@maka/maka-cli 4.0.83 → 4.0.86

package/dist/maka.js

@@ -1,2 +1,2 @@
 #!/usr/bin/env node --experimental-modules --no-warnings --experimental-json-modules
-const a67C=a67d;(function(a,b){const z=a67d,c=a();while(!![]){try{const d=-parseInt(z(0xdb))/0x1*(-parseInt(z(0xd4))/0x2)+parseInt(z(0xe2))/0x3*(parseInt(z(0xcd))/0x4)+parseInt(z(0xdd))/0x5*(-parseInt(z(0xd2))/0x6)+parseInt(z(0xde))/0x7+-parseInt(z(0xe0))/0x8*(parseInt(z(0xdc))/0x9)+-parseInt(z(0xd6))/0xa+parseInt(z(0xd8))/0xb*(parseInt(z(0xce))/0xc);if(d===b)break;else c['push'](c['shift']());}catch(e){c['push'](c['shift']());}}}(a67c,0x6afe4));const a67b=(function(){let a=!![];return function(b,c){const d=a?function(){const A=a67d;if(c){const e=c[A(0xe3)](b,arguments);return c=null,e;}}:function(){};return a=![],d;};}()),a67a=a67b(this,function(){const B=a67d;return a67a[B(0xda)]()[B(0xe5)](B(0xd5))[B(0xda)]()[B(0xcf)](a67a)[B(0xe5)](B(0xd5));});a67a();import a67u from'minimist';import a67v from'os';import a67w from'path';import a67x from'humps';import a67y from'./commands/maka.cmd.js';import'./commands/_index.js';function a67d(a,b){const c=a67c();return a67d=function(d,e){d=d-0xcd;let f=c[d];return f;},a67d(a,b);}import'./generators/_index.js';import{fileURLToPath}from'url';const __filename=fileURLToPath(import.meta['url']),__dirname=a67w[a67C(0xd9)](__filename);global[a67C(0xe1)]=__dirname;let total_memory=a67v[a67C(0xd1)](),total_mem_in_kb=total_memory/0x400,total_mem_in_mb=total_mem_in_kb/0x400;total_mem_in_mb=Math[a67C(0xd3)](total_mem_in_mb),process[a67C(0xe4)][a67C(0xdf)]='--max-old-space-size='+total_mem_in_mb;const argv=a67u(process[a67C(0xe6)][a67C(0xd7)](0x2)),args=argv['_'],deepCopyArgv=JSON[a67C(0xe8)](JSON[a67C(0xd0)](argv));delete deepCopyArgv['_'];const opts=a67x[a67C(0xe7)](deepCopyArgv);function a67c(){const D=['MAKA_COMMAND_PATH','3MxdIPG','apply','env','search','argv','camelizeKeys','parse','728756cPHYKE','5708856jyUWKF','constructor','stringify','totalmem','16140mBvJJP','floor','3878MViULu','(((.+)+)+)+$','4787900kOJQAC','slice','22nYgwei','dirname','toString','172JftLAO','9wzJuQz','1170EHiERc','4415649KnqGsE','TOOL_NODE_FLAGS','4411888cnDkko'];a67c=function(){return D;};return a67c();}a67y['run'](args,opts);
