nuxt-security-module 0.0.0-stage → 4.1.1

package/dist/runtime/nitro/plugins/hidePoweredBy.js

@@ -0,0 +1,13 @@
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { definePlugin } from "nitro";
+import { isEvent } from "nitro/h3";
+//#region src/runtime/nitro/plugins/hidePoweredBy.ts
+const hidePoweredBy = definePlugin((nitroApp) => {
+	nitroApp.hooks.hook("response", (_response, event) => {
+		if (!isEvent(event)) return;
+		const rules = getSecurityRules(event);
+		if (rules?.enabled && rules.hidePoweredBy) event.res.headers.delete("x-powered-by");
+	});
+});
+//#endregion
+export { hidePoweredBy as default };

package/dist/runtime/nitro/plugins/nonce.d.ts

@@ -0,0 +1,5 @@
+import { NitroAppPlugin } from "nitro/types";
+//#region src/runtime/nitro/plugins/nonce.d.ts
+declare const noncePlugin: NitroAppPlugin;
+//#endregion
+export { noncePlugin as default };

package/dist/runtime/nitro/plugins/nonce.js

@@ -0,0 +1,27 @@
+import { generateNonce } from "../../services/generateNonce.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { getSecurityState } from "../../services/getSecurityState.js";
+import { injectNonce } from "../../services/injectNonce.js";
+import { definePlugin } from "nitro";
+//#region src/runtime/nitro/plugins/nonce.ts
+const HTML_SECTIONS = [
+	"body",
+	"bodyAppend",
+	"bodyPrepend",
+	"head"
+];
+const noncePlugin = definePlugin((nitroApp) => {
+	if (import.meta.prerender) return;
+	nitroApp.hooks.hook("render:route", (_context, { event }) => {
+		const rules = getSecurityRules(event);
+		if (rules?.enabled && rules.nonce) getSecurityState(event).nonce = generateNonce();
+	});
+	nitroApp.hooks.hook("render:html", (html, { event }) => {
+		const rules = getSecurityRules(event);
+		const nonce = getSecurityState(event).nonce;
+		if (!rules?.enabled || !rules.nonce || !rules.headers || !rules.headers.contentSecurityPolicy || !nonce) return;
+		for (const section of HTML_SECTIONS) html[section] = html[section].map((element) => injectNonce(element, nonce));
+	});
+});
+//#endregion
+export { noncePlugin as default };

package/dist/runtime/nitro/plugins/routeRules.d.ts

@@ -0,0 +1,5 @@
+import { SecurityRules } from "../../../models/SecurityRules.js";
+import { NitroAppPlugin } from "nitro/types";
+//#region src/runtime/nitro/plugins/routeRules.d.ts
+export declare const createRouteRulesPlugin: (routeRules: Record<string, SecurityRules>) => NitroAppPlugin;
+//#endregion

package/dist/runtime/nitro/plugins/routeRules.js

@@ -0,0 +1,17 @@
+import { ROUTE_RULES_HOOK } from "../../constants.js";
+import { setSecurityRouteMatcher } from "../../services/securityRouteMatcher.js";
+import { definePlugin } from "nitro";
+//#region src/runtime/nitro/plugins/routeRules.ts
+const createRouteRulesPlugin = (routeRules) => definePlugin((nitroApp) => {
+	let routesResolved;
+	nitroApp.hooks.hook("request", () => {
+		routesResolved ??= (async () => {
+			const routes = structuredClone(routeRules);
+			await nitroApp.hooks.callHook(ROUTE_RULES_HOOK, routes);
+			setSecurityRouteMatcher(routes);
+		})();
+		return routesResolved;
+	});
+});
+//#endregion
+export { createRouteRulesPlugin };

package/dist/runtime/nitro/plugins/securityHeaders.d.ts

@@ -0,0 +1,5 @@
+import { NitroAppPlugin } from "nitro/types";
+//#region src/runtime/nitro/plugins/securityHeaders.d.ts
+declare const securityHeaders: NitroAppPlugin;
+//#endregion
+export { securityHeaders as default };

