nuxt-security-module 4.1.1 → 4.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-security-module",
-  "version": "4.1.1",
+  "version": "4.2.0",
   "description": "Nuxt security module for Nitro 3 and h3 2 — security headers, a per-request nonce Content Security Policy, subresource integrity, CORS, allowed methods, basic auth and a request size limit.",
   "license": "Apache-2.0",
   "author": "Jimmy Chen",
@@ -53,8 +53,8 @@
   },
   "devDependencies": {
     "@arethetypeswrong/core": "^0.18.5",
-    "@esposter/configuration": "4.1.1",
-    "@esposter/shared-node": "4.1.1",
+    "@esposter/configuration": "4.2.0",
+    "@esposter/shared-node": "4.2.0",
     "@nuxt/nitro-server": "npm:@nuxt/nitro-server-nightly@5x",
     "@types/node": "^26.6.5",
     "fast-check": "^4.10.2",
@@ -68,5 +68,5 @@
     "nitro": "npm:nitro-nightly@latest",
     "nuxt": "npm:nuxt-nightly@5x"
   },
-  "gitHead": "47b7795ab557d7731aa60588d0b9d1cdff243328"
+  "gitHead": "fef4971cf6a621a2c1850f32fcec19ee4ec0de99"
 }

package/dist/index.d.ts

@@ -1,17 +0,0 @@
-import { ModuleOptions } from "./models/ModuleOptions.js";
-import { SecurityRouteRules } from "./models/SecurityRouteRules.js";
-import { NuxtModule } from "@nuxt/schema";
-//#region src/module.d.ts
-declare module "@nuxt/schema" {
-  interface NuxtConfig {
-    security?: Partial<ModuleOptions>;
-  }
-}
-declare module "h3/rules" {
-  interface RouteRuleConfig {
-    security?: SecurityRouteRules;
-  }
-}
-declare const securityModule: NuxtModule<Partial<ModuleOptions>>;
-//#endregion
-export { type ModuleOptions, securityModule as default };

