader.loadHtml(this.options.htmlPath, url);
         const page = await this.ssrEntry.render(url, this.options.buildInitialState(request));
-        return { html: fillHtmlTemplate(html, page), statusCode: page.statusCode };
+        const { headers, nonce } = this.contentSecurityPolicy.issue();
+        return { headers, html: fillHtmlTemplate(html, page, nonce), statusCode: page.statusCode };
     }
 };
 ViteApplicationRenderer = __decorate([
@@ -36,6 +40,7 @@ ViteApplicationRenderer = __decorate([
     __param(0, Inject(SSR_ENTRY_INTERFACE)),
     __param(1, Inject(HTML_LOADER_INTERFACE)),
     __param(2, Inject(VITE_SSR_OPTIONS)),
-    __metadata("design:paramtypes", [Object, Object, Object])
+    __param(3, Inject(ContentSecurityPolicyConfig)),
+    __metadata("design:paramtypes", [Object, Object, Object, ContentSecurityPolicyConfig])
 ], ViteApplicationRenderer);
 export { ViteApplicationRenderer };

package/dist/esm/static-assets-gate/assert-static-assets-layout.d.ts

@@ -0,0 +1,10 @@
+export interface StaticAssetsLayoutOptionsInterface {
+    readonly clientModuleFile: string;
+    readonly iconFile: string;
+    readonly indexHtmlFile: string;
+    readonly rootDirectory: string;
+    readonly serverEntries: readonly string[];
+    readonly tsconfigBuildFile: string;
+    readonly viteConfigFile: string;
+}
+export declare const assertStaticAssetsLayout: (options: StaticAssetsLayoutOptionsInterface) => Promise<void>;