package/dist/runtime/nitro/plugins/securityHeaders.js

@@ -0,0 +1,25 @@
+import { CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME, SECURITY_HEADER_NAMES } from "../../constants.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { getSecurityState } from "../../services/getSecurityState.js";
+import { serializeSecurityHeaders } from "../../services/serializeSecurityHeaders.js";
+import { updateContentSecurityPolicy } from "../../services/updateContentSecurityPolicy.js";
+import { definePlugin } from "nitro";
+//#region src/runtime/nitro/plugins/securityHeaders.ts
+const CONTENT_SECURITY_POLICY_HEADER_NAME = SECURITY_HEADER_NAMES.contentSecurityPolicy;
+const securityHeaders = definePlugin((nitroApp) => {
+	nitroApp.hooks.hook("render:route", (_context, { event }) => {
+		const rules = getSecurityRules(event);
+		if (!rules?.enabled || !rules.headers) return;
+		const { contentSecurityPolicy } = rules.headers;
+		const serializedHeaders = serializeSecurityHeaders({
+			...rules.headers,
+			contentSecurityPolicy: contentSecurityPolicy ? updateContentSecurityPolicy(contentSecurityPolicy, getSecurityState(event)) : false
+		});
+		for (const [name, value] of Object.entries(serializedHeaders)) {
+			const isPolicy = name === CONTENT_SECURITY_POLICY_HEADER_NAME;
+			event.res.headers.set(isPolicy && rules.contentSecurityPolicyReportOnly ? CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME : name, value);
+		}
+	});
+});
+//#endregion
+export { securityHeaders as default };

package/dist/runtime/nitro/plugins/ssgHashes.d.ts

@@ -0,0 +1,5 @@
+import { NitroAppPlugin } from "nitro/types";
+//#region src/runtime/nitro/plugins/ssgHashes.d.ts
+declare const ssgHashes: NitroAppPlugin;
+//#endregion
+export { ssgHashes as default };

package/dist/runtime/nitro/plugins/ssgHashes.js

@@ -0,0 +1,27 @@
+import { collectSsgHashes } from "../../services/collectSsgHashes.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { getSecurityState } from "../../services/getSecurityState.js";
+import { insertContentSecurityPolicyMeta } from "../../services/insertContentSecurityPolicyMeta.js";
+import { updateContentSecurityPolicy } from "../../services/updateContentSecurityPolicy.js";
+import { definePlugin } from "nitro";
+//#region src/runtime/nitro/plugins/ssgHashes.ts
+const HTML_SECTIONS = [
+	"head",
+	"bodyPrepend",
+	"body",
+	"bodyAppend"
+];
+const ssgHashes = definePlugin((nitroApp) => {
+	if (!import.meta.prerender) return;
+	nitroApp.hooks.hook("render:html", async (html, { event }) => {
+		const rules = getSecurityRules(event);
+		if (!rules?.enabled || !rules.ssg || !rules.headers || !rules.headers.contentSecurityPolicy) return;
+		const state = getSecurityState(event);
+		state.hashes = await collectSsgHashes(HTML_SECTIONS.map((section) => html[section].join("")).join(""), rules.ssg);
+		if (!rules.ssg.meta) return;
+		const policy = updateContentSecurityPolicy(rules.headers.contentSecurityPolicy, state);
+		html.head = [insertContentSecurityPolicyMeta(html.head.join(""), policy)];
+	});
+});
+//#endregion
+export { ssgHashes as default };

package/dist/runtime/nitro/plugins/subresourceIntegrity.d.ts

@@ -0,0 +1,4 @@
+import { NitroAppPlugin } from "nitro/types";
+//#region src/runtime/nitro/plugins/subresourceIntegrity.d.ts
+export declare const createSubresourceIntegrityPlugin: (sriHashes: Record<string, string>) => NitroAppPlugin;
+//#endregion

