@alxia/secure-headers 0.4.10 → 0.5.0

package/README.md

@@ -71,6 +71,96 @@ with `nonce: true`. Without `nonce: true`, the headers are what they always
 were. With `@alxia/react-router`, `nonceOf(loadContext)` hands it to
 `entry.server.tsx` ([its README](https://github.com/softistx/alxia/tree/develop/packages/react-router#a-csp-nonce)).
 
+## A policy from directives
+
+`csp()` writes the policy from directives, in the order you list them, and
+checks it once at startup. A list of sources is an array, `true` is a bare
+directive and `false` leaves one out; `NONCE` passes through, for
+`nonce: true` to replace on each request.
+
+```ts
+import { csp, NONCE, secureHeaders } from '@alxia/secure-headers';
+
+app.use(
+	secureHeaders({
+		nonce: true,
+		contentSecurityPolicy: csp({
+			'default-src': ["'self'"],
+			'script-src': ["'self'", NONCE],
+			'object-src': ["'none'"],
+			'upgrade-insecure-requests': true,
+		}),
+	}),
+);
+// default-src 'self'; script-src 'self' 'nonce-…'; object-src 'none'; upgrade-insecure-requests
+```
+
+An empty source list, a source holding `;`, `,` or a space, a name that is
+not lowercase letters, digits and hyphens starting with a letter, and a policy with no directive are
+refused with a `TypeError` that starts `csp():`.
+
+## Clearing the browser on sign-out
+
+```ts
+import { clearSiteData } from '@alxia/secure-headers';
+
+const cleared = clearSiteData(['cache']);
+
+app.use('/sign-out', cleared).use('/sign-out.data', cleared);
+```
+
+`Clear-Site-Data: "cache"` is sent on a 2xx or 3xx answer to a `POST`, so
+nothing of the visit stays in the browser's HTTP cache on a shared device. A
+GET, a 400, a 403 or a 500 clears nothing. `{ methods: ['POST', 'DELETE'] }`
+widens the rule. A route's own `Clear-Site-Data` is kept. React Router's client-side sign-out posts `/sign-out.data`,
+so mount both paths. An empty list or an unknown type is refused with a
+`TypeError` that starts `clearSiteData():`.
+
+## Pages
+
+`pageHeaders()` is `secureHeaders` for server-rendered pages: a strict policy
+with a nonce per request, HSTS and `upgrade-insecure-requests` only over
+HTTPS, `Referrer-Policy: strict-origin-when-cross-origin`, and
+`Cache-Control: private, no-store`, since a cache must never store a nonce.
+
+```ts
+import { createServer } from '@alxia/react-router';
+import { pageHeaders } from '@alxia/secure-headers';
+
+export default createServer({
+	configure: (app) => app.use(pageHeaders({ https: import.meta.env.PROD })),
+});
+```
+
+`https` is required and never read from the environment. `PAGE_DIRECTIVES`
+is the policy: `'self'` for everything, scripts only with the nonce (and what
+they load, `'strict-dynamic'`), nonced `<style>` elements, no `<base>`, forms
+to this site, no framing. `directives` merges over it: a list replaces a
+directive's sources, `false` removes the directive.
+
+```ts
+app.use(
+	pageHeaders({
+		https: true,
+		directives: {
+			'img-src': ["'self'", 'https://images.example'],
+			'manifest-src': false,
+		},
+	}),
+);
+```
+
+Any other `secureHeaders` option passes through and wins over the preset's;
+`contentSecurityPolicy` and `nonce` are not options here, and an explicit
+`undefined` keeps the preset's value. A `script-src`, or a `script-src-elem`
+list, without `NONCE` is refused with a `TypeError` that starts
+`pageHeaders():`; so is removing `default-src`, `base-uri` or `object-src`.
+`csp()` refuses a keyword written without its quotes (`self` for `'self'`) with
+a `TypeError` that starts `csp():`. `clearSiteData()` sends nothing for a
+request another site made (`Sec-Fetch-Site`, else `Origin` against the
+`origin` option, which a TLS-terminating proxy needs for older browsers),
+unless `crossSite: true`.
+
 ## Defaults
 
 | header | default | option |
@@ -87,18 +177,34 @@ were. With `@alxia/react-router`, `nonceOf(loadContext)` hands it to
 | `X-DNS-Prefetch-Control` | `off` | `xDnsPrefetchControl` |
 | `X-Permitted-Cross-Domain-Policies` | `none` | `xPermittedCrossDomainPolicies` |
 | `Permissions-Policy` | not sent | `permissionsPolicy` |
+| `Cache-Control` | not sent | `cacheControl` |
 
 Each option takes a value, or `false` to leave the header out; an empty
 value is refused at startup. `nonce` is off by default.
 `X-Powered-By` and `Server` are removed unless `hidePoweredBy: false`.
 
