nuxt-security-module 4.3.3 → 4.5.0

package/README.md

@@ -5,14 +5,15 @@
 [![NPM downloads][badge-npm-downloads]][url-npm]
 [![NPM Unpacked Size (with version)][badge-npm-unpacked-size]][url-npm]
 
-Nuxt security module for [Nitro 3](https://nitro.build) and h3 2. It sets security headers on rendered pages, a per-request nonce Content Security Policy with the nonce written onto the page's own tags, subresource integrity, a prerender policy as a `<meta>` element, the framework's `X-Powered-By` header removed, CORS, allowed methods, basic auth and a request size limit.
+This package is a Nuxt security module for [Nitro 3](https://nitro.build) and h3 2 that sets security headers on rendered pages. It also provides a per-request nonce Content Security Policy, subresource integrity, CORS, allowed methods, basic auth and a request size limit.
 
-It replaces [nuxt-security](https://github.com/Baroshem/nuxt-security). Its upstream audit, every issue it was held to, and the defaults it ships are on the documentation page: [nuxt-security-module](https://github.com/Esposter/Esposter/blob/main/openspec/specs/nuxt-security-module/README.md).
+Design notes live in [the specs](https://github.com/Esposter/Esposter/tree/main/openspec/specs/nuxt-security-module).
 
 ## Table of Contents
 
 - 🚀 [Getting Started](#getting-started)
-- 📖 [Documentation](#documentation)
+- 🧩 [Key Exports](#key-exports)
+- 📝 [Usage](#usage)
 - ⚖️ [License](#license)
 
 ---
@@ -28,17 +29,43 @@ pnpm i nuxt-security-module
 export default defineNuxtConfig({ modules: ["nuxt-security-module"] });
 ```
 
-## <a name="documentation">📖 Documentation</a>
+## <a name="key-exports">🧩 Key Exports</a>
 
-We highly recommend you take a look at the [documentation](https://github.com/Esposter/Esposter/tree/main/openspec/specs/nuxt-security-module) to level up.
+| Export                   | Kind      | Purpose                                                                                                                  |
+| :----------------------- | :-------- | :----------------------------------------------------------------------------------------------------------------------- |
+| `createRouteRulesPlugin` | function  | Exported from `./runtime/nitro/plugins/routeRules`: the plugin that matches each request against the build's route rules |
+| `default`                | const     | The Nuxt module, set up from the `security` config key; each feature registers only when its option is on                |
+| `ModuleOptions`          | interface | The module's options, one key per feature, each on or off; the `security` config key takes a partial of them             |
+| `rateLimiter`            | const     | Default export of `./runtime/server/middleware/rateLimiter`: refuses a request with `429` once its key's window is spent |
 
-The module's option reference, its upstream audit and its defaults review live in the repository's [specs](https://github.com/Esposter/Esposter/tree/main/openspec/specs/nuxt-security-module). The package's status and the steps not yet built are in its `README.md` there.
+## <a name="usage">📝 Usage</a>
 
----
+```ts
+// nuxt.config.ts
+export default defineNuxtConfig({
+  modules: ["nuxt-security-module"],
+  security: {
+    // Refuses a client with 429 after 100 requests in each minute-long window
+    rateLimiter: { intervalInMilliseconds: 60000, tokensPerInterval: 100 },
+  },
+});
+```
+
+A request's body limit is the one its route sets, whatever its `Content-Type` claims, since a client writes that header. A route that takes a larger body names its own limit in its route rule:
+
+```ts
+// nuxt.config.ts
+export default defineNuxtConfig({
+  routeRules: {
+    // Lets a request to this route carry a 10 MB body, where the rest of the app takes the 2 MB default
+    "/api/import/**": { security: { requestSizeLimiter: { maxRequestSizeInBytes: 10_000_000 } } },
+  },
+});
+```
 
 ## <a name="license">⚖️ License</a>
 
-Apache-2.0
+Licensed under [Apache-2.0][url-license].
 
 [badge-license]: https://img.shields.io/github/license/Esposter/Esposter.svg?color=blue
 [url-license]: https://github.com/Esposter/Esposter/blob/main/LICENSE

package/dist/constants.js

@@ -0,0 +1,7 @@
+import { MODULE_NAME } from "./runtime/constants.js";
+// src/constants.ts
+const ROUTE_RULES_TEMPLATE_FILENAME = `#${MODULE_NAME}/route-rules.mjs`;
+const SRI_HASHES_TEMPLATE_FILENAME = `#${MODULE_NAME}/sri-hashes.mjs`;
+const ROUTE_RULES_PLUGIN_FILENAME = `#${MODULE_NAME}/route-rules-plugin.mjs`;
+const SRI_PLUGIN_FILENAME = `#${MODULE_NAME}/sri-plugin.mjs`;
+export { ROUTE_RULES_PLUGIN_FILENAME, ROUTE_RULES_TEMPLATE_FILENAME, SRI_HASHES_TEMPLATE_FILENAME, SRI_PLUGIN_FILENAME };

package/dist/index.js

@@ -1,3 +1,4 @@
+import { ROUTE_RULES_PLUGIN_FILENAME, ROUTE_RULES_TEMPLATE_FILENAME, SRI_HASHES_TEMPLATE_FILENAME, SRI_PLUGIN_FILENAME } from "./constants.js";
 import { MODULE_NAME } from "./runtime/constants.js";
 import { checkIsRecord } from "./runtime/services/checkIsRecord.js";
 import { computeSubresourceIntegrityHashes } from "./services/computeSubresourceIntegrityHashes.js";
@@ -5,18 +6,14 @@ import { getDefaultModuleOptions } from "./services/getDefaultModuleOptions.js";
 import { getPluginTemplate } from "./services/getPluginTemplate.js";
 import { getRemoveLoggersViteConfig } from "./services/getRemoveLoggersViteConfig.js";
 import { getRouteRulesTemplate } from "./services/getRouteRulesTemplate.js";
-import { mergeModuleOptions } from "./services/mergeModuleOptions.js";
 import { getRouteSecurityRules } from "./services/getRouteSecurityRules.js";
 import { getStaticResourceHeaders } from "./services/getStaticResourceHeaders.js";
 import { getTypeTemplate } from "./services/getTypeTemplate.js";
+import { mergeModuleOptions } from "./services/mergeModuleOptions.js";
 import { parseModuleOptions } from "./services/parseModuleOptions.js";
