@mouryaamit/nx-polystack 0.0.0-stage → 1.0.1

package/dist/src/generators/shared-libs/generator.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const devkit_1 = require("@nx/devkit");
+const project_json_files_1 = require("../../lib/utils/project-json-files");
+const shared_libs_1 = require("../../lib/utils/shared-libs");
+/** Creates the shared assets/styles folders when missing and wires them into Angular/Ionic apps. */
+async function sharedLibsGenerator(tree, options) {
+    const named = (options.projects ?? []).map((p) => p.trim()).filter(Boolean);
+    if (!!options.all === named.length > 0) {
+        throw new Error('shared-libs generator: name the apps (projects) or pass all, one of them.');
+    }
+    const projects = (0, project_json_files_1.readProjects)(tree);
+    const apps = projects.filter((p) => p.json['projectType'] === 'application' && (0, shared_libs_1.angularBuildTargetOf)(p.json));
+    const problems = [];
+    const selected = options.all
+        ? apps
+        : named.map((name) => {
+            const p = projects.find((x) => x.name === name);
+            if (!p)
+                problems.push(`${name}: no such project`);
+            else if (!apps.includes(p))
+                problems.push(`${name}: not an Angular/Ionic app`);
+            return p;
+        });
+    if (problems.length > 0)
+        throw new Error(`shared-libs generator: ${problems.join('; ')}.`);
+    if (selected.length === 0) {
+        devkit_1.logger.info('No Angular/Ionic apps found; nothing to wire.');
+        return;
+    }
+    const libs = (0, shared_libs_1.ensureSharedLibs)(tree);
+    for (const file of libs.created)
+        devkit_1.logger.info(`created ${file}`);
+    for (const note of libs.notes)
+        devkit_1.logger.info(`Note: ${note}`);
+    const wired = [];
+    const already = [];
+    for (const p of selected) {
+        if (!p)
+            continue;
+        const json = p.json;
+        const build = (0, shared_libs_1.angularBuildTargetOf)(json);
+        if ((0, shared_libs_1.wireSharedLibs)(json, build, libs)) {
+            tree.write(`${p.root}/project.json`, JSON.stringify(json, null, 2) + '\n');
+            wired.push(p.name);
+        }
+        else {
+            already.push(p.name);
+        }
+    }
+    if (wired.length > 0) {
+        devkit_1.logger.info(`shared assets (${libs.assets.dir} → assets/shared/) and styles (${libs.styles.dir}, ` +
+            `@use 'theme';) wired into ${wired.join(', ')}.`);
+    }
+    if (already.length > 0)
+        devkit_1.logger.info(`already wired: ${already.join(', ')}.`);
+    await (0, devkit_1.formatFiles)(tree);
+}
+exports.default = sharedLibsGenerator;
+//# sourceMappingURL=generator.js.map

package/dist/src/generators/shared-libs/generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../../../src/generators/shared-libs/generator.ts"],"names":[],"mappings":";;AAAA,uCAAuD;AAEvD,2EAAkE;AAClE,6DAIqC;AAIrC,oGAAoG;AACrF,KAAK,UAAU,mBAAmB,CAC/C,IAAU,EACV,OAAkC;IAElC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;QACtC,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;KAC9F;IACD,MAAM,QAAQ,GAAG,IAAA,iCAAY,EAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,aAAa,IAAI,IAAA,kCAAoB,EAAC,CAAC,CAAC,IAAI,CAAC,CAC/E,CAAC;IAEF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG;QAC1B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACjB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;iBAC7C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,4BAA4B,CAAC,CAAC;YAC/E,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;IACP,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE;QACzB,eAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC7D,OAAO;KACR;IAED,MAAM,IAAI,GAAG,IAAA,8BAAgB,EAAC,IAAI,CAAC,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO;QAAE,eAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;QAAE,eAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE;QACxB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACpB,MAAM,KAAK,GAAG,IAAA,kCAAoB,EAAC,IAAI,CAAE,CAAC;QAC1C,IAAI,IAAA,4BAAc,EAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE;YACrC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3E,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACpB;aAAM;YACL,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACtB;KACF;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;QACpB,eAAM,CAAC,IAAI,CACT,kBAAkB,IAAI,CAAC,MAAM,CAAC,GAAG,kCAAkC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI;YACpF,6BAA6B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnD,CAAC;KACH;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,eAAM,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7E,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AArDD,sCAqDC"}