+`cacheControl` is for pages that carry a nonce or a viewer's data:
+`cacheControl: 'private, no-store'` keeps a cache from storing them. A route's
+own `Cache-Control` wins, and a 404 or a thrown error gets it too.
+
 ## API
 
 | export | |
 | --- | --- |
 | `secureHeaders(options?)` | the middleware, for `app.use`: a `SecureHeaders`, or with `nonce: true` a `NonceMiddleware` |
-| `SecureHeadersOptions` | its options: the headers and `hidePoweredBy`; `nonce` is added by each overload |
+| `SecureHeadersOptions` | its options: the headers (`cacheControl` included) and `hidePoweredBy`; `nonce` is added by each overload |
 | `Setting` | a header option's type: its value, or `false` to leave it out |
+| `csp(directives)` | a `Content-Security-Policy` string from directives, checked at startup |
+| `CspDirectives` | its argument: directive names to a `CspValue`, any name allowed |
+| `CspDirectiveName` | the directive names it completes |
+| `CspValue` | a directive's value: a list of sources, `true` for a bare directive, `false` to leave it out |
+| `clearSiteData(types, options?)` | a middleware sending `Clear-Site-Data` on a 2xx or 3xx answer to a `POST` (or `options.methods`) |
+| `ClearSiteDataType` | a value of the header: `'cache'`, `'cookies'`, `'storage'`, `'executionContexts'`, `'clientHints'`, `'prefetchCache'`, `'prerenderCache'` or `'*'` |
+| `ClearSiteDataOptions` | its options: `methods`, `['POST']` by default |
+| `ClearSiteData` | what `clearSiteData()` returns: a middleware that adds nothing to the context |
+| `pageHeaders(options)` | `secureHeaders({ nonce: true, … })` for server-rendered pages: `PAGE_DIRECTIVES` with a nonce, HSTS with `https`, no-store |
+| `PageHeadersOptions` | its options: `https` (required), `directives`, and every `secureHeaders` option but the policy and `nonce` |
+| `PAGE_DIRECTIVES` | the page policy's 13 directives, a `CspDirectives` |
 | `NONCE` | where the nonce goes in `contentSecurityPolicy`, each time it is named |
 | `NonceContext` | what `nonce: true` adds to the context: `nonce`, a string |
 | `SecureHeaders` | what `secureHeaders()` returns: a middleware that adds nothing to the context |
@@ -119,6 +225,6 @@ const app = alxia().use(secureHeaders()).use(errorHandler).get(...);
 
 ## Documentation
 
-- [Guide](https://github.com/softistx/alxia/tree/develop/packages/secure-headers/docs): every option and its default, the per-request nonce, which responses get the headers, a page's own policy, the order with other middlewares, and recipes.
+- [Guide](https://github.com/softistx/alxia/tree/develop/packages/secure-headers/docs): every option and its default, the per-request nonce, `csp()`, `pageHeaders()`, `cacheControl` and `clearSiteData()`, which responses get the headers, a page's own policy, the order with other middlewares, and recipes.
 - [Troubleshooting](https://github.com/softistx/alxia/blob/develop/packages/secure-headers/docs/troubleshooting.md): an error message or a browser refusal, and what to do about it.
 - [Roadmap](https://github.com/softistx/alxia/blob/develop/packages/secure-headers/docs/roadmap.md): what is coming, and what is not planned.