 import { defu } from "defu";
 import { addNitroPlugin, addServerHandler, addServerTemplate, addTypeTemplate, createResolver, defineNuxtModule } from "@nuxt/kit";
 // src/module.ts
-const ROUTE_RULES_TEMPLATE_FILENAME = `#${MODULE_NAME}/route-rules.mjs`;
-const SRI_HASHES_TEMPLATE_FILENAME = `#${MODULE_NAME}/sri-hashes.mjs`;
-const ROUTE_RULES_PLUGIN_FILENAME = `#${MODULE_NAME}/route-rules-plugin.mjs`;
-const SRI_PLUGIN_FILENAME = `#${MODULE_NAME}/sri-plugin.mjs`;
 const securityModule = defineNuxtModule({
 	meta: {
 		compatibility: { nuxt: ">=5.0.0-0" },
@@ -88,7 +85,7 @@ const securityModule = defineNuxtModule({
 				filename: SRI_HASHES_TEMPLATE_FILENAME,
 				getContents: () => `export default ${JSON.stringify(sriHashes)}\n`
 			});
-			nuxt.hook("nitro:build:before", async (nitro) => {
+			nuxt.hook("nitro:build:public-assets", async (nitro) => {
 				sriHashes = await computeSubresourceIntegrityHashes(nitro);
 			});
 		}

package/dist/models/RequestSizeLimiterOptions.d.ts

@@ -1,4 +1,3 @@
 export interface RequestSizeLimiterOptions {
   maxRequestSizeInBytes: number;
-  maxUploadFileRequestInBytes: number;
 }

package/dist/models/SsgElement.d.ts

@@ -0,0 +1 @@
+export type SsgElement = [name: string, attributes: string, body: string | undefined];

package/dist/models/SsgHashSource.d.ts

@@ -0,0 +1,2 @@
+import { SecurityState } from "../runtime/services/getSecurityState.js";
+export type SsgHashSource = [kind: keyof SecurityState["hashes"], source: string];

package/dist/models/SsgOptions.d.ts

@@ -1,7 +1,5 @@
 export interface SsgOptions {
-  exportToPresets: boolean;
   hashScripts: boolean;
   hashStyles: boolean;
   meta: boolean;
-  nitroHeaders: boolean;
 }

package/dist/runtime/constants.d.ts

@@ -11,12 +11,10 @@ export declare const NONCE_BYTE_LENGTH = 18;
 export declare const NONCE_PLACEHOLDER = "'nonce-{{nonce}}'";
 export declare const SRI_HASH_ALGORITHM = "SHA-384";
 export declare const CSP_HASH_ALGORITHM = "SHA-256";
-export declare const PRERENDERED_HEADERS_DIRECTORY_NAME = "nuxt-security";
-export declare const PRERENDERED_HEADERS_FILE_NAME = "headers.json";
 export declare const HTML_ATTRIBUTE_REGEX: RegExp;
 export declare const HTML_TAG_REGEX: RegExp;
 export declare const NONCE_TAG_NAMES: readonly string[];
-export declare const FILE_UPLOAD_CONTENT_TYPE = "multipart/form-data";
+export declare const HTML_SECTIONS: readonly ["head", "bodyPrepend", "body", "bodyAppend"];
 export declare const SIZE_LIMITED_METHODS: readonly string[];
 export declare const DEFAULT_BASIC_AUTH_REALM = "Please enter username and password";
 export declare const BASIC_AUTHORIZATION_SCHEME = "Basic";

package/dist/runtime/constants.js

@@ -19,19 +19,18 @@ const SECURITY_HEADER_NAMES = {
 const CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME = "Content-Security-Policy-Report-Only";
 const MAX_RATE_LIMIT_ENTRIES = 1e4;
 const UNKNOWN_CLIENT_KEY = "unknown";
-const CSRF_UNSAFE_METHODS = [
+const STATE_CHANGING_METHODS = [
 	"DELETE",
 	"PATCH",
 	"POST",
 	"PUT"
 ];
+const CSRF_UNSAFE_METHODS = STATE_CHANGING_METHODS;
 const CSRF_TOKEN_BYTE_LENGTH = 32;
 const NONCE_BYTE_LENGTH = 18;
 const NONCE_PLACEHOLDER = "'nonce-{{nonce}}'";
 const SRI_HASH_ALGORITHM = "SHA-384";
 const CSP_HASH_ALGORITHM = "SHA-256";
-const PRERENDERED_HEADERS_DIRECTORY_NAME = "nuxt-security";
-const PRERENDERED_HEADERS_FILE_NAME = "headers.json";
 const HTML_ATTRIBUTE_PATTERN = String.raw`\s+[^\s"'<>/=]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s"'<>=]+))?`;
 const HTML_ATTRIBUTE_REGEX = /\s+(?<name>[^\s"'<>/=]+)(?<assignment>\s*=\s*(?<value>"[^"]*"|'[^']*'|[^\s"'<>=]+))?/gu;
 const HTML_TAG_REGEX = new RegExp(String.raw`<(script|style)\b((?:${HTML_ATTRIBUTE_PATTERN})*)(\s*\/?)>([\s\S]*?)<\/\1\s*>|<([a-z][\w:-]*)((?:${HTML_ATTRIBUTE_PATTERN})*)(\s*\/?)>`, "giu");
@@ -40,12 +39,13 @@ const NONCE_TAG_NAMES = [
 	"script",
 	"style"
 ];
-const FILE_UPLOAD_CONTENT_TYPE = "multipart/form-data";
-const SIZE_LIMITED_METHODS = [
-	"DELETE",
-	"POST",
-	"PUT"
+const HTML_SECTIONS = [
+	"head",
+	"bodyPrepend",
+	"body",
+	"bodyAppend"
 ];
+const SIZE_LIMITED_METHODS = STATE_CHANGING_METHODS;
 const DEFAULT_BASIC_AUTH_REALM = "Please enter username and password";
 const BASIC_AUTHORIZATION_SCHEME = "Basic";
-export { BASIC_AUTHORIZATION_SCHEME, CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME, CSP_HASH_ALGORITHM, CSRF_TOKEN_BYTE_LENGTH, CSRF_UNSAFE_METHODS, DEFAULT_BASIC_AUTH_REALM, FILE_UPLOAD_CONTENT_TYPE, HTML_ATTRIBUTE_REGEX, HTML_TAG_REGEX, MAX_RATE_LIMIT_ENTRIES, MODULE_NAME, NONCE_BYTE_LENGTH, NONCE_PLACEHOLDER, NONCE_TAG_NAMES, PRERENDERED_HEADERS_DIRECTORY_NAME, PRERENDERED_HEADERS_FILE_NAME, ROUTE_RULES_HOOK, SECURITY_HEADER_NAMES, SIZE_LIMITED_METHODS, SRI_HASH_ALGORITHM, UNKNOWN_CLIENT_KEY };
+export { BASIC_AUTHORIZATION_SCHEME, CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER_NAME, CSP_HASH_ALGORITHM, CSRF_TOKEN_BYTE_LENGTH, CSRF_UNSAFE_METHODS, DEFAULT_BASIC_AUTH_REALM, HTML_ATTRIBUTE_REGEX, HTML_SECTIONS, HTML_TAG_REGEX, MAX_RATE_LIMIT_ENTRIES, MODULE_NAME, NONCE_BYTE_LENGTH, NONCE_PLACEHOLDER, NONCE_TAG_NAMES, ROUTE_RULES_HOOK, SECURITY_HEADER_NAMES, SIZE_LIMITED_METHODS, SRI_HASH_ALGORITHM, UNKNOWN_CLIENT_KEY };

package/dist/runtime/nitro/plugins/hidePoweredBy.js

@@ -3,10 +3,10 @@ import { definePlugin } from "nitro";
 import { isEvent } from "nitro/h3";
 // src/runtime/nitro/plugins/hidePoweredBy.ts
 const hidePoweredBy = definePlugin((nitroApp) => {
-	nitroApp.hooks.hook("response", (_response, event) => {
+	nitroApp.hooks.hook("response", (response, event) => {
 		if (!isEvent(event)) return;
 		const rules = getSecurityRules(event);
-		if (rules?.enabled && rules.hidePoweredBy) event.res.headers.delete("x-powered-by");
+		if (rules?.enabled && rules.hidePoweredBy) response.headers.delete("x-powered-by");
 	});
 });
 export { hidePoweredBy as default };

