@maka/maka-cli 4.0.85 → 4.0.86

package/dist/generators/service.js

@@ -1 +1 @@
-const a66D=a66d;(function(a,b){const A=a66d,c=a();while(!![]){try{const d=-parseInt(A(0xa7))/0x1+parseInt(A(0xb5))/0x2+parseInt(A(0xaa))/0x3+-parseInt(A(0x76))/0x4*(-parseInt(A(0x9b))/0x5)+-parseInt(A(0x71))/0x6*(-parseInt(A(0x95))/0x7)+-parseInt(A(0x9c))/0x8*(-parseInt(A(0x79))/0x9)+-parseInt(A(0xb9))/0xa;if(d===b)break;else c['push'](c['shift']());}catch(e){c['push'](c['shift']());}}}(a66c,0x339e3));const a66b=(function(){let a=!![];return function(b,c){const d=a?function(){const B=a66d;if('zfEeZ'!==B(0x6a)){if(c){if(B(0x91)!==B(0x72)){const e=c['apply'](b,arguments);return c=null,e;}else c(d);}}else try{i(j['throw'](k));}catch(h){m(h);}}:function(){};return a=![],d;};}()),a66a=a66b(this,function(){const C=a66d;return a66a[C(0x98)]()[C(0xa8)](C(0xa4))[C(0x98)]()[C(0xa9)](a66a)[C(0xa8)](C(0xa4));});a66a();function a66c(){const L=['Generate\x20a\x20service\x20to\x20run\x20within\x20your\x20meteor\x20application.','fhfSm','/imports/startup/lib/collections/logs','/imports/startup/lib/services/logger-transports','svc','imports','service/logger/logger.js','__awaiter','create','lMqAf','Winston\x20Logger','notice','fsi','done','logger','warn','iKJOk','checkMeteorPackage','maka\x20{generate,\x20g}:{service}\x20<service-name>\x20--type=logger','CsPNE','findGenerator','winston','service','21VjSwUL','next','import\x20Logs\x20from\x20\x27','toString','TAiPi','jScRS','5NgeODj','199480egCmwR','value','MrMzZ','sGypd','type','WYPDb','sJGKH','installNpmPackage','(((.+)+)+)+$','getProjectConfig','injectAtBeginningOfFile','287527tnXiQa','search','constructor','249399pGAYXE','mongo','lUFua','pathFromApp','Verifying\x20meteor\x20package\x20requirements:\x20mongo\x20...','MXhej','invoke','indexOf','serviceAnswer','resourceName','(blank)','842764RfTCQx','startup','collection','lib','4546530zMbjrp','apply','options','lDxbQ','error','taOHQ','rewriteDestinationPathForType','throw','Invalid\x20type\x20',',\x20you\x20must\x20provide\x20a\x20valid\x20type\x20as\x20an\x20argument.\x20\x20Usage:','70410VuJUDg','DmjKS','Owxtr','logger-transports.','template','1555808BFzEeN','then','services','9OctPos','Service\x20Type','engines','installMeteorPackage','withValue'];a66c=function(){return L;};return a66c();}var __awaiter=this&&this[a66D(0x85)]||function(a,b,c,d){function e(f){const E=a66d;if(E(0xaf)==='hIpZc'){const h=d[E(0xba)](e,arguments);return f=null,h;}else return f instanceof c?f:new c(function(h){h(f);});}return new(c||(c=Promise))(function(f,g){const I=a66d;function h(k){const F=a66d;try{j(d[F(0x96)](k));}catch(l){g(l);}}function i(k){const G=a66d;if(G(0x99)==='PUiFD')d(e[G(0x96)](f));else try{j(d[G(0x6e)](k));}catch(m){if(G(0xa1)==='WYPDb')g(m);else{if(m){const o=i[G(0xba)](j,arguments);return k=null,o;}}}}function j(k){const H=a66d;if('taOHQ'!==H(0x6c))return f instanceof g?h:new i(function(m){m(k);});else k['done']?f(k[H(0x9d)]):e(k[H(0x9d)])[H(0x77)](h,i);}j((d=d[I(0xba)](a,b||[]))[I(0x96)]());});};import{camelCase,paramCase,pascalCase}from'change-case';function a66d(a,b){const c=a66c();return a66d=function(d,e){d=d-0x69;let f=c[d];return f;},a66d(a,b);}import a66u from'../generators/maka.gen.js';import{Generator}from'../generator.js';import{Log}from'../tools/log/log.class.js';import{Actions}from'../tools/actions/actions.class.js';Generator[a66D(0x86)]({'name':a66D(0x94),'aliases':[a66D(0x82)],'usage':a66D(0x90),'description':a66D(0x7e),'examples':['maka\x20g:s\x20Logger\x20--type=logger']},function(a,b){return __awaiter(this,void 0x0,void 0x0,function*(){const J=a66d;if(J(0xa2)===J(0x87)){const d=g?function(){if(d){const u=q['apply'](r,arguments);return s=null,u;}}:function(){};return l=![],d;}else try{const d=this[J(0x8a)][J(0xa5)]();this[J(0x8a)][J(0x7d)](d,()=>__awaiter(this,void 