nuxt-security-module 4.1.2 → 4.2.0

package/dist/runtime/services/securityRouteMatcher.d.ts

@@ -1,5 +0,0 @@
-import { SecurityRules } from "../../models/SecurityRules.js";
-//#region src/runtime/services/securityRouteMatcher.d.ts
-export declare const setSecurityRouteMatcher: (routes: Record<string, SecurityRules>) => void;
-export declare const findSecurityRules: (pathname: string) => SecurityRules[] | undefined;
-//#endregion

package/dist/runtime/services/securityRouteMatcher.js

@@ -1,11 +0,0 @@
-import { addRoute, createRouter, findAllRoutes } from "rou3";
-//#region src/runtime/services/securityRouteMatcher.ts
-let securityRouter;
-const setSecurityRouteMatcher = (routes) => {
-	const router = createRouter();
-	for (const [pattern, rules] of Object.entries(routes)) addRoute(router, "", pattern, rules);
-	securityRouter = router;
-};
-const findSecurityRules = (pathname) => securityRouter && findAllRoutes(securityRouter, "", pathname).flatMap(({ data }) => data ? [data] : []);
-//#endregion
-export { findSecurityRules, setSecurityRouteMatcher };

package/dist/runtime/services/serializeBasicAuthChallenge.d.ts

@@ -1,3 +0,0 @@
-//#region src/runtime/services/serializeBasicAuthChallenge.d.ts
-export declare const serializeBasicAuthChallenge: (realm: string) => string;
-//#endregion

package/dist/runtime/services/serializeBasicAuthChallenge.js

@@ -1,4 +0,0 @@
-//#region src/runtime/services/serializeBasicAuthChallenge.ts
-const serializeBasicAuthChallenge = (realm) => `Basic realm="${realm.replaceAll(/["\\]/gu, String.raw`\$&`)}"`;
-//#endregion
-export { serializeBasicAuthChallenge };

package/dist/runtime/services/serializeContentSecurityPolicy.d.ts

@@ -1,4 +0,0 @@
-import { ContentSecurityPolicy } from "../../models/ContentSecurityPolicy.js";
-//#region src/runtime/services/serializeContentSecurityPolicy.d.ts
-export declare const serializeContentSecurityPolicy: (policy: ContentSecurityPolicy) => string;
-//#endregion

package/dist/runtime/services/serializeContentSecurityPolicy.js

@@ -1,7 +0,0 @@
-//#region src/runtime/services/serializeContentSecurityPolicy.ts
-const serializeContentSecurityPolicy = (policy) => Object.entries(policy).filter(([, value]) => value !== false).map(([directive, value]) => {
-	if (directive === "upgrade-insecure-requests") return "upgrade-insecure-requests;";
-	return `${directive} ${Array.isArray(value) ? value.map((source) => source.trim()).join(" ") : ""};`;
-}).join(" ");
-//#endregion
-export { serializeContentSecurityPolicy };

package/dist/runtime/services/serializePermissionsPolicy.d.ts

@@ -1,4 +0,0 @@
-import { PermissionsPolicy } from "../../models/PermissionsPolicy.js";
-//#region src/runtime/services/serializePermissionsPolicy.d.ts
-export declare const serializePermissionsPolicy: (policy: PermissionsPolicy) => string;
-//#endregion

package/dist/runtime/services/serializePermissionsPolicy.js

@@ -1,4 +0,0 @@
-//#region src/runtime/services/serializePermissionsPolicy.ts
-const serializePermissionsPolicy = (policy) => Object.entries(policy).flatMap(([feature, sources]) => sources === false ? [] : [`${feature}=(${(sources ?? []).join(" ")})`]).join(", ");
-//#endregion
-export { serializePermissionsPolicy };

package/dist/runtime/services/serializeSecurityHeaders.d.ts

@@ -1,4 +0,0 @@
-import { SecurityHeaders } from "../../models/SecurityHeaders.js";
-//#region src/runtime/services/serializeSecurityHeaders.d.ts
-export declare const serializeSecurityHeaders: (headers: SecurityHeaders) => Record<string, string>;
-//#endregion

package/dist/runtime/services/serializeSecurityHeaders.js

@@ -1,19 +0,0 @@
-import { SECURITY_HEADER_NAMES } from "../constants.js";
-import { serializeContentSecurityPolicy } from "./serializeContentSecurityPolicy.js";
-import { serializePermissionsPolicy } from "./serializePermissionsPolicy.js";
-import { serializeStrictTransportSecurity } from "./serializeStrictTransportSecurity.js";
-//#region src/runtime/services/serializeSecurityHeaders.ts
-const checkIsSecurityHeaderKey = (key) => Object.hasOwn(SECURITY_HEADER_NAMES, key);
-const serializeSecurityHeaders = (headers) => Object.fromEntries(Object.keys(headers).flatMap((key) => {
-	if (!checkIsSecurityHeaderKey(key)) return [];
-	const value = headers[key];
-	return value === false || value === void 0 ? [] : [[SECURITY_HEADER_NAMES[key], serializeValue(key, value)]];
-}));
-const serializeValue = (key, value) => {
-	if (key === "contentSecurityPolicy") return serializeContentSecurityPolicy(value);
-	if (key === "permissionsPolicy") return serializePermissionsPolicy(value);
-	if (key === "strictTransportSecurity") return serializeStrictTransportSecurity(value);
-	return String(value);
-};
-//#endregion
-export { serializeSecurityHeaders };

package/dist/runtime/services/serializeStrictTransportSecurity.d.ts

@@ -1,4 +0,0 @@
-import { StrictTransportSecurity } from "../../models/StrictTransportSecurity.js";
-//#region src/runtime/services/serializeStrictTransportSecurity.d.ts
-export declare const serializeStrictTransportSecurity: (policy: StrictTransportSecurity) => string;
-//#endregion

package/dist/runtime/services/serializeStrictTransportSecurity.js

@@ -1,8 +0,0 @@
-//#region src/runtime/services/serializeStrictTransportSecurity.ts
-const serializeStrictTransportSecurity = (policy) => [
-	`max-age=${policy.maxAge}`,
-	policy.includeSubdomains && "includeSubDomains",
-	policy.preload && "preload"
-].filter(Boolean).join("; ");
-//#endregion
-export { serializeStrictTransportSecurity };

package/dist/runtime/services/stripHtmlTagAttribute.d.ts

@@ -1,3 +0,0 @@
-//#region src/runtime/services/stripHtmlTagAttribute.d.ts
-export declare const stripHtmlTagAttribute: (attributes: string, attributeName: string) => string;
-//#endregion

package/dist/runtime/services/stripHtmlTagAttribute.js

@@ -1,5 +0,0 @@
-import { HTML_ATTRIBUTE_REGEX } from "../constants.js";
-//#region src/runtime/services/stripHtmlTagAttribute.ts
-const stripHtmlTagAttribute = (attributes, attributeName) => attributes.replace(HTML_ATTRIBUTE_REGEX, (token, name) => name.toLowerCase() === attributeName ? "" : token);
-//#endregion
-export { stripHtmlTagAttribute };

package/dist/runtime/services/updateContentSecurityPolicy.d.ts

@@ -1,5 +0,0 @@
-import { ContentSecurityPolicy } from "../../models/ContentSecurityPolicy.js";
-import { SecurityState } from "./getSecurityState.js";
-//#region src/runtime/services/updateContentSecurityPolicy.d.ts
-export declare const updateContentSecurityPolicy: (policy: ContentSecurityPolicy, { hashes, nonce }: SecurityState) => ContentSecurityPolicy;
-//#endregion

package/dist/runtime/services/updateContentSecurityPolicy.js

@@ -1,15 +0,0 @@
-import { NONCE_PLACEHOLDER } from "../constants.js";
-//#region src/runtime/services/updateContentSecurityPolicy.ts
-const SCRIPT_DIRECTIVES = /* @__PURE__ */ new Set(["script-src", "script-src-elem"]);
-const STYLE_DIRECTIVES = /* @__PURE__ */ new Set(["style-src", "style-src-elem"]);
-const updateContentSecurityPolicy = (policy, { hashes, nonce }) => Object.fromEntries(Object.keys(policy).map((directive) => {
-	const value = policy[directive];
-	if (!Array.isArray(value)) return [directive, value];
-	const sources = value.filter((source) => !checkIsStaticNonce(source)).map((source) => source === "'nonce-{{nonce}}'" && nonce ? `'nonce-${nonce}'` : source).filter((source) => source !== NONCE_PLACEHOLDER);
-	if (SCRIPT_DIRECTIVES.has(directive)) sources.push(...hashes.script);
-	if (STYLE_DIRECTIVES.has(directive)) sources.push(...hashes.style);
-	return [directive, sources];
-}));
-const checkIsStaticNonce = (source) => source.startsWith("'nonce-") && source !== "'nonce-{{nonce}}'";
-//#endregion
-export { updateContentSecurityPolicy };

package/dist/schemas/allowedMethodsRestricterOptionsSchema.js

@@ -1,5 +0,0 @@
-import { z } from "zod";
-//#region src/schemas/allowedMethodsRestricterOptionsSchema.ts
-const allowedMethodsRestricterOptionsSchema = z.strictObject({ methods: z.array(z.string().min(1)).min(1) });
-//#endregion
-export { allowedMethodsRestricterOptionsSchema };

package/dist/schemas/basicAuthOptionsSchema.js

@@ -1,12 +0,0 @@
-import { z } from "zod";
-//#region src/schemas/basicAuthOptionsSchema.ts
-const pathSchema = z.string().startsWith("/");
-const basicAuthOptionsSchema = z.strictObject({
-	exclude: z.array(pathSchema).optional(),
-	include: z.array(pathSchema).optional(),
-	message: z.string().optional(),
-	name: z.string().min(1),
-	pass: z.string().min(1)
-});
-//#endregion
-export { basicAuthOptionsSchema };

package/dist/schemas/contentSecurityPolicySchema.js

@@ -1,5 +0,0 @@
-import { z } from "zod";
-//#region src/schemas/contentSecurityPolicySchema.ts
-const contentSecurityPolicySchema = z.record(z.string().min(1), z.union([z.boolean(), z.array(z.string().min(1))]).optional());
-//#endregion
-export { contentSecurityPolicySchema };

package/dist/schemas/corsHandlerOptionsSchema.js

@@ -1,14 +0,0 @@
-import { z } from "zod";
-//#region src/schemas/corsHandlerOptionsSchema.ts
-const headerNameSchema = z.string().regex(/^[\w-]+$/u);
-const corsHandlerOptionsSchema = z.strictObject({
-	allowHeaders: z.array(headerNameSchema).optional(),
-	credentials: z.boolean().optional(),
-	exposeHeaders: z.array(headerNameSchema).optional(),
-	maxAge: z.string().regex(/^\d+$/u).optional(),
-	methods: z.array(z.string().min(1)).min(1),
-	origin: z.union([z.url(), z.array(z.url())]),
-	preflight: z.strictObject({ statusCode: z.int().min(200).max(299) }).optional()
-});
-//#endregion
-export { corsHandlerOptionsSchema };

package/dist/schemas/csrfOptionsSchema.js

@@ -1,9 +0,0 @@
-import { z } from "zod";
-//#region src/schemas/csrfOptionsSchema.ts
-const tokenNameSchema = z.string().regex(/^[\w-]+$/u, "must be letters, digits, underscores or hyphens");
-const csrfOptionsSchema = z.strictObject({
-	cookieName: tokenNameSchema,
-	headerName: tokenNameSchema
-});
-//#endregion
-export { csrfOptionsSchema };

package/dist/schemas/moduleOptionsSchema.js

@@ -1,29 +0,0 @@
-import { allowedMethodsRestricterOptionsSchema } from "./allowedMethodsRestricterOptionsSchema.js";
-import { basicAuthOptionsSchema } from "./basicAuthOptionsSchema.js";
-import { corsHandlerOptionsSchema } from "./corsHandlerOptionsSchema.js";
-import { csrfOptionsSchema } from "./csrfOptionsSchema.js";
-import { rateLimiterOptionsSchema } from "./rateLimiterOptionsSchema.js";
-import { requestSizeLimiterOptionsSchema } from "./requestSizeLimiterOptionsSchema.js";
-import { securityHeadersSchema } from "./securityHeadersSchema.js";
-import { ssgOptionsSchema } from "./ssgOptionsSchema.js";
-import { z } from "zod";
-//#region src/schemas/moduleOptionsSchema.ts
-const moduleOptionsSchema = z.strictObject({
-	allowedMethodsRestricter: z.union([allowedMethodsRestricterOptionsSchema, z.literal(false)]),
-	basicAuth: z.union([basicAuthOptionsSchema, z.literal(false)]),
-	contentSecurityPolicyReportOnly: z.boolean(),
-	corsHandler: z.union([corsHandlerOptionsSchema, z.literal(false)]),
-	csrf: z.union([csrfOptionsSchema, z.literal(false)]),
-	enabled: z.boolean(),
-	headers: z.union([securityHeadersSchema, z.literal(false)]),
-	hidePoweredBy: z.boolean(),
-	nonce: z.boolean(),
-	rateLimiter: z.union([rateLimiterOptionsSchema, z.literal(false)]),
-	removeLoggers: z.boolean(),
-	requestSizeLimiter: z.union([requestSizeLimiterOptionsSchema, z.literal(false)]),
-	sri: z.boolean(),
-	ssg: z.union([ssgOptionsSchema, z.literal(false)]),
-	strict: z.boolean()
-});
-//#endregion
-export { moduleOptionsSchema };

package/dist/schemas/permissionsPolicySchema.js

@@ -1,5 +0,0 @@
-import { z } from "zod";
-//#region src/schemas/permissionsPolicySchema.ts
-const permissionsPolicySchema = z.record(z.string().min(1), z.union([z.literal(false), z.array(z.string().min(1))]).optional());
-//#endregion
-export { permissionsPolicySchema };

package/dist/schemas/rateLimiterOptionsSchema.js

@@ -1,8 +0,0 @@
-import { z } from "zod";
-//#region src/schemas/rateLimiterOptionsSchema.ts
-const rateLimiterOptionsSchema = z.strictObject({
-	intervalInMilliseconds: z.int("must be a whole number of milliseconds").positive("must be more than zero milliseconds"),
-	tokensPerInterval: z.int("must be a whole number of requests").positive("must allow at least one request")
-});
-//#endregion
-export { rateLimiterOptionsSchema };

package/dist/schemas/requestSizeLimiterOptionsSchema.js

@@ -1,8 +0,0 @@
-import { z } from "zod";
-//#region src/schemas/requestSizeLimiterOptionsSchema.ts
-const requestSizeLimiterOptionsSchema = z.strictObject({
-	maxRequestSizeInBytes: z.int("must be a whole number of bytes").positive("must be more than zero bytes"),
-	maxUploadFileRequestInBytes: z.int("must be a whole number of bytes").positive("must be more than zero bytes")
-});
-//#endregion
-export { requestSizeLimiterOptionsSchema };

package/dist/schemas/securityHeadersSchema.js

@@ -1,25 +0,0 @@
-import { CrossOriginEmbedderPolicy } from "../models/CrossOriginEmbedderPolicy.js";
-import { XFrameOptions } from "../models/XFrameOptions.js";
-import { contentSecurityPolicySchema } from "./contentSecurityPolicySchema.js";
-import { permissionsPolicySchema } from "./permissionsPolicySchema.js";
-import { strictTransportSecurityOptionsSchema } from "./strictTransportSecurityOptionsSchema.js";
-import { z } from "zod";
-//#region src/schemas/securityHeadersSchema.ts
-const headerValueSchema = z.string().min(1);
-const securityHeadersSchema = z.strictObject({
-	contentSecurityPolicy: z.union([contentSecurityPolicySchema, z.literal(false)]).optional(),
-	crossOriginEmbedderPolicy: z.union([z.enum(CrossOriginEmbedderPolicy), z.literal(false)]).optional(),
-	crossOriginOpenerPolicy: z.union([headerValueSchema, z.literal(false)]).optional(),
-	crossOriginResourcePolicy: z.union([headerValueSchema, z.literal(false)]).optional(),
-	originAgentCluster: z.union([headerValueSchema, z.literal(false)]).optional(),
-	permissionsPolicy: z.union([permissionsPolicySchema, z.literal(false)]).optional(),
-	referrerPolicy: z.union([headerValueSchema, z.literal(false)]).optional(),
-	strictTransportSecurity: z.union([strictTransportSecurityOptionsSchema, z.literal(false)]).optional(),
-	xContentTypeOptions: z.union([headerValueSchema, z.literal(false)]).optional(),
-	xDNSPrefetchControl: z.union([headerValueSchema, z.literal(false)]).optional(),
-	xDownloadOptions: z.union([headerValueSchema, z.literal(false)]).optional(),
-	xFrameOptions: z.union([z.enum(XFrameOptions), z.literal(false)]).optional(),
-	xPermittedCrossDomainPolicies: z.union([headerValueSchema, z.literal(false)]).optional()
-});
-//#endregion
-export { securityHeadersSchema };

package/dist/schemas/ssgOptionsSchema.js

@@ -1,11 +0,0 @@
-import { z } from "zod";
-//#region src/schemas/ssgOptionsSchema.ts
-const ssgOptionsSchema = z.strictObject({
-	exportToPresets: z.boolean(),
-	hashScripts: z.boolean(),
-	hashStyles: z.boolean(),
-	meta: z.boolean(),
-	nitroHeaders: z.boolean()
-});
-//#endregion
-export { ssgOptionsSchema };

package/dist/schemas/strictTransportSecurityOptionsSchema.js

@@ -1,9 +0,0 @@
-import { z } from "zod";
-//#region src/schemas/strictTransportSecurityOptionsSchema.ts
-const strictTransportSecurityOptionsSchema = z.strictObject({
-	includeSubdomains: z.boolean(),
-	maxAge: z.int().nonnegative(),
-	preload: z.boolean()
-});
-//#endregion
-export { strictTransportSecurityOptionsSchema };

package/dist/services/computeSubresourceIntegrityHashes.js

@@ -1,29 +0,0 @@
-import { SRI_HASH_ALGORITHM } from "../runtime/constants.js";
-import { generateHash } from "../runtime/services/generateHash.js";
-import { existsSync } from "node:fs";
-import { readFile, readdir } from "node:fs/promises";
-import { join, posix, relative, sep } from "node:path";
-//#region src/services/computeSubresourceIntegrityHashes.ts
-const computeSubresourceIntegrityHashes = async (nitro) => {
-	const { baseURL: appBaseUrl, cdnURL: appCdnUrl } = nitro.options.runtimeConfig.app;
-	const existingPublicAssets = nitro.options.publicAssets.filter(({ dir: directory }) => existsSync(directory));
-	const filesByPublicAsset = await Promise.all(existingPublicAssets.map(async ({ baseURL = "", dir: directory }) => {
-		return (await readdir(directory, {
-			recursive: true,
-			withFileTypes: true
-		})).filter((entry) => entry.isFile()).map((entry) => {
-			const filePath = join(entry.parentPath, entry.name);
-			return {
-				filePath,
-				fullPath: posix.join(baseURL, ...relative(directory, filePath).split(sep))
-			};
-		});
-	}));
-	const hashEntries = await Promise.all(filesByPublicAsset.flat().map(async ({ filePath, fullPath }) => {
-		const hash = await generateHash(await readFile(filePath), SRI_HASH_ALGORITHM);
-		return [appCdnUrl ? new URL(posix.isAbsolute(fullPath) ? fullPath.slice(1) : fullPath, appCdnUrl.endsWith("/") ? appCdnUrl : `${appCdnUrl}/`).href : posix.join("/", appBaseUrl, fullPath), hash];
-	}));
-	return Object.fromEntries(hashEntries);
-};
-//#endregion
-export { computeSubresourceIntegrityHashes };

package/dist/services/formatZodIssues.js

@@ -1,16 +0,0 @@
-//#region src/services/formatZodIssues.ts
-const getDeepestPathLength = (leafIssues) => Math.max(-1, ...leafIssues.map(({ path }) => path.length));
-const getLeafIssues = (issue, parentPath) => {
-	const path = [...parentPath, ...issue.path];
-	if (issue.code !== "invalid_union") return [{
-		issue,
-		path
-	}];
-	return issue.errors.map((branch) => branch.flatMap((branchIssue) => getLeafIssues(branchIssue, path))).reduce((deepest, branch) => getDeepestPathLength(branch) > getDeepestPathLength(deepest) ? branch : deepest);
-};
-const formatLeafIssue = ({ issue, path }) => {
-	return `${path.map(String).join(".") || "(options)"}: ${issue.message}`;
-};
-const formatZodIssues = (issues) => issues.flatMap((issue) => getLeafIssues(issue, [])).map((leafIssue) => formatLeafIssue(leafIssue)).join("; ");
-//#endregion
-export { formatZodIssues };

package/dist/services/getDefaultModuleOptions.js

@@ -1,41 +0,0 @@
-import { getDefaultSecurityHeaders } from "./getDefaultSecurityHeaders.js";
-//#region src/services/getDefaultModuleOptions.ts
-const getDefaultModuleOptions = (isDevelopment, devServerUrl, isStrict) => ({
-	allowedMethodsRestricter: false,
-	basicAuth: false,
-	contentSecurityPolicyReportOnly: false,
-	corsHandler: {
-		methods: [
-			"GET",
-			"HEAD",
-			"PUT",
-			"PATCH",
-			"POST",
-			"DELETE"
-		],
-		origin: devServerUrl,
-		preflight: { statusCode: 204 }
-	},
-	csrf: false,
-	enabled: true,
-	headers: getDefaultSecurityHeaders(isDevelopment, isStrict),
-	hidePoweredBy: true,
-	nonce: true,
-	rateLimiter: false,
-	removeLoggers: false,
-	requestSizeLimiter: {
-		maxRequestSizeInBytes: 2e6,
-		maxUploadFileRequestInBytes: 8e6
-	},
-	sri: true,
-	ssg: {
-		exportToPresets: true,
-		hashScripts: true,
-		hashStyles: false,
-		meta: true,
-		nitroHeaders: true
-	},
-	strict: isStrict
-});
-//#endregion
-export { getDefaultModuleOptions };

package/dist/services/getDefaultSecurityHeaders.js

@@ -1,85 +0,0 @@
-import { NONCE_PLACEHOLDER } from "../runtime/constants.js";
-import { CrossOriginEmbedderPolicy } from "../models/CrossOriginEmbedderPolicy.js";
-import { XFrameOptions } from "../models/XFrameOptions.js";
-//#region src/services/getDefaultSecurityHeaders.ts
-const getDefaultSecurityHeaders = (isDevelopment, isStrict) => ({
-	contentSecurityPolicy: {
-		"base-uri": ["'none'"],
-		"default-src": ["'self'"],
-		"font-src": [
-			"'self'",
-			"https:",
-			"data:"
-		],
-		"form-action": ["'self'"],
-		"frame-ancestors": ["'self'"],
-		"img-src": ["'self'", "data:"],
-		"object-src": ["'none'"],
-		"script-src": isStrict ? [
-			"'self'",
-			"'strict-dynamic'",
-			NONCE_PLACEHOLDER
-		] : [
-			"'self'",
-			"https:",
-			"'unsafe-inline'",
-			"'strict-dynamic'",
-			NONCE_PLACEHOLDER
-		],
-		"script-src-attr": ["'none'"],
-		"style-src": [
-			"'self'",
-			"https:",
-			"'unsafe-inline'"
-		],
-		"upgrade-insecure-requests": true
-	},
-	crossOriginEmbedderPolicy: isDevelopment ? CrossOriginEmbedderPolicy.UnsafeNone : CrossOriginEmbedderPolicy.Credentialless,
-	crossOriginOpenerPolicy: "same-origin",
-	crossOriginResourcePolicy: "same-origin",
-	originAgentCluster: "?1",
-	permissionsPolicy: {
-		accelerometer: [],
-		autoplay: [],
-		camera: [],
-		"clipboard-read": [],
-		"clipboard-write": [],
-		"cross-origin-isolated": [],
-		"display-capture": [],
-		"encrypted-media": [],
-		fullscreen: [],
-		gamepad: [],
-		geolocation: [],
-		gyroscope: [],
-		hid: [],
-		"idle-detection": [],
-		"interest-cohort": [],
-		"keyboard-map": [],
-		magnetometer: [],
-		microphone: [],
-		midi: [],
-		payment: [],
-		"picture-in-picture": [],
-		"publickey-credentials-get": [],
-		"screen-wake-lock": [],
-		serial: [],
-		"sync-xhr": ["self"],
-		unload: [],
-		usb: [],
-		"web-share": [],
-		"xr-spatial-tracking": []
-	},
-	referrerPolicy: "no-referrer",
-	strictTransportSecurity: {
-		includeSubdomains: true,
-		maxAge: 63072e3,
-		preload: false
-	},
-	xContentTypeOptions: "nosniff",
-	xDNSPrefetchControl: "off",
-	xDownloadOptions: "noopen",
-	xFrameOptions: XFrameOptions.SameOrigin,
-	xPermittedCrossDomainPolicies: "none"
-});
-//#endregion
-export { getDefaultSecurityHeaders };

