{"_id":"@bernierllc/validators-header-policy","_rev":"7-a05db3a4ffec21f49fa636c2b8313a23","name":"@bernierllc/validators-header-policy","dist-tags":{"latest":"1.6.0"},"versions":{"1.0.1":{"name":"@bernierllc/validators-header-policy","version":"1.0.1","keywords":["validator","security","http-headers","csp","hsts","cors","x-frame-options","security-headers","content-security-policy","referrer-policy","permissions-policy","primitive"],"author":{"name":"Bernier LLC"},"license":"UNLICENSED","_id":"@bernierllc/validators-header-policy@1.0.1","maintainers":[{"name":"alikhan410","email":"mczeyo@gmail.com"},{"name":"mkbernier","email":"mkbernier@gmail.com"}],"dist":{"shasum":"ac4b49fc98872fd56ef8580e3cb186821f5644c7","tarball":"https://registry.npmjs.org/@bernierllc/validators-header-policy/-/validators-header-policy-1.0.1.tgz","fileCount":38,"integrity":"sha512-k0qfBqXVoWclg14V0KkrLeeve4O/I5jzW/bQR+lTuW49593CAPspcQbOIaZ5gAwiCzIehwgYaJEuzp/TW6UDdw==","signatures":[{"sig":"MEYCIQDWP+Pd2ALvA3yk39CzV41DY3EFPwngYRhCc3c05fBQmgIhAILNRiRWzFTjUivgO8qwERmu22ZF/b0aIx8LqUEQFM8N","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":106979},"main":"dist/index.js","type":"module","types":"dist/index.d.ts","gitHead":"723019a41a9147794882664b648d778a1b9766cf","scripts":{"lint":"eslint src --ext .ts","test":"jest","build":"tsc","clean":"rm -rf dist","test:watch":"jest --watch","test:coverage":"jest --coverage","prepublishOnly":"npm run clean && npm run build && rm -rf dist/__tests__"},"_npmUser":{"name":"mkbernier","email":"mkbernier@gmail.com"},"_npmVersion":"11.4.2","description":"Primitive validator for HTTP security header policy validation (CSP, HSTS, CORS, security headers)","directories":{},"_nodeVersion":"24.4.1","dependencies":{"@bernierllc/validators-core":"^0.1.1"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"jest":"^29.5.0","eslint":"^8.0.0","ts-jest":"^29.1.0","typescript":"^5.0.0","@types/jest":"^29.5.0","@types/node":"^20.0.0","@typescript-eslint/parser":"^6.0.0","@typescript-eslint/eslint-plugin":"^6.0.0"},"_npmOperationalInternal":{"tmp":"tmp/validators-header-policy_1.0.1_1760037243754_0.29243565296657925","host":"s3://npm-registry-packages-npm-production"}},"1.2.0":{"name":"@bernierllc/validators-header-policy","version":"1.2.0","keywords":["validator","security","http-headers","csp","hsts","cors","x-frame-options","security-headers","content-security-policy","referrer-policy","permissions-policy","primitive"],"author":{"name":"Bernier LLC"},"license":"UNLICENSED","_id":"@bernierllc/validators-header-policy@1.2.0","maintainers":[{"name":"alikhan410","email":"mczeyo@gmail.com"},{"name":"mkbernier","email":"mkbernier@gmail.com"}],"dist":{"shasum":"716dfa107377429667cda6361267f53ad17a8302","tarball":"https://registry.npmjs.org/@bernierllc/validators-header-policy/-/validators-header-policy-1.2.0.tgz","fileCount":38,"integrity":"sha512-TVx8+Yy+cMqpoogVJs3d4RdTvFUa6hB5qpYgQwIl43Dywcw2/EyKVPLt93/pYuJ+W1D2f2q5b7I0rIyqRnpmgA==","signatures":[{"sig":"MEUCIQDTknH/bcPcdLvnN/DcT66cG1ii0UKQVQU+7Z7egd6b0gIgDSThbfyOv66qpk/qJV1g/IoHE4MM93/E0lqjHu2g7yk=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":107082},"main":"dist/index.js","type":"module","types":"dist/index.d.ts","gitHead":"af7e74b3715d56d3a193e1bb6743b337c2b0df6d","scripts":{"lint":"eslint src --ext .ts","test":"jest","build":"tsc","clean":"rm -rf dist","test:watch":"jest --watch","test:coverage":"jest --coverage","prepublishOnly":"npm run clean && npm run build && rm -rf dist/__tests__"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:0e9ea35b-520a-4f58-bd82-459fa613d888"}},"_npmVersion":"lerna/9.0.3/node@v20.19.6+x64 (linux)","description":"Primitive validator for HTTP security header policy validation (CSP, HSTS, CORS, security