package/dist/esm/static-assets-gate/assert-static-assets-layout.js

@@ -0,0 +1,98 @@
+import { access, readdir, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { loadConfigFromFile } from 'vite';
+const ASSETS_DIRECTORY = 'assets';
+const CLIENT_ENTRY = `${ASSETS_DIRECTORY}/main`;
+const CHUNK_NAME = 'chunk';
+const isPresent = async (file) => {
+    try {
+        await access(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+const loadBuildConfig = async ({ rootDirectory, viteConfigFile }, isSsrBuild) => {
+    const { argv } = process;
+    process.argv = isSsrBuild ? [...argv, '--ssr'] : argv;
+    try {
+        const loaded = await loadConfigFromFile({ command: 'build', isSsrBuild, mode: 'production' }, path.join(rootDirectory, viteConfigFile), rootDirectory, 'silent');
+        if (loaded === null) {
+            throw new Error(`${viteConfigFile} не найден`);
+        }
+        return loaded.config;
+    }
+    finally {
+        process.argv = argv;
+    }
+};
+const buildOf = (config) => config.build ?? {};
+const outputOf = (config, viteConfigFile) => {
+    const output = buildOf(config).rolldownOptions?.output;
+    if (output === undefined || Array.isArray(output)) {
+        throw new TypeError(`${viteConfigFile}: ожидается один набор output`);
+    }
+    return output;
+};
+const fileNameOf = (pattern, name) => (typeof pattern === 'function'
+    ? pattern({ exports: [], facadeModuleId: null, isDynamicEntry: false, isEntry: true, moduleIds: [], name })
+    : pattern);
+const violationIf = (isViolated, message) => (isViolated ? [message] : []);
+const mismatch = (what, actual, expected) => (isDeepStrictEqual(actual, expected)
+    ? []
+    : [`${what}: ${JSON.stringify(actual)}, ожидается ${JSON.stringify(expected)}`]);
+const clientOutputViolations = (output) => [
+    ...mismatch('клиентские ассеты', output.assetFileNames, `${ASSETS_DIRECTORY}/[hash][extname]`),
+    ...mismatch('клиентские чанки', fileNameOf(output.chunkFileNames, CHUNK_NAME), `${ASSETS_DIRECTORY}/[hash].js`),
+    ...mismatch('клиентский вход', fileNameOf(output.entryFileNames, CLIENT_ENTRY), `${ASSETS_DIRECTORY}/[hash].js`),
+];
+const serverOutputViolations = (output, serverEntries) => [
+    ...mismatch('серверные чанки', fileNameOf(output.chunkFileNames, CHUNK_NAME), '[hash].mjs'),
+    ...serverEntries.flatMap((entry) => mismatch(`серверный вход ${entry}`, fileNameOf(output.entryFileNames, entry), '[name].mjs')),
+];
+const listPublicAssets = async (rootDirectory) => {
+    try {
+        return await readdir(path.join(rootDirectory, 'public', ASSETS_DIRECTORY));
+    }
+    catch {
+        return [];
+    }
+};
+const placementViolations = async ({ iconFile, indexHtmlFile, rootDirectory }, input) => {
+    const [html, iconPresent, publicAssets] = await Promise.all([
+        readFile(path.join(rootDirectory, indexHtmlFile), 'utf8'),
+        isPresent(path.join(rootDirectory, iconFile)),
+        listPublicAssets(rootDirectory),
+    ]);
+    const iconHref = `href="./${ASSETS_DIRECTORY}/${path.basename(iconFile)}"`;
+    return [
+        ...mismatch('клиентский вход сборки', input, { [CLIENT_ENTRY]: path.join(rootDirectory, indexHtmlFile) }),
+        ...violationIf(!html.includes(iconHref), `${indexHtmlFile} не содержит ${iconHref}`),
+        ...violationIf(!iconPresent, `нет иконки ${iconFile}`),
+        ...publicAssets.map((file) => `нехешируемая статика под вечным кешем: public/${ASSETS_DIRECTORY}/${file}`),
+    ];
+};
+export const assertStaticAssetsLayout = async (options) => {
+    const { clientModuleFile, rootDirectory, serverEntries, tsconfigBuildFile, viteConfigFile } = options;
+    const clientConfig = await loadBuildConfig(options, false);
+    const serverConfig = await loadBuildConfig(options, true);
+    const [clientModule, tsconfig, placement] = await Promise.all([
+        readFile(path.join(rootDirectory, clientModuleFile), 'utf8'),
+        readFile(path.join(rootDirectory, tsconfigBuildFile), 'utf8'),
+        placementViolations(options, buildOf(clientConfig).rolldownOptions?.input),
+    ]);
+    const violations = [
+        ...violationIf(clientModule.includes('useStaticAssets'), `${clientModuleFile} раздаёт статику приложением`),
+        ...clientOutputViolations(outputOf(clientConfig, viteConfigFile)),
+        ...serverOutputViolations(outputOf(serverConfig, viteConfigFile), serverEntries),
+        ...placement,
+        ...mismatch('карта клиентской сборки', buildOf(clientConfig).sourcemap, false),
+        ...mismatch('карта серверной сборки', buildOf(serverConfig).sourcemap, false),
+        ...violationIf(!tsconfig.includes('"sourceMap": false'), `${tsconfigBuildFile}: нужен "sourceMap": false`),
+    ];
+    if (violations.length > 0) {
+        throw new Error(`Гейт статики прод-сборки:\n${violations.join('\n')}`);
+    }
+};

package/dist/esm/static-assets-gate/index.d.ts

@@ -0,0 +1 @@
+export * from './assert-static-assets-layout.js';

package/dist/esm/static-assets-gate/index.js

@@ -0,0 +1 @@
+export * from './assert-static-assets-layout.js';

package/dist/esm/vite-application-renderer.interface.d.ts

@@ -1,6 +1,7 @@
 import type { HttpStatus } from '@nestjs/common';
 import type { FastifyRequest } from 'fastify';
 interface AppInterface {
+    headers?: Readonly<Record<string, string>>;
     html: string;
     statusCode: HttpStatus;
 }