package/dist/runtime/nitro/plugins/subresourceIntegrity.js

@@ -0,0 +1,19 @@
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { injectSubresourceIntegrity } from "../../services/injectSubresourceIntegrity.js";
+import { definePlugin } from "nitro";
+//#region src/runtime/nitro/plugins/subresourceIntegrity.ts
+const HTML_SECTIONS = [
+	"body",
+	"bodyAppend",
+	"bodyPrepend",
+	"head"
+];
+const createSubresourceIntegrityPlugin = (sriHashes) => definePlugin((nitroApp) => {
+	nitroApp.hooks.hook("render:html", (html, { event }) => {
+		const rules = getSecurityRules(event);
+		if (!rules?.enabled || !rules.sri) return;
+		for (const section of HTML_SECTIONS) html[section] = html[section].map((element) => injectSubresourceIntegrity(element, sriHashes));
+	});
+});
+//#endregion
+export { createSubresourceIntegrityPlugin };

package/dist/runtime/server/middleware/allowedMethodsRestricter.d.ts

@@ -0,0 +1,5 @@
+import { Middleware } from "nitro/h3";
+//#region src/runtime/server/middleware/allowedMethodsRestricter.d.ts
+declare const allowedMethodsRestricter: Middleware;
+//#endregion
+export { allowedMethodsRestricter as default };

package/dist/runtime/server/middleware/allowedMethodsRestricter.js

@@ -0,0 +1,15 @@
+import { checkIsMethodAllowed } from "../../services/checkIsMethodAllowed.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { defineMiddleware } from "nitro";
+import { HTTPError } from "nitro/h3";
+//#region src/runtime/server/middleware/allowedMethodsRestricter.ts
+const allowedMethodsRestricter = defineMiddleware((event) => {
+	const rules = getSecurityRules(event);
+	if (!rules?.enabled || !rules.allowedMethodsRestricter) return;
+	if (!checkIsMethodAllowed(event.req.method, rules.allowedMethodsRestricter.methods)) throw new HTTPError({
+		status: 405,
+		statusText: "Method not allowed"
+	});
+});
+//#endregion
+export { allowedMethodsRestricter as default };

package/dist/runtime/server/middleware/basicAuth.d.ts

@@ -0,0 +1,5 @@
+import { Middleware } from "nitro/h3";
+//#region src/runtime/server/middleware/basicAuth.d.ts
+declare const basicAuthMiddleware: Middleware;
+//#endregion
+export { basicAuthMiddleware as default };

package/dist/runtime/server/middleware/basicAuth.js

@@ -0,0 +1,23 @@
+import "../../constants.js";
+import { checkIsBasicAuthorized } from "../../services/checkIsBasicAuthorized.js";
+import { checkIsChallenged } from "../../services/checkIsChallenged.js";
+import { getBasicAuthOptions } from "../../services/getBasicAuthOptions.js";
+import { serializeBasicAuthChallenge } from "../../services/serializeBasicAuthChallenge.js";
+import { defineMiddleware } from "nitro";
+import { HTTPError } from "nitro/h3";
+import { useRuntimeConfig } from "nuxt/server";
+//#region src/runtime/server/middleware/basicAuth.ts
+const basicAuthMiddleware = defineMiddleware((event) => {
+	const basicAuth = getBasicAuthOptions(useRuntimeConfig().private);
+	if (!basicAuth) return;
+	const { pathname } = event.url;
+	if (!checkIsChallenged(pathname, basicAuth)) return;
+	if (checkIsBasicAuthorized(event.req.headers.get("authorization"), basicAuth)) return;
+	event.res.headers.set("WWW-Authenticate", serializeBasicAuthChallenge(basicAuth.message || "Please enter username and password"));
+	throw new HTTPError({
+		status: 401,
+		statusText: "Access denied"
+	});
+});
+//#endregion
+export { basicAuthMiddleware as default };