+const a67B=a67d;(function(a,b){const z=a67d,c=a();while(!![]){try{const d=-parseInt(z(0xd7))/0x1+-parseInt(z(0xc7))/0x2*(parseInt(z(0xd8))/0x3)+-parseInt(z(0xc8))/0x4*(parseInt(z(0xcc))/0x5)+parseInt(z(0xc2))/0x6*(-parseInt(z(0xbf))/0x7)+parseInt(z(0xd4))/0x8*(parseInt(z(0xd6))/0x9)+parseInt(z(0xce))/0xa+-parseInt(z(0xcb))/0xb*(-parseInt(z(0xd1))/0xc);if(d===b)break;else c['push'](c['shift']());}catch(e){c['push'](c['shift']());}}}(a67c,0xe8b94));const a67b=(function(){let a=!![];return function(b,c){const d=a?function(){if(c){const e=c['apply'](b,arguments);return c=null,e;}}:function(){};return a=![],d;};}()),a67a=a67b(this,function(){const A=a67d;return a67a[A(0xcd)]()[A(0xc1)](A(0xd0))[A(0xcd)]()['constructor'](a67a)[A(0xc1)](A(0xd0));});function a67d(a,b){const c=a67c();return a67d=function(d,e){d=d-0xbd;let f=c[d];return f;},a67d(a,b);}a67a();import a67u from'minimist';function a67c(){const C=['url','2pjBoeC','3088SeFgcg','env','argv','10276145elHtka','8705HuiJJi','toString','15127410xRubpF','--max-old-space-size=','(((.+)+)+)+$','24YBxoMC','MAKA_COMMAND_PATH','slice','8ZXajcj','totalmem','2921733dIjyRU','816580LjqyKZ','933174epGQAS','dirname','parse','982947byroyh','camelizeKeys','search','12tJedLW','floor','TOOL_NODE_FLAGS','run'];a67c=function(){return C;};return a67c();}import a67v from'os';import a67w from'path';import a67x from'humps';import a67y from'./commands/maka.cmd.js';import'./commands/_index.js';import'./generators/_index.js';import{fileURLToPath}from'url';const __filename=fileURLToPath(import.meta[a67B(0xc6)]),__dirname=a67w[a67B(0xbd)](__filename);global[a67B(0xd2)]=__dirname;let total_memory=a67v[a67B(0xd5)](),total_mem_in_kb=total_memory/0x400,total_mem_in_mb=total_mem_in_kb/0x400;total_mem_in_mb=Math[a67B(0xc3)](total_mem_in_mb),process[a67B(0xc9)][a67B(0xc4)]=a67B(0xcf)+total_mem_in_mb;const argv=a67u(process[a67B(0xca)][a67B(0xd3)](0x2)),args=argv['_'],deepCopyArgv=JSON[a67B(0xbe)](JSON['stringify'](argv));delete deepCopyArgv['_'];const opts=a67x[a67B(0xc0)](deepCopyArgv);a67y[a67B(0xc5)](args,opts);

