nuxt-security-module 0.0.0-stage → 4.1.1

package/dist/runtime/services/getBasicAuthOptions.js

@@ -0,0 +1,17 @@
+import { checkIsRecord } from "./checkIsRecord.js";
+//#region src/runtime/services/getBasicAuthOptions.ts
+const checkIsStringList = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
+const getBasicAuthOptions = (privateRuntimeConfig) => {
+	if (!checkIsRecord(privateRuntimeConfig) || !checkIsRecord(privateRuntimeConfig.basicAuth)) return void 0;
+	const { exclude, include, message, name, pass } = privateRuntimeConfig.basicAuth;
+	if (typeof name !== "string" || typeof pass !== "string") return void 0;
+	return {
+		...checkIsStringList(exclude) && { exclude },
+		...checkIsStringList(include) && { include },
+		...typeof message === "string" && { message },
+		name,
+		pass
+	};
+};
+//#endregion
+export { getBasicAuthOptions };

package/dist/runtime/services/getRetryAfterSeconds.d.ts

@@ -0,0 +1,5 @@
+import { RateLimiterOptions } from "../../models/RateLimiterOptions.js";
+import { RateLimiterStore } from "../../models/RateLimiterStore.js";
+//#region src/runtime/services/getRetryAfterSeconds.d.ts
+export declare const getRetryAfterSeconds: (store: RateLimiterStore, key: string, { intervalInMilliseconds, tokensPerInterval }: RateLimiterOptions) => Promise<number | undefined>;
+//#endregion

package/dist/runtime/services/getRetryAfterSeconds.js

@@ -0,0 +1,9 @@
+//#region src/runtime/services/getRetryAfterSeconds.ts
+const MILLISECONDS_PER_SECOND = 1e3;
+const getRetryAfterSeconds = async (store, key, { intervalInMilliseconds, tokensPerInterval }) => {
+	const { count, resetAt } = await store.increment(key, intervalInMilliseconds);
+	if (count <= tokensPerInterval) return void 0;
+	return Math.max(1, Math.ceil((resetAt - Date.now()) / MILLISECONDS_PER_SECOND));
+};
+//#endregion
+export { getRetryAfterSeconds };

package/dist/runtime/services/getSecurityRules.d.ts

@@ -0,0 +1,5 @@
+import { SecurityRules } from "../../models/SecurityRules.js";
+import { H3Event } from "nitro/h3";
+//#region src/runtime/services/getSecurityRules.d.ts
+export declare const getSecurityRules: (event: H3Event) => SecurityRules | undefined;
+//#endregion

package/dist/runtime/services/getSecurityRules.js

@@ -0,0 +1,15 @@
+import { mergeSecurityRules } from "./mergeSecurityRules.js";
+import { findSecurityRules } from "./securityRouteMatcher.js";
+//#region src/runtime/services/getSecurityRules.ts
+const securityRulesByEvent = /* @__PURE__ */ new WeakMap();
+const getSecurityRules = (event) => {
+	const cachedRules = securityRulesByEvent.get(event);
+	if (cachedRules) return cachedRules;
+	const matchedRules = findSecurityRules(event.url.pathname);
+	if (!matchedRules) return void 0;
+	const rules = mergeSecurityRules(...matchedRules.toReversed());
+	securityRulesByEvent.set(event, rules);
+	return rules;
+};
+//#endregion
+export { getSecurityRules };

package/dist/runtime/services/getSecurityState.d.ts

@@ -0,0 +1,11 @@
+import { H3Event } from "nitro/h3";
+//#region src/runtime/services/getSecurityState.d.ts
+export interface SecurityState {
+  hashes: {
+    script: string[];
+    style: string[];
+  };
+  nonce?: string;
+}
+export declare const getSecurityState: (event: H3Event) => SecurityState;
+//#endregion

package/dist/runtime/services/getSecurityState.js

@@ -0,0 +1,14 @@
+//#region src/runtime/services/getSecurityState.ts
+const securityStateByEvent = /* @__PURE__ */ new WeakMap();
+const getSecurityState = (event) => {
+	const cachedState = securityStateByEvent.get(event);
+	if (cachedState) return cachedState;
+	const state = { hashes: {
+		script: [],
+		style: []
+	} };
+	securityStateByEvent.set(event, state);
+	return state;
+};
+//#endregion
+export { getSecurityState };