package/dist/services/getPluginTemplate.js

@@ -1,10 +0,0 @@
-//#region src/services/getPluginTemplate.ts
-const getPluginTemplate = (factoryPath, factoryName, dataPath) => [
-	`import { ${factoryName} } from ${JSON.stringify(factoryPath)};`,
-	`import data from ${JSON.stringify(dataPath)};`,
-	"",
-	`export default ${factoryName}(data);`,
-	""
-].join("\n");
-//#endregion
-export { getPluginTemplate };

package/dist/services/getRemoveLoggersViteConfig.js

@@ -1,4 +0,0 @@
-//#region src/services/getRemoveLoggersViteConfig.ts
-const getRemoveLoggersViteConfig = () => ({ build: { rolldownOptions: { output: { minify: { compress: { dropConsole: true } } } } } });
-//#endregion
-export { getRemoveLoggersViteConfig };

package/dist/services/getRouteRulesTemplate.js

@@ -1,4 +0,0 @@
-//#region src/services/getRouteRulesTemplate.ts
-const getRouteRulesTemplate = (routes) => `export default ${JSON.stringify(routes)}\n`;
-//#endregion
-export { getRouteRulesTemplate };

package/dist/services/getRouteSecurityRules.js

@@ -1,17 +0,0 @@
-import { moduleOptionsSchema } from "../schemas/moduleOptionsSchema.js";
-import { formatZodIssues } from "./formatZodIssues.js";
-import { mergeModuleOptions } from "./mergeModuleOptions.js";
-//#region src/services/getRouteSecurityRules.ts
-const getRouteSecurityRules = (routeRules, options) => {
-	const routeSecurityRules = {};
-	for (const [route, { security }] of Object.entries(routeRules)) {
-		if (security === void 0) continue;
-		if (Object.hasOwn(security, "basicAuth")) throw new TypeError(`nuxt-security-module: route ${route}: basicAuth cannot be set in a route rule`);
-		const result = moduleOptionsSchema.safeParse(mergeModuleOptions(options, security));
-		if (!result.success) throw new TypeError(`nuxt-security-module: route ${route}: ${formatZodIssues(result.error.issues)}`);
-		routeSecurityRules[route] = security;
-	}
-	return routeSecurityRules;
-};
-//#endregion
-export { getRouteSecurityRules };

package/dist/services/getStaticResourceHeaders.js

@@ -1,12 +0,0 @@
-import { serializeSecurityHeaders } from "../runtime/services/serializeSecurityHeaders.js";
-//#region src/services/getStaticResourceHeaders.ts
-const getStaticResourceHeaders = (headers) => serializeSecurityHeaders({
-	referrerPolicy: headers.referrerPolicy,
-	strictTransportSecurity: headers.strictTransportSecurity,
-	xContentTypeOptions: headers.xContentTypeOptions,
-	xDownloadOptions: headers.xDownloadOptions,
-	xFrameOptions: headers.xFrameOptions,
-	xPermittedCrossDomainPolicies: headers.xPermittedCrossDomainPolicies
-});
-//#endregion
-export { getStaticResourceHeaders };

package/dist/services/getTypeTemplate.js

@@ -1,25 +0,0 @@
-import { MODULE_NAME, ROUTE_RULES_HOOK } from "../runtime/constants.js";
-//#region src/services/getTypeTemplate.ts
-const getTypeTemplate = () => `// Generated by ${MODULE_NAME}
-import type { ModuleOptions } from '${MODULE_NAME}'
-
-declare module '#${MODULE_NAME}/route-rules.mjs' {
-  const routeRules: Record<string, Partial<ModuleOptions>>
-  export default routeRules
-}
-
-declare module '#${MODULE_NAME}/sri-hashes.mjs' {
-  const sriHashes: Record<string, string>
-  export default sriHashes
-}
-
-declare module 'nitro/types' {
-  interface NitroRuntimeHooks {
-    '${ROUTE_RULES_HOOK}': (routeRules: Record<string, Partial<ModuleOptions>>) => void | Promise<void>
-  }
-}
-
-export {}
-`;
-//#endregion
-export { getTypeTemplate };

package/dist/services/mergeModuleOptions.js

@@ -1,39 +0,0 @@
-//#region src/services/mergeModuleOptions.ts
-const mergeModuleOptions = (defaults, overrides) => ({
-	...defaults,
-	...overrides,
-	headers: mergeHeaders(defaults.headers, overrides.headers),
-	ssg: overrides.ssg === false ? false : {
-		...defaults.ssg,
-		...overrides.ssg
-	}
-});
-const mergeHeaders = (defaults, overrides) => {
-	if (overrides === false || defaults === false) return overrides ?? defaults;
-	if (overrides === void 0) return defaults;
-	return {
-		...defaults,
-		...overrides,
-		contentSecurityPolicy: mergeDirectives(defaults.contentSecurityPolicy, overrides.contentSecurityPolicy),
-		permissionsPolicy: mergeFeatures(defaults.permissionsPolicy, overrides.permissionsPolicy)
-	};
-};
-const mergeDirectives = (defaults, overrides) => {
-	if (overrides === false || defaults === false) return overrides ?? defaults;
-	if (overrides === void 0) return defaults;
-	const merged = { ...defaults };
-	for (const [directive, value] of Object.entries(overrides)) if (value === false) delete merged[directive];
-	else if (Array.isArray(value)) merged[directive] = [.../* @__PURE__ */ new Set([...Array.isArray(merged[directive]) ? merged[directive] : [], ...value])];
-	else merged[directive] = value;
-	return merged;
-};
-const mergeFeatures = (defaults, overrides) => {
-	if (overrides === false || defaults === false) return overrides ?? defaults;
-	if (overrides === void 0) return defaults;
-	const merged = { ...defaults };
-	for (const [feature, sources] of Object.entries(overrides)) if (sources === false) delete merged[feature];
-	else merged[feature] = [.../* @__PURE__ */ new Set([...merged[feature] || [], ...sources || []])];
-	return merged;
-};
-//#endregion
-export { mergeModuleOptions };

package/dist/services/parseModuleOptions.js

@@ -1,10 +0,0 @@
-import { moduleOptionsSchema } from "../schemas/moduleOptionsSchema.js";
-import { formatZodIssues } from "./formatZodIssues.js";
-//#region src/services/parseModuleOptions.ts
-const parseModuleOptions = (options) => {
-	const result = moduleOptionsSchema.safeParse(options);
-	if (!result.success) throw new TypeError(`nuxt-security-module: ${formatZodIssues(result.error.issues)}`);
-	return result.data;
-};
-//#endregion
-export { parseModuleOptions };