@nosecone/sveltekit 1.7.0-rc.0 → 1.7.0

package/index.d.ts

@@ -0,0 +1,115 @@
+import nosecone from "nosecone";
+import type { CspDirectives, Options } from "nosecone";
+import type { Handle, KitConfig } from "@sveltejs/kit";
+export { withVercelToolbar, type Options, type NoseconeOptions, } from "nosecone";
+/**
+ * Nosecone SvelteKit defaults.
+ */
+export declare const defaults: {
+    readonly directives: {
+        readonly scriptSrc: readonly ["'strict-dynamic'"];
+        readonly baseUri: readonly ["'none'"];
+        readonly childSrc: readonly ["'none'"];
+        readonly connectSrc: readonly ["'self'"];
+        readonly defaultSrc: readonly ["'self'"];
+        readonly fontSrc: readonly ["'self'"];
+        readonly formAction: readonly ["'self'"];
+        readonly frameAncestors: readonly ["'none'"];
+        readonly frameSrc: readonly ["'none'"];
+        readonly imgSrc: readonly ["'self'", "blob:", "data:"];
+        readonly manifestSrc: readonly ["'self'"];
+        readonly mediaSrc: readonly ["'self'"];
+        readonly objectSrc: readonly ["'none'"];
+        readonly styleSrc: readonly ["'self'"];
+        readonly workerSrc: readonly ["'self'"];
+    };
+    readonly contentSecurityPolicy: {
+        readonly directives: {
+            readonly baseUri: readonly ["'none'"];
+            readonly childSrc: readonly ["'none'"];
+            readonly connectSrc: readonly ["'self'"];
+            readonly defaultSrc: readonly ["'self'"];
+            readonly fontSrc: readonly ["'self'"];
+            readonly formAction: readonly ["'self'"];
+            readonly frameAncestors: readonly ["'none'"];
+            readonly frameSrc: readonly ["'none'"];
+            readonly imgSrc: readonly ["'self'", "blob:", "data:"];
+            readonly manifestSrc: readonly ["'self'"];
+            readonly mediaSrc: readonly ["'self'"];
+            readonly objectSrc: readonly ["'none'"];
+            readonly scriptSrc: readonly ["'self'"];
+            readonly styleSrc: readonly ["'self'"];
+            readonly workerSrc: readonly ["'self'"];
+        };
+    };
+    readonly crossOriginEmbedderPolicy: {
+        readonly policy: "require-corp";
+    };
+    readonly crossOriginOpenerPolicy: {
+        readonly policy: "same-origin";
+    };
+    readonly crossOriginResourcePolicy: {
+        readonly policy: "same-origin";
+    };
+    readonly originAgentCluster: true;
+    readonly referrerPolicy: {
+        readonly policy: readonly ["no-referrer"];
+    };
+    readonly strictTransportSecurity: {
+        readonly maxAge: number;
+        readonly includeSubDomains: true;
+        readonly preload: false;
+    };
+    readonly xContentTypeOptions: true;
+    readonly xDnsPrefetchControl: {
+        readonly allow: false;
+    };
+    readonly xDownloadOptions: true;
+    readonly xFrameOptions: {
+        readonly action: "sameorigin";
+    };
+    readonly xPermittedCrossDomainPolicies: {
+        readonly permittedPolicies: "none";
+    };
+    readonly xXssProtection: true;
+};
+export { nosecone };
+/**
+ * Create security headers.
+ *
+ * @deprecated
+ *   Use the named export `nosecone` instead.
+ */
+export default nosecone;
+/**
+ * Create a SvelteKit hook that sets secure headers on every request.
+ *
+ * @param options
+ *   Configuration to provide to Nosecone.
+ * @returns
+ *   SvelteKit hook that sets secure headers.
+ */
+export declare function createHook(options?: Options): Handle;
+type SvelteKitCsp = Exclude<KitConfig["csp"], undefined>;
+/**
+ * Content Security Policy configuration for SvelteKit.
+ */
+export type ContentSecurityPolicyConfig = {
+    /**
+     * Mode of the `Content-Security-Policy` header.
+     */
+    mode?: SvelteKitCsp["mode"] | undefined;
+    /**
+     * Directives to use in the `Content-Security-Policy` header.
+     */
+    directives?: CspDirectives | undefined;
+};
+/**
+ * Create a SvelteKit Content Security Policy configuration.
+ *
+ * @param options
+ *   Configuration.
+ * @returns
+ *   SvelteKit Content Security Policy configuration.
+ */
+export declare function csp(options?: ContentSecurityPolicyConfig | undefined): SvelteKitCsp;