0x0,void 0x0,function*(){const K=J;if(K(0x9e)===K(0x8e)){let h=d[K(0xa0)]?e[K(0xa0)]:'(blank)';f[K(0x6b)]('Invalid\x20type\x20'+h+K(0x70));return;}else{const g=this[K(0x8a)][K(0xad)]({}),h=paramCase(b[K(0xb3)]),i=paramCase(b[K(0xb3)]);if(!b[K(0xa0)]){if(K(0x9f)===K(0x9f)){const m={'type':'list','name':K(0xb2),'message':K(0x7a),'choices':[{'name':K(0x88),'value':K(0x8c)}]},{serviceAnswer:n}=yield Actions[K(0x69)](m);n&&(b['type']=n);}else h[K(0x8b)]?i(j[K(0x9d)]):k(l['value'])[K(0x77)](m,n);}const j={'name':pascalCase(b[K(0xb3)]),'fileName':h,'camelCase':camelCase(b[K(0xb3)]),'type':b[K(0xa0)],'engine':d['engines']['js'],'noRename':!![]};let k='js';d[K(0x7b)]['js']==='tsx'&&(k='ts');let l=[K(0x8c)];if(l[K(0xb1)](j[K(0xa0)])<0x0){let p=j[K(0xa0)]?j[K(0xa0)]:K(0xb4);Log['error'](K(0x6f)+p+K(0x70));return;}if(b[K(0xa0)]===K(0x8c)){if(K(0xac)===K(0x73))c[K(0x6b)](d);else{!this[K(0x8a)]['checkNpmPackage'](K(0x93))&&(K(0x7f)!==K(0x7f)?d(e[K(0x6e)](f)):(Log[K(0x8d)]('Verifying\x20npm\x20package\x20requirements:\x20winston\x20...'),yield this[K(0x8a)][K(0xa3)]('winston\x20winston-transport\x20setimmediate',{'cwd':g})));!this[K(0x8a)][K(0x8f)](K(0xab))&&(Log[K(0x89)](K(0xae)),yield this[K(0x8a)][K(0x7c)](K(0xab),{'cwd':g}));let r=this[K(0x8a)][K(0xad)]({'pathParts':[K(0x83),K(0xb6),K(0xb8),K(0x78),h+'.'+k]});this[K(0x8a)][K(0x75)]({'srcPath':K(0x84),'destPath':r,'context':j,'config':d});const s=a66u[K(0x92)](K(0xb7));s&&(K(0x9a)==='Ocqbw'?b='ts':yield s[K(0xb0)]([i],{'where':'both','appPathPrefix':K(0xb8),'dir':''}));let t=this['fsi'][K(0x6d)]({'pathParts':[r]});const u=this[K(0x8a)][K(0x6d)]({'pathParts':[K(0x81)]});this[K(0x8a)][K(0xa6)]({'filePath':t,'content':'import\x20{\x20MongoTransport\x20}\x20from\x20\x27'+u+'\x27;'});let v=this['fsi']['pathFromApp']({'pathParts':[K(0x83),K(0xb6),K(0xb8),'services',K(0x74)+k]});this['fsi']['template']({'srcPath':'service/logger/transports.js','destPath':v,'context':j,'config':d});let w=this['fsi'][K(0x6d)]({'pathParts':[v]});const x=this[K(0x8a)][K(0x6d)]({'pathParts':[K(0x80)]});this[K(0x8a)][K(0xa6)]({'filePath':w,'content':K(0x97)+x+'\x27;'});}}}}));}catch(f){Log['error'](f);}});});
+const a66F=a66d;(function(a,b){const y=a66d,c=a();while(!![]){try{const d=parseInt(y(0xa8))/0x1+-parseInt(y(0xca))/0x2+parseInt(y(0xcd))/0x3*(parseInt(y(0xbf))/0x4)+parseInt(y(0x9b))/0x5*(parseInt(y(0xc5))/0x6)+parseInt(y(0xc4))/0x7+-parseInt(y(0xb8))/0x8+-parseInt(y(0xc2))/0x9;if(d===b)break;else c['push'](c['shift']());}catch(e){c['push'](c['shift']());}}}(a66c,0xdccfd));const a66b=(function(){let a=!![];return function(b,c){const d=a?function(){const z=a66d;if(c){if(z(0x8d)!==z(0x8d))c[z(0xb6)]=d;else{const f=c[z(0x92)](b,arguments);return c=null,f;}}}:function(){};return a=![],d;};}()),a66a=a66b(this,function(){const A=a66d;return a66a[A(0x8a)]()[A(0xa5)](A(0xce))['toString']()[A(0x9d)](a66a)[A(0xa5)]('(((.+)+)+)+$');});a66a();var __awaiter=this&&this['__awaiter']||function(a,b,c,d){function e(f){const B=a66d;if('EMAqA'===B(0xae)){const h=g?function(){if(h){const u=q['apply'](r,arguments);return s=null,u;}}:function(){};return l=![],h;}else return f instanceof c?f:new c(function(h){h(f);});}return new(c||(c=Promise))(function(f,g){const E=a66d;function h(k){const C=a66d;if(C(0xb3)!==C(0xb7))try{C(0x9e)!==C(0x91)?j(d[C(0x9a)](k)):b='ts';}catch(m){C(0x8f)!=='wpqdx'?h['done']?i(j[C(0x8b)]):k(l[C(0x8b)])[C(0xb9)](m,n):g(m);}else c(d);}function i(k){try{j(d['throw'](k));}catch(l){g(l);}}function j(k){const D=a66d;k[D(0xbc)]?f(k[D(0x8b)]):e(k[D(0x8b)])['then'](h,i);}j((d=d['apply'](a,b||[]))[E(0x9a)]());});};function a66d(a,b){const c=a66c();return a66d=function(d,e){d=d-0x87;let f=c[d];return f;},a66d(a,b);}import{camelCase,paramCase,pascalCase}from'change-case';import a66u from'../generators/maka.gen.js';import{Generator}from'../generator.js';import{Log}from'../tools/log/log.class.js';function a66c(){const I=['injectAtBeginningOfFile','services','2415174GxNgfF','(((.+)+)+)+$','service','error','throw','mongo','toString','value','template','gQFuG','WAwaU','wpqdx','logger','jWPiU','apply','/imports/startup/lib/services/logger-transports','winston\x20winston-transport\x20setimmediate','winston','maka\x20g:s\x20Logger\x20--type=logger','pRnsi','create','engines','next','187940tkHKOy','notice','constructor','kyeGK','(blank)','lib','fsi','collection','installNpmPackage','Service\x20Type','search','findGenerator','getProjectConfig','1581283jnCNke','service/logger/transports.js','withValue','AKslw','/imports/startup/lib/collections/logs','checkMeteorPackage','KEXbM','import\x20{\x20MongoTransport\x20}\x20from\x20\x27','resourceName','checkNpmPackage','imports','UfvNW','maka\x20{generate,\x20g}:{service}\x20<service-name>\x20--type=logger','pathFromApp','type','kbqnw','8444696QGTYDx','then','both','startup','done','options','tsx','4pDOcPE','list','Generate\x20a\x20service\x20to\x20run\x20within\x20your\x20meteor\x20application.','22997637oEpAtd','rewriteDestinationPathForType','6886257bsGWQJ','270czlljv','Winston\x20Logger','indexOf',',\x20you\x20must\x20provide\x20a\x20valid\x20type\x20as\x20an\x20argument.\x20\x20Usage:','serviceAnswer','1092454zTYzqr'];a66c=function(){return I;};return a66c();}import{Actions}from'../tools/actions/actions.class.js';Generator[a66F(0x98)]({'name':a66F(0xcf),'aliases':['svc'],'usage':a66F(0xb4),'description':a66F(0xc1),'examples':[a66F(0x96)]},function(a,b){return __awaiter(this,void 0x0,void 0x0,function*(){const G=a66d;try{const c=this[G(0xa1)][G(0xa7)]();this[G(0xa1)][G(0xaa)](c,()=>__awaiter(this,void 0x0,void 0x0,function*(){const H=G;if(H(0xab)===H(0xab)){const d=this[H(0xa1)][H(0xb5)]({}),f=paramCase(b[H(0xb0)]),g=paramCase(b['resourceName']);if(!b['type']){const k={'type':H(0xc0),'name':H(0xc9),'message':H(0xa4),'choices':[{'name':H(0xc6),'value':H(0x90)}]},{serviceAnswer:l}=yield Actions[H(0xbd)](k);if(l){if(H(0x8e)!=='mtUiE')b[H(0xb6)]=l;else try{i(j[H(0x88)](k));}catch(o){m(o);}}}const h={'name':pascalCase(b[H(0xb0)]),'fileName':f,'camelCase':camelCase(b['resourceName']),'type':b[H(0xb6)],'engine':c[H(0x99)]['js'],'noRename':!![]};let i='js';c[H(0x99)]['js']===H(0xbe)&&(i='ts');let j=[H(0x90)];if(j[H(0xc7)](h[H(0xb6)])<0x0){let n=h[H(0xb6)]?h[H(0xb6)]:H(0x9f);Log[H(0x87)]('Invalid\x20type\x20'+n+H(0xc8));return;}if(b['type']===H(0x90)){!this['fsi'][H(0xb1)](H(0x95))&&(Log['warn']('Verifying\x20npm\x20package\x20requirements:\x20winston\x20...'),yield this[H(0xa1)][H(0xa3)](H(0x94),{'cwd':d}));!this[H(0xa1)][H(0xad)](H(0x89))&&(Log[H(0x9c)]('Verifying\x20meteor\x20package\x20requirements:\x20mongo\x20...'),yield this['fsi']['installMeteorPackage'](H(0x89),{'cwd':d}));let o=this[H(0xa1)]['pathFromApp']({'pathParts':[H(0xb2),'startup','lib',H(0xcc),f+'.'+i]});this[H(0xa1)][H(0x8c)]({'srcPath':'service/logger/logger.js','destPath':o,'context':h,'config':c});const p=a66u[H(0xa6)](H(0xa2));p&&('pRnsi'!==H(0x97)?d(e[H(0x9a)](f)):yield p['invoke']([g],{'where':H(0xba),'appPathPrefix':'lib','dir':''}));let q=this['fsi'][H(0xc3)]({'pathParts':[o]});const r=this[H(0xa1)][H(0xc3)]({'pathParts':[H(0x93)]});this[H(0xa1)][H(0xcb)]({'filePath':q,'content':H(0xaf)+r+'\x27;'});let s=this['fsi'][H(0xb5)]({'pathParts':[H(0xb2),H(0xbb),H(0xa0),H(0xcc),'logger-transports.'+i]});this[H(0xa1)][H(0x8c)]({'srcPath':H(0xa9),'destPath':s,'context':h,'config':c});let t=this[H(0xa1)][H(0xc3)]({'pathParts':[s]});const u=this['fsi'][H(0xc3)]({'pathParts':[H(0xac)]});this[H(0xa1)][H(0xcb)]({'filePath':t,'content':'import\x20Logs\x20from\x20\x27'+u+'\x27;'});}}else{const x=d[H(0x92)](e,arguments);return f=null,x;}}));}catch(d){Log[G(0x87)](d);}});});

