@botiverse/porthole 0.1.8 → 0.2.0

package/dist/server/host.js

@@ -0,0 +1,416 @@
+import { embedderFrameSourcesOf } from "../compile/policy.js";
+import { base64url, hmacSha256, utf8 } from "./crypto.js";
+import { ContentDomainError, contentDomain, serverDomain, } from "./domain.js";
+import { reservedLabels } from "./naming.js";
+import { appStatusPage } from "./pages.js";
+import { createServer } from "./server.js";
+/**
+ * The host kit (P066): everything around `/server` that every host wrote, so an app writes only
+ * its policy (four callbacks) and its settings. Web-standard and runtime-agnostic: Node (through
+ * `@botiverse/porthole/node`), Cloudflare Workers, Deno, Bun.
+ */
+/** Where Porthole answers its health check, on the health label. */
+export const HEALTH_PATH = "/__porthole/health";
+const DEFAULT_HEALTH_LABEL = "porthole-health";
+const PROBE_TIMEOUT_MS = 10_000;
+const UNHEALTHY_EVERY_MS = 60_000;
+const HEALTHY_EVERY_MS = 600_000;
+const isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const json = (status, body, headers = {}) => new Response(JSON.stringify(body), {
+    status,
+    headers: {
+        "content-type": "application/json; charset=utf-8",
+        "cache-control": "no-store",
+        "x-content-type-options": "nosniff",
+        ...headers,
+    },
+});
+const refusal = (status, code, message) => json(status, { error: { code, message } });
+/** A plain page for the content domain's own refusals: never the app's. */
+const plain = (status, text) => new Response(text, {
+    status,
+    headers: {
+        "content-type": "text/plain; charset=utf-8",
+        "cache-control": "no-store",
+        "x-content-type-options": "nosniff",
+        "referrer-policy": "no-referrer",
+        "x-robots-tag": "noindex, nofollow",
+    },
+});
+/** The CSP source for an authorize route: its origin and path, so nothing else there frames. */
+const authorizeSource = (url) => {
+    const parsed = new URL(url);
+    return `${parsed.origin}${parsed.pathname}`;
+};
+/** The default probe: the runtime's `fetch`, no redirects followed, a timeout. */
+const fetchProbe = async (url, timeoutMs) => {
+    const response = await fetch(url, {
+        redirect: "manual",
+        headers: { accept: "application/json" },
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    const body = (await response.text()).slice(0, 4_096);
+    return { status: response.status, body };
+};
+export function createContentHost(options) {
+    const gate = options.health;
+    const log = options.log ?? (() => { });
+    const secret = typeof options.secret === "string" ? utf8(options.secret.trim()) : options.secret;
+    const healthLabel = gate?.label ?? DEFAULT_HEALTH_LABEL;
+    // The id Porthole's health check answers with: keyed, so another deployment's answer fails.
+    const healthId = base64url(hmacSha256(secret, utf8("porthole/health"))).slice(0, 22);
+    const appReserved = reservedLabels(options.reserved);
+    let domain = null;
+    let server = null;
+    let view = { state: "off" };
+    let configs = {};
+    try {
+        domain =
+            options.domain !== null && typeof options.domain === "object"
+                ? options.domain
+                : contentDomain(options.domain, { appOrigins: options.appOrigins });
+        if (domain !== null) {
+            if (options.entry !== undefined && options.name?.scopeOf === undefined) {
+                throw new TypeError("Redirect entry needs a naming that says which scope a label names (prefixedName)");
+            }
+            configs =
+                typeof options.configs === "function" ? options.configs(domain.source) : options.configs;
+            server = createServer({
+                content: serverDomain(domain, {
+                    ...(options.name === undefined ? {} : { name: options.name }),
+                    reserved: (label) => appReserved(label) || (gate !== undefined && label === healthLabel),
+                }),
+                secret,
+                hostOrigins: options.appOrigins,
+                configs,
+                ...(options.source === undefined ? {} : { artifacts: { get: options.source } }),
+                ...(options.tickets === undefined ? {} : { tickets: options.tickets }),
+                ...(options.upstream === undefined ? {} : { upstream: options.upstream }),
+                ...(options.entry === undefined
+                    ? {}
+                    : { entry: { authorizeUrl: options.entry.authorizeUrl } }),
+                ...(options.authorize === undefined
+                    ? {}
+                    : {
+                        authorize: {
+                            check: options.authorize,
+                            ...(options.authorizeTtlSeconds === undefined
+                                ? {}
+                                : { ttlSeconds: options.authorizeTtlSeconds }),
+                        },
+                    }),
+            });
+            view = gate === undefined ? { state: "healthy" } : { state: "checking" };
+        }
+    }
+    catch (error) {
+        // Porthole never serves settings it refuses. Without the fallback, the app can't start so;
+        // with it, they are a lasting "unhealthy: misconfigured", told once.