package/dist/clear-site-data.d.ts

@@ -0,0 +1,49 @@
+/**
+ * `clearSiteData`: `Clear-Site-Data` on a successful, same-site sign-out, as a
+ * middleware for the sign-out path.
+ */
+import { type Empty, type Middleware } from '@alxia/core';
+declare const TYPES: readonly ["cache", "cookies", "storage", "executionContexts", "clientHints", "prefetchCache", "prerenderCache", "*"];
+/** A value of the `Clear-Site-Data` header, without its quotes. */
+export type ClearSiteDataType = (typeof TYPES)[number];
+export interface ClearSiteDataOptions {
+    /** Defaults to `['POST']`: a GET to a sign-out URL clears nothing. */
+    readonly methods?: readonly string[];
+    /**
+     * Also clear on a request another site made. Defaults to `false`: a
+     * request whose `Sec-Fetch-Site` is not `same-origin` or `none`, or whose
+     * `Origin` is not the request's own, clears nothing.
+     */
+    readonly crossSite?: boolean;
+    /**
+     * The origin a request must come from, such as `https://app.example.com`:
+     * required behind a TLS-terminating proxy, where the request's own URL
+     * says `http:`, for a browser that sends no `Sec-Fetch-Site`. A getter is
+     * read at each request. Else the request's own origin.
+     */
+    readonly origin?: string | (() => string | undefined);
+}
+/**
+ * What `clearSiteData()` returns: a middleware, for `app.use`, that adds
+ * nothing to the context.
+ */
+export type ClearSiteData = Middleware<Empty, Promise<Response>>;
+/**
+ * `Clear-Site-Data` on a 2xx or 3xx answer to one of `methods` (`POST` by
+ * default). A request clears nothing when it is refused (a 403, a failure) or
+ * when another site made it (`Sec-Fetch-Site` other than `same-origin` or
+ * `none`; without that header, a foreign `Origin`), unless `crossSite` is `true`; a request
+ * with neither header, such as curl's, is cleared. Give it to `use(path, …)` for the sign-out path; React Router's
+ * single fetch posts `.data` too, so mount both:
+ *
+ * ```ts
+ * const cleared = clearSiteData(['cache']);
+ * app.use('/sign-out', cleared).use('/sign-out.data', cleared);
+ * ```
+ *
+ * Throws a `TypeError` at declaration on an empty `types`, a type that is not
+ * one of `ClearSiteDataType`, and an empty `methods` or an empty method name.
+ */
+export declare function clearSiteData(types: readonly ClearSiteDataType[], options?: ClearSiteDataOptions): ClearSiteData;
+export {};
+//# sourceMappingURL=clear-site-data.d.ts.map

package/dist/clear-site-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clear-site-data.d.ts","sourceRoot":"","sources":["../src/clear-site-data.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAEN,KAAK,KAAK,EACV,KAAK,UAAU,EAIf,MAAM,aAAa,CAAC;AAErB,QAAA,MAAM,KAAK,sHASD,CAAC;AAEX,mEAAmE;AACnE,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,MAAM,WAAW,oBAAoB;IACpC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;CACtD;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;AAwBjE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAC5B,KAAK,EAAE,SAAS,iBAAiB,EAAE,EACnC,OAAO,GAAE,oBAAyB,GAChC,aAAa,CAgCf"}

package/dist/csp.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `csp`: a `Content-Security-Policy` written as directives, checked once at
+ * startup, instead of one long string.
+ */
+/**
+ * A directive's value: its sources; `true` for a bare directive
+ * (`upgrade-insecure-requests`); `false` to leave it out.
+ */
+export type CspValue = readonly string[] | boolean;
+/** The directives a policy usually names, for completion. */
+export type CspDirectiveName = 'default-src' | 'script-src' | 'script-src-elem' | 'script-src-attr' | 'style-src' | 'style-src-elem' | 'style-src-attr' | 'img-src' | 'font-src' | 'connect-src' | 'media-src' | 'object-src' | 'frame-src' | 'child-src' | 'worker-src' | 'manifest-src' | 'base-uri' | 'form-action' | 'frame-ancestors' | 'upgrade-insecure-requests' | 'sandbox';
+/** A policy's directives: the known names complete, any other name is allowed. */
+export type CspDirectives = {
+    readonly [K in CspDirectiveName]?: CspValue | undefined;
+} & {
+    readonly [name: string]: CspValue | undefined;
+};
+/**
+ * The policy, written in insertion order: `name src src; name src`. `NONCE`
+ * passes through as it is, for `secureHeaders({ nonce: true })` to replace.
+ * Throws a `TypeError` at startup on a policy a browser would misread, such
+ * as a keyword written without its quotes (`self` for `'self'`).
+ *
+ * ```ts
+ * secureHeaders({
+ *   nonce: true,
+ *   contentSecurityPolicy: csp({
+ *     'default-src': ["'self'"],
+ *     'script-src': ["'self'", NONCE],
+ *     'upgrade-insecure-requests': true,
+ *   }),
+ * });
+ * ```
+ */
+export declare function csp(directives: CspDirectives): string;
+//# sourceMappingURL=csp.d.ts.map