headers)","directories":{},"_nodeVersion":"20.19.6","dependencies":{"@bernierllc/validators-core":"0.1.2"},"publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"_hasShrinkwrap":false,"devDependencies":{"jest":"^29.5.0","eslint":"^8.0.0","ts-jest":"^29.1.0","typescript":"^5.0.0","@types/jest":"^29.5.0","@types/node":"^20.0.0","@typescript-eslint/parser":"^6.0.0","@typescript-eslint/eslint-plugin":"^6.0.0"},"_npmOperationalInternal":{"tmp":"tmp/validators-header-policy_1.2.0_1767642365433_0.8351612765627989","host":"s3://npm-registry-packages-npm-production"}},"1.2.1":{"name":"@bernierllc/validators-header-policy","version":"1.2.1","keywords":["validator","security","http-headers","csp","hsts","cors","x-frame-options","security-headers","content-security-policy","referrer-policy","permissions-policy","primitive"],"author":{"name":"Bernier LLC"},"license":"UNLICENSED","_id":"@bernierllc/validators-header-policy@1.2.1","maintainers":[{"name":"alikhan410","email":"mczeyo@gmail.com"},{"name":"mkbernier","email":"mkbernier@gmail.com"}],"dist":{"shasum":"9d0f9b723d17bfd29bcc238987ad81b55f2e1db7","tarball":"https://registry.npmjs.org/@bernierllc/validators-header-policy/-/validators-header-policy-1.2.1.tgz","fileCount":38,"integrity":"sha512-s9SuezTA8iAeqV59MIZqkTI+hWAYI1WkhBvmS2nBw1mt7TQEb6XF9hD6Q9JPeap8ypu6zkaHl8Plu8rSSkMN5g==","signatures":[{"sig":"MEYCIQCf/fbzyXxfmPGqfD+D7nP90cjQIiMSXCkfyEWcqqWiAgIhAMIOJsftqfBwkoG+FgR3axnmLXqP9I1mXIhzr8UUEici","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":106943},"main":"dist/index.js","type":"module","_from":"file:bernierllc-validators-header-policy-1.2.1.tgz","types":"dist/index.d.ts","scripts":{"lint":"eslint src --ext .ts","test":"jest","build":"tsc","clean":"rm -rf dist","test:watch":"jest --watch","test:coverage":"jest --coverage"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:0e9ea35b-520a-4f58-bd82-459fa613d888"}},"_resolved":"/tmp/1c96d2a4cd363b644ce312e26302eb41/bernierllc-validators-header-policy-1.2.1.tgz","_integrity":"sha512-s9SuezTA8iAeqV59MIZqkTI+hWAYI1WkhBvmS2nBw1mt7TQEb6XF9hD6Q9JPeap8ypu6zkaHl8Plu8rSSkMN5g==","_npmVersion":"11.11.0","description":"Primitive validator for HTTP security header policy validation (CSP, HSTS, CORS, security headers)","directories":{},"_nodeVersion":"20.20.0","dependencies":{"@bernierllc/validators-core":"0.1.3"},"publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"_hasShrinkwrap":false,"devDependencies":{"jest":"^29.5.0","eslint":"^8.0.0","ts-jest":"^29.1.0","typescript":"^5.0.0","@types/jest":"^29.5.0","@types/node":"^20.0.0","@typescript-eslint/parser":"^6.0.0","@typescript-eslint/eslint-plugin":"^6.0.0"},"_npmOperationalInternal":{"tmp":"tmp/validators-header-policy_1.2.1_1773078289147_0.28739109107011895","host":"s3://npm-registry-packages-npm-production"}},"1.2.2":{"name":"@bernierllc/validators-header-policy","version":"1.2.2","keywords":["validator","security","http-headers","csp","hsts","cors","x-frame-options","security-headers","content-security-policy","referrer-policy","permissions-policy","primitive"],"author":{"name":"Bernier LLC"},"license":"UNLICENSED","_id":"@bernierllc/validators-header-policy@1.2.2","maintainers":[{"name":"alikhan410","email":"mczeyo@gmail.com"},{"name":"mkbernier","email":"mkbernier@gmail.com"}],"dist":{"shasum":"c995897f1f7cf6c76618fc0fafbf9947de6d68a7","tarball":"https://registry.npmjs.org/@bernierllc/validators-header-policy/-/validators-header-policy-1.2.2.tgz","fileCount":38,"integrity":"sha512-9FaSF77gBOsUkmMRH/NniHhoemGH9njy5hy9BeDnn1WuW6lkn5UewJ+xWmuzf95bWt/qIVg9vFS/nzja8Fqjlg==","signatures":[{"sig":"MEYCIQCGh+3U68QHTWJbtvsvbwqLYrKiNvAvat9/jzXSLCaPMAIhAKuyySrTkFJlSxhAj0vG5Xd7BXtvYpBEQ1CrCihydgmB","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":106943},"main":"dist/index.js","type":"module","_from":"file:bernierllc-validators-header-policy-1.2.2.tgz","types":"dist/index.d.ts","scripts":{"lint":"eslint