package/dist/index.js

@@ -1,105 +0,0 @@
-import { MODULE_NAME } from "./runtime/constants.js";
-import { checkIsRecord } from "./runtime/services/checkIsRecord.js";
-import { computeSubresourceIntegrityHashes } from "./services/computeSubresourceIntegrityHashes.js";
-import { getDefaultModuleOptions } from "./services/getDefaultModuleOptions.js";
-import { getPluginTemplate } from "./services/getPluginTemplate.js";
-import { getRemoveLoggersViteConfig } from "./services/getRemoveLoggersViteConfig.js";
-import { getRouteRulesTemplate } from "./services/getRouteRulesTemplate.js";
-import { mergeModuleOptions } from "./services/mergeModuleOptions.js";
-import { getRouteSecurityRules } from "./services/getRouteSecurityRules.js";
-import { getStaticResourceHeaders } from "./services/getStaticResourceHeaders.js";
-import { getTypeTemplate } from "./services/getTypeTemplate.js";
-import { parseModuleOptions } from "./services/parseModuleOptions.js";
-import { defu } from "defu";
-import { addNitroPlugin, addServerHandler, addServerTemplate, addTypeTemplate, createResolver, defineNuxtModule } from "@nuxt/kit";
-//#region src/module.ts
-const ROUTE_RULES_TEMPLATE_FILENAME = `#${MODULE_NAME}/route-rules.mjs`;
-const SRI_HASHES_TEMPLATE_FILENAME = `#${MODULE_NAME}/sri-hashes.mjs`;
-const ROUTE_RULES_PLUGIN_FILENAME = `#${MODULE_NAME}/route-rules-plugin.mjs`;
-const SRI_PLUGIN_FILENAME = `#${MODULE_NAME}/sri-plugin.mjs`;
-const securityModule = defineNuxtModule({
-	meta: {
-		compatibility: { nuxt: ">=5.0.0-0" },
-		configKey: "security",
-		name: MODULE_NAME
-	},
-	setup(userOptions, nuxt) {
-		const options = parseModuleOptions(mergeModuleOptions(getDefaultModuleOptions(nuxt.options.dev, nuxt.options.devServer.url, userOptions.strict === true), userOptions));
-		if (!options.enabled) return;
-		const resolver = createResolver(import.meta.url);
-		const { basicAuth, ...publicOptions } = options;
-		if (basicAuth) {
-			const { private: privateRuntimeConfig } = nuxt.options.runtimeConfig;
-			nuxt.options.runtimeConfig.private = defu(checkIsRecord(privateRuntimeConfig) ? privateRuntimeConfig : {}, { basicAuth });
-		}
-		const routeSecurityRules = getRouteSecurityRules(nuxt.options.routeRules ?? {}, options);
-		addServerTemplate({
-			filename: ROUTE_RULES_TEMPLATE_FILENAME,
-			getContents: () => getRouteRulesTemplate({
-				"/**": publicOptions,
-				...routeSecurityRules
-			})
-		});
-		addServerTemplate({
-			filename: ROUTE_RULES_PLUGIN_FILENAME,
-			getContents: () => getPluginTemplate(resolver.resolve("./runtime/nitro/plugins/routeRules"), "createRouteRulesPlugin", ROUTE_RULES_TEMPLATE_FILENAME)
-		});
-		addNitroPlugin(ROUTE_RULES_PLUGIN_FILENAME);
-		if (options.removeLoggers) nuxt.options.vite = defu(getRemoveLoggersViteConfig(), nuxt.options.vite);
-		if (options.headers) nuxt.options.routeRules = defu({ "/**": { headers: getStaticResourceHeaders(options.headers) } }, nuxt.options.routeRules);
-		if (options.nonce) addNitroPlugin(resolver.resolve("./runtime/nitro/plugins/nonce"));
-		if (options.sri) {
-			addServerTemplate({
-				filename: SRI_PLUGIN_FILENAME,
-				getContents: () => getPluginTemplate(resolver.resolve("./runtime/nitro/plugins/subresourceIntegrity"), "createSubresourceIntegrityPlugin", SRI_HASHES_TEMPLATE_FILENAME)
-			});
-			addNitroPlugin(SRI_PLUGIN_FILENAME);
-		}
-		if (options.ssg) addNitroPlugin(resolver.resolve("./runtime/nitro/plugins/ssgHashes"));
-		if (options.headers) addNitroPlugin(resolver.resolve("./runtime/nitro/plugins/securityHeaders"));
-		if (options.hidePoweredBy) addNitroPlugin(resolver.resolve("./runtime/nitro/plugins/hidePoweredBy"));
-		if (options.csrf) addServerHandler({
-			handler: resolver.resolve("./runtime/server/middleware/csrf"),
-			middleware: true
-		});
-		if (options.rateLimiter) addServerHandler({
-			handler: resolver.resolve("./runtime/server/middleware/rateLimiter"),
-			middleware: true
-		});
-		if (options.requestSizeLimiter) addServerHandler({
-			handler: resolver.resolve("./runtime/server/middleware/requestSizeLimiter"),
-			middleware: true
-		});
-		if (options.corsHandler) addServerHandler({
-			handler: resolver.resolve("./runtime/server/middleware/corsHandler"),
-			middleware: true
-		});
-		if (options.allowedMethodsRestricter) addServerHandler({
-			handler: resolver.resolve("./runtime/server/middleware/allowedMethodsRestricter"),
-			middleware: true
-		});
-		if (basicAuth) addServerHandler({
-			handler: resolver.resolve("./runtime/server/middleware/basicAuth"),
-			middleware: true
-		});
-		let sriHashes = {};
-		if (options.sri) {
-			addServerTemplate({
-				filename: SRI_HASHES_TEMPLATE_FILENAME,
-				getContents: () => `export default ${JSON.stringify(sriHashes)}\n`
-			});
-			nuxt.hook("nitro:build:before", async (nitro) => {
-				sriHashes = await computeSubresourceIntegrityHashes(nitro);
-			});
-		}
-		addTypeTemplate({
-			filename: `types/${MODULE_NAME}.d.ts`,
-			getContents: getTypeTemplate
-		}, {
-			nitro: true,
-			nuxt: true
-		});
-	}
-});
-//#endregion
-export { securityModule as default };

package/dist/models/AllowedMethodsRestricterOptions.d.ts

@@ -1,5 +0,0 @@
-//#region src/models/AllowedMethodsRestricterOptions.d.ts
-export interface AllowedMethodsRestricterOptions {
-  methods: string[];
-}
-//#endregion

