nuxt-security-module 4.3.3 → 4.4.0

package/README.md

@@ -5,14 +5,15 @@
 [![NPM downloads][badge-npm-downloads]][url-npm]
 [![NPM Unpacked Size (with version)][badge-npm-unpacked-size]][url-npm]
 
-Nuxt security module for [Nitro 3](https://nitro.build) and h3 2. It sets security headers on rendered pages, a per-request nonce Content Security Policy with the nonce written onto the page's own tags, subresource integrity, a prerender policy as a `<meta>` element, the framework's `X-Powered-By` header removed, CORS, allowed methods, basic auth and a request size limit.
+A Nuxt security module for [Nitro 3](https://nitro.build) and h3 2 that sets security headers on rendered pages, a per-request nonce Content Security Policy, subresource integrity, CORS, allowed methods, basic auth and a request size limit.
 
-It replaces [nuxt-security](https://github.com/Baroshem/nuxt-security). Its upstream audit, every issue it was held to, and the defaults it ships are on the documentation page: [nuxt-security-module](https://github.com/Esposter/Esposter/blob/main/openspec/specs/nuxt-security-module/README.md).
+Design notes live in [the specs](https://github.com/Esposter/Esposter/tree/main/openspec/specs/nuxt-security-module).
 
 ## Table of Contents
 
 - 🚀 [Getting Started](#getting-started)
-- 📖 [Documentation](#documentation)
+- 🧩 [Key Exports](#key-exports)
+- 📝 [Usage](#usage)
 - ⚖️ [License](#license)
 
 ---
@@ -28,17 +29,31 @@ pnpm i nuxt-security-module
 export default defineNuxtConfig({ modules: ["nuxt-security-module"] });
 ```
 
-## <a name="documentation">📖 Documentation</a>
+## <a name="key-exports">🧩 Key Exports</a>
 
-We highly recommend you take a look at the [documentation](https://github.com/Esposter/Esposter/tree/main/openspec/specs/nuxt-security-module) to level up.
+| Export                   | Kind      | Purpose                                                                                                                  |
+| :----------------------- | :-------- | :----------------------------------------------------------------------------------------------------------------------- |
+| `createRouteRulesPlugin` | function  | Exported from `./runtime/nitro/plugins/routeRules`: the plugin that matches each request against the build's route rules |
+| `default`                | const     | The Nuxt module, set up from the `security` config key; each feature registers only when its option is on                |
+| `ModuleOptions`          | interface | The module's options, one key per feature, each on or off; the `security` config key takes a partial of them             |
+| `rateLimiter`            | const     | Default export of `./runtime/server/middleware/rateLimiter`: refuses a request with `429` once its key's window is spent |
 
-The module's option reference, its upstream audit and its defaults review live in the repository's [specs](https://github.com/Esposter/Esposter/tree/main/openspec/specs/nuxt-security-module). The package's status and the steps not yet built are in its `README.md` there.
+## <a name="usage">📝 Usage</a>
 
----
+```ts
+// nuxt.config.ts
+export default defineNuxtConfig({
+  modules: ["nuxt-security-module"],
+  security: {
+    // Refuses a client with 429 after 100 requests in each minute-long window
+    rateLimiter: { intervalInMilliseconds: 60000, tokensPerInterval: 100 },
+  },
+});
+```
 
 ## <a name="license">⚖️ License</a>
 
-Apache-2.0
+Licensed under [Apache-2.0][url-license].