src --ext .ts","test":"jest","build":"tsc","clean":"rm -rf dist","test:watch":"jest --watch","test:coverage":"jest --coverage"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:0e9ea35b-520a-4f58-bd82-459fa613d888"}},"_resolved":"/home/runner/work/tools/tools/packages/validators/validators-header-policy/bernierllc-validators-header-policy-1.2.2.tgz","_integrity":"sha512-9FaSF77gBOsUkmMRH/NniHhoemGH9njy5hy9BeDnn1WuW6lkn5UewJ+xWmuzf95bWt/qIVg9vFS/nzja8Fqjlg==","_npmVersion":"11.11.0","description":"Primitive validator for HTTP security header policy validation (CSP, HSTS, CORS, security headers)","directories":{},"_nodeVersion":"20.20.0","dependencies":{"@bernierllc/validators-core":"0.1.4"},"publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"_hasShrinkwrap":false,"devDependencies":{"jest":"^29.5.0","eslint":"^8.0.0","ts-jest":"^29.1.0","typescript":"^5.0.0","@types/jest":"^29.5.0","@types/node":"^20.0.0","@typescript-eslint/parser":"^6.0.0","@typescript-eslint/eslint-plugin":"^6.0.0"},"_npmOperationalInternal":{"tmp":"tmp/validators-header-policy_1.2.2_1773163929192_0.17437713130353094","host":"s3://npm-registry-packages-npm-production"}},"1.3.0":{"name":"@bernierllc/validators-header-policy","version":"1.3.0","keywords":["validator","security","http-headers","csp","hsts","cors","x-frame-options","security-headers","content-security-policy","referrer-policy","permissions-policy","primitive"],"author":{"name":"Bernier LLC"},"license":"UNLICENSED","_id":"@bernierllc/validators-header-policy@1.3.0","maintainers":[{"name":"alikhan410","email":"mczeyo@gmail.com"},{"name":"mkbernier","email":"mkbernier@gmail.com"}],"dist":{"shasum":"28690d2acb0f4839bcd04b53b794e346f0f4c219","tarball":"https://registry.npmjs.org/@bernierllc/validators-header-policy/-/validators-header-policy-1.3.0.tgz","fileCount":38,"integrity":"sha512-/QuT8Zs8wC3j8FuIcHi75S8xIENzILCSXx4n5nTMA0tsSs0JT+IGe93HW45IuE7bceqzctZ7O5ni7FINWrSiyA==","signatures":[{"sig":"MEUCIQDceeapHm0vxwRurds++YYg7/ctHWckE+WeGrmvXaUsrgIgbuGHLM5veVkIdv5oIMImdYGtSVJnOLiUQx/89e58AN8=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":106943},"main":"dist/index.js","type":"module","_from":"file:bernierllc-validators-header-policy-1.3.0.tgz","types":"dist/index.d.ts","scripts":{"lint":"eslint src --ext .ts","test":"jest","build":"tsc","clean":"rm -rf dist","test:watch":"jest --watch","test:coverage":"jest --coverage"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:0e9ea35b-520a-4f58-bd82-459fa613d888"}},"_resolved":"/home/runner/work/tools/tools/packages/validators/validators-header-policy/bernierllc-validators-header-policy-1.3.0.tgz","_integrity":"sha512-/QuT8Zs8wC3j8FuIcHi75S8xIENzILCSXx4n5nTMA0tsSs0JT+IGe93HW45IuE7bceqzctZ7O5ni7FINWrSiyA==","_npmVersion":"11.14.1","description":"Primitive validator for HTTP security header policy validation (CSP, HSTS, CORS, security headers)","directories":{},"_nodeVersion":"20.20.2","dependencies":{"@bernierllc/validators-core":"0.2.0"},"publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"_hasShrinkwrap":false,"devDependencies":{"jest":"^29.5.0","eslint":"^8.0.0","ts-jest":"^29.1.0","typescript":"^5.0.0","@types/jest":"^29.5.0","@types/node":"^20.0.0","@typescript-eslint/parser":"^6.0.0","@typescript-eslint/eslint-plugin":"^6.0.0"},"_npmOperationalInternal":{"tmp":"tmp/validators-header-policy_1.3.0_1779242159126_0.48112052393647775","host":"s3://npm-registry-packages-npm-production"}},"1.4.0":{"name":"@bernierllc/validators-header-policy","version":"1.4.0","keywords":["validator","security","http-headers","csp","hsts","cors","x-frame-options","security-headers","content-security-policy","referrer-policy","permissions-policy","primitive"],"author":{"name":"Bernier