// @bun
var{defineProperty:J,getOwnPropertyNames:Z,getOwnPropertyDescriptor:_}=Object,$=Object.prototype.hasOwnProperty;function k(j){return this[j]}var b=(j)=>{var q=(R??=new WeakMap).get(j),z;if(q)return q;if(q=J({},"__esModule",{value:!0}),j&&typeof j==="object"||typeof j==="function"){for(var F of Z(j))if(!$.call(q,F))J(q,F,{get:k.bind(j,F),enumerable:!(z=_(j,F))||z.enumerable})}return R.set(j,q),q},R;var A=(j)=>j;function O(j,q){this[j]=A.bind(null,q)}var w=(j,q)=>{for(var z in q)J(j,z,{get:q[z],enumerable:!0,configurable:!0,set:O.bind(q,z)})};var D=(j,q)=>()=>(j&&(q=j(j=0)),q);var N=import.meta.require;function U(j=16){let q=new Uint8Array(j);return crypto.getRandomValues(q),btoa(String.fromCharCode(...q))}function I(j,q){if(!j)return q?.nonceGenerator?.()??U();let z=K.get(j);if(!z)z=q?.nonceGenerator?.()??U(),K.set(j,z);return z}function m(j){K.delete(j)}function W(j,q){let z=[];for(let[F,E]of Object.entries(j)){if(E===void 0||E===null)continue;if(typeof E==="boolean"){if(E)z.push(F);continue}if(Array.isArray(E)){let B=[...E];if(q&&(F==="script-src"||F==="style-src"))B=B.filter((G)=>!G.startsWith("'nonce-")),B.push(`'nonce-${q}'`);if(B.length>0)z.push(`${F} ${B.join(" ")}`)}}return z.join("; ")}function Q(j,q){return`<meta http-equiv="Content-Security-Policy" content="${W(j,q).replace(/&/g,"&amp;").replace(/"/g,"&quot;")}">`}function x(j){return{enabled:!0,directives:{strict:H,moderate:L,relaxed:M,api:S}[j]||L,useNonce:j==="strict",addMetaTag:!0}}function C(j,q){let z={...j};for(let[F,E]of Object.entries(q)){let B=F,G=z[B];if(E===void 0||E===null)continue;if(typeof E==="boolean")z[B]=G||E;else if(Array.isArray(E)){let X=Array.isArray(G)?G:[],Y=[...new Set([...X,...E])];z[B]=Y}}return z}function d(j,q,z){if(!q.enabled||!q.addMetaTag)return j;if(j.includes('http-equiv="Content-Security-Policy"'))return j;if(!j.includes("<head>")&&!j.includes("<head "))return j;let F=q.useNonce?I(z,q):void 0,E=Q(q.directives,F);return j.replace(/<head([^>]*)>/,`<head$1>
${E}`)}function u(j,q){let z=j;return z=z.replace(/<script(?![^>]*\ssrc=)([^>]*)>/gi,(F,E)=>{if(E.includes("nonce="))return F;return`<script nonce="${q}"${E}>`}),z=z.replace(/<style([^>]*)>/gi,(F,E)=>{if(E.includes("nonce="))return F;return`<style nonce="${q}"${E}>`}),z}function v(j,q,z,F){let E=j,B=F.csp;if(E=E.replace(/@csp\b/g,()=>{if(!B?.enabled||!B.directives)return"<!-- CSP not configured -->";let G=B.useNonce?I(q,B):void 0;return Q(B.directives,G)}),E=E.replace(/@cspNonce\b/g,()=>{if(!B?.enabled||!B.useNonce)return"";return I(q,B)}),B?.enabled&&B.useNonce)q.cspNonce=I(q,B);return E}function f(){return[T,V]}function l(j){let q=[];if(j["script-src"]?.includes("'unsafe-inline'"))q.push("CSP: Using unsafe-inline in script-src significantly reduces XSS protection");if(j["script-src"]?.includes("'unsafe-eval'"))q.push("CSP: Using unsafe-eval in script-src allows eval() and related functions");if(!j["default-src"])q.push("CSP: No default-src specified. Recommend adding default-src as a fallback");if(j["default-src"]?.includes("*"))q.push("CSP: Using * in default-src provides minimal protection");if(!j["object-src"]&&!j["default-src"]?.includes("'none'"))q.push("CSP: Consider adding object-src: none to block plugins");if(!j["base-uri"])q.push("CSP: Consider adding base-uri to prevent base tag injection attacks");for(let[z,F]of Object.entries(j))if(Array.isArray(F)&&F.includes("http:"))q.push(`CSP: Using http: in ${z} allows insecure resources`);return q}function y(j=!1){return j?"Content-Security-Policy-Report-Only":"Content-Security-Policy"}function p(j,q){if(!j.enabled)return{};let z=j.useNonce?I(q,j):void 0,F=W(j.directives,z);return{[y(j.reportOnly)]:F}}var K,H,L,M,S,T,V,g;var P=D(()=>{K=new WeakMap;H={"default-src":["'self'"],"script-src":["'self'","'strict-dynamic'"],"style-src":["'self'"],"img-src":["'self'","data:","https:"],"font-src":["'self'","https:","data:"],"connect-src":["'self'"],"media-src":["'self'"],"object-src":["'none'"],"frame-src":["'none'"],"base-uri":["'self'"],"form-action":["'self'"],"frame-ancestors":["'self'"],"upgrade-insecure-requests":!0},L={"default-src":["'self'"],"script-src":["'self'"],"style-src":["'self'","'unsafe-inline'"],"img-src":["'self'","data:","https:"],"font-src":["'self'","https:","data:"],"connect-src":["'self'","https:"],"media-src":["'self'"],"object-src":["'none'"],"frame-src":["'self'"],"base-uri":["'self'"],"form-action":["'self'"],"upgrade-insecure-requests":!0},M={"default-src":["'self'"],"script-src":["'self'","'unsafe-inline'"],"style-src":["'self'","'unsafe-inline'"],"img-src":["'self'","data:","https:","http:"],"font-src":["'self'","https:","http:","data:"],"connect-src":["'self'","https:","http:","ws:","wss:"],"media-src":["'self'","https:","http:"],"object-src":["'none'"],"frame-src":["'self'","https:"],"base-uri":["'self'"]},S={"default-src":["'none'"],"frame-ancestors":["'none'"]};T={name:"csp",handler:(j,q,z,F)=>{let B=z.__stx_options?.csp;if(!B?.enabled||!B.directives)return"<!-- CSP not configured -->";let G=B.useNonce?I(z,B):void 0;return Q(B.directives,G)},hasEndTag:!1,description:"Insert Content-Security-Policy meta tag"},V={name:"cspNonce",handler:(j,q,z,F)=>{let B=z.__stx_options?.csp;if(!B?.enabled||!B.useNonce)return"";return I(z,B)},hasEndTag:!1,description:"Output the current CSP nonce value"};g={enabled:!1,reportOnly:!1,directives:L,useNonce:!1,addMetaTag:!0}});P();export{l as validateCspDirectives,H as strictCspPreset,M as relaxedCspPreset,f as registerCspDirectives,v as processCspDirectives,L as moderateCspPreset,C as mergeCspDirectives,d as injectCspMetaTag,I as getNonce,x as getCspPreset,y as getCspHeaderName,U as generateNonce,Q as generateCspMetaTag,W as generateCspHeader,g as defaultCspConfig,V as cspNonceDirective,T as cspDirective,p as createCspHeaders,m as clearNonce,S as apiCspPreset,u as addNonceToInlineContent};