 
 [badge-license]: https://img.shields.io/github/license/Esposter/Esposter.svg?color=blue
 [url-license]: https://github.com/Esposter/Esposter/blob/main/LICENSE

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-security-module",
-  "version": "4.3.3",
+  "version": "4.4.0",
   "description": "Nuxt security module for Nitro 3 and h3 2 — security headers, a per-request nonce Content Security Policy, subresource integrity, CORS, allowed methods, basic auth and a request size limit.",
   "license": "Apache-2.0",
   "author": "Jimmy Chen",
@@ -19,19 +19,8 @@
   },
   "exports": {
     ".": "./dist/index.js",
-    "./runtime/constants": "./dist/runtime/constants.js",
-    "./runtime/nitro/plugins/hidePoweredBy": "./dist/runtime/nitro/plugins/hidePoweredBy.js",
-    "./runtime/nitro/plugins/nonce": "./dist/runtime/nitro/plugins/nonce.js",
     "./runtime/nitro/plugins/routeRules": "./dist/runtime/nitro/plugins/routeRules.js",
-    "./runtime/nitro/plugins/securityHeaders": "./dist/runtime/nitro/plugins/securityHeaders.js",
-    "./runtime/nitro/plugins/ssgHashes": "./dist/runtime/nitro/plugins/ssgHashes.js",
-    "./runtime/nitro/plugins/subresourceIntegrity": "./dist/runtime/nitro/plugins/subresourceIntegrity.js",
-    "./runtime/server/middleware/allowedMethodsRestricter": "./dist/runtime/server/middleware/allowedMethodsRestricter.js",
-    "./runtime/server/middleware/basicAuth": "./dist/runtime/server/middleware/basicAuth.js",
-    "./runtime/server/middleware/corsHandler": "./dist/runtime/server/middleware/corsHandler.js",
-    "./runtime/server/middleware/csrf": "./dist/runtime/server/middleware/csrf.js",
     "./runtime/server/middleware/rateLimiter": "./dist/runtime/server/middleware/rateLimiter.js",
-    "./runtime/server/middleware/requestSizeLimiter": "./dist/runtime/server/middleware/requestSizeLimiter.js",
     "./package.json": "./package.json"
   },
   "scripts": {
@@ -40,7 +29,7 @@
     "lint": "eslint .",
     "lint:fix": "eslint --fix .",
     "test": "vitest",
-    "typecheck": "tsc"
+    "typecheck": "tsrs --fast"
   },
   "dependencies": {
     "@nuxt/kit": "npm:@nuxt/kit-nightly@5x",
@@ -50,16 +39,16 @@
     "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@esposter/configuration": "4.3.3",
-    "@esposter/shared-node": "4.3.3",
+    "@esposter/configuration": "4.4.0",
+    "@esposter/shared-node": "4.4.0",
     "@nuxt/nitro-server": "npm:@nuxt/nitro-server-nightly@5x",
-    "@types/node": "^26.6.5",
-    "h3": "^2.0.7",
-    "tsdown": "^0.23.1"
+    "@types/node": "^26.6.6",
+    "h3": "^2.0.8",
+    "tsdown": "0.23.2"
   },
   "peerDependencies": {
-    "nitro": "npm:nitro-nightly@3.0.1-20261018-005730-bb9894fe",
+    "nitro": "npm:nitro-nightly@latest",
     "nuxt": "npm:nuxt-nightly@5x"
   },
-  "gitHead": "955bbc130ad9b28877fd4ae8efc73a045141ce01"
+  "gitHead": "e1a416c4b91da69cc2aa259b50a4d656f204d272"
 }

package/dist/index.d.ts

@@ -1,15 +0,0 @@
-import { ModuleOptions } from "./models/ModuleOptions.js";
-import { SecurityRouteRules } from "./models/SecurityRouteRules.js";
-import { NuxtModule } from "@nuxt/schema";
-declare module "@nuxt/schema" {
-  interface NuxtConfig {
-    security?: Partial<ModuleOptions>;
-  }
-}
-declare module "h3/rules" {
-  interface RouteRuleConfig {
-    security?: SecurityRouteRules;
-  }
-}
-declare const securityModule: NuxtModule<Partial<ModuleOptions>>;
-export { type ModuleOptions, securityModule as default };

package/dist/index.js

@@ -1,104 +0,0 @@
-import { MODULE_NAME } from "./runtime/constants.js";
-import { checkIsRecord } from "./runtime/services/checkIsRecord.js";