package/dist/esm/vite-ssr.module.js

@@ -4,8 +4,11 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+import { ConfigsModule } from '@libs-for-dev/nestjs-config-module';
 import { Module } from '@nestjs/common';
 import { APP_FILTER } from '@nestjs/core';
+import { ContentSecurityPolicyConfig } from './content-security-policy/content-security-policy.config.js';
+import { ContentSecurityPolicyEnvironment } from './content-security-policy/content-security-policy.environment.js';
 import { NotFoundFilter } from './filters/not-found.filter.js';
 import { HtmlLoaderWithVite } from './html-loader/html-loader-with-vite.js';
 import { HTML_LOADER_INTERFACE } from './html-loader/html-loader.interface.js';
@@ -34,7 +37,10 @@ let ViteSsrModule = class ViteSsrModule {
         return {
             exports: [VITE_APPLICATION_RENDERER],
             global: true,
-            imports: isProduction ? [] : [ViteModule],
+            imports: [
+                ConfigsModule.forFeature([ContentSecurityPolicyConfig], [ContentSecurityPolicyEnvironment]),
+                ...isProduction ? [] : [ViteModule],
+            ],
             module: this,
             providers: [
                 { provide: VITE_SSR_OPTIONS, useValue: options },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@application-kit/nestjs-vite",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Мост Vite ↔ NestJS для SSR: dev-обвязка, загрузка HTML и ssr-entry",
   "keywords": [
     "nestjs",
@@ -32,6 +32,16 @@
       }
     },
     "./package.json": "./package.json",
+    "./static-assets-gate": {
+      "import": {
+        "types": "./dist/esm/static-assets-gate/index.d.ts",
+        "default": "./dist/esm/static-assets-gate/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/static-assets-gate/index.d.ts",
+        "default": "./dist/cjs/static-assets-gate/index.js"
+      }
+    },
     "./testing": {
       "import": {
         "types": "./dist/esm/testing/index.d.ts",
@@ -60,12 +70,13 @@
     "dist"
   ],
   "scripts": {
-    "build": "rm -rf ./dist && node ../../scripts/barrels.mjs create ./src --entry-only=testing && tsc --project tsconfig.build.json && tsc --project tsconfig.build.cjs.json && node ../../scripts/barrels.mjs clean ./src && node ../../scripts/mark-cjs.mjs ./dist/cjs",
+    "build": "rm -rf ./dist && node ../../scripts/barrels.mjs create ./src --entry-only=static-assets-gate,testing && tsc --project tsconfig.build.json && tsc --project tsconfig.build.cjs.json && node ../../scripts/barrels.mjs clean ./src && node ../../scripts/mark-cjs.mjs ./dist/cjs",
     "lint:tsc": "tsc --noEmit --pretty --project .",
     "test:mutation": "stryker run",
     "test:unit": "vitest run"
   },
   "devDependencies": {
+    "@libs-for-dev/nestjs-config-module": "3.0.0",
     "@nestjs/common": "^11.2.1",
     "@nestjs/core": "^11.2.1",
     "@nestjs/platform-fastify": "^11.2.1",
@@ -73,6 +84,8 @@
     "@stryker-mutator/core": "^10.0.0",
     "@stryker-mutator/vitest-runner": "^10.0.0",
     "@types/node": "^26.2.0",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.15.1",
     "fastify": "^5.12.1",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2",
@@ -81,9 +94,12 @@
     "vitest": "^4.1.11"
   },
   "peerDependencies": {
+    "@libs-for-dev/nestjs-config-module": "^3.0.0",
     "@nestjs/common": "^11.0.0",
     "@nestjs/core": "^11.0.0",
     "@nestjs/platform-fastify": "^11.0.0",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.15.1",
     "fastify": "^5.0.0",
     "vite": "^8.0.0"
   },