package/dist/runtime/services/injectNonce.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/injectNonce.d.ts
+export declare const injectNonce: (html: string, nonce: string) => string;
+//#endregion

package/dist/runtime/services/injectNonce.js

@@ -0,0 +1,7 @@
+import { NONCE_TAG_NAMES } from "../constants.js";
+import { rewriteHtmlTags } from "./rewriteHtmlTags.js";
+import { stripHtmlTagAttribute } from "./stripHtmlTagAttribute.js";
+//#region src/runtime/services/injectNonce.ts
+const injectNonce = (html, nonce) => rewriteHtmlTags(html, (tagName, attributes) => NONCE_TAG_NAMES.includes(tagName.toLowerCase()) ? ` nonce="${nonce}"${stripHtmlTagAttribute(attributes, "nonce")}` : void 0);
+//#endregion
+export { injectNonce };

package/dist/runtime/services/injectSubresourceIntegrity.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/injectSubresourceIntegrity.d.ts
+export declare const injectSubresourceIntegrity: (html: string, hashes: Record<string, string>) => string;
+//#endregion

package/dist/runtime/services/injectSubresourceIntegrity.js

@@ -0,0 +1,22 @@
+import { readHtmlTagAttribute } from "./readHtmlTagAttribute.js";
+import { rewriteHtmlTags } from "./rewriteHtmlTags.js";
+//#region src/runtime/services/injectSubresourceIntegrity.ts
+const RESOURCE_ATTRIBUTE_NAMES = {
+	link: "href",
+	script: "src"
+};
+const INTEGRITY_LINK_RELS = /* @__PURE__ */ new Set([
+	"modulepreload",
+	"preload",
+	"stylesheet"
+]);
+const injectSubresourceIntegrity = (html, hashes) => rewriteHtmlTags(html, (tagName, attributes) => {
+	const resourceAttributeName = RESOURCE_ATTRIBUTE_NAMES[tagName.toLowerCase()];
+	if (!resourceAttributeName || readHtmlTagAttribute(attributes, "integrity") !== void 0) return void 0;
+	const resource = readHtmlTagAttribute(attributes, resourceAttributeName);
+	if (resource === void 0 || hashes[resource] === void 0) return void 0;
+	if (tagName.toLowerCase() === "link" && !INTEGRITY_LINK_RELS.has(readHtmlTagAttribute(attributes, "rel") ?? "")) return void 0;
+	return ` integrity="${hashes[resource]}"${attributes}`;
+});
+//#endregion
+export { injectSubresourceIntegrity };

package/dist/runtime/services/insertContentSecurityPolicyMeta.d.ts

@@ -0,0 +1,4 @@
+import { ContentSecurityPolicy } from "../../models/ContentSecurityPolicy.js";
+//#region src/runtime/services/insertContentSecurityPolicyMeta.d.ts
+export declare const insertContentSecurityPolicyMeta: (html: string, policy: ContentSecurityPolicy) => string;
+//#endregion

package/dist/runtime/services/insertContentSecurityPolicyMeta.js

@@ -0,0 +1,17 @@
+import { serializeContentSecurityPolicy } from "./serializeContentSecurityPolicy.js";
+//#region src/runtime/services/insertContentSecurityPolicyMeta.ts
+const META_CONTENT_SECURITY_POLICY_REGEX = /<meta\s+http-equiv=["']Content-Security-Policy["'][^>]*>/iu;
+const HEAD_CHARSET_REGEX = /<meta\s+charset=["'][^"']*["'][^>]*>/iu;
+const HEAD_OPEN_REGEX = /<head\b[^>]*>/iu;
+const insertContentSecurityPolicyMeta = (html, policy) => {
+	const metaTag = `<meta http-equiv="Content-Security-Policy" content="${serializeContentSecurityPolicy({
+		...policy,
+		"frame-ancestors": false
+	})}">`;
+	if (META_CONTENT_SECURITY_POLICY_REGEX.test(html)) return html.replace(META_CONTENT_SECURITY_POLICY_REGEX, metaTag);
+	const insertion = HEAD_CHARSET_REGEX.exec(html) ?? HEAD_OPEN_REGEX.exec(html);
+	const insertAt = insertion ? insertion.index + insertion[0].length : 0;
+	return html.slice(0, insertAt) + metaTag + html.slice(insertAt);
+};
+//#endregion
+export { insertContentSecurityPolicyMeta };