+        if (gate === undefined) {
+            throw error;
+        }
+        const code = error instanceof ContentDomainError ? error.code : "refused";
+        const reason = error instanceof Error ? error.message : String(error);
+        server = null;
+        view = { state: "unhealthy", reason: `misconfigured: ${reason}`, misconfigured: true };
+        log({ evt: "porthole.content.misconfigured", code, reason });
+    }
+    const served = () => server !== null && view.state === "healthy";
+    // The health gate: one check at a time, again after a minute while unhealthy, ten while healthy.
+    let timer = null;
+    let running = null;
+    let closed = false;
+    const schedule = () => {
+        if (closed || gate === undefined || view.misconfigured === true || domain === null) {
+            return;
+        }
+        timer = setTimeout(() => void check(), view.state === "healthy" ? HEALTHY_EVERY_MS : UNHEALTHY_EVERY_MS);
+        timer.unref?.();
+    };
+    const probe = async () => {
+        if (domain === null) {
+            return "no content domain";
+        }
+        const host = `${healthLabel}.${domain.domain}`;
+        try {
+            const answer = await (gate?.probe ?? fetchProbe)(`${domain.originOf(healthLabel)}${HEALTH_PATH}`, gate?.timeoutMs ?? PROBE_TIMEOUT_MS);
+            if (answer.status !== 200) {
+                return `${host} answered ${answer.status}, not Porthole's health check`;
+            }
+            let said = null;
+            try {
+                said = JSON.parse(answer.body);
+            }
+            catch {
+                said = null;
+            }
+            if (!isRecord(said) || said.porthole !== "content-domain") {
+                return `${host} is answered by something else`;
+            }
+            return said.id === healthId ? null : `${host} is answered by another deployment`;
+        }
+        catch (error) {
+            return `${host}: ${error instanceof Error ? error.message : String(error)}`;
+        }
+    };
+    const check = async () => {
+        if (gate === undefined || domain === null || view.misconfigured === true) {
+            return view;
+        }
+        running ??= (async () => {
+            if (timer !== null) {
+                clearTimeout(timer);
+                timer = null;
+            }
+            const reason = await probe();
+            const before = view;
+            view =
+                reason === null
+                    ? { state: "healthy", checkedAt: Date.now() }
+                    : { state: "unhealthy", reason, checkedAt: Date.now() };
+            if (before.state !== view.state || before.reason !== view.reason) {
+                log(reason === null
+                    ? { evt: "porthole.content.healthy" }
+                    : { evt: "porthole.content.unhealthy", reason });
+            }
+            running = null;
+            schedule();
+            return view;
+        })();
+        return running;
+    };
+    // Issues per key per minute, in this process.
+    const issued = new Map();
+    const withinRate = (key) => {
+        const limit = options.rateLimit;
+        if (limit === undefined) {
+            return true;
+        }
+        const at = Date.now();
+        const recent = (issued.get(key) ?? []).filter((time) => at - time < 60_000);
+        if (recent.length >= limit.perMinute) {
+            issued.set(key, recent);
+            return false;
+        }
+        recent.push(at);
+        issued.set(key, recent);
+        if (issued.size > 50_000) {
+            issued.clear();
+        }
+        return true;
+    };
+    /** The content domain's label for a request, or null: the app's host, or a label it reserved. */
+    const routeOf = (request) => {
+        if (domain === null) {
+            return null;
+        }
+        let url;
+        try {
+            url = new URL(request.url);
+        }
+        catch {
+            return null;
+        }
+        const header = request.headers.get("host");
+        const byUrl = domain.isContentHost(url.hostname);
+        const byHeader = header !== null && domain.isContentHost(header);
+        if (!byUrl && !byHeader) {
+            return null;
+        }
+        const label = (byUrl ? domain.labelOf(url.hostname) : header === null ? null : domain.labelOf(header)) ??
+            "";
+        const top = label.split(".").at(-1) ?? "";
+        return top !== "" && appReserved(top) ? null : { url, label };
+    };
+    return {
+        get domain() {
+            return domain;
+        },
+        get server() {
+            return server;
+        },
+        frameSources: server === null || domain === null
+            ? []
+            : [
+                ...embedderFrameSourcesOf(Object.values(configs)),
+                // A frame on a clean address goes by the authorize route (only that path).