package/dist/templates/meteor/app/client/head.html

@@ -11,15 +11,4 @@
   <noscript>
     Please enable JavaScript
   </noscript>
-  <script type="text/javascript">
-  window.onbeforeunload = closingCode;
-  function closingCode(){
-    if (Meteor.settings.public.logoutOnClose === true && Meteor.logout) Meteor.logout();
-    return null;
-  }
-  // stop ios bounce and zoom
-  document.ontouchmove = event => {
-    event.preventDefault();
-  };
-  </script>
 </head>

package/dist/templates/meteor/app/client/main.js

@@ -1 +1,13 @@
+window.onbeforeunload = () => {
+  if (Meteor.settings.public.logoutOnClose === true && Meteor.logout) {
+    Meteor.logout();
+  }
+  return null;
+}
+
+// stop ios bounce and zoom
+document.ontouchmove = event => {
+  event.preventDefault();
+};
+
 import '/imports/startup/client';

package/dist/templates/meteor/app/client/main.js.jsx

@@ -1 +1,13 @@
+window.onbeforeunload = () => {
+  if (Meteor.settings.public.logoutOnClose === true && Meteor.logout) {
+    Meteor.logout();
+  }
+  return null;
+}
+
+// stop ios bounce and zoom
+document.ontouchmove = event => {
+  event.preventDefault();
+};
+
 import '/imports/startup/client/index.jsx';

package/dist/templates/meteor/app/client/main.js.ts

@@ -1 +1,13 @@
+window.onbeforeunload = () => {
+  if (Meteor.settings.public.logoutOnClose === true && Meteor.logout) {
+    Meteor.logout();
+  }
+  return null;
+}
+
+// stop ios bounce and zoom
+document.ontouchmove = event => {
+  event.preventDefault();
+};
+
 import '/imports/startup/client';