package/dist/maka.js

@@ -1,2 +1,2 @@
 #!/usr/bin/env node --experimental-modules --no-warnings --experimental-json-modules
-const a67C=a67d;(function(a,b){const z=a67d,c=a();while(!![]){try{const d=-parseInt(z(0x192))/0x1+parseInt(z(0x18c))/0x2+-parseInt(z(0x18f))/0x3*(parseInt(z(0x194))/0x4)+parseInt(z(0x190))/0x5+-parseInt(z(0x197))/0x6*(-parseInt(z(0x185))/0x7)+parseInt(z(0x18b))/0x8*(-parseInt(z(0x198))/0x9)+parseInt(z(0x187))/0xa;if(d===b)break;else c['push'](c['shift']());}catch(e){c['push'](c['shift']());}}}(a67c,0xa4a1b));const a67b=(function(){let a=!![];return function(b,c){const d=a?function(){const A=a67d;if(c){const e=c[A(0x195)](b,arguments);return c=null,e;}}:function(){};return a=![],d;};}()),a67a=a67b(this,function(){const B=a67d;return a67a['toString']()[B(0x186)](B(0x191))[B(0x199)]()['constructor'](a67a)[B(0x186)]('(((.+)+)+)+$');});a67a();import a67u from'minimist';function a67d(a,b){const c=a67c();return a67d=function(d,e){d=d-0x185;let f=c[d];return f;},a67d(a,b);}import a67v from'os';import a67w from'path';import a67x from'humps';import a67y from'./commands/maka.cmd.js';import'./commands/_index.js';import'./generators/_index.js';import{fileURLToPath}from'url';const __filename=fileURLToPath(import.meta[a67C(0x193)]),__dirname=a67w['dirname'](__filename);global[a67C(0x19a)]=__dirname;let total_memory=a67v[a67C(0x19b)](),total_mem_in_kb=total_memory/0x400,total_mem_in_mb=total_mem_in_kb/0x400;total_mem_in_mb=Math['floor'](total_mem_in_mb),process[a67C(0x196)][a67C(0x188)]='--max-old-space-size='+total_mem_in_mb;const argv=a67u(process['argv'][a67C(0x18a)](0x2)),args=argv['_'],deepCopyArgv=JSON[a67C(0x18d)](JSON['stringify'](argv));function a67c(){const D=['apply','env','108KIPOxi','99cDxmTq','toString','MAKA_COMMAND_PATH','totalmem','116284suEYjd','search','6092350ekHSYu','TOOL_NODE_FLAGS','run','slice','324248DLjwvs','1789556DHhcJG','parse','camelizeKeys','6NivKRD','1278670BVkVkc','(((.+)+)+)+$','115089AfIOVa','url','1647004mxinme'];a67c=function(){return D;};return a67c();}delete deepCopyArgv['_'];const opts=a67x[a67C(0x18e)](deepCopyArgv);a67y[a67C(0x189)](args,opts);
+const a67B=a67d;(function(a,b){const z=a67d,c=a();while(!![]){try{const d=-parseInt(z(0xd7))/0x1+-parseInt(z(0xc7))/0x2*(parseInt(z(0xd8))/0x3)+-parseInt(z(0xc8))/0x4*(parseInt(z(0xcc))/0x5)+parseInt(z(0xc2))/0x6*(-parseInt(z(0xbf))/0x7)+parseInt(z(0xd4))/0x8*(parseInt(z(0xd6))/0x9)+parseInt(z(0xce))/0xa+-parseInt(z(0xcb))/0xb*(-parseInt(z(0xd1))/0xc);if(d===b)break;else c['push'](c['shift']());}catch(e){c['push'](c['shift']());}}}(a67c,0xe8b94));const a67b=(function(){let a=!![];return function(b,c){const d=a?function(){if(c){const e=c['apply'](b,arguments);return c=null,e;}}:function(){};return a=![],d;};}()),a67a=a67b(this,function(){const A=a67d;return a67a[A(0xcd)]()[A(0xc1)](A(0xd0))[A(0xcd)]()['constructor'](a67a)[A(0xc1)](A(0xd0));});function a67d(a,b){const c=a67c();return a67d=function(d,e){d=d-0xbd;let f=c[d];return f;},a67d(a,b);}a67a();import a67u from'minimist';function a67c(){const C=['url','2pjBoeC','3088SeFgcg','env','argv','10276145elHtka','8705HuiJJi','toString','15127410xRubpF','--max-old-space-size=','(((.+)+)+)+$','24YBxoMC','MAKA_COMMAND_PATH','slice','8ZXajcj','totalmem','2921733dIjyRU','816580LjqyKZ','933174epGQAS','dirname','parse','982947byroyh','camelizeKeys','search','12tJedLW','floor','TOOL_NODE_FLAGS','run'];a67c=function(){return C;};return a67c();}import a67v from'os';import a67w from'path';import a67x from'humps';import a67y from'./commands/maka.cmd.js';import'./commands/_index.js';import'./generators/_index.js';import{fileURLToPath}from'url';const __filename=fileURLToPath(import.meta[a67B(0xc6)]),__dirname=a67w[a67B(0xbd)](__filename);global[a67B(0xd2)]=__dirname;let total_memory=a67v[a67B(0xd5)](),total_mem_in_kb=total_memory/0x400,total_mem_in_mb=total_mem_in_kb/0x400;total_mem_in_mb=Math[a67B(0xc3)](total_mem_in_mb),process[a67B(0xc9)][a67B(0xc4)]=a67B(0xcf)+total_mem_in_mb;const argv=a67u(process[a67B(0xca)][a67B(0xd3)](0x2)),args=argv['_'],deepCopyArgv=JSON[a67B(0xbe)](JSON['stringify'](argv));delete deepCopyArgv['_'];const opts=a67x[a67B(0xc0)](deepCopyArgv);a67y[a67B(0xc5)](args,opts);