+                ...(options.entry === undefined ? [] : [authorizeSource(options.entry.authorizeUrl)]),
+            ],
+        owns: (request) => routeOf(request) !== null,
+        async fetch(request) {
+            const route = routeOf(request);
+            if (route === null) {
+                return null;
+            }
+            const { url, label } = route;
+            if (server === null) {
+                return plain(503, "Content is unavailable.");
+            }
+            if (gate !== undefined && label === healthLabel) {
+                return url.pathname === HEALTH_PATH && request.method.toUpperCase() === "GET"
+                    ? json(200, { porthole: "content-domain", id: healthId })
+                    : plain(404, "Not found.");
+            }
+            return (await server.handle(request)) ?? plain(404, "Not found.");
+        },
+        issue(viewerOf) {
+            return async (request) => {
+                if (request.method.toUpperCase() !== "POST") {
+                    return refusal(405, "method", "POST { instance } here");
+                }
+                if (!served() || server === null) {
+                    return refusal(503, "not-served", domain === null && view.misconfigured !== true
+                        ? "This app serves no content frames"
+                        : `Content frames aren't served now: ${view.reason ?? "the content domain is checking"}`);
+                }
+                let viewer;
+                try {
+                    viewer = await viewerOf(request);
+                }
+                catch {
+                    return refusal(500, "failed", "The app couldn't tell who is asking");
+                }
+                const key = options.rateLimit?.key?.(request, viewer) ??
+                    (viewer === null
+                        ? `address:${request.headers.get("cf-connecting-ip") ?? request.headers.get("x-forwarded-for") ?? ""}`
+                        : `viewer:${JSON.stringify(viewer)}`);
+                if (!withinRate(key)) {
+                    return refusal(429, "rate-limited", "Too many frames asked for: try again in a minute");
+                }
+                let body;
+                try {
+                    body = await request.json();
+                }
+                catch {
+                    return refusal(400, "bad-json", "The body is JSON: { instance }");
+                }
+                const proposal = isRecord(body) ? body.instance : undefined;
+                if (!isRecord(proposal) ||
+                    typeof proposal.scope !== "string" ||
+                    !isRecord(proposal.document) ||
+                    typeof proposal.document.kind !== "string") {
+                    return refusal(400, "bad-request", "The body is { instance: { scope, document } }");
+                }
+                try {
+                    const instance = await options.instance(proposal, viewer, request);
+                    if (instance === null) {
+                        return refusal(404, "not-found", "There is nothing to show for that instance");
+                    }
+                    const grant = await options.access(instance, viewer, request);
+                    if (grant === null) {
+                        return viewer === null
+                            ? refusal(401, "unauthenticated", "Sign in to see this")
+                            : refusal(403, "forbidden", "You can't see this");
+                    }
+                    let location;
+                    try {
+                        location = await server.issue(instance, grant);
+                    }
+                    catch (error) {
+                        return refusal(409, "refused", error instanceof Error ? error.message : String(error));
+                    }
+                    return json(201, location);
+                }
+                catch {
+                    return refusal(500, "failed", "The app's policy failed");
+                }
+            };
+        },
+        meta: () => ({
+            served: served(),
+            contentSource: domain?.source ?? null,
+            health: gate === undefined ? null : view,
+        }),
+        urlOf(scope, path = "/") {
+            return server === null || !served() ? null : server.urlOf(scope, path);
+        },
+        authorize(viewerOf) {
+            const appPage = (status, title, detail, reason, method, link) => appStatusPage(status, title, detail, options.appOrigins.join(" "), reason, options.appOrigins, link, method);
+            return async (request) => {
+                const method = request.method.toUpperCase();
+                if (method !== "GET" && method !== "HEAD") {
+                    return appPage(405, "Not allowed", "Open this address in a browser.", "error", method);
+                }
+                const entry = options.entry;
+                if (entry === undefined || server === null || domain === null || !served()) {
+                    return appPage(503, "Content is unavailable", "This app isn't serving content now. Try again later.", "error", method);
+                }
+                const state = server.entryState(new URL(request.url).searchParams.get("state") ?? "");
+                if (state === null) {
+                    return appPage(400, "This link isn't valid", "Open the address again.", "error", method);
+                }
+                const dest = request.headers.get("sec-fetch-dest");
+                const framed = dest === null ? state.framed : dest !== "document";
+                const clean = `${domain.originOf(state.label)}${state.path}`;
+                if (state.expired) {
+                    return appPage(401, "This took too long", "Open the address again.", "session", method, framed ? undefined : { href: clean, text: "Open it again" });
+                }
+                const scope = options.name?.scopeOf?.(state.label) ?? null;
+                let viewer;
+                try {
+                    viewer = await viewerOf(request);
+                }
+                catch {
+                    return appPage(500, "Something went wrong", "The app couldn't tell who is asking.", "error", method);
+                }
+                try {
+                    const instance = scope === null
+                        ? null
+                        : await entry.at(scope, new URL(state.path, "https://x.invalid").pathname, viewer, request);
+                    const grant = instance === null ? null : await options.access(instance, viewer, request);
+                    if (instance === null || grant === null) {
+                        if (viewer === null) {
+                            // The app's sign-in never shows in a frame: the person opens a tab for it.