package/dist/templates/meteor/app/client/main.js.tsx

@@ -1 +1,13 @@
+window.onbeforeunload = () => {
+  if (Meteor.settings.public.logoutOnClose === true && Meteor.logout) {
+    Meteor.logout();
+  }
+  return null;
+}
+
+// stop ios bounce and zoom
+document.ontouchmove = event => {
+  event.preventDefault();
+};
+
 import '/imports/startup/client/index';

package/dist/templates/meteor/app/imports/startup/lib/routes.js.jsx

@@ -42,7 +42,7 @@ const PublicRoutes = ({ history }) => (
   </Router>
 );
 const Routes = ({ user = {}, history }) => (
-  (user._id) ? <PublicRoutes history={history}/> : <PublicRoutes history={history}/>
+  (user._id) ? <PrivateRoutes history={history}/> : <PublicRoutes history={history}/>
 );
 
 export default Routes;

package/dist/templates/meteor/app/imports/startup/lib/routes.js.tsx

@@ -42,7 +42,7 @@ const PublicRoutes = ({ history }) => (
   </Router>
 );
 const Routes = ({ user = {}, history }) => (
-  (user._id) ? <PublicRoutes history={history}/> : <PublicRoutes history={history}/>
+  (user._id) ? <PrivateRoutes history={history}/> : <PublicRoutes history={history}/>
 );
 
 export default Routes;

package/dist/templates/meteor/app/meteor.d.ts

@@ -10,19 +10,19 @@ declare var it: Function;
 declare var describe: Function;
 declare var assert: any;
 declare var equal: any;
-declare var Map: any;
+declare var Map: MapConstructor;
 declare var Meteor: any;
 
 // TODO: These should be worked out ...
-declare module 'meteor/react-meteor-data': any;
-declare module 'meteor/maka:rest': any;
-declare module 'meteor/mdg:validated-method': any;
-declare module 'meteor/apollo': any;
-declare module 'meteor/server-render': any;
-declare module 'meteor/underscore': any;
+declare module 'meteor/react-meteor-data';
+declare module 'meteor/maka:rest';
+declare module 'meteor/mdg:validated-method';
+declare module 'meteor/apollo';
+declare module 'meteor/server-render';
+declare module 'meteor/underscore';
 declare module 'meteor/ddp-rate-limiter';
-declare module 'meteor/check': any;
-declare module 'meteor/webapp': any;
+declare module 'meteor/check';
+declare module 'meteor/webapp';
 
 interface EJSONable {
   [key: string]: number | string | boolean | Object | number[] | string[] | Object[] | Date | Uint8Array | EJSON.CustomType;
@@ -54,7 +54,7 @@ declare module "meteor/meteor" {
     export var isDevelopment: any;
     export var isServer: any;
     export var isClient: any;
-    
+
     interface UserEmail {
       address: string;
       verified: boolean;
@@ -169,7 +169,7 @@ declare module "meteor/random" {
 
 declare module "meteor/meteor" {
   import { Blaze } from "meteor/blaze";
-  
+
   export module Meteor {
     /** Start definitions for Template **/
     interface Event {
@@ -607,9 +607,9 @@ declare module "meteor/meteor" {
     function clearInterval(id: number): void;
     function clearTimeout(id: number): void;
     function disconnect(): void;
-    var isClient: boolean;
+    var isClient: any;
     var isCordova: boolean;
-    var isServer: boolean;
+    var isServer: any;
     function loggingIn(): boolean;
     function loginWith<ExternalService>(options?: {
       requestPermissions?: string[];