package/index.js

@@ -0,0 +1,96 @@
+import nosecone, { defaults as defaults$1, CONTENT_SECURITY_POLICY_DIRECTIVES, NoseconeValidationError, QUOTED } from 'nosecone';
+export { default, default as nosecone, withVercelToolbar } from 'nosecone';
+
+/**
+ * Nosecone SvelteKit defaults.
+ */
+const defaults = {
+    ...defaults$1,
+    directives: {
+        ...defaults$1.contentSecurityPolicy.directives,
+        scriptSrc: ["'strict-dynamic'"],
+    },
+};
+/**
+ * Create a SvelteKit hook that sets secure headers on every request.
+ *
+ * @param options
+ *   Configuration to provide to Nosecone.
+ * @returns
+ *   SvelteKit hook that sets secure headers.
+ */
+function createHook(options = defaults) {
+    return async ({ event, resolve }) => {
+        const response = await resolve(event);
+        const headers = nosecone(options);
+        for (const [headerName, headerValue] of headers.entries()) {
+            // Only add headers that aren't already set. For example, SvelteKit will
+            // likely have added `Content-Security-Policy` if configured with `csp`
+            if (!response.headers.has(headerName)) {
+                response.headers.set(headerName, headerValue);
+            }
+        }
+        return response;
+    };
+}
+function unquote(value) {
+    for (const [unquoted, quoted] of QUOTED) {
+        if (value === quoted) {
+            return unquoted;
+        }
+    }
+    return value;
+}
+function resolveValue(v) {
+    if (typeof v === "function") {
+        return v();
+    }
+    else {
+        return v;
+    }
+}
+function directivesToSvelteKitConfig(directives) {
+    const sveltekitDirectives = {};
+    for (const [optionKey, optionValues] of Object.entries(directives)) {
+        const key = CONTENT_SECURITY_POLICY_DIRECTIVES.get(
+        // @ts-expect-error because we're validating this option key
+        optionKey);
+        if (!key) {
+            throw new NoseconeValidationError(`${optionKey} is not a Content-Security-Policy directive`);
+        }
+        // Skip anything falsey
+        if (!optionValues) {
+            continue;
+        }
+        // TODO: What do we want to do if array is empty? I think they work differently for some directives
+        const resolvedValues = Array.isArray(optionValues)
+            ? new Set(optionValues.map(resolveValue))
+            : new Set();
+        // TODO: Add validations for SvelteKit CSP directives
+        const values = Array.from(resolvedValues);
+        if (key === "upgrade-insecure-requests") {
+            sveltekitDirectives[key] = true;
+        }
+        else {
+            // @ts-expect-error because we're mapping to SvelteKit options
+            sveltekitDirectives[key] = values.map(unquote);
+        }
+    }
+    return sveltekitDirectives;
+}
+/**
+ * Create a SvelteKit Content Security Policy configuration.
+ *
+ * @param options
+ *   Configuration.
+ * @returns
+ *   SvelteKit Content Security Policy configuration.
+ */
+function csp(options) {
+    return {
+        mode: options?.mode ? options.mode : "auto",
+        directives: directivesToSvelteKitConfig(options?.directives ?? defaults.contentSecurityPolicy.directives) || {},
+    };
+}
+
+export { createHook, csp, defaults };

