nuxt-security-module 4.4.0 → 4.6.0

package/dist/runtime/services/serializeSecurityHeaders.js

@@ -0,0 +1,10 @@
+import { SECURITY_HEADER_NAMES } from "../constants.js";
+import { checkIsSecurityHeaderKey } from "./checkIsSecurityHeaderKey.js";
+import { serializeValue } from "./serializeValue.js";
+// src/runtime/services/serializeSecurityHeaders.ts
+const serializeSecurityHeaders = (headers) => Object.fromEntries(Object.keys(headers).flatMap((key) => {
+	if (!checkIsSecurityHeaderKey(key)) return [];
+	const value = headers[key];
+	return value === false || value === void 0 ? [] : [[SECURITY_HEADER_NAMES[key], serializeValue(key, value)]];
+}));
+export { serializeSecurityHeaders };

package/dist/runtime/services/serializeStrictTransportSecurity.d.ts

@@ -0,0 +1,2 @@
+import { StrictTransportSecurity } from "../../models/StrictTransportSecurity.js";
+export declare const serializeStrictTransportSecurity: (policy: StrictTransportSecurity) => string;

package/dist/runtime/services/serializeStrictTransportSecurity.js

@@ -0,0 +1,7 @@
+// src/runtime/services/serializeStrictTransportSecurity.ts
+const serializeStrictTransportSecurity = (policy) => [
+	`max-age=${policy.maxAge}`,
+	policy.includeSubdomains && "includeSubDomains",
+	policy.preload && "preload"
+].filter(Boolean).join("; ");
+export { serializeStrictTransportSecurity };

package/dist/runtime/services/serializeValue.d.ts

@@ -0,0 +1 @@
+export declare const serializeValue: (key: string, value: unknown) => string;

package/dist/runtime/services/serializeValue.js

@@ -0,0 +1,11 @@
+import { serializeContentSecurityPolicy } from "./serializeContentSecurityPolicy.js";
+import { serializePermissionsPolicy } from "./serializePermissionsPolicy.js";
+import { serializeStrictTransportSecurity } from "./serializeStrictTransportSecurity.js";
+// src/runtime/services/serializeValue.ts
+const serializeValue = (key, value) => {
+	if (key === "contentSecurityPolicy") return serializeContentSecurityPolicy(value);
+	if (key === "permissionsPolicy") return serializePermissionsPolicy(value);
+	if (key === "strictTransportSecurity") return serializeStrictTransportSecurity(value);
+	return String(value);
+};
+export { serializeValue };

package/dist/runtime/services/stripHtmlTagAttribute.d.ts

@@ -0,0 +1 @@
+export declare const stripHtmlTagAttribute: (attributes: string, attributeName: string) => string;

package/dist/runtime/services/stripHtmlTagAttribute.js

@@ -0,0 +1,4 @@
+import { HTML_ATTRIBUTE_REGEX } from "../constants.js";
+// src/runtime/services/stripHtmlTagAttribute.ts
+const stripHtmlTagAttribute = (attributes, attributeName) => attributes.replace(HTML_ATTRIBUTE_REGEX, (token, name) => name.toLowerCase() === attributeName ? "" : token);
+export { stripHtmlTagAttribute };

package/dist/runtime/services/unquote.d.ts

@@ -0,0 +1 @@
+export declare const unquote: (value: string) => string;

package/dist/runtime/services/unquote.js

@@ -0,0 +1,3 @@
+// src/runtime/services/unquote.ts
+const unquote = (value) => value.replace(/^(?<quote>["'])(?<inner>.*)\k<quote>$/su, "$<inner>");
+export { unquote };

package/dist/runtime/services/updateContentSecurityPolicy.d.ts

@@ -0,0 +1,3 @@
+import { ContentSecurityPolicy } from "../../models/ContentSecurityPolicy.js";
+import { SecurityState } from "./getSecurityState.js";
+export declare const updateContentSecurityPolicy: (policy: ContentSecurityPolicy, { hashes, nonce }: SecurityState) => ContentSecurityPolicy;

