@nuxt/scripts 1.3.5 → 2.0.0-beta.1

package/dist/runtime/plugins/proxy-token.server.js

@@ -1,17 +0,0 @@
-import { defineNuxtPlugin, useRuntimeConfig } from "nuxt/app";
-import { useScriptProxyToken } from "../composables/useScriptProxyToken.js";
-import { generateProxyToken } from "../server/utils/sign.js";
-export default defineNuxtPlugin({
-  name: "nuxt-scripts:proxy-token",
-  enforce: "pre",
-  setup() {
-    const secret = useRuntimeConfig()["nuxt-scripts"]?.proxySecret;
-    if (!secret)
-      return;
-    const ts = Math.floor(Date.now() / 1e3);
-    useScriptProxyToken().value = {
-      token: generateProxyToken(secret, ts),
-      ts
-    };
-  }
-});

package/dist/runtime/server/google-maps-geocode-proxy.d.ts

@@ -1,2 +0,0 @@
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, any>;
-export default _default;

package/dist/runtime/server/google-maps-geocode-proxy.js

@@ -1,43 +0,0 @@
-import { withQuery } from "ufo";
-import { createError, defineEventHandler, getQuery, setHeader } from "#nuxt-scripts/h3";
-import { useRuntimeConfig } from "#nuxt-scripts/nitro";
-import { createCachedJsonFetch, isSafeHttpsUrl } from "./utils/cached-upstream.js";
-import { stripProxyAuthQuery } from "./utils/proxy-query.js";
-import { withSigning } from "./utils/withSigning.js";
-const cachedGeocodeFetch = createCachedJsonFetch(
-  "nuxt-scripts-geocode",
-  2592e3,
-  (url) => url,
-  {
-    allowUrl: (url) => isSafeHttpsUrl(url) && url.hostname === "maps.googleapis.com",
-    contentTypePrefixes: ["application/json"]
-  }
-);
-export default withSigning(defineEventHandler(async (event) => {
-  const runtimeConfig = useRuntimeConfig();
-  const privateConfig = runtimeConfig["nuxt-scripts"]?.googleMapsGeocodeProxy;
-  const apiKey = privateConfig?.apiKey;
-  if (!apiKey) {
-    throw createError({
-      statusCode: 500,
-      statusMessage: "Google Maps API key not configured for geocode proxy"
-    });
-  }
-  const query = stripProxyAuthQuery(getQuery(event));
-  const { key: _clientKey, ...safeQuery } = query;
-  const geocodeUrl = withQuery("https://maps.googleapis.com/maps/api/geocode/json", {
-    ...safeQuery,
-    key: apiKey
-  });
-  const data = await cachedGeocodeFetch(geocodeUrl, {
-    headers: { "User-Agent": "Nuxt Scripts Google Geocode Proxy" }
-  }).catch((error) => {
-    throw createError({
-      statusCode: error.statusCode || 500,
-      statusMessage: error.statusMessage || "Failed to geocode"
-    });
-  });
-  setHeader(event, "Content-Type", "application/json");
-  setHeader(event, "Cache-Control", "public, max-age=86400, s-maxage=86400");
-  return data;
-}));

package/dist/runtime/server/google-static-maps-proxy.d.ts

@@ -1,2 +0,0 @@
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, any>;
-export default _default;