package/dist/csp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.d.ts","sourceRoot":"","sources":["../src/csp.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC;AAEnD,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GACzB,aAAa,GACb,YAAY,GACZ,iBAAiB,GACjB,iBAAiB,GACjB,WAAW,GACX,gBAAgB,GAChB,gBAAgB,GAChB,SAAS,GACT,UAAU,GACV,aAAa,GACb,WAAW,GACX,YAAY,GACZ,WAAW,GACX,WAAW,GACX,YAAY,GACZ,cAAc,GACd,UAAU,GACV,aAAa,GACb,iBAAiB,GACjB,2BAA2B,GAC3B,SAAS,CAAC;AAEb,kFAAkF;AAClF,MAAM,MAAM,aAAa,GAAG;IAC3B,QAAQ,EAAE,CAAC,IAAI,gBAAgB,CAAC,CAAC,EAAE,QAAQ,GAAG,SAAS;CACvD,GAAG;IACH,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;CAC9C,CAAC;AAuBF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,GAAG,CAAC,UAAU,EAAE,aAAa,GAAG,MAAM,CAwCrD"}

package/dist/index.d.ts

@@ -1,3 +1,6 @@
+export { type ClearSiteData, type ClearSiteDataOptions, type ClearSiteDataType, clearSiteData, } from './clear-site-data';
+export { type CspDirectiveName, type CspDirectives, type CspValue, csp, } from './csp';
 export { NONCE, type NonceContext } from './nonce';
+export { PAGE_DIRECTIVES, type PageHeadersOptions, pageHeaders, } from './page';
 export { type NonceMiddleware, type SecureHeaders, type SecureHeadersOptions, type Setting, secureHeaders, } from './secure-headers';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EACN,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,OAAO,EACZ,aAAa,GACb,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,aAAa,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,GAAG,GACH,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EACN,eAAe,EACf,KAAK,kBAAkB,EACvB,WAAW,GACX,MAAM,QAAQ,CAAC;AAChB,OAAO,EACN,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,OAAO,EACZ,aAAa,GACb,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -1,3 +1,112 @@
+// src/clear-site-data.ts
+import {
+  defineMiddleware,
+  markFactory,
+  settle,
+  withHeaders
+} from "@alxia/core";
+var TYPES = [
+  "cache",
+  "cookies",
+  "storage",
+  "executionContexts",
+  "clientHints",
+  "prefetchCache",
+  "prerenderCache",
+  "*"
+];
+function quoted(names) {
+  return names.map((name) => `"${name}"`).join(", ");
+}
+function isCrossSite(request, own) {
+  const site = request.headers.get("sec-fetch-site");
+  if (site !== null)
+    return site !== "same-origin" && site !== "none";
+  const origin = request.headers.get("origin");
+  if (origin === null)
+    return false;
+  const set = typeof own === "function" ? own() : own;
+  return origin !== (set ?? new URL(request.url).origin);
+}
+function clearSiteData(types, options = {}) {
+  if (types.length === 0) {
+    throw new TypeError('clearSiteData(): no type is given: write at least one, such as ["cache"]');
+  }
+  for (const type of types) {
+    if (!TYPES.includes(type)) {
+      throw new TypeError(`clearSiteData(): "${type}" is not a type: write one of ${quoted(TYPES)}`);
+    }
+  }
+  const value = quoted(types);
+  const given = options.methods ?? ["POST"];
+  if (given.length === 0 || given.some((method) => method === "")) {
+    throw new TypeError('clearSiteData(): methods is empty or holds an empty method: write at least one, such as ["POST"], or leave methods out');
+  }
+  const methods = new Set(given.map((method) => method.toUpperCase()));
+  const crossSite = options.crossSite === true;
+  return defineMiddleware(async function clearSiteData(ctx, next) {
+    const response = await settle(ctx, next());
+    if (!methods.has(ctx.request.method))
+      return response;
+    if (response.status < 200 || response.status >= 400)
+      return response;
+    if (!crossSite && isCrossSite(ctx.request, options.origin))
+      return response;
+    return withHeaders(response, (headers) => {
+      if (!headers.has("clear-site-data"))