package/dist/runtime/services/mergeSecurityRules.d.ts

@@ -0,0 +1,4 @@
+import { SecurityRules } from "../../models/SecurityRules.js";
+//#region src/runtime/services/mergeSecurityRules.d.ts
+export declare const mergeSecurityRules: (...rules: SecurityRules[]) => SecurityRules;
+//#endregion

package/dist/runtime/services/mergeSecurityRules.js

@@ -0,0 +1,11 @@
+import { createDefu } from "defu";
+//#region src/runtime/services/mergeSecurityRules.ts
+const mergeRulesWithReplacedArrays = createDefu((object, key, value) => {
+	if (Array.isArray(object[key]) || Array.isArray(value)) {
+		object[key] = value;
+		return true;
+	}
+});
+const mergeSecurityRules = (...rules) => mergeRulesWithReplacedArrays({}, ...rules);
+//#endregion
+export { mergeSecurityRules };

package/dist/runtime/services/readHtmlTagAttribute.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/readHtmlTagAttribute.d.ts
+export declare const readHtmlTagAttribute: (attributes: string, attributeName: string) => string | undefined;
+//#endregion

package/dist/runtime/services/readHtmlTagAttribute.js

@@ -0,0 +1,8 @@
+import { HTML_ATTRIBUTE_REGEX } from "../constants.js";
+//#region src/runtime/services/readHtmlTagAttribute.ts
+const readHtmlTagAttribute = (attributes, attributeName) => {
+	for (const [, name, , value] of attributes.matchAll(HTML_ATTRIBUTE_REGEX)) if (name?.toLowerCase() === attributeName) return unquote(value ?? "");
+};
+const unquote = (value) => value.replace(/^(?<quote>["'])(?<inner>.*)\k<quote>$/su, "$<inner>");
+//#endregion
+export { readHtmlTagAttribute };

package/dist/runtime/services/rewriteHtmlTags.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/rewriteHtmlTags.d.ts
+export declare const rewriteHtmlTags: (html: string, rewriteAttributes: (tagName: string, attributes: string) => string | undefined) => string;
+//#endregion

package/dist/runtime/services/rewriteHtmlTags.js

@@ -0,0 +1,9 @@
+import { HTML_TAG_REGEX } from "../constants.js";
+//#region src/runtime/services/rewriteHtmlTags.ts
+const rewriteHtmlTags = (html, rewriteAttributes) => html.replace(HTML_TAG_REGEX, (match, elementName, elementAttributes, elementTrailer, body, tagName, tagAttributes, tagTrailer) => {
+	if (elementName) return `<${elementName}${rewriteAttributes(elementName, elementAttributes ?? "") ?? elementAttributes}${elementTrailer}>${body}</${elementName}>`;
+	const attributes = rewriteAttributes(tagName ?? "", tagAttributes ?? "");
+	return attributes === void 0 ? match : `<${tagName}${attributes}${tagTrailer}>`;
+});
+//#endregion
+export { rewriteHtmlTags };

package/dist/runtime/services/securityRouteMatcher.d.ts

@@ -0,0 +1,5 @@
+import { SecurityRules } from "../../models/SecurityRules.js";
+//#region src/runtime/services/securityRouteMatcher.d.ts
+export declare const setSecurityRouteMatcher: (routes: Record<string, SecurityRules>) => void;
+export declare const findSecurityRules: (pathname: string) => SecurityRules[] | undefined;
+//#endregion

package/dist/runtime/services/securityRouteMatcher.js

@@ -0,0 +1,11 @@
+import { addRoute, createRouter, findAllRoutes } from "rou3";
+//#region src/runtime/services/securityRouteMatcher.ts
+let securityRouter;
+const setSecurityRouteMatcher = (routes) => {
+	const router = createRouter();
+	for (const [pattern, rules] of Object.entries(routes)) addRoute(router, "", pattern, rules);
+	securityRouter = router;
+};
+const findSecurityRules = (pathname) => securityRouter && findAllRoutes(securityRouter, "", pathname).flatMap(({ data }) => data ? [data] : []);
+//#endregion
+export { findSecurityRules, setSecurityRouteMatcher };