package/dist/templates/meteor/app/server/helmet-csp.js

@@ -0,0 +1,145 @@
+/*
+ * Content Security Policy (CSP)
+ * https://guide.meteor.com/security.html#httpheaders
+ */
+
+/* global __meteor_runtime_config__ */
+import { Meteor } from 'meteor/meteor'
+import { WebApp } from 'meteor/webapp'
+import { Autoupdate } from 'meteor/autoupdate'
+import crypto from 'crypto'
+
+const self = '\'self\''
+const data = 'data:'
+const unsafeEval = '\'unsafe-eval\''
+const unsafeInline = '\'unsafe-inline\''
+const allowedOrigins = Meteor.settings.extraAllowedOrigins;
+
+// create the default connect source for our current domain in
+// a multi-protocol compatible way (http/ws or https/wss)
+const url = Meteor.absoluteUrl()
+const domain = url.replace(/http(s)*:\/\//, '').replace(/\/$/, '')
+const s = url.match(/(?!=http)s(?=:\/\/)/) ? 's' : ''
+const usesHttps = s.length > 0
+const connectSrc = [
+  self,
+  `http${s}://${domain}`,
+  `ws${s}://${domain}`
+]
+
+// Prepare runtime config for generating the sha256 hash
+// It is important, that the hash meets exactly the hash of the
+// script in the client bundle.
+// Otherwise the app would not be able to start, since the runtimeConfigScript
+// is rejected __meteor_runtime_config__ is not available, causing
+// a cascade of follow-up errors.
+const runtimeConfig = Object.assign(__meteor_runtime_config__, Autoupdate, {
+  // the following lines may depend on, whether you called Accounts.config
+  // and whether your Meteor app is a "newer" version
+  accountsConfigCalled: true,
+  isModern: true
+})
+
+// add client versions to __meteor_runtime_config__
+Object.keys(WebApp.clientPrograms).forEach(arch => {
+  __meteor_runtime_config__.versions[arch] = {
+    version: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].version(),
+    versionRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionRefreshable(),
+    versionNonRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionNonRefreshable(),
+    // comment the following line if you use Meteor < 2.0
+    versionReplaceable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionReplaceable()
+  }
+})
+
+const runtimeConfigScript = `__meteor_runtime_config__ = JSON.parse(decodeURIComponent("${encodeURIComponent(JSON.stringify(runtimeConfig))}"))`
+const runtimeConfigHash = crypto.createHash('sha256').update(runtimeConfigScript).digest('base64')
+
+const helmetOptions = {
+  contentSecurityPolicy: {
+    blockAllMixedContent: true,
+    directives: {
+      defaultSrc: [self],
+      scriptSrc: [
+        self,
+        // Remove / comment out unsafeEval if you do not use dynamic imports
+        // to tighten security. However, if you use dynamic imports this line
+        // must be kept in order to make them work.
+        unsafeEval,
+        `'sha256-${runtimeConfigHash}'`
+      ],
+      childSrc: [self],
+      // If you have external apps, that should be allowed as sources for
+      // connections or images, your should add them here
+      // Call helmetOptions() without args if you have no external sources
+      // Note, that this is just an example and you may configure this to your needs
+      connectSrc: connectSrc.concat(allowedOrigins),
+      fontSrc: [self, data],
+      formAction: [self],
+      frameAncestors: [self],
+      frameSrc: ['*'],
+      // This is an example to show, that we can define to show images only
+      // from our self, browser data/blob and a defined set of hosts.
+      // Configure to your needs.
+      imgSrc: [self, data, 'blob:'].concat(allowedOrigins),
+      manifestSrc: [self],
+      mediaSrc: [self],
+      objectSrc: [self],
+      // these are just examples, configure to your needs, see
+      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
+      sandbox: [
+        // allow-downloads-without-user-activation // experimental
+        'allow-forms',
+        'allow-modals',
+        // 'allow-orientation-lock',
+        // 'allow-pointer-lock',
+        // 'allow-popups',
+        // 'allow-popups-to-escape-sandbox',
+        // 'allow-presentation',
+        'allow-same-origin',
+        'allow-scripts',
+        // 'allow-storage-access-by-user-activation ', // experimental
+        // 'allow-top-navigation',
+        // 'allow-top-navigation-by-user-activation'
+      ],
+      styleSrc: [self, unsafeInline],
+      workerSrc: [self, 'blob:']
+    }
+  },
+  // see the helmet documentation to get a better understanding of
+  // the following configurations and settings
+  strictTransportSecurity: {
+    maxAge: 15552000,
+    includeSubDomains: true,
+    preload: false
+  },
+  referrerPolicy: {
+    policy: 'no-referrer'
+  },
+  expectCt: {
+    enforce: true,
+    maxAge: 604800
+  },
+  frameguard: {
+    action: 'sameorigin'
+  },
+  dnsPrefetchControl: {
+    allow: false
+  },
+  permittedCrossDomainPolicies: {
+    permittedPolicies: 'none'
+  }
+}
+
+// We assume, that we are working on a localhost when there is no https
+// connection available.
+// Run your project with --production flag to simulate script-src hashing
+if (!usesHttps && Meteor.isDevelopment) {
+  delete helmetOptions.contentSecurityPolicy.blockAllMixedContent;
+  helmetOptions.contentSecurityPolicy.directives.scriptSrc = [
+    self,
+    unsafeEval,
+    unsafeInline,
+  ];
+}
+
+export default helmetOptions;

package/dist/templates/meteor/app/server/helmet-csp.js.jsx

@@ -0,0 +1,145 @@
+/*
+ * Content Security Policy (CSP)
+ * https://guide.meteor.com/security.html#httpheaders
+ */
+
+/* global __meteor_runtime_config__ */
+import { Meteor } from 'meteor/meteor'
+import { WebApp } from 'meteor/webapp'
+import { Autoupdate } from 'meteor/autoupdate'
+import crypto from 'crypto'
+
+const self = '\'self\''
+const data = 'data:'
+const unsafeEval = '\'unsafe-eval\''
+const unsafeInline = '\'unsafe-inline\''
+const allowedOrigins = Meteor.settings.extraAllowedOrigins;
+
+// create the default connect source for our current domain in
+// a multi-protocol compatible way (http/ws or https/wss)
+const url = Meteor.absoluteUrl()
+const domain = url.replace(/http(s)*:\/\//, '').replace(/\/$/, '')
+const s = url.match(/(?!=http)s(?=:\/\/)/) ? 's' : ''
+const usesHttps = s.length > 0
+const connectSrc = [
+  self,
+  `http${s}://${domain}`,
+  `ws${s}://${domain}`
+]
+
+// Prepare runtime config for generating the sha256 hash
+// It is important, that the hash meets exactly the hash of the
+// script in the client bundle.
+// Otherwise the app would not be able to start, since the runtimeConfigScript
+// is rejected __meteor_runtime_config__ is not available, causing
+// a cascade of follow-up errors.
+const runtimeConfig = Object.assign(__meteor_runtime_config__, Autoupdate, {
+  // the following lines may depend on, whether you called Accounts.config
+  // and whether your Meteor app is a "newer" version
+  accountsConfigCalled: true,
+  isModern: true
+})
+
+// add client versions to __meteor_runtime_config__
+Object.keys(WebApp.clientPrograms).forEach(arch => {
+  __meteor_runtime_config__.versions[arch] = {
+    version: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].version(),
+    versionRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionRefreshable(),
+    versionNonRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionNonRefreshable(),
+    // comment the following line if you use Meteor < 2.0
+    versionReplaceable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionReplaceable()
+  }
+})
+
+const runtimeConfigScript = `__meteor_runtime_config__ = JSON.parse(decodeURIComponent("${encodeURIComponent(JSON.stringify(runtimeConfig))}"))`
+const runtimeConfigHash = crypto.createHash('sha256').update(runtimeConfigScript).digest('base64')
+
+const helmetOptions = {
+  contentSecurityPolicy: {
+    blockAllMixedContent: true,
+    directives: {
+      defaultSrc: [self],
+      scriptSrc: [
+        self,
+        // Remove / comment out unsafeEval if you do not use dynamic imports
+        // to tighten security. However, if you use dynamic imports this line
+        // must be kept in order to make them work.
+        unsafeEval,
+        `'sha256-${runtimeConfigHash}'`
+      ],
+      childSrc: [self],
+      // If you have external apps, that should be allowed as sources for
+      // connections or images, your should add them here
+      // Call helmetOptions() without args if you have no external sources
+      // Note, that this is just an example and you may configure this to your needs
+      connectSrc: connectSrc.concat(allowedOrigins),
+      fontSrc: [self, data],
+      formAction: [self],
+      frameAncestors: [self],
+      frameSrc: ['*'],
+      // This is an example to show, that we can define to show images only
+      // from our self, browser data/blob and a defined set of hosts.
+      // Configure to your needs.
+      imgSrc: [self, data, 'blob:'].concat(allowedOrigins),
+      manifestSrc: [self],
+      mediaSrc: [self],
+      objectSrc: [self],
+      // these are just examples, configure to your needs, see
+      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
+      sandbox: [
+        // allow-downloads-without-user-activation // experimental
+        'allow-forms',
+        'allow-modals',
+        // 'allow-orientation-lock',
+        // 'allow-pointer-lock',
+        // 'allow-popups',
+        // 'allow-popups-to-escape-sandbox',
+        // 'allow-presentation',
+        'allow-same-origin',
+        'allow-scripts',
+        // 'allow-storage-access-by-user-activation ', // experimental
+        // 'allow-top-navigation',
+        // 'allow-top-navigation-by-user-activation'
+      ],
+      styleSrc: [self, unsafeInline],
+      workerSrc: [self, 'blob:']
+    }
+  },
+  // see the helmet documentation to get a better understanding of
+  // the following configurations and settings
+  strictTransportSecurity: {
+    maxAge: 15552000,
+    includeSubDomains: true,
+    preload: false
+  },
+  referrerPolicy: {
+    policy: 'no-referrer'
+  },
+  expectCt: {
+    enforce: true,
+    maxAge: 604800
+  },
+  frameguard: {
+    action: 'sameorigin'
+  },
+  dnsPrefetchControl: {
+    allow: false
+  },
+  permittedCrossDomainPolicies: {
+    permittedPolicies: 'none'
+  }
+}
+
+// We assume, that we are working on a localhost when there is no https
+// connection available.
+// Run your project with --production flag to simulate script-src hashing
+if (!usesHttps && Meteor.isDevelopment) {
+  delete helmetOptions.contentSecurityPolicy.blockAllMixedContent;
+  helmetOptions.contentSecurityPolicy.directives.scriptSrc = [
+    self,
+    unsafeEval,
+    unsafeInline,
+  ];
+}
+
+export default helmetOptions;

