@maka/maka-cli 5.3.12 → 5.3.13

package/bundle/typescript/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maka/maka-cli",
-  "version": "5.3.12",
+  "version": "5.3.13",
   "type": "module",
   "summary": "A command line tool for scaffolding Meteor 2.x applications using either React.",
   "description": "A command line tool for scaffolding Meteor 2.x applications using React.",

package/bundle/typescript/src/templates/meteor/app/maka.d.ts

@@ -2,6 +2,24 @@ interface Window { cordova: any; }
 
 declare module "*.css";
 
+// Meteor's server-injected runtime config global. Genuinely undocumented --
+// not part of @types/meteor's app-facing API coverage.
+declare var __meteor_runtime_config__: any;
+
+// No official types; not covered by @types/meteor.
+declare module 'meteor/autoupdate' {
+  export const Autoupdate: any;
+}
+
+// Adds the one real WebApp member @types/meteor doesn't have yet. This
+// merges additively with @types/meteor's own `declare module "meteor/webapp"`
+// -- it must not redeclare anything already defined there.
+declare module 'meteor/webapp' {
+  namespace WebApp {
+    function addHtmlAttributeHook(callback: (request?: any) => Record<string, string>): void;
+  }
+}
+
 declare module 'meteor/maka:http' {
     export const HTTP: {
     /**
@@ -149,10 +167,18 @@ declare module 'meteor/maka:http' {
 
 declare module 'meteor/maka:rest' {
   import { IncomingMessage, ServerResponse } from 'http';
-  import { RateLimiterMemory, RateLimiterRedis, IRateLimiterOptions } from 'rate-limiter-flexible';
-  import { RedisClientType } from '@redis/client';
   import { Meteor } from 'meteor/meteor';
 
+  // rate-limiter-flexible and @redis/client are optional peer packages used
+  // only by maka:rest's rate-limiting feature -- they're bundled by the
+  // Meteor package itself, not something every app needs to npm install
+  // just to typecheck. Typed as `any` rather than pulling those packages in
+  // as devDependencies for every scaffolded project.
+  type IRateLimiterOptions = any;
+  type RateLimiterMemory = any;
+  type RateLimiterRedis = any;
+  type RedisClientType = any;
+
   export type LoginType = 'default' | null;
 
   export interface MakaRestOptions {

package/bundle/typescript/src/templates/meteor/app/server/helmet-csp.js.ts

@@ -8,6 +8,7 @@ import { Meteor } from 'meteor/meteor'
 import { WebApp } from 'meteor/webapp'
 import { Autoupdate } from 'meteor/autoupdate'
 import crypto from 'crypto'
+import type { HelmetOptions } from 'helmet'
 
 const self = '\'self\''
 const data = 'data:'
@@ -42,13 +43,18 @@ const runtimeConfig = Object.assign(__meteor_runtime_config__, Autoupdate, {
 })
 
 // add client versions to __meteor_runtime_config__
+// clientProgram is typed `any` here: @types/meteor's WebApp.clientPrograms
+// shape only documents `version` as a plain string, but Meteor's real
+// runtime object also carries the versionRefreshable/versionNonRefreshable/
+// versionReplaceable accessor methods used below.
 Object.keys(WebApp.clientPrograms).forEach(arch => {
+  const clientProgram: any = WebApp.clientPrograms[arch];
   __meteor_runtime_config__.versions[arch] = {
-    version: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].version(),
-    versionRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionRefreshable(),
-    versionNonRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionNonRefreshable(),
+    version: Autoupdate.autoupdateVersion || clientProgram.version(),
+    versionRefreshable: Autoupdate.autoupdateVersion || clientProgram.versionRefreshable(),
+    versionNonRefreshable: Autoupdate.autoupdateVersion || clientProgram.versionNonRefreshable(),
     // comment the following line if you use Meteor < 2.0
-    versionReplaceable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionReplaceable()
+    versionReplaceable: Autoupdate.autoupdateVersion || clientProgram.versionReplaceable()
   }
 })
 
@@ -62,7 +68,6 @@ const helmetOptions = {
   //If this is truu, site's won't be able to link to you
   crossOriginEmbedderPolicy: false,
   contentSecurityPolicy: {
-    blockAllMixedContent: true,
     directives: {
       defaultSrc: [self].concat(allowedOrigins),
       scriptSrc: [
@@ -121,10 +126,6 @@ const helmetOptions = {
   referrerPolicy: {
     policy: 'no-referrer'
   },
-  expectCt: {
-    enforce: true,
-    maxAge: 604800
-  },
   frameguard: {
     action: 'sameorigin'
   },
@@ -134,13 +135,12 @@ const helmetOptions = {
   permittedCrossDomainPolicies: {
     permittedPolicies: 'none'
   }
-};
+} satisfies HelmetOptions;
 