package/dist/models/BasicAuthOptions.d.ts

@@ -1,9 +0,0 @@
-//#region src/models/BasicAuthOptions.d.ts
-export interface BasicAuthOptions {
-  exclude?: string[];
-  include?: string[];
-  message?: string;
-  name: string;
-  pass: string;
-}
-//#endregion

package/dist/models/ContentSecurityPolicy.d.ts

@@ -1,3 +0,0 @@
-//#region src/models/ContentSecurityPolicy.d.ts
-export type ContentSecurityPolicy = Record<string, boolean | string[] | undefined>;
-//#endregion

package/dist/models/CorsHandlerOptions.d.ts

@@ -1,13 +0,0 @@
-//#region src/models/CorsHandlerOptions.d.ts
-export interface CorsHandlerOptions {
-  allowHeaders?: string[];
-  credentials?: boolean;
-  exposeHeaders?: string[];
-  maxAge?: string;
-  methods: string[];
-  origin: string | string[];
-  preflight?: {
-    statusCode: number;
-  };
-}
-//#endregion

package/dist/models/CrossOriginEmbedderPolicy.d.ts

@@ -1,8 +0,0 @@
-//#region src/models/CrossOriginEmbedderPolicy.d.ts
-export declare const CrossOriginEmbedderPolicy: {
-  readonly Credentialless: "credentialless";
-  readonly RequireCorp: "require-corp";
-  readonly UnsafeNone: "unsafe-none";
-};
-export type CrossOriginEmbedderPolicy = (typeof CrossOriginEmbedderPolicy)[keyof typeof CrossOriginEmbedderPolicy];
-//#endregion

package/dist/models/CrossOriginEmbedderPolicy.js

@@ -1,8 +0,0 @@
-//#region src/models/CrossOriginEmbedderPolicy.ts
-const CrossOriginEmbedderPolicy = {
-	Credentialless: "credentialless",
-	RequireCorp: "require-corp",
-	UnsafeNone: "unsafe-none"
-};
-//#endregion
-export { CrossOriginEmbedderPolicy };

package/dist/models/CsrfOptions.d.ts

@@ -1,6 +0,0 @@
-//#region src/models/CsrfOptions.d.ts
-export interface CsrfOptions {
-  cookieName: string;
-  headerName: string;
-}
-//#endregion

package/dist/models/ModuleOptions.d.ts

@@ -1,27 +0,0 @@
-import { AllowedMethodsRestricterOptions } from "./AllowedMethodsRestricterOptions.js";
-import { BasicAuthOptions } from "./BasicAuthOptions.js";
-import { CorsHandlerOptions } from "./CorsHandlerOptions.js";
-import { CsrfOptions } from "./CsrfOptions.js";
-import { RateLimiterOptions } from "./RateLimiterOptions.js";
-import { RequestSizeLimiterOptions } from "./RequestSizeLimiterOptions.js";
-import { SecurityHeaders } from "./SecurityHeaders.js";
-import { SsgOptions } from "./SsgOptions.js";
-//#region src/models/ModuleOptions.d.ts
-export interface ModuleOptions {
-  allowedMethodsRestricter: AllowedMethodsRestricterOptions | false;
-  basicAuth: BasicAuthOptions | false;
-  contentSecurityPolicyReportOnly: boolean;
-  corsHandler: CorsHandlerOptions | false;
-  csrf: CsrfOptions | false;
-  enabled: boolean;
-  headers: false | SecurityHeaders;
-  hidePoweredBy: boolean;
-  nonce: boolean;
-  rateLimiter: false | RateLimiterOptions;
-  removeLoggers: boolean;
-  requestSizeLimiter: false | RequestSizeLimiterOptions;
-  sri: boolean;
-  ssg: false | SsgOptions;
-  strict: boolean;
-}
-//#endregion

package/dist/models/PermissionsPolicy.d.ts

@@ -1,3 +0,0 @@
-//#region src/models/PermissionsPolicy.d.ts
-export type PermissionsPolicy = Record<string, false | string[] | undefined>;
-//#endregion

package/dist/models/RateLimitWindow.d.ts

@@ -1,6 +0,0 @@
-//#region src/models/RateLimitWindow.d.ts
-export interface RateLimitWindow {
-  count: number;
-  resetAt: number;
-}
-//#endregion