package/dist/runtime/server/middleware/corsHandler.d.ts

@@ -0,0 +1,5 @@
+import { Middleware } from "nitro/h3";
+//#region src/runtime/server/middleware/corsHandler.d.ts
+declare const corsHandler: Middleware;
+//#endregion
+export { corsHandler as default };

package/dist/runtime/server/middleware/corsHandler.js

@@ -0,0 +1,20 @@
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { defineMiddleware } from "nitro";
+import { handleCors } from "nitro/h3";
+//#region src/runtime/server/middleware/corsHandler.ts
+const corsHandler = defineMiddleware((event) => {
+	const rules = getSecurityRules(event);
+	if (!rules?.enabled || !rules.corsHandler) return;
+	const { allowHeaders, credentials, exposeHeaders, maxAge, methods, origin, preflight } = rules.corsHandler;
+	handleCors(event, {
+		allowHeaders,
+		credentials,
+		exposeHeaders,
+		maxAge,
+		methods,
+		origin: [origin].flat(),
+		preflight
+	});
+});
+//#endregion
+export { corsHandler as default };

package/dist/runtime/server/middleware/csrf.d.ts

@@ -0,0 +1,5 @@
+import { Middleware } from "nitro/h3";
+//#region src/runtime/server/middleware/csrf.d.ts
+declare const csrf: Middleware;
+//#endregion
+export { csrf as default };

package/dist/runtime/server/middleware/csrf.js

@@ -0,0 +1,28 @@
+import { CSRF_UNSAFE_METHODS } from "../../constants.js";
+import { checkIsCsrfTokenValid } from "../../services/checkIsCsrfTokenValid.js";
+import { generateRandomToken } from "../../services/generateRandomToken.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { defineMiddleware } from "nitro";
+import { HTTPError, getCookie, setCookie } from "nitro/h3";
+//#region src/runtime/server/middleware/csrf.ts
+const csrf = defineMiddleware((event) => {
+	const rules = getSecurityRules(event);
+	if (!rules?.enabled || !rules.csrf) return;
+	const { cookieName, headerName } = rules.csrf;
+	const cookieToken = getCookie(event, cookieName);
+	if (!CSRF_UNSAFE_METHODS.includes(event.req.method)) {
+		if (cookieToken === void 0) setCookie(event, cookieName, generateRandomToken(32), {
+			httpOnly: false,
+			path: "/",
+			sameSite: "strict",
+			secure: event.url.protocol === "https:"
+		});
+		return;
+	}
+	if (!checkIsCsrfTokenValid(cookieToken, event.req.headers.get(headerName))) throw new HTTPError({
+		status: 403,
+		statusText: "Forbidden"
+	});
+});
+//#endregion
+export { csrf as default };

package/dist/runtime/server/middleware/rateLimiter.d.ts

@@ -0,0 +1,5 @@
+import { Middleware } from "nitro/h3";
+//#region src/runtime/server/middleware/rateLimiter.d.ts
+declare const rateLimiter: Middleware;
+//#endregion
+export { rateLimiter as default };

package/dist/runtime/server/middleware/rateLimiter.js

@@ -0,0 +1,22 @@
+import { MAX_RATE_LIMIT_ENTRIES } from "../../constants.js";
+import { createInMemoryRateLimiterStore } from "../../services/createInMemoryRateLimiterStore.js";
+import { getRetryAfterSeconds } from "../../services/getRetryAfterSeconds.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { defineMiddleware } from "nitro";
+import { HTTPError, getRequestIP } from "nitro/h3";
+//#region src/runtime/server/middleware/rateLimiter.ts
+const rateLimiterStore = createInMemoryRateLimiterStore(MAX_RATE_LIMIT_ENTRIES);
+const rateLimiter = defineMiddleware(async (event) => {
+	const rules = getSecurityRules(event);
+	if (!rules?.enabled || !rules.rateLimiter) return;
+	const key = getRequestIP(event, { xForwardedFor: false }) ?? "unknown";
+	const retryAfterSeconds = await getRetryAfterSeconds(rateLimiterStore, key, rules.rateLimiter);
+	if (retryAfterSeconds === void 0) return;
+	event.res.headers.set("Retry-After", String(retryAfterSeconds));
+	throw new HTTPError({
+		status: 429,
+		statusText: "Too Many Requests"
+	});
+});
+//#endregion
+export { rateLimiter as default };

package/dist/runtime/server/middleware/requestSizeLimiter.d.ts

@@ -0,0 +1,5 @@
+import { Middleware } from "nitro/h3";
+//#region src/runtime/server/middleware/requestSizeLimiter.d.ts
+declare const requestSizeLimiter: Middleware;
+//#endregion
+export { requestSizeLimiter as default };

package/dist/runtime/server/middleware/requestSizeLimiter.js

@@ -0,0 +1,17 @@
+import { checkIsRequestTooLarge } from "../../services/checkIsRequestTooLarge.js";
+import { getSecurityRules } from "../../services/getSecurityRules.js";
+import { defineMiddleware } from "nitro";
+import { HTTPError } from "nitro/h3";
+//#region src/runtime/server/middleware/requestSizeLimiter.ts
+const requestSizeLimiter = defineMiddleware((event) => {
+	const rules = getSecurityRules(event);
+	if (!rules?.enabled || !rules.requestSizeLimiter) return;
+	const contentLength = event.req.headers.get("content-length");
+	const contentType = event.req.headers.get("content-type");
+	if (checkIsRequestTooLarge(event.req.method, contentLength, contentType, rules.requestSizeLimiter)) throw new HTTPError({
+		status: 413,
+		statusText: "Payload Too Large"
+	});
+});
+//#endregion
+export { requestSizeLimiter as default };

package/dist/runtime/services/checkIsBasicAuthorized.d.ts

@@ -0,0 +1,4 @@
+import { BasicAuthOptions } from "../../models/BasicAuthOptions.js";
+//#region src/runtime/services/checkIsBasicAuthorized.d.ts
+export declare const checkIsBasicAuthorized: (authorization: null | string, { name, pass }: BasicAuthOptions) => boolean;
+//#endregion

package/dist/runtime/services/checkIsBasicAuthorized.js

@@ -0,0 +1,12 @@
+import { checkIsEqualInConstantTime } from "./checkIsEqualInConstantTime.js";
+import { getBasicAuthCredentials } from "./getBasicAuthCredentials.js";
+//#region src/runtime/services/checkIsBasicAuthorized.ts
+const checkIsBasicAuthorized = (authorization, { name, pass }) => {
+	const credentials = getBasicAuthCredentials(authorization);
+	if (!credentials) return false;
+	const isNameEqual = checkIsEqualInConstantTime(credentials.name, name);
+	const isPassEqual = checkIsEqualInConstantTime(credentials.pass, pass);
+	return isNameEqual && isPassEqual;
+};
+//#endregion
+export { checkIsBasicAuthorized };

package/dist/runtime/services/checkIsChallenged.d.ts

@@ -0,0 +1,4 @@
+import { BasicAuthOptions } from "../../models/BasicAuthOptions.js";
+//#region src/runtime/services/checkIsChallenged.d.ts
+export declare const checkIsChallenged: (path: string, { exclude, include }: BasicAuthOptions) => boolean;
+//#endregion

package/dist/runtime/services/checkIsChallenged.js

@@ -0,0 +1,8 @@
+//#region src/runtime/services/checkIsChallenged.ts
+const checkIsChallenged = (path, { exclude = [], include = [] }) => {
+	const isIncluded = include.some((prefix) => path.startsWith(prefix));
+	const isExcluded = exclude.some((prefix) => path.startsWith(prefix));
+	return isIncluded || !isExcluded;
+};
+//#endregion
+export { checkIsChallenged };

package/dist/runtime/services/checkIsCsrfTokenValid.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/checkIsCsrfTokenValid.d.ts
+export declare const checkIsCsrfTokenValid: (cookieToken: string | undefined, headerToken: null | string) => boolean;
+//#endregion

package/dist/runtime/services/checkIsCsrfTokenValid.js

@@ -0,0 +1,8 @@
+import { checkIsEqualInConstantTime } from "./checkIsEqualInConstantTime.js";
+//#region src/runtime/services/checkIsCsrfTokenValid.ts
+const checkIsCsrfTokenValid = (cookieToken, headerToken) => {
+	if (!cookieToken || !headerToken) return false;
+	return checkIsEqualInConstantTime(cookieToken, headerToken);
+};
+//#endregion
+export { checkIsCsrfTokenValid };

package/dist/runtime/services/checkIsEqualInConstantTime.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/checkIsEqualInConstantTime.d.ts
+export declare const checkIsEqualInConstantTime: (first: string, second: string) => boolean;
+//#endregion

package/dist/runtime/services/checkIsEqualInConstantTime.js

@@ -0,0 +1,11 @@
+//#region src/runtime/services/checkIsEqualInConstantTime.ts
+const checkIsEqualInConstantTime = (first, second) => {
+	const firstBytes = new TextEncoder().encode(first);
+	const secondBytes = new TextEncoder().encode(second);
+	if (firstBytes.length !== secondBytes.length) return false;
+	let difference = 0;
+	for (const [index, byte] of firstBytes.entries()) difference |= byte ^ (secondBytes[index] ?? 0);
+	return difference === 0;
+};
+//#endregion
+export { checkIsEqualInConstantTime };

package/dist/runtime/services/checkIsMethodAllowed.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/checkIsMethodAllowed.d.ts
+export declare const checkIsMethodAllowed: (method: string, methods: string[]) => boolean;
+//#endregion

package/dist/runtime/services/checkIsMethodAllowed.js

@@ -0,0 +1,4 @@
+//#region src/runtime/services/checkIsMethodAllowed.ts
+const checkIsMethodAllowed = (method, methods) => methods.includes(method);
+//#endregion
+export { checkIsMethodAllowed };

package/dist/runtime/services/checkIsRecord.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/checkIsRecord.d.ts
+export declare const checkIsRecord: (value: unknown) => value is Record<string, unknown>;
+//#endregion

package/dist/runtime/services/checkIsRecord.js

@@ -0,0 +1,4 @@
+//#region src/runtime/services/checkIsRecord.ts
+const checkIsRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+//#endregion
+export { checkIsRecord };

package/dist/runtime/services/checkIsRequestTooLarge.d.ts

@@ -0,0 +1,4 @@
+import { RequestSizeLimiterOptions } from "../../models/RequestSizeLimiterOptions.js";
+//#region src/runtime/services/checkIsRequestTooLarge.d.ts
+export declare const checkIsRequestTooLarge: (method: string, contentLength: null | string, contentType: null | string, { maxRequestSizeInBytes, maxUploadFileRequestInBytes }: RequestSizeLimiterOptions) => boolean;
+//#endregion

package/dist/runtime/services/checkIsRequestTooLarge.js

@@ -0,0 +1,9 @@
+import { SIZE_LIMITED_METHODS } from "../constants.js";
+//#region src/runtime/services/checkIsRequestTooLarge.ts
+const checkIsRequestTooLarge = (method, contentLength, contentType, { maxRequestSizeInBytes, maxUploadFileRequestInBytes }) => {
+	if (!SIZE_LIMITED_METHODS.includes(method) || contentLength === null) return false;
+	const limit = contentType?.includes("multipart/form-data") ?? false ? maxUploadFileRequestInBytes : maxRequestSizeInBytes;
+	return Math.trunc(Number(contentLength)) >= limit;
+};
+//#endregion
+export { checkIsRequestTooLarge };

package/dist/runtime/services/collectSsgHashes.d.ts

@@ -0,0 +1,5 @@
+import { SsgOptions } from "../../models/SsgOptions.js";
+import { SecurityState } from "./getSecurityState.js";
+//#region src/runtime/services/collectSsgHashes.d.ts
+export declare const collectSsgHashes: (html: string, options: SsgOptions) => Promise<SecurityState["hashes"]>;
+//#endregion