package/dist/src/generators/shared-libs/schema.d.ts

@@ -0,0 +1,6 @@
+export interface SharedLibsGeneratorSchema {
+  /** Angular/Ionic apps to wire. Either this or all. */
+  projects?: string[];
+  /** Wire every Angular/Ionic app. */
+  all?: boolean;
+}

package/dist/src/generators/shared-libs/schema.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "http://json-schema.org/schema",
+  "cli": "nx",
+  "id": "shared-libs",
+  "title": "Shared assets and styles",
+  "description": "Create libs/shared/assets and libs/shared/styles when missing (a workspace's libs/assets and libs/styles are used when present) and wire them into Angular/Ionic apps: build assets under assets/shared/, the Sass include path, implicitDependencies.",
+  "type": "object",
+  "properties": {
+    "projects": {
+      "type": "array",
+      "items": { "type": "string" },
+      "description": "Angular/Ionic apps to wire. Either this or all."
+    },
+    "all": {
+      "type": "boolean",
+      "default": false,
+      "description": "Wire every Angular/Ionic app."
+    }
+  },
+  "required": []
+}

package/dist/src/index.d.ts

@@ -0,0 +1,16 @@
+export * from './lib/utils/ci-resolve';
+export * from './lib/utils/npm-scripts';
+export * from './lib/utils/ts-paths';
+export * from './lib/utils/env-files';
+export * from './lib/utils/nx-targets';
+export * from './lib/utils/filesystem';
+export * from './lib/helpers/encrypt-env';
+export * from './lib/helpers/inject-meta';
+export * from './lib/helpers/inject-nonce';
+export * from './lib/helpers/inject-sri';
+export * from './lib/helpers/strip-exif';
+export type { FlutterBuildExecutorSchema } from './executors/flutter-build/schema.d';
+export type { FlutterExportExecutorSchema } from './executors/flutter-export/schema.d';
+export type { AppGeneratorSchema } from './generators/app/schema.d';
+export type { EnvGeneratorSchema } from './generators/env/schema.d';
+export type { LlmGeneratorSchema } from './generators/llm/schema.d';

package/dist/src/index.js

@@ -0,0 +1,20 @@
+"use strict";
+// Public API barrel for @mouryaamit/nx-polystack.
+// Generators and executors are referenced via generators.json / executors.json.
+// This barrel exports the helper utilities a consumer may import directly.
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+// Utils
+tslib_1.__exportStar(require("./lib/utils/ci-resolve"), exports);
+tslib_1.__exportStar(require("./lib/utils/npm-scripts"), exports);
+tslib_1.__exportStar(require("./lib/utils/ts-paths"), exports);
+tslib_1.__exportStar(require("./lib/utils/env-files"), exports);
+tslib_1.__exportStar(require("./lib/utils/nx-targets"), exports);
+tslib_1.__exportStar(require("./lib/utils/filesystem"), exports);
+// Helpers (build pipeline)
+tslib_1.__exportStar(require("./lib/helpers/encrypt-env"), exports);
+tslib_1.__exportStar(require("./lib/helpers/inject-meta"), exports);
+tslib_1.__exportStar(require("./lib/helpers/inject-nonce"), exports);
+tslib_1.__exportStar(require("./lib/helpers/inject-sri"), exports);
+tslib_1.__exportStar(require("./lib/helpers/strip-exif"), exports);
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA,kDAAkD;AAClD,gFAAgF;AAChF,2EAA2E;;;AAE3E,QAAQ;AACR,iEAAuC;AACvC,kEAAwC;AACxC,+DAAqC;AACrC,gEAAsC;AACtC,iEAAuC;AACvC,iEAAuC;AAEvC,2BAA2B;AAC3B,oEAA0C;AAC1C,oEAA0C;AAC1C,qEAA2C;AAC3C,mEAAyC;AACzC,mEAAyC"}