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@nosecone/sveltekit",
-  "version": "1.7.0-rc.0",
+  "version": "1.7.0",
   "description": "Protect your SvelteKit application with secure headers",
   "keywords": [
     "arcjet",
     "coep",
+    "coep",
     "content-security-policy",
     "coop",
     "corp",
@@ -16,65 +17,62 @@
     "http",
     "nosecone",
     "protect",
-    "svelte",
-    "sveltekit"
+    "sveltekit",
+    "svelte"
   ],
+  "license": "Apache-2.0",
   "homepage": "https://arcjet.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/arcjet/arcjet-js.git",
+    "directory": "nosecone-sveltekit"
+  },
   "bugs": {
     "url": "https://github.com/arcjet/arcjet-js/issues",
     "email": "support@arcjet.com"
   },
-  "license": "Apache-2.0",
   "author": {
     "name": "Arcjet",
     "email": "support@arcjet.com",
     "url": "https://arcjet.com"
   },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/arcjet/arcjet-js.git",
-    "directory": "nosecone-sveltekit"
+  "engines": {
+    "node": ">=22.21.0 <23 || >=24.5.0"
   },
+  "type": "module",
+  "main": "./index.js",
+  "types": "./index.d.ts",
   "files": [
-    "dist"
+    "index.d.ts",
+    "index.js"
   ],
-  "type": "module",
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "publishConfig": {
-    "access": "public",
-    "tag": "latest"
-  },
   "scripts": {
-    "build": "tsdown",
-    "typecheck": "tsgo --noEmit",
-    "test-api": "node --test -- test/*.test.ts",
-    "test-coverage": "node --experimental-test-coverage --test -- test/*.test.ts",
-    "test": "npm run build && npm run test-coverage"
+    "build": "rollup --config rollup.config.js",
+    "lint": "eslint .",
+    "test-api": "node --test -- test/*.test.js",
+    "test-coverage": "node --experimental-test-coverage --test -- test/*.test.js",
+    "test": "npm run build && npm run lint && npm run test-coverage"
   },
   "dependencies": {
-    "nosecone": "1.7.0-rc.0"
+    "nosecone": "1.7.0"
+  },
+  "peerDependencies": {
+    "@sveltejs/kit": ">=2"
   },
   "devDependencies": {
+    "@arcjet/eslint-config": "1.7.0",
+    "@arcjet/rollup-config": "1.7.0",
+    "@rollup/wasm-node": "4.62.2",
     "@sveltejs/kit": "2.66.0",
     "@sveltejs/vite-plugin-svelte": "7.1.2",
     "@types/node": "22.19.21",
+    "eslint": "9.39.4",
     "svelte": "5.56.3",
-    "tsdown": "0.22.3",
-    "typescript": "6.0.3",
+    "typescript": "5.9.3",
     "vite": "8.0.16"
   },
-  "peerDependencies": {
-    "@sveltejs/kit": ">=2"
-  },
-  "engines": {
-    "node": ">=22.21.0 <23 || >=24.5.0"
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
   }
 }

package/dist/index.d.ts

@@ -1,109 +0,0 @@
-import nosecone, { CspDirectives, NoseconeOptions, Options, Options as Options$1, withVercelToolbar } from "nosecone";
-import { Handle, KitConfig } from "@sveltejs/kit";
-
-//#region src/index.d.ts
-/**
- * Nosecone SvelteKit defaults.
- */
-declare const defaults: {
-  readonly directives: {
-    readonly scriptSrc: readonly ["'strict-dynamic'"];
-    readonly baseUri: readonly ["'none'"];
-    readonly childSrc: readonly ["'none'"];
-    readonly connectSrc: readonly ["'self'"];
-    readonly defaultSrc: readonly ["'self'"];
-    readonly fontSrc: readonly ["'self'"];
-    readonly formAction: readonly ["'self'"];
-    readonly frameAncestors: readonly ["'none'"];
-    readonly frameSrc: readonly ["'none'"];
-    readonly imgSrc: readonly ["'self'", "blob:", "data:"];
-    readonly manifestSrc: readonly ["'self'"];
-    readonly mediaSrc: readonly ["'self'"];
-    readonly objectSrc: readonly ["'none'"];
-    readonly styleSrc: readonly ["'self'"];
-    readonly workerSrc: readonly ["'self'"];
-  };
-  readonly contentSecurityPolicy: {
-    readonly directives: {
-      readonly baseUri: readonly ["'none'"];
-      readonly childSrc: readonly ["'none'"];
-      readonly connectSrc: readonly ["'self'"];
-      readonly defaultSrc: readonly ["'self'"];
-      readonly fontSrc: readonly ["'self'"];
-      readonly formAction: readonly ["'self'"];
-      readonly frameAncestors: readonly ["'none'"];
-      readonly frameSrc: readonly ["'none'"];
-      readonly imgSrc: readonly ["'self'", "blob:", "data:"];
-      readonly manifestSrc: readonly ["'self'"];
-      readonly mediaSrc: readonly ["'self'"];
-      readonly objectSrc: readonly ["'none'"];
-      readonly scriptSrc: readonly ["'self'"];
-      readonly styleSrc: readonly ["'self'"];
-      readonly workerSrc: readonly ["'self'"];
-    };
-  };
-  readonly crossOriginEmbedderPolicy: {
-    readonly policy: "require-corp";
-  };
-  readonly crossOriginOpenerPolicy: {
-    readonly policy: "same-origin";
-  };
-  readonly crossOriginResourcePolicy: {
-    readonly policy: "same-origin";
-  };
-  readonly originAgentCluster: true;
-  readonly referrerPolicy: {
-    readonly policy: readonly ["no-referrer"];
-  };
-  readonly strictTransportSecurity: {
-    readonly maxAge: 31536000;
-    readonly includeSubDomains: true;
-    readonly preload: false;
-  };
-  readonly xContentTypeOptions: true;
-  readonly xDnsPrefetchControl: {
-    readonly allow: false;
-  };
-  readonly xDownloadOptions: true;
-  readonly xFrameOptions: {
-    readonly action: "sameorigin";
-  };
-  readonly xPermittedCrossDomainPolicies: {
-    readonly permittedPolicies: "none";
-  };
-  readonly xXssProtection: true;
-};
-/**
- * Create a SvelteKit hook that sets secure headers on every request.
- *
- * @param options
- *   Configuration to provide to Nosecone.
- * @returns
- *   SvelteKit hook that sets secure headers.
- */
-declare function createHook(options?: Options$1): Handle;
-type SvelteKitCsp = Exclude<KitConfig["csp"], undefined>;
-/**
- * Content Security Policy configuration for SvelteKit.
- */
-type ContentSecurityPolicyConfig = {
-  /**
-   * Mode of the `Content-Security-Policy` header.
-   */
-  mode?: SvelteKitCsp["mode"] | undefined;
-  /**
-   * Directives to use in the `Content-Security-Policy` header.
-   */
-  directives?: CspDirectives | undefined;
-};
-/**
- * Create a SvelteKit Content Security Policy configuration.
- *
- * @param options
- *   Configuration.
- * @returns
- *   SvelteKit Content Security Policy configuration.
- */
-declare function csp(options?: ContentSecurityPolicyConfig | undefined): SvelteKitCsp;
-//#endregion
-export { ContentSecurityPolicyConfig, type NoseconeOptions, type Options, createHook, csp, nosecone as default, nosecone, defaults, withVercelToolbar };