package/dist/runtime/nitro/plugins/nonce.js

@@ -1,15 +1,10 @@
+import { HTML_SECTIONS } from "../../constants.js";
 import { generateNonce } from "../../services/generateNonce.js";
 import { getSecurityRules } from "../../services/getSecurityRules.js";
 import { getSecurityState } from "../../services/getSecurityState.js";
 import { injectNonce } from "../../services/injectNonce.js";
 import { definePlugin } from "nitro";
 // src/runtime/nitro/plugins/nonce.ts
-const HTML_SECTIONS = [
-	"body",
-	"bodyAppend",
-	"bodyPrepend",
-	"head"
-];
 const noncePlugin = definePlugin((nitroApp) => {
 	if (import.meta.prerender) return;
 	nitroApp.hooks.hook("render:route", (_context, { event }) => {

package/dist/runtime/nitro/plugins/routeRules.js

@@ -1,14 +1,18 @@
 import { ROUTE_RULES_HOOK } from "../../constants.js";
-import { setSecurityRouteMatcher } from "../../services/securityRouteMatcher.js";
+import { setSecurityRouteMatcher, setSecurityRouteMatcherFailure } from "../../services/securityRouteMatcher.js";
 import { definePlugin } from "nitro";
 // src/runtime/nitro/plugins/routeRules.ts
 const createRouteRulesPlugin = (routeRules) => definePlugin((nitroApp) => {
+	const resolveRouteRules = async () => {
+		const routes = structuredClone(routeRules);
+		await nitroApp.hooks.callHook(ROUTE_RULES_HOOK, routes);
+		setSecurityRouteMatcher(routes);
+	};
 	let routesResolved;
 	nitroApp.hooks.hook("request", () => {
 		routesResolved ??= (async () => {
-			const routes = structuredClone(routeRules);
-			await nitroApp.hooks.callHook(ROUTE_RULES_HOOK, routes);
-			setSecurityRouteMatcher(routes);
+			const [resolution] = await Promise.allSettled([resolveRouteRules()]);
+			if (resolution.status === "rejected") setSecurityRouteMatcherFailure(resolution.reason);
 		})();
 		return routesResolved;
 	});

package/dist/runtime/nitro/plugins/ssgHashes.js

@@ -1,3 +1,4 @@
+import { HTML_SECTIONS } from "../../constants.js";
 import { collectSsgHashes } from "../../services/collectSsgHashes.js";
 import { getSecurityRules } from "../../services/getSecurityRules.js";
 import { getSecurityState } from "../../services/getSecurityState.js";
@@ -5,12 +6,6 @@ import { insertContentSecurityPolicyMeta } from "../../services/insertContentSec
 import { updateContentSecurityPolicy } from "../../services/updateContentSecurityPolicy.js";
 import { definePlugin } from "nitro";
 // src/runtime/nitro/plugins/ssgHashes.ts
-const HTML_SECTIONS = [
-	"head",
-	"bodyPrepend",
-	"body",
-	"bodyAppend"
-];
 const ssgHashes = definePlugin((nitroApp) => {
 	if (!import.meta.prerender) return;
 	nitroApp.hooks.hook("render:html", async (html, { event }) => {
@@ -18,7 +13,7 @@ const ssgHashes = definePlugin((nitroApp) => {
 		if (!rules?.enabled || !rules.ssg || !rules.headers || !rules.headers.contentSecurityPolicy) return;
 		const state = getSecurityState(event);
 		state.hashes = await collectSsgHashes(HTML_SECTIONS.map((section) => html[section].join("")).join(""), rules.ssg);
-		if (!rules.ssg.meta) return;
+		if (!rules.ssg.meta || rules.contentSecurityPolicyReportOnly) return;
 		const policy = updateContentSecurityPolicy(rules.headers.contentSecurityPolicy, state);
 		html.head = [insertContentSecurityPolicyMeta(html.head.join(""), policy)];
 	});

package/dist/runtime/nitro/plugins/subresourceIntegrity.js

@@ -1,13 +1,8 @@
+import { HTML_SECTIONS } from "../../constants.js";
 import { getSecurityRules } from "../../services/getSecurityRules.js";
 import { injectSubresourceIntegrity } from "../../services/injectSubresourceIntegrity.js";
 import { definePlugin } from "nitro";
 // src/runtime/nitro/plugins/subresourceIntegrity.ts
-const HTML_SECTIONS = [
-	"body",
-	"bodyAppend",
-	"bodyPrepend",
-	"head"
-];
 const createSubresourceIntegrityPlugin = (sriHashes) => definePlugin((nitroApp) => {
 	nitroApp.hooks.hook("render:html", (html, { event }) => {
 		const rules = getSecurityRules(event);

package/dist/runtime/server/middleware/basicAuth.js

@@ -13,8 +13,8 @@ const basicAuthMiddleware = defineMiddleware((event) => {
 	const { pathname } = event.url;
 	if (!checkIsChallenged(pathname, basicAuth)) return;
 	if (checkIsBasicAuthorized(event.req.headers.get("authorization"), basicAuth)) return;
-	event.res.headers.set("WWW-Authenticate", serializeBasicAuthChallenge(basicAuth.message || "Please enter username and password"));
 	throw new HTTPError({
+		headers: { "WWW-Authenticate": serializeBasicAuthChallenge(basicAuth.message || "Please enter username and password") },
 		status: 401,
 		statusText: "Access denied"
 	});

package/dist/runtime/server/middleware/corsHandler.js

@@ -4,9 +4,9 @@ import { handleCors } from "nitro/h3";
 // src/runtime/server/middleware/corsHandler.ts
 const corsHandler = defineMiddleware((event) => {
 	const rules = getSecurityRules(event);
-	if (!rules?.enabled || !rules.corsHandler) return;
+	if (!rules?.enabled || !rules.corsHandler) return void 0;
 	const { allowHeaders, credentials, exposeHeaders, maxAge, methods, origin, preflight } = rules.corsHandler;
-	handleCors(event, {
+	const response = handleCors(event, {
 		allowHeaders,
 		credentials,
 		exposeHeaders,
@@ -15,5 +15,6 @@ const corsHandler = defineMiddleware((event) => {
 		origin: [origin].flat(),
 		preflight
 	});
+	return response === false ? void 0 : response;
 });
 export { corsHandler as default };

package/dist/runtime/server/middleware/rateLimiter.js

@@ -12,8 +12,8 @@ const rateLimiter = defineMiddleware(async (event) => {
 	const key = getRequestIP(event, { xForwardedFor: false }) ?? "unknown";
 	const retryAfterSeconds = await getRetryAfterSeconds(rateLimiterStore, key, rules.rateLimiter);
 	if (retryAfterSeconds === void 0) return;
-	event.res.headers.set("Retry-After", String(retryAfterSeconds));
 	throw new HTTPError({
+		headers: { "Retry-After": String(retryAfterSeconds) },
 		status: 429,
