"use strict";
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
  for (var name in all)
    __defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
  if (from && typeof from === "object" || typeof from === "function") {
    for (let key of __getOwnPropNames(from))
      if (!__hasOwnProp.call(to, key) && key !== except)
        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
  }
  return to;
};
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

// src/security-headers.ts
var security_headers_exports = {};
__export(security_headers_exports, {
  SecurityHeaderPresets: () => SecurityHeaderPresets,
  generateSecurityHeaders: () => generateSecurityHeaders
});
module.exports = __toCommonJS(security_headers_exports);
var SecurityHeaderPresets = {
  /** Minimal: basic headers only, no CSP */
  minimal: {
    csp: false,
    hsts: false
  },
  /** Standard: full CSP + HSTS for most apps */
  standard: {
    csp: true,
    hsts: true,
    frameOptions: "DENY"
  },
  /** Strict: deny all permissions, strict CSP, no frame embedding */
  strict: {
    csp: true,
    hsts: true,
    hstsMaxAge: 63072e3,
    // 2 years
    frameOptions: "DENY"
  }
};
function generateSecurityHeaders(config = {}) {
  const isProduction = config.isProduction ?? process.env.NODE_ENV === "production";
  const frameOptions = config.frameOptions ?? "DENY";
  const enableCsp = config.csp ?? true;
  const enableHsts = config.hsts ?? true;
  const hstsMaxAge = config.hstsMaxAge ?? 31536e3;
  const baseHeaders = [
    { key: "X-Frame-Options", value: frameOptions },
    { key: "X-Content-Type-Options", value: "nosniff" },
    // Modern browsers use CSP, not XSS-Protection. Value '0' disables the
    // legacy filter which can itself introduce vulnerabilities.
    { key: "X-XSS-Protection", value: "0" },
    {
      key: "Referrer-Policy",
      value: "strict-origin-when-cross-origin"
    },
    {
      key: "Permissions-Policy",
      value: "camera=(), microphone=(), geolocation=()"
    }
  ];
  const entries = [
    { source: "/:path*", headers: baseHeaders }
  ];
  if (isProduction) {
    const prodHeaders = [];
    if (enableHsts) {
      prodHeaders.push({
        key: "Strict-Transport-Security",
        value: `max-age=${hstsMaxAge}; includeSubDomains`
      });
    }
    if (enableCsp) {
      const csp = buildCsp(config);
      prodHeaders.push({ key: "Content-Security-Policy", value: csp });
    }
    if (prodHeaders.length > 0) {
      entries.push({ source: "/:path*", headers: prodHeaders });
    }
  }
  return entries;
}
function buildCsp(config) {
  const scriptSrc = [
    "'self'",
    "'unsafe-inline'",
    "'unsafe-eval'",
    ...config.cspScriptSrc ?? []
  ];
  const styleSrc = [
    "'self'",
    "'unsafe-inline'",
    "https://fonts.googleapis.com",
    ...config.cspStyleSrc ?? []
  ];
  const imgSrc = [
    "'self'",
    "data:",
    "https:",
    "blob:",
    ...config.cspImgSrc ?? []
  ];
  const fontSrc = ["'self'", "data:", "https://fonts.gstatic.com"];
  const connectSrc = ["'self'", ...config.cspConnectSrc ?? []];
  const frameSrc = [...config.cspFrameSrc ?? []];
  const directives = [
    `default-src 'self'`,
    `script-src ${scriptSrc.join(" ")}`,
    `style-src ${styleSrc.join(" ")}`,
    `img-src ${imgSrc.join(" ")}`,
    `font-src ${fontSrc.join(" ")}`,
    `connect-src ${connectSrc.join(" ")}`
  ];
  if (frameSrc.length > 0) {
    directives.push(`frame-src ${frameSrc.join(" ")}`);
  }
  directives.push(
    `object-src 'none'`,
    `base-uri 'self'`,
    `form-action 'self'`,
    `frame-ancestors 'none'`
  );
  return directives.join("; ");
}
// Annotate the CommonJS export names for ESM import in node:
0 && (module.exports = {
  SecurityHeaderPresets,
  generateSecurityHeaders
});
//# sourceMappingURL=security-headers.js.map