package/dist/models/RateLimiterOptions.d.ts

@@ -1,6 +0,0 @@
-//#region src/models/RateLimiterOptions.d.ts
-export interface RateLimiterOptions {
-  intervalInMilliseconds: number;
-  tokensPerInterval: number;
-}
-//#endregion

package/dist/models/RateLimiterStore.d.ts

@@ -1,6 +0,0 @@
-import { RateLimitWindow } from "./RateLimitWindow.js";
-//#region src/models/RateLimiterStore.d.ts
-export interface RateLimiterStore {
-  increment: (key: string, intervalInMilliseconds: number) => Promise<RateLimitWindow>;
-}
-//#endregion

package/dist/models/RequestSizeLimiterOptions.d.ts

@@ -1,6 +0,0 @@
-//#region src/models/RequestSizeLimiterOptions.d.ts
-export interface RequestSizeLimiterOptions {
-  maxRequestSizeInBytes: number;
-  maxUploadFileRequestInBytes: number;
-}
-//#endregion

package/dist/models/SecurityHeaders.d.ts

@@ -1,22 +0,0 @@
-import { ContentSecurityPolicy } from "./ContentSecurityPolicy.js";
-import { CrossOriginEmbedderPolicy } from "./CrossOriginEmbedderPolicy.js";
-import { PermissionsPolicy } from "./PermissionsPolicy.js";
-import { StrictTransportSecurity } from "./StrictTransportSecurity.js";
-import { XFrameOptions } from "./XFrameOptions.js";
-//#region src/models/SecurityHeaders.d.ts
-export interface SecurityHeaders {
-  contentSecurityPolicy?: ContentSecurityPolicy | false;
-  crossOriginEmbedderPolicy?: CrossOriginEmbedderPolicy | false;
-  crossOriginOpenerPolicy?: false | string;
-  crossOriginResourcePolicy?: false | string;
-  originAgentCluster?: false | string;
-  permissionsPolicy?: false | PermissionsPolicy;
-  referrerPolicy?: false | string;
-  strictTransportSecurity?: false | StrictTransportSecurity;
-  xContentTypeOptions?: false | string;
-  xDNSPrefetchControl?: false | string;
-  xDownloadOptions?: false | string;
-  xFrameOptions?: false | XFrameOptions;
-  xPermittedCrossDomainPolicies?: false | string;
-}
-//#endregion

package/dist/models/SecurityRouteRules.d.ts

@@ -1,4 +0,0 @@
-import { ModuleOptions } from "./ModuleOptions.js";
-//#region src/models/SecurityRouteRules.d.ts
-export type SecurityRouteRules = Partial<ModuleOptions>;
-//#endregion

package/dist/models/SecurityRules.d.ts

@@ -1,4 +0,0 @@
-import { ModuleOptions } from "./ModuleOptions.js";
-//#region src/models/SecurityRules.d.ts
-export type SecurityRules = Partial<ModuleOptions>;
-//#endregion

package/dist/models/SsgOptions.d.ts

@@ -1,9 +0,0 @@
-//#region src/models/SsgOptions.d.ts
-export interface SsgOptions {
-  exportToPresets: boolean;
-  hashScripts: boolean;
-  hashStyles: boolean;
-  meta: boolean;
-  nitroHeaders: boolean;
-}
-//#endregion

package/dist/models/StrictTransportSecurity.d.ts

@@ -1,7 +0,0 @@
-//#region src/models/StrictTransportSecurity.d.ts
-export interface StrictTransportSecurity {
-  includeSubdomains: boolean;
-  maxAge: number;
-  preload: boolean;
-}
-//#endregion

package/dist/models/XFrameOptions.d.ts

@@ -1,7 +0,0 @@
-//#region src/models/XFrameOptions.d.ts
-export declare const XFrameOptions: {
-  readonly Deny: "DENY";
-  readonly SameOrigin: "SAMEORIGIN";
-};
-export type XFrameOptions = (typeof XFrameOptions)[keyof typeof XFrameOptions];
-//#endregion

