@elliemae/pui-cli 9.0.0-next.52 → 9.0.0-next.61

package/dist/cjs/server/certs/cert.crt

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIERjCCAy6gAwIBAgIURZDLMeITZ77a7OqWfmuim11w3/0wDQYJKoZIhvcNAQEL
+BQAwgZYxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTETMBEGA1UEBwwKUGxlYXNh
+bnRvbjEMMAoGA1UECgwDSUNFMRQwEgYDVQQLDAtVSSBQbGF0Zm9ybTESMBAGA1UE
+AwwJbG9jYWxob3N0MS0wKwYJKoZIhvcNAQkBFh52aW5vdGgua2FseWFuYXN1bmRh
+cmFtQGljZS5jb20wHhcNMjQxMDMxMTg1ODI1WhcNMjUxMDMxMTg1ODI1WjCBmzEL
+MAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRMwEQYDVQQHDApQbGVhc2FudG9uMQww
+CgYDVQQKDANJQ0UxFDASBgNVBAsMC1VJIFBsYXRmb3JtMRcwFQYDVQQDDA5sb2Nh
+bGhvc3Q6ODA4MDEtMCsGCSqGSIb3DQEJARYedmlub3RoLmthbHlhbmFzdW5kYXJh
+bUBpY2UuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwfAgF1AN
+m/RnbzKzoXS7SU3JkQWTeQ1ndaZRwiD4Xkg5bvdhzWUJORVYQTWIJJrL3KxqZzGM
+gVj4UJt3AaQD73A+bQagS5EgYxLqg1v34HZvhwMfdoZfw9epQt5KCF3JQXyH+lJk
+RyklnjHVZbYE1/eF1pb0KosIWPXY+kCYTi2b0oPifyO90bVOw3QvxLDF4fgk+QqL
+7HU1EOAak4wj07dNi83xqCOqjtWzmlYokvYELFgCUMzWFEjxuWZMuGu8+28JAMX9
+oXni9K8f4SJX5eZrRrtAHt+LwsxcLQPTmHHeTxvEc/L8//jAVUTohUr+/IfC59z0
+dko7ulPQKjgsFwIDAQABo4GEMIGBMB8GA1UdIwQYMBaAFB/8xooBufI/rf2vXZBh
+sLmQARwoMAkGA1UdEwQCMAAwNAYDVR0RBC0wK4IJbG9jYWxob3N0gg5sb2NhbGhv
+c3Q6ODA4MIIObG9jYWxob3N0OjMwMDAwHQYDVR0OBBYEFLQKGRQF7uuWmv1mYPGF
+lWd8FxjbMA0GCSqGSIb3DQEBCwUAA4IBAQAVqVVBtbkQo1JI7+3oPSgL+CPQC37x
+szF+vXLeswBS6OYrqA4AgW0R3vnhB64t/+oRmUu59vi+PuC1ff4w23g2HMZ+MlY2
+smgJ8XMoxyEn4aVAPLECzBuR67uGzCxJbqtg/avb6EIWTXzBwHI95PWVcWaLav1q
+sf3Mc60LVlAFQb1Ec5MlQHgMHaGJSDE3UwPL+JOOTG1XLnqMt+WFfqG6gN6G3FkY
+dSg3HOR2m2VHaQWvA8Zb34uTUan40K+/hlpbzfgDXF8nvg1Fwivje8+7L3FOcCw0
+k3yHwccxFqhPkXXaByZzaBKIlFXtLA4LiUwVQ7JEwPsJS5U108tuAQ8V
+-----END CERTIFICATE-----