 		statusText: "Too Many Requests"
 	});

package/dist/runtime/server/middleware/requestSizeLimiter.js

@@ -1,16 +1,18 @@
+import { checkIsBodyCounted } from "../../services/checkIsBodyCounted.js";
 import { checkIsRequestTooLarge } from "../../services/checkIsRequestTooLarge.js";
 import { getSecurityRules } from "../../services/getSecurityRules.js";
 import { defineMiddleware } from "nitro";
-import { HTTPError } from "nitro/h3";
+import { HTTPError, assertBodySize } from "nitro/h3";
 // src/runtime/server/middleware/requestSizeLimiter.ts
 const requestSizeLimiter = defineMiddleware((event) => {
 	const rules = getSecurityRules(event);
 	if (!rules?.enabled || !rules.requestSizeLimiter) return;
+	const { method } = event.req;
 	const contentLength = event.req.headers.get("content-length");
-	const contentType = event.req.headers.get("content-type");
-	if (checkIsRequestTooLarge(event.req.method, contentLength, contentType, rules.requestSizeLimiter)) throw new HTTPError({
+	if (checkIsRequestTooLarge(method, contentLength, rules.requestSizeLimiter)) throw new HTTPError({
 		status: 413,
 		statusText: "Payload Too Large"
 	});
+	if (checkIsBodyCounted(method, contentLength)) assertBodySize(event, rules.requestSizeLimiter.maxRequestSizeInBytes);
 });
 export { requestSizeLimiter as default };

package/dist/runtime/services/checkIsBase64.d.ts

@@ -0,0 +1 @@
+export declare const checkIsBase64: (value: string) => boolean;

package/dist/runtime/services/checkIsBase64.js

@@ -0,0 +1,5 @@
+// src/runtime/services/checkIsBase64.ts
+const BASE64_REGEX = /^[\d+/A-Za-z]*={0,2}$/u;
+const BASE64_QUANTUM_LENGTH = 4;
+const checkIsBase64 = (value) => BASE64_REGEX.test(value) && (value.endsWith("=") ? value.length % BASE64_QUANTUM_LENGTH === 0 : value.length % BASE64_QUANTUM_LENGTH !== 1);
+export { checkIsBase64 };

package/dist/runtime/services/checkIsBasicAuthorized.js

@@ -2,6 +2,7 @@ import { checkIsEqualInConstantTime } from "./checkIsEqualInConstantTime.js";
 import { getBasicAuthCredentials } from "./getBasicAuthCredentials.js";
 // src/runtime/services/checkIsBasicAuthorized.ts
 const checkIsBasicAuthorized = (authorization, { name, pass }) => {
+	if (!name || !pass) return false;
 	const credentials = getBasicAuthCredentials(authorization);
 	if (!credentials) return false;
 	const isNameEqual = checkIsEqualInConstantTime(credentials.name, name);

package/dist/runtime/services/checkIsBodyCounted.d.ts

@@ -0,0 +1 @@
+export declare const checkIsBodyCounted: (method: string, contentLength: null | string) => boolean;

package/dist/runtime/services/checkIsBodyCounted.js

@@ -0,0 +1,4 @@
+import { SIZE_LIMITED_METHODS } from "../constants.js";
+// src/runtime/services/checkIsBodyCounted.ts
+const checkIsBodyCounted = (method, contentLength) => contentLength === null && SIZE_LIMITED_METHODS.includes(method);
+export { checkIsBodyCounted };

package/dist/runtime/services/checkIsRequestTooLarge.d.ts

@@ -1,2 +1,2 @@
 import { RequestSizeLimiterOptions } from "../../models/RequestSizeLimiterOptions.js";
-export declare const checkIsRequestTooLarge: (method: string, contentLength: null | string, contentType: null | string, { maxRequestSizeInBytes, maxUploadFileRequestInBytes }: RequestSizeLimiterOptions) => boolean;
+export declare const checkIsRequestTooLarge: (method: string, contentLength: null | string, { maxRequestSizeInBytes }: RequestSizeLimiterOptions) => boolean;

package/dist/runtime/services/checkIsRequestTooLarge.js

@@ -1,8 +1,7 @@
 import { SIZE_LIMITED_METHODS } from "../constants.js";
 // src/runtime/services/checkIsRequestTooLarge.ts
-const checkIsRequestTooLarge = (method, contentLength, contentType, { maxRequestSizeInBytes, maxUploadFileRequestInBytes }) => {
+const checkIsRequestTooLarge = (method, contentLength, { maxRequestSizeInBytes }) => {
 	if (!SIZE_LIMITED_METHODS.includes(method) || contentLength === null) return false;
-	const limit = contentType?.includes("multipart/form-data") ?? false ? maxUploadFileRequestInBytes : maxRequestSizeInBytes;
-	return Math.trunc(Number(contentLength)) >= limit;
+	return Math.trunc(Number(contentLength)) > maxRequestSizeInBytes;
 };
 export { checkIsRequestTooLarge };

package/dist/runtime/services/checkIsSecurityHeaderKey.d.ts

@@ -0,0 +1,2 @@
+import { SecurityHeaders } from "../../models/SecurityHeaders.js";
+export declare const checkIsSecurityHeaderKey: (key: string) => key is keyof SecurityHeaders;

package/dist/runtime/services/checkIsSecurityHeaderKey.js

@@ -0,0 +1,4 @@
+import { SECURITY_HEADER_NAMES } from "../constants.js";
+// src/runtime/services/checkIsSecurityHeaderKey.ts
+const checkIsSecurityHeaderKey = (key) => Object.hasOwn(SECURITY_HEADER_NAMES, key);
+export { checkIsSecurityHeaderKey };

package/dist/runtime/services/checkIsStaticNonce.d.ts

@@ -0,0 +1 @@
+export declare const checkIsStaticNonce: (source: string) => boolean;

package/dist/runtime/services/checkIsStaticNonce.js

@@ -0,0 +1,4 @@
+import "../constants.js";
+// src/runtime/services/checkIsStaticNonce.ts
+const checkIsStaticNonce = (source) => source.startsWith("'nonce-") && source !== "'nonce-{{nonce}}'";
+export { checkIsStaticNonce };

package/dist/runtime/services/checkIsStringList.d.ts

@@ -0,0 +1 @@
+export declare const checkIsStringList: (value: unknown) => value is string[];

package/dist/runtime/services/checkIsStringList.js

@@ -0,0 +1,3 @@
+// src/runtime/services/checkIsStringList.ts
+const checkIsStringList = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
+export { checkIsStringList };

package/dist/runtime/services/collectSsgHashes.js

@@ -1,28 +1,6 @@
-import { CSP_HASH_ALGORITHM, HTML_TAG_REGEX } from "../constants.js";
-import { generateHash } from "./generateHash.js";
-import { readHtmlTagAttribute } from "./readHtmlTagAttribute.js";
+import { HTML_TAG_REGEX } from "../constants.js";
+import { getSsgHashSource } from "./getSsgHashSource.js";