package/dist/models/XFrameOptions.js

@@ -1,7 +0,0 @@
-//#region src/models/XFrameOptions.ts
-const XFrameOptions = {
-	Deny: "DENY",
-	SameOrigin: "SAMEORIGIN"
-};
-//#endregion
-export { XFrameOptions };

package/dist/runtime/constants.d.ts

@@ -1,24 +0,0 @@
-import { SecurityHeaders } from "../models/SecurityHeaders.js";
-//#region src/runtime/constants.d.ts
-export declare const MODULE_NAME = "nuxt-security-module";
-export declare const ROUTE_RULES_HOOK: `${typeof MODULE_NAME}:routeRules`;
-export declare const SECURITY_HEADER_NAMES: Readonly<Record<keyof SecurityHeaders, string>>;
-export declare const CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME = "Content-Security-Policy-Report-Only";
-export declare const MAX_RATE_LIMIT_ENTRIES = 1e4;
-export declare const UNKNOWN_CLIENT_KEY = "unknown";
-export declare const CSRF_UNSAFE_METHODS: readonly string[];
-export declare const CSRF_TOKEN_BYTE_LENGTH = 32;
-export declare const NONCE_BYTE_LENGTH = 18;
-export declare const NONCE_PLACEHOLDER = "'nonce-{{nonce}}'";
-export declare const SRI_HASH_ALGORITHM = "SHA-384";
-export declare const CSP_HASH_ALGORITHM = "SHA-256";
-export declare const PRERENDERED_HEADERS_DIRECTORY_NAME = "nuxt-security";
-export declare const PRERENDERED_HEADERS_FILE_NAME = "headers.json";
-export declare const HTML_ATTRIBUTE_REGEX: RegExp;
-export declare const HTML_TAG_REGEX: RegExp;
-export declare const NONCE_TAG_NAMES: readonly string[];
-export declare const FILE_UPLOAD_CONTENT_TYPE = "multipart/form-data";
-export declare const SIZE_LIMITED_METHODS: readonly string[];
-export declare const DEFAULT_BASIC_AUTH_REALM = "Please enter username and password";
-export declare const BASIC_AUTHORIZATION_SCHEME = "Basic";
-//#endregion

package/dist/runtime/constants.js

@@ -1,52 +0,0 @@
-//#region src/runtime/constants.ts
-const MODULE_NAME = "nuxt-security-module";
-const ROUTE_RULES_HOOK = `${MODULE_NAME}:routeRules`;
-const SECURITY_HEADER_NAMES = {
-	contentSecurityPolicy: "Content-Security-Policy",
-	crossOriginEmbedderPolicy: "Cross-Origin-Embedder-Policy",
-	crossOriginOpenerPolicy: "Cross-Origin-Opener-Policy",
-	crossOriginResourcePolicy: "Cross-Origin-Resource-Policy",
-	originAgentCluster: "Origin-Agent-Cluster",
-	permissionsPolicy: "Permissions-Policy",
-	referrerPolicy: "Referrer-Policy",
-	strictTransportSecurity: "Strict-Transport-Security",
-	xContentTypeOptions: "X-Content-Type-Options",
-	xDNSPrefetchControl: "X-DNS-Prefetch-Control",
-	xDownloadOptions: "X-Download-Options",
-	xFrameOptions: "X-Frame-Options",
-	xPermittedCrossDomainPolicies: "X-Permitted-Cross-Domain-Policies"
-};
-const CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME = "Content-Security-Policy-Report-Only";
-const MAX_RATE_LIMIT_ENTRIES = 1e4;
-const UNKNOWN_CLIENT_KEY = "unknown";
-const CSRF_UNSAFE_METHODS = [
-	"DELETE",
-	"PATCH",
-	"POST",
-	"PUT"
-];
-const CSRF_TOKEN_BYTE_LENGTH = 32;
-const NONCE_BYTE_LENGTH = 18;
-const NONCE_PLACEHOLDER = "'nonce-{{nonce}}'";
-const SRI_HASH_ALGORITHM = "SHA-384";
-const CSP_HASH_ALGORITHM = "SHA-256";
-const PRERENDERED_HEADERS_DIRECTORY_NAME = "nuxt-security";
-const PRERENDERED_HEADERS_FILE_NAME = "headers.json";
-const HTML_ATTRIBUTE_PATTERN = String.raw`\s+[^\s"'<>/=]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s"'<>=]+))?`;
-const HTML_ATTRIBUTE_REGEX = /\s+(?<name>[^\s"'<>/=]+)(?<assignment>\s*=\s*(?<value>"[^"]*"|'[^']*'|[^\s"'<>=]+))?/gu;
-const HTML_TAG_REGEX = new RegExp(String.raw`<(script|style)\b((?:${HTML_ATTRIBUTE_PATTERN})*)(\s*\/?)>([\s\S]*?)<\/\1\s*>|<([a-z][\w:-]*)((?:${HTML_ATTRIBUTE_PATTERN})*)(\s*\/?)>`, "giu");
-const NONCE_TAG_NAMES = [
-	"link",
-	"script",
-	"style"
-];
-const FILE_UPLOAD_CONTENT_TYPE = "multipart/form-data";
-const SIZE_LIMITED_METHODS = [
-	"DELETE",
-	"POST",
-	"PUT"
-];
-const DEFAULT_BASIC_AUTH_REALM = "Please enter username and password";
-const BASIC_AUTHORIZATION_SCHEME = "Basic";
-//#endregion
-export { BASIC_AUTHORIZATION_SCHEME, CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME, CSP_HASH_ALGORITHM, CSRF_TOKEN_BYTE_LENGTH, CSRF_UNSAFE_METHODS, DEFAULT_BASIC_AUTH_REALM, FILE_UPLOAD_CONTENT_TYPE, HTML_ATTRIBUTE_REGEX, HTML_TAG_REGEX, MAX_RATE_LIMIT_ENTRIES, MODULE_NAME, NONCE_BYTE_LENGTH, NONCE_PLACEHOLDER, NONCE_TAG_NAMES, PRERENDERED_HEADERS_DIRECTORY_NAME, PRERENDERED_HEADERS_FILE_NAME, ROUTE_RULES_HOOK, SECURITY_HEADER_NAMES, SIZE_LIMITED_METHODS, SRI_HASH_ALGORITHM, UNKNOWN_CLIENT_KEY };