package/dist/runtime/services/serializeBasicAuthChallenge.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/serializeBasicAuthChallenge.d.ts
+export declare const serializeBasicAuthChallenge: (realm: string) => string;
+//#endregion

package/dist/runtime/services/serializeBasicAuthChallenge.js

@@ -0,0 +1,4 @@
+//#region src/runtime/services/serializeBasicAuthChallenge.ts
+const serializeBasicAuthChallenge = (realm) => `Basic realm="${realm.replaceAll(/["\\]/gu, String.raw`\$&`)}"`;
+//#endregion
+export { serializeBasicAuthChallenge };

package/dist/runtime/services/serializeContentSecurityPolicy.d.ts

@@ -0,0 +1,4 @@
+import { ContentSecurityPolicy } from "../../models/ContentSecurityPolicy.js";
+//#region src/runtime/services/serializeContentSecurityPolicy.d.ts
+export declare const serializeContentSecurityPolicy: (policy: ContentSecurityPolicy) => string;
+//#endregion

package/dist/runtime/services/serializeContentSecurityPolicy.js

@@ -0,0 +1,7 @@
+//#region src/runtime/services/serializeContentSecurityPolicy.ts
+const serializeContentSecurityPolicy = (policy) => Object.entries(policy).filter(([, value]) => value !== false).map(([directive, value]) => {
+	if (directive === "upgrade-insecure-requests") return "upgrade-insecure-requests;";
+	return `${directive} ${Array.isArray(value) ? value.map((source) => source.trim()).join(" ") : ""};`;
+}).join(" ");
+//#endregion
+export { serializeContentSecurityPolicy };

package/dist/runtime/services/serializePermissionsPolicy.d.ts

@@ -0,0 +1,4 @@
+import { PermissionsPolicy } from "../../models/PermissionsPolicy.js";
+//#region src/runtime/services/serializePermissionsPolicy.d.ts
+export declare const serializePermissionsPolicy: (policy: PermissionsPolicy) => string;
+//#endregion

package/dist/runtime/services/serializePermissionsPolicy.js

@@ -0,0 +1,4 @@
+//#region src/runtime/services/serializePermissionsPolicy.ts
+const serializePermissionsPolicy = (policy) => Object.entries(policy).flatMap(([feature, sources]) => sources === false ? [] : [`${feature}=(${(sources ?? []).join(" ")})`]).join(", ");
+//#endregion
+export { serializePermissionsPolicy };

package/dist/runtime/services/serializeSecurityHeaders.d.ts

@@ -0,0 +1,4 @@
+import { SecurityHeaders } from "../../models/SecurityHeaders.js";
+//#region src/runtime/services/serializeSecurityHeaders.d.ts
+export declare const serializeSecurityHeaders: (headers: SecurityHeaders) => Record<string, string>;
+//#endregion

package/dist/runtime/services/serializeSecurityHeaders.js

@@ -0,0 +1,19 @@
+import { SECURITY_HEADER_NAMES } from "../constants.js";
+import { serializeContentSecurityPolicy } from "./serializeContentSecurityPolicy.js";
+import { serializePermissionsPolicy } from "./serializePermissionsPolicy.js";
+import { serializeStrictTransportSecurity } from "./serializeStrictTransportSecurity.js";
+//#region src/runtime/services/serializeSecurityHeaders.ts
+const checkIsSecurityHeaderKey = (key) => Object.hasOwn(SECURITY_HEADER_NAMES, key);
+const serializeSecurityHeaders = (headers) => Object.fromEntries(Object.keys(headers).flatMap((key) => {
+	if (!checkIsSecurityHeaderKey(key)) return [];
+	const value = headers[key];
+	return value === false || value === void 0 ? [] : [[SECURITY_HEADER_NAMES[key], serializeValue(key, value)]];
+}));
+const serializeValue = (key, value) => {
+	if (key === "contentSecurityPolicy") return serializeContentSecurityPolicy(value);
+	if (key === "permissionsPolicy") return serializePermissionsPolicy(value);
+	if (key === "strictTransportSecurity") return serializeStrictTransportSecurity(value);
+	return String(value);
+};
+//#endregion
+export { serializeSecurityHeaders };