package/dist/templates/meteor/app/client/head.html

@@ -11,15 +11,4 @@
   <noscript>
     Please enable JavaScript
   </noscript>
-  <script type="text/javascript">
-  window.onbeforeunload = closingCode;
-  function closingCode(){
-    if (Meteor.settings.public.logoutOnClose === true && Meteor.logout) Meteor.logout();
-    return null;
-  }
-  // stop ios bounce and zoom
-  document.ontouchmove = event => {
-    event.preventDefault();
-  };
-  </script>
 </head>

package/dist/templates/meteor/app/client/main.js

@@ -1 +1,13 @@
+window.onbeforeunload = () => {
+  if (Meteor.settings.public.logoutOnClose === true && Meteor.logout) {
+    Meteor.logout();
+  }
+  return null;
+}
+
+// stop ios bounce and zoom
+document.ontouchmove = event => {
+  event.preventDefault();
+};
+
 import '/imports/startup/client';

package/dist/templates/meteor/app/client/main.js.jsx

@@ -1 +1,13 @@
+window.onbeforeunload = () => {
+  if (Meteor.settings.public.logoutOnClose === true && Meteor.logout) {
+    Meteor.logout();
+  }
+  return null;
+}
+
+// stop ios bounce and zoom
+document.ontouchmove = event => {
+  event.preventDefault();
+};
+
 import '/imports/startup/client/index.jsx';

package/dist/templates/meteor/app/client/main.js.ts

@@ -1 +1,13 @@
+window.onbeforeunload = () => {
+  if (Meteor.settings.public.logoutOnClose === true && Meteor.logout) {
+    Meteor.logout();
+  }
+  return null;
+}
+
+// stop ios bounce and zoom
+document.ontouchmove = event => {
+  event.preventDefault();
+};
+
 import '/imports/startup/client';

package/dist/templates/meteor/app/client/main.js.tsx

@@ -1 +1,13 @@
+window.onbeforeunload = () => {
+  if (Meteor.settings.public.logoutOnClose === true && Meteor.logout) {
+    Meteor.logout();
+  }
+  return null;
+}
+
+// stop ios bounce and zoom
+document.ontouchmove = event => {
+  event.preventDefault();
+};
+
 import '/imports/startup/client/index';

