@alxia/secure-headers 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Steve Tsala
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,57 @@
+# @alxia/secure-headers
+
+Secure HTTP headers on every response of an
+[alxia](https://www.npmjs.com/package/@alxia/core) app, 404s included, with
+no dependency.
+
+```sh
+bun add @alxia/secure-headers @alxia/core
+bun add -d typescript
+```
+
+## Usage
+
+```ts
+import { secureHeaders } from '@alxia/secure-headers';
+
+app.use(secureHeaders());
+app.use(secureHeaders({ contentSecurityPolicy: "default-src 'self'", xFrameOptions: false }));
+```
+
+A header a route sets itself is kept: a page that needs its own policy sets
+it on its reply.
+
+## Defaults
+
+| header | default | option |
+| --- | --- | --- |
+| `Content-Security-Policy` | `default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'` | `contentSecurityPolicy` |
+| `Strict-Transport-Security` | `max-age=31536000; includeSubDomains` | `strictTransportSecurity` |
+| `X-Content-Type-Options` | `nosniff` | `xContentTypeOptions` |
+| `X-Frame-Options` | `DENY` | `xFrameOptions` |
+| `Referrer-Policy` | `no-referrer` | `referrerPolicy` |
+| `Cross-Origin-Opener-Policy` | `same-origin` | `crossOriginOpenerPolicy` |
+| `Cross-Origin-Resource-Policy` | `same-origin` | `crossOriginResourcePolicy` |
+| `Cross-Origin-Embedder-Policy` | not sent | `crossOriginEmbedderPolicy` |
+| `Origin-Agent-Cluster` | `?1` | `originAgentCluster` |
+| `X-DNS-Prefetch-Control` | `off` | `xDnsPrefetchControl` |
+| `X-Permitted-Cross-Domain-Policies` | `none` | `xPermittedCrossDomainPolicies` |
+| `Permissions-Policy` | not sent | `permissionsPolicy` |
+
+Each option takes a value, or `false` to leave the header out; an empty
+value is refused at startup.
+`X-Powered-By` and `Server` are removed unless `hidePoweredBy: false`.
+
+## API
+
+| export | |
+| --- | --- |
+| `secureHeaders(options?)` | the plugin |
+| `SecureHeadersOptions` | its options |
+| `Setting` | a header option's type: its value, or `false` to leave it out |
+
+## Documentation
+
+- [Guide](https://github.com/softistx/alxia/tree/develop/packages/secure-headers/docs): every option and its default, which responses get the headers, a page's own policy, the order with other hooks, and recipes.
+- [Troubleshooting](https://github.com/softistx/alxia/blob/develop/packages/secure-headers/docs/troubleshooting.md): an error message or a browser refusal, and what to do about it.
+- [Roadmap](https://github.com/softistx/alxia/blob/develop/packages/secure-headers/docs/roadmap.md): what is coming, and what is not planned.

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { type SecureHeadersOptions, type Setting, secureHeaders, } from './secure-headers';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,OAAO,EACZ,aAAa,GACb,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,59 @@
+// src/secure-headers.ts
+import { withHeaders } from "@alxia/core";
+var DEFAULTS = {
+  "content-security-policy": "default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+  "strict-transport-security": "max-age=31536000; includeSubDomains",
+  "x-content-type-options": "nosniff",
+  "x-frame-options": "DENY",
+  "referrer-policy": "no-referrer",
+  "cross-origin-opener-policy": "same-origin",
+  "cross-origin-resource-policy": "same-origin",
+  "cross-origin-embedder-policy": false,
+  "origin-agent-cluster": "?1",
+  "x-dns-prefetch-control": "off",
+  "x-permitted-cross-domain-policies": "none",
+  "permissions-policy": false
+};
+var OPTION = {
+  "content-security-policy": "contentSecurityPolicy",
+  "strict-transport-security": "strictTransportSecurity",
+  "x-content-type-options": "xContentTypeOptions",
+  "x-frame-options": "xFrameOptions",
+  "referrer-policy": "referrerPolicy",
+  "cross-origin-opener-policy": "crossOriginOpenerPolicy",
+  "cross-origin-resource-policy": "crossOriginResourcePolicy",
+  "cross-origin-embedder-policy": "crossOriginEmbedderPolicy",
+  "origin-agent-cluster": "originAgentCluster",
+  "x-dns-prefetch-control": "xDnsPrefetchControl",
+  "x-permitted-cross-domain-policies": "xPermittedCrossDomainPolicies",
+  "permissions-policy": "permissionsPolicy"
+};
+function secureHeaders(options = {}) {
+  const headers = [];
+  for (const [name, fallback] of Object.entries(DEFAULTS)) {
+    const setting = options[OPTION[name]];
+    if (typeof setting === "string" && setting.trim() === "") {
+      throw new TypeError(`secureHeaders: ${OPTION[name]} is empty; give false to leave the ${name} header out`);
+    }
+    const value = setting === undefined ? fallback : setting;
+    if (typeof value === "string")
+      headers.push([name, value]);
+  }
+  const hide = options.hidePoweredBy ?? true;
+  return (app) => app.onResponse((response) => withHeaders(response, (current) => {
+    for (const [name, value] of headers) {
+      if (!current.has(name))
+        current.set(name, value);
+    }
+    if (hide) {
+      current.delete("x-powered-by");
+      current.delete("server");
+    }