package/dist/runtime/nitro/plugins/hidePoweredBy.d.ts

@@ -1,5 +0,0 @@
-import { NitroAppPlugin } from "nitro/types";
-//#region src/runtime/nitro/plugins/hidePoweredBy.d.ts
-declare const hidePoweredBy: NitroAppPlugin;
-//#endregion
-export { hidePoweredBy as default };

package/dist/runtime/nitro/plugins/hidePoweredBy.js

@@ -1,13 +0,0 @@
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { definePlugin } from "nitro";
-import { isEvent } from "nitro/h3";
-//#region src/runtime/nitro/plugins/hidePoweredBy.ts
-const hidePoweredBy = definePlugin((nitroApp) => {
-	nitroApp.hooks.hook("response", (_response, event) => {
-		if (!isEvent(event)) return;
-		const rules = getSecurityRules(event);
-		if (rules?.enabled && rules.hidePoweredBy) event.res.headers.delete("x-powered-by");
-	});
-});
-//#endregion
-export { hidePoweredBy as default };

package/dist/runtime/nitro/plugins/nonce.d.ts

@@ -1,5 +0,0 @@
-import { NitroAppPlugin } from "nitro/types";
-//#region src/runtime/nitro/plugins/nonce.d.ts
-declare const noncePlugin: NitroAppPlugin;
-//#endregion
-export { noncePlugin as default };

package/dist/runtime/nitro/plugins/nonce.js

@@ -1,27 +0,0 @@
-import { generateNonce } from "../../services/generateNonce.js";
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { getSecurityState } from "../../services/getSecurityState.js";
-import { injectNonce } from "../../services/injectNonce.js";
-import { definePlugin } from "nitro";
-//#region src/runtime/nitro/plugins/nonce.ts
-const HTML_SECTIONS = [
-	"body",
-	"bodyAppend",
-	"bodyPrepend",
-	"head"
-];
-const noncePlugin = definePlugin((nitroApp) => {
-	if (import.meta.prerender) return;
-	nitroApp.hooks.hook("render:route", (_context, { event }) => {
-		const rules = getSecurityRules(event);
-		if (rules?.enabled && rules.nonce) getSecurityState(event).nonce = generateNonce();
-	});
-	nitroApp.hooks.hook("render:html", (html, { event }) => {
-		const rules = getSecurityRules(event);
-		const nonce = getSecurityState(event).nonce;
-		if (!rules?.enabled || !rules.nonce || !rules.headers || !rules.headers.contentSecurityPolicy || !nonce) return;
-		for (const section of HTML_SECTIONS) html[section] = html[section].map((element) => injectNonce(element, nonce));
-	});
-});
-//#endregion
-export { noncePlugin as default };

package/dist/runtime/nitro/plugins/routeRules.d.ts

@@ -1,5 +0,0 @@
-import { SecurityRules } from "../../../models/SecurityRules.js";
-import { NitroAppPlugin } from "nitro/types";
-//#region src/runtime/nitro/plugins/routeRules.d.ts
-export declare const createRouteRulesPlugin: (routeRules: Record<string, SecurityRules>) => NitroAppPlugin;
-//#endregion

package/dist/runtime/nitro/plugins/routeRules.js

@@ -1,17 +0,0 @@
-import { ROUTE_RULES_HOOK } from "../../constants.js";
-import { setSecurityRouteMatcher } from "../../services/securityRouteMatcher.js";
-import { definePlugin } from "nitro";
-//#region src/runtime/nitro/plugins/routeRules.ts
-const createRouteRulesPlugin = (routeRules) => definePlugin((nitroApp) => {
-	let routesResolved;
-	nitroApp.hooks.hook("request", () => {
-		routesResolved ??= (async () => {
-			const routes = structuredClone(routeRules);
-			await nitroApp.hooks.callHook(ROUTE_RULES_HOOK, routes);
-			setSecurityRouteMatcher(routes);
-		})();
-		return routesResolved;
-	});
-});
-//#endregion
-export { createRouteRulesPlugin };

package/dist/runtime/nitro/plugins/securityHeaders.d.ts

@@ -1,5 +0,0 @@
-import { NitroAppPlugin } from "nitro/types";
-//#region src/runtime/nitro/plugins/securityHeaders.d.ts
-declare const securityHeaders: NitroAppPlugin;
-//#endregion
-export { securityHeaders as default };

package/dist/runtime/nitro/plugins/securityHeaders.js

@@ -1,25 +0,0 @@
-import { CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME, SECURITY_HEADER_NAMES } from "../../constants.js";
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { getSecurityState } from "../../services/getSecurityState.js";
-import { serializeSecurityHeaders } from "../../services/serializeSecurityHeaders.js";
-import { updateContentSecurityPolicy } from "../../services/updateContentSecurityPolicy.js";
-import { definePlugin } from "nitro";
-//#region src/runtime/nitro/plugins/securityHeaders.ts
-const CONTENT_SECURITY_POLICY_HEADER_NAME = SECURITY_HEADER_NAMES.contentSecurityPolicy;
-const securityHeaders = definePlugin((nitroApp) => {
-	nitroApp.hooks.hook("render:route", (_context, { event }) => {
-		const rules = getSecurityRules(event);
-		if (!rules?.enabled || !rules.headers) return;
-		const { contentSecurityPolicy } = rules.headers;
-		const serializedHeaders = serializeSecurityHeaders({
-			...rules.headers,
-			contentSecurityPolicy: contentSecurityPolicy ? updateContentSecurityPolicy(contentSecurityPolicy, getSecurityState(event)) : false
-		});
-		for (const [name, value] of Object.entries(serializedHeaders)) {
-			const isPolicy = name === CONTENT_SECURITY_POLICY_HEADER_NAME;
-			event.res.headers.set(isPolicy && rules.contentSecurityPolicyReportOnly ? CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME : name, value);
-		}
-	});
-});
-//#endregion
-export { securityHeaders as default };

package/dist/runtime/nitro/plugins/ssgHashes.d.ts

@@ -1,5 +0,0 @@
-import { NitroAppPlugin } from "nitro/types";
-//#region src/runtime/nitro/plugins/ssgHashes.d.ts
-declare const ssgHashes: NitroAppPlugin;
-//#endregion
-export { ssgHashes as default };