package/dist/runtime/server/google-static-maps-proxy.js

@@ -1,56 +0,0 @@
-import { withQuery } from "ufo";
-import { createError, defineEventHandler, getQuery, setHeader } from "#nuxt-scripts/h3";
-import { useRuntimeConfig } from "#nuxt-scripts/nitro";
-import { createCachedBinaryFetch, isSafeHttpsUrl } from "./utils/cached-upstream.js";
-import { stripProxyAuthQuery } from "./utils/proxy-query.js";
-import { withSigning } from "./utils/withSigning.js";
-const cachedMapFetch = createCachedBinaryFetch("nuxt-scripts-static-map", 604800, {
-  allowContentType: (contentType) => contentType.startsWith("image/") && contentType !== "image/svg+xml",
-  allowUrl: (url) => isSafeHttpsUrl(url) && url.hostname === "maps.googleapis.com"
-});
-export default withSigning(defineEventHandler(async (event) => {
-  const runtimeConfig = useRuntimeConfig();
-  const publicConfig = runtimeConfig.public["nuxt-scripts"]?.googleStaticMapsProxy;
-  const privateConfig = runtimeConfig["nuxt-scripts"]?.googleStaticMapsProxy;
-  if (!publicConfig?.enabled) {
-    throw createError({
-      statusCode: 404,
-      statusMessage: "Google Static Maps proxy is not enabled"
-    });
-  }
-  const apiKey = privateConfig?.apiKey;
-  if (!apiKey) {
-    throw createError({
-      statusCode: 500,
-      statusMessage: "Google Maps API key not configured for proxy"
-    });
-  }
-  const query = stripProxyAuthQuery(getQuery(event));
-  const { key: _clientKey, ...safeQuery } = query;
-  const googleMapsUrl = withQuery("https://maps.googleapis.com/maps/api/staticmap", {
-    ...safeQuery,
-    key: apiKey
-  });
-  const result = await cachedMapFetch(googleMapsUrl, {
-    headers: { "User-Agent": "Nuxt Scripts Google Static Maps Proxy" }
-  }).catch((error) => {
-    throw createError({
-      statusCode: error.statusCode || 500,
-      statusMessage: error.statusMessage || "Failed to fetch static map"
-    });
-  });
-  const contentType = result.contentType?.split(";", 1)[0]?.trim().toLowerCase();
-  if (!contentType?.startsWith("image/") || contentType === "image/svg+xml") {
-    throw createError({
-      statusCode: 415,
-      statusMessage: "Unsupported upstream content type"
-    });
-  }
-  const cacheMaxAge = publicConfig.cacheMaxAge || 3600;
-  setHeader(event, "Content-Type", result.contentType);
-  setHeader(event, "Cache-Control", `public, max-age=${cacheMaxAge}, s-maxage=${cacheMaxAge}`);
-  setHeader(event, "Vary", "Accept-Encoding");
-  setHeader(event, "Content-Security-Policy", "sandbox; default-src 'none'; base-uri 'none'; form-action 'none'");
-  setHeader(event, "X-Content-Type-Options", "nosniff");
-  return result.body;
-}));

package/dist/runtime/server/utils/proxy-query.d.ts

@@ -1,2 +0,0 @@
-/** Remove proxy-only credentials before constructing an upstream URL or cache key. */
-export declare function stripProxyAuthQuery(query: Record<string, unknown>): Record<string, unknown>;

package/dist/runtime/server/utils/proxy-query.js

@@ -1,10 +0,0 @@
-import { PAGE_TOKEN_PARAM, PAGE_TOKEN_TS_PARAM, SIG_PARAM } from "./sign-constants.js";
-const PROXY_AUTH_PARAMS = /* @__PURE__ */ new Set([SIG_PARAM, PAGE_TOKEN_PARAM, PAGE_TOKEN_TS_PARAM]);
-export function stripProxyAuthQuery(query) {
-  const upstreamQuery = /* @__PURE__ */ Object.create(null);
-  for (const [key, value] of Object.entries(query)) {
-    if (!PROXY_AUTH_PARAMS.has(key))
-      upstreamQuery[key] = value;
-  }
-  return upstreamQuery;
-}

package/dist/runtime/server/utils/sign-constants.d.ts

@@ -1,16 +0,0 @@
-/**
- * Signing constants shared between server (HMAC) and client (page-token) code.
- *
- * Kept in a crypto-free module so client bundles can import the param names
- * without pulling in `node:crypto`.
- */
-/** Query param name for the HMAC signature. */
-export declare const SIG_PARAM = "sig";
-/** Length of the hex signature (16 chars = 64 bits). */
-export declare const SIG_LENGTH = 16;
-/** Query param name for the page token. */
-export declare const PAGE_TOKEN_PARAM = "_pt";
-/** Query param name for the page token timestamp. */
-export declare const PAGE_TOKEN_TS_PARAM = "_ts";
-/** Default max age for page tokens in seconds (1 hour). */
-export declare const PAGE_TOKEN_MAX_AGE = 3600;