 // src/runtime/services/collectSsgHashes.ts
-const SCRIPT_PRELOAD_TYPES = /* @__PURE__ */ new Set([
-	"audioworklet",
-	"paintworklet",
-	"script",
-	"xslt"
-]);
-const getSsgHashSource = async ([name, attributes, body], { hashScripts, hashStyles }) => {
-	const integrity = readHtmlTagAttribute(attributes, "integrity");
-	if (name === "script" && hashScripts) {
-		const source = readHtmlTagAttribute(attributes, "src");
-		if (source !== void 0 && integrity !== void 0) return ["script", `'${integrity}'`];
-		if (source === void 0 && body) return ["script", `'${await generateHash(body, CSP_HASH_ALGORITHM)}'`];
-		return;
-	}
-	if (name === "style" && hashStyles && body) return ["style", `'${await generateHash(body, CSP_HASH_ALGORITHM)}'`];
-	if (name !== "link" || integrity === void 0) return void 0;
-	const rel = readHtmlTagAttribute(attributes, "rel");
-	const as = readHtmlTagAttribute(attributes, "as") ?? "";
-	if (rel === "stylesheet" && hashStyles) return ["style", `'${integrity}'`];
-	if (hashScripts && (rel === "modulepreload" || rel === "preload" && SCRIPT_PRELOAD_TYPES.has(as))) return ["script", `'${integrity}'`];
-};
 const collectSsgHashes = async (html, options) => {
 	const elements = Array.from(html.matchAll(HTML_TAG_REGEX), ([, elementName, elementAttributes, , body, tagName, tagAttributes]) => [
 		(elementName ?? tagName ?? "").toLowerCase(),

package/dist/runtime/services/getBasicAuthCredentials.js

@@ -1,8 +1,6 @@
 import { BASIC_AUTHORIZATION_SCHEME } from "../constants.js";
+import { checkIsBase64 } from "./checkIsBase64.js";
 // src/runtime/services/getBasicAuthCredentials.ts
-const BASE64_REGEX = /^[\d+/A-Za-z]*={0,2}$/u;
-const BASE64_QUANTUM_LENGTH = 4;
-const checkIsBase64 = (value) => BASE64_REGEX.test(value) && (value.endsWith("=") ? value.length % BASE64_QUANTUM_LENGTH === 0 : value.length % BASE64_QUANTUM_LENGTH !== 1);
 const getBasicAuthCredentials = (authorization) => {
 	if (!authorization?.startsWith(`Basic `)) return void 0;
 	const encoded = authorization.slice(BASIC_AUTHORIZATION_SCHEME.length + 1).trim();

package/dist/runtime/services/getBasicAuthOptions.js

@@ -1,6 +1,6 @@
 import { checkIsRecord } from "./checkIsRecord.js";
+import { checkIsStringList } from "./checkIsStringList.js";
 // src/runtime/services/getBasicAuthOptions.ts
-const checkIsStringList = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
 const getBasicAuthOptions = (privateRuntimeConfig) => {
 	if (!checkIsRecord(privateRuntimeConfig) || !checkIsRecord(privateRuntimeConfig.basicAuth)) return void 0;
 	const { exclude, include, message, name, pass } = privateRuntimeConfig.basicAuth;

package/dist/runtime/services/getSsgHashSource.d.ts

@@ -0,0 +1,4 @@
+import { SsgElement } from "../../models/SsgElement.js";
+import { SsgHashSource } from "../../models/SsgHashSource.js";
+import { SsgOptions } from "../../models/SsgOptions.js";
+export declare const getSsgHashSource: ([name, attributes, body]: SsgElement, { hashScripts, hashStyles }: SsgOptions) => Promise<SsgHashSource | undefined>;

package/dist/runtime/services/getSsgHashSource.js

@@ -0,0 +1,26 @@
+import { CSP_HASH_ALGORITHM } from "../constants.js";
+import { generateHash } from "./generateHash.js";
+import { readHtmlTagAttribute } from "./readHtmlTagAttribute.js";
+// src/runtime/services/getSsgHashSource.ts
+const SCRIPT_PRELOAD_TYPES = /* @__PURE__ */ new Set([
+	"audioworklet",
+	"paintworklet",
+	"script",
+	"xslt"
+]);
+const getSsgHashSource = async ([name, attributes, body], { hashScripts, hashStyles }) => {
+	const integrity = readHtmlTagAttribute(attributes, "integrity");
+	if (name === "script" && hashScripts) {
+		const source = readHtmlTagAttribute(attributes, "src");
+		if (source !== void 0 && integrity !== void 0) return ["script", `'${integrity}'`];
+		if (source === void 0 && body) return ["script", `'${await generateHash(body, CSP_HASH_ALGORITHM)}'`];
+		return;
+	}
+	if (name === "style" && hashStyles && body) return ["style", `'${await generateHash(body, CSP_HASH_ALGORITHM)}'`];
+	if (name !== "link" || integrity === void 0) return void 0;
+	const rel = readHtmlTagAttribute(attributes, "rel");
+	const as = readHtmlTagAttribute(attributes, "as") ?? "";
+	if (rel === "stylesheet" && hashStyles) return ["style", `'${integrity}'`];
+	if (hashScripts && (rel === "modulepreload" || rel === "preload" && SCRIPT_PRELOAD_TYPES.has(as))) return ["script", `'${integrity}'`];
+};
+export { getSsgHashSource };

package/dist/runtime/services/injectSubresourceIntegrity.js

@@ -14,7 +14,7 @@ const injectSubresourceIntegrity = (html, hashes) => rewriteHtmlTags(html, (tagN
 	const resourceAttributeName = RESOURCE_ATTRIBUTE_NAMES[tagName.toLowerCase()];
 	if (!resourceAttributeName || readHtmlTagAttribute(attributes, "integrity") !== void 0) return void 0;
 	const resource = readHtmlTagAttribute(attributes, resourceAttributeName);
-	if (resource === void 0 || hashes[resource] === void 0) return void 0;
+	if (resource === void 0 || !Object.hasOwn(hashes, resource)) return void 0;
 	if (tagName.toLowerCase() === "link" && !INTEGRITY_LINK_RELS.has(readHtmlTagAttribute(attributes, "rel") ?? "")) return void 0;
 	return ` integrity="${hashes[resource]}"${attributes}`;
 });

package/dist/runtime/services/readHtmlTagAttribute.js

@@ -1,7 +1,7 @@
 import { HTML_ATTRIBUTE_REGEX } from "../constants.js";
+import { unquote } from "./unquote.js";
 // src/runtime/services/readHtmlTagAttribute.ts
 const readHtmlTagAttribute = (attributes, attributeName) => {
 	for (const [, name, , value] of attributes.matchAll(HTML_ATTRIBUTE_REGEX)) if (name?.toLowerCase() === attributeName) return unquote(value ?? "");
 };
-const unquote = (value) => value.replace(/^(?<quote>["'])(?<inner>.*)\k<quote>$/su, "$<inner>");
 export { readHtmlTagAttribute };

package/dist/runtime/services/securityRouteMatcher.d.ts

@@ -1,3 +1,4 @@