package/dist/runtime/services/serializeStrictTransportSecurity.d.ts

@@ -0,0 +1,4 @@
+import { StrictTransportSecurity } from "../../models/StrictTransportSecurity.js";
+//#region src/runtime/services/serializeStrictTransportSecurity.d.ts
+export declare const serializeStrictTransportSecurity: (policy: StrictTransportSecurity) => string;
+//#endregion

package/dist/runtime/services/serializeStrictTransportSecurity.js

@@ -0,0 +1,8 @@
+//#region src/runtime/services/serializeStrictTransportSecurity.ts
+const serializeStrictTransportSecurity = (policy) => [
+	`max-age=${policy.maxAge}`,
+	policy.includeSubdomains && "includeSubDomains",
+	policy.preload && "preload"
+].filter(Boolean).join("; ");
+//#endregion
+export { serializeStrictTransportSecurity };

package/dist/runtime/services/stripHtmlTagAttribute.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/stripHtmlTagAttribute.d.ts
+export declare const stripHtmlTagAttribute: (attributes: string, attributeName: string) => string;
+//#endregion

package/dist/runtime/services/stripHtmlTagAttribute.js

@@ -0,0 +1,5 @@
+import { HTML_ATTRIBUTE_REGEX } from "../constants.js";
+//#region src/runtime/services/stripHtmlTagAttribute.ts
+const stripHtmlTagAttribute = (attributes, attributeName) => attributes.replace(HTML_ATTRIBUTE_REGEX, (token, name) => name.toLowerCase() === attributeName ? "" : token);
+//#endregion
+export { stripHtmlTagAttribute };

package/dist/runtime/services/updateContentSecurityPolicy.d.ts

@@ -0,0 +1,5 @@
+import { ContentSecurityPolicy } from "../../models/ContentSecurityPolicy.js";
+import { SecurityState } from "./getSecurityState.js";
+//#region src/runtime/services/updateContentSecurityPolicy.d.ts
+export declare const updateContentSecurityPolicy: (policy: ContentSecurityPolicy, { hashes, nonce }: SecurityState) => ContentSecurityPolicy;
+//#endregion

package/dist/runtime/services/updateContentSecurityPolicy.js

@@ -0,0 +1,15 @@
+import { NONCE_PLACEHOLDER } from "../constants.js";
+//#region src/runtime/services/updateContentSecurityPolicy.ts
+const SCRIPT_DIRECTIVES = /* @__PURE__ */ new Set(["script-src", "script-src-elem"]);
+const STYLE_DIRECTIVES = /* @__PURE__ */ new Set(["style-src", "style-src-elem"]);
+const updateContentSecurityPolicy = (policy, { hashes, nonce }) => Object.fromEntries(Object.keys(policy).map((directive) => {
+	const value = policy[directive];
+	if (!Array.isArray(value)) return [directive, value];
+	const sources = value.filter((source) => !checkIsStaticNonce(source)).map((source) => source === "'nonce-{{nonce}}'" && nonce ? `'nonce-${nonce}'` : source).filter((source) => source !== NONCE_PLACEHOLDER);
+	if (SCRIPT_DIRECTIVES.has(directive)) sources.push(...hashes.script);
+	if (STYLE_DIRECTIVES.has(directive)) sources.push(...hashes.style);
+	return [directive, sources];
+}));
+const checkIsStaticNonce = (source) => source.startsWith("'nonce-") && source !== "'nonce-{{nonce}}'";
+//#endregion
+export { updateContentSecurityPolicy };

package/dist/schemas/allowedMethodsRestricterOptionsSchema.js

@@ -0,0 +1,5 @@
+import { z } from "zod";
+//#region src/schemas/allowedMethodsRestricterOptionsSchema.ts
+const allowedMethodsRestricterOptionsSchema = z.strictObject({ methods: z.array(z.string().min(1)).min(1) });
+//#endregion
+export { allowedMethodsRestricterOptionsSchema };

package/dist/schemas/basicAuthOptionsSchema.js

@@ -0,0 +1,12 @@
+import { z } from "zod";
+//#region src/schemas/basicAuthOptionsSchema.ts
+const pathSchema = z.string().startsWith("/");
+const basicAuthOptionsSchema = z.strictObject({
+	exclude: z.array(pathSchema).optional(),
+	include: z.array(pathSchema).optional(),
+	message: z.string().optional(),
+	name: z.string().min(1),
+	pass: z.string().min(1)
+});
+//#endregion
+export { basicAuthOptionsSchema };