LLC"},"license":"UNLICENSED","_id":"@bernierllc/validators-header-policy@1.4.0","maintainers":[{"name":"alikhan410","email":"mczeyo@gmail.com"},{"name":"mkbernier","email":"mkbernier@gmail.com"}],"dist":{"shasum":"82021d5f884a124b050ad69795ecd8cf327c59d8","tarball":"https://registry.npmjs.org/@bernierllc/validators-header-policy/-/validators-header-policy-1.4.0.tgz","fileCount":38,"integrity":"sha512-iOHcv2jrZ2TwpMw2reQPzd3B+twj5MWQ4gzwhX47FUYEJr7NiQxAtbe6OluIafUWgf++PQdYpqyF5EA9gxoCkQ==","signatures":[{"sig":"MEUCIAvtr9JIFlX3op9G+NMj9WDwc+GoCSJs8r2nPpdIHkP+AiEAyaSsVjLKfngWkc4maf6bauVu9HfgBvOJTUusGHyFfkY=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":106943},"main":"dist/index.js","type":"module","_from":"file:bernierllc-validators-header-policy-1.4.0.tgz","types":"dist/index.d.ts","scripts":{"lint":"eslint src --ext .ts","test":"jest","build":"tsc","clean":"rm -rf dist","test:watch":"jest --watch","test:coverage":"jest --coverage"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:0e9ea35b-520a-4f58-bd82-459fa613d888"}},"_resolved":"/home/runner/work/tools/tools/packages/validators/validators-header-policy/bernierllc-validators-header-policy-1.4.0.tgz","_integrity":"sha512-iOHcv2jrZ2TwpMw2reQPzd3B+twj5MWQ4gzwhX47FUYEJr7NiQxAtbe6OluIafUWgf++PQdYpqyF5EA9gxoCkQ==","_npmVersion":"11.14.1","description":"Primitive validator for HTTP security header policy validation (CSP, HSTS, CORS, security headers)","directories":{},"_nodeVersion":"20.20.2","dependencies":{"@bernierllc/validators-core":"0.3.0"},"publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"_hasShrinkwrap":false,"devDependencies":{"jest":"^29.5.0","eslint":"^8.0.0","ts-jest":"^29.1.0","typescript":"^5.0.0","@types/jest":"^29.5.0","@types/node":"^20.0.0","@typescript-eslint/parser":"^6.0.0","@typescript-eslint/eslint-plugin":"^6.0.0"},"_npmOperationalInternal":{"tmp":"tmp/validators-header-policy_1.4.0_1779250916672_0.29722164395950323","host":"s3://npm-registry-packages-npm-production"}},"1.6.0":{"name":"@bernierllc/validators-header-policy","version":"1.6.0","description":"Primitive validator for HTTP security header policy validation (CSP, HSTS, CORS, security headers)","main":"dist/index.js","types":"dist/index.d.ts","type":"module","keywords":["validator","security","http-headers","csp","hsts","cors","x-frame-options","security-headers","content-security-policy","referrer-policy","permissions-policy","primitive"],"author":{"name":"Bernier LLC"},"license":"UNLICENSED","dependencies":{"@bernierllc/validators-core":"0.4.0"},"devDependencies":{"@types/jest":"^29.5.0","@types/node":"^20.0.0","@typescript-eslint/eslint-plugin":"^6.0.0","@typescript-eslint/parser":"^6.0.0","eslint":"^8.0.0","jest":"^29.5.0","ts-jest":"^29.1.0","typescript":"^5.0.0"},"publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"scripts":{"build":"tsc","clean":"rm -rf dist","test":"jest","test:watch":"jest --watch","test:coverage":"jest --coverage","lint":"eslint src --ext .ts"},"_id":"@bernierllc/validators-header-policy@1.6.0","_integrity":"sha512-k/kfp86g4OAQOm/adeQgT1P/XMLXfF4NrEWzDvnxvkq5necmp4+UwkYNZANoly2d0jh+9tDhHyzothEz79gofA==","_resolved":"/home/runner/work/tools/tools/packages/validators/validators-header-policy/bernierllc-validators-header-policy-1.6.0.tgz","_from":"file:bernierllc-validators-header-policy-1.6.0.tgz","_nodeVersion":"20.20.2","_npmVersion":"11.14.1","dist":{"integrity":"sha512-k/kfp86g4OAQOm/adeQgT1P/XMLXfF4NrEWzDvnxvkq5necmp4+UwkYNZANoly2d0jh+9tDhHyzothEz79gofA==","shasum":"1bc70fae67831e5e858d214eb44d01ded82cf74f","tarball":"https://registry.npmjs.org/@bernierllc/validators-header-policy/-/validators-header-policy-1.6.0.tgz","fileCount":42,"unpackedSize":109797,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIEbygNNVNOIflYQ4/bXtPG2EkFVSzelUitAXuLXr8fx6AiAnXyGkSpVMjA