@scalemule/nextjs 0.0.40 → 0.0.41

package/dist/server/index.d.mts

@@ -1142,4 +1142,121 @@ declare function validateSafeRedirect(input: string | null | undefined, opts?: S
  */
 declare function isSafeRedirect(input: string | null | undefined, opts?: SafeRedirectOptions): boolean;
 
-export { type AnalyticsRoutesConfig, type AnalyticsTrackingGateConfig, type AuthMiddlewareConfig, type AuthRoutesConfig, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type HandlerContext, type HandlerOptions, KNOWN_ACCOUNTS_COOKIE_NAME, type KnownAccountEntry, type MySqlBundle, type NotificationRoutesConfig, OAUTH_STATE_COOKIE_NAME, type OAuthBundle, type PostgresBundle, type PushRoutesConfig, type RedisBundle, type S3Bundle, SESSION_COOKIE_NAME, type SafeRedirectOptions, ScaleMuleError, ServerConfig, type SessionCookieOptions, type SessionData, type SmtpBundle, USER_ID_COOKIE_NAME, apiHandler, appendKnownAccountCookie, buildClientContextHeaders, buildFlagContext, clearKnownAccountsCookie, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, createNotificationRoutes, createPushRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBootstrapFlags, getBundle, getCSRFToken, getKnownAccountsCookieRaw, getKnownAccountsFromRequest, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, isSafeRedirect, normalizeKnownAccountsCookie, prefetchBundles, prefetchSecrets, removeKnownAccountFromCookie, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, validateSafeRedirect, withAuth, withCSRFProtection, withCSRFToken, withSession };
+/**
+ * Security-headers helper for Next.js hosts.
+ *
+ * Returns a shape that drops directly into the `headers()` entry in
+ * `next.config.ts` (or the `headers` field of a Route Handler
+ * `NextResponse`). Reasonable defaults for the top-of-OWASP headers
+ * — HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy,
+ * X-XSS-Protection, Permissions-Policy — with knobs for the fields
+ * that typically differ by app (HSTS duration, frame ancestors,
+ * camera/microphone policies).
+ *
+ * Framework-agnostic: no imports from `next/*` so the function works
+ * in Edge / Node / middleware and is trivially unit-testable.
+ */
+interface SecurityHeaderEntry {
+    key: string;
+    value: string;
+}
+interface BuildSecurityHeadersOptions {
+    /**
+     * HSTS max-age in seconds. Default `31536000` (1 year) — the value
+     * required for inclusion on the HSTS preload list. Set to `0` (or
+     * pass `includeHsts: false`) to opt out entirely.
+     */
+    hstsMaxAgeSeconds?: number;
+    /** Adds the `includeSubDomains` directive to HSTS. Default `true`. */
+    hstsIncludeSubDomains?: boolean;
+    /**
+     * Adds the `preload` directive to HSTS. Default `false` — only set
+     * to `true` after you've read https://hstspreload.org and are ready
+     * to commit; reversing it requires months of calendar time.
+     */
+    hstsPreload?: boolean;
+    /** Emit the HSTS header at all. Default `true`. */
+    includeHsts?: boolean;
+    /**
+     * Value for `X-Frame-Options`. Default `'DENY'`. Pass `'SAMEORIGIN'`
+     * if your app is framed by its own subdomain. Set to `null` to
+     * suppress (e.g. when you're already using `frame-ancestors` in
+     * CSP). `SAMEORIGIN` accepts no host parameter; use CSP's
+     * `frame-ancestors` for finer-grained framing policy.
+     */
+    frameOptions?: 'DENY' | 'SAMEORIGIN' | null;
+    /**
+     * Value for `Referrer-Policy`. Default `'strict-origin-when-cross-origin'`
+     * — same as Next.js's own default, balances analytics with privacy.
+     */
+    referrerPolicy?: 'no-referrer' | 'no-referrer-when-downgrade' | 'origin' | 'origin-when-cross-origin' | 'same-origin' | 'strict-origin' | 'strict-origin-when-cross-origin' | 'unsafe-url';
+    /**
+     * Permissions-Policy directives. Pass a map of `{ feature: allowlist }`