package/dist/schemas/contentSecurityPolicySchema.js

@@ -0,0 +1,5 @@
+import { z } from "zod";
+//#region src/schemas/contentSecurityPolicySchema.ts
+const contentSecurityPolicySchema = z.record(z.string().min(1), z.union([z.boolean(), z.array(z.string().min(1))]).optional());
+//#endregion
+export { contentSecurityPolicySchema };

package/dist/schemas/corsHandlerOptionsSchema.js

@@ -0,0 +1,14 @@
+import { z } from "zod";
+//#region src/schemas/corsHandlerOptionsSchema.ts
+const headerNameSchema = z.string().regex(/^[\w-]+$/u);
+const corsHandlerOptionsSchema = z.strictObject({
+	allowHeaders: z.array(headerNameSchema).optional(),
+	credentials: z.boolean().optional(),
+	exposeHeaders: z.array(headerNameSchema).optional(),
+	maxAge: z.string().regex(/^\d+$/u).optional(),
+	methods: z.array(z.string().min(1)).min(1),
+	origin: z.union([z.url(), z.array(z.url())]),
+	preflight: z.strictObject({ statusCode: z.int().min(200).max(299) }).optional()
+});
+//#endregion
+export { corsHandlerOptionsSchema };

package/dist/schemas/csrfOptionsSchema.js

@@ -0,0 +1,9 @@
+import { z } from "zod";
+//#region src/schemas/csrfOptionsSchema.ts
+const tokenNameSchema = z.string().regex(/^[\w-]+$/u, "must be letters, digits, underscores or hyphens");
+const csrfOptionsSchema = z.strictObject({
+	cookieName: tokenNameSchema,
+	headerName: tokenNameSchema
+});
+//#endregion
+export { csrfOptionsSchema };

package/dist/schemas/moduleOptionsSchema.js

@@ -0,0 +1,29 @@
+import { allowedMethodsRestricterOptionsSchema } from "./allowedMethodsRestricterOptionsSchema.js";
+import { basicAuthOptionsSchema } from "./basicAuthOptionsSchema.js";
+import { corsHandlerOptionsSchema } from "./corsHandlerOptionsSchema.js";
+import { csrfOptionsSchema } from "./csrfOptionsSchema.js";
+import { rateLimiterOptionsSchema } from "./rateLimiterOptionsSchema.js";
+import { requestSizeLimiterOptionsSchema } from "./requestSizeLimiterOptionsSchema.js";
+import { securityHeadersSchema } from "./securityHeadersSchema.js";
+import { ssgOptionsSchema } from "./ssgOptionsSchema.js";
+import { z } from "zod";
+//#region src/schemas/moduleOptionsSchema.ts
+const moduleOptionsSchema = z.strictObject({
+	allowedMethodsRestricter: z.union([allowedMethodsRestricterOptionsSchema, z.literal(false)]),
+	basicAuth: z.union([basicAuthOptionsSchema, z.literal(false)]),
+	contentSecurityPolicyReportOnly: z.boolean(),
+	corsHandler: z.union([corsHandlerOptionsSchema, z.literal(false)]),
+	csrf: z.union([csrfOptionsSchema, z.literal(false)]),
+	enabled: z.boolean(),
+	headers: z.union([securityHeadersSchema, z.literal(false)]),
+	hidePoweredBy: z.boolean(),
+	nonce: z.boolean(),
+	rateLimiter: z.union([rateLimiterOptionsSchema, z.literal(false)]),
+	removeLoggers: z.boolean(),
+	requestSizeLimiter: z.union([requestSizeLimiterOptionsSchema, z.literal(false)]),
+	sri: z.boolean(),
+	ssg: z.union([ssgOptionsSchema, z.literal(false)]),
+	strict: z.boolean()
+});
+//#endregion
+export { moduleOptionsSchema };

package/dist/schemas/permissionsPolicySchema.js

@@ -0,0 +1,5 @@
+import { z } from "zod";
+//#region src/schemas/permissionsPolicySchema.ts
+const permissionsPolicySchema = z.record(z.string().min(1), z.union([z.literal(false), z.array(z.string().min(1))]).optional());
+//#endregion
+export { permissionsPolicySchema };