+  }));
+}
+export {
+  secureHeaders
+};
+
+//# debugId=DD4A7A8B39A4596664756E2164756E21
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/secure-headers.ts"],
+  "sourcesContent": [
+    "import { type Plugin, withHeaders } from '@alxia/core';\n\n/** A header's value, or `false` to leave it out. An empty value is refused. */\nexport type Setting = string | false;\n\nexport interface SecureHeadersOptions {\n\t/** Defaults to a policy for an API: nothing loads, nothing frames it. */\n\treadonly contentSecurityPolicy?: Setting;\n\treadonly strictTransportSecurity?: Setting;\n\treadonly xContentTypeOptions?: Setting;\n\treadonly xFrameOptions?: Setting;\n\treadonly referrerPolicy?: Setting;\n\treadonly crossOriginOpenerPolicy?: Setting;\n\treadonly crossOriginResourcePolicy?: Setting;\n\treadonly crossOriginEmbedderPolicy?: Setting;\n\treadonly originAgentCluster?: Setting;\n\treadonly xDnsPrefetchControl?: Setting;\n\treadonly xPermittedCrossDomainPolicies?: Setting;\n\t/** Off by default: a policy is the app's to write. */\n\treadonly permissionsPolicy?: Setting;\n\t/** Whether `X-Powered-By` and `Server` are removed. On by default. */\n\treadonly hidePoweredBy?: boolean;\n}\n\nconst DEFAULTS = {\n\t'content-security-policy':\n\t\t\"default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'\",\n\t'strict-transport-security': 'max-age=31536000; includeSubDomains',\n\t'x-content-type-options': 'nosniff',\n\t'x-frame-options': 'DENY',\n\t'referrer-policy': 'no-referrer',\n\t'cross-origin-opener-policy': 'same-origin',\n\t'cross-origin-resource-policy': 'same-origin',\n\t'cross-origin-embedder-policy': false,\n\t'origin-agent-cluster': '?1',\n\t'x-dns-prefetch-control': 'off',\n\t'x-permitted-cross-domain-policies': 'none',\n\t'permissions-policy': false,\n} as const satisfies Record<string, Setting>;\n\nconst OPTION: Record<keyof typeof DEFAULTS, keyof SecureHeadersOptions> = {\n\t'content-security-policy': 'contentSecurityPolicy',\n\t'strict-transport-security': 'strictTransportSecurity',\n\t'x-content-type-options': 'xContentTypeOptions',\n\t'x-frame-options': 'xFrameOptions',\n\t'referrer-policy': 'referrerPolicy',\n\t'cross-origin-opener-policy': 'crossOriginOpenerPolicy',\n\t'cross-origin-resource-policy': 'crossOriginResourcePolicy',\n\t'cross-origin-embedder-policy': 'crossOriginEmbedderPolicy',\n\t'origin-agent-cluster': 'originAgentCluster',\n\t'x-dns-prefetch-control': 'xDnsPrefetchControl',\n\t'x-permitted-cross-domain-policies': 'xPermittedCrossDomainPolicies',\n\t'permissions-policy': 'permissionsPolicy',\n};\n\n/**\n * Secure headers on every response, as a plugin. A header a route set\n * itself is kept: a page that needs its own `Content-Security-Policy` —\n * `@alxia/openapi`'s reference page — sets it.\n *\n * ```ts\n * app.use(secureHeaders({ contentSecurityPolicy: \"default-src 'self'\" }));\n * ```\n */\nexport function secureHeaders(options: SecureHeadersOptions = {}): Plugin {\n\tconst headers: [string, string][] = [];\n\tfor (const [name, fallback] of Object.entries(DEFAULTS) as [\n\t\tkeyof typeof DEFAULTS,\n\t\tSetting,\n\t][]) {\n\t\tconst setting = options[OPTION[name]];\n\t\tif (typeof setting === 'string' && setting.trim() === '') {\n\t\t\t// An empty header says nothing a browser can act on: leave it out.\n\t\t\tthrow new TypeError(\n\t\t\t\t`secureHeaders: ${OPTION[name]} is empty; give false to leave the ${name} header out`,\n\t\t\t);\n\t\t}\n\t\tconst value = setting === undefined ? fallback : setting;\n\t\tif (typeof value === 'string') headers.push([name, value]);\n\t}\n\tconst hide = options.hidePoweredBy ?? true;\n\treturn (app) =>\n\t\tapp.onResponse((response) =>\n\t\t\twithHeaders(response, (current) => {\n\t\t\t\tfor (const [name, value] of headers) {\n\t\t\t\t\tif (!current.has(name)) current.set(name, value);\n\t\t\t\t}\n\t\t\t\tif (hide) {\n\t\t\t\t\tcurrent.delete('x-powered-by');\n\t\t\t\t\tcurrent.delete('server');\n\t\t\t\t}\n\t\t\t}),\n\t\t);\n}\n"
+  ],
+  "mappings": ";AAAA;AAwBA,IAAM,WAAW;AAAA,EAChB,2BACC;AAAA,EACD,6BAA6B;AAAA,EAC7B,0BAA0B;AAAA,EAC1B,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,8BAA8B;AAAA,EAC9B,gCAAgC;AAAA,EAChC,gCAAgC;AAAA,EAChC,wBAAwB;AAAA,EACxB,0BAA0B;AAAA,EAC1B,qCAAqC;AAAA,EACrC,sBAAsB;AACvB;AAEA,IAAM,SAAoE;AAAA,EACzE,2BAA2B;AAAA,EAC3B,6BAA6B;AAAA,EAC7B,0BAA0B;AAAA,EAC1B,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,8BAA8B;AAAA,EAC9B,gCAAgC;AAAA,EAChC,gCAAgC;AAAA,EAChC,wBAAwB;AAAA,EACxB,0BAA0B;AAAA,EAC1B,qCAAqC;AAAA,EACrC,sBAAsB;AACvB;AAWO,SAAS,aAAa,CAAC,UAAgC,CAAC,GAAW;AAAA,EACzE,MAAM,UAA8B,CAAC;AAAA,EACrC,YAAY,MAAM,aAAa,OAAO,QAAQ,QAAQ,GAGjD;AAAA,IACJ,MAAM,UAAU,QAAQ,OAAO;AAAA,IAC/B,IAAI,OAAO,YAAY,YAAY,QAAQ,KAAK,MAAM,IAAI;AAAA,MAEzD,MAAM,IAAI,UACT,kBAAkB,OAAO,2CAA2C,iBACrE;AAAA,IACD;AAAA,IACA,MAAM,QAAQ,YAAY,YAAY,WAAW;AAAA,IACjD,IAAI,OAAO,UAAU;AAAA,MAAU,QAAQ,KAAK,CAAC,MAAM,KAAK,CAAC;AAAA,EAC1D;AAAA,EACA,MAAM,OAAO,QAAQ,iBAAiB;AAAA,EACtC,OAAO,CAAC,QACP,IAAI,WAAW,CAAC,aACf,YAAY,UAAU,CAAC,YAAY;AAAA,IAClC,YAAY,MAAM,UAAU,SAAS;AAAA,MACpC,IAAI,CAAC,QAAQ,IAAI,IAAI;AAAA,QAAG,QAAQ,IAAI,MAAM,KAAK;AAAA,IAChD;AAAA,IACA,IAAI,MAAM;AAAA,MACT,QAAQ,OAAO,cAAc;AAAA,MAC7B,QAAQ,OAAO,QAAQ;AAAA,IACxB;AAAA,GACA,CACF;AAAA;",