0PUtKpLBNdIn4wlxY6ukjHdCR5XEHLYQ=="}]},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:0e9ea35b-520a-4f58-bd82-459fa613d888"}},"directories":{},"maintainers":[{"name":"alikhan410","email":"mczeyo@gmail.com"},{"name":"mkbernier","email":"mkbernier@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/validators-header-policy_1.6.0_1779252204061_0.24823010858004757"},"_hasShrinkwrap":false}},"time":{"created":"2025-10-09T19:14:03.649Z","modified":"2026-05-20T04:43:24.347Z","1.0.1":"2025-10-09T19:14:03.959Z","1.2.0":"2026-01-05T19:46:05.568Z","1.2.1":"2026-03-09T17:44:49.278Z","1.2.2":"2026-03-10T17:32:09.365Z","1.3.0":"2026-05-20T01:55:59.277Z","1.4.0":"2026-05-20T04:21:56.877Z","1.6.0":"2026-05-20T04:43:24.206Z"},"author":{"name":"Bernier LLC"},"license":"UNLICENSED","keywords":["validator","security","http-headers","csp","hsts","cors","x-frame-options","security-headers","content-security-policy","referrer-policy","permissions-policy","primitive"],"description":"Primitive validator for HTTP security header policy validation (CSP, HSTS, CORS, security headers)","maintainers":[{"name":"alikhan410","email":"mczeyo@gmail.com"},{"name":"mkbernier","email":"mkbernier@gmail.com"}],"readme":"# @bernierllc/validators-header-policy\n\nPrimitive validator for HTTP security header policy validation (CSP, HSTS, CORS, security headers).\n\n## Installation\n\n```bash\nnpm install @bernierllc/validators-header-policy\n```\n\n## Overview\n\nThis package validates HTTP security headers to ensure they follow security best practices. It checks Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy headers.\n\n## Features\n\n- **Content-Security-Policy (CSP)** - Validates CSP directives, detects unsafe-inline/eval, checks for wildcards\n- **Strict-Transport-Security (HSTS)** - Validates max-age, includeSubDomains, and preload directives\n- **X-Frame-Options** - Validates clickjacking protection headers\n- **X-Content-Type-Options** - Validates MIME sniffing prevention\n- **Referrer-Policy** - Validates referrer information leakage controls\n- **Permissions-Policy** - Validates browser feature access controls\n\n## Usage\n\n### Basic Validation\n\n```typescript\nimport { validateHeaderPolicy } from '@bernierllc/validators-header-policy';\n\nconst headers = {\n  'Content-Security-Policy': \"default-src 'self'; script-src 'self' https://cdn.example.com\",\n  'Strict-Transport-Security': 'max-age=31536000; includeSubDomains; preload',\n  'X-Frame-Options': 'DENY',\n  'X-Content-Type-Options': 'nosniff',\n  'Referrer-Policy': 'strict-origin-when-cross-origin'\n};\n\nconst problems = await validateHeaderPolicy(headers);\n\nif (problems.length > 0) {\n  console.log('Security issues found:');\n  problems.forEach(p => {\n    console.log(`[${p.severity}] ${p.message}`);\n  });\n}\n```\n\n### Quick Security Check\n\n```typescript\nimport { hasSecurityIssues } from '@bernierllc/validators-header-policy';\n\nconst headers = {\n  'Content-Security-Policy': \"script-src 'unsafe-inline'\"\n};\n\nif (await hasSecurityIssues(headers)) {\n  console.log('Warning: Security headers need attention');\n}\n```\n\n### Security Scoring\n\n```typescript\nimport { getSecurityScore } from '@bernierllc/validators-header-policy';\n\nconst score = await getSecurityScore(headers);\nconsole.log(`Security score: ${score}/100`);\n\n// Score interpretation:\n// 100: Perfect security headers\n// 80-99: Good security with minor issues\n// 60-79: Moderate security, improvements recommended\n// <60: Poor security, critical issues present\n```\n\n### Detailed Summary\n\n```typescript\nimport { getHeaderPolicySummary } from '@bernierllc/validators-header-policy';\n\nconst summary = await getHeaderPolicySummary(headers);\n\nconsole.log(`Total issues: ${summary.total}`);\nconsole.log(`Errors: ${summary.errors}`);\nconsole.log(`Warnings: ${summary.warnings}`);\nconsole.log(`Security Score: ${summary.securityScore}`);\nconsole.log('Issues by rule:', summary.byRule);\n```\n\n## API Reference\n\n### Main Functions\n\n#### validateHeaderPolicy(headers, options?)