+     * where the allowlist is either an array of origins (string[]) or
+     * one of the well-known tokens `'self'` / `'*'` / `'()'` (deny).
+     *
+     * Default: camera + microphone allowed for `'self'` only (useful
+     * for the conference track); geolocation + payment denied; every
+     * other common feature left unset (browsers apply their own
+     * conservative defaults).
+     *
+     * Pass `{}` to emit an empty `Permissions-Policy: ` header (rarely
+     * useful). Pass `null` to suppress the header entirely.
+     */
+    permissionsPolicy?: PermissionsPolicyMap | null;
+    /**
+     * Value for `X-Content-Type-Options`. Default `'nosniff'` — do not
+     * override without a specific reason.
+     */
+    contentTypeOptions?: string | null;
+    /**
+     * Legacy `X-XSS-Protection`. Default `'0'` (disables the
+     * deprecated IE/Edge filter which had known bypass issues —
+     * recommended by OWASP + Next.js). Set to `'1; mode=block'` only
+     * if you have a specific compliance reason.
+     */
+    xssProtection?: string | null;
+    /**
+     * Extra headers to merge into the result. Takes precedence over
+     * the computed ones — useful for adding Content-Security-Policy or
+     * Cross-Origin-* headers without forcing a new option for each.
+     */
+    extraHeaders?: SecurityHeaderEntry[];
+}
+type PermissionsPolicyValue = readonly string[] | 'self' | '*' | '()';
+type PermissionsPolicyMap = Readonly<Record<string, PermissionsPolicyValue>>;
+declare const DEFAULT_PERMISSIONS_POLICY: PermissionsPolicyMap;
+/**
+ * Build a reasonable-default set of security response headers in the
+ * exact shape Next.js `headers()` expects.
+ *
+ * @example next.config.ts
+ * ```ts
+ * import { buildSecurityHeaders } from '@scalemule/nextjs/server'
+ *
+ * export default {
+ *   async headers() {
+ *     return [
+ *       { source: '/:path*', headers: buildSecurityHeaders() },
+ *     ]
+ *   },
+ * }
+ * ```
+ *
+ * @example custom overrides
+ * ```ts
+ * buildSecurityHeaders({
+ *   frameOptions: 'SAMEORIGIN',
+ *   permissionsPolicy: {
+ *     camera: ['https://trusted.example.com'],
+ *     microphone: ['https://trusted.example.com'],
+ *   },
+ *   extraHeaders: [
+ *     { key: 'Content-Security-Policy', value: "default-src 'self'" },
+ *   ],
+ * })
+ * ```
+ */
+declare function buildSecurityHeaders(opts?: BuildSecurityHeadersOptions): SecurityHeaderEntry[];
+
+export { type AnalyticsRoutesConfig, type AnalyticsTrackingGateConfig, type AuthMiddlewareConfig, type AuthRoutesConfig, type BuildSecurityHeadersOptions, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, DEFAULT_PERMISSIONS_POLICY, type HandlerContext, type HandlerOptions, KNOWN_ACCOUNTS_COOKIE_NAME, type KnownAccountEntry, type MySqlBundle, type NotificationRoutesConfig, OAUTH_STATE_COOKIE_NAME, type OAuthBundle, type PermissionsPolicyMap, type PermissionsPolicyValue, type PostgresBundle, type PushRoutesConfig, type RedisBundle, type S3Bundle, SESSION_COOKIE_NAME, type SafeRedirectOptions, ScaleMuleError, type SecurityHeaderEntry, ServerConfig, type SessionCookieOptions, type SessionData, type SmtpBundle, USER_ID_COOKIE_NAME, apiHandler, appendKnownAccountCookie, buildClientContextHeaders, buildFlagContext, buildSecurityHeaders, clearKnownAccountsCookie, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, createNotificationRoutes, createPushRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBootstrapFlags, getBundle, getCSRFToken, getKnownAccountsCookieRaw, getKnownAccountsFromRequest, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, isSafeRedirect, normalizeKnownAccountsCookie, prefetchBundles, prefetchSecrets, removeKnownAccountFromCookie, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, validateSafeRedirect, withAuth, withCSRFProtection, withCSRFToken, withSession };

package/dist/server/index.d.ts

@@ -1142,4 +1142,121 @@ declare function validateSafeRedirect(input: string | null | undefined, opts?: S
  */
 declare function isSafeRedirect(input: string | null | undefined, opts?: SafeRedirectOptions): boolean;
 
-export { type AnalyticsRoutesConfig, type AnalyticsTrackingGateConfig, type AuthMiddlewareConfig, type AuthRoutesConfig, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type HandlerContext, type HandlerOptions, KNOWN_ACCOUNTS_COOKIE_NAME, type KnownAccountEntry, type MySqlBundle, type NotificationRoutesConfig, OAUTH_STATE_COOKIE_NAME, type OAuthBundle, type PostgresBundle, type PushRoutesConfig, type RedisBundle, type S3Bundle, SESSION_COOKIE_NAME, type SafeRedirectOptions, ScaleMuleError, ServerConfig, type SessionCookieOptions, type SessionData, type SmtpBundle, USER_ID_COOKIE_NAME, apiHandler, appendKnownAccountCookie, buildClientContextHeaders, buildFlagContext, clearKnownAccountsCookie, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, createNotificationRoutes, createPushRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBootstrapFlags, getBundle, getCSRFToken, getKnownAccountsCookieRaw, getKnownAccountsFromRequest, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, isSafeRedirect, normalizeKnownAccountsCookie, prefetchBundles, prefetchSecrets, removeKnownAccountFromCookie, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, validateSafeRedirect, withAuth, withCSRFProtection, withCSRFToken, withSession };
+/**
+ * Security-headers helper for Next.js hosts.
+ *
+ * Returns a shape that drops directly into the `headers()` entry in
+ * `next.config.ts` (or the `headers` field of a Route Handler
+ * `NextResponse`). Reasonable defaults for the top-of-OWASP headers
+ * — HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy,
+ * X-XSS-Protection, Permissions-Policy — with knobs for the fields
+ * that typically differ by app (HSTS duration, frame ancestors,
+ * camera/microphone policies).
+ *
+ * Framework-agnostic: no imports from `next/*` so the function works
+ * in Edge / Node / middleware and is trivially unit-testable.
+ */
+interface SecurityHeaderEntry {
+    key: string;
+    value: string;
+}
+interface BuildSecurityHeadersOptions {
+    /**
+     * HSTS max-age in seconds. Default `31536000` (1 year) — the value
+     * required for inclusion on the HSTS preload list. Set to `0` (or
+     * pass `includeHsts: false`) to opt out entirely.
+     */
+    hstsMaxAgeSeconds?: number;
+    /** Adds the `includeSubDomains` directive to HSTS. Default `true`. */
+    hstsIncludeSubDomains?: boolean;
+    /**
+     * Adds the `preload` directive to HSTS. Default `false` — only set
+     * to `true` after you've read https://hstspreload.org and are ready
+     * to commit; reversing it requires months of calendar time.
+     */
+    hstsPreload?: boolean;
+    /** Emit the HSTS header at all. Default `true`. */
+    includeHsts?: boolean;
+    /**
+     * Value for `X-Frame-Options`. Default `'DENY'`. Pass `'SAMEORIGIN'`
+     * if your app is framed by its own subdomain. Set to `null` to
+     * suppress (e.g. when you're already using `frame-ancestors` in
+     * CSP). `SAMEORIGIN` accepts no host parameter; use CSP's
+     * `frame-ancestors` for finer-grained framing policy.
+     */
+    frameOptions?: 'DENY' | 'SAMEORIGIN' | null;
+    /**
+     * Value for `Referrer-Policy`. Default `'strict-origin-when-cross-origin'`
+     * — same as Next.js's own default, balances analytics with privacy.
+     */
+    referrerPolicy?: 'no-referrer' | 'no-referrer-when-downgrade' | 'origin' | 'origin-when-cross-origin' | 'same-origin' | 'strict-origin' | 'strict-origin-when-cross-origin' | 'unsafe-url';
+    /**
+     * Permissions-Policy directives. Pass a map of `{ feature: allowlist }`
+     * where the allowlist is either an array of origins (string[]) or
+     * one of the well-known tokens `'self'` / `'*'` / `'()'` (deny).
+     *
+     * Default: camera + microphone allowed for `'self'` only (useful
+     * for the conference track); geolocation + payment denied; every
+     * other common feature left unset (browsers apply their own
+     * conservative defaults).
+     *
+     * Pass `{}` to emit an empty `Permissions-Policy: ` header (rarely
+     * useful). Pass `null` to suppress the header entirely.
+     */
+    permissionsPolicy?: PermissionsPolicyMap | null;
+    /**
+     * Value for `X-Content-Type-Options`. Default `'nosniff'` — do not
+     * override without a specific reason.
+     */
+    contentTypeOptions?: string | null;
+    /**
+     * Legacy `X-XSS-Protection`. Default `'0'` (disables the
+     * deprecated IE/Edge filter which had known bypass issues —
+     * recommended by OWASP + Next.js). Set to `'1; mode=block'` only
+     * if you have a specific compliance reason.
+     */
+    xssProtection?: string | null;
+    /**
+     * Extra headers to merge into the result. Takes precedence over
+     * the computed ones — useful for adding Content-Security-Policy or
+     * Cross-Origin-* headers without forcing a new option for each.
+     */
+    extraHeaders?: SecurityHeaderEntry[];
+}
+type PermissionsPolicyValue = readonly string[] | 'self' | '*' | '()';
+type PermissionsPolicyMap = Readonly<Record<string, PermissionsPolicyValue>>;
+declare const DEFAULT_PERMISSIONS_POLICY: PermissionsPolicyMap;
+/**
+ * Build a reasonable-default set of security response headers in the
+ * exact shape Next.js `headers()` expects.
+ *
+ * @example next.config.ts
+ * ```ts
+ * import { buildSecurityHeaders } from '@scalemule/nextjs/server'
+ *
+ * export default {
+ *   async headers() {
+ *     return [
+ *       { source: '/:path*', headers: buildSecurityHeaders() },
+ *     ]
+ *   },
+ * }
+ * ```
+ *
+ * @example custom overrides
+ * ```ts
+ * buildSecurityHeaders({
+ *   frameOptions: 'SAMEORIGIN',
+ *   permissionsPolicy: {
+ *     camera: ['https://trusted.example.com'],
+ *     microphone: ['https://trusted.example.com'],
+ *   },
+ *   extraHeaders: [
+ *     { key: 'Content-Security-Policy', value: "default-src 'self'" },
+ *   ],
+ * })
+ * ```
+ */
+declare function buildSecurityHeaders(opts?: BuildSecurityHeadersOptions): SecurityHeaderEntry[];
+
+export { type AnalyticsRoutesConfig, type AnalyticsTrackingGateConfig, type AuthMiddlewareConfig, type AuthRoutesConfig, type BuildSecurityHeadersOptions, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, DEFAULT_PERMISSIONS_POLICY, type HandlerContext, type HandlerOptions, KNOWN_ACCOUNTS_COOKIE_NAME, type KnownAccountEntry, type MySqlBundle, type NotificationRoutesConfig, OAUTH_STATE_COOKIE_NAME, type OAuthBundle, type PermissionsPolicyMap, type PermissionsPolicyValue, type PostgresBundle, type PushRoutesConfig, type RedisBundle, type S3Bundle, SESSION_COOKIE_NAME, type SafeRedirectOptions, ScaleMuleError, type SecurityHeaderEntry, ServerConfig, type SessionCookieOptions, type SessionData, type SmtpBundle, USER_ID_COOKIE_NAME, apiHandler, appendKnownAccountCookie, buildClientContextHeaders, buildFlagContext, buildSecurityHeaders, clearKnownAccountsCookie, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, createNotificationRoutes, createPushRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBootstrapFlags, getBundle, getCSRFToken, getKnownAccountsCookieRaw, getKnownAccountsFromRequest, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, isSafeRedirect, normalizeKnownAccountsCookie, prefetchBundles, prefetchSecrets, removeKnownAccountFromCookie, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, validateSafeRedirect, withAuth, withCSRFProtection, withCSRFToken, withSession };

package/dist/server/index.js

@@ -5145,8 +5145,77 @@ function isSafeRedirect(input, opts = {}) {
   return resolved !== defaultPath;
 }
 
+// src/server/security-headers.ts
+var DEFAULT_PERMISSIONS_POLICY = {
+  // Conference track features — allow self-origin only.
+  camera: "self",
+  microphone: "self",
+  "display-capture": "self",
+  // Deny-by-default for features the SDK never uses.
+  geolocation: "()",
+  payment: "()",
+  "publickey-credentials-get": "self",
+  usb: "()",
+  serial: "()",
+  bluetooth: "()"
+};
+function formatPermissionsDirective(feature, value) {
+  if (value === "*") return `${feature}=*`;
+  if (value === "()" || Array.isArray(value) && value.length === 0) {
+    return `${feature}=()`;
+  }
+  if (value === "self") return `${feature}=(self)`;
+  const origins = value;
+  const parts = origins.map((o) => o === "self" ? "self" : `"${o}"`);
+  return `${feature}=(${parts.join(" ")})`;
+}
+function buildSecurityHeaders(opts = {}) {
+  const headers2 = [];
+  const includeHsts = opts.includeHsts ?? true;
+  const hstsMaxAge = opts.hstsMaxAgeSeconds ?? 31536e3;
+  if (includeHsts && hstsMaxAge > 0) {
+    const parts = [`max-age=${hstsMaxAge}`];
+    if (opts.hstsIncludeSubDomains ?? true) parts.push("includeSubDomains");
+    if (opts.hstsPreload ?? false) parts.push("preload");
+    headers2.push({
+      key: "Strict-Transport-Security",
+      value: parts.join("; ")
+    });
+  }
+  const frameOptions = opts.frameOptions === void 0 ? "DENY" : opts.frameOptions;
+  if (frameOptions !== null) {
+    headers2.push({ key: "X-Frame-Options", value: frameOptions });
+  }
+  const contentTypeOptions = opts.contentTypeOptions === void 0 ? "nosniff" : opts.contentTypeOptions;
+  if (contentTypeOptions !== null) {
+    headers2.push({ key: "X-Content-Type-Options", value: contentTypeOptions });
+  }
+  headers2.push({
+    key: "Referrer-Policy",
+    value: opts.referrerPolicy ?? "strict-origin-when-cross-origin"
+  });
+  const xss = opts.xssProtection === void 0 ? "0" : opts.xssProtection;
+  if (xss !== null) {
+    headers2.push({ key: "X-XSS-Protection", value: xss });
+  }
+  const permissions = opts.permissionsPolicy === void 0 ? DEFAULT_PERMISSIONS_POLICY : opts.permissionsPolicy;
+  if (permissions !== null) {
+    const directives = Object.entries(permissions).map(([feature, value]) => formatPermissionsDirective(feature, value)).join(", ");
+    headers2.push({ key: "Permissions-Policy", value: directives });
+  }
+  if (opts.extraHeaders?.length) {
+    const byKey = new Map(headers2.map((h) => [h.key.toLowerCase(), h]));
+    for (const extra of opts.extraHeaders) {
+      byKey.set(extra.key.toLowerCase(), extra);
+    }
+    return Array.from(byKey.values());
+  }
+  return headers2;
+}
+
 exports.CSRF_COOKIE_NAME = CSRF_COOKIE_NAME;
 exports.CSRF_HEADER_NAME = CSRF_HEADER_NAME;
+exports.DEFAULT_PERMISSIONS_POLICY = DEFAULT_PERMISSIONS_POLICY;
 exports.KNOWN_ACCOUNTS_COOKIE_NAME = KNOWN_ACCOUNTS_COOKIE_NAME;
 exports.OAUTH_STATE_COOKIE_NAME = OAUTH_STATE_COOKIE_NAME;
 exports.SESSION_COOKIE_NAME = SESSION_COOKIE_NAME;
@@ -5157,6 +5226,7 @@ exports.apiHandler = apiHandler;
 exports.appendKnownAccountCookie = appendKnownAccountCookie;
 exports.buildClientContextHeaders = buildClientContextHeaders;
 exports.buildFlagContext = buildFlagContext;
+exports.buildSecurityHeaders = buildSecurityHeaders;
 exports.clearKnownAccountsCookie = clearKnownAccountsCookie;
 exports.clearOAuthState = clearOAuthState;
 exports.clearSession = clearSession;

package/dist/server/index.mjs

@@ -5143,4 +5143,72 @@ function isSafeRedirect(input, opts = {}) {
   return resolved !== defaultPath;
 }
 