package/dist/cjs/server/certs/cert.csr

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIC4TCCAckCAQAwgZsxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTETMBEGA1UE
+BwwKUGxlYXNhbnRvbjEMMAoGA1UECgwDSUNFMRQwEgYDVQQLDAtVSSBQbGF0Zm9y
+bTEXMBUGA1UEAwwObG9jYWxob3N0OjgwODAxLTArBgkqhkiG9w0BCQEWHnZpbm90
+aC5rYWx5YW5hc3VuZGFyYW1AaWNlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAMHwIBdQDZv0Z28ys6F0u0lNyZEFk3kNZ3WmUcIg+F5IOW73Yc1l
+CTkVWEE1iCSay9ysamcxjIFY+FCbdwGkA+9wPm0GoEuRIGMS6oNb9+B2b4cDH3aG
+X8PXqULeSghdyUF8h/pSZEcpJZ4x1WW2BNf3hdaW9CqLCFj12PpAmE4tm9KD4n8j
+vdG1TsN0L8SwxeH4JPkKi+x1NRDgGpOMI9O3TYvN8agjqo7Vs5pWKJL2BCxYAlDM
+1hRI8blmTLhrvPtvCQDF/aF54vSvH+EiV+Xma0a7QB7fi8LMXC0D05hx3k8bxHPy
+/P/4wFVE6IVK/vyHwufc9HZKO7pT0Co4LBcCAwEAAaAAMA0GCSqGSIb3DQEBCwUA
+A4IBAQA/ud/JTN+FBGDyQFoGes/CAhKdj8hfZq1F/sivJXiXoC03FYd4NhAan/aY
+1BFqiYESW1aYrDN4MyXEFhxeB5aOPHaraQ7Ny5eSAiQd6GJMNs5/lpc9W6gddXA/
+rtl0BJ85YUh9NrRNKYdplJDrCUaZh5lFQcHb7eDsQyZJVBgJzjJ1YgpTh3Sz+hcS
+eK6HiPqKIvRBaCgeKzEStEaLlrrsKhCezX7MOJ56JDGO7UgAxe5nRBD6Rg1Eoq+H
+En6Q4im/SwFIFdYt0G2BW60OEmzP+sW16XfPeMTyNZrVYQ5a3r0oMYEPrPnL6FXo
+u4ogdp1aQ2AhdGnsZxbht1uTAmCO
+-----END CERTIFICATE REQUEST-----

package/dist/cjs/server/certs/cert.ext

@@ -0,0 +1,7 @@
+authorityKeyIdentifier=keyid,issuer
+basicConstraints=CA:FALSE
+subjectAltName = @alt_names
+[alt_names]
+DNS.1 = localhost
+DNS.2 = localhost:8080
+DNS.3 = localhost:3000

package/dist/cjs/server/certs/cert.key

@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFJDBWBgkqhkiG9w0BBQ0wSTAxBgkqhkiG9w0BBQwwJAQQDe26Vas7aUu8EpLs
+1tLs2wICCAAwDAYIKoZIhvcNAgkFADAUBggqhkiG9w0DBwQIXoZbQE//THYEggTI
+27d2i58EwLcpAj74FeVRYZs3bwgap2fqjeAV1I0YIpUKSXXBe6cLAlWoU2dP1Ze/
+37LZyyFhM41VODvJog4DSvR1EwRHswfcz/iUogR9IRgzoALltLSzzv/C60H/7LS+
+Ta1PD1wOtt1vRqRwgfH32OgFNvSl+Mtq6EvSSO/1egQDniyvFHoNdu7xuKhPCHzG
+SriyYj4/ul7uBGihU+dzpTwc/nAKzto6SNT/ONsvr2Gx0LAWTtAzvc45yqMJ8NBR
+O0+9AYxnmkC4dBoZyiQ5bzvxLRYB8jkGTOYBkY3LKOoOQ7F2zjhZHs/m2uFjLXXd
+Z+j4XYVUeGmB97C6jDE1tlbNPR0eea0E64FkHoQZiqgENbX0UgYQujBLpborPhgn
+BOgdftsnms8UYadN4UxB6elgKLpqqVtUepng0ypURZqv3BLTnDVxvNdjGsmTlwSc
+W/7f1ZKlNMIpLsMjxq96pyTPJ379KneBI0B+k1p6hnXKhiGI09UiiHdpkzNovA9H
+TG9HqMDaRdbMe4tQTdPpDCbRawokTmNhEp95PU5/xjveOxCexdRA2ICXlU+pS9ur
+Oz78CuRZLiI7otcAo9ezr7KAh1L484RXnoTOXdvAYJFr4i4+VY2aW1+7yzlxgnVl
+eAvLv5hI7uAradt+xzcLhLoaq1/Srr0qBvu/hfyiY5ZJUs0MYJ/fu6b3QVZsurMK
+OU1RRot29Ckl+NRTVkc+87nanTkFkiAdVTQhBWurEjhKzyiGd/wckBfLL/8Xf5KD
+vd5ZLUBK/KvofxtSYmYHPLCNPszXRMde3buzeQg4VHtdq5cF8bXzgDIZdsl/6R6I
+alfwsJvuaGlBGPpxagntfsWgFsEw+24vYwXNsOJqv9qgrcM2mfVSmzDGxytRQ6i7
+blMg7UeZLRXMVABTIkbgoLiiP795oryqC+gKX3xzHRobFiCW+k0UtUaUM/3rDOdq
+h6HSuvPy9y+eIaFVJPi3py5m75y0UbKJjhITK241CkmO/R8AHL8gofYYfscp7Amj
+Z4zIaG1qJHUvD3Jn9GNhLDUHA6zR7fT+Ckkym49UxidECxktT0B7xUUfRV0rwe7X
+4mcb+5YDlUJzrV2Nx+0xnAvxyfU2PdTveU5OGZFEK0eb8BYVre5eLRbnw63TP6Km
+OiRzhRt4/MoeTN2IieORs8G6hHnNfCS4VX91vYoAOGQz/tJt2b+aCZ+XC+viWS3/
+JY1a0yLkplBbn2n/+XAo7N6fz+Zf7xa2RduqOX0CkkST9FQwBlt7zPVhLQM9u3SR
+2Gn/B/ar5ac/gaFZ1unbV1ncyTqj3euLxWTFAohptCaxTqvjHQroZHgXok/e1OzB
+CoSVdjJ+fvmg+Fl29whZ7kN4gXkawRNOzwUNQFaplbcjc1xGWDDw/QMnvfB0RJUF
+ZaOHZhfX+BJhG2LalhoFWhpK50e884KFime/AMqCDHcm8RqH8pcjisK9QfIA1YC7
+Fxh3ewpmwkHJjR0jSKEy/AEM0kXdV1k273DoU7zLPbDtqgHEQSP40MCstCUjX4vy
+pnSeSKuu4VGWHEBzekKmJHrx8BUjGC/dMTevG3lzIKrWXOttiL/Btu21S9fGCukd
+r4eCFaUCCZOC2RMb8/iTn8x1VXqTkOQB
+-----END ENCRYPTED PRIVATE KEY-----