package/dist/runtime/services/updateContentSecurityPolicy.js

@@ -0,0 +1,14 @@
+import { NONCE_PLACEHOLDER } from "../constants.js";
+import { checkIsStaticNonce } from "./checkIsStaticNonce.js";
+// src/runtime/services/updateContentSecurityPolicy.ts
+const SCRIPT_DIRECTIVES = /* @__PURE__ */ new Set(["script-src", "script-src-elem"]);
+const STYLE_DIRECTIVES = /* @__PURE__ */ new Set(["style-src", "style-src-elem"]);
+const updateContentSecurityPolicy = (policy, { hashes, nonce }) => Object.fromEntries(Object.keys(policy).map((directive) => {
+	const value = policy[directive];
+	if (!Array.isArray(value)) return [directive, value];
+	const sources = value.filter((source) => !checkIsStaticNonce(source)).map((source) => source === "'nonce-{{nonce}}'" && nonce ? `'nonce-${nonce}'` : source).filter((source) => source !== NONCE_PLACEHOLDER);
+	if (SCRIPT_DIRECTIVES.has(directive)) sources.push(...hashes.script);
+	if (STYLE_DIRECTIVES.has(directive)) sources.push(...hashes.style);
+	return [directive, sources];
+}));
+export { updateContentSecurityPolicy };

package/dist/schemas/allowedMethodsRestricterOptionsSchema.js

@@ -0,0 +1,4 @@
+import { z } from "zod";
+// src/schemas/allowedMethodsRestricterOptionsSchema.ts
+const allowedMethodsRestricterOptionsSchema = z.strictObject({ methods: z.array(z.string().min(1)).min(1) });
+export { allowedMethodsRestricterOptionsSchema };

package/dist/schemas/basicAuthOptionsSchema.js

@@ -0,0 +1,11 @@
+import { z } from "zod";
+// src/schemas/basicAuthOptionsSchema.ts
+const pathSchema = z.string().startsWith("/");
+const basicAuthOptionsSchema = z.strictObject({
+	exclude: z.array(pathSchema).optional(),
+	include: z.array(pathSchema).optional(),
+	message: z.string().optional(),
+	name: z.string().min(1),
+	pass: z.string().min(1)
+});
+export { basicAuthOptionsSchema };

package/dist/schemas/contentSecurityPolicySchema.js

@@ -0,0 +1,4 @@
+import { z } from "zod";
+// src/schemas/contentSecurityPolicySchema.ts
+const contentSecurityPolicySchema = z.record(z.string().min(1), z.union([z.boolean(), z.array(z.string().min(1))]).optional());
+export { contentSecurityPolicySchema };

package/dist/schemas/corsHandlerOptionsSchema.js

@@ -0,0 +1,13 @@
+import { z } from "zod";
+// src/schemas/corsHandlerOptionsSchema.ts
+const headerNameSchema = z.string().regex(/^[\w-]+$/u);
+const corsHandlerOptionsSchema = z.strictObject({
+	allowHeaders: z.array(headerNameSchema).optional(),
+	credentials: z.boolean().optional(),
+	exposeHeaders: z.array(headerNameSchema).optional(),
+	maxAge: z.string().regex(/^\d+$/u).optional(),
+	methods: z.array(z.string().min(1)).min(1),
+	origin: z.union([z.url(), z.array(z.url())]),
+	preflight: z.strictObject({ statusCode: z.int().min(200).max(299) }).optional()
+});
+export { corsHandlerOptionsSchema };

package/dist/schemas/csrfOptionsSchema.js

@@ -0,0 +1,8 @@
+import { z } from "zod";
+// src/schemas/csrfOptionsSchema.ts
+const tokenNameSchema = z.string().regex(/^[\w-]+$/u, "must be letters, digits, underscores or hyphens");
+const csrfOptionsSchema = z.strictObject({
+	cookieName: tokenNameSchema,
+	headerName: tokenNameSchema
+});
+export { csrfOptionsSchema };

package/dist/schemas/moduleOptionsSchema.js

@@ -0,0 +1,28 @@
+import { allowedMethodsRestricterOptionsSchema } from "./allowedMethodsRestricterOptionsSchema.js";
+import { basicAuthOptionsSchema } from "./basicAuthOptionsSchema.js";
+import { corsHandlerOptionsSchema } from "./corsHandlerOptionsSchema.js";
+import { csrfOptionsSchema } from "./csrfOptionsSchema.js";
+import { rateLimiterOptionsSchema } from "./rateLimiterOptionsSchema.js";
+import { requestSizeLimiterOptionsSchema } from "./requestSizeLimiterOptionsSchema.js";
+import { securityHeadersSchema } from "./securityHeadersSchema.js";
+import { ssgOptionsSchema } from "./ssgOptionsSchema.js";
+import { z } from "zod";
+// src/schemas/moduleOptionsSchema.ts
+const moduleOptionsSchema = z.strictObject({
+	allowedMethodsRestricter: z.union([allowedMethodsRestricterOptionsSchema, z.literal(false)]),
+	basicAuth: z.union([basicAuthOptionsSchema, z.literal(false)]),
+	contentSecurityPolicyReportOnly: z.boolean(),
+	corsHandler: z.union([corsHandlerOptionsSchema, z.literal(false)]),
+	csrf: z.union([csrfOptionsSchema, z.literal(false)]),
+	enabled: z.boolean(),
+	headers: z.union([securityHeadersSchema, z.literal(false)]),
+	hidePoweredBy: z.boolean(),
+	nonce: z.boolean(),
+	rateLimiter: z.union([rateLimiterOptionsSchema, z.literal(false)]),
+	removeLoggers: z.boolean(),
+	requestSizeLimiter: z.union([requestSizeLimiterOptionsSchema, z.literal(false)]),
+	sri: z.boolean(),
+	ssg: z.union([ssgOptionsSchema, z.literal(false)]),
+	strict: z.boolean()
+});
+export { moduleOptionsSchema };

package/dist/schemas/permissionsPolicySchema.js

@@ -0,0 +1,4 @@
+import { z } from "zod";
+// src/schemas/permissionsPolicySchema.ts
+const permissionsPolicySchema = z.record(z.string().min(1), z.union([z.literal(false), z.array(z.string().min(1))]).optional());
+export { permissionsPolicySchema };

package/dist/schemas/rateLimiterOptionsSchema.js

@@ -0,0 +1,7 @@
+import { z } from "zod";
+// src/schemas/rateLimiterOptionsSchema.ts
+const rateLimiterOptionsSchema = z.strictObject({
+	intervalInMilliseconds: z.int("must be a whole number of milliseconds").positive("must be more than zero milliseconds"),
+	tokensPerInterval: z.int("must be a whole number of requests").positive("must allow at least one request")
+});
+export { rateLimiterOptionsSchema };

package/dist/schemas/requestSizeLimiterOptionsSchema.js

@@ -0,0 +1,4 @@
+import { z } from "zod";
+// src/schemas/requestSizeLimiterOptionsSchema.ts
+const requestSizeLimiterOptionsSchema = z.strictObject({ maxRequestSizeInBytes: z.int("must be a whole number of bytes").positive("must be more than zero bytes") });
+export { requestSizeLimiterOptionsSchema };

package/dist/schemas/securityHeadersSchema.js

@@ -0,0 +1,23 @@
+import { CrossOriginEmbedderPolicy } from "../models/CrossOriginEmbedderPolicy.js";
+import { XFrameOptions } from "../models/XFrameOptions.js";
+import { contentSecurityPolicySchema } from "./contentSecurityPolicySchema.js";
+import { permissionsPolicySchema } from "./permissionsPolicySchema.js";
+import { strictTransportSecurityOptionsSchema } from "./strictTransportSecurityOptionsSchema.js";
+import { z } from "zod";
+// src/schemas/securityHeadersSchema.ts
+const headerValueSchema = z.string().min(1);
+const securityHeadersSchema = z.strictObject({
+	contentSecurityPolicy: z.union([contentSecurityPolicySchema, z.literal(false)]).optional(),
+	crossOriginEmbedderPolicy: z.union([z.enum(CrossOriginEmbedderPolicy), z.literal(false)]).optional(),
+	crossOriginOpenerPolicy: z.union([headerValueSchema, z.literal(false)]).optional(),
+	crossOriginResourcePolicy: z.union([headerValueSchema, z.literal(false)]).optional(),
+	originAgentCluster: z.union([headerValueSchema, z.literal(false)]).optional(),
+	permissionsPolicy: z.union([permissionsPolicySchema, z.literal(false)]).optional(),
+	referrerPolicy: z.union([headerValueSchema, z.literal(false)]).optional(),
+	strictTransportSecurity: z.union([strictTransportSecurityOptionsSchema, z.literal(false)]).optional(),
+	xContentTypeOptions: z.union([headerValueSchema, z.literal(false)]).optional(),
+	xDNSPrefetchControl: z.union([headerValueSchema, z.literal(false)]).optional(),
+	xFrameOptions: z.union([z.enum(XFrameOptions), z.literal(false)]).optional(),
+	xPermittedCrossDomainPolicies: z.union([headerValueSchema, z.literal(false)]).optional()
+});
+export { securityHeadersSchema };