+                            return framed
+                                ? appPage(401, "Open this in a new tab to sign in", "Signing in doesn't work inside a frame.", "sign-in", method)
+                                : await entry.signIn(request.url, request);
+                        }
+                        const status = instance === null ? 404 : 403;
+                        if (!framed && entry.refusal !== undefined) {
+                            return await entry.refusal(status, request);
+                        }
+                        return status === 404
+                            ? appPage(404, "Not found", "There is nothing here.", "not-found", method)
+                            : appPage(403, "You can't open this", "You don't have access to it.", "denied", method);
+                    }
+                    const key = options.rateLimit?.key?.(request, viewer) ??
+                        (viewer === null ? `entry:${state.label}` : `viewer:${JSON.stringify(viewer)}`);
+                    if (!withinRate(key)) {
+                        return appPage(429, "Too many requests", "Try again in a minute.", "error", method);
+                    }
+                    let location;
+                    try {
+                        location = await server.enterBy(state, instance, grant);
+                    }
+                    catch {
+                        return appPage(409, "This can't be opened here", "Open the address again.", "error", method);
+                    }
+                    return new Response(null, {
+                        status: 302,
+                        headers: {
+                            location,
+                            "cache-control": "no-store",
+                            "referrer-policy": "no-referrer",
+                        },
+                    });
+                }
+                catch {
+                    return appPage(500, "Something went wrong", "The app's policy failed.", "error", method);
+                }
+            };
+        },
+        access: async (request) => (server === null ? null : server.access(request)),
+        start() {
+            closed = false;
+            void check();
+        },
+        check,
+        close() {
+            closed = true;
+            if (timer !== null) {
+                clearTimeout(timer);
+                timer = null;
+            }
+        },
+    };
+}

package/dist/server/index.d.ts

@@ -9,6 +9,11 @@
  *
  * and calls `issue` from its own authenticated API when a viewer opens served content.
  *
+ * The host kit (P066): `createContentHost` wraps `createServer` with the routing middleware
+ * (`fetch`), the issue endpoint (`issue`), the content domain's parsing and clash guards
+ * (`contentDomain`), and an optional health gate with an opaque fallback. An app writes its four
+ * policy callbacks and its settings; on Node, `@botiverse/porthole/node` adapts it.
+ *
  * Runs on any runtime with web-standard `Request`/`Response` and `crypto.getRandomValues`: Node,
  * Cloudflare Workers (no `nodejs_compat` needed), Deno, Bun (P044). On Workers, keep tickets in D1
  * (`d1TicketStore`, P045).
@@ -28,8 +33,10 @@
  * content without a valid ticket or cookie gets nothing of the content.
  */
 export { createServer } from "./server.ts";
+export { createContentHost, HEALTH_PATH, type ContentHealthView, type ContentHost, type ContentHostEvent, type ContentHostOptions, type EntryOptions, type ContentMeta, type HealthOptions, type HealthProbe, } from "./host.ts";
+export { clashOf, contentDomain, ContentDomainError, hostnameOf, type ContentDomainInfo, type ContentDomainProblem, } from "./domain.ts";
 export { d1TicketSchema, d1TicketStore, memoryTicketStore, type D1Like, type D1StatementLike, } from "./tickets.ts";
 export { FRAME_STATUS_METHOD } from "../isolation/types.ts";
-export { isHostLabel, prefixedName } from "./naming.ts";
+export { isHostLabel, prefixedName, type Naming } from "./naming.ts";
 export { proxyTo, type ProxyOptions } from "./proxy.ts";
-export type { Access, ArtifactStore, AuthorizeAnswer, AuthorizeRequest, Authