nuxt-security-module 4.2.0 → 4.3.1

package/dist/runtime/services/readHtmlTagAttribute.js

@@ -0,0 +1,8 @@
+import { HTML_ATTRIBUTE_REGEX } from "../constants.js";
+//#region src/runtime/services/readHtmlTagAttribute.ts
+const readHtmlTagAttribute = (attributes, attributeName) => {
+	for (const [, name, , value] of attributes.matchAll(HTML_ATTRIBUTE_REGEX)) if (name?.toLowerCase() === attributeName) return unquote(value ?? "");
+};
+const unquote = (value) => value.replace(/^(?<quote>["'])(?<inner>.*)\k<quote>$/su, "$<inner>");
+//#endregion
+export { readHtmlTagAttribute };

package/dist/runtime/services/rewriteHtmlTags.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/rewriteHtmlTags.d.ts
+export declare const rewriteHtmlTags: (html: string, rewriteAttributes: (tagName: string, attributes: string) => string | undefined) => string;
+//#endregion

package/dist/runtime/services/rewriteHtmlTags.js

@@ -0,0 +1,9 @@
+import { HTML_TAG_REGEX } from "../constants.js";
+//#region src/runtime/services/rewriteHtmlTags.ts
+const rewriteHtmlTags = (html, rewriteAttributes) => html.replace(HTML_TAG_REGEX, (match, elementName, elementAttributes, elementTrailer, body, tagName, tagAttributes, tagTrailer) => {
+	if (elementName) return `<${elementName}${rewriteAttributes(elementName, elementAttributes ?? "") ?? elementAttributes}${elementTrailer}>${body}</${elementName}>`;
+	const attributes = rewriteAttributes(tagName ?? "", tagAttributes ?? "");
+	return attributes === void 0 ? match : `<${tagName}${attributes}${tagTrailer}>`;
+});
+//#endregion
+export { rewriteHtmlTags };

package/dist/runtime/services/securityRouteMatcher.d.ts

@@ -0,0 +1,5 @@
+import { SecurityRules } from "../../models/SecurityRules.js";
+//#region src/runtime/services/securityRouteMatcher.d.ts
+export declare const setSecurityRouteMatcher: (routes: Record<string, SecurityRules>) => void;
+export declare const findSecurityRules: (pathname: string) => SecurityRules[] | undefined;
+//#endregion

package/dist/runtime/services/securityRouteMatcher.js

@@ -0,0 +1,11 @@
+import { addRoute, createRouter, findAllRoutes } from "rou3";
+//#region src/runtime/services/securityRouteMatcher.ts
+let securityRouter;
+const setSecurityRouteMatcher = (routes) => {
+	const router = createRouter();
+	for (const [pattern, rules] of Object.entries(routes)) addRoute(router, "", pattern, rules);
+	securityRouter = router;
+};
+const findSecurityRules = (pathname) => securityRouter && findAllRoutes(securityRouter, "", pathname).flatMap(({ data }) => data ? [data] : []);
+//#endregion
+export { findSecurityRules, setSecurityRouteMatcher };

package/dist/runtime/services/serializeBasicAuthChallenge.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/serializeBasicAuthChallenge.d.ts
+export declare const serializeBasicAuthChallenge: (realm: string) => string;
+//#endregion

package/dist/runtime/services/serializeBasicAuthChallenge.js

@@ -0,0 +1,4 @@
+//#region src/runtime/services/serializeBasicAuthChallenge.ts
+const serializeBasicAuthChallenge = (realm) => `Basic realm="${realm.replaceAll(/["\\]/gu, String.raw`\$&`)}"`;
+//#endregion
+export { serializeBasicAuthChallenge };

package/dist/runtime/services/serializeContentSecurityPolicy.d.ts

@@ -0,0 +1,4 @@
+import { ContentSecurityPolicy } from "../../models/ContentSecurityPolicy.js";
+//#region src/runtime/services/serializeContentSecurityPolicy.d.ts
+export declare const serializeContentSecurityPolicy: (policy: ContentSecurityPolicy) => string;
+//#endregion

package/dist/runtime/services/serializeContentSecurityPolicy.js

@@ -0,0 +1,7 @@
+//#region src/runtime/services/serializeContentSecurityPolicy.ts
+const serializeContentSecurityPolicy = (policy) => Object.entries(policy).filter(([, value]) => value !== false).map(([directive, value]) => {
+	if (directive === "upgrade-insecure-requests") return "upgrade-insecure-requests;";
+	return `${directive} ${Array.isArray(value) ? value.map((source) => source.trim()).join(" ") : ""};`;
+}).join(" ");
+//#endregion
+export { serializeContentSecurityPolicy };

package/dist/runtime/services/serializePermissionsPolicy.d.ts

@@ -0,0 +1,4 @@
+import { PermissionsPolicy } from "../../models/PermissionsPolicy.js";
+//#region src/runtime/services/serializePermissionsPolicy.d.ts
+export declare const serializePermissionsPolicy: (policy: PermissionsPolicy) => string;
+//#endregion

package/dist/runtime/services/serializePermissionsPolicy.js

@@ -0,0 +1,4 @@
+//#region src/runtime/services/serializePermissionsPolicy.ts
+const serializePermissionsPolicy = (policy) => Object.entries(policy).flatMap(([feature, sources]) => sources === false ? [] : [`${feature}=(${(sources ?? []).join(" ")})`]).join(", ");
+//#endregion
+export { serializePermissionsPolicy };

package/dist/runtime/services/serializeSecurityHeaders.d.ts

@@ -0,0 +1,4 @@
+import { SecurityHeaders } from "../../models/SecurityHeaders.js";
+//#region src/runtime/services/serializeSecurityHeaders.d.ts
+export declare const serializeSecurityHeaders: (headers: SecurityHeaders) => Record<string, string>;
+//#endregion

package/dist/runtime/services/serializeSecurityHeaders.js

@@ -0,0 +1,19 @@
+import { SECURITY_HEADER_NAMES } from "../constants.js";
+import { serializeContentSecurityPolicy } from "./serializeContentSecurityPolicy.js";
+import { serializePermissionsPolicy } from "./serializePermissionsPolicy.js";
+import { serializeStrictTransportSecurity } from "./serializeStrictTransportSecurity.js";
+//#region src/runtime/services/serializeSecurityHeaders.ts
+const checkIsSecurityHeaderKey = (key) => Object.hasOwn(SECURITY_HEADER_NAMES, key);
+const serializeSecurityHeaders = (headers) => Object.fromEntries(Object.keys(headers).flatMap((key) => {
+	if (!checkIsSecurityHeaderKey(key)) return [];
+	const value = headers[key];
+	return value === false || value === void 0 ? [] : [[SECURITY_HEADER_NAMES[key], serializeValue(key, value)]];
+}));
+const serializeValue = (key, value) => {
+	if (key === "contentSecurityPolicy") return serializeContentSecurityPolicy(value);
+	if (key === "permissionsPolicy") return serializePermissionsPolicy(value);
+	if (key === "strictTransportSecurity") return serializeStrictTransportSecurity(value);
+	return String(value);
+};
+//#endregion
+export { serializeSecurityHeaders };

package/dist/runtime/services/serializeStrictTransportSecurity.d.ts

@@ -0,0 +1,4 @@
+import { StrictTransportSecurity } from "../../models/StrictTransportSecurity.js";
+//#region src/runtime/services/serializeStrictTransportSecurity.d.ts
+export declare const serializeStrictTransportSecurity: (policy: StrictTransportSecurity) => string;
+//#endregion

package/dist/runtime/services/serializeStrictTransportSecurity.js

@@ -0,0 +1,8 @@
+//#region src/runtime/services/serializeStrictTransportSecurity.ts
+const serializeStrictTransportSecurity = (policy) => [
+	`max-age=${policy.maxAge}`,
+	policy.includeSubdomains && "includeSubDomains",
+	policy.preload && "preload"
+].filter(Boolean).join("; ");
+//#endregion
+export { serializeStrictTransportSecurity };

package/dist/runtime/services/stripHtmlTagAttribute.d.ts

@@ -0,0 +1,3 @@
+//#region src/runtime/services/stripHtmlTagAttribute.d.ts
+export declare const stripHtmlTagAttribute: (attributes: string, attributeName: string) => string;
+//#endregion

package/dist/runtime/services/stripHtmlTagAttribute.js

@@ -0,0 +1,5 @@
+import { HTML_ATTRIBUTE_REGEX } from "../constants.js";
+//#region src/runtime/services/stripHtmlTagAttribute.ts
+const stripHtmlTagAttribute = (attributes, attributeName) => attributes.replace(HTML_ATTRIBUTE_REGEX, (token, name) => name.toLowerCase() === attributeName ? "" : token);
+//#endregion
+export { stripHtmlTagAttribute };

package/dist/runtime/services/updateContentSecurityPolicy.d.ts

@@ -0,0 +1,5 @@
+import { ContentSecurityPolicy } from "../../models/ContentSecurityPolicy.js";
+import { SecurityState } from "./getSecurityState.js";
+//#region src/runtime/services/updateContentSecurityPolicy.d.ts
+export declare const updateContentSecurityPolicy: (policy: ContentSecurityPolicy, { hashes, nonce }: SecurityState) => ContentSecurityPolicy;
+//#endregion

package/dist/runtime/services/updateContentSecurityPolicy.js

@@ -0,0 +1,15 @@
+import { NONCE_PLACEHOLDER } from "../constants.js";
+//#region src/runtime/services/updateContentSecurityPolicy.ts
+const SCRIPT_DIRECTIVES = /* @__PURE__ */ new Set(["script-src", "script-src-elem"]);
+const STYLE_DIRECTIVES = /* @__PURE__ */ new Set(["style-src", "style-src-elem"]);
+const updateContentSecurityPolicy = (policy, { hashes, nonce }) => Object.fromEntries(Object.keys(policy).map((directive) => {
+	const value = policy[directive];
+	if (!Array.isArray(value)) return [directive, value];
+	const sources = value.filter((source) => !checkIsStaticNonce(source)).map((source) => source === "'nonce-{{nonce}}'" && nonce ? `'nonce-${nonce}'` : source).filter((source) => source !== NONCE_PLACEHOLDER);
+	if (SCRIPT_DIRECTIVES.has(directive)) sources.push(...hashes.script);
+	if (STYLE_DIRECTIVES.has(directive)) sources.push(...hashes.style);
+	return [directive, sources];
+}));
+const checkIsStaticNonce = (source) => source.startsWith("'nonce-") && source !== "'nonce-{{nonce}}'";
+//#endregion
+export { updateContentSecurityPolicy };

package/dist/schemas/allowedMethodsRestricterOptionsSchema.js

@@ -0,0 +1,5 @@
+import { z } from "zod";
+//#region src/schemas/allowedMethodsRestricterOptionsSchema.ts
+const allowedMethodsRestricterOptionsSchema = z.strictObject({ methods: z.array(z.string().min(1)).min(1) });
+//#endregion
+export { allowedMethodsRestricterOptionsSchema };

package/dist/schemas/basicAuthOptionsSchema.js

@@ -0,0 +1,12 @@
+import { z } from "zod";
+//#region src/schemas/basicAuthOptionsSchema.ts
+const pathSchema = z.string().startsWith("/");
+const basicAuthOptionsSchema = z.strictObject({
+	exclude: z.array(pathSchema).optional(),
+	include: z.array(pathSchema).optional(),
+	message: z.string().optional(),
+	name: z.string().min(1),
+	pass: z.string().min(1)
+});
+//#endregion
+export { basicAuthOptionsSchema };

package/dist/schemas/contentSecurityPolicySchema.js

@@ -0,0 +1,5 @@
+import { z } from "zod";
+//#region src/schemas/contentSecurityPolicySchema.ts
+const contentSecurityPolicySchema = z.record(z.string().min(1), z.union([z.boolean(), z.array(z.string().min(1))]).optional());
+//#endregion
+export { contentSecurityPolicySchema };

package/dist/schemas/corsHandlerOptionsSchema.js

@@ -0,0 +1,14 @@
+import { z } from "zod";
+//#region src/schemas/corsHandlerOptionsSchema.ts
+const headerNameSchema = z.string().regex(/^[\w-]+$/u);
+const corsHandlerOptionsSchema = z.strictObject({
+	allowHeaders: z.array(headerNameSchema).optional(),
+	credentials: z.boolean().optional(),
+	exposeHeaders: z.array(headerNameSchema).optional(),
+	maxAge: z.string().regex(/^\d+$/u).optional(),
+	methods: z.array(z.string().min(1)).min(1),
+	origin: z.union([z.url(), z.array(z.url())]),
+	preflight: z.strictObject({ statusCode: z.int().min(200).max(299) }).optional()
+});
+//#endregion
+export { corsHandlerOptionsSchema };

package/dist/schemas/csrfOptionsSchema.js

@@ -0,0 +1,9 @@
+import { z } from "zod";
+//#region src/schemas/csrfOptionsSchema.ts
+const tokenNameSchema = z.string().regex(/^[\w-]+$/u, "must be letters, digits, underscores or hyphens");
+const csrfOptionsSchema = z.strictObject({
+	cookieName: tokenNameSchema,
+	headerName: tokenNameSchema
+});
+//#endregion
+export { csrfOptionsSchema };

package/dist/schemas/moduleOptionsSchema.js

@@ -0,0 +1,29 @@
+import { allowedMethodsRestricterOptionsSchema } from "./allowedMethodsRestricterOptionsSchema.js";
+import { basicAuthOptionsSchema } from "./basicAuthOptionsSchema.js";
+import { corsHandlerOptionsSchema } from "./corsHandlerOptionsSchema.js";
+import { csrfOptionsSchema } from "./csrfOptionsSchema.js";
+import { rateLimiterOptionsSchema } from "./rateLimiterOptionsSchema.js";
+import { requestSizeLimiterOptionsSchema } from "./requestSizeLimiterOptionsSchema.js";
+import { securityHeadersSchema } from "./securityHeadersSchema.js";
+import { ssgOptionsSchema } from "./ssgOptionsSchema.js";
+import { z } from "zod";
+//#region src/schemas/moduleOptionsSchema.ts
+const moduleOptionsSchema = z.strictObject({
+	allowedMethodsRestricter: z.union([allowedMethodsRestricterOptionsSchema, z.literal(false)]),
+	basicAuth: z.union([basicAuthOptionsSchema, z.literal(false)]),
+	contentSecurityPolicyReportOnly: z.boolean(),
+	corsHandler: z.union([corsHandlerOptionsSchema, z.literal(false)]),
+	csrf: z.union([csrfOptionsSchema, z.literal(false)]),
+	enabled: z.boolean(),
+	headers: z.union([securityHeadersSchema, z.literal(false)]),
+	hidePoweredBy: z.boolean(),
+	nonce: z.boolean(),
+	rateLimiter: z.union([rateLimiterOptionsSchema, z.literal(false)]),
+	removeLoggers: z.boolean(),
+	requestSizeLimiter: z.union([requestSizeLimiterOptionsSchema, z.literal(false)]),
+	sri: z.boolean(),
+	ssg: z.union([ssgOptionsSchema, z.literal(false)]),
+	strict: z.boolean()
+});
+//#endregion
+export { moduleOptionsSchema };

package/dist/schemas/permissionsPolicySchema.js

@@ -0,0 +1,5 @@
+import { z } from "zod";
+//#region src/schemas/permissionsPolicySchema.ts
+const permissionsPolicySchema = z.record(z.string().min(1), z.union([z.literal(false), z.array(z.string().min(1))]).optional());
+//#endregion
+export { permissionsPolicySchema };

package/dist/schemas/rateLimiterOptionsSchema.js

@@ -0,0 +1,8 @@
+import { z } from "zod";
+//#region src/schemas/rateLimiterOptionsSchema.ts
+const rateLimiterOptionsSchema = z.strictObject({
+	intervalInMilliseconds: z.int("must be a whole number of milliseconds").positive("must be more than zero milliseconds"),
+	tokensPerInterval: z.int("must be a whole number of requests").positive("must allow at least one request")
+});
+//#endregion
+export { rateLimiterOptionsSchema };

package/dist/schemas/requestSizeLimiterOptionsSchema.js

@@ -0,0 +1,8 @@
+import { z } from "zod";
+//#region src/schemas/requestSizeLimiterOptionsSchema.ts
+const requestSizeLimiterOptionsSchema = z.strictObject({
+	maxRequestSizeInBytes: z.int("must be a whole number of bytes").positive("must be more than zero bytes"),
+	maxUploadFileRequestInBytes: z.int("must be a whole number of bytes").positive("must be more than zero bytes")
+});
+//#endregion
+export { requestSizeLimiterOptionsSchema };

package/dist/schemas/securityHeadersSchema.js

@@ -0,0 +1,25 @@
+import { CrossOriginEmbedderPolicy } from "../models/CrossOriginEmbedderPolicy.js";
+import { XFrameOptions } from "../models/XFrameOptions.js";
+import { contentSecurityPolicySchema } from "./contentSecurityPolicySchema.js";
+import { permissionsPolicySchema } from "./permissionsPolicySchema.js";
+import { strictTransportSecurityOptionsSchema } from "./strictTransportSecurityOptionsSchema.js";
+import { z } from "zod";
+//#region src/schemas/securityHeadersSchema.ts
+const headerValueSchema = z.string().min(1);
+const securityHeadersSchema = z.strictObject({
+	contentSecurityPolicy: z.union([contentSecurityPolicySchema, z.literal(false)]).optional(),
+	crossOriginEmbedderPolicy: z.union([z.enum(CrossOriginEmbedderPolicy), z.literal(false)]).optional(),
+	crossOriginOpenerPolicy: z.union([headerValueSchema, z.literal(false)]).optional(),
+	crossOriginResourcePolicy: z.union([headerValueSchema, z.literal(false)]).optional(),
+	originAgentCluster: z.union([headerValueSchema, z.literal(false)]).optional(),
+	permissionsPolicy: z.union([permissionsPolicySchema, z.literal(false)]).optional(),
+	referrerPolicy: z.union([headerValueSchema, z.literal(false)]).optional(),
+	strictTransportSecurity: z.union([strictTransportSecurityOptionsSchema, z.literal(false)]).optional(),
+	xContentTypeOptions: z.union([headerValueSchema, z.literal(false)]).optional(),
+	xDNSPrefetchControl: z.union([headerValueSchema, z.literal(false)]).optional(),
+	xDownloadOptions: z.union([headerValueSchema, z.literal(false)]).optional(),
+	xFrameOptions: z.union([z.enum(XFrameOptions), z.literal(false)]).optional(),
+	xPermittedCrossDomainPolicies: z.union([headerValueSchema, z.literal(false)]).optional()
+});
+//#endregion
+export { securityHeadersSchema };

package/dist/schemas/ssgOptionsSchema.js

@@ -0,0 +1,11 @@
+import { z } from "zod";
+//#region src/schemas/ssgOptionsSchema.ts
+const ssgOptionsSchema = z.strictObject({
+	exportToPresets: z.boolean(),
+	hashScripts: z.boolean(),
+	hashStyles: z.boolean(),
+	meta: z.boolean(),
+	nitroHeaders: z.boolean()
+});
+//#endregion
+export { ssgOptionsSchema };

package/dist/schemas/strictTransportSecurityOptionsSchema.js

@@ -0,0 +1,9 @@
+import { z } from "zod";
+//#region src/schemas/strictTransportSecurityOptionsSchema.ts
+const strictTransportSecurityOptionsSchema = z.strictObject({
+	includeSubdomains: z.boolean(),
+	maxAge: z.int().nonnegative(),
+	preload: z.boolean()
+});
+//#endregion
+export { strictTransportSecurityOptionsSchema };

package/dist/services/computeSubresourceIntegrityHashes.js

@@ -0,0 +1,29 @@
+import { SRI_HASH_ALGORITHM } from "../runtime/constants.js";
+import { generateHash } from "../runtime/services/generateHash.js";
+import { existsSync } from "node:fs";
+import { readFile, readdir } from "node:fs/promises";
+import { join, posix, relative, sep } from "node:path";
+//#region src/services/computeSubresourceIntegrityHashes.ts
+const computeSubresourceIntegrityHashes = async (nitro) => {
+	const { baseURL: appBaseUrl, cdnURL: appCdnUrl } = nitro.options.runtimeConfig.app;
+	const existingPublicAssets = nitro.options.publicAssets.filter(({ dir: directory }) => existsSync(directory));
+	const filesByPublicAsset = await Promise.all(existingPublicAssets.map(async ({ baseURL = "", dir: directory }) => {
+		return (await readdir(directory, {
+			recursive: true,
+			withFileTypes: true
+		})).filter((entry) => entry.isFile()).map((entry) => {
+			const filePath = join(entry.parentPath, entry.name);
+			return {
+				filePath,
+				fullPath: posix.join(baseURL, ...relative(directory, filePath).split(sep))
+			};
+		});
+	}));
+	const hashEntries = await Promise.all(filesByPublicAsset.flat().map(async ({ filePath, fullPath }) => {
+		const hash = await generateHash(await readFile(filePath), SRI_HASH_ALGORITHM);
+		return [appCdnUrl ? new URL(posix.isAbsolute(fullPath) ? fullPath.slice(1) : fullPath, appCdnUrl.endsWith("/") ? appCdnUrl : `${appCdnUrl}/`).href : posix.join("/", appBaseUrl, fullPath), hash];
+	}));
+	return Object.fromEntries(hashEntries);
+};
+//#endregion
+export { computeSubresourceIntegrityHashes };

package/dist/services/formatZodIssues.js

@@ -0,0 +1,16 @@
+//#region src/services/formatZodIssues.ts
+const getDeepestPathLength = (leafIssues) => Math.max(-1, ...leafIssues.map(({ path }) => path.length));
+const getLeafIssues = (issue, parentPath) => {
+	const path = [...parentPath, ...issue.path];
+	if (issue.code !== "invalid_union") return [{
+		issue,
+		path
+	}];
+	return issue.errors.map((branch) => branch.flatMap((branchIssue) => getLeafIssues(branchIssue, path))).reduce((deepest, branch) => getDeepestPathLength(branch) > getDeepestPathLength(deepest) ? branch : deepest);
+};
+const formatLeafIssue = ({ issue, path }) => {
+	return `${path.map(String).join(".") || "(options)"}: ${issue.message}`;
+};
+const formatZodIssues = (issues) => issues.flatMap((issue) => getLeafIssues(issue, [])).map((leafIssue) => formatLeafIssue(leafIssue)).join("; ");
+//#endregion
+export { formatZodIssues };

package/dist/services/getDefaultModuleOptions.js

@@ -0,0 +1,41 @@
+import { getDefaultSecurityHeaders } from "./getDefaultSecurityHeaders.js";
+//#region src/services/getDefaultModuleOptions.ts
+const getDefaultModuleOptions = (isDevelopment, devServerUrl, isStrict) => ({
+	allowedMethodsRestricter: false,
+	basicAuth: false,
+	contentSecurityPolicyReportOnly: false,
+	corsHandler: {
+		methods: [
+			"GET",
+			"HEAD",
+			"PUT",
+			"PATCH",
+			"POST",
+			"DELETE"
+		],
+		origin: devServerUrl,
+		preflight: { statusCode: 204 }
+	},
+	csrf: false,
+	enabled: true,
+	headers: getDefaultSecurityHeaders(isDevelopment, isStrict),
+	hidePoweredBy: true,
+	nonce: true,
+	rateLimiter: false,
+	removeLoggers: false,
+	requestSizeLimiter: {
+		maxRequestSizeInBytes: 2e6,
+		maxUploadFileRequestInBytes: 8e6
+	},
+	sri: true,
+	ssg: {
+		exportToPresets: true,
+		hashScripts: true,
+		hashStyles: false,
+		meta: true,
+		nitroHeaders: true
+	},
+	strict: isStrict
+});
+//#endregion
+export { getDefaultModuleOptions };

package/dist/services/getDefaultSecurityHeaders.js

@@ -0,0 +1,85 @@
+import { NONCE_PLACEHOLDER } from "../runtime/constants.js";
+import { CrossOriginEmbedderPolicy } from "../models/CrossOriginEmbedderPolicy.js";
+import { XFrameOptions } from "../models/XFrameOptions.js";
+//#region src/services/getDefaultSecurityHeaders.ts
+const getDefaultSecurityHeaders = (isDevelopment, isStrict) => ({
+	contentSecurityPolicy: {
+		"base-uri": ["'none'"],
+		"default-src": ["'self'"],
+		"font-src": [
+			"'self'",
+			"https:",
+			"data:"
+		],
+		"form-action": ["'self'"],
+		"frame-ancestors": ["'self'"],
+		"img-src": ["'self'", "data:"],
+		"object-src": ["'none'"],
+		"script-src": isStrict ? [
+			"'self'",
+			"'strict-dynamic'",
+			NONCE_PLACEHOLDER
+		] : [
+			"'self'",
+			"https:",
+			"'unsafe-inline'",
+			"'strict-dynamic'",
+			NONCE_PLACEHOLDER
+		],
+		"script-src-attr": ["'none'"],
+		"style-src": [
+			"'self'",
+			"https:",
+			"'unsafe-inline'"
+		],
+		"upgrade-insecure-requests": true
+	},
+	crossOriginEmbedderPolicy: isDevelopment ? CrossOriginEmbedderPolicy.UnsafeNone : CrossOriginEmbedderPolicy.Credentialless,
+	crossOriginOpenerPolicy: "same-origin",
+	crossOriginResourcePolicy: "same-origin",
+	originAgentCluster: "?1",
+	permissionsPolicy: {
+		accelerometer: [],
+		autoplay: [],
+		camera: [],
+		"clipboard-read": [],
+		"clipboard-write": [],
+		"cross-origin-isolated": [],
+		"display-capture": [],
+		"encrypted-media": [],
+		fullscreen: [],
+		gamepad: [],
+		geolocation: [],
+		gyroscope: [],
+		hid: [],
+		"idle-detection": [],
+		"interest-cohort": [],
+		"keyboard-map": [],
+		magnetometer: [],
+		microphone: [],
+		midi: [],
+		payment: [],
+		"picture-in-picture": [],
+		"publickey-credentials-get": [],
+		"screen-wake-lock": [],
+		serial: [],
+		"sync-xhr": ["self"],
+		unload: [],
+		usb: [],
+		"web-share": [],
+		"xr-spatial-tracking": []
+	},
+	referrerPolicy: "no-referrer",
+	strictTransportSecurity: {
+		includeSubdomains: true,
+		maxAge: 63072e3,
+		preload: false
+	},
+	xContentTypeOptions: "nosniff",
+	xDNSPrefetchControl: "off",
+	xDownloadOptions: "noopen",
+	xFrameOptions: XFrameOptions.SameOrigin,
+	xPermittedCrossDomainPolicies: "none"
+});
+//#endregion
+export { getDefaultSecurityHeaders };

package/dist/services/getPluginTemplate.js

@@ -0,0 +1,10 @@
+//#region src/services/getPluginTemplate.ts
+const getPluginTemplate = (factoryPath, factoryName, dataPath) => [
+	`import { ${factoryName} } from ${JSON.stringify(factoryPath)};`,
+	`import data from ${JSON.stringify(dataPath)};`,
+	"",
+	`export default ${factoryName}(data);`,
+	""
+].join("\n");
+//#endregion
+export { getPluginTemplate };

package/dist/services/getRemoveLoggersViteConfig.js

@@ -0,0 +1,4 @@
+//#region src/services/getRemoveLoggersViteConfig.ts
+const getRemoveLoggersViteConfig = () => ({ build: { rolldownOptions: { output: { minify: { compress: { dropConsole: true } } } } } });
+//#endregion
+export { getRemoveLoggersViteConfig };

package/dist/services/getRouteRulesTemplate.js

@@ -0,0 +1,4 @@
+//#region src/services/getRouteRulesTemplate.ts
+const getRouteRulesTemplate = (routes) => `export default ${JSON.stringify(routes)}\n`;
+//#endregion
+export { getRouteRulesTemplate };

package/dist/services/getRouteSecurityRules.js

@@ -0,0 +1,17 @@
+import { moduleOptionsSchema } from "../schemas/moduleOptionsSchema.js";
+import { formatZodIssues } from "./formatZodIssues.js";
+import { mergeModuleOptions } from "./mergeModuleOptions.js";
+//#region src/services/getRouteSecurityRules.ts
+const getRouteSecurityRules = (routeRules, options) => {
+	const routeSecurityRules = {};
+	for (const [route, { security }] of Object.entries(routeRules)) {
+		if (security === void 0) continue;
+		if (Object.hasOwn(security, "basicAuth")) throw new TypeError(`nuxt-security-module: route ${route}: basicAuth cannot be set in a route rule`);
+		const result = moduleOptionsSchema.safeParse(mergeModuleOptions(options, security));
+		if (!result.success) throw new TypeError(`nuxt-security-module: route ${route}: ${formatZodIssues(result.error.issues)}`);
+		routeSecurityRules[route] = security;
+	}
+	return routeSecurityRules;
+};
+//#endregion
+export { getRouteSecurityRules };