\n\nValidates HTTP security headers against security best practices.\n\n**Parameters:**\n- `headers: Record<string, string | string[]>` - HTTP headers object\n- `options?: HeaderPolicyOptions` - Optional validation configuration\n\n**Returns:** `Promise<ValidationProblem[]>` - Array of validation problems found\n\n**Example:**\n```typescript\nconst problems = await validateHeaderPolicy(headers, {\n  requireCsp: true,\n  strictMode: true\n});\n```\n\n#### hasSecurityIssues(headers, options?)\n\nQuick check if headers have any security issues.\n\n**Parameters:**\n- `headers: Record<string, string | string[]>` - HTTP headers object\n- `options?: HeaderPolicyOptions` - Optional validation configuration\n\n**Returns:** `Promise<boolean>` - True if security issues found\n\n**Example:**\n```typescript\nif (await hasSecurityIssues(headers)) {\n  console.warn('Security headers need attention');\n}\n```\n\n#### getSecurityScore(headers, options?)\n\nCalculate a security score (0-100) for the given headers.\n\n**Parameters:**\n- `headers: Record<string, string | string[]>` - HTTP headers object\n- `options?: HeaderPolicyOptions` - Optional validation configuration\n\n**Returns:** `Promise<number>` - Security score from 0 (worst) to 100 (perfect)\n\n**Example:**\n```typescript\nconst score = await getSecurityScore(headers);\nconsole.log(`Security score: ${score}/100`);\n```\n\n#### getHeaderPolicySummary(headers, options?)\n\nGet a comprehensive summary of validation results.\n\n**Parameters:**\n- `headers: Record<string, string | string[]>` - HTTP headers object\n- `options?: HeaderPolicyOptions` - Optional validation configuration\n\n**Returns:** `Promise<HeaderPolicySummary>` - Summary object with counts and details\n\n**Example:**\n```typescript\nconst summary = await getHeaderPolicySummary(headers);\nconsole.log(`Errors: ${summary.errors}, Warnings: ${summary.warnings}`);\n```\n\n### Types\n\n#### ValidationProblem\n\n```typescript\ninterface ValidationProblem {\n  message: string;\n  severity: 'error' | 'warn' | 'info';\n  ruleId: string;\n  location?: string;\n}\n```\n\n#### HeaderPolicySummary\n\n```typescript\ninterface HeaderPolicySummary {\n  total: number;\n  errors: number;\n  warnings: number;\n  infos: number;\n  securityScore: number;\n  byRule: Record<string, number>;\n}\n```\n\n## Configuration Options\n\n### HeaderPolicyOptions\n\n```typescript\ninterface HeaderPolicyOptions {\n  // CSP Options\n  checkCsp?: boolean;              // Default: true\n  requireCsp?: boolean;            // Default: false\n  allowUnsafeInline?: boolean;     // Default: false\n  allowUnsafeEval?: boolean;       // Default: false\n  cspDirectives?: {                // Custom CSP directive requirements\n    defaultSrc?: string[];\n    scriptSrc?: string[];\n    styleSrc?: string[];\n    // ... other CSP directives\n  };\n\n  // HSTS Options\n  checkHsts?: boolean;             // Default: true\n  requireHsts?: boolean;           // Default: false\n  minHstsMaxAge?: number;          // Default: 31536000 (1 year)\n  requireHstsIncludeSubDomains?: boolean;\n  requireHstsPreload?: boolean;\n\n  // X-Frame-Options\n  checkXFrameOptions?: boolean;    // Default: true\n  requireXFrameOptions?: boolean;  // Default: false\n  allowedXFrameValues?: ('DENY' | 'SAMEORIGIN')[];\n\n  // X-Content-Type-Options\n  checkXContentTypeOptions?: boolean;    // Default: true\n  requireXContentTypeOptions?: boolean;  // Default: false\n\n  // Referrer-Policy\n  checkReferrerPolicy?: boolean;   // Default: true\n  