@nosecone/sveltekit 1.0.0-alpha.30 → 1.0.0-alpha.31

package/index.d.ts

@@ -1,7 +1,76 @@
-import nosecone, { defaults } from "nosecone";
+import nosecone from "nosecone";
 import type { CspDirectives, NoseconeOptions } from "nosecone";
 import type { Handle, KitConfig } from "@sveltejs/kit";
-export { defaults };
+export declare const defaults: {
+    readonly directives: {
+        readonly scriptSrc: readonly ["'strict-dynamic'"];
+        readonly baseUri: readonly ["'none'"];
+        readonly childSrc: readonly ["'none'"];
+        readonly connectSrc: readonly ["'self'"];
+        readonly defaultSrc: readonly ["'self'"];
+        readonly fontSrc: readonly ["'self'"];
+        readonly formAction: readonly ["'self'"];
+        readonly frameAncestors: readonly ["'none'"];
+        readonly frameSrc: readonly ["'none'"];
+        readonly imgSrc: readonly ["'self'", "blob:", "data:"];
+        readonly manifestSrc: readonly ["'self'"];
+        readonly mediaSrc: readonly ["'self'"];
+        readonly objectSrc: readonly ["'none'"];
+        readonly styleSrc: readonly ["'self'"];
+        readonly workerSrc: readonly ["'self'"];
+        readonly upgradeInsecureRequests: true;
+    };
+    readonly contentSecurityPolicy: {
+        readonly directives: {
+            readonly baseUri: readonly ["'none'"];
+            readonly childSrc: readonly ["'none'"];
+            readonly connectSrc: readonly ["'self'"];
+            readonly defaultSrc: readonly ["'self'"];
+            readonly fontSrc: readonly ["'self'"];
+            readonly formAction: readonly ["'self'"];
+            readonly frameAncestors: readonly ["'none'"];
+            readonly frameSrc: readonly ["'none'"];
+            readonly imgSrc: readonly ["'self'", "blob:", "data:"];
+            readonly manifestSrc: readonly ["'self'"];
+            readonly mediaSrc: readonly ["'self'"];
+            readonly objectSrc: readonly ["'none'"];
+            readonly scriptSrc: readonly ["'self'"];
+            readonly styleSrc: readonly ["'self'"];
+            readonly workerSrc: readonly ["'self'"];
+            readonly upgradeInsecureRequests: true;
+        };
+    };
+    readonly crossOriginEmbedderPolicy: {
+        readonly policy: "require-corp";
+    };
+    readonly crossOriginOpenerPolicy: {
+        readonly policy: "same-origin";
+    };
+    readonly crossOriginResourcePolicy: {
+        readonly policy: "same-origin";
+    };
+    readonly originAgentCluster: true;
+    readonly referrerPolicy: {
+        readonly policy: readonly ["no-referrer"];
+    };
+    readonly strictTransportSecurity: {
+        readonly maxAge: number;
+        readonly includeSubDomains: true;
+        readonly preload: false;
+    };
+    readonly xContentTypeOptions: true;
+    readonly xDnsPrefetchControl: {
+        readonly allow: false;
+    };
+    readonly xDownloadOptions: true;
+    readonly xFrameOptions: {
+        readonly action: "sameorigin";
+    };
+    readonly xPermittedCrossDomainPolicies: {
+        readonly permittedPolicies: "none";
+    };
+    readonly xXssProtection: true;
+};
 export default nosecone;
 /**
  * Create a SvelteKit hook that sets secure headers on every request.

package/index.js

@@ -1,6 +1,13 @@
-import nosecone, { defaults, CONTENT_SECURITY_POLICY_DIRECTIVES, NoseconeValidationError, QUOTED } from 'nosecone';
-export { default, defaults } from 'nosecone';
+import nosecone, { defaults as defaults$1, CONTENT_SECURITY_POLICY_DIRECTIVES, NoseconeValidationError, QUOTED } from 'nosecone';
+export { default } from 'nosecone';
 
+const defaults = {
+    ...defaults$1,
+    directives: {
+        ...defaults$1.contentSecurityPolicy.directives,
+        scriptSrc: ["'strict-dynamic'"],
+    },
+};
 /**
  * Create a SvelteKit hook that sets secure headers on every request.
  *
@@ -21,10 +28,6 @@ function createHook(options = defaults) {
         return response;
     };
 }
-const directives = {
-    ...defaults.contentSecurityPolicy.directives,
-    scriptSrc: ["'strict-dynamic'"],
-};
 function unquote(value) {
     for (const [unquoted, quoted] of QUOTED) {
         if (value === quoted) {
@@ -70,11 +73,11 @@ function directivesToSvelteKitConfig(directives) {
     }
     return sveltekitDirectives;
 }
-function csp(options = { mode: "auto", directives }) {
+function csp(options = { mode: "auto" }) {
     return {
         mode: options.mode ? options.mode : "auto",
         directives: directivesToSvelteKitConfig(options.directives ?? defaults.contentSecurityPolicy.directives),
     };
 }
 
-export { createHook, csp };
+export { createHook, csp, defaults };

package/index.ts

@@ -1,14 +1,19 @@
 import nosecone, {
   CONTENT_SECURITY_POLICY_DIRECTIVES,
   QUOTED,
-  defaults,
+  defaults as baseDefaults,
   NoseconeValidationError,
 } from "nosecone";
 import type { CspDirectives, NoseconeOptions } from "nosecone";
 import type { Handle, KitConfig } from "@sveltejs/kit";
 
-// Re-exports the defaults for easier overrides
-export { defaults };
+export const defaults = {
+  ...baseDefaults,
+  directives: {
+    ...baseDefaults.contentSecurityPolicy.directives,
+    scriptSrc: ["'strict-dynamic'"],
+  },
+} as const;
 
 // We export `nosecone` as the default so it can be used with `new Response()`
 export default nosecone;
@@ -44,11 +49,6 @@ export type ContentSecurityPolicyConfig = {
   // TODO: Support `reportOnly`
 };
 
-const directives: CspDirectives = {
-  ...defaults.contentSecurityPolicy.directives,
-  scriptSrc: ["'strict-dynamic'"],
-};
-
 function unquote(value?: string) {
   for (const [unquoted, quoted] of QUOTED) {
     if (value === quoted) {
@@ -108,7 +108,7 @@ function directivesToSvelteKitConfig(
 }
 
 export function csp(
-  options: ContentSecurityPolicyConfig = { mode: "auto", directives },
+  options: ContentSecurityPolicyConfig = { mode: "auto" },
 ): SvelteKitCsp {
   return {
     mode: options.mode ? options.mode : "auto",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nosecone/sveltekit",
-  "version": "1.0.0-alpha.30",
+  "version": "1.0.0-alpha.31",
   "description": "Protect your SvelteKit application with secure headers",
   "license": "Apache-2.0",
   "homepage": "https://arcjet.com",
@@ -40,15 +40,15 @@
     "test": "node --test"
   },
   "dependencies": {
-    "nosecone": "1.0.0-alpha.30"
+    "nosecone": "1.0.0-alpha.31"
   },
   "peerDependencies": {
     "@sveltejs/kit": ">=2"
   },
   "devDependencies": {
-    "@arcjet/eslint-config": "1.0.0-alpha.30",
-    "@arcjet/rollup-config": "1.0.0-alpha.30",
-    "@arcjet/tsconfig": "1.0.0-alpha.30",
+    "@arcjet/eslint-config": "1.0.0-alpha.31",
+    "@arcjet/rollup-config": "1.0.0-alpha.31",
+    "@arcjet/tsconfig": "1.0.0-alpha.31",
     "@rollup/wasm-node": "4.27.3",
     "@sveltejs/kit": "^2.8.0",
     "@types/node": "18.18.0",