package/dist/cjs/server/certs/rootCA.crt

@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIIEDzCCAvegAwIBAgIUX5nLM97FoZtWQKe+Ez6zVIpf88QwDQYJKoZIhvcNAQEL
+BQAwgZYxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTETMBEGA1UEBwwKUGxlYXNh
+bnRvbjEMMAoGA1UECgwDSUNFMRQwEgYDVQQLDAtVSSBQbGF0Zm9ybTESMBAGA1UE
+AwwJbG9jYWxob3N0MS0wKwYJKoZIhvcNAQkBFh52aW5vdGgua2FseWFuYXN1bmRh
+cmFtQGljZS5jb20wHhcNMjQxMDMxMTg1NjExWhcNMjkxMDMwMTg1NjExWjCBljEL
+MAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRMwEQYDVQQHDApQbGVhc2FudG9uMQww
+CgYDVQQKDANJQ0UxFDASBgNVBAsMC1VJIFBsYXRmb3JtMRIwEAYDVQQDDAlsb2Nh
+bGhvc3QxLTArBgkqhkiG9w0BCQEWHnZpbm90aC5rYWx5YW5hc3VuZGFyYW1AaWNl
+LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAP1YQm5nQotkgTAW
+vuxRAlqLeO8peX0WHcgReIaoNXlMkoYBsiQkkX2pW1WdB1PPmQntE9bhJ2lR8Onq
+//g5tjjfIB05pptbIDd7WCnLCseVHfeCbvOhvFza0qjsKUdoS4xBCWlY9WLR7rfo
+ahv8yi9De+HuSgAmPCf3/IQm1/BvBfG5IDLU2maAruolTQUW+sDj+clQDpucKvS0
+YaJMyfOAFjUj/0FvA2XwzQ9FTQX3Mv4NLXgJzhfNKTpJjgfM5lNEkV4EJmmQPS+5
+BBZbaV1A9yabYEUsAfyYtOJc1tdCjnSCXB3cdnPOx1FBIZCM3CdJXyHnDnvZlzfY
+SSNAR/sCAwEAAaNTMFEwHQYDVR0OBBYEFB/8xooBufI/rf2vXZBhsLmQARwoMB8G
+A1UdIwQYMBaAFB/8xooBufI/rf2vXZBhsLmQARwoMA8GA1UdEwEB/wQFMAMBAf8w
+DQYJKoZIhvcNAQELBQADggEBAEJHfJTGWjrQ3toRb+dbQbWdOeqtHW5uvIZ4Mg3E
+Fb6DIz4xe0AOnWJSTk567nCQjHBYnSvjuCtNIbrREeNkkk2oCWVw5RQKwJjkOKzI
+MiHYsckf5JJKGT2ELRZdHlRWWMZxPKy6pDIQU37R7k+E9Jr8VM62W9A5gZo9WWrG
+Qje98PXE0qXmKKbYP9ZJx3Rsj12+GGJyiNc/pkeY17MX8bfRladueCNkiXbof3Xc
+GwjRWw/OS/Dj4VVgDRsh3T24xh3yHY323t4T/3StzR61ix0/ITh3JUqPGoRiKjHC
+8YDasQh3yuJfsfZTif0MeGT20bdZPgPgqmUTB2tVYe67aZM=
+-----END CERTIFICATE-----