package/dist/index.js

@@ -1,72 +0,0 @@
-import nosecone, { CONTENT_SECURITY_POLICY_DIRECTIVES, NoseconeValidationError, QUOTED, defaults as defaults$1, withVercelToolbar } from "nosecone";
-//#region src/index.ts
-/**
-* Nosecone SvelteKit defaults.
-*/
-const defaults = {
-	...defaults$1,
-	directives: {
-		...defaults$1.contentSecurityPolicy.directives,
-		scriptSrc: ["'strict-dynamic'"]
-	}
-};
-/**
-* Create security headers.
-*
-* @deprecated
-*   Use the named export `nosecone` instead.
-*/
-var src_default = nosecone;
-/**
-* Create a SvelteKit hook that sets secure headers on every request.
-*
-* @param options
-*   Configuration to provide to Nosecone.
-* @returns
-*   SvelteKit hook that sets secure headers.
-*/
-function createHook(options = defaults) {
-	return async ({ event, resolve }) => {
-		const response = await resolve(event);
-		const headers = nosecone(options);
-		for (const [headerName, headerValue] of headers.entries()) if (!response.headers.has(headerName)) response.headers.set(headerName, headerValue);
-		return response;
-	};
-}
-function unquote(value) {
-	for (const [unquoted, quoted] of QUOTED) if (value === quoted) return unquoted;
-	return value;
-}
-function resolveValue(v) {
-	if (typeof v === "function") return v();
-	else return v;
-}
-function directivesToSvelteKitConfig(directives) {
-	const sveltekitDirectives = {};
-	for (const [optionKey, optionValues] of Object.entries(directives)) {
-		const key = CONTENT_SECURITY_POLICY_DIRECTIVES.get(optionKey);
-		if (!key) throw new NoseconeValidationError(`${optionKey} is not a Content-Security-Policy directive`);
-		if (!optionValues) continue;
-		const resolvedValues = Array.isArray(optionValues) ? new Set(optionValues.map(resolveValue)) : /* @__PURE__ */ new Set();
-		const values = Array.from(resolvedValues);
-		if (key === "upgrade-insecure-requests") sveltekitDirectives[key] = true;
-		else sveltekitDirectives[key] = values.map(unquote);
-	}
-	return sveltekitDirectives;
-}
-/**
-* Create a SvelteKit Content Security Policy configuration.
-*
-* @param options
-*   Configuration.
-* @returns
-*   SvelteKit Content Security Policy configuration.
-*/
-function csp(options) {
-	return {
-		mode: options?.mode ? options.mode : "auto",
-		directives: directivesToSvelteKitConfig(options?.directives ?? defaults.contentSecurityPolicy.directives) || {}
-	};
-}
-//#endregion
-export { createHook, csp, src_default as default, defaults, nosecone, withVercelToolbar };