/** Generate a cryptographically secure nonce for Content Security Policy inline scripts/styles. */
export function generateCspNonce() {
    const bytes = crypto.getRandomValues(new Uint8Array(16));
    return btoa(String.fromCharCode(...bytes));
}
/** Build a CSP header value incorporating the generated nonce. */
export function buildCspHeader(nonce, directives) {
    const defaults = {
        'default-src': ["'self'"],
        'script-src': ["'self'", `'nonce-${nonce}'`],
        'style-src': ["'self'", `'nonce-${nonce}'`, "'unsafe-inline'"],
        'img-src': ["'self'", 'data:', 'https:'],
        'font-src': ["'self'"],
        'connect-src': ["'self'"],
        'frame-ancestors': ["'none'"],
        'base-uri': ["'self'"],
        'form-action': ["'self'"],
        ...directives,
    };
    return Object.entries(defaults)
        .map(([key, values]) => `${key} ${values.join(' ')}`)
        .join('; ');
}
//# sourceMappingURL=csp-nonces.js.map