package/dist/schemas/rateLimiterOptionsSchema.js

@@ -0,0 +1,8 @@
+import { z } from "zod";
+//#region src/schemas/rateLimiterOptionsSchema.ts
+const rateLimiterOptionsSchema = z.strictObject({
+	intervalInMilliseconds: z.int("must be a whole number of milliseconds").positive("must be more than zero milliseconds"),
+	tokensPerInterval: z.int("must be a whole number of requests").positive("must allow at least one request")
+});
+//#endregion
+export { rateLimiterOptionsSchema };

package/dist/schemas/requestSizeLimiterOptionsSchema.js

@@ -0,0 +1,8 @@
+import { z } from "zod";
+//#region src/schemas/requestSizeLimiterOptionsSchema.ts
+const requestSizeLimiterOptionsSchema = z.strictObject({
+	maxRequestSizeInBytes: z.int("must be a whole number of bytes").positive("must be more than zero bytes"),
+	maxUploadFileRequestInBytes: z.int("must be a whole number of bytes").positive("must be more than zero bytes")
+});
+//#endregion
+export { requestSizeLimiterOptionsSchema };

package/dist/schemas/securityHeadersSchema.js

@@ -0,0 +1,25 @@
+import { CrossOriginEmbedderPolicy } from "../models/CrossOriginEmbedderPolicy.js";
+import { XFrameOptions } from "../models/XFrameOptions.js";
+import { contentSecurityPolicySchema } from "./contentSecurityPolicySchema.js";
+import { permissionsPolicySchema } from "./permissionsPolicySchema.js";
+import { strictTransportSecurityOptionsSchema } from "./strictTransportSecurityOptionsSchema.js";
+import { z } from "zod";
+//#region src/schemas/securityHeadersSchema.ts
+const headerValueSchema = z.string().min(1);
+const securityHeadersSchema = z.strictObject({
+	contentSecurityPolicy: z.union([contentSecurityPolicySchema, z.literal(false)]).optional(),
+	crossOriginEmbedderPolicy: z.union([z.enum(CrossOriginEmbedderPolicy), z.literal(false)]).optional(),
+	crossOriginOpenerPolicy: z.union([headerValueSchema, z.literal(false)]).optional(),
+	crossOriginResourcePolicy: z.union([headerValueSchema, z.literal(false)]).optional(),
+	originAgentCluster: z.union([headerValueSchema, z.literal(false)]).optional(),
+	permissionsPolicy: z.union([permissionsPolicySchema, z.literal(false)]).optional(),
+	referrerPolicy: z.union([headerValueSchema, z.literal(false)]).optional(),
+	strictTransportSecurity: z.union([strictTransportSecurityOptionsSchema, z.literal(false)]).optional(),
+	xContentTypeOptions: z.union([headerValueSchema, z.literal(false)]).optional(),
+	xDNSPrefetchControl: z.union([headerValueSchema, z.literal(false)]).optional(),
+	xDownloadOptions: z.union([headerValueSchema, z.literal(false)]).optional(),
+	xFrameOptions: z.union([z.enum(XFrameOptions), z.literal(false)]).optional(),
+	xPermittedCrossDomainPolicies: z.union([headerValueSchema, z.literal(false)]).optional()
+});
+//#endregion
+export { securityHeadersSchema };

package/dist/schemas/ssgOptionsSchema.js

@@ -0,0 +1,11 @@
+import { z } from "zod";
+//#region src/schemas/ssgOptionsSchema.ts
+const ssgOptionsSchema = z.strictObject({
+	exportToPresets: z.boolean(),
+	hashScripts: z.boolean(),
+	hashStyles: z.boolean(),
+	meta: z.boolean(),
+	nitroHeaders: z.boolean()
+});
+//#endregion
+export { ssgOptionsSchema };

package/dist/schemas/strictTransportSecurityOptionsSchema.js

@@ -0,0 +1,9 @@
+import { z } from "zod";
+//#region src/schemas/strictTransportSecurityOptionsSchema.ts
+const strictTransportSecurityOptionsSchema = z.strictObject({
+	includeSubdomains: z.boolean(),
+	maxAge: z.int().nonnegative(),
+	preload: z.boolean()
+});
+//#endregion
+export { strictTransportSecurityOptionsSchema };