 // We assume, that we are working on a localhost when there is no https
 // connection available.
 // Run your project with --production flag to simulate script-src hashing
 if (!usesHttps && Meteor.isDevelopment && devAllowedOrigins) {
-  delete helmetOptions.contentSecurityPolicy.blockAllMixedContent;
   helmetOptions.contentSecurityPolicy.directives.scriptSrc = [
     self,
     devAllowedOrigins.join(' '),
@@ -173,7 +173,7 @@ if (!usesHttps && Meteor.isDevelopment && devAllowedOrigins) {
     unsafeInline,
   ];
 
-  helmetOptions.contentSecurityPolicy.directives['script-src-attr'] = null;
+  (helmetOptions.contentSecurityPolicy.directives as Record<string, any>)['script-src-attr'] = null;
 }
 
 export default helmetOptions;

package/bundle/typescript/src/templates/meteor/app/server/helmet-csp.js.tsx

@@ -8,6 +8,7 @@ import { Meteor } from 'meteor/meteor'
 import { WebApp } from 'meteor/webapp'
 import { Autoupdate } from 'meteor/autoupdate'
 import crypto from 'crypto'
+import type { HelmetOptions } from 'helmet'
 
 const self = '\'self\''
 const data = 'data:'
@@ -42,13 +43,18 @@ const runtimeConfig = Object.assign(__meteor_runtime_config__, Autoupdate, {
 })
 
 // add client versions to __meteor_runtime_config__
+// clientProgram is typed `any` here: @types/meteor's WebApp.clientPrograms
+// shape only documents `version` as a plain string, but Meteor's real
+// runtime object also carries the versionRefreshable/versionNonRefreshable/
+// versionReplaceable accessor methods used below.
 Object.keys(WebApp.clientPrograms).forEach(arch => {
+  const clientProgram: any = WebApp.clientPrograms[arch];
   __meteor_runtime_config__.versions[arch] = {
-    version: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].version(),
-    versionRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionRefreshable(),
-    versionNonRefreshable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionNonRefreshable(),
+    version: Autoupdate.autoupdateVersion || clientProgram.version(),
+    versionRefreshable: Autoupdate.autoupdateVersion || clientProgram.versionRefreshable(),
+    versionNonRefreshable: Autoupdate.autoupdateVersion || clientProgram.versionNonRefreshable(),
     // comment the following line if you use Meteor < 2.0
-    versionReplaceable: Autoupdate.autoupdateVersion || WebApp.clientPrograms[arch].versionReplaceable()
+    versionReplaceable: Autoupdate.autoupdateVersion || clientProgram.versionReplaceable()
   }
 })
 
@@ -62,7 +68,6 @@ const helmetOptions = {
   //If this is truu, site's won't be able to link to you
   crossOriginEmbedderPolicy: false,
   contentSecurityPolicy: {
-    blockAllMixedContent: true,
     directives: {
       defaultSrc: [self].concat(allowedOrigins),
       scriptSrc: [
@@ -121,10 +126,6 @@ const helmetOptions = {
   referrerPolicy: {
     policy: 'no-referrer'
   },
-  expectCt: {
-    enforce: true,
-    maxAge: 604800
-  },
   frameguard: {
     action: 'sameorigin'
   },
@@ -134,13 +135,12 @@ const helmetOptions = {
   permittedCrossDomainPolicies: {
     permittedPolicies: 'none'
   }
-};
+} satisfies HelmetOptions;
 
 // We assume, that we are working on a localhost when there is no https
 // connection available.
 // Run your project with --production flag to simulate script-src hashing
 if (!usesHttps && Meteor.isDevelopment && devAllowedOrigins) {
-  delete helmetOptions.contentSecurityPolicy.blockAllMixedContent;
   helmetOptions.contentSecurityPolicy.directives.scriptSrc = [
     self,
     devAllowedOrigins.join(' '),
@@ -173,7 +173,7 @@ if (!usesHttps && Meteor.isDevelopment && devAllowedOrigins) {
     unsafeInline,
   ];
 
-  helmetOptions.contentSecurityPolicy.directives['script-src-attr'] = null;
+  (helmetOptions.contentSecurityPolicy.directives as Record<string, any>)['script-src-attr'] = null;
 }
 
 export default helmetOptions;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maka/maka-cli",
-  "version": "5.3.12",
+  "version": "5.3.13",
   "type": "module",
   "summary": "A command line tool for scaffolding Meteor 2.x applications using either React.",
   "description": "A command line tool for scaffolding Meteor 2.x applications using React.",