package/dist/runtime/server/utils/sign-constants.js

@@ -1,5 +0,0 @@
-export const SIG_PARAM = "sig";
-export const SIG_LENGTH = 16;
-export const PAGE_TOKEN_PARAM = "_pt";
-export const PAGE_TOKEN_TS_PARAM = "_ts";
-export const PAGE_TOKEN_MAX_AGE = 3600;

package/dist/runtime/server/utils/sign.d.ts

@@ -1,101 +0,0 @@
-/**
- * HMAC URL signing for proxy endpoints.
- *
- * ## Why
- *
- * Proxy endpoints like `/_scripts/proxy/google-static-maps` inject a server-side
- * API key and forward requests to third-party services. Without signing, anyone
- * can call these endpoints with arbitrary parameters and burn the site owner's
- * API quota. Signing ensures only URLs generated server-side (during SSR/prerender
- * or via the `/_scripts/sign` endpoint) are accepted.
- *
- * ## How
- *
- * 1. The module stores a deterministic secret in `runtimeConfig.nuxt-scripts.proxySecret`
- *    (env: `NUXT_SCRIPTS_PROXY_SECRET`).
- * 2. URLs are canonicalized (sort query keys, strip `sig`) and signed with HMAC-SHA256.
- * 3. The first 16 hex chars (64 bits) of the digest is appended as `?sig=<hex>`.
- * 4. Endpoints wrapped with `withSigning()` verify the sig against the current request.
- *
- * A 64-bit signature is enough to defeat brute force for this threat model
- * (a billion guesses gives a ~5% hit rate at 2^64). Longer signatures bloat
- * prerendered HTML for no practical gain.
- */
-import type { H3Event } from '#nuxt-scripts/h3';
-import { PAGE_TOKEN_MAX_AGE, PAGE_TOKEN_PARAM, PAGE_TOKEN_TS_PARAM, SIG_LENGTH, SIG_PARAM } from './sign-constants.js';
-export { PAGE_TOKEN_MAX_AGE, PAGE_TOKEN_PARAM, PAGE_TOKEN_TS_PARAM, SIG_LENGTH, SIG_PARAM };
-/**
- * Canonicalize a query object into a deterministic string suitable for HMAC input.
- *
- * Rules:
- * - The `sig` param is stripped (it can't sign itself).
- * - `undefined` and `null` values are skipped (mirrors `ufo.withQuery`).
- * - Keys are sorted alphabetically so order-independent reconstruction works.
- * - Arrays expand to repeated keys (e.g. `markers=a&markers=b`), matching how
- *   `ufo.withQuery` serializes array-valued params.
- * - Objects are JSON-stringified (rare, but consistent with `ufo.withQuery`).
- * - Encoding uses `encodeURIComponent` for both keys and values so the canonical
- *   form matches what shows up on the wire.
- *
- * The resulting string is stable across server/client and different JS runtimes
- * because it does not depend on `URLSearchParams` insertion order.
- */
-export declare function canonicalizeQuery(query: Record<string, unknown>): string;
-/**
- * Sign a path + query using HMAC-SHA256 and return the 16-char hex digest.
- *
- * The HMAC input is `${path}?${canonicalQuery}` so that the same query signed
- * against a different endpoint yields a different signature (prevents cross-
- * endpoint signature reuse).
- *
- * `path` should be the URL path without query string (e.g. `/_scripts/proxy/google-static-maps`).
- * Callers should not include origin / host since the signing contract is path-relative.
- */
-export declare function signProxyUrl(path: string, query: Record<string, unknown>, secret: string): string;
-/**
- * Build a fully-formed signed URL (path + query + sig).
- *
- * This is the primary helper for code paths that need to emit a proxy URL
- * (SSR components, server-side URL rewriters like instagram-embed).
- */
-export declare function buildSignedProxyUrl(path: string, query: Record<string, unknown>, secret: string): string;
-/**
- * Generate a page token that authorizes client-side proxy requests.
- *
- * Embedded in the SSR payload so the browser can attach it to reactive proxy
- * URL updates without needing a `/sign` round-trip. The token is scoped to
- * a timestamp and expires after `PAGE_TOKEN_MAX_AGE` seconds.
- *
- * Construction: first 16 hex chars of `HMAC(secret, "proxy-access:<timestamp>")`.
- */
-export declare function generateProxyToken(secret: string, timestamp: number): string;
-/**
- * Verify a page token against the current time.
- *
- * Returns `true` if the token matches the HMAC for the given timestamp AND
- * the timestamp is within `maxAge` seconds of `now`.
- */
-export declare function verifyProxyToken(token: string, timestamp: number, secret: string, maxAge?: number, now?: number): boolean;
-/**
- * Verify a request against either a URL signature or a page token.
- *
- * Two verification modes, checked in order:
- *
- * 1. **URL signature** (`sig` param): the exact URL was signed server-side
- *    during SSR/prerender. Locked to the specific path + query params.
- *
- * 2. **Page token** (`_pt` + `_ts` params): the client received a short-lived
- *    token during SSR and is making a reactive proxy request with new params.
- *    Valid for any params on the target path, but expires after `maxAge`.
- *
- * Returns `false` if neither mode validates.
- */
-export declare function verifyProxyRequest(event: H3Event, secret: string, maxAge?: number): boolean;
-/**
- * Constant-time string comparison.
- *
- * Both inputs are expected to be equal-length hex strings. The loop runs over
- * the longer length so an early-exit on length mismatch doesn't leak the
- * expected length (though both are fixed at `SIG_LENGTH` in practice).
- */
-export declare function constantTimeEqual(a: string, b: string): boolean;

package/dist/runtime/server/utils/sign.js

@@ -1,91 +0,0 @@
-import { createHmac } from "node:crypto";
-import { getQuery } from "#nuxt-scripts/h3";
-import {
-  PAGE_TOKEN_MAX_AGE,
-  PAGE_TOKEN_PARAM,
-  PAGE_TOKEN_TS_PARAM,
-  SIG_LENGTH,
-  SIG_PARAM
-} from "./sign-constants.js";
-export { PAGE_TOKEN_MAX_AGE, PAGE_TOKEN_PARAM, PAGE_TOKEN_TS_PARAM, SIG_LENGTH, SIG_PARAM };
-export function canonicalizeQuery(query) {
-  const keys = Object.keys(query).filter((k) => k !== SIG_PARAM && query[k] !== void 0 && query[k] !== null).sort();
-  const parts = [];
-  for (const key of keys) {
-    const value = query[key];
-    const encodedKey = encodeURIComponent(key);
-    if (Array.isArray(value)) {
-      for (const item of value) {
-        if (item === void 0 || item === null)
-          continue;
-        parts.push(`${encodedKey}=${encodeURIComponent(serializeValue(item))}`);
-      }
-    } else {
-      parts.push(`${encodedKey}=${encodeURIComponent(serializeValue(value))}`);
-    }
-  }
-  return parts.join("&");
-}
-function serializeValue(value) {
-  if (typeof value === "string")
-    return value;
-  if (typeof value === "object")
-    return JSON.stringify(value);
-  return String(value);
-}
-export function signProxyUrl(path, query, secret) {
-  const canonical = canonicalizeQuery(query);
-  const input = canonical ? `${path}?${canonical}` : path;
-  return createHmac("sha256", secret).update(input).digest("hex").slice(0, SIG_LENGTH);
-}
-export function buildSignedProxyUrl(path, query, secret) {
-  const sig = signProxyUrl(path, query, secret);
-  const canonical = canonicalizeQuery(query);
-  const queryString = canonical ? `${canonical}&${SIG_PARAM}=${sig}` : `${SIG_PARAM}=${sig}`;
-  return `${path}?${queryString}`;
-}
-export function generateProxyToken(secret, timestamp) {
-  return createHmac("sha256", secret).update(`proxy-access:${timestamp}`).digest("hex").slice(0, SIG_LENGTH);
-}
-export function verifyProxyToken(token, timestamp, secret, maxAge = PAGE_TOKEN_MAX_AGE, now = Math.floor(Date.now() / 1e3)) {
-  if (!token || !secret || typeof timestamp !== "number")
-    return false;
-  if (token.length !== SIG_LENGTH)
-    return false;
-  const age = now - timestamp;
-  if (age > maxAge || age < -60)
-    return false;
-  const expected = generateProxyToken(secret, timestamp);
-  return constantTimeEqual(expected, token);
-}
-export function verifyProxyRequest(event, secret, maxAge) {
-  if (!secret)
-    return false;
-  const query = getQuery(event);
-  const rawSig = query[SIG_PARAM];
-  const sig = Array.isArray(rawSig) ? rawSig[0] : rawSig;
-  if (typeof sig === "string" && sig.length === SIG_LENGTH) {
-    const path = (event.path || "").split("?")[0] || "";
-    const expected = signProxyUrl(path, query, secret);
-    if (constantTimeEqual(expected, sig))
-      return true;
-  }
-  const rawToken = query[PAGE_TOKEN_PARAM];
-  const rawTs = query[PAGE_TOKEN_TS_PARAM];
-  const token = Array.isArray(rawToken) ? rawToken[0] : rawToken;
-  const ts = Array.isArray(rawTs) ? rawTs[0] : rawTs;
-  if (typeof token === "string" && ts !== void 0) {
-    const timestamp = Number(ts);
-    if (!Number.isNaN(timestamp))
-      return verifyProxyToken(token, timestamp, secret, maxAge);
-  }
-  return false;
-}
-export function constantTimeEqual(a, b) {
-  if (a.length !== b.length)
-    return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++)
-    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  return diff === 0;
-}

package/dist/runtime/server/utils/withSigning.d.ts

@@ -1,23 +0,0 @@
-/**
- * Middleware wrapper that enforces HMAC signature verification on a proxy handler.
- *
- * Usage:
- * ```ts
- * export default withSigning(defineEventHandler(async (event) => {
- *   // ... handler logic
- * }))
- * ```
- *
- * Behavior:
- * - Reads `runtimeConfig.nuxt-scripts.proxySecret` (server-only).
- * - If no secret is configured: passes through (signing not yet enabled).
- *   This allows shipping handler wiring before components emit signed URLs.
- *   Once `NUXT_SCRIPTS_PROXY_SECRET` is set, verification is enforced.
- * - If a secret IS configured and the request's signature is invalid: 403.
- * - Otherwise, delegates to the wrapped handler.
- *
- * The outer wrapper runs before any handler logic, so unauthorized requests
- * never reach the upstream fetch and cannot consume API quota.
- */
-import type { EventHandler, EventHandlerRequest, EventHandlerResponse } from '#nuxt-scripts/h3';
-export declare function withSigning<Req extends EventHandlerRequest = EventHandlerRequest, Res extends EventHandlerResponse = EventHandlerResponse>(handler: EventHandler<Req, Res>): EventHandler<Req, any>;

package/dist/runtime/server/utils/withSigning.js

@@ -1,19 +0,0 @@
-import { createError, defineEventHandler } from "#nuxt-scripts/h3";
-import { useRuntimeConfig } from "#nuxt-scripts/nitro";
-import { verifyProxyRequest } from "./sign.js";
-export function withSigning(handler) {
-  return defineEventHandler(async (event) => {
-    const runtimeConfig = useRuntimeConfig();
-    const scriptsConfig = runtimeConfig["nuxt-scripts"];
-    const secret = scriptsConfig?.proxySecret;
-    if (!secret)
-      return handler(event);
-    if (!verifyProxyRequest(event, secret, scriptsConfig?.pageTokenMaxAge)) {
-      throw createError({
-        statusCode: 403,
-        statusMessage: "Invalid signature"
-      });
-    }
-    return handler(event);
-  });
-}

package/dist/runtime/unhead-features.d.ts

@@ -1 +0,0 @@
-export declare function isUnheadSourceLessScriptLoaderEnabled(): boolean;

package/dist/runtime/unhead-features.js

@@ -1,3 +0,0 @@
-export function isUnheadSourceLessScriptLoaderEnabled() {
-  return typeof __NUXT_SCRIPTS_UNHEAD_SOURCELESS__ !== "undefined" && __NUXT_SCRIPTS_UNHEAD_SOURCELESS__;
-}