package/dist/src/lib/csp/allowlist.d.ts

@@ -0,0 +1,64 @@
+/** Directives an app may extend in csp-allowlist.json, and what each starts from. */
+export declare const CSP_DIRECTIVES: {
+    readonly 'script-src': {
+        readonly base: readonly ["'self'", "'nonce-{N}'"];
+        readonly always: true;
+    };
+    readonly 'style-src': {
+        readonly base: readonly ["'self'", "'nonce-{N}'"];
+        readonly always: true;
+    };
+    readonly 'img-src': {
+        readonly base: readonly ["'self'", "data:"];
+        readonly always: true;
+    };
+    readonly 'font-src': {
+        readonly base: readonly ["'self'", "data:"];
+        readonly always: true;
+    };
+    readonly 'connect-src': {
+        readonly base: readonly ["'self'"];
+        readonly always: true;
+    };
+    readonly 'frame-src': {
+        readonly base: readonly ["'self'"];
+        readonly always: false;
+    };
+    readonly 'media-src': {
+        readonly base: readonly ["'self'"];
+        readonly always: false;
+    };
+    readonly 'worker-src': {
+        readonly base: readonly ["'self'"];
+        readonly always: false;
+    };
+    readonly 'manifest-src': {
+        readonly base: readonly ["'self'"];
+        readonly always: false;
+    };
+    readonly 'form-action': {
+        readonly base: readonly ["'self'"];
+        readonly always: true;
+    };
+    readonly 'frame-ancestors': {
+        readonly base: readonly ["'none'"];
+        readonly always: true;
+    };
+};
+export type CspDirective = keyof typeof CSP_DIRECTIVES;
+export declare const DEFAULT_PERMISSIONS_POLICY = "camera=(), microphone=(), geolocation=()";
+export interface CspAllowlist {
+    sources: Partial<Record<CspDirective, string[]>>;
+    permissionsPolicy: string;
+}
+/** Why a source cannot be used in a directive, or undefined when it can. */
+export declare function sourceProblem(directive: CspDirective, source: string): string | undefined;
+/**
+ * Reads csp-allowlist.json content: { "<directive>": [sources], "permissions-policy": "…" }.
+ * Throws naming the key and source on anything unknown or unsafe.
+ */
+export declare function parseAllowlist(raw: unknown): CspAllowlist;
+/** JSON for the file: directives in table order, then permissions-policy when not the default. */
+export declare function serializeAllowlist(a: CspAllowlist): string;
+/** The CSP with `{N}` where the per-request nonce goes. */
+export declare function buildPolicy(a: CspAllowlist): string;

package/dist/src/lib/csp/allowlist.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildPolicy = exports.serializeAllowlist = exports.parseAllowlist = exports.sourceProblem = exports.DEFAULT_PERMISSIONS_POLICY = exports.CSP_DIRECTIVES = void 0;
+/** Directives an app may extend in csp-allowlist.json, and what each starts from. */
+exports.CSP_DIRECTIVES = {
+    'script-src': { base: ["'self'", "'nonce-{N}'"], always: true },
+    'style-src': { base: ["'self'", "'nonce-{N}'"], always: true },
+    'img-src': { base: ["'self'", 'data:'], always: true },
+    'font-src': { base: ["'self'", 'data:'], always: true },
+    'connect-src': { base: ["'self'"], always: true },
+    'frame-src': { base: ["'self'"], always: false },
+    'media-src': { base: ["'self'"], always: false },
+    'worker-src': { base: ["'self'"], always: false },
+    'manifest-src': { base: ["'self'"], always: false },
+    'form-action': { base: ["'self'"], always: true },
+    'frame-ancestors': { base: ["'none'"], always: true },
+};
+exports.DEFAULT_PERMISSIONS_POLICY = 'camera=(), microphone=(), geolocation=()';
+/** Host sources: https/wss (or no scheme), optional *. prefix, port and a plain path. */
+const HOST = /^(?:(?:https|wss):\/\/)?(?:\*\.)?[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*(?::(?:\d{1,5}|\*))?(?:\/[A-Za-z0-9._~!&()*+=:@/-]*)?$/;
+const SCHEMES = new Set(['https:', 'wss:', 'data:', 'blob:']);
+/** Keywords written without quotes by mistake. */
+const BARE_KEYWORDS = new Set(['self', 'none', 'unsafe-inline', 'unsafe-eval', 'strict-dynamic']);
+/** Characters a Permissions-Policy value may hold (structured fields); `"` is escaped on output. */
+const PERMISSIONS_POLICY = /^[A-Za-z0-9=(),;*:"/. _-]*$/;
+/** Why a source cannot be used in a directive, or undefined when it can. */
+function sourceProblem(directive, source) {
+    if (source === "'self'")
+        return undefined;
+    // WebAssembly compilation only; no JavaScript eval.
+    if (source === "'wasm-unsafe-eval'" && directive === 'script-src')
+        return undefined;
+    if (source.startsWith("'")) {
+        return "quoted keywords other than 'self' (and 'wasm-unsafe-eval' in script-src) are not allowed";
+    }
+    if (source === '*')
+        return '"*" allows any host';
+    if (SCHEMES.has(source)) {
+        if (directive === 'script-src' || directive === 'style-src') {
+            return `a bare scheme (${source}) would allow any source and make the nonce pointless`;
+        }
+        return undefined;
+    }
+    if (BARE_KEYWORDS.has(source.toLowerCase()))
+        return `write it quoted ('${source}')`;
+    if (/[\s;,"]/.test(source))
+        return 'spaces, ; , and quotes are not allowed';
+    if (/[%$\\`]/.test(source))
+        return '% $ \\ and ` are not allowed';
+    if (/^(?:http|ws):\/\//i.test(source))
+        return 'use https:// or wss:// (the policy upgrades http)';
+    if (!HOST.test(source) || !/[A-Za-z]/.test(source))
+        return 'not a host or scheme source';
+    return undefined;
+}
+exports.sourceProblem = sourceProblem;
+/**
+ * Reads csp-allowlist.json content: { "<directive>": [sources], "permissions-policy": "…" }.
+ * Throws naming the key and source on anything unknown or unsafe.
+ */
+function parseAllowlist(raw) {
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
+        throw new Error('csp-allowlist.json must be an object of directive → list of sources');
+    }
+    const out = { sources: {}, permissionsPolicy: exports.DEFAULT_PERMISSIONS_POLICY };
+    for (const [key, value] of Object.entries(raw)) {
+        if (key === 'permissions-policy') {
+            if (typeof value !== 'string' || !PERMISSIONS_POLICY.test(value)) {
+                throw new Error('csp-allowlist.json "permissions-policy" must be one line of letters, digits and = ( ) , ; * : " / . _ - spaces');
+            }
+            out.permissionsPolicy = value.trim();
+            continue;
+        }
+        if (!(key in exports.CSP_DIRECTIVES)) {
+            throw new Error(`csp-allowlist.json: "${key}" is not supported (use ${Object.keys(exports.CSP_DIRECTIVES).join(', ')}, permissions-policy)`);
+        }
+        if (!Array.isArray(value) || !value.every((v) => typeof v === 'string')) {
+            throw new Error(`csp-allowlist.json "${key}" must be a list of sources`);
+        }
+        const directive = key;
+        const sources = [];
+        for (const v of value) {
+            const source = v.trim();
+            const problem = sourceProblem(directive, source);
+            if (problem)
+                throw new Error(`csp-allowlist.json "${key}": "${source}" — ${problem}`);
+            if (!sources.includes(source))
+                sources.push(source);
+        }
+        out.sources[directive] = sources;
+    }
+    return out;
+}
+exports.parseAllowlist = parseAllowlist;
+/** JSON for the file: directives in table order, then permissions-policy when not the default. */
+function serializeAllowlist(a) {
+    const obj = {};
+    for (const d of Object.keys(exports.CSP_DIRECTIVES)) {
+        if (a.sources[d] && a.sources[d].length > 0)
+            obj[d] = a.sources[d];
+    }
+    if (a.permissionsPolicy !== exports.DEFAULT_PERMISSIONS_POLICY)
+        obj['permissions-policy'] = a.permissionsPolicy;
+    return JSON.stringify(obj, null, 2) + '\n';
+}
+exports.serializeAllowlist = serializeAllowlist;
+/** The CSP with `{N}` where the per-request nonce goes. */
+function buildPolicy(a) {
+    const parts = ["default-src 'self'"];
+    for (const [d, spec] of Object.entries(exports.CSP_DIRECTIVES)) {
+        const extra = a.sources[d] ?? [];
+        if (!spec.always && extra.length === 0)
+            continue;
+        const base = d === 'frame-ancestors' && extra.length > 0 ? [] : [...spec.base];
+        const all = [...base, ...extra.filter((s) => !base.includes(s))];
+        parts.push(`${d} ${all.join(' ')}`);
+        if (d === 'style-src')
+            parts.push("style-src-attr 'unsafe-inline'");
+        if (d === 'connect-src')
+            parts.push("object-src 'none'", "base-uri 'self'");
+    }
+    parts.push('upgrade-insecure-requests');
+    return parts.join('; ');
+}
+exports.buildPolicy = buildPolicy;
+//# sourceMappingURL=allowlist.js.map