requireReferrerPolicy?: boolean; // Default: false\n  allowedReferrerPolicies?: ReferrerPolicyValue[];\n\n  // Permissions-Policy\n  checkPermissionsPolicy?: boolean;    // Default: true\n  requirePermissionsPolicy?: boolean;  // Default: false\n  requiredPermissions?: string[];\n\n  // General\n  strictMode?: boolean;            // Default: false (enforce stricter checks)\n}\n```\n\n### Example with Custom Options\n\n```typescript\nconst problems = await validateHeaderPolicy(headers, {\n  requireCsp: true,\n  requireHsts: true,\n  allowUnsafeInline: false,\n  minHstsMaxAge: 63072000, // 2 years\n  requireHstsIncludeSubDomains: true,\n  strictMode: true,\n  cspDirectives: {\n    scriptSrc: [\"'self'\", \"https://trusted-cdn.example.com\"],\n    styleSrc: [\"'self'\"]\n  },\n  allowedReferrerPolicies: ['no-referrer', 'strict-origin-when-cross-origin']\n});\n```\n\n## Validation Rules\n\n### Content-Security-Policy (CSP)\n\n**What it validates:**\n- Presence of `default-src` directive\n- Detection of `unsafe-inline` in script-src\n- Detection of `unsafe-eval` in script-src\n- Detection of `unsafe-inline` in style-src\n- Wildcard (`*`) usage in directives\n- Custom directive requirements\n\n**Example problems detected:**\n```typescript\n// Missing default-src\n\"default-src directive missing\" // severity: warn\n\n// Unsafe inline scripts\n\"script-src 'unsafe-inline'\" // severity: warn/error (strict mode)\n\n// Wildcard in script-src\n\"script-src *\" // severity: warn\n```\n\n### Strict-Transport-Security (HSTS)\n\n**What it validates:**\n- Presence and value of `max-age` directive\n- Presence of `includeSubDomains` directive\n- Presence of `preload` directive\n- HSTS preload requirements (31536000+ max-age + includeSubDomains)\n\n**Example problems detected:**\n```typescript\n// Low max-age\n\"max-age=3600 is below recommended 31536000\" // severity: warn\n\n// Missing includeSubDomains\n\"Should include includeSubDomains\" // severity: warn\n\n// Preload without includeSubDomains\n\"preload requires includeSubDomains\" // severity: error\n```\n\n### X-Frame-Options\n\n**What it validates:**\n- Valid values (DENY, SAMEORIGIN)\n- Deprecated ALLOW-FROM directive\n- Redundancy with CSP frame-ancestors\n\n**Example problems detected:**\n```typescript\n// Invalid value\n\"X-Frame-Options: INVALID not recommended\" // severity: warn\n\n// Deprecated directive\n\"ALLOW-FROM is deprecated\" // severity: error\n```\n\n### X-Content-Type-Options\n\n**What it validates:**\n- Must be set to `nosniff` (only valid value)\n\n**Example problems detected:**\n```typescript\n// Invalid value\n\"X-Content-Type-Options: invalid is invalid\" // severity: error\n```\n\n### Referrer-Policy\n\n**What it validates:**\n- Valid referrer policy values\n- Detection of unsafe policies (unsafe-url)\n- Custom allowed policies\n\n**Recommended values:**\n- `no-referrer`\n- `strict-origin`\n- `strict-origin-when-cross-origin`\n\n**Example problems detected:**\n```typescript\n// Invalid policy\n\"invalid-policy is not valid\" // severity: error\n\n// Unsafe policy\n\"unsafe-url leaks full URL\" // severity: warn\n```\n\n### Permissions-Policy\n\n**What it validates:**\n- Deprecated Feature-Policy header\n- Wildcard usage in sensitive permissions\n- Unquoted origins\n- Required permissions\n\n**Sensitive permissions monitored:**\n- camera, microphone, geolocation\n- payment, usb, bluetooth, midi, serial\n\n**Example problems detected:**\n```typescript\n// Wildcard in sensitive permission\n\"geolocation allows all origins (*)\" // severity: warn\n\n// Unquoted origin\n\"Origin should be quoted\" // severity: warn\n```\n\n## Severities\n\n- **error** - Critical security issue that should block deployment\n- **warn** - Security concern that should be addressed\n- **info** - Informational message or best practice recommendation\n\n## Integration Status\n\n- **Logger Integration**: Not applicable - Pure validation package with no logging requirements. As a primitive validator following validators-principles, this package has no observable state changes or operational events requiring structured logging. All validation results are returned synchronously through function return values.