package/dist/services/getStaticResourceHeaders.js

@@ -0,0 +1,12 @@
+import { serializeSecurityHeaders } from "../runtime/services/serializeSecurityHeaders.js";
+//#region src/services/getStaticResourceHeaders.ts
+const getStaticResourceHeaders = (headers) => serializeSecurityHeaders({
+	referrerPolicy: headers.referrerPolicy,
+	strictTransportSecurity: headers.strictTransportSecurity,
+	xContentTypeOptions: headers.xContentTypeOptions,
+	xDownloadOptions: headers.xDownloadOptions,
+	xFrameOptions: headers.xFrameOptions,
+	xPermittedCrossDomainPolicies: headers.xPermittedCrossDomainPolicies
+});
+//#endregion
+export { getStaticResourceHeaders };

package/dist/services/getTypeTemplate.js

@@ -0,0 +1,25 @@
+import { MODULE_NAME, ROUTE_RULES_HOOK } from "../runtime/constants.js";
+//#region src/services/getTypeTemplate.ts
+const getTypeTemplate = () => `// Generated by ${MODULE_NAME}
+import type { ModuleOptions } from '${MODULE_NAME}'
+
+declare module '#${MODULE_NAME}/route-rules.mjs' {
+  const routeRules: Record<string, Partial<ModuleOptions>>
+  export default routeRules
+}
+
+declare module '#${MODULE_NAME}/sri-hashes.mjs' {
+  const sriHashes: Record<string, string>
+  export default sriHashes
+}
+
+declare module 'nitro/types' {
+  interface NitroRuntimeHooks {
+    '${ROUTE_RULES_HOOK}': (routeRules: Record<string, Partial<ModuleOptions>>) => void | Promise<void>
+  }
+}
+
+export {}
+`;
+//#endregion
+export { getTypeTemplate };

package/dist/services/mergeModuleOptions.js

@@ -0,0 +1,39 @@
+//#region src/services/mergeModuleOptions.ts
+const mergeModuleOptions = (defaults, overrides) => ({
+	...defaults,
+	...overrides,
+	headers: mergeHeaders(defaults.headers, overrides.headers),
+	ssg: overrides.ssg === false ? false : {
+		...defaults.ssg,
+		...overrides.ssg
+	}
+});
+const mergeHeaders = (defaults, overrides) => {
+	if (overrides === false || defaults === false) return overrides ?? defaults;
+	if (overrides === void 0) return defaults;
+	return {
+		...defaults,
+		...overrides,
+		contentSecurityPolicy: mergeDirectives(defaults.contentSecurityPolicy, overrides.contentSecurityPolicy),
+		permissionsPolicy: mergeFeatures(defaults.permissionsPolicy, overrides.permissionsPolicy)
+	};
+};
+const mergeDirectives = (defaults, overrides) => {
+	if (overrides === false || defaults === false) return overrides ?? defaults;
+	if (overrides === void 0) return defaults;
+	const merged = { ...defaults };
+	for (const [directive, value] of Object.entries(overrides)) if (value === false) delete merged[directive];
+	else if (Array.isArray(value)) merged[directive] = [.../* @__PURE__ */ new Set([...Array.isArray(merged[directive]) ? merged[directive] : [], ...value])];
+	else merged[directive] = value;
+	return merged;
+};
+const mergeFeatures = (defaults, overrides) => {
+	if (overrides === false || defaults === false) return overrides ?? defaults;
+	if (overrides === void 0) return defaults;
+	const merged = { ...defaults };
+	for (const [feature, sources] of Object.entries(overrides)) if (sources === false) delete merged[feature];
+	else merged[feature] = [.../* @__PURE__ */ new Set([...merged[feature] || [], ...sources || []])];
+	return merged;
+};
+//#endregion
+export { mergeModuleOptions };

package/dist/services/parseModuleOptions.js

@@ -0,0 +1,10 @@
+import { moduleOptionsSchema } from "../schemas/moduleOptionsSchema.js";
+import { formatZodIssues } from "./formatZodIssues.js";
+//#region src/services/parseModuleOptions.ts
+const parseModuleOptions = (options) => {
+	const result = moduleOptionsSchema.safeParse(options);
+	if (!result.success) throw new TypeError(`nuxt-security-module: ${formatZodIssues(result.error.issues)}`);
+	return result.data;
+};
+//#endregion
+export { parseModuleOptions };