package/dist/runtime/nitro/plugins/ssgHashes.js

@@ -1,27 +0,0 @@
-import { collectSsgHashes } from "../../services/collectSsgHashes.js";
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { getSecurityState } from "../../services/getSecurityState.js";
-import { insertContentSecurityPolicyMeta } from "../../services/insertContentSecurityPolicyMeta.js";
-import { updateContentSecurityPolicy } from "../../services/updateContentSecurityPolicy.js";
-import { definePlugin } from "nitro";
-//#region src/runtime/nitro/plugins/ssgHashes.ts
-const HTML_SECTIONS = [
-	"head",
-	"bodyPrepend",
-	"body",
-	"bodyAppend"
-];
-const ssgHashes = definePlugin((nitroApp) => {
-	if (!import.meta.prerender) return;
-	nitroApp.hooks.hook("render:html", async (html, { event }) => {
-		const rules = getSecurityRules(event);
-		if (!rules?.enabled || !rules.ssg || !rules.headers || !rules.headers.contentSecurityPolicy) return;
-		const state = getSecurityState(event);
-		state.hashes = await collectSsgHashes(HTML_SECTIONS.map((section) => html[section].join("")).join(""), rules.ssg);
-		if (!rules.ssg.meta) return;
-		const policy = updateContentSecurityPolicy(rules.headers.contentSecurityPolicy, state);
-		html.head = [insertContentSecurityPolicyMeta(html.head.join(""), policy)];
-	});
-});
-//#endregion
-export { ssgHashes as default };

package/dist/runtime/nitro/plugins/subresourceIntegrity.d.ts

@@ -1,4 +0,0 @@
-import { NitroAppPlugin } from "nitro/types";
-//#region src/runtime/nitro/plugins/subresourceIntegrity.d.ts
-export declare const createSubresourceIntegrityPlugin: (sriHashes: Record<string, string>) => NitroAppPlugin;
-//#endregion

package/dist/runtime/nitro/plugins/subresourceIntegrity.js

@@ -1,19 +0,0 @@
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { injectSubresourceIntegrity } from "../../services/injectSubresourceIntegrity.js";
-import { definePlugin } from "nitro";
-//#region src/runtime/nitro/plugins/subresourceIntegrity.ts
-const HTML_SECTIONS = [
-	"body",
-	"bodyAppend",
-	"bodyPrepend",
-	"head"
-];
-const createSubresourceIntegrityPlugin = (sriHashes) => definePlugin((nitroApp) => {
-	nitroApp.hooks.hook("render:html", (html, { event }) => {
-		const rules = getSecurityRules(event);
-		if (!rules?.enabled || !rules.sri) return;
-		for (const section of HTML_SECTIONS) html[section] = html[section].map((element) => injectSubresourceIntegrity(element, sriHashes));
-	});
-});
-//#endregion
-export { createSubresourceIntegrityPlugin };

package/dist/runtime/server/middleware/allowedMethodsRestricter.d.ts

@@ -1,5 +0,0 @@
-import { Middleware } from "nitro/h3";
-//#region src/runtime/server/middleware/allowedMethodsRestricter.d.ts
-declare const allowedMethodsRestricter: Middleware;
-//#endregion
-export { allowedMethodsRestricter as default };

package/dist/runtime/server/middleware/allowedMethodsRestricter.js

@@ -1,15 +0,0 @@
-import { checkIsMethodAllowed } from "../../services/checkIsMethodAllowed.js";
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { defineMiddleware } from "nitro";
-import { HTTPError } from "nitro/h3";
-//#region src/runtime/server/middleware/allowedMethodsRestricter.ts
-const allowedMethodsRestricter = defineMiddleware((event) => {
-	const rules = getSecurityRules(event);
-	if (!rules?.enabled || !rules.allowedMethodsRestricter) return;
-	if (!checkIsMethodAllowed(event.req.method, rules.allowedMethodsRestricter.methods)) throw new HTTPError({
-		status: 405,
-		statusText: "Method not allowed"
-	});
-});
-//#endregion
-export { allowedMethodsRestricter as default };

package/dist/runtime/server/middleware/basicAuth.d.ts

@@ -1,5 +0,0 @@
-import { Middleware } from "nitro/h3";
-//#region src/runtime/server/middleware/basicAuth.d.ts
-declare const basicAuthMiddleware: Middleware;
-//#endregion
-export { basicAuthMiddleware as default };