package/dist/templates/meteor/app/server/helmet-csp.js

@@ -0,0 +1,145 @@
+/*
+ * Content Security Policy (CSP)
+ * https://guide.meteor.com/security.html#httpheaders
+ */
+
+/* global __meteor_runtime_config__ */
+import { Meteor } from 'meteor/meteor'
+import { WebApp } from 'meteor/webapp'
+import { Autoupdate } from 'meteor/autoupdate'
+import crypto from 'crypto'
+
+const self = '\'self\''
+const data = 'data:'
+const unsafeEval = '\'unsafe-eval\''
+const unsafeInline = '\'unsafe-inline\''
+const allowedOrigins = Meteor.settings.extraAllowedOrigins;
+
+// create the default connect source for our current domain in
+// a multi-protocol compatible way (http/ws or https/wss)
+const url = Meteor.absoluteUrl()
+const domain = url.replace(/http(s)*:\/\//, '').replace(/\/$/, '')
+const s = url.match(/(?!=http)s(?=:\/\/)/) ? 's' : ''
+const usesHttps = s.length > 0
+const connectSrc = [
+  self,
+  `http${s}://${domain}`,
+  `ws${s}://${domain}`
+]
+
+// Prepare runtime config for generating the sha256 hash
+// It is important, that the hash meets exactly the hash of the
+// script in the client bundle.
+// Otherwise the app would not be able to start, since the runtimeConfigScript
+// is rejected __meteor_runtime_config__ is not available, causing
+// a cascade of follow-up errors.
+const runtimeConfig = Object.assign(__meteor_runtime_config__, Autoupdate, {
+  // the following lines may depend on, whether you called Accounts.config
+  // and whether your Meteor app is a "newer" version
+  accountsConfigCalled: true,
+  isModern: true
+})
+
+// add client versions to __meteor_runtime_config__
+Object.keys(WebApp.clientPrograms).forEach(arch => {
+  __meteor_runtime_config__.versions[arch] = {
+    version: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].version(),
+    versionRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionRefreshable(),
+    versionNonRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionNonRefreshable(),
+    // comment the following line if you use Meteor < 2.0
+    versionReplaceable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionReplaceable()
+  }
+})
+
+const runtimeConfigScript = `__meteor_runtime_config__ = JSON.parse(decodeURIComponent("${encodeURIComponent(JSON.stringify(runtimeConfig))}"))`
+const runtimeConfigHash = crypto.createHash('sha256').update(runtimeConfigScript).digest('base64')
+
+const helmetOptions = {
+  contentSecurityPolicy: {
+    blockAllMixedContent: true,
+    directives: {
+      defaultSrc: [self],
+      scriptSrc: [
+        self,
+        // Remove / comment out unsafeEval if you do not use dynamic imports
+        // to tighten security. However, if you use dynamic imports this line
+        // must be kept in order to make them work.
+        unsafeEval,
+        `'sha256-${runtimeConfigHash}'`
+      ],
+      childSrc: [self],
+      // If you have external apps, that should be allowed as sources for
+      // connections or images, your should add them here
+      // Call helmetOptions() without args if you have no external sources
+      // Note, that this is just an example and you may configure this to your needs
+      connectSrc: connectSrc.concat(allowedOrigins),
+      fontSrc: [self, data],
+      formAction: [self],
+      frameAncestors: [self],
+      frameSrc: ['*'],
+      // This is an example to show, that we can define to show images only
+      // from our self, browser data/blob and a defined set of hosts.
+      // Configure to your needs.
+      imgSrc: [self, data, 'blob:'].concat(allowedOrigins),
+      manifestSrc: [self],
+      mediaSrc: [self],
+      objectSrc: [self],
+      // these are just examples, configure to your needs, see
+      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
+      sandbox: [
+        // allow-downloads-without-user-activation // experimental
+        'allow-forms',
+        'allow-modals',
+        // 'allow-orientation-lock',
+        // 'allow-pointer-lock',
+        // 'allow-popups',
+        // 'allow-popups-to-escape-sandbox',
+        // 'allow-presentation',
+        'allow-same-origin',
+        'allow-scripts',
+        // 'allow-storage-access-by-user-activation ', // experimental
+        // 'allow-top-navigation',
+        // 'allow-top-navigation-by-user-activation'
+      ],
+      styleSrc: [self, unsafeInline],
+      workerSrc: [self, 'blob:']
+    }
+  },
+  // see the helmet documentation to get a better understanding of
+  // the following configurations and settings
+  strictTransportSecurity: {
+    maxAge: 15552000,
+    includeSubDomains: true,
+    preload: false
+  },
+  referrerPolicy: {
+    policy: 'no-referrer'
+  },
+  expectCt: {
+    enforce: true,
+    maxAge: 604800
+  },
+  frameguard: {
+    action: 'sameorigin'
+  },
+  dnsPrefetchControl: {
+    allow: false
+  },
+  permittedCrossDomainPolicies: {
+    permittedPolicies: 'none'
+  }
+}
+
+// We assume, that we are working on a localhost when there is no https
+// connection available.
+// Run your project with --production flag to simulate script-src hashing
+if (!usesHttps && Meteor.isDevelopment) {
+  delete helmetOptions.contentSecurityPolicy.blockAllMixedContent;
+  helmetOptions.contentSecurityPolicy.directives.scriptSrc = [
+    self,
+    unsafeEval,
+    unsafeInline,
+  ];
+}
+
+export default helmetOptions;