package/dist/runtime/services/collectSsgHashes.js

@@ -0,0 +1,41 @@
+import { CSP_HASH_ALGORITHM, HTML_TAG_REGEX } from "../constants.js";
+import { generateHash } from "./generateHash.js";
+import { readHtmlTagAttribute } from "./readHtmlTagAttribute.js";
+//#region src/runtime/services/collectSsgHashes.ts
+const SCRIPT_PRELOAD_TYPES = /* @__PURE__ */ new Set([
+	"audioworklet",
+	"paintworklet",
+	"script",
+	"xslt"
+]);
+const getSsgHashSource = async ([name, attributes, body], { hashScripts, hashStyles }) => {
+	const integrity = readHtmlTagAttribute(attributes, "integrity");
+	if (name === "script" && hashScripts) {
+		const source = readHtmlTagAttribute(attributes, "src");
+		if (source !== void 0 && integrity !== void 0) return ["script", `'${integrity}'`];
+		if (source === void 0 && body) return ["script", `'${await generateHash(body, CSP_HASH_ALGORITHM)}'`];
+		return;
+	}
+	if (name === "style" && hashStyles && body) return ["style", `'${await generateHash(body, CSP_HASH_ALGORITHM)}'`];
+	if (name !== "link" || integrity === void 0) return void 0;
+	const rel = readHtmlTagAttribute(attributes, "rel");
+	const as = readHtmlTagAttribute(attributes, "as") ?? "";
+	if (rel === "stylesheet" && hashStyles) return ["style", `'${integrity}'`];
+	if (hashScripts && (rel === "modulepreload" || rel === "preload" && SCRIPT_PRELOAD_TYPES.has(as))) return ["script", `'${integrity}'`];
+};
+const collectSsgHashes = async (html, options) => {
+	const elements = Array.from(html.matchAll(HTML_TAG_REGEX), ([, elementName, elementAttributes, , body, tagName, tagAttributes]) => [
+		(elementName ?? tagName ?? "").toLowerCase(),
+		elementAttributes ?? tagAttributes ?? "",
+		body
+	]);
+	const hashSources = await Promise.all(elements.map((element) => getSsgHashSource(element, options)));
+	const hashes = {
+		script: [],
+		style: []
+	};
+	for (const hashSource of hashSources) if (hashSource) hashes[hashSource[0]].push(hashSource[1]);
+	return hashes;
+};
+//#endregion
+export { collectSsgHashes };

package/dist/runtime/services/createInMemoryRateLimiterStore.d.ts

@@ -0,0 +1,4 @@
+import { RateLimiterStore } from "../../models/RateLimiterStore.js";
+//#region src/runtime/services/createInMemoryRateLimiterStore.d.ts
+export declare const createInMemoryRateLimiterStore: (maxEntries: number) => RateLimiterStore;
+//#endregion

package/dist/runtime/services/createInMemoryRateLimiterStore.js

@@ -0,0 +1,22 @@
+//#region src/runtime/services/createInMemoryRateLimiterStore.ts
+const createInMemoryRateLimiterStore = (maxEntries) => {
+	const windows = /* @__PURE__ */ new Map();
+	return { increment: (key, intervalInMilliseconds) => {
+		const now = Date.now();
+		const current = windows.get(key);
+		const window = current && current.resetAt > now ? {
+			count: current.count + 1,
+			resetAt: current.resetAt
+		} : {
+			count: 1,
+			resetAt: now + intervalInMilliseconds
+		};
+		windows.delete(key);
+		windows.set(key, window);
+		const [oldestKey] = windows.keys();
+		if (windows.size > maxEntries && oldestKey !== void 0) windows.delete(oldestKey);
+		return Promise.resolve(window);
+	} };
+};
+//#endregion
+export { createInMemoryRateLimiterStore };