package/dist/src/lib/csp/allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.js","sourceRoot":"","sources":["../../../../src/lib/csp/allowlist.ts"],"names":[],"mappings":";;;AAAA,qFAAqF;AACxE,QAAA,cAAc,GAAG;IAC5B,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;IAC/D,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;IAC9D,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;IACtD,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;IACvD,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;IACjD,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;IAChD,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;IAChD,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;IACjD,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;IACnD,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;IACjD,iBAAiB,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;CAC7C,CAAC;AAIE,QAAA,0BAA0B,GAAG,0CAA0C,CAAC;AAOrF,yFAAyF;AACzF,MAAM,IAAI,GACR,0HAA0H,CAAC;AAC7H,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9D,kDAAkD;AAClD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAClG,oGAAoG;AACpG,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AAEzD,4EAA4E;AAC5E,SAAgB,aAAa,CAAC,SAAuB,EAAE,MAAc;IACnE,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1C,oDAAoD;IACpD,IAAI,MAAM,KAAK,oBAAoB,IAAI,SAAS,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IACpF,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;QAC1B,OAAO,0FAA0F,CAAC;KACnG;IACD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,qBAAqB,CAAC;IACjD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;QACvB,IAAI,SAAS,KAAK,YAAY,IAAI,SAAS,KAAK,WAAW,EAAE;YAC3D,OAAO,kBAAkB,MAAM,uDAAuD,CAAC;SACxF;QACD,OAAO,SAAS,CAAC;KAClB;IACD,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,qBAAqB,MAAM,IAAI,CAAC;IACpF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,wCAAwC,CAAC;IAC5E,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,8BAA8B,CAAC;IAClE,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,mDAAmD,CAAC;IAClG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,6BAA6B,CAAC;IACzF,OAAO,SAAS,CAAC;AACnB,CAAC;AApBD,sCAoBC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,GAAY;IACzC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QACjE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;KACxF;IACD,MAAM,GAAG,GAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,kCAA0B,EAAE,CAAC;IACzF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE;QACzE,IAAI,GAAG,KAAK,oBAAoB,EAAE;YAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;gBAChE,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;aACH;YACD,GAAG,CAAC,iBAAiB,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YACrC,SAAS;SACV;QACD,IAAI,CAAC,CAAC,GAAG,IAAI,sBAAc,CAAC,EAAE;YAC5B,MAAM,IAAI,KAAK,CACb,wBAAwB,GAAG,2BAA2B,MAAM,CAAC,IAAI,CAAC,sBAAc,CAAC,CAAC,IAAI,CACpF,IAAI,CACL,uBAAuB,CACzB,CAAC;SACH;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE;YACvE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,6BAA6B,CAAC,CAAC;SAC1E;QACD,MAAM,SAAS,GAAG,GAAmB,CAAC;QACtC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,KAAiB,EAAE;YACjC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACjD,IAAI,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,OAAO,MAAM,OAAO,OAAO,EAAE,CAAC,CAAC;YACtF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;SACrD;QACD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;KAClC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AApCD,wCAoCC;AAED,kGAAkG;AAClG,SAAgB,kBAAkB,CAAC,CAAe;IAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,sBAAc,CAAmB,EAAE;QAC7D,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAc,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;KAClF;IACD,IAAI,CAAC,CAAC,iBAAiB,KAAK,kCAA0B;QACpD,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC;IAClD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AAC7C,CAAC;AARD,gDAQC;AAED,2DAA2D;AAC3D,SAAgB,WAAW,CAAC,CAAe;IACzC,MAAM,KAAK,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAc,CAGlD,EAAE;QACH,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjD,MAAM,IAAI,GACR,CAAC,KAAK,iBAAiB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAI,IAAI,CAAC,IAA0B,CAAC,CAAC;QAC3F,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK,aAAa;YAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;KAC7E;IACD,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAjBD,kCAiBC"}