 import { SecurityRules } from "../../models/SecurityRules.js";
 export declare const setSecurityRouteMatcher: (routes: Record<string, SecurityRules>) => void;
+export declare const setSecurityRouteMatcherFailure: (cause: unknown) => void;
 export declare const findSecurityRules: (pathname: string) => SecurityRules[] | undefined;

package/dist/runtime/services/securityRouteMatcher.js

@@ -1,10 +1,17 @@
 import { addRoute, createRouter, findAllRoutes } from "rou3";
 // src/runtime/services/securityRouteMatcher.ts
 let securityRouter;
+let securityRouteFailure;
 const setSecurityRouteMatcher = (routes) => {
 	const router = createRouter();
 	for (const [pattern, rules] of Object.entries(routes)) addRoute(router, "", pattern, rules);
 	securityRouter = router;
 };
-const findSecurityRules = (pathname) => securityRouter && findAllRoutes(securityRouter, "", pathname).flatMap(({ data }) => data ? [data] : []);
-export { findSecurityRules, setSecurityRouteMatcher };
+const setSecurityRouteMatcherFailure = (cause) => {
+	securityRouteFailure = new TypeError("nuxt-security-module: the security route rules did not resolve", { cause });
+};
+const findSecurityRules = (pathname) => {
+	if (securityRouteFailure) throw securityRouteFailure;
+	return securityRouter && findAllRoutes(securityRouter, "", pathname).flatMap(({ data }) => data ? [data] : []);
+};
+export { findSecurityRules, setSecurityRouteMatcher, setSecurityRouteMatcherFailure };

package/dist/runtime/services/serializeSecurityHeaders.js

@@ -1,18 +1,10 @@
 import { SECURITY_HEADER_NAMES } from "../constants.js";
-import { serializeContentSecurityPolicy } from "./serializeContentSecurityPolicy.js";
-import { serializePermissionsPolicy } from "./serializePermissionsPolicy.js";
-import { serializeStrictTransportSecurity } from "./serializeStrictTransportSecurity.js";
+import { checkIsSecurityHeaderKey } from "./checkIsSecurityHeaderKey.js";
+import { serializeValue } from "./serializeValue.js";
 // src/runtime/services/serializeSecurityHeaders.ts
-const checkIsSecurityHeaderKey = (key) => Object.hasOwn(SECURITY_HEADER_NAMES, key);
 const serializeSecurityHeaders = (headers) => Object.fromEntries(Object.keys(headers).flatMap((key) => {
 	if (!checkIsSecurityHeaderKey(key)) return [];
 	const value = headers[key];
 	return value === false || value === void 0 ? [] : [[SECURITY_HEADER_NAMES[key], serializeValue(key, value)]];
 }));
-const serializeValue = (key, value) => {
-	if (key === "contentSecurityPolicy") return serializeContentSecurityPolicy(value);
-	if (key === "permissionsPolicy") return serializePermissionsPolicy(value);
-	if (key === "strictTransportSecurity") return serializeStrictTransportSecurity(value);
-	return String(value);
-};
 export { serializeSecurityHeaders };

package/dist/runtime/services/serializeValue.d.ts

@@ -0,0 +1 @@
+export declare const serializeValue: (key: string, value: unknown) => string;

package/dist/runtime/services/serializeValue.js

@@ -0,0 +1,11 @@
+import { serializeContentSecurityPolicy } from "./serializeContentSecurityPolicy.js";
+import { serializePermissionsPolicy } from "./serializePermissionsPolicy.js";
+import { serializeStrictTransportSecurity } from "./serializeStrictTransportSecurity.js";
+// src/runtime/services/serializeValue.ts
+const serializeValue = (key, value) => {
+	if (key === "contentSecurityPolicy") return serializeContentSecurityPolicy(value);
+	if (key === "permissionsPolicy") return serializePermissionsPolicy(value);
+	if (key === "strictTransportSecurity") return serializeStrictTransportSecurity(value);
+	return String(value);
+};
+export { serializeValue };

package/dist/runtime/services/unquote.d.ts

@@ -0,0 +1 @@
+export declare const unquote: (value: string) => string;

package/dist/runtime/services/unquote.js

@@ -0,0 +1,3 @@
+// src/runtime/services/unquote.ts
+const unquote = (value) => value.replace(/^(?<quote>["'])(?<inner>.*)\k<quote>$/su, "$<inner>");
+export { unquote };

package/dist/runtime/services/updateContentSecurityPolicy.js

@@ -1,4 +1,5 @@
 import { NONCE_PLACEHOLDER } from "../constants.js";
+import { checkIsStaticNonce } from "./checkIsStaticNonce.js";
 // src/runtime/services/updateContentSecurityPolicy.ts
 const SCRIPT_DIRECTIVES = /* @__PURE__ */ new Set(["script-src", "script-src-elem"]);
 const STYLE_DIRECTIVES = /* @__PURE__ */ new Set(["style-src", "style-src-elem"]);
@@ -10,5 +11,4 @@ const updateContentSecurityPolicy = (policy, { hashes, nonce }) => Object.fromEn
 	if (STYLE_DIRECTIVES.has(directive)) sources.push(...hashes.style);
 	return [directive, sources];
 }));
-const checkIsStaticNonce = (source) => source.startsWith("'nonce-") && source !== "'nonce-{{nonce}}'";
 export { updateContentSecurityPolicy };

package/dist/schemas/requestSizeLimiterOptionsSchema.js

@@ -1,7 +1,4 @@
 import { z } from "zod";
 // src/schemas/requestSizeLimiterOptionsSchema.ts
-const requestSizeLimiterOptionsSchema = z.strictObject({
-	maxRequestSizeInBytes: z.int("must be a whole number of bytes").positive("must be more than zero bytes"),
-	maxUploadFileRequestInBytes: z.int("must be a whole number of bytes").positive("must be more than zero bytes")
-});
+const requestSizeLimiterOptionsSchema = z.strictObject({ maxRequestSizeInBytes: z.int("must be a whole number of bytes").positive("must be more than zero bytes") });
 export { requestSizeLimiterOptionsSchema };

package/dist/schemas/ssgOptionsSchema.js

@@ -1,10 +1,8 @@
 import { z } from "zod";
 // src/schemas/ssgOptionsSchema.ts
 const ssgOptionsSchema = z.strictObject({
-	exportToPresets: z.boolean(),
 	hashScripts: z.boolean(),
 	hashStyles: z.boolean(),
-	meta: z.boolean(),
-	nitroHeaders: z.boolean()
+	meta: z.boolean()
 });
 export { ssgOptionsSchema };

package/dist/services/computeSubresourceIntegrityHashes.js

@@ -6,22 +6,17 @@ import { join, posix, relative, sep } from "node:path";
 // src/services/computeSubresourceIntegrityHashes.ts
 const computeSubresourceIntegrityHashes = async (nitro) => {
 	const { baseURL: appBaseUrl, cdnURL: appCdnUrl } = nitro.options.runtimeConfig.app;
-	const existingPublicAssets = nitro.options.publicAssets.filter(({ dir: directory }) => existsSync(directory));
-	const filesByPublicAsset = await Promise.all(existingPublicAssets.map(async ({ baseURL = "", dir: directory }) => {
-		return (await readdir(directory, {
-			recursive: true,
-			withFileTypes: true
-		})).filter((entry) => entry.isFile()).map((entry) => {
-			const filePath = join(entry.parentPath, entry.name);
-			return {
-				filePath,
-				fullPath: posix.join(baseURL, ...relative(directory, filePath).split(sep))
-			};
-		});
-	}));
-	const hashEntries = await Promise.all(filesByPublicAsset.flat().map(async ({ filePath, fullPath }) => {
+	const { publicDir } = nitro.options.output;
+	if (!existsSync(publicDir)) return {};
+	const entries = await readdir(publicDir, {
+		recursive: true,
+		withFileTypes: true
+	});
+	const hashEntries = await Promise.all(entries.filter((entry) => entry.isFile()).map(async (entry) => {
+		const filePath = join(entry.parentPath, entry.name);
 		const hash = await generateHash(await readFile(filePath), SRI_HASH_ALGORITHM);
-		return [appCdnUrl ? new URL(posix.isAbsolute(fullPath) ? fullPath.slice(1) : fullPath, appCdnUrl.endsWith("/") ? appCdnUrl : `${appCdnUrl}/`).href : posix.join("/", appBaseUrl, fullPath), hash];
+		const fullPath = posix.join(...relative(publicDir, filePath).split(sep));
+		return [appCdnUrl ? new URL(fullPath, appCdnUrl.endsWith("/") ? appCdnUrl : `${appCdnUrl}/`).href : posix.join("/", appBaseUrl, fullPath), hash];
 	}));
 	return Object.fromEntries(hashEntries);
 };

package/dist/services/constants.js

@@ -0,0 +1,3 @@
+// src/services/constants.ts
+const NONE_SOURCE = "'none'";
+export { NONE_SOURCE };

package/dist/services/formatLeafIssue.js

@@ -0,0 +1,5 @@
+// src/services/formatLeafIssue.ts
+const formatLeafIssue = ({ issue, path }) => {
+	return `${path.map(String).join(".") || "(options)"}: ${issue.message}`;
+};
+export { formatLeafIssue };

package/dist/services/formatZodIssues.js

@@ -1,15 +1,5 @@
+import { formatLeafIssue } from "./formatLeafIssue.js";
+import { getLeafIssues } from "./getLeafIssues.js";
 // src/services/formatZodIssues.ts
-const getDeepestPathLength = (leafIssues) => Math.max(-1, ...leafIssues.map(({ path }) => path.length));
-const getLeafIssues = (issue, parentPath) => {
-	const path = [...parentPath, ...issue.path];
-	if (issue.code !== "invalid_union") return [{
-		issue,
-		path
-	}];
-	return issue.errors.map((branch) => branch.flatMap((branchIssue) => getLeafIssues(branchIssue, path))).reduce((deepest, branch) => getDeepestPathLength(branch) > getDeepestPathLength(deepest) ? branch : deepest);
-};
-const formatLeafIssue = ({ issue, path }) => {
-	return `${path.map(String).join(".") || "(options)"}: ${issue.message}`;
-};
 const formatZodIssues = (issues) => issues.flatMap((issue) => getLeafIssues(issue, [])).map((leafIssue) => formatLeafIssue(leafIssue)).join("; ");
 export { formatZodIssues };

package/dist/services/getDeepestPathLength.js

@@ -0,0 +1,3 @@
+// src/services/getDeepestPathLength.ts
+const getDeepestPathLength = (leafIssues) => Math.max(-1, ...leafIssues.map(({ path }) => path.length));
+export { getDeepestPathLength };

package/dist/services/getDefaultModuleOptions.js

@@ -23,17 +23,12 @@ const getDefaultModuleOptions = (isDevelopment, devServerUrl, isStrict) => ({
 	nonce: true,
 	rateLimiter: false,
 	removeLoggers: false,
-	requestSizeLimiter: {
-		maxRequestSizeInBytes: 2e6,
-		maxUploadFileRequestInBytes: 8e6
-	},
+	requestSizeLimiter: { maxRequestSizeInBytes: 2e6 },
 	sri: true,
 	ssg: {
-		exportToPresets: true,
 		hashScripts: true,
 		hashStyles: false,
-		meta: true,
-		nitroHeaders: true
+		meta: true
 	},
 	strict: isStrict
 });

package/dist/services/getDefaultSecurityHeaders.js

@@ -1,6 +1,6 @@
-import { NONCE_PLACEHOLDER } from "../runtime/constants.js";
 import { CrossOriginEmbedderPolicy } from "../models/CrossOriginEmbedderPolicy.js";
 import { XFrameOptions } from "../models/XFrameOptions.js";
+import { NONCE_PLACEHOLDER } from "../runtime/constants.js";
 // src/services/getDefaultSecurityHeaders.ts
 const getDefaultSecurityHeaders = (isDevelopment, isStrict) => ({
 	contentSecurityPolicy: {

package/dist/services/getLeafIssues.js

@@ -0,0 +1,11 @@
+import { getDeepestPathLength } from "./getDeepestPathLength.js";
+// src/services/getLeafIssues.ts
+const getLeafIssues = (issue, parentPath) => {
+	const path = [...parentPath, ...issue.path];
+	if (issue.code !== "invalid_union") return [{
+		issue,
+		path
+	}];
+	return issue.errors.map((branch) => branch.flatMap((branchIssue) => getLeafIssues(branchIssue, path))).reduce((deepest, branch) => getDeepestPathLength(branch) > getDeepestPathLength(deepest) ? branch : deepest);
+};
+export { getLeafIssues };

package/dist/services/mergeDirectives.js

@@ -0,0 +1,12 @@
+import { mergeSources } from "./mergeSources.js";
+// src/services/mergeDirectives.ts
+const mergeDirectives = (defaults, overrides) => {
+	if (overrides === false || defaults === false) return overrides ?? defaults;
+	if (overrides === void 0) return defaults;
+	const merged = { ...defaults };
+	for (const [directive, value] of Object.entries(overrides)) if (value === false) delete merged[directive];
+	else if (Array.isArray(value)) merged[directive] = mergeSources(merged[directive], value);
+	else merged[directive] = value;
+	return merged;
+};
+export { mergeDirectives };

package/dist/services/mergeFeatures.js

@@ -0,0 +1,10 @@
+// src/services/mergeFeatures.ts
+const mergeFeatures = (defaults, overrides) => {
+	if (overrides === false || defaults === false) return overrides ?? defaults;
+	if (overrides === void 0) return defaults;
+	const merged = { ...defaults };