package/dist/cjs/server/certs/rootCA.key

@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFJDBWBgkqhkiG9w0BBQ0wSTAxBgkqhkiG9w0BBQwwJAQQRf+eVHsoPx56J/99
+1cmVewICCAAwDAYIKoZIhvcNAgkFADAUBggqhkiG9w0DBwQIQyQkzwnWuQgEggTI
+7CvoMlZgiMKLQsZ1+I+ZhKdezUacrMw2vGkCx+Gwuehf/ZdH3VGUAhb8PEV9DPrU
+nAWl8E8opWl/1kjxp9OCNBTxm7Nhg2fF9SriYa0gX+B+9DYMwgu626UC4bBzs6gn
+qDVhPzbYa6WGhK3wOZoAFWw6TFfuztmPc3dZxRX6akVtCL/LA64GQvsYvvLDp+LZ
+jlaceogKyyXiyCLWrNLPQlPsw1OzmXw5FV30zZWjxdqNnB9YfVfWOOYpaxE0Z+yX
+ARrAN8Yg8yRcfAwJmxAwsmDIBJymR97dXEs2yeTYvEcxSjA0ZY5X3n10eIYayfoi
+JBPoeTqmHgkKghR2JrveZkYUIQhCgchHzrGsb+rIqKP1gaXdyaWJvItvEm5Ou7tg
+R2pNMepzlKoyntIyYhMEXJjUwisX5sqzcHa3nKQVfDjWiSViymjxGwOUAUqLhC+j
+DhIlVbf9ZHZm4+jIpJAPrlT3PsfDO9tQ718GliERVLPaHB33BJqB1C0fqM3YCmYH
+6LaRkgP8dAUKc+VN8roy17NLUxWQKCvNKLRKkLrAXlJ1RYK3EKX0J7RRhUKX35Wj
+llYq39P/nCfw56D4Kh/vHUd0Vn0eoZQAbPnriftpk405C3pQCbbkuDaTnmEJGUj3
+g8h6ctkHDnj4Ord7TeTolMtKlQpt1DbNPKFwEZpR1+E7ojt//DIwaerE6NO1itxG
+xKTMqXUqmcKgQlCmuRzjZKlMmVfQI2cuCiBkWR6O45PXj6JFNipM4qNTVZz3RsH6
+tuLB/JfHhwglP2P/OsCyB39yhfsFhLQXLo5/fUqA9yHUJdd4Nq7V9G36vtQQaUs9
+AQt34ithtWZcmrGxIu/UL6xGYrVSbUZRIlkrWTkRuMw6WGMmv+P5ptG/ZAxsATGp
+A5jSCt4wMGTJMy8s3ksImv0dr8x8NgsEAPKBpxPpktdoj5e0C/ovnsrR0/SJ4SYl
+WB2gFQv9cWwDziQB9SQ+OwvpZ7BwEuHqtsY0vYemvY4m99wSTydHEBL+hCqlbTxo
+00Rq1BNJrEAYJ0olzc2Uwyw392W9jDFjUSmIcOfYVG6sdbyOaAgTzA4fDNasLfEl
+sEOmNeQfeeaOgVXmXUZpioVeiDxsmaGZMHwwQlmLgdefBsUvh4JxdNxTZFwbttCD
+t1mbH/OaJ8eahCGXREY32qfNb2xwz4oTkwrJxT9lbC82DBSgn+IzZCm3CfjcqZ+j
+kJoXnsAiCRljHSHYE6sTxOr0b5ND8E/x3f9O9rjbR5IcNMO7S6P9q3FwHKGpgKFx
+NTPVBHrnTehkCjEr8uED+VIWkodrk1mLNQt2hGITlkqEiAD209OAl8DuaMtX49FE
+/Op90vfIn7WBxVHLO0Q82NNkHPSDS8N0bhQZFe8IZME3JfIlKn1/6SiZ+0EnYP58
+FdS4EPc3z1ajyI/Q7CEwAt3eMM+w1KA9ypaD33pcpBP3OKP04ps5jSviY2V0UwJY
+iOLvGLoY2cQ4xwAS68ljjoHtSRz76pQlKAG8zHwx+RbtIkkUvtX5lYpSa70YIM1O
+oy3TJwIxvv1ZXyUWn5qm6qLnrmyAj/1/Jknh0+TkjUfsSYLqoOzu1+E0hPGEByJ+
+eG1+pj5536megxAPm8DIZVe208oiwc+e
+-----END ENCRYPTED PRIVATE KEY-----