\n- **Docs-Suite**: Ready - Markdown documentation exportable\n- **NeverHub Integration**: Not applicable - Primitive validator with no service dependencies. Following validators-principles architecture, this is a pure validation utility with no event publishing, service discovery, or orchestration needs. The package operates synchronously with no external service communication requirements.\n\n## Advanced Usage\n\n### Using Individual Rules\n\n```typescript\nimport { cspRule, hstsRule } from '@bernierllc/validators-header-policy';\n\n// Access rule metadata\nconsole.log(cspRule.meta.id); // 'header-policy/csp'\nconsole.log(cspRule.meta.title); // 'Content-Security-Policy Validation'\n```\n\n### Primitive Validator\n\n```typescript\nimport { headerPolicyValidator } from '@bernierllc/validators-header-policy';\n\nconsole.log(headerPolicyValidator.name); // 'header-policy'\nconsole.log(headerPolicyValidator.domain); // 'security'\nconsole.log(headerPolicyValidator.rules.length); // 6\n```\n\n## Examples\n\n### Validating Express Response Headers\n\n```typescript\nimport express from 'express';\nimport { validateHeaderPolicy, getSecurityScore } from '@bernierllc/validators-header-policy';\n\nconst app = express();\n\napp.use(async (req, res, next) => {\n  // Set security headers\n  res.setHeader('Content-Security-Policy', \"default-src 'self'\");\n  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');\n  res.setHeader('X-Frame-Options', 'DENY');\n  res.setHeader('X-Content-Type-Options', 'nosniff');\n\n  // Validate headers\n  const headers = res.getHeaders() as Record<string, string | string[]>;\n  const problems = await validateHeaderPolicy(headers);\n\n  if (problems.length > 0) {\n    console.warn('Security header issues:', problems);\n  }\n\n  next();\n});\n```\n\n### Testing Headers in CI/CD\n\n```typescript\nimport { getSecurityScore } from '@bernierllc/validators-header-policy';\n\nasync function testSecurityHeaders() {\n  const response = await fetch('https://example.com');\n  const headers = Object.fromEntries(response.headers.entries());\n\n  const score = await getSecurityScore(headers);\n\n  if (score < 80) {\n    throw new Error(`Security score ${score} is below minimum 80`);\n  }\n\n  console.log('Security headers validated successfully');\n}\n```\n\n### Monitoring Header Policy\n\n```typescript\nimport { getHeaderPolicySummary } from '@bernierllc/validators-header-policy';\n\nsetInterval(async () => {\n  const response = await fetch('https://example.com');\n  const headers = Object.fromEntries(response.headers.entries());\n\n  const summary = await getHeaderPolicySummary(headers);\n\n  console.log('Security Header Summary:');\n  console.log(`  Score: ${summary.securityScore}/100`);\n  console.log(`  Errors: ${summary.errors}`);\n  console.log(`  Warnings: ${summary.warnings}`);\n\n  if (summary.errors > 0) {\n    // Alert team\n    sendAlert('Security header errors detected');\n  }\n}, 300000); // Check every 5 minutes\n```\n\n## See Also\n\n- [@bernierllc/validators-core](../validators-core) - Core validation types and utilities\n- [@bernierllc/validators-secret-patterns](../validators-secret-patterns) - Secret detection validator\n- [@bernierllc/validators-html-syntax](../validators-html-syntax) - HTML syntax validator\n\n## License\n\nCopyright (c) 2025 Bernier LLC. All rights reserved.\n","readmeFilename":"README.md"}