package/dist/runtime/services/generateHash.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/generateHash.d.ts
+export declare const generateHash: (content: string | Uint8Array, hashAlgorithm: string) => Promise<string>;
+//#endregion

package/dist/runtime/services/generateHash.js

@@ -0,0 +1,9 @@
+//#region src/runtime/services/generateHash.ts
+const generateHash = async (content, hashAlgorithm) => {
+	const bytes = typeof content === "string" ? new TextEncoder().encode(content) : new Uint8Array(content);
+	const hashBuffer = await globalThis.crypto.subtle.digest(hashAlgorithm, bytes);
+	const base64 = btoa(String.fromCodePoint(...new Uint8Array(hashBuffer)));
+	return `${hashAlgorithm.replace("-", "").toLowerCase()}-${base64}`;
+};
+//#endregion
+export { generateHash };

package/dist/runtime/services/generateNonce.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/generateNonce.d.ts
+export declare const generateNonce: () => string;
+//#endregion

package/dist/runtime/services/generateNonce.js

@@ -0,0 +1,6 @@
+import "../constants.js";
+import { generateRandomToken } from "./generateRandomToken.js";
+//#region src/runtime/services/generateNonce.ts
+const generateNonce = () => generateRandomToken(18);
+//#endregion
+export { generateNonce };

package/dist/runtime/services/generateRandomToken.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/generateRandomToken.d.ts
+export declare const generateRandomToken: (byteLength: number) => string;
+//#endregion

package/dist/runtime/services/generateRandomToken.js

@@ -0,0 +1,8 @@
+//#region src/runtime/services/generateRandomToken.ts
+const generateRandomToken = (byteLength) => {
+	const bytes = new Uint8Array(byteLength);
+	globalThis.crypto.getRandomValues(bytes);
+	return btoa(String.fromCodePoint(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+};
+//#endregion
+export { generateRandomToken };

package/dist/runtime/services/getBasicAuthCredentials.d.ts

@@ -0,0 +1,6 @@
+//#region src/runtime/services/getBasicAuthCredentials.d.ts
+export declare const getBasicAuthCredentials: (authorization: null | string) => undefined | {
+  name: string;
+  pass: string;
+};
+//#endregion

package/dist/runtime/services/getBasicAuthCredentials.js

@@ -0,0 +1,19 @@
+import { BASIC_AUTHORIZATION_SCHEME } from "../constants.js";
+//#region src/runtime/services/getBasicAuthCredentials.ts
+const BASE64_REGEX = /^[\d+/A-Za-z]*={0,2}$/u;
+const BASE64_QUANTUM_LENGTH = 4;
+const checkIsBase64 = (value) => BASE64_REGEX.test(value) && (value.endsWith("=") ? value.length % BASE64_QUANTUM_LENGTH === 0 : value.length % BASE64_QUANTUM_LENGTH !== 1);
+const getBasicAuthCredentials = (authorization) => {
+	if (!authorization?.startsWith(`Basic `)) return void 0;
+	const encoded = authorization.slice(BASIC_AUTHORIZATION_SCHEME.length + 1).trim();
+	if (!checkIsBase64(encoded)) return void 0;
+	const decoded = new TextDecoder().decode(Uint8Array.fromBase64(encoded));
+	const separatorIndex = decoded.indexOf(":");
+	if (separatorIndex === -1) return void 0;
+	return {
+		name: decoded.slice(0, separatorIndex),
+		pass: decoded.slice(separatorIndex + 1)
+	};
+};
+//#endregion
+export { getBasicAuthCredentials };

package/dist/runtime/services/getBasicAuthOptions.d.ts

@@ -0,0 +1,4 @@
+import { BasicAuthOptions } from "../../models/BasicAuthOptions.js";
+//#region src/runtime/services/getBasicAuthOptions.d.ts
+export declare const getBasicAuthOptions: (privateRuntimeConfig: unknown) => BasicAuthOptions | undefined;
+//#endregion