+	for (const [feature, sources] of Object.entries(overrides)) if (sources === false) delete merged[feature];
+	else merged[feature] = [.../* @__PURE__ */ new Set([...merged[feature] || [], ...sources || []])];
+	return merged;
+};
+export { mergeFeatures };

package/dist/services/mergeHeaders.js

@@ -0,0 +1,14 @@
+import { mergeDirectives } from "./mergeDirectives.js";
+import { mergeFeatures } from "./mergeFeatures.js";
+// src/services/mergeHeaders.ts
+const mergeHeaders = (defaults, overrides) => {
+	if (overrides === false || defaults === false) return overrides ?? defaults;
+	if (overrides === void 0) return defaults;
+	return {
+		...defaults,
+		...overrides,
+		contentSecurityPolicy: mergeDirectives(defaults.contentSecurityPolicy, overrides.contentSecurityPolicy),
+		permissionsPolicy: mergeFeatures(defaults.permissionsPolicy, overrides.permissionsPolicy)
+	};
+};
+export { mergeHeaders };

package/dist/services/mergeModuleOptions.js

@@ -1,3 +1,4 @@
+import { mergeHeaders } from "./mergeHeaders.js";
 // src/services/mergeModuleOptions.ts
 const mergeModuleOptions = (defaults, overrides) => ({
 	...defaults,
@@ -8,31 +9,4 @@ const mergeModuleOptions = (defaults, overrides) => ({
 		...overrides.ssg
 	}
 });
-const mergeHeaders = (defaults, overrides) => {
-	if (overrides === false || defaults === false) return overrides ?? defaults;
-	if (overrides === void 0) return defaults;
-	return {
-		...defaults,
-		...overrides,
-		contentSecurityPolicy: mergeDirectives(defaults.contentSecurityPolicy, overrides.contentSecurityPolicy),
-		permissionsPolicy: mergeFeatures(defaults.permissionsPolicy, overrides.permissionsPolicy)
-	};
-};
-const mergeDirectives = (defaults, overrides) => {
-	if (overrides === false || defaults === false) return overrides ?? defaults;
-	if (overrides === void 0) return defaults;
-	const merged = { ...defaults };
-	for (const [directive, value] of Object.entries(overrides)) if (value === false) delete merged[directive];
-	else if (Array.isArray(value)) merged[directive] = [.../* @__PURE__ */ new Set([...Array.isArray(merged[directive]) ? merged[directive] : [], ...value])];
-	else merged[directive] = value;
-	return merged;
-};
-const mergeFeatures = (defaults, overrides) => {
-	if (overrides === false || defaults === false) return overrides ?? defaults;
-	if (overrides === void 0) return defaults;
-	const merged = { ...defaults };
-	for (const [feature, sources] of Object.entries(overrides)) if (sources === false) delete merged[feature];
-	else merged[feature] = [.../* @__PURE__ */ new Set([...merged[feature] || [], ...sources || []])];
-	return merged;
-};
 export { mergeModuleOptions };

package/dist/services/mergeSources.js

@@ -0,0 +1,9 @@
+import { NONE_SOURCE } from "./constants.js";
+// src/services/mergeSources.ts
+const mergeSources = (defaultSources, sources) => {
+	if (sources.length === 1 && sources[0] === "'none'") return sources;
+	const mergedSources = /* @__PURE__ */ new Set([...Array.isArray(defaultSources) ? defaultSources : [], ...sources]);
+	if (mergedSources.size > 1) mergedSources.delete(NONE_SOURCE);
+	return [...mergedSources];
+};
+export { mergeSources };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-security-module",
-  "version": "4.3.3",
+  "version": "4.5.0",
   "description": "Nuxt security module for Nitro 3 and h3 2 — security headers, a per-request nonce Content Security Policy, subresource integrity, CORS, allowed methods, basic auth and a request size limit.",
   "license": "Apache-2.0",
   "author": "Jimmy Chen",
@@ -19,19 +19,8 @@
   },
   "exports": {
     ".": "./dist/index.js",
-    "./runtime/constants": "./dist/runtime/constants.js",
-    "./runtime/nitro/plugins/hidePoweredBy": "./dist/runtime/nitro/plugins/hidePoweredBy.js",
-    "./runtime/nitro/plugins/nonce": "./dist/runtime/nitro/plugins/nonce.js",
     "./runtime/nitro/plugins/routeRules": "./dist/runtime/nitro/plugins/routeRules.js",
-    "./runtime/nitro/plugins/securityHeaders": "./dist/runtime/nitro/plugins/securityHeaders.js",
-    "./runtime/nitro/plugins/ssgHashes": "./dist/runtime/nitro/plugins/ssgHashes.js",
-    "./runtime/nitro/plugins/subresourceIntegrity": "./dist/runtime/nitro/plugins/subresourceIntegrity.js",
-    "./runtime/server/middleware/allowedMethodsRestricter": "./dist/runtime/server/middleware/allowedMethodsRestricter.js",
-    "./runtime/server/middleware/basicAuth": "./dist/runtime/server/middleware/basicAuth.js",
-    "./runtime/server/middleware/corsHandler": "./dist/runtime/server/middleware/corsHandler.js",
-    "./runtime/server/middleware/csrf": "./dist/runtime/server/middleware/csrf.js",
     "./runtime/server/middleware/rateLimiter": "./dist/runtime/server/middleware/rateLimiter.js",
-    "./runtime/server/middleware/requestSizeLimiter": "./dist/runtime/server/middleware/requestSizeLimiter.js",
     "./package.json": "./package.json"
   },
   "scripts": {
@@ -40,7 +29,7 @@
     "lint": "eslint .",
     "lint:fix": "eslint --fix .",
     "test": "vitest",
-    "typecheck": "tsc"
+    "typecheck": "tsrs --fast"
   },
   "dependencies": {
     "@nuxt/kit": "npm:@nuxt/kit-nightly@5x",
@@ -50,16 +39,16 @@
     "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@esposter/configuration": "4.3.3",
-    "@esposter/shared-node": "4.3.3",
+    "@esposter/configuration": "4.5.0",
+    "@esposter/shared-node": "4.5.0",
     "@nuxt/nitro-server": "npm:@nuxt/nitro-server-nightly@5x",
-    "@types/node": "^26.6.5",
-    "h3": "^2.0.7",
-    "tsdown": "^0.23.1"
+    "@types/node": "^26.6.6",
+    "h3": "^2.0.8",
+    "tsdown": "^0.23.5"
   },
   "peerDependencies": {
-    "nitro": "npm:nitro-nightly@3.0.1-20261018-005730-bb9894fe",
+    "nitro": "npm:nitro-nightly@latest",
     "nuxt": "npm:nuxt-nightly@5x"
   },
-  "gitHead": "955bbc130ad9b28877fd4ae8efc73a045141ce01"
+  "gitHead": "e30c001f3b4b15693e75fb53092d62a97ade4d2b"
 }