-export { CSRF_COOKIE_NAME, CSRF_HEADER_NAME, KNOWN_ACCOUNTS_COOKIE_NAME, OAUTH_STATE_COOKIE_NAME, SESSION_COOKIE_NAME, ScaleMuleError, ScaleMuleServer, USER_ID_COOKIE_NAME, apiHandler, appendKnownAccountCookie, buildClientContextHeaders, buildFlagContext, clearKnownAccountsCookie, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, createNotificationRoutes, createPushRoutes, createServerClient, createWebhookHandler, createWebhookRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBootstrapFlags, getBundle, getCSRFToken, getKnownAccountsCookieRaw, getKnownAccountsFromRequest, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, isSafeRedirect, normalizeKnownAccountsCookie, parseWebhookEvent, prefetchBundles, prefetchSecrets, registerVideoWebhook, removeKnownAccountFromCookie, requireAppSecret, requireBundle, requireSession, resolveGatewayUrl, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, validateSafeRedirect, verifyWebhookSignature, withAuth, withCSRFProtection, withCSRFToken, withSession };
+// src/server/security-headers.ts
+var DEFAULT_PERMISSIONS_POLICY = {
+  // Conference track features — allow self-origin only.
+  camera: "self",
+  microphone: "self",
+  "display-capture": "self",
+  // Deny-by-default for features the SDK never uses.
+  geolocation: "()",
+  payment: "()",
+  "publickey-credentials-get": "self",
+  usb: "()",
+  serial: "()",
+  bluetooth: "()"
+};
+function formatPermissionsDirective(feature, value) {
+  if (value === "*") return `${feature}=*`;
+  if (value === "()" || Array.isArray(value) && value.length === 0) {
+    return `${feature}=()`;
+  }
+  if (value === "self") return `${feature}=(self)`;
+  const origins = value;
+  const parts = origins.map((o) => o === "self" ? "self" : `"${o}"`);
+  return `${feature}=(${parts.join(" ")})`;
+}
+function buildSecurityHeaders(opts = {}) {
+  const headers2 = [];
+  const includeHsts = opts.includeHsts ?? true;
+  const hstsMaxAge = opts.hstsMaxAgeSeconds ?? 31536e3;
+  if (includeHsts && hstsMaxAge > 0) {
+    const parts = [`max-age=${hstsMaxAge}`];
+    if (opts.hstsIncludeSubDomains ?? true) parts.push("includeSubDomains");
+    if (opts.hstsPreload ?? false) parts.push("preload");
+    headers2.push({
+      key: "Strict-Transport-Security",
+      value: parts.join("; ")
+    });
+  }
+  const frameOptions = opts.frameOptions === void 0 ? "DENY" : opts.frameOptions;
+  if (frameOptions !== null) {
+    headers2.push({ key: "X-Frame-Options", value: frameOptions });
+  }
+  const contentTypeOptions = opts.contentTypeOptions === void 0 ? "nosniff" : opts.contentTypeOptions;
+  if (contentTypeOptions !== null) {
+    headers2.push({ key: "X-Content-Type-Options", value: contentTypeOptions });
+  }
+  headers2.push({
+    key: "Referrer-Policy",
+    value: opts.referrerPolicy ?? "strict-origin-when-cross-origin"
+  });
+  const xss = opts.xssProtection === void 0 ? "0" : opts.xssProtection;
+  if (xss !== null) {
+    headers2.push({ key: "X-XSS-Protection", value: xss });
+  }
+  const permissions = opts.permissionsPolicy === void 0 ? DEFAULT_PERMISSIONS_POLICY : opts.permissionsPolicy;
+  if (permissions !== null) {
+    const directives = Object.entries(permissions).map(([feature, value]) => formatPermissionsDirective(feature, value)).join(", ");
+    headers2.push({ key: "Permissions-Policy", value: directives });
+  }
+  if (opts.extraHeaders?.length) {
+    const byKey = new Map(headers2.map((h) => [h.key.toLowerCase(), h]));
+    for (const extra of opts.extraHeaders) {
+      byKey.set(extra.key.toLowerCase(), extra);
+    }
+    return Array.from(byKey.values());
+  }
+  return headers2;
+}
+
+export { CSRF_COOKIE_NAME, CSRF_HEADER_NAME, DEFAULT_PERMISSIONS_POLICY, KNOWN_ACCOUNTS_COOKIE_NAME, OAUTH_STATE_COOKIE_NAME, SESSION_COOKIE_NAME, ScaleMuleError, ScaleMuleServer, USER_ID_COOKIE_NAME, apiHandler, appendKnownAccountCookie, buildClientContextHeaders, buildFlagContext, buildSecurityHeaders, clearKnownAccountsCookie, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, createNotificationRoutes, createPushRoutes, createServerClient, createWebhookHandler, createWebhookRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBootstrapFlags, getBundle, getCSRFToken, getKnownAccountsCookieRaw, getKnownAccountsFromRequest, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, isSafeRedirect, normalizeKnownAccountsCookie, parseWebhookEvent, prefetchBundles, prefetchSecrets, registerVideoWebhook, removeKnownAccountFromCookie, requireAppSecret, requireBundle, requireSession, resolveGatewayUrl, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, validateSafeRedirect, verifyWebhookSignature, withAuth, withCSRFProtection, withCSRFToken, withSession };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalemule/nextjs",
-  "version": "0.0.40",
+  "version": "0.0.41",
   "description": "ScaleMule SDK for Next.js applications - authentication, storage, and user management",
   "main": "dist/index.js",
   "module": "dist/index.mjs",