package/dist/src/lib/csp/import.d.ts

@@ -0,0 +1,52 @@
+import { CspAllowlist } from './allowlist';
+/** directive → sources, as read from a policy, a server config or JSON. */
+export type RawPolicy = Record<string, string[]>;
+export type ImportFormat = 'policy' | 'server-config' | 'json';
+export interface Skipped {
+    directive: string;
+    source?: string;
+    reason: string;
+    /** refused: the strict policy does not allow it; not-taken: the generated policy has no place for it. */
+    kind: 'refused' | 'not-taken';
+}
+export interface ImportResult {
+    /** The merged allowlist sources (existing + imported, covered imports dropped). */
+    sources: CspAllowlist['sources'];
+    /** directive → sources that were not in the allowlist before. */
+    added: Record<string, string[]>;
+    skipped: Skipped[];
+    /** Imported sources not added because an entry of the same directive already allows them. */
+    covered: Array<{
+        directive: string;
+        source: string;
+        by: string;
+    }>;
+    notes: string[];
+}
+export interface ReadPolicyResult {
+    format: ImportFormat;
+    policy: RawPolicy;
+    /** Number of Content-Security-Policy headers found (server configs). */
+    policies: number;
+    notes: string[];
+}
+/** A raw `Content-Security-Policy` value: `directive source source; directive …`. */
+export declare function parsePolicyText(text: string): RawPolicy;
+/**
+ * Every Content-Security-Policy set in an Apache (`Header … Content-Security-Policy "…"`) or
+ * Nginx (`add_header Content-Security-Policy "…"`) config, also inside one-line blocks and across
+ * `\` line continuations; Report-Only headers are not read.
+ */
+export declare function policiesInServerConfig(text: string): string[];
+/** directive → sources from JSON: an object of lists or strings, under `directives` or `suggestedPolicy.directives` too. */
+export declare function parseJsonPolicy(value: unknown, notes?: string[]): RawPolicy;
+/** Reads a policy from file content or text, detecting the format. */
+export declare function readPolicy(text: string): ReadPolicyResult;
+/** The source in `list` that already allows `source` (a broader host entry), if any. */
+export declare function coveringSource(source: string, list: string[]): string | undefined;
+/**
+ * Merges an imported policy into the allowlist sources: sources the strict policy refuses, and
+ * directives it does not take, are skipped with the reason; imported sources that an entry
+ * already allows are not added. Existing entries are never removed.
+ */
+export declare function importPolicy(policy: RawPolicy, existing: CspAllowlist['sources']): ImportResult;