package/dist/cjs/server/certs/rootCA.srl

@@ -0,0 +1 @@
+4590CB31E21367BEDAECEA967E6BA29B5D70DFFD

package/dist/cjs/server/csp.js

@@ -36,20 +36,17 @@ var import_node_fs = __toESM(require("node:fs"));
 var import_node_path = __toESM(require("node:path"));
 var import_crypto = __toESM(require("crypto"));
 var import_express = __toESM(require("express"));
-var import_helmet_csp = __toESM(require("helmet-csp"));
+var import_helmet = __toESM(require("helmet"));
 const CSP_REPORT_URI = "/diagnostics/v1/csp";
 const sources = [
-  "'self'",
   "http://localhost:*",
+  "https://localhost:*",
   "ws://localhost:*",
+  "*.ice.com",
   "*.elliemae.io",
   "*.elliemae.com",
-  "*.elliservices.com",
-  "*.ellielabs.com",
-  "http://pdx-col.eum-appdynamics.com",
-  "https://pdx-col.eum-appdynamics.com/",
-  "https://www.google-analytics.com",
-  "https://www.googletagmanager.com"
+  "*.ellieservices.com",
+  "*.ellielabs.com"
 ];
 const sendFileWithCSPNonce = ({
   buildPath,
@@ -63,41 +60,55 @@ const sendFileWithCSPNonce = ({
       res.sendStatus(404);
     } else {
       res.set("Content-Type", "text/html");
+      res.set("Reporting-Endpoints", `csp-report-uri="${CSP_REPORT_URI}"`);
+      res.set(
+        "Permissions-Policy",
+        "geolocation=(), camera=(), microphone=(), interest-cohort=()"
+      );
       res.send(html.replace(nonceRegex, res.locals.cspNonce));
     }
   });
 };
 const getScriptSrc = () => {
-  const source = (req, res) => `'nonce-${res.locals.cspNonce}'`;
-  const scriptSrc = sources.concat([source]);
+  const source = (_req, res) => `'nonce-${res.locals.cspNonce}'`;
+  const scriptSrc = [source, "'strict-dynamic'"];
   return true ? scriptSrc.concat(["'unsafe-eval'"]) : scriptSrc;
 };
 const csp = (app) => {
-  app.use((req, res, next) => {
-    res.locals.cspNonce = import_crypto.default.randomBytes(16).toString("hex");
+  app.use((_req, res, next) => {
+    res.locals.cspNonce = import_crypto.default.randomBytes(32).toString("base64");
     next();
   });
   app.use(
-    (0, import_helmet_csp.default)({
-      directives: {
-        defaultSrc: ["'self'"],
-        baseUri: ["'self'"],
-        blockAllMixedContent: [],
-        connectSrc: sources,
-        fontSrc: sources.concat(["data:"]),
-        frameAncestors: sources,
-        imgSrc: sources.concat(["data:"]),
-        objectSrc: ["'none'"],
-        scriptSrc: getScriptSrc(),
-        scriptSrcAttr: ["'none'"],
-        styleSrc: sources.concat(["'unsafe-inline'"]),
-        upgradeInsecureRequests: [],
-        reportUri: CSP_REPORT_URI
+    (0, import_helmet.default)({
+      crossOriginOpenerPolicy: { policy: "same-origin-allow-popups" },
+      crossOriginResourcePolicy: false,
+      contentSecurityPolicy: {
+        useDefaults: false,
+        directives: {
+          defaultSrc: import_helmet.default.contentSecurityPolicy.dangerouslyDisableDefaultSrc,
+          baseUri: ["'self'"],
+          frameAncestors: sources,
+          objectSrc: ["'none'"],
+          scriptSrc: getScriptSrc(),
+          upgradeInsecureRequests: [],
+          reportUri: CSP_REPORT_URI,
+          reportTo: "csp-report-uri"
+        },
+        reportOnly: process.env.CSP_REPORT_ONLY !== "false"
       },
-      reportOnly: true
+      xFrameOptions: false,
+      xPermittedCrossDomainPolicies: false,
+      xDownloadOptions: false,
+      xXssProtection: false
+    })
+  );
+  app.use(
+    CSP_REPORT_URI,
+    import_express.default.json({
+      type: ["application/csp-report", "application/reports+json"]
     })
   );
-  app.use(CSP_REPORT_URI, import_express.default.json({ type: "application/csp-report" }));
   app.use(CSP_REPORT_URI, (req, res) => {
     console.log("CSP Violation: ", req.body);
     res.status(204).end();