package/dist/schemas/ssgOptionsSchema.js

@@ -0,0 +1,8 @@
+import { z } from "zod";
+// src/schemas/ssgOptionsSchema.ts
+const ssgOptionsSchema = z.strictObject({
+	hashScripts: z.boolean(),
+	hashStyles: z.boolean(),
+	meta: z.boolean()
+});
+export { ssgOptionsSchema };

package/dist/schemas/strictTransportSecurityOptionsSchema.js

@@ -0,0 +1,8 @@
+import { z } from "zod";
+// src/schemas/strictTransportSecurityOptionsSchema.ts
+const strictTransportSecurityOptionsSchema = z.strictObject({
+	includeSubdomains: z.boolean(),
+	maxAge: z.int().nonnegative(),
+	preload: z.boolean()
+});
+export { strictTransportSecurityOptionsSchema };

package/dist/services/computeSubresourceIntegrityHashes.js

@@ -0,0 +1,23 @@
+import { SRI_HASH_ALGORITHM } from "../runtime/constants.js";
+import { generateHash } from "../runtime/services/generateHash.js";
+import { existsSync } from "node:fs";
+import { readFile, readdir } from "node:fs/promises";
+import { join, posix, relative, sep } from "node:path";
+// src/services/computeSubresourceIntegrityHashes.ts
+const computeSubresourceIntegrityHashes = async (nitro) => {
+	const { baseURL: appBaseUrl, cdnURL: appCdnUrl } = nitro.options.runtimeConfig.app;
+	const { publicDir } = nitro.options.output;
+	if (!existsSync(publicDir)) return {};
+	const entries = await readdir(publicDir, {
+		recursive: true,
+		withFileTypes: true
+	});
+	const hashEntries = await Promise.all(entries.filter((entry) => entry.isFile()).map(async (entry) => {
+		const filePath = join(entry.parentPath, entry.name);
+		const hash = await generateHash(await readFile(filePath), SRI_HASH_ALGORITHM);
+		const fullPath = posix.join(...relative(publicDir, filePath).split(sep));
+		return [appCdnUrl ? new URL(fullPath, appCdnUrl.endsWith("/") ? appCdnUrl : `${appCdnUrl}/`).href : posix.join("/", appBaseUrl, fullPath), hash];
+	}));
+	return Object.fromEntries(hashEntries);
+};
+export { computeSubresourceIntegrityHashes };

package/dist/services/constants.js

@@ -0,0 +1,3 @@
+// src/services/constants.ts
+const NONE_SOURCE = "'none'";
+export { NONE_SOURCE };

package/dist/services/formatLeafIssue.js

@@ -0,0 +1,5 @@
+// src/services/formatLeafIssue.ts
+const formatLeafIssue = ({ issue, path }) => {
+	return `${path.map(String).join(".") || "(options)"}: ${issue.message}`;
+};
+export { formatLeafIssue };

package/dist/services/formatZodIssues.js

@@ -0,0 +1,5 @@
+import { formatLeafIssue } from "./formatLeafIssue.js";
+import { getLeafIssues } from "./getLeafIssues.js";
+// src/services/formatZodIssues.ts
+const formatZodIssues = (issues) => issues.flatMap((issue) => getLeafIssues(issue, [])).map((leafIssue) => formatLeafIssue(leafIssue)).join("; ");
+export { formatZodIssues };

package/dist/services/getDeepestPathLength.js

@@ -0,0 +1,3 @@
+// src/services/getDeepestPathLength.ts
+const getDeepestPathLength = (leafIssues) => Math.max(-1, ...leafIssues.map(({ path }) => path.length));
+export { getDeepestPathLength };

