const DEFAULT_HEADERS = {
    'X-Content-Type-Options': 'nosniff',
    'X-Frame-Options': 'DENY',
    'X-XSS-Protection': '0',
    'Referrer-Policy': 'strict-origin-when-cross-origin',
    'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload',
    'Permissions-Policy': 'camera=(), microphone=(), geolocation=()',
};
/** Get the default security headers for HTTP responses. */
export function getSecurityHeaders(overrides) {
    const headers = { ...DEFAULT_HEADERS };
    if (overrides?.contentSecurityPolicy) {
        headers['Content-Security-Policy'] = overrides.contentSecurityPolicy;
    }
    if (overrides?.strictTransportSecurity) {
        headers['Strict-Transport-Security'] = overrides.strictTransportSecurity;
    }
    if (overrides?.xContentTypeOptions) {
        headers['X-Content-Type-Options'] = overrides.xContentTypeOptions;
    }
    if (overrides?.xFrameOptions) {
        headers['X-Frame-Options'] = overrides.xFrameOptions;
    }
    if (overrides?.referrerPolicy) {
        headers['Referrer-Policy'] = overrides.referrerPolicy;
    }
    if (overrides?.permissionsPolicy) {
        headers['Permissions-Policy'] = overrides.permissionsPolicy;
    }
    return headers;
}
//# sourceMappingURL=headers.js.map