// src/security-headers.ts
var SecurityHeaderPresets = {
  /** Minimal: basic headers only, no CSP */
  minimal: {
    csp: false,
    hsts: false
  },
  /** Standard: full CSP + HSTS for most apps */
  standard: {
    csp: true,
    hsts: true,
    frameOptions: "DENY"
  },
  /** Strict: deny all permissions, strict CSP, no frame embedding */
  strict: {
    csp: true,
    hsts: true,
    hstsMaxAge: 63072e3,
    // 2 years
    frameOptions: "DENY"
  }
};
function generateSecurityHeaders(config = {}) {
  const isProduction = config.isProduction ?? process.env.NODE_ENV === "production";
  const frameOptions = config.frameOptions ?? "DENY";
  const enableCsp = config.csp ?? true;
  const enableHsts = config.hsts ?? true;
  const hstsMaxAge = config.hstsMaxAge ?? 31536e3;
  const baseHeaders = [
    { key: "X-Frame-Options", value: frameOptions },
    { key: "X-Content-Type-Options", value: "nosniff" },
    // Modern browsers use CSP, not XSS-Protection. Value '0' disables the
    // legacy filter which can itself introduce vulnerabilities.
    { key: "X-XSS-Protection", value: "0" },
    {
      key: "Referrer-Policy",
      value: "strict-origin-when-cross-origin"
    },
    {
      key: "Permissions-Policy",
      value: "camera=(), microphone=(), geolocation=()"
    }
  ];
  const entries = [
    { source: "/:path*", headers: baseHeaders }
  ];
  if (isProduction) {
    const prodHeaders = [];
    if (enableHsts) {
      prodHeaders.push({
        key: "Strict-Transport-Security",
        value: `max-age=${hstsMaxAge}; includeSubDomains`
      });
    }
    if (enableCsp) {
      const csp = buildCsp(config);
      prodHeaders.push({ key: "Content-Security-Policy", value: csp });
    }
    if (prodHeaders.length > 0) {
      entries.push({ source: "/:path*", headers: prodHeaders });
    }
  }
  return entries;
}
function buildCsp(config) {
  const scriptSrc = [
    "'self'",
    "'unsafe-inline'",
    "'unsafe-eval'",
    ...config.cspScriptSrc ?? []
  ];
  const styleSrc = [
    "'self'",
    "'unsafe-inline'",
    "https://fonts.googleapis.com",
    ...config.cspStyleSrc ?? []
  ];
  const imgSrc = [
    "'self'",
    "data:",
    "https:",
    "blob:",
    ...config.cspImgSrc ?? []
  ];
  const fontSrc = ["'self'", "data:", "https://fonts.gstatic.com"];
  const connectSrc = ["'self'", ...config.cspConnectSrc ?? []];
  const frameSrc = [...config.cspFrameSrc ?? []];
  const directives = [
    `default-src 'self'`,
    `script-src ${scriptSrc.join(" ")}`,
    `style-src ${styleSrc.join(" ")}`,
    `img-src ${imgSrc.join(" ")}`,
    `font-src ${fontSrc.join(" ")}`,
    `connect-src ${connectSrc.join(" ")}`
  ];
  if (frameSrc.length > 0) {
    directives.push(`frame-src ${frameSrc.join(" ")}`);
  }
  directives.push(
    `object-src 'none'`,
    `base-uri 'self'`,
    `form-action 'self'`,
    `frame-ancestors 'none'`
  );
  return directives.join("; ");
}
export {
  SecurityHeaderPresets,
  generateSecurityHeaders
};
//# sourceMappingURL=security-headers.mjs.map