package/dist/services/getDefaultModuleOptions.js

@@ -0,0 +1,35 @@
+import { getDefaultSecurityHeaders } from "./getDefaultSecurityHeaders.js";
+// src/services/getDefaultModuleOptions.ts
+const getDefaultModuleOptions = (isDevelopment, devServerUrl, isStrict) => ({
+	allowedMethodsRestricter: false,
+	basicAuth: false,
+	contentSecurityPolicyReportOnly: false,
+	corsHandler: {
+		methods: [
+			"GET",
+			"HEAD",
+			"PUT",
+			"PATCH",
+			"POST",
+			"DELETE"
+		],
+		origin: devServerUrl,
+		preflight: { statusCode: 204 }
+	},
+	csrf: false,
+	enabled: true,
+	headers: getDefaultSecurityHeaders(isDevelopment, isStrict),
+	hidePoweredBy: true,
+	nonce: true,
+	rateLimiter: false,
+	removeLoggers: false,
+	requestSizeLimiter: { maxRequestSizeInBytes: 2e6 },
+	sri: true,
+	ssg: {
+		hashScripts: true,
+		hashStyles: false,
+		meta: true
+	},
+	strict: isStrict
+});
+export { getDefaultModuleOptions };

package/dist/services/getDefaultSecurityHeaders.js

@@ -0,0 +1,83 @@
+import { CrossOriginEmbedderPolicy } from "../models/CrossOriginEmbedderPolicy.js";
+import { XFrameOptions } from "../models/XFrameOptions.js";
+import { NONCE_PLACEHOLDER } from "../runtime/constants.js";
+// src/services/getDefaultSecurityHeaders.ts
+const getDefaultSecurityHeaders = (isDevelopment, isStrict) => ({
+	contentSecurityPolicy: {
+		"base-uri": ["'none'"],
+		"default-src": ["'self'"],
+		"font-src": [
+			"'self'",
+			"https:",
+			"data:"
+		],
+		"form-action": ["'self'"],
+		"frame-ancestors": ["'self'"],
+		"img-src": ["'self'", "data:"],
+		"object-src": ["'none'"],
+		"script-src": isStrict ? [
+			"'self'",
+			"'strict-dynamic'",
+			NONCE_PLACEHOLDER
+		] : [
+			"'self'",
+			"https:",
+			"'unsafe-inline'",
+			"'strict-dynamic'",
+			NONCE_PLACEHOLDER
+		],
+		"script-src-attr": ["'none'"],
+		"style-src": [
+			"'self'",
+			"https:",
+			"'unsafe-inline'"
+		],
+		"upgrade-insecure-requests": true
+	},
+	crossOriginEmbedderPolicy: isDevelopment ? CrossOriginEmbedderPolicy.UnsafeNone : CrossOriginEmbedderPolicy.Credentialless,
+	crossOriginOpenerPolicy: "same-origin",
+	crossOriginResourcePolicy: "same-origin",
+	originAgentCluster: "?1",
+	permissionsPolicy: {
+		accelerometer: [],
+		autoplay: [],
+		camera: [],
+		"clipboard-read": [],
+		"clipboard-write": [],
+		"cross-origin-isolated": [],
+		"display-capture": [],
+		"encrypted-media": [],
+		fullscreen: [],
+		gamepad: [],
+		geolocation: [],
+		gyroscope: [],
+		hid: [],
+		"idle-detection": [],
+		"interest-cohort": [],
+		"keyboard-map": [],
+		magnetometer: [],
+		microphone: [],
+		midi: [],
+		payment: [],
+		"picture-in-picture": [],
+		"publickey-credentials-get": [],
+		"screen-wake-lock": [],
+		serial: [],
+		"sync-xhr": ["self"],
+		unload: [],
+		usb: [],
+		"web-share": [],
+		"xr-spatial-tracking": []
+	},
+	referrerPolicy: "no-referrer",
+	strictTransportSecurity: {
+		includeSubdomains: true,
+		maxAge: 63072e3,
+		preload: false
+	},
+	xContentTypeOptions: "nosniff",
+	xDNSPrefetchControl: "off",
+	xFrameOptions: XFrameOptions.SameOrigin,
+	xPermittedCrossDomainPolicies: "none"
+});
+export { getDefaultSecurityHeaders };

package/dist/services/getLeafIssues.js

@@ -0,0 +1,11 @@
+import { getDeepestPathLength } from "./getDeepestPathLength.js";
+// src/services/getLeafIssues.ts
+const getLeafIssues = (issue, parentPath) => {
+	const path = [...parentPath, ...issue.path];
+	if (issue.code !== "invalid_union") return [{
+		issue,
+		path
+	}];
+	return issue.errors.map((branch) => branch.flatMap((branchIssue) => getLeafIssues(branchIssue, path))).reduce((deepest, branch) => getDeepestPathLength(branch) > getDeepestPathLength(deepest) ? branch : deepest);
+};
+export { getLeafIssues };

package/dist/services/getPluginTemplate.js

@@ -0,0 +1,9 @@
+// src/services/getPluginTemplate.ts
+const getPluginTemplate = (factoryPath, factoryName, dataPath) => [
+	`import { ${factoryName} } from ${JSON.stringify(factoryPath)};`,
+	`import data from ${JSON.stringify(dataPath)};`,
+	"",
+	`export default ${factoryName}(data);`,
+	""
+].join("\n");
+export { getPluginTemplate };

package/dist/services/getRemoveLoggersViteConfig.js

@@ -0,0 +1,3 @@
+// src/services/getRemoveLoggersViteConfig.ts
+const getRemoveLoggersViteConfig = () => ({ build: { rolldownOptions: { output: { minify: { compress: { dropConsole: true } } } } } });
+export { getRemoveLoggersViteConfig };

package/dist/services/getRouteRulesTemplate.js

@@ -0,0 +1,3 @@
+// src/services/getRouteRulesTemplate.ts
+const getRouteRulesTemplate = (routes) => `export default ${JSON.stringify(routes)}\n`;
+export { getRouteRulesTemplate };

package/dist/services/getRouteSecurityRules.js

@@ -0,0 +1,16 @@
+import { moduleOptionsSchema } from "../schemas/moduleOptionsSchema.js";
+import { formatZodIssues } from "./formatZodIssues.js";
+import { mergeModuleOptions } from "./mergeModuleOptions.js";
+// src/services/getRouteSecurityRules.ts
+const getRouteSecurityRules = (routeRules, options) => {
+	const routeSecurityRules = {};
+	for (const [route, { security }] of Object.entries(routeRules)) {
+		if (security === void 0) continue;
+		if (Object.hasOwn(security, "basicAuth")) throw new TypeError(`nuxt-security-module: route ${route}: basicAuth cannot be set in a route rule`);
+		const result = moduleOptionsSchema.safeParse(mergeModuleOptions(options, security));
+		if (!result.success) throw new TypeError(`nuxt-security-module: route ${route}: ${formatZodIssues(result.error.issues)}`);
+		routeSecurityRules[route] = security;
+	}
+	return routeSecurityRules;
+};
+export { getRouteSecurityRules };

package/dist/services/getStaticResourceHeaders.js

@@ -0,0 +1,10 @@
+import { serializeSecurityHeaders } from "../runtime/services/serializeSecurityHeaders.js";
+// src/services/getStaticResourceHeaders.ts
+const getStaticResourceHeaders = (headers) => serializeSecurityHeaders({
+	referrerPolicy: headers.referrerPolicy,
+	strictTransportSecurity: headers.strictTransportSecurity,
+	xContentTypeOptions: headers.xContentTypeOptions,
+	xFrameOptions: headers.xFrameOptions,
+	xPermittedCrossDomainPolicies: headers.xPermittedCrossDomainPolicies
+});
+export { getStaticResourceHeaders };

package/dist/services/getTypeTemplate.js

@@ -0,0 +1,24 @@
+import { MODULE_NAME, ROUTE_RULES_HOOK } from "../runtime/constants.js";
+// src/services/getTypeTemplate.ts
+const getTypeTemplate = () => `// Generated by ${MODULE_NAME}
+import type { ModuleOptions } from '${MODULE_NAME}'
+
+declare module '#${MODULE_NAME}/route-rules.mjs' {
+  const routeRules: Record<string, Partial<ModuleOptions>>
+  export default routeRules
+}
+
+declare module '#${MODULE_NAME}/sri-hashes.mjs' {
+  const sriHashes: Record<string, string>
+  export default sriHashes
+}
+
+declare module 'nitro/types' {
+  interface NitroRuntimeHooks {
+    '${ROUTE_RULES_HOOK}': (routeRules: Record<string, Partial<ModuleOptions>>) => void | Promise<void>
+  }
+}
+
+export {}
+`;
+export { getTypeTemplate };

package/dist/services/mergeDirectives.js

@@ -0,0 +1,12 @@
+import { mergeSources } from "./mergeSources.js";
+// src/services/mergeDirectives.ts
+const mergeDirectives = (defaults, overrides) => {
+	if (overrides === false || defaults === false) return overrides ?? defaults;
+	if (overrides === void 0) return defaults;
+	const merged = { ...defaults };
+	for (const [directive, value] of Object.entries(overrides)) if (value === false) delete merged[directive];
+	else if (Array.isArray(value)) merged[directive] = mergeSources(merged[directive], value);
+	else merged[directive] = value;
+	return merged;
+};
+export { mergeDirectives };

package/dist/services/mergeFeatures.js

@@ -0,0 +1,10 @@
+// src/services/mergeFeatures.ts
+const mergeFeatures = (defaults, overrides) => {
+	if (overrides === false || defaults === false) return overrides ?? defaults;
+	if (overrides === void 0) return defaults;
+	const merged = { ...defaults };
+	for (const [feature, sources] of Object.entries(overrides)) if (sources === false) delete merged[feature];
+	else merged[feature] = [.../* @__PURE__ */ new Set([...merged[feature] || [], ...sources || []])];
+	return merged;
+};
+export { mergeFeatures };

package/dist/services/mergeHeaders.js

@@ -0,0 +1,14 @@
+import { mergeDirectives } from "./mergeDirectives.js";
+import { mergeFeatures } from "./mergeFeatures.js";
+// src/services/mergeHeaders.ts
+const mergeHeaders = (defaults, overrides) => {
+	if (overrides === false || defaults === false) return overrides ?? defaults;
+	if (overrides === void 0) return defaults;
+	return {
+		...defaults,
+		...overrides,
+		contentSecurityPolicy: mergeDirectives(defaults.contentSecurityPolicy, overrides.contentSecurityPolicy),
+		permissionsPolicy: mergeFeatures(defaults.permissionsPolicy, overrides.permissionsPolicy)
+	};
+};
+export { mergeHeaders };

package/dist/services/mergeModuleOptions.js

@@ -0,0 +1,12 @@
+import { mergeHeaders } from "./mergeHeaders.js";
+// src/services/mergeModuleOptions.ts
+const mergeModuleOptions = (defaults, overrides) => ({
+	...defaults,
+	...overrides,
+	headers: mergeHeaders(defaults.headers, overrides.headers),
+	ssg: overrides.ssg === false ? false : {
+		...defaults.ssg,
+		...overrides.ssg
+	}
+});
+export { mergeModuleOptions };

package/dist/services/mergeSources.js

@@ -0,0 +1,9 @@
+import { NONE_SOURCE } from "./constants.js";
+// src/services/mergeSources.ts
+const mergeSources = (defaultSources, sources) => {
+	if (sources.length === 1 && sources[0] === "'none'") return sources;
+	const mergedSources = /* @__PURE__ */ new Set([...Array.isArray(defaultSources) ? defaultSources : [], ...sources]);
+	if (mergedSources.size > 1) mergedSources.delete(NONE_SOURCE);
+	return [...mergedSources];
+};
+export { mergeSources };

package/dist/services/parseModuleOptions.js

@@ -0,0 +1,9 @@
+import { moduleOptionsSchema } from "../schemas/moduleOptionsSchema.js";
+import { formatZodIssues } from "./formatZodIssues.js";
+// src/services/parseModuleOptions.ts
+const parseModuleOptions = (options) => {
+	const result = moduleOptionsSchema.safeParse(options);
+	if (!result.success) throw new TypeError(`nuxt-security-module: ${formatZodIssues(result.error.issues)}`);
+	return result.data;
+};
+export { parseModuleOptions };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-security-module",
-  "version": "4.4.0",
+  "version": "4.6.0",
   "description": "Nuxt security module for Nitro 3 and h3 2 — security headers, a per-request nonce Content Security Policy, subresource integrity, CORS, allowed methods, basic auth and a request size limit.",
   "license": "Apache-2.0",
   "author": "Jimmy Chen",
@@ -39,16 +39,16 @@
     "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@esposter/configuration": "4.4.0",
-    "@esposter/shared-node": "4.4.0",
+    "@esposter/configuration": "4.6.0",
+    "@esposter/shared-node": "4.6.0",
     "@nuxt/nitro-server": "npm:@nuxt/nitro-server-nightly@5x",
     "@types/node": "^26.6.6",
     "h3": "^2.0.8",
-    "tsdown": "0.23.2"
+    "tsdown": "^0.23.7"
   },
   "peerDependencies": {
     "nitro": "npm:nitro-nightly@latest",
     "nuxt": "npm:nuxt-nightly@5x"
   },
-  "gitHead": "e1a416c4b91da69cc2aa259b50a4d656f204d272"
+  "gitHead": "0ceea3ffbe12ca69413ea5db2d3cfad197a63cba"
 }