package/dist/templates/meteor/app/server/helmet-csp.js.jsx

@@ -0,0 +1,145 @@
+/*
+ * Content Security Policy (CSP)
+ * https://guide.meteor.com/security.html#httpheaders
+ */
+
+/* global __meteor_runtime_config__ */
+import { Meteor } from 'meteor/meteor'
+import { WebApp } from 'meteor/webapp'
+import { Autoupdate } from 'meteor/autoupdate'
+import crypto from 'crypto'
+
+const self = '\'self\''
+const data = 'data:'
+const unsafeEval = '\'unsafe-eval\''
+const unsafeInline = '\'unsafe-inline\''
+const allowedOrigins = Meteor.settings.extraAllowedOrigins;
+
+// create the default connect source for our current domain in
+// a multi-protocol compatible way (http/ws or https/wss)
+const url = Meteor.absoluteUrl()
+const domain = url.replace(/http(s)*:\/\//, '').replace(/\/$/, '')
+const s = url.match(/(?!=http)s(?=:\/\/)/) ? 's' : ''
+const usesHttps = s.length > 0
+const connectSrc = [
+  self,
+  `http${s}://${domain}`,
+  `ws${s}://${domain}`
+]
+
+// Prepare runtime config for generating the sha256 hash
+// It is important, that the hash meets exactly the hash of the
+// script in the client bundle.
+// Otherwise the app would not be able to start, since the runtimeConfigScript
+// is rejected __meteor_runtime_config__ is not available, causing
+// a cascade of follow-up errors.
+const runtimeConfig = Object.assign(__meteor_runtime_config__, Autoupdate, {
+  // the following lines may depend on, whether you called Accounts.config
+  // and whether your Meteor app is a "newer" version
+  accountsConfigCalled: true,
+  isModern: true
+})
+
+// add client versions to __meteor_runtime_config__
+Object.keys(WebApp.clientPrograms).forEach(arch => {
+  __meteor_runtime_config__.versions[arch] = {
+    version: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].version(),
+    versionRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionRefreshable(),
+    versionNonRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionNonRefreshable(),
+    // comment the following line if you use Meteor < 2.0
+    versionReplaceable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionReplaceable()
+  }
+})
+
+const runtimeConfigScript = `__meteor_runtime_config__ = JSON.parse(decodeURIComponent("${encodeURIComponent(JSON.stringify(runtimeConfig))}"))`
+const runtimeConfigHash = crypto.createHash('sha256').update(runtimeConfigScript).digest('base64')
+
+const helmetOptions = {
+  contentSecurityPolicy: {
+    blockAllMixedContent: true,
+    directives: {
+      defaultSrc: [self],
+      scriptSrc: [
+        self,
+        // Remove / comment out unsafeEval if you do not use dynamic imports
+        // to tighten security. However, if you use dynamic imports this line
+        // must be kept in order to make them work.
+        unsafeEval,
+        `'sha256-${runtimeConfigHash}'`
+      ],
+      childSrc: [self],
+      // If you have external apps, that should be allowed as sources for
+      // connections or images, your should add them here
+      // Call helmetOptions() without args if you have no external sources
+      // Note, that this is just an example and you may configure this to your needs
+      connectSrc: connectSrc.concat(allowedOrigins),
+      fontSrc: [self, data],
+      formAction: [self],
+      frameAncestors: [self],
+      frameSrc: ['*'],
+      // This is an example to show, that we can define to show images only
+      // from our self, browser data/blob and a defined set of hosts.
+      // Configure to your needs.
+      imgSrc: [self, data, 'blob:'].concat(allowedOrigins),
+      manifestSrc: [self],
+      mediaSrc: [self],
+      objectSrc: [self],
+      // these are just examples, configure to your needs, see
+      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
+      sandbox: [
+        // allow-downloads-without-user-activation // experimental
+        'allow-forms',
+        'allow-modals',
+        // 'allow-orientation-lock',
+        // 'allow-pointer-lock',
+        // 'allow-popups',
+        // 'allow-popups-to-escape-sandbox',
+        // 'allow-presentation',
+        'allow-same-origin',
+        'allow-scripts',
+        // 'allow-storage-access-by-user-activation ', // experimental
+        // 'allow-top-navigation',
+        // 'allow-top-navigation-by-user-activation'
+      ],
+      styleSrc: [self, unsafeInline],
+      workerSrc: [self, 'blob:']
+    }
+  },
+  // see the helmet documentation to get a better understanding of
+  // the following configurations and settings
+  strictTransportSecurity: {
+    maxAge: 15552000,
+    includeSubDomains: true,
+    preload: false
+  },
+  referrerPolicy: {
+    policy: 'no-referrer'
+  },
+  expectCt: {
+    enforce: true,
+    maxAge: 604800
+  },
+  frameguard: {
+    action: 'sameorigin'
+  },
+  dnsPrefetchControl: {
+    allow: false
+  },
+  permittedCrossDomainPolicies: {
+    permittedPolicies: 'none'
+  }
+}
+
+// We assume, that we are working on a localhost when there is no https
+// connection available.
+// Run your project with --production flag to simulate script-src hashing
+if (!usesHttps && Meteor.isDevelopment) {
+  delete helmetOptions.contentSecurityPolicy.blockAllMixedContent;
+  helmetOptions.contentSecurityPolicy.directives.scriptSrc = [
+    self,
+    unsafeEval,
+    unsafeInline,
+  ];
+}
+
+export default helmetOptions;