+  "debugId": "DD4A7A8B39A4596664756E2164756E21",
+  "names": []
+}

package/dist/secure-headers.d.ts

@@ -0,0 +1,32 @@
+import { type Plugin } from '@alxia/core';
+/** A header's value, or `false` to leave it out. An empty value is refused. */
+export type Setting = string | false;
+export interface SecureHeadersOptions {
+    /** Defaults to a policy for an API: nothing loads, nothing frames it. */
+    readonly contentSecurityPolicy?: Setting;
+    readonly strictTransportSecurity?: Setting;
+    readonly xContentTypeOptions?: Setting;
+    readonly xFrameOptions?: Setting;
+    readonly referrerPolicy?: Setting;
+    readonly crossOriginOpenerPolicy?: Setting;
+    readonly crossOriginResourcePolicy?: Setting;
+    readonly crossOriginEmbedderPolicy?: Setting;
+    readonly originAgentCluster?: Setting;
+    readonly xDnsPrefetchControl?: Setting;
+    readonly xPermittedCrossDomainPolicies?: Setting;
+    /** Off by default: a policy is the app's to write. */
+    readonly permissionsPolicy?: Setting;
+    /** Whether `X-Powered-By` and `Server` are removed. On by default. */
+    readonly hidePoweredBy?: boolean;
+}
+/**
+ * Secure headers on every response, as a plugin. A header a route set
+ * itself is kept: a page that needs its own `Content-Security-Policy` —
+ * `@alxia/openapi`'s reference page — sets it.
+ *
+ * ```ts
+ * app.use(secureHeaders({ contentSecurityPolicy: "default-src 'self'" }));
+ * ```
+ */
+export declare function secureHeaders(options?: SecureHeadersOptions): Plugin;
+//# sourceMappingURL=secure-headers.d.ts.map

package/dist/secure-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-headers.d.ts","sourceRoot":"","sources":["../src/secure-headers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAe,MAAM,aAAa,CAAC;AAEvD,+EAA+E;AAC/E,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAErC,MAAM,WAAW,oBAAoB;IACpC,yEAAyE;IACzE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACjD,sDAAsD;IACtD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CACjC;AAiCD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,MAAM,CA6BxE"}

package/docs/README.md

@@ -0,0 +1,11 @@
+# @alxia/secure-headers documentation
+
+The [package README](../README.md) is the short version. This folder is
+the long one: every option with its default, which responses get the
+headers, and what to do when a browser refuses what they forbid.
+
+| Page | Read it when |
+| --- | --- |
+| [Guide](guide.md) | changing or dropping a header, giving a page its own policy, ordering it with other hooks, or testing the headers |
+| [Troubleshooting](troubleshooting.md) | something went wrong and you have the message: a TypeScript error, a browser refusal, a header that is or is not there |
+| [Roadmap](roadmap.md) | wondering what is coming, and what is not planned |

package/docs/guide.md

@@ -0,0 +1,369 @@
+# Guide
+
+This page covers `secureHeaders`: what it sends, how to change or drop each
+header, which responses it reaches, and how a page or another plugin sets
+its own policy.
+
+```ts
+import { alxia } from '@alxia/core';
+import { secureHeaders } from '@alxia/secure-headers';
+
+const app = alxia()
+	.use(secureHeaders())
+	.get('/health', ({ reply }) => reply(200, 'ok'));
+
+app.listen(3000);
+```
+
+Every response of that app now carries the headers below, and none carries
+`X-Powered-By` or `Server`.
+
+## The signature
+
+```ts
+function secureHeaders(options?: SecureHeadersOptions): Plugin;
+
+interface SecureHeadersOptions {
+	readonly contentSecurityPolicy?: string | false;
+	readonly strictTransportSecurity?: string | false;
+	readonly xContentTypeOptions?: string | false;
+	readonly xFrameOptions?: string | false;
+	readonly referrerPolicy?: string | false;
+	readonly crossOriginOpenerPolicy?: string | false;
+	readonly crossOriginResourcePolicy?: string | false;
+	readonly crossOriginEmbedderPolicy?: string | false;
+	readonly originAgentCluster?: string | false;
+	readonly xDnsPrefetchControl?: string | false;
+	readonly xPermittedCrossDomainPolicies?: string | false;
+	readonly permissionsPolicy?: string | false;
+	readonly hidePoweredBy?: boolean;
+}
+```
+
+`secureHeaders` returns a function `Plugin` from `@alxia/core`: give it to
+`use`, called, and the app keeps its type. It adds one global `onResponse`
+hook, so where it sits in the chain does not matter for which routes it
+reaches: every route, declared before or after it, is covered. Used inside
+a `group`, it still covers the whole app — a group's global hooks are the
+app's. To vary a header for some routes, set it on their replies
+([below](#a-header-a-route-sets-is-kept)).
+
+The options are read once, when `secureHeaders(…)` is called; the header
+values are fixed from then on.
+
+## The options
+
+Each header option takes the header's value as a string, or `false` to
+leave the header out. An option left out keeps the default.
+
+| Option | Header | Default | What the default does |
+| --- | --- | --- | --- |
+| `contentSecurityPolicy` | `Content-Security-Policy` | `default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'` | a policy for an API: the response may load nothing, set no `<base>`, post no form, and be framed by no page |
+| `strictTransportSecurity` | `Strict-Transport-Security` | `max-age=31536000; includeSubDomains` | over HTTPS, the browser uses HTTPS for this host and its subdomains for a year |
+| `xContentTypeOptions` | `X-Content-Type-Options` | `nosniff` | the browser trusts `Content-Type` and does not guess |
+| `xFrameOptions` | `X-Frame-Options` | `DENY` | no page may frame the response, for browsers that predate `frame-ancestors` |
+| `referrerPolicy` | `Referrer-Policy` | `no-referrer` | links and requests from the response send no `Referer` |
+| `crossOriginOpenerPolicy` | `Cross-Origin-Opener-Policy` | `same-origin` | a window of another origin opened from, or opening, this one gets no handle on it |
+| `crossOriginResourcePolicy` | `Cross-Origin-Resource-Policy` | `same-origin` | another origin cannot embed the response with `<img>`, `<script>` or a `no-cors` fetch |
+| `crossOriginEmbedderPolicy` | `Cross-Origin-Embedder-Policy` | not sent | — |
+| `originAgentCluster` | `Origin-Agent-Cluster` | `?1` | the browser isolates the origin in its own agent cluster |
+| `xDnsPrefetchControl` | `X-DNS-Prefetch-Control` | `off` | the browser does not resolve the response's links ahead of time |
+| `xPermittedCrossDomainPolicies` | `X-Permitted-Cross-Domain-Policies` | `none` | Adobe clients load no cross-domain policy file |
+| `permissionsPolicy` | `Permissions-Policy` | not sent | — the policy is the app's to write |
+
+| Option | Type | Default | Effect |
+| --- | --- | --- | --- |
+| `hidePoweredBy` | `boolean` | `true` | removes `X-Powered-By` and `Server` from every response, a route's own included |
+
+### A value
+
+A string replaces the default as it is, with no parsing: write the header
+exactly as it should go out.
+
+```ts
+app.use(
+	secureHeaders({
+		contentSecurityPolicy: "default-src 'self'; img-src 'self' data:",
+		referrerPolicy: 'strict-origin-when-cross-origin',
+		permissionsPolicy: 'camera=(), microphone=(), geolocation=()',
+	}),
+);
+```
+
+### `false`
+
+`false` leaves the header out of every response the plugin touches.
+
+```ts
+app.use(secureHeaders({ xFrameOptions: false, strictTransportSecurity: false }));
+```
+
+An empty string is refused: `secureHeaders({ xFrameOptions: '' })` throws a
+`TypeError` at startup
+([troubleshooting](troubleshooting.md#typeerror-secureheaders--is-empty-give-false-to-leave-the--header-out)).
+Use `false` to drop a header.
+
+### The defaults, explicitly
+
+With `exactOptionalPropertyTypes` on, an option set to `undefined` is a
+compile error; with it off, `undefined` means the default. To keep the
+default under a condition, leave the key out:
+
+```ts
+const production = Bun.env.NODE_ENV === 'production';
+
+app.use(
+	secureHeaders({
+		...(production ? {} : { strictTransportSecurity: false }),
+	}),
+);
+```
+
+### `hidePoweredBy`
+
+On by default: `X-Powered-By` and `Server` are deleted from the response,
+even when a route set them.
+
+```ts
+const app = alxia()
+	.use(secureHeaders())
+	.get('/', ({ reply }) => reply(200, 'hi', { headers: { 'x-powered-by': 'php' } }));
+
+(await app.request('/')).headers.get('x-powered-by'); // null
+```
+
+`hidePoweredBy: false` keeps whatever the route or another hook sent.
+
+## A header a route sets is kept
+
+The plugin only fills in a header the response does not have yet. A route
+that needs its own policy sets it on its reply, and the other defaults
+still apply:
+
+```ts
+import { alxia } from '@alxia/core';
+import { secureHeaders } from '@alxia/secure-headers';
+
+const app = alxia()
+	.use(secureHeaders({ referrerPolicy: 'same-origin', xFrameOptions: false }))
+	.get('/page', ({ reply }) =>
+		reply(200, '<p>hi</p>', {
+			headers: { 'content-security-policy': "default-src 'self'" },
+		}),
+	);
+
+const response = await app.request('/page');
+response.headers.get('content-security-policy'); // "default-src 'self'"   — the route's
+response.headers.get('x-content-type-options');  // 'nosniff'              — the default
+response.headers.get('referrer-policy');         // 'same-origin'          — the option
+response.headers.get('x-frame-options');         // null                   — false
+```
+
+`set.headers` in a handler or a `derive` works the same way, since it ends
+up on the response before the plugin reads it.
+
+That is how `@alxia/openapi`'s reference page and `@alxia/graphql`'s IDE
+load under the strict default: each sets the `Content-Security-Policy` it
+needs, and `secureHeaders` keeps it.
+
+## Which responses get the headers
+
+The plugin runs as an `onResponse` hook, so it reaches what the app's
+`onResponse` hooks reach:
+
+| Response | Headers |
+| --- | --- |
+| a route's reply, `static` and `file` included | yes |
+| the core's 400, 404, 405 and 500 | yes |
+| a `Response` an `onRequest` hook returned (a CORS preflight, a redirect) | yes |
+| a WebSocket upgrade that succeeds (`101`) | no: `onResponse` hooks do not run for it |
+| a page served with `page()` | no: `Bun.serve` serves it, around no hook |
+| the 500 sent when an `around` hook itself throws | no |
+
+```ts
+const app = alxia().use(secureHeaders());
+
+const response = await app.request('/nope');
+response.status;                                // 404
+response.headers.get('x-content-type-options'); // 'nosniff'
+```
+
+## Order with other `onResponse` hooks
+
+`onResponse` hooks run in the order they are declared, and the plugin never
+overwrites a header that is already there. So:
+
+- a hook declared **before** `secureHeaders` that sets one of its headers
+  wins;
+- a hook declared **after** it that sets one of its headers wins too, by
+  overwriting;
+- a hook declared **after** it that adds `X-Powered-By` or `Server` keeps
+  it: the plugin deleted them before that hook ran.
+
+```ts
+import { alxia, withHeaders } from '@alxia/core';
+import { secureHeaders } from '@alxia/secure-headers';
+
+const app = alxia()
+	.onResponse((response) =>
+		withHeaders(response, (headers) => headers.set('referrer-policy', 'origin')),
+	)
+	.use(secureHeaders())
+	.get('/', ({ reply }) => reply(200, 'ok'));
+
+(await app.request('/')).headers.get('referrer-policy'); // 'origin'
+```
+
+## A header the plugin does not know
+
+The plugin sends the twelve headers above and nothing else. Another one —
+`Content-Security-Policy-Report-Only` while a policy is being tried, say —
+is a hook of your own, with `withHeaders` from `@alxia/core`:
+
+```ts
+import { alxia, withHeaders } from '@alxia/core';
+import { secureHeaders } from '@alxia/secure-headers';
+
+const app = alxia()
+	.use(secureHeaders())
+	.onResponse((response) =>
+		withHeaders(response, (headers) => {
+			if (!headers.has('content-security-policy-report-only')) {
+				headers.set(
+					'content-security-policy-report-only',
+					"default-src 'self'; report-to csp",
+				);
+			}
+		}),
+	);
+```
+
+See [Hooks](https://github.com/softistx/alxia/blob/develop/packages/core/docs/guide/hooks.md#onresponse)
+in the core's guide for what an `onResponse` hook may do.
+
+## Recipes
+
+### An app that serves HTML too
+
+The default policy blocks everything a page loads. Loosen it for the whole
+app when it serves its own pages, and keep framing refused:
+
+```ts
+app.use(
+	secureHeaders({
+		contentSecurityPolicy:
+			"default-src 'self'; img-src 'self' data:; base-uri 'self'; form-action 'self'; frame-ancestors 'none'",
+	}),
+);
+```
+
+Or keep the strict default for the API and give the pages their policy on
+their reply, as in [A header a route sets is kept](#a-header-a-route-sets-is-kept).
+
+### Framed by your own origin
+
+Both `frame-ancestors` in the policy and `X-Frame-Options` refuse framing;
+change both:
+
+```ts
+app.use(
+	secureHeaders({
+		contentSecurityPolicy: "default-src 'none'; frame-ancestors 'self'",
+		xFrameOptions: 'SAMEORIGIN',
+	}),
+);
+```
+
+### Images or files embedded by another origin
+
+`Cross-Origin-Resource-Policy: same-origin` stops another origin's
+`<img>`, `<script>` or `no-cors` fetch from reading the response. A
+CORS `fetch` is not affected. For a public asset host:
+
+```ts
+app.use(secureHeaders({ crossOriginResourcePolicy: 'cross-origin' }));
+```
+
+### Sign-in in a popup
+
+`Cross-Origin-Opener-Policy: same-origin` cuts the link between a page and
+a popup of another origin, which a sign-in popup that reports back through
+`window.opener` needs:
+
+```ts
+app.use(secureHeaders({ crossOriginOpenerPolicy: 'same-origin-allow-popups' }));
+```
+
+### Cross-origin isolation
+
+`SharedArrayBuffer` and precise timers need the page to be cross-origin
+isolated, which takes `Cross-Origin-Embedder-Policy` beside the default
+`Cross-Origin-Opener-Policy: same-origin`:
+
+```ts
+app.use(secureHeaders({ crossOriginEmbedderPolicy: 'require-corp' }));
+```
+
+## In a real app
+
+An API with a sign-in page, its own pages' policy, HSTS only in production,
+and a test that holds the headers in place:
+
+```ts
+// app.ts
+import { alxia } from '@alxia/core';
+import { secureHeaders } from '@alxia/secure-headers';
+
+const production = Bun.env.NODE_ENV === 'production';
+const PAGE_POLICY =
+	"default-src 'self'; img-src 'self' data:; base-uri 'self'; form-action 'self'; frame-ancestors 'none'";
+
+export const app = alxia()
+	.use(
+		secureHeaders({
+			permissionsPolicy: 'camera=(), microphone=(), geolocation=()',
+			...(production ? {} : { strictTransportSecurity: false }),
+		}),
+	)
+	.get('/api/me', ({ reply }) => reply(200, { name: 'Ada' }))
+	.get('/sign-in', ({ reply }) =>
+		reply(200, '<form method="post" action="/sign-in">…</form>', {
+			headers: {
+				'content-type': 'text/html; charset=utf-8',
+				'content-security-policy': PAGE_POLICY,
+			},
+		}),
+	);
+```
+
+```ts
+// app.spec.ts
+import { expect, test } from 'bun:test';
+import { app } from './app';
+
+test('the API keeps the strict policy', async () => {
+	const response = await app.request('/api/me');
+	expect(response.headers.get('content-security-policy')).toStartWith("default-src 'none'");
+	expect(response.headers.get('x-frame-options')).toBe('DENY');
+});
+
+test('the sign-in page has its own', async () => {
+	const response = await app.request('/sign-in');
+	expect(response.headers.get('content-security-policy')).toContain("form-action 'self'");
+	expect(response.headers.get('permissions-policy')).toBe('camera=(), microphone=(), geolocation=()');
+});
+
+test('a 404 is covered too', async () => {
+	const response = await app.request('/nope');
+	expect(response.status).toBe(404);
+	expect(response.headers.get('x-content-type-options')).toBe('nosniff');
+});
+```
+
+## See also
+
+- [Troubleshooting](troubleshooting.md): a browser refuses something, or
+  TypeScript does.
+- [Hooks](https://github.com/softistx/alxia/blob/develop/packages/core/docs/guide/hooks.md)
+  and [Groups and plugins](https://github.com/softistx/alxia/blob/develop/packages/core/docs/guide/groups-and-plugins.md)
+  in the core's guide.

package/docs/roadmap.md

@@ -0,0 +1,44 @@
+# Roadmap
+
+What `@alxia/secure-headers` gives an app, and what is coming. This page is
+a direction, not a commitment: the version something shipped in is the only
+number on it. Every release, with each change it made, is in
+[`CHANGELOG.md`](https://github.com/softistx/alxia/blob/develop/packages/secure-headers/CHANGELOG.md).
+
+## Now
+
+Nothing scheduled yet.
+
+## Next
+
+Nothing scheduled yet.
+
+## Later
+
+Nothing scheduled yet.
+
+## Not planned
+
+- **A runtime dependency.** The package installs nothing beside itself: the
+  headers are written on `@alxia/core`'s public API, its peer, so adding it
+  to an app adds no transitive package to audit or update.
+
+## Shipped
+
+### 0.1.0
+
+- **Secure headers on every response.** `secureHeaders()` is a plugin for
+  `use` that sends `Content-Security-Policy`, `Strict-Transport-Security`,
+  `X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy`,
+  `Cross-Origin-Opener-Policy`, `Cross-Origin-Resource-Policy`,
+  `Origin-Agent-Cluster`, `X-DNS-Prefetch-Control` and
+  `X-Permitted-Cross-Domain-Policies` with strict defaults for an API, on
+  every response — 404s, 405s and 500s included.
+- **Each header adjustable.** Every option takes the header's value, or
+  `false` to leave it out, and an empty value is refused at startup;
+  `Cross-Origin-Embedder-Policy` and `Permissions-Policy` are sent only when
+  given.
+- **A route's own header wins.** A header a route sets on its reply is kept,
+  so a page that needs its own policy sets it there.
+- **No `X-Powered-By` or `Server`.** Both are removed from every response,
+  unless `hidePoweredBy: false`.

package/docs/troubleshooting.md

@@ -0,0 +1,388 @@
+# Troubleshooting
+
+Each entry is headed by the text you see: a TypeScript error, an exception,
+a browser console message, or a header that is or is not on a response.
+`secureHeaders` itself throws nothing; what goes wrong is a type, a
+browser refusing what a header forbids, or a header in the wrong place.
+
+**Types**
+
+- [`Type 'true' is not assignable to type 'Setting | undefined'`](#type-true-is-not-assignable-to-type-setting--undefined)
+- [`… is not assignable to parameter of type 'SecureHeadersOptions' with 'exactOptionalPropertyTypes: true'`](#-is-not-assignable-to-parameter-of-type-secureheadersoptions-with-exactoptionalpropertytypes-true)
+- [`Object literal may only specify known properties, and '…' does not exist in type 'SecureHeadersOptions'`](#object-literal-may-only-specify-known-properties-and--does-not-exist-in-type-secureheadersoptions)
+- [`No overload matches this call` … `has no properties in common with type 'SecureHeadersOptions'`](#no-overload-matches-this-call--has-no-properties-in-common-with-type-secureheadersoptions)
+
+**Runtime**
+
+- [`TypeError: secureHeaders: … is empty; give false to leave the … header out`](#typeerror-secureheaders--is-empty-give-false-to-leave-the--header-out)
+- [`TypeError: alxia().use(secureHeaders).get is not a function`](#typeerror-alxiausesecureheadersget-is-not-a-function)
+
+**In the browser**
+
+- [`Refused to load the … because it violates the following Content Security Policy directive: "default-src 'none'"`](#refused-to-load-the--because-it-violates-the-following-content-security-policy-directive-default-src-none)
+- [`Refused to send form data to '…' because it violates the following Content Security Policy directive: "form-action 'none'"`](#refused-to-send-form-data-to--because-it-violates-the-following-content-security-policy-directive-form-action-none)
+- [`Refused to frame '…' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'"`](#refused-to-frame--because-an-ancestor-violates-the-following-content-security-policy-directive-frame-ancestors-none)
+- [`net::ERR_BLOCKED_BY_RESPONSE.NotSameOrigin`](#neterr_blocked_by_responsenotsameorigin)
+- [`window.opener` is `null` in a sign-in popup](#windowopener-is-null-in-a-sign-in-popup)
+- [A subdomain on plain HTTP no longer opens](#a-subdomain-on-plain-http-no-longer-opens)
+
+**Headers**
+
+- [An option has no effect on a response](#an-option-has-no-effect-on-a-response)
+- [`X-Powered-By` or `Server` is still sent](#x-powered-by-or-server-is-still-sent)
+- [A response arrives without the headers](#a-response-arrives-without-the-headers)
+- [Routes outside a group get the headers](#routes-outside-a-group-get-the-headers)
+
+## Types
+
+### `Type 'true' is not assignable to type 'Setting | undefined'`
+
+**When:** a header option is given `true`, an object or an array.
+
+```text
+error TS2322: Type 'true' is not assignable to type 'Setting | undefined'.
+error TS2322: Type '{ defaultSrc: string[]; }' is not assignable to type 'Setting | undefined'.
+```
+
+`hidePoweredBy` given anything but a boolean is the same error, against
+`'boolean | undefined'`.
+
+**Why:** a header option is the header's value as a string, or `false` to
+leave it out (`Setting`, exported, is `string | false`). There is no
+`true` — leaving the key out is the default — and no object form for a
+policy.
+
+**Fix:** write the header as it goes out, or leave the key out:
+
+```ts
+app.use(
+	secureHeaders({
+		contentSecurityPolicy: "default-src 'self'; img-src 'self' data:",
+		// xFrameOptions: true  →  leave it out for 'DENY'
+	}),
+);
+```
+
+### `… is not assignable to parameter of type 'SecureHeadersOptions' with 'exactOptionalPropertyTypes: true'`
+
+**When:** an option is set to `undefined`, often from a condition, with
+`exactOptionalPropertyTypes` on.
+
+```text
+error TS2379: Argument of type '{ xFrameOptions: undefined; }' is not assignable to parameter of type 'SecureHeadersOptions' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
+```
+
+**Why:** the options are optional, not `undefined`-able. Under that flag a
+key present with `undefined` is not a key left out.
+
+**Fix:** spread the key in only when it has a value:
+
+```ts
+const production = Bun.env.NODE_ENV === 'production';
+
+app.use(secureHeaders({ ...(production ? {} : { strictTransportSecurity: false }) }));
+```
+
+### `Object literal may only specify known properties, and '…' does not exist in type 'SecureHeadersOptions'`
+
+**When:** an option names a header the plugin does not send, or uses
+another library's name for one.
+
+```text
+error TS2353: Object literal may only specify known properties, and 'xPoweredBy' does not exist in type 'SecureHeadersOptions'.
+```
+
+**Why:** the options are the twelve headers in the
+[guide](guide.md#the-options), plus `hidePoweredBy`. `X-Powered-By` and
+`Server` are governed by `hidePoweredBy`; anything else —
+`Content-Security-Policy-Report-Only`, `X-XSS-Protection` — is not sent by
+the plugin.
+
+**Fix:** `hidePoweredBy` for those two; a hook of your own for another
+header:
+
+```ts
+import { alxia, withHeaders } from '@alxia/core';
+import { secureHeaders } from '@alxia/secure-headers';
+
+const app = alxia()
+	.use(secureHeaders({ hidePoweredBy: true }))
+	.onResponse((response) =>
+		withHeaders(response, (headers) =>
+			headers.set('content-security-policy-report-only', "default-src 'self'"),
+		),
+	);
+```
+
+### `No overload matches this call` … `has no properties in common with type 'SecureHeadersOptions'`
+
+**When:** `secureHeaders` is given to `use` without being called.
+
+```text
+error TS2769: No overload matches this call.
+  Overload 1 of 2, '(plugin: (app: Alxia<Empty, Empty, "", never>) => AnyAlxia): AnyAlxia', gave the following error.
+    Argument of type '(options?: SecureHeadersOptions | undefined) => Plugin' is not assignable to parameter of type '(app: Alxia<Empty, Empty, "", never>) => AnyAlxia'.
+      Types of parameters 'options' and 'app' are incompatible.
+        Type 'Alxia<Empty, Empty, "", never>' has no properties in common with type 'SecureHeadersOptions'.
+```
+
+**Why:** `secureHeaders` makes the plugin from its options; the plugin is
+what it returns.
+
+**Fix:** call it, with or without options:
+
+```ts
+app.use(secureHeaders());
+```
+
+## Runtime
+
+### `TypeError: secureHeaders: … is empty; give false to leave the … header out`
+
+**When:** `secureHeaders()` is called with a header option set to `''`, or
+to spaces only, usually to turn a header off. It throws at once, so the app
+fails at startup:
+
+```text
+TypeError: secureHeaders: xFrameOptions is empty; give false to leave the x-frame-options header out
+```
+
+**Why:** a header with an empty value says nothing a browser can act on.
+Only `false` leaves a header out.
+
+**Fix:**
+
+```ts
+app.use(secureHeaders({ xFrameOptions: false }));
+```
+
+### `TypeError: alxia().use(secureHeaders).get is not a function`
+
+**When:** the same mistake as above in JavaScript, or past a cast: the
+chain breaks on the next method after `use(secureHeaders)`.
+
+**Why:** `use` calls the function with the app. Uncalled, `secureHeaders`
+reads the app as its options and returns a plugin, not the app, so the
+next `.get` is called on a function.
+
+**Fix:**
+
+```ts
+const app = alxia()
+	.use(secureHeaders())
+	.get('/', ({ reply }) => reply(200, 'ok'));
+```
+
+## In the browser
+
+These messages are Chrome's wording; Firefox and Safari report the same
+refusal in their own words.
+
+### `Refused to load the … because it violates the following Content Security Policy directive: "default-src 'none'"`
+
+**When:** the app serves an HTML page, and the page's styles, scripts,
+images or fonts do not load. Chrome adds `Note that 'style-src-elem' was
+not explicitly set, so 'default-src' is used as a fallback.` or similar.
+Inline code reads `Refused to execute inline script …` or
+`Refused to apply inline style …`.
+
+**Why:** the default `Content-Security-Policy` is for an API:
+`default-src 'none'` lets a response load nothing.
+
+**Fix:** give the pages a policy on their reply, and keep the strict one for
+the API:
+
+```ts
+app.get('/', ({ reply }) =>
+	reply(200, html, {
+		headers: {
+			'content-type': 'text/html; charset=utf-8',
+			'content-security-policy': "default-src 'self'; img-src 'self' data:; frame-ancestors 'none'",
+		},
+	}),
+);
+```
+
+or set `contentSecurityPolicy` for the whole app. See the
+[guide](guide.md#an-app-that-serves-html-too).
+
+### `Refused to send form data to '…' because it violates the following Content Security Policy directive: "form-action 'none'"`
+
+**When:** a `<form>` on a page the app serves is submitted, and nothing
+happens.
+
+**Why:** the default policy has `form-action 'none'`: the page may post no
+form, even to itself.
+
+**Fix:** allow your origin in that page's policy:
+
+```ts
+const PAGE_POLICY = "default-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'";
+```
+
+### `Refused to frame '…' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'"`
+
+**When:** a page puts a response of the app in an `<iframe>`. With the
+policy turned off, the message becomes `Refused to display '…' in a frame
+because it set 'X-Frame-Options' to 'deny'.`
+
+**Why:** two headers refuse framing: `frame-ancestors 'none'` in the
+default policy, and `X-Frame-Options: DENY`. Turning one off leaves the
+other.
+
+**Fix:** change both:
+
+```ts
+app.use(
+	secureHeaders({
+		contentSecurityPolicy: "default-src 'none'; frame-ancestors 'self'",
+		xFrameOptions: 'SAMEORIGIN',
+	}),
+);
+```
+
+### `net::ERR_BLOCKED_BY_RESPONSE.NotSameOrigin`
+
+**When:** a page on another origin embeds a response of the app — an
+`<img>`, a `<script>`, a `no-cors` fetch — and the network panel shows it
+blocked, although it answered 200.
+
+**Why:** `Cross-Origin-Resource-Policy: same-origin` lets only the app's own
+origin embed its responses. A CORS `fetch` is not concerned.
+
+**Fix:** open it for the app when it serves public assets, or for the
+routes that need it, on their reply:
+
+```ts
+app.use(secureHeaders({ crossOriginResourcePolicy: 'cross-origin' }));
+```
+
+### `window.opener` is `null` in a sign-in popup
+
+**When:** a page of the app opens a popup to another origin — a sign-in,
+a payment — and the popup cannot report back, or the page sees the popup
+as closed at once.
+
+**Why:** `Cross-Origin-Opener-Policy: same-origin` puts the page in a
+browsing context group of its own, cut from any window of another origin.
+
+**Fix:**
+
+```ts
+app.use(secureHeaders({ crossOriginOpenerPolicy: 'same-origin-allow-popups' }));
+```
+
+### A subdomain on plain HTTP no longer opens
+
+**When:** after a browser has visited the app over HTTPS, another host
+under the same domain, served over plain HTTP, is forced to HTTPS and fails.
+
+**Why:** the default `Strict-Transport-Security` is
+`max-age=31536000; includeSubDomains`: the browser remembers, for a year,
+to use HTTPS for the host **and every subdomain**. A browser ignores the
+header on a plain-HTTP response, so it bites only once the app is reached
+over HTTPS.
+
+**Fix:** drop `includeSubDomains` when a subdomain is still on HTTP, or the
+header altogether where the app is not served over HTTPS:
+
+```ts
+app.use(secureHeaders({ strictTransportSecurity: 'max-age=31536000' }));
+```
+
+A browser that already stored the policy keeps it until it expires, or
+until it reads `max-age=0` from the host over HTTPS.
+
+## Headers
+
+### An option has no effect on a response
+
+**When:** an option is set, and some responses still carry another value.
+
+**Why:** the plugin never overwrites a header the response already has.
+A route set it on its reply or on `set.headers`, an `onResponse` hook
+declared before `secureHeaders` set it, or one declared after overwrote it.
+`@alxia/openapi`'s reference page and `@alxia/graphql`'s IDE set their own
+`Content-Security-Policy` on purpose.
+
+**Fix:** find what sets it on that route, and change it there:
+
+```ts
+const response = await app.request('/the-route');
+console.log(response.headers.get('content-security-policy'));
+```
+
+### `X-Powered-By` or `Server` is still sent
+
+**When:** `hidePoweredBy` is on (the default), and one of them is on the
+response.
+
+**Why:** the plugin deletes them when its hook runs. An `onResponse` hook
+declared after `secureHeaders` that adds one runs later, and keeps it. A
+proxy in front of the app may add its own `Server` too.
+
+**Fix:** declare `secureHeaders` after the hook that adds the header, or
+stop that hook adding it:
+
+```ts
+import { alxia, withHeaders } from '@alxia/core';
+import { secureHeaders } from '@alxia/secure-headers';
+
+const app = alxia()
+	.onResponse((response) =>
+		withHeaders(response, (headers) => headers.set('x-powered-by', 'my-app')),
+	)
+	.use(secureHeaders()); // its hook runs after, and deletes it
+```
+
+### A response arrives without the headers
+
+**When:** a response has none of the headers, though `secureHeaders` is
+in use.
+
+**Why:** the plugin is an `onResponse` hook, and three responses run no
+`onResponse` hook: a WebSocket upgrade that succeeds (the `101`), a page
+served with `page()`, which `Bun.serve` answers itself, and the 500 sent
+when an `around` hook throws.
+
+**Fix:** serve a page that needs the headers through a route, `file` or
+`static` rather than `page()` — or give it its policy in its HTML with
+`<meta http-equiv="Content-Security-Policy" content="…">`, where browsers
+ignore `frame-ancestors`. An `around` hook whose own work may fail catches
+it and still returns what `next()` resolved to, which already carries the
+headers:
+
+```ts
+app.around(async (_ctx, next) => {
+	const response = await next();
+	try {
+		recordTiming(response); // your own work
+	} catch (error) {
+		console.error(error);
+	}
+	return response;
+});
+```
+
+### Routes outside a group get the headers
+
+**When:** `secureHeaders` is used inside a `group`, meant for its routes
+only, and every route of the app gets the headers.
+
+**Why:** it adds a global hook, and a group's global hooks are the app's.
+
+**Fix:** use it on the app, and give the routes that differ their own
+values on their replies:
+
+```ts
+const app = alxia()
+	.use(secureHeaders())
+	.get('/embed', ({ reply }) =>
+		reply(200, 'ok', {
+			headers: {
+				'content-security-policy': "default-src 'none'; frame-ancestors 'self'",
+				'x-frame-options': 'SAMEORIGIN',
+			},
+		}),
+	);
+```

package/package.json

@@ -0,0 +1,53 @@
+{
+	"name": "@alxia/secure-headers",
+	"version": "0.1.0",
+	"description": "Secure HTTP headers for alxia: HSTS, CSP, nosniff and the rest, each one adjustable",
+	"license": "MIT",
+	"type": "module",
+	"main": "./dist/index.js",
+	"types": "./dist/index.d.ts",
+	"files": [
+		"dist",
+		"docs",
+		"README.md",
+		"package.json",
+		"LICENSE"
+	],
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"import": "./dist/index.js",
+			"default": "./dist/index.js"
+		},
+		"./package.json": "./package.json"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/softistx/alxia.git",
+		"directory": "packages/secure-headers"
+	},
+	"publishConfig": {
+		"registry": "https://registry.npmjs.org",
+		"access": "public"
+	},
+	"scripts": {
+		"build": "bun run ../../build.ts",
+		"test": "bun test src",
+		"typecheck": "tsc --noEmit"
+	},
+	"alxia": {
+		"entrypoints": [
+			"src/index.ts"
+		]
+	},
+	"devDependencies": {
+		"@alxia/client": "^0.1.0",
+		"@alxia/core": "^0.1.0",
+		"@types/bun": "^1.4.2",
+		"zod": "^4.2.0"
+	},
+	"peerDependencies": {
+		"@alxia/core": "^0.1.0",
+		"typescript": "^6.0.3 || ^7.0.0"
+	}
+}