package/dist/templates/meteor/app/server/helmet-csp.js.ts

@@ -0,0 +1,145 @@
+/*
+ * Content Security Policy (CSP)
+ * https://guide.meteor.com/security.html#httpheaders
+ */
+
+/* global __meteor_runtime_config__ */
+import { Meteor } from 'meteor/meteor'
+import { WebApp } from 'meteor/webapp'
+import { Autoupdate } from 'meteor/autoupdate'
+import crypto from 'crypto'
+
+const self = '\'self\''
+const data = 'data:'
+const unsafeEval = '\'unsafe-eval\''
+const unsafeInline = '\'unsafe-inline\''
+const allowedOrigins = Meteor.settings.extraAllowedOrigins;
+
+// create the default connect source for our current domain in
+// a multi-protocol compatible way (http/ws or https/wss)
+const url = Meteor.absoluteUrl()
+const domain = url.replace(/http(s)*:\/\//, '').replace(/\/$/, '')
+const s = url.match(/(?!=http)s(?=:\/\/)/) ? 's' : ''
+const usesHttps = s.length > 0
+const connectSrc = [
+  self,
+  `http${s}://${domain}`,
+  `ws${s}://${domain}`
+]
+
+// Prepare runtime config for generating the sha256 hash
+// It is important, that the hash meets exactly the hash of the
+// script in the client bundle.
+// Otherwise the app would not be able to start, since the runtimeConfigScript
+// is rejected __meteor_runtime_config__ is not available, causing
+// a cascade of follow-up errors.
+const runtimeConfig = Object.assign(__meteor_runtime_config__, Autoupdate, {
+  // the following lines may depend on, whether you called Accounts.config
+  // and whether your Meteor app is a "newer" version
+  accountsConfigCalled: true,
+  isModern: true
+})
+
+// add client versions to __meteor_runtime_config__
+Object.keys(WebApp.clientPrograms).forEach(arch => {
+  __meteor_runtime_config__.versions[arch] = {
+    version: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].version(),
+    versionRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionRefreshable(),
+    versionNonRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionNonRefreshable(),
+    // comment the following line if you use Meteor < 2.0
+    versionReplaceable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionReplaceable()
+  }
+})
+
+const runtimeConfigScript = `__meteor_runtime_config__ = JSON.parse(decodeURIComponent("${encodeURIComponent(JSON.stringify(runtimeConfig))}"))`
+const runtimeConfigHash = crypto.createHash('sha256').update(runtimeConfigScript).digest('base64')
+
+const helmetOptions = {
+  contentSecurityPolicy: {
+    blockAllMixedContent: true,
+    directives: {
+      defaultSrc: [self],
+      scriptSrc: [
+        self,
+        // Remove / comment out unsafeEval if you do not use dynamic imports
+        // to tighten security. However, if you use dynamic imports this line
+        // must be kept in order to make them work.
+        unsafeEval,
+        `'sha256-${runtimeConfigHash}'`
+      ],
+      childSrc: [self],
+      // If you have external apps, that should be allowed as sources for
+      // connections or images, your should add them here
+      // Call helmetOptions() without args if you have no external sources
+      // Note, that this is just an example and you may configure this to your needs
+      connectSrc: connectSrc.concat(allowedOrigins),
+      fontSrc: [self, data],
+      formAction: [self],
+      frameAncestors: [self],
+      frameSrc: ['*'],
+      // This is an example to show, that we can define to show images only
+      // from our self, browser data/blob and a defined set of hosts.
+      // Configure to your needs.
+      imgSrc: [self, data, 'blob:'].concat(allowedOrigins),
+      manifestSrc: [self],
+      mediaSrc: [self],
+      objectSrc: [self],
+      // these are just examples, configure to your needs, see
+      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
+      sandbox: [
+        // allow-downloads-without-user-activation // experimental
+        'allow-forms',
+        'allow-modals',
+        // 'allow-orientation-lock',
+        // 'allow-pointer-lock',
+        // 'allow-popups',
+        // 'allow-popups-to-escape-sandbox',
+        // 'allow-presentation',
+        'allow-same-origin',
+        'allow-scripts',
+        // 'allow-storage-access-by-user-activation ', // experimental
+        // 'allow-top-navigation',
+        // 'allow-top-navigation-by-user-activation'
+      ],
+      styleSrc: [self, unsafeInline],
+      workerSrc: [self, 'blob:']
+    }
+  },
+  // see the helmet documentation to get a better understanding of
+  // the following configurations and settings
+  strictTransportSecurity: {
+    maxAge: 15552000,
+    includeSubDomains: true,
+    preload: false
+  },
+  referrerPolicy: {
+    policy: 'no-referrer'
+  },
+  expectCt: {
+    enforce: true,
+    maxAge: 604800
+  },
+  frameguard: {
+    action: 'sameorigin'
+  },
+  dnsPrefetchControl: {
+    allow: false
+  },
+  permittedCrossDomainPolicies: {
+    permittedPolicies: 'none'
+  }
+}
+
+// We assume, that we are working on a localhost when there is no https
+// connection available.
+// Run your project with --production flag to simulate script-src hashing
+if (!usesHttps && Meteor.isDevelopment) {
+  delete helmetOptions.contentSecurityPolicy.blockAllMixedContent;
+  helmetOptions.contentSecurityPolicy.directives.scriptSrc = [
+    self,
+    unsafeEval,
+    unsafeInline,
+  ];
+}
+
+export default helmetOptions;