package/dist/templates/meteor/app/server/helmet-csp.js.ts

@@ -0,0 +1,145 @@
+/*
+ * Content Security Policy (CSP)
+ * https://guide.meteor.com/security.html#httpheaders
+ */
+
+/* global __meteor_runtime_config__ */
+import { Meteor } from 'meteor/meteor'
+import { WebApp } from 'meteor/webapp'
+import { Autoupdate } from 'meteor/autoupdate'
+import crypto from 'crypto'
+
+const self = '\'self\''
+const data = 'data:'
+const unsafeEval = '\'unsafe-eval\''
+const unsafeInline = '\'unsafe-inline\''
+const allowedOrigins = Meteor.settings.extraAllowedOrigins;
+
+// create the default connect source for our current domain in
+// a multi-protocol compatible way (http/ws or https/wss)
+const url = Meteor.absoluteUrl()
+const domain = url.replace(/http(s)*:\/\//, '').replace(/\/$/, '')
+const s = url.match(/(?!=http)s(?=:\/\/)/) ? 's' : ''
+const usesHttps = s.length > 0
+const connectSrc = [
+  self,
+  `http${s}://${domain}`,
+  `ws${s}://${domain}`
+]
+
+// Prepare runtime config for generating the sha256 hash
+// It is important, that the hash meets exactly the hash of the
+// script in the client bundle.
+// Otherwise the app would not be able to start, since the runtimeConfigScript
+// is rejected __meteor_runtime_config__ is not available, causing
+// a cascade of follow-up errors.
+const runtimeConfig = Object.assign(__meteor_runtime_config__, Autoupdate, {
+  // the following lines may depend on, whether you called Accounts.config
+  // and whether your Meteor app is a "newer" version
+  accountsConfigCalled: true,
+  isModern: true
+})
+
+// add client versions to __meteor_runtime_config__
+Object.keys(WebApp.clientPrograms).forEach(arch => {
+  __meteor_runtime_config__.versions[arch] = {
+    version: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].version(),
+    versionRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionRefreshable(),
+    versionNonRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionNonRefreshable(),
+    // comment the following line if you use Meteor < 2.0
+    versionReplaceable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionReplaceable()
+  }
+})
+
+const runtimeConfigScript = `__meteor_runtime_config__ = JSON.parse(decodeURIComponent("${encodeURIComponent(JSON.stringify(runtimeConfig))}"))`
+const runtimeConfigHash = crypto.createHash('sha256').update(runtimeConfigScript).digest('base64')
+
+const helmetOptions = {
+  contentSecurityPolicy: {
+    blockAllMixedContent: true,
+    directives: {
+      defaultSrc: [self],
+      scriptSrc: [
+        self,
+        // Remove / comment out unsafeEval if you do not use dynamic imports
+        // to tighten security. However, if you use dynamic imports this line
+        // must be kept in order to make them work.
+        unsafeEval,
+        `'sha256-${runtimeConfigHash}'`
+      ],
+      childSrc: [self],
+      // If you have external apps, that should be allowed as sources for
+      // connections or images, your should add them here
+      // Call helmetOptions() without args if you have no external sources
+      // Note, that this is just an example and you may configure this to your needs
+      connectSrc: connectSrc.concat(allowedOrigins),
+      fontSrc: [self, data],
+      formAction: [self],
+      frameAncestors: [self],
+      frameSrc: ['*'],
+      // This is an example to show, that we can define to show images only
+      // from our self, browser data/blob and a defined set of hosts.
+      // Configure to your needs.
+      imgSrc: [self, data, 'blob:'].concat(allowedOrigins),
+      manifestSrc: [self],
+      mediaSrc: [self],
+      objectSrc: [self],
+      // these are just examples, configure to your needs, see
+      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
+      sandbox: [
+        // allow-downloads-without-user-activation // experimental
+        'allow-forms',
+        'allow-modals',
+        // 'allow-orientation-lock',
+        // 'allow-pointer-lock',
+        // 'allow-popups',
+        // 'allow-popups-to-escape-sandbox',
+        // 'allow-presentation',
+        'allow-same-origin',
+        'allow-scripts',
+        // 'allow-storage-access-by-user-activation ', // experimental
+        // 'allow-top-navigation',
+        // 'allow-top-navigation-by-user-activation'
+      ],
+      styleSrc: [self, unsafeInline],
+      workerSrc: [self, 'blob:']
+    }
+  },
+  // see the helmet documentation to get a better understanding of
+  // the following configurations and settings
+  strictTransportSecurity: {
+    maxAge: 15552000,
+    includeSubDomains: true,
+    preload: false
+  },
+  referrerPolicy: {
+    policy: 'no-referrer'
+  },
+  expectCt: {
+    enforce: true,
+    maxAge: 604800
+  },
+  frameguard: {
+    action: 'sameorigin'
+  },
+  dnsPrefetchControl: {
+    allow: false
+  },
+  permittedCrossDomainPolicies: {
+    permittedPolicies: 'none'
+  }
+}
+
+// We assume, that we are working on a localhost when there is no https
+// connection available.
+// Run your project with --production flag to simulate script-src hashing
+if (!usesHttps && Meteor.isDevelopment) {
+  delete helmetOptions.contentSecurityPolicy.blockAllMixedContent;
+  helmetOptions.contentSecurityPolicy.directives.scriptSrc = [
+    self,
+    unsafeEval,
+    unsafeInline,
+  ];
+}
+
+export default helmetOptions;