+        headers.set("clear-site-data", value);
+    });
+  });
+}
+markFactory(clearSiteData);
+// src/csp.ts
+var KEYWORDS = new Set([
+  "self",
+  "none",
+  "unsafe-inline",
+  "unsafe-eval",
+  "unsafe-hashes",
+  "strict-dynamic",
+  "wasm-unsafe-eval",
+  "report-sample",
+  "inline-speculation-rules"
+]);
+function isUnquotedKeyword(source) {
+  const lower = source.toLowerCase();
+  return KEYWORDS.has(lower) || /^(nonce|sha256|sha384|sha512)-[a-z0-9+/_-]+=*$/.test(lower);
+}
+function csp(directives) {
+  const written = [];
+  for (const [name, value] of Object.entries(directives)) {
+    if (!/^[a-z][a-z0-9-]*$/.test(name)) {
+      throw new TypeError(`csp(): "${name}" is not a directive name: write lowercase letters, digits and hyphens, starting with a letter, as in "script-src"`);
+    }
+    if (value === undefined || value === false)
+      continue;
+    if (value === true) {
+      written.push(name);
+      continue;
+    }
+    if (value.length === 0) {
+      throw new TypeError(`csp(): ${name} has no source: write ["'none'"] to allow nothing, or false to leave it out`);
+    }
+    for (const source of value) {
+      if (/[;,\s]/.test(source) || source === "") {
+        throw new TypeError(`csp(): ${name} has the source "${source}", which is empty or holds ";", "," or a space: a source is one token, so split a list into several sources, and write a comma inside a URL as %2C`);
+      }
+    }
+    for (const source of value) {
+      if (isUnquotedKeyword(source)) {
+        throw new TypeError(`csp(): ${source} in ${name} is a keyword: write it quoted, '${source}'`);
+      }
+    }
+    written.push(`${name} ${value.join(" ")}`);
+  }
+  if (written.length === 0) {
+    throw new TypeError(`csp(): no directive is left: give at least one, such as { "default-src": ["'none'"] }`);
+  }
+  return written.join("; ");
+}
 // src/nonce.ts
 var NONCE = "'nonce-{alxia}'";
 var SCRIPT_DIRECTIVES = new Set(["script-src", "script-src-elem"]);
@@ -16,12 +125,15 @@ function freshNonce() {
   const bytes = crypto.getRandomValues(new Uint8Array(16));
   return btoa(String.fromCharCode(...bytes));
 }
+// src/page.ts
+import { markFactory as markFactory3 } from "@alxia/core";
+
 // src/secure-headers.ts
 import {
-  defineMiddleware,
-  markFactory,
-  settle,
-  withHeaders
+  defineMiddleware as defineMiddleware2,
+  markFactory as markFactory2,
+  settle as settle2,
+  withHeaders as withHeaders2
 } from "@alxia/core";
 var DEFAULTS = {
   "content-security-policy": "default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
@@ -35,7 +147,8 @@ var DEFAULTS = {
   "origin-agent-cluster": "?1",
   "x-dns-prefetch-control": "off",
   "x-permitted-cross-domain-policies": "none",
-  "permissions-policy": false
+  "permissions-policy": false,
+  "cache-control": false
 };
 var OPTION = {
   "content-security-policy": "contentSecurityPolicy",
@@ -49,7 +162,8 @@ var OPTION = {
   "origin-agent-cluster": "originAgentCluster",
   "x-dns-prefetch-control": "xDnsPrefetchControl",
   "x-permitted-cross-domain-policies": "xPermittedCrossDomainPolicies",
-  "permissions-policy": "permissionsPolicy"
+  "permissions-policy": "permissionsPolicy",
+  "cache-control": "cacheControl"
 };
 function secureHeaders(options = {}) {
   const headers = fixedHeaders(options);
@@ -60,8 +174,8 @@ function secureHeaders(options = {}) {
       throw new TypeError("secureHeaders: contentSecurityPolicy names NONCE, but nonce is off: give nonce: true");
     }
     const set = setter(headers, hide);
-    return defineMiddleware(async function secureHeaders(ctx, next) {
-      return set(await settle(ctx, next()));
+    return defineMiddleware2(async function secureHeaders(ctx, next) {
+      return set(await settle2(ctx, next()));
     });
   }
   if (policy === undefined) {
@@ -70,9 +184,9 @@ function secureHeaders(options = {}) {
   headers.delete("content-security-policy");
   const withNonce = policyWithNonce(policy);
   const set = setter(headers, hide);
-  return defineMiddleware(async function secureHeaders(ctx, next) {
+  return defineMiddleware2(async function secureHeaders(ctx, next) {
     const added = { nonce: freshNonce() };
-    const response = await settle(ctx, next(added));
+    const response = await settle2(ctx, next(added));
     return set(response, withNonce(added.nonce));
   });
 }
@@ -90,7 +204,7 @@ function fixedHeaders(options) {
   return headers;
 }
 function setter(headers, hide) {
-  return (response, policy) => withHeaders(response, (current) => {
+  return (response, policy) => withHeaders2(response, (current) => {
     for (const [name, value] of headers) {
       if (!current.has(name))
         current.set(name, value);
@@ -104,11 +218,75 @@ function setter(headers, hide) {
     }
   });
 }
-markFactory(secureHeaders);
+markFactory2(secureHeaders);
+
+// src/page.ts
+var PAGE_POLICY = {
+  "default-src": ["'self'"],
+  "script-src": ["'self'", NONCE, "'strict-dynamic'"],
+  "style-src-elem": ["'self'", NONCE],
+  "style-src-attr": ["'unsafe-inline'"],
+  "img-src": ["'self'"],
+  "font-src": ["'self'"],
+  "connect-src": ["'self'"],
+  "worker-src": ["'self'"],
+  "manifest-src": ["'self'"],
+  "object-src": ["'none'"],
+  "base-uri": ["'none'"],
+  "form-action": ["'self'"],
+  "frame-ancestors": ["'none'"]
+};
+var PAGE_DIRECTIVES = Object.freeze(Object.fromEntries(Object.entries(PAGE_POLICY).map(([name, sources]) => [
+  name,
+  Object.freeze(sources)
+])));
+var REQUIRED = {
+  "default-src": "it covers frame, media and child sources",
+  "base-uri": "it has no fallback, so an injected <base> would redirect nonced relative scripts",
+  "object-src": "it blocks plugin content"
+};
+function pageHeaders(options) {
+  const { https, directives: asGiven = {}, ...given } = options;
+  const defined = (entries) => Object.fromEntries(Object.entries(entries).filter(([, value]) => value !== undefined));
+  const rest = defined(given);
+  const directives = defined(asGiven);
+  for (const [name, why] of Object.entries(REQUIRED)) {
+    const value = directives[name];
+    if (value === false || value === true) {
+      throw new TypeError(`pageHeaders(): ${name} cannot be removed from a page policy: ${why}, so give it a list of sources`);
+    }
+  }
+  const merged = {
+    ...PAGE_DIRECTIVES,
+    ...directives,
+    "upgrade-insecure-requests": directives["upgrade-insecure-requests"] ?? https
+  };
+  const scripts = merged["script-src"];
+  if (!Array.isArray(scripts) || !scripts.includes(NONCE)) {
+    throw new TypeError(`pageHeaders(): script-src has no NONCE: a page script runs only with the response's nonce, so write script-src with NONCE in directives, such as ["'self'", NONCE, "'strict-dynamic'"]`);
+  }
+  const elements = merged["script-src-elem"];
+  if (Array.isArray(elements) && !elements.includes(NONCE)) {
+    throw new TypeError("pageHeaders(): script-src-elem has no NONCE: script elements follow it instead of script-src, so add NONCE to it, or give false to remove it");
+  }
+  return secureHeaders({
+    ...https ? {} : { strictTransportSecurity: false },
+    referrerPolicy: "strict-origin-when-cross-origin",
+    cacheControl: "private, no-store",
+    ...rest,
+    nonce: true,
+    contentSecurityPolicy: csp(merged)
+  });
+}
+markFactory3(pageHeaders);
 export {
   NONCE,
+  PAGE_DIRECTIVES,
+  clearSiteData,
+  csp,
+  pageHeaders,
   secureHeaders
 };
 
-//# debugId=DA6BBAE79DDA945364756E2164756E21
+//# debugId=544F13C33DDC4CC564756E2164756E21
 //# sourceMappingURL=index.js.map