-import { computeSubresourceIntegrityHashes } from "./services/computeSubresourceIntegrityHashes.js";
-import { getDefaultModuleOptions } from "./services/getDefaultModuleOptions.js";
-import { getPluginTemplate } from "./services/getPluginTemplate.js";
-import { getRemoveLoggersViteConfig } from "./services/getRemoveLoggersViteConfig.js";
-import { getRouteRulesTemplate } from "./services/getRouteRulesTemplate.js";
-import { mergeModuleOptions } from "./services/mergeModuleOptions.js";
-import { getRouteSecurityRules } from "./services/getRouteSecurityRules.js";
-import { getStaticResourceHeaders } from "./services/getStaticResourceHeaders.js";
-import { getTypeTemplate } from "./services/getTypeTemplate.js";
-import { parseModuleOptions } from "./services/parseModuleOptions.js";
-import { defu } from "defu";
-import { addNitroPlugin, addServerHandler, addServerTemplate, addTypeTemplate, createResolver, defineNuxtModule } from "@nuxt/kit";
-// src/module.ts
-const ROUTE_RULES_TEMPLATE_FILENAME = `#${MODULE_NAME}/route-rules.mjs`;
-const SRI_HASHES_TEMPLATE_FILENAME = `#${MODULE_NAME}/sri-hashes.mjs`;
-const ROUTE_RULES_PLUGIN_FILENAME = `#${MODULE_NAME}/route-rules-plugin.mjs`;
-const SRI_PLUGIN_FILENAME = `#${MODULE_NAME}/sri-plugin.mjs`;
-const securityModule = defineNuxtModule({
-	meta: {
-		compatibility: { nuxt: ">=5.0.0-0" },
-		configKey: "security",
-		name: MODULE_NAME
-	},
-	setup(userOptions, nuxt) {
-		const options = parseModuleOptions(mergeModuleOptions(getDefaultModuleOptions(nuxt.options.dev, nuxt.options.devServer.url, userOptions.strict === true), userOptions));
-		if (!options.enabled) return;
-		const resolver = createResolver(import.meta.url);
-		const { basicAuth, ...publicOptions } = options;
-		if (basicAuth) {
-			const { private: privateRuntimeConfig } = nuxt.options.runtimeConfig;
-			nuxt.options.runtimeConfig.private = defu(checkIsRecord(privateRuntimeConfig) ? privateRuntimeConfig : {}, { basicAuth });
-		}
-		const routeSecurityRules = getRouteSecurityRules(nuxt.options.routeRules ?? {}, options);
-		addServerTemplate({
-			filename: ROUTE_RULES_TEMPLATE_FILENAME,
-			getContents: () => getRouteRulesTemplate({
-				"/**": publicOptions,
-				...routeSecurityRules
-			})
-		});
-		addServerTemplate({
-			filename: ROUTE_RULES_PLUGIN_FILENAME,
-			getContents: () => getPluginTemplate(resolver.resolve("./runtime/nitro/plugins/routeRules"), "createRouteRulesPlugin", ROUTE_RULES_TEMPLATE_FILENAME)
-		});
-		addNitroPlugin(ROUTE_RULES_PLUGIN_FILENAME);
-		if (options.removeLoggers) nuxt.options.vite = defu(getRemoveLoggersViteConfig(), nuxt.options.vite);
-		if (options.headers) nuxt.options.routeRules = defu({ "/**": { headers: getStaticResourceHeaders(options.headers) } }, nuxt.options.routeRules);
-		if (options.nonce) addNitroPlugin(resolver.resolve("./runtime/nitro/plugins/nonce"));
-		if (options.sri) {
-			addServerTemplate({
-				filename: SRI_PLUGIN_FILENAME,
-				getContents: () => getPluginTemplate(resolver.resolve("./runtime/nitro/plugins/subresourceIntegrity"), "createSubresourceIntegrityPlugin", SRI_HASHES_TEMPLATE_FILENAME)
-			});
-			addNitroPlugin(SRI_PLUGIN_FILENAME);
-		}
-		if (options.ssg) addNitroPlugin(resolver.resolve("./runtime/nitro/plugins/ssgHashes"));
-		if (options.headers) addNitroPlugin(resolver.resolve("./runtime/nitro/plugins/securityHeaders"));
-		if (options.hidePoweredBy) addNitroPlugin(resolver.resolve("./runtime/nitro/plugins/hidePoweredBy"));
-		if (options.csrf) addServerHandler({
-			handler: resolver.resolve("./runtime/server/middleware/csrf"),
-			middleware: true
-		});
-		if (options.rateLimiter) addServerHandler({
-			handler: resolver.resolve("./runtime/server/middleware/rateLimiter"),
-			middleware: true
-		});
-		if (options.requestSizeLimiter) addServerHandler({
-			handler: resolver.resolve("./runtime/server/middleware/requestSizeLimiter"),
-			middleware: true
-		});
-		if (options.corsHandler) addServerHandler({
-			handler: resolver.resolve("./runtime/server/middleware/corsHandler"),
-			middleware: true
-		});
-		if (options.allowedMethodsRestricter) addServerHandler({
-			handler: resolver.resolve("./runtime/server/middleware/allowedMethodsRestricter"),
-			middleware: true
-		});
-		if (basicAuth) addServerHandler({
-			handler: resolver.resolve("./runtime/server/middleware/basicAuth"),
-			middleware: true
-		});
-		let sriHashes = {};
-		if (options.sri) {
-			addServerTemplate({
-				filename: SRI_HASHES_TEMPLATE_FILENAME,
-				getContents: () => `export default ${JSON.stringify(sriHashes)}\n`
-			});
-			nuxt.hook("nitro:build:before", async (nitro) => {
-				sriHashes = await computeSubresourceIntegrityHashes(nitro);
-			});
-		}
-		addTypeTemplate({
-			filename: `types/${MODULE_NAME}.d.ts`,
-			getContents: getTypeTemplate
-		}, {
-			nitro: true,
-			nuxt: true
-		});
-	}
-});
-export { securityModule as default };

package/dist/models/AllowedMethodsRestricterOptions.d.ts

@@ -1,3 +0,0 @@
-export interface AllowedMethodsRestricterOptions {
-  methods: string[];
-}

package/dist/models/BasicAuthOptions.d.ts

@@ -1,7 +0,0 @@
-export interface BasicAuthOptions {
-  exclude?: string[];
-  include?: string[];
-  message?: string;
-  name: string;
-  pass: string;
-}

package/dist/models/ContentSecurityPolicy.d.ts

@@ -1 +0,0 @@
-export type ContentSecurityPolicy = Record<string, boolean | string[] | undefined>;

package/dist/models/CorsHandlerOptions.d.ts

@@ -1,11 +0,0 @@
-export interface CorsHandlerOptions {
-  allowHeaders?: string[];
-  credentials?: boolean;
-  exposeHeaders?: string[];
-  maxAge?: string;
-  methods: string[];
-  origin: string | string[];
-  preflight?: {
-    statusCode: number;
-  };
-}

package/dist/models/CrossOriginEmbedderPolicy.d.ts

@@ -1,6 +0,0 @@
-export declare const CrossOriginEmbedderPolicy: {
-  readonly Credentialless: "credentialless";
-  readonly RequireCorp: "require-corp";
-  readonly UnsafeNone: "unsafe-none";
-};
-export type CrossOriginEmbedderPolicy = (typeof CrossOriginEmbedderPolicy)[keyof typeof CrossOriginEmbedderPolicy];

package/dist/models/CrossOriginEmbedderPolicy.js

@@ -1,7 +0,0 @@
-// src/models/CrossOriginEmbedderPolicy.ts
-const CrossOriginEmbedderPolicy = {
-	Credentialless: "credentialless",
-	RequireCorp: "require-corp",
-	UnsafeNone: "unsafe-none"
-};
-export { CrossOriginEmbedderPolicy };

package/dist/models/CsrfOptions.d.ts

@@ -1,4 +0,0 @@
-export interface CsrfOptions {
-  cookieName: string;
-  headerName: string;
-}

package/dist/models/ModuleOptions.d.ts

@@ -1,25 +0,0 @@
-import { AllowedMethodsRestricterOptions } from "./AllowedMethodsRestricterOptions.js";
-import { BasicAuthOptions } from "./BasicAuthOptions.js";
-import { CorsHandlerOptions } from "./CorsHandlerOptions.js";
-import { CsrfOptions } from "./CsrfOptions.js";
-import { RateLimiterOptions } from "./RateLimiterOptions.js";
-import { RequestSizeLimiterOptions } from "./RequestSizeLimiterOptions.js";
-import { SecurityHeaders } from "./SecurityHeaders.js";
-import { SsgOptions } from "./SsgOptions.js";
-export interface ModuleOptions {
-  allowedMethodsRestricter: AllowedMethodsRestricterOptions | false;
-  basicAuth: BasicAuthOptions | false;
-  contentSecurityPolicyReportOnly: boolean;
-  corsHandler: CorsHandlerOptions | false;
-  csrf: CsrfOptions | false;
-  enabled: boolean;
-  headers: false | SecurityHeaders;
-  hidePoweredBy: boolean;
-  nonce: boolean;
-  rateLimiter: false | RateLimiterOptions;
-  removeLoggers: boolean;
-  requestSizeLimiter: false | RequestSizeLimiterOptions;
-  sri: boolean;
-  ssg: false | SsgOptions;
-  strict: boolean;
-}

package/dist/models/PermissionsPolicy.d.ts

@@ -1 +0,0 @@
-export type PermissionsPolicy = Record<string, false | string[] | undefined>;

package/dist/models/RateLimitWindow.d.ts

@@ -1,4 +0,0 @@
-export interface RateLimitWindow {
-  count: number;
-  resetAt: number;
-}

package/dist/models/RateLimiterOptions.d.ts

@@ -1,4 +0,0 @@
-export interface RateLimiterOptions {
-  intervalInMilliseconds: number;
-  tokensPerInterval: number;
-}

package/dist/models/RateLimiterStore.d.ts

@@ -1,4 +0,0 @@
-import { RateLimitWindow } from "./RateLimitWindow.js";
-export interface RateLimiterStore {
-  increment: (key: string, intervalInMilliseconds: number) => Promise<RateLimitWindow>;
-}

package/dist/models/RequestSizeLimiterOptions.d.ts

@@ -1,4 +0,0 @@
-export interface RequestSizeLimiterOptions {
-  maxRequestSizeInBytes: number;
-  maxUploadFileRequestInBytes: number;
-}

package/dist/models/SecurityHeaders.d.ts

@@ -1,20 +0,0 @@
-import { ContentSecurityPolicy } from "./ContentSecurityPolicy.js";
-import { CrossOriginEmbedderPolicy } from "./CrossOriginEmbedderPolicy.js";
-import { PermissionsPolicy } from "./PermissionsPolicy.js";
-import { StrictTransportSecurity } from "./StrictTransportSecurity.js";
-import { XFrameOptions } from "./XFrameOptions.js";
-export interface SecurityHeaders {
-  contentSecurityPolicy?: ContentSecurityPolicy | false;
-  crossOriginEmbedderPolicy?: CrossOriginEmbedderPolicy | false;
-  crossOriginOpenerPolicy?: false | string;
-  crossOriginResourcePolicy?: false | string;
-  originAgentCluster?: false | string;
-  permissionsPolicy?: false | PermissionsPolicy;
-  referrerPolicy?: false | string;
-  strictTransportSecurity?: false | StrictTransportSecurity;
-  xContentTypeOptions?: false | string;
-  xDNSPrefetchControl?: false | string;
-  xDownloadOptions?: false | string;
-  xFrameOptions?: false | XFrameOptions;
-  xPermittedCrossDomainPolicies?: false | string;
-}

package/dist/models/SecurityRouteRules.d.ts

@@ -1,2 +0,0 @@
-import { ModuleOptions } from "./ModuleOptions.js";
-export type SecurityRouteRules = Partial<ModuleOptions>;

package/dist/models/SecurityRules.d.ts

@@ -1,2 +0,0 @@
-import { ModuleOptions } from "./ModuleOptions.js";
-export type SecurityRules = Partial<ModuleOptions>;

package/dist/models/SsgOptions.d.ts

@@ -1,7 +0,0 @@
-export interface SsgOptions {
-  exportToPresets: boolean;
-  hashScripts: boolean;
-  hashStyles: boolean;
-  meta: boolean;
-  nitroHeaders: boolean;
-}

package/dist/models/StrictTransportSecurity.d.ts

@@ -1,5 +0,0 @@
-export interface StrictTransportSecurity {
-  includeSubdomains: boolean;
-  maxAge: number;
-  preload: boolean;
-}

package/dist/models/XFrameOptions.d.ts

@@ -1,5 +0,0 @@
-export declare const XFrameOptions: {
-  readonly Deny: "DENY";
-  readonly SameOrigin: "SAMEORIGIN";
-};
-export type XFrameOptions = (typeof XFrameOptions)[keyof typeof XFrameOptions];

package/dist/models/XFrameOptions.js

@@ -1,6 +0,0 @@
-// src/models/XFrameOptions.ts
-const XFrameOptions = {
-	Deny: "DENY",
-	SameOrigin: "SAMEORIGIN"
-};
-export { XFrameOptions };

package/dist/runtime/constants.d.ts

@@ -1,22 +0,0 @@
-import { SecurityHeaders } from "../models/SecurityHeaders.js";
-export declare const MODULE_NAME = "nuxt-security-module";
-export declare const ROUTE_RULES_HOOK: `${typeof MODULE_NAME}:routeRules`;
-export declare const SECURITY_HEADER_NAMES: Readonly<Record<keyof SecurityHeaders, string>>;
-export declare const CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME = "Content-Security-Policy-Report-Only";
-export declare const MAX_RATE_LIMIT_ENTRIES = 1e4;
-export declare const UNKNOWN_CLIENT_KEY = "unknown";
-export declare const CSRF_UNSAFE_METHODS: readonly string[];
-export declare const CSRF_TOKEN_BYTE_LENGTH = 32;
-export declare const NONCE_BYTE_LENGTH = 18;
-export declare const NONCE_PLACEHOLDER = "'nonce-{{nonce}}'";
-export declare const SRI_HASH_ALGORITHM = "SHA-384";
-export declare const CSP_HASH_ALGORITHM = "SHA-256";
-export declare const PRERENDERED_HEADERS_DIRECTORY_NAME = "nuxt-security";
-export declare const PRERENDERED_HEADERS_FILE_NAME = "headers.json";
-export declare const HTML_ATTRIBUTE_REGEX: RegExp;
-export declare const HTML_TAG_REGEX: RegExp;
-export declare const NONCE_TAG_NAMES: readonly string[];
-export declare const FILE_UPLOAD_CONTENT_TYPE = "multipart/form-data";
-export declare const SIZE_LIMITED_METHODS: readonly string[];
-export declare const DEFAULT_BASIC_AUTH_REALM = "Please enter username and password";
-export declare const BASIC_AUTHORIZATION_SCHEME = "Basic";

package/dist/runtime/constants.js

@@ -1,51 +0,0 @@
-// src/runtime/constants.ts
-const MODULE_NAME = "nuxt-security-module";
-const ROUTE_RULES_HOOK = `${MODULE_NAME}:routeRules`;
-const SECURITY_HEADER_NAMES = {
-	contentSecurityPolicy: "Content-Security-Policy",
-	crossOriginEmbedderPolicy: "Cross-Origin-Embedder-Policy",
-	crossOriginOpenerPolicy: "Cross-Origin-Opener-Policy",
-	crossOriginResourcePolicy: "Cross-Origin-Resource-Policy",
-	originAgentCluster: "Origin-Agent-Cluster",
-	permissionsPolicy: "Permissions-Policy",
-	referrerPolicy: "Referrer-Policy",
-	strictTransportSecurity: "Strict-Transport-Security",
-	xContentTypeOptions: "X-Content-Type-Options",
-	xDNSPrefetchControl: "X-DNS-Prefetch-Control",
-	xDownloadOptions: "X-Download-Options",
-	xFrameOptions: "X-Frame-Options",
-	xPermittedCrossDomainPolicies: "X-Permitted-Cross-Domain-Policies"
-};
-const CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME = "Content-Security-Policy-Report-Only";
-const MAX_RATE_LIMIT_ENTRIES = 1e4;
-const UNKNOWN_CLIENT_KEY = "unknown";
-const CSRF_UNSAFE_METHODS = [
-	"DELETE",
-	"PATCH",
-	"POST",
-	"PUT"
-];
-const CSRF_TOKEN_BYTE_LENGTH = 32;
-const NONCE_BYTE_LENGTH = 18;
-const NONCE_PLACEHOLDER = "'nonce-{{nonce}}'";
-const SRI_HASH_ALGORITHM = "SHA-384";
-const CSP_HASH_ALGORITHM = "SHA-256";
-const PRERENDERED_HEADERS_DIRECTORY_NAME = "nuxt-security";
-const PRERENDERED_HEADERS_FILE_NAME = "headers.json";
-const HTML_ATTRIBUTE_PATTERN = String.raw`\s+[^\s"'<>/=]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s"'<>=]+))?`;
-const HTML_ATTRIBUTE_REGEX = /\s+(?<name>[^\s"'<>/=]+)(?<assignment>\s*=\s*(?<value>"[^"]*"|'[^']*'|[^\s"'<>=]+))?/gu;
-const HTML_TAG_REGEX = new RegExp(String.raw`<(script|style)\b((?:${HTML_ATTRIBUTE_PATTERN})*)(\s*\/?)>([\s\S]*?)<\/\1\s*>|<([a-z][\w:-]*)((?:${HTML_ATTRIBUTE_PATTERN})*)(\s*\/?)>`, "giu");
-const NONCE_TAG_NAMES = [
-	"link",
-	"script",
-	"style"
-];
-const FILE_UPLOAD_CONTENT_TYPE = "multipart/form-data";
-const SIZE_LIMITED_METHODS = [
-	"DELETE",
-	"POST",
-	"PUT"
-];
-const DEFAULT_BASIC_AUTH_REALM = "Please enter username and password";
-const BASIC_AUTHORIZATION_SCHEME = "Basic";
-export { BASIC_AUTHORIZATION_SCHEME, CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME, CSP_HASH_ALGORITHM, CSRF_TOKEN_BYTE_LENGTH, CSRF_UNSAFE_METHODS, DEFAULT_BASIC_AUTH_REALM, FILE_UPLOAD_CONTENT_TYPE, HTML_ATTRIBUTE_REGEX, HTML_TAG_REGEX, MAX_RATE_LIMIT_ENTRIES, MODULE_NAME, NONCE_BYTE_LENGTH, NONCE_PLACEHOLDER, NONCE_TAG_NAMES, PRERENDERED_HEADERS_DIRECTORY_NAME, PRERENDERED_HEADERS_FILE_NAME, ROUTE_RULES_HOOK, SECURITY_HEADER_NAMES, SIZE_LIMITED_METHODS, SRI_HASH_ALGORITHM, UNKNOWN_CLIENT_KEY };

package/dist/runtime/nitro/plugins/hidePoweredBy.d.ts

@@ -1,3 +0,0 @@
-import { NitroAppPlugin } from "nitro/types";
-declare const hidePoweredBy: NitroAppPlugin;
-export { hidePoweredBy as default };

package/dist/runtime/nitro/plugins/hidePoweredBy.js

@@ -1,12 +0,0 @@
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { definePlugin } from "nitro";
-import { isEvent } from "nitro/h3";
-// src/runtime/nitro/plugins/hidePoweredBy.ts
-const hidePoweredBy = definePlugin((nitroApp) => {
-	nitroApp.hooks.hook("response", (_response, event) => {
-		if (!isEvent(event)) return;
-		const rules = getSecurityRules(event);
-		if (rules?.enabled && rules.hidePoweredBy) event.res.headers.delete("x-powered-by");
-	});
-});
-export { hidePoweredBy as default };

package/dist/runtime/nitro/plugins/nonce.d.ts

@@ -1,3 +0,0 @@
-import { NitroAppPlugin } from "nitro/types";
-declare const noncePlugin: NitroAppPlugin;
-export { noncePlugin as default };

package/dist/runtime/nitro/plugins/nonce.js

@@ -1,26 +0,0 @@
-import { generateNonce } from "../../services/generateNonce.js";
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { getSecurityState } from "../../services/getSecurityState.js";
-import { injectNonce } from "../../services/injectNonce.js";
-import { definePlugin } from "nitro";
-// src/runtime/nitro/plugins/nonce.ts
-const HTML_SECTIONS = [
-	"body",
-	"bodyAppend",
-	"bodyPrepend",
-	"head"
-];
-const noncePlugin = definePlugin((nitroApp) => {
-	if (import.meta.prerender) return;
-	nitroApp.hooks.hook("render:route", (_context, { event }) => {
-		const rules = getSecurityRules(event);
-		if (rules?.enabled && rules.nonce) getSecurityState(event).nonce = generateNonce();
-	});
-	nitroApp.hooks.hook("render:html", (html, { event }) => {
-		const rules = getSecurityRules(event);
-		const nonce = getSecurityState(event).nonce;
-		if (!rules?.enabled || !rules.nonce || !rules.headers || !rules.headers.contentSecurityPolicy || !nonce) return;
-		for (const section of HTML_SECTIONS) html[section] = html[section].map((element) => injectNonce(element, nonce));
-	});
-});
-export { noncePlugin as default };

package/dist/runtime/nitro/plugins/routeRules.d.ts

@@ -1,3 +0,0 @@
-import { SecurityRules } from "../../../models/SecurityRules.js";
-import { NitroAppPlugin } from "nitro/types";
-export declare const createRouteRulesPlugin: (routeRules: Record<string, SecurityRules>) => NitroAppPlugin;

package/dist/runtime/nitro/plugins/routeRules.js

@@ -1,16 +0,0 @@
-import { ROUTE_RULES_HOOK } from "../../constants.js";
-import { setSecurityRouteMatcher } from "../../services/securityRouteMatcher.js";
-import { definePlugin } from "nitro";
-// src/runtime/nitro/plugins/routeRules.ts
-const createRouteRulesPlugin = (routeRules) => definePlugin((nitroApp) => {
-	let routesResolved;
-	nitroApp.hooks.hook("request", () => {
-		routesResolved ??= (async () => {
-			const routes = structuredClone(routeRules);
-			await nitroApp.hooks.callHook(ROUTE_RULES_HOOK, routes);
-			setSecurityRouteMatcher(routes);
-		})();
-		return routesResolved;
-	});
-});
-export { createRouteRulesPlugin };

package/dist/runtime/nitro/plugins/securityHeaders.d.ts

@@ -1,3 +0,0 @@
-import { NitroAppPlugin } from "nitro/types";
-declare const securityHeaders: NitroAppPlugin;
-export { securityHeaders as default };

package/dist/runtime/nitro/plugins/securityHeaders.js

@@ -1,24 +0,0 @@
-import { CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME, SECURITY_HEADER_NAMES } from "../../constants.js";
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { getSecurityState } from "../../services/getSecurityState.js";
-import { serializeSecurityHeaders } from "../../services/serializeSecurityHeaders.js";
-import { updateContentSecurityPolicy } from "../../services/updateContentSecurityPolicy.js";
-import { definePlugin } from "nitro";
-// src/runtime/nitro/plugins/securityHeaders.ts
-const CONTENT_SECURITY_POLICY_HEADER_NAME = SECURITY_HEADER_NAMES.contentSecurityPolicy;
-const securityHeaders = definePlugin((nitroApp) => {
-	nitroApp.hooks.hook("render:route", (_context, { event }) => {
-		const rules = getSecurityRules(event);
-		if (!rules?.enabled || !rules.headers) return;
-		const { contentSecurityPolicy } = rules.headers;
-		const serializedHeaders = serializeSecurityHeaders({
-			...rules.headers,
-			contentSecurityPolicy: contentSecurityPolicy ? updateContentSecurityPolicy(contentSecurityPolicy, getSecurityState(event)) : false
-		});
-		for (const [name, value] of Object.entries(serializedHeaders)) {
-			const isPolicy = name === CONTENT_SECURITY_POLICY_HEADER_NAME;
-			event.res.headers.set(isPolicy && rules.contentSecurityPolicyReportOnly ? CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME : name, value);
-		}
-	});
-});
-export { securityHeaders as default };

package/dist/runtime/nitro/plugins/ssgHashes.d.ts

@@ -1,3 +0,0 @@
-import { NitroAppPlugin } from "nitro/types";
-declare const ssgHashes: NitroAppPlugin;
-export { ssgHashes as default };

package/dist/runtime/nitro/plugins/ssgHashes.js

@@ -1,26 +0,0 @@
-import { collectSsgHashes } from "../../services/collectSsgHashes.js";
-import { getSecurityRules } from "../../services/getSecurityRules.js";
-import { getSecurityState } from "../../services/getSecurityState.js";
-import { insertContentSecurityPolicyMeta } from "../../services/insertContentSecurityPolicyMeta.js";
-import { updateContentSecurityPolicy } from "../../services/updateContentSecurityPolicy.js";
-import { definePlugin } from "nitro";
-// src/runtime/nitro/plugins/ssgHashes.ts
-const HTML_SECTIONS = [
-	"head",
-	"bodyPrepend",
-	"body",
-	"bodyAppend"
-];
-const ssgHashes = definePlugin((nitroApp) => {
-	if (!import.meta.prerender) return;
-	nitroApp.hooks.hook("render:html", async (html, { event }) => {
-		const rules = getSecurityRules(event);
-		if (!rules?.enabled || !rules.ssg || !rules.headers || !rules.headers.contentSecurityPolicy) return;
-		const state = getSecurityState(event);
-		state.hashes = await collectSsgHashes(HTML_SECTIONS.map((section) => html[section].join("")).join(""), rules.ssg);
-		if (!rules.ssg.meta) return;
-		const policy = updateContentSecurityPolicy(rules.headers.contentSecurityPolicy, state);
-		html.head = [insertContentSecurityPolicyMeta(html.head.join(""), policy)];
-	});
-});
-export { ssgHashes as default };

package/dist/runtime/nitro/plugins/subresourceIntegrity.d.ts

@@ -1,2 +0,0 @@
-import { NitroAppPlugin } from "nitro/types";
-export declare const createSubresourceIntegrityPlugin: (sriHashes: Record<string, string>) => NitroAppPlugin;