package/dist/services/computeSubresourceIntegrityHashes.js

@@ -0,0 +1,29 @@
+import { SRI_HASH_ALGORITHM } from "../runtime/constants.js";
+import { generateHash } from "../runtime/services/generateHash.js";
+import { existsSync } from "node:fs";
+import { readFile, readdir } from "node:fs/promises";
+import { join, posix, relative, sep } from "node:path";
+//#region src/services/computeSubresourceIntegrityHashes.ts
+const computeSubresourceIntegrityHashes = async (nitro) => {
+	const { baseURL: appBaseUrl, cdnURL: appCdnUrl } = nitro.options.runtimeConfig.app;
+	const existingPublicAssets = nitro.options.publicAssets.filter(({ dir: directory }) => existsSync(directory));
+	const filesByPublicAsset = await Promise.all(existingPublicAssets.map(async ({ baseURL = "", dir: directory }) => {
+		return (await readdir(directory, {
+			recursive: true,
+			withFileTypes: true
+		})).filter((entry) => entry.isFile()).map((entry) => {
+			const filePath = join(entry.parentPath, entry.name);
+			return {
+				filePath,
+				fullPath: posix.join(baseURL, ...relative(directory, filePath).split(sep))
+			};
+		});
+	}));
+	const hashEntries = await Promise.all(filesByPublicAsset.flat().map(async ({ filePath, fullPath }) => {
+		const hash = await generateHash(await readFile(filePath), SRI_HASH_ALGORITHM);
+		return [appCdnUrl ? new URL(posix.isAbsolute(fullPath) ? fullPath.slice(1) : fullPath, appCdnUrl.endsWith("/") ? appCdnUrl : `${appCdnUrl}/`).href : posix.join("/", appBaseUrl, fullPath), hash];
+	}));
+	return Object.fromEntries(hashEntries);
+};
+//#endregion
+export { computeSubresourceIntegrityHashes };

package/dist/services/formatZodIssues.js

@@ -0,0 +1,16 @@
+//#region src/services/formatZodIssues.ts
+const getDeepestPathLength = (leafIssues) => Math.max(-1, ...leafIssues.map(({ path }) => path.length));
+const getLeafIssues = (issue, parentPath) => {
+	const path = [...parentPath, ...issue.path];
+	if (issue.code !== "invalid_union") return [{
+		issue,
+		path
+	}];
+	return issue.errors.map((branch) => branch.flatMap((branchIssue) => getLeafIssues(branchIssue, path))).reduce((deepest, branch) => getDeepestPathLength(branch) > getDeepestPathLength(deepest) ? branch : deepest);
+};
+const formatLeafIssue = ({ issue, path }) => {
+	return `${path.map(String).join(".") || "(options)"}: ${issue.message}`;
+};
+const formatZodIssues = (issues) => issues.flatMap((issue) => getLeafIssues(issue, [])).map((leafIssue) => formatLeafIssue(leafIssue)).join("; ");
+//#endregion
+export { formatZodIssues };

package/dist/services/getDefaultModuleOptions.js

@@ -0,0 +1,41 @@
+import { getDefaultSecurityHeaders } from "./getDefaultSecurityHeaders.js";
+//#region src/services/getDefaultModuleOptions.ts
+const getDefaultModuleOptions = (isDevelopment, devServerUrl, isStrict) => ({
+	allowedMethodsRestricter: false,
+	basicAuth: false,
+	contentSecurityPolicyReportOnly: false,
+	corsHandler: {
+		methods: [
+			"GET",
+			"HEAD",
+			"PUT",
+			"PATCH",
+			"POST",
+			"DELETE"
+		],
+		origin: devServerUrl,
+		preflight: { statusCode: 204 }
+	},
+	csrf: false,
+	enabled: true,
+	headers: getDefaultSecurityHeaders(isDevelopment, isStrict),
+	hidePoweredBy: true,
+	nonce: true,
+	rateLimiter: false,
+	removeLoggers: false,
+	requestSizeLimiter: {
+		maxRequestSizeInBytes: 2e6,
+		maxUploadFileRequestInBytes: 8e6
+	},
+	sri: true,
+	ssg: {
+		exportToPresets: true,
+		hashScripts: true,
+		hashStyles: false,
+		meta: true,
+		nitroHeaders: true
+	},
+	strict: isStrict
+});
+//#endregion
+export { getDefaultModuleOptions };