package/dist/cjs/server/index.js

@@ -21,18 +21,23 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
   mod
 ));
+var import_node_https = __toESM(require("node:https"));
+var import_node_http = __toESM(require("node:http"));
 var import_express = __toESM(require("express"));
+var import_cert = require("./cert.js");
 var import_logger = require("./logger.js");
 var import_middlewares = require("./middlewares.js");
 var import_utils = require("./utils.js");
+var import_utils2 = require("../utils.js");
 var import_appRoutes = require("./appRoutes.js");
 var import_wsServer = require("./wsServer.js");
-(async function startServer() {
+void async function startServer() {
   const app = (0, import_express.default)();
   (0, import_middlewares.setupDefaultMiddlewares)(app);
   await (0, import_appRoutes.loadRoutes)(app);
   (0, import_middlewares.setupAdditionalMiddlewars)(app);
-  app.listen(import_utils.port, import_utils.host, () => {
+  const server = (0, import_utils2.isHttps)() ? import_node_https.default.createServer((0, import_cert.getCertOptions)(), app) : import_node_http.default.createServer(app);
+  server.listen(import_utils.port, import_utils.host, () => {
     import_logger.logger.appStarted(import_utils.port.toString(), import_utils.host || "localhost");
   }).on("error", (err) => {
     import_logger.logger.error(err);
@@ -42,4 +47,4 @@ var import_wsServer = require("./wsServer.js");
     port: import_utils.wsPort
   });
   app.locals.wsServer = wsServer;
-})();
+}();

package/dist/cjs/server/logger.js

@@ -33,6 +33,7 @@ __export(logger_exports, {
 module.exports = __toCommonJS(logger_exports);
 var import_chalk = __toESM(require("chalk"));
 var import_ip = __toESM(require("ip"));
+var import_utils = require("../utils.js");
 const divider = import_chalk.default.gray("\n-----------------------------------");
 const logger = {
   // Called whenever there's an error on the server we want to print
@@ -48,10 +49,12 @@ const logger = {
     const accessUrls = `${import_chalk.default.bold("Access URLs:")}${divider}
 `;
     const localHostUrl = `Localhost: ${import_chalk.default.magenta(
-      `http://${host}:${port}`
+      `${(0, import_utils.isHttps)() ? "https" : "http"}://${host}:${port}`
     )}
 `;
-    const lanUrl = `LAN: ${import_chalk.default.magenta(`http://${import_ip.default.address()}:${port}`)}
+    const lanUrl = `LAN: ${import_chalk.default.magenta(
+      `${(0, import_utils.isHttps)() ? "https" : "http"}://${import_ip.default.address()}:${port}`
+    )}
 `;
     const proxy = tunnelStarted ? `
     Proxy: ${import_chalk.default.magenta(tunnelStarted)}` : "";

package/dist/cjs/server/middlewares.js

@@ -61,7 +61,7 @@ const setupDefaultMiddlewares = (app) => {
 const setupAdditionalMiddlewars = (app, options = {}) => {
   const { buildPath = paths.buildPath, basePath = paths.basePath } = options;
   app.use((0, import_compression.default)());
-  app.get(basePath, (req, res) => {
+  app.get(basePath, (_req, res) => {
     (0, import_csp.sendFileWithCSPNonce)({ buildPath, res });
   });
   app.use(
@@ -75,7 +75,7 @@ const setupAdditionalMiddlewars = (app, options = {}) => {
   app.use((0, import_express_static_gzip.default)("cdn", {}));
   app.get(
     "*",
-    (req, res) => (0, import_csp.sendFileWithCSPNonce)({ buildPath, res })
+    (_req, res) => (0, import_csp.sendFileWithCSPNonce)({ buildPath, res })
   );
   return app;
 };

package/dist/cjs/server/wsServer.js

@@ -31,8 +31,11 @@ __export(wsServer_exports, {
   createWSServer: () => createWSServer
 });
 module.exports = __toCommonJS(wsServer_exports);
+var import_node_https = __toESM(require("node:https"));
 var import_node_http = __toESM(require("node:http"));
 var wsLib = __toESM(require("ws"));
+var import_cert = require("./cert.js");
+var import_utils = require("../utils.js");
 const PING_INTERVAL = 3e4;
 const DEFAULT_PORT = 5001;
 const onSocketError = (err) => {
@@ -58,9 +61,9 @@ const createWSServer = ({
   const heartbeat = () => {
     isAlive = true;
   };
-  const httpServer = import_node_http.default.createServer();
+  const server = (0, import_utils.isHttps)() ? import_node_https.default.createServer((0, import_cert.getCertOptions)()) : import_node_http.default.createServer();
   const wsServer = new wsLib.WebSocketServer({ noServer: true });
-  httpServer.on("upgrade", (req, socket, head) => {
+  server.on("upgrade", (req, socket, head) => {
     socket.on("error", onSocketError);
     wsServer.handleUpgrade(req, socket, head, (ws) => {
       const protocols = req.headers["sec-websocket-protocol"]?.split(",");
@@ -117,9 +120,9 @@ const createWSServer = ({
     clearInterval(interval);
   });
   return new Promise((resolve) => {
-    httpServer.listen(port, () => {
+    server.listen(port, () => {
       console.log(`Websocket server listening on port ${port}`);
-      return resolve({ httpServer, wsServer });
+      return resolve({ server, wsServer });
     });
   });
 };

package/dist/cjs/testing/jest.config.cjs

@@ -6,10 +6,8 @@ const { findMonoRepoRoot } = require('../monorepo/utils.cjs');
 
 let isReactModule = true;
 try {
-  /* eslint-disable global-require, import/no-unresolved */
   require('react');
   require('styled-components');
-  /* eslint-enable global-require, import/no-unresolved */
 } catch (err) {
   isReactModule = false;
 }
@@ -64,6 +62,7 @@ const jestConfig = {
     '.*\\.(jpg|jpeg|png|gif|eot|otf|webp|ttf|woff|woff2|mp4|webm|wav|mp3|m4a|aac|oga|ico)$':
       getMockFilePath('image.js'),
     '.*\\.svg(?:\\?[a-zA-Z]+)?$': getMockFilePath('svg.js'),
+    '.*iframe\\.html(?:\\?[a-zA-Z]+)?$': getMockFilePath('iframe.js'),
     '.*\\.html(?:\\?[a-zA-Z]+)?$': getMockFilePath('html.js'),
     '@elliemae/pui-user-monitoring': getMockFilePath('pui-user-monitoring.js'),
     '@elliemae/pui-app-loader': getMockFilePath('pui-app-loader.js'),

package/dist/cjs/testing/jest.polyfills.cjs

@@ -1,5 +1,5 @@
 /**
- * @note The block below contains polyfills for Node.js globals
+ * The block below contains polyfills for Node.js globals
  * required for Jest to function when running JSDOM tests.
  * These HAVE to be require's and HAVE to be in this exact
  * order, since "undici" depends on the "TextEncoder" global API.

package/dist/cjs/testing/mocks/iframe.js

@@ -0,0 +1,24 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var iframe_exports = {};
+__export(iframe_exports, {
+  default: () => iframe_default
+});
+module.exports = __toCommonJS(iframe_exports);
+var iframe_default = "./iframe.html";

package/dist/cjs/testing/mocks/svg.js

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,14 +15,6 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var svg_exports = {};
 __export(svg_exports, {
@@ -32,6 +22,5 @@ __export(svg_exports, {
   default: () => svg_default
 });
 module.exports = __toCommonJS(svg_exports);
-var React = __toESM(require("react"));
 var svg_default = "SvgrURL";
 const ReactComponent = "div";

package/dist/cjs/testing/resolver.cjs

@@ -32,7 +32,6 @@ module.exports = (request, options) => {
   }
   const resolution = resolutions.find(({ matcher }) => matcher.test(request));
   if (resolution) {
-    // eslint-disable-next-line no-restricted-syntax
     for (const extension of resolution.extensions) {
       try {
         return resolver(

package/dist/cjs/testing/vitest.config.js

@@ -31,20 +31,16 @@ __export(vitest_config_exports, {
   vitestConfig: () => vitestConfig
 });
 module.exports = __toCommonJS(vitest_config_exports);
-var import_node_path = __toESM(require("node:path"));
-var import_node_url = require("node:url");
 var import_config = require("vitest/config");
 var import_plugin_react = __toESM(require("@vitejs/plugin-react"));
 var import_vite_tsconfig_paths = __toESM(require("vite-tsconfig-paths"));
-const import_meta = {};
-const __dirname = import_node_path.default.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
 const vitestConfig = (0, import_config.defineConfig)({
+  // @ts-expect-error - `react` and `tsconfigPaths` are not part of the default config
   plugins: [(0, import_plugin_react.default)(), (0, import_vite_tsconfig_paths.default)()],
   test: {
     globals: true,
     root: process.cwd(),
     environment: "happy-dom",
-    setupFiles: [import_node_path.default.resolve(__dirname, "./setup-test-env.js")],
     include: ["./{app,lib}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}"],
     exclude: [...import_config.configDefaults.exclude, ".idea", ".git", ".cache", "e2e"],
     coverage: {

package/dist/cjs/transpile/.swcrc

@@ -4,6 +4,7 @@
       "syntax": "typescript",
       "jsx": true,
       "tsx": true,
+      "decorators": true,
       "dynamicImport": true
     },
     "target": "es2022"

package/dist/cjs/utils.cjs

@@ -14,7 +14,7 @@ exports.getAppConfig = () => {
 
   if (!fs.existsSync(appConfigPath)) return '{}';
   const appConfig = fs.readFileSync(appConfigPath);
-  return appConfig || '{}';
+  return appConfig ?? '{}';
 };
 
 exports.isApp = isApp;

package/dist/cjs/utils.js

@@ -30,13 +30,15 @@ var utils_exports = {};
 __export(utils_exports, {
   basePath: () => basePath,
   getAppConfig: () => getAppConfig,
-  isApp: () => isApp
+  isApp: () => isApp,
+  isHttps: () => isHttps
 });
 module.exports = __toCommonJS(utils_exports);
 var import_node_fs = __toESM(require("node:fs"));
 var import_node_path = __toESM(require("node:path"));
 const basePath = (process.env.BASE_PATH ?? "/").replace(/\/?$/, "/");
 const isApp = () => import_node_fs.default.existsSync(import_node_path.default.join(process.cwd(), "app"));
+const isHttps = () => process.env.HTTPS === "true";
 const getAppConfig = () => {
   const appConfigPath = import_node_path.default.join(
     process.cwd(),

package/dist/cjs/webpack/csp-plugin.js

@@ -0,0 +1,79 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var csp_plugin_exports = {};
+__export(csp_plugin_exports, {
+  CspPlugin: () => CspPlugin
+});
+module.exports = __toCommonJS(csp_plugin_exports);
+var import_html_webpack_plugin = __toESM(require("html-webpack-plugin"));
+var import_csp = require("./csp.js");
+const defaultOptions = {
+  enableUnsafeEval: false
+};
+class CspPlugin {
+  #options = defaultOptions;
+  /**
+   * @param {object} options Additional options for this module.
+   */
+  constructor(options) {
+    this.#options = { ...this.#options, ...options ?? {} };
+  }
+  /**
+   * Processes HtmlWebpackPlugin's html data by adding the CSP
+   * @param _compilation
+   * @param htmlPluginData
+   * @param htmlPluginData.html
+   * @param compileCb
+   * @returns {*}
+   */
+  processCsp(_compilation, htmlPluginData, compileCb) {
+    const cspModule = new import_csp.CSP(htmlPluginData.html);
+    cspModule.refactorSourcedScriptsForHashBasedCsp();
+    const scriptHashes = cspModule.hashAllInlineScripts();
+    const { enableUnsafeEval } = this.#options;
+    const strictCsp = import_csp.CSP.getStrictCsp(scriptHashes, {
+      enableUnsafeEval
+    });
+    cspModule.addMetaTag(strictCsp);
+    htmlPluginData.html = cspModule.serializeDom();
+    return compileCb(null, htmlPluginData);
+  }
+  /**
+   * Hooks into webpack to collect assets and hash them, build the policy, and add it into our HTML template
+   * @param compiler
+   */
+  apply(compiler) {
+    compiler.hooks.compilation.tap("CspPlugin", (compilation) => {
+      import_html_webpack_plugin.default.getCompilationHooks(compilation).beforeEmit.tapAsync(
+        "CspPlugin",
+        this.processCsp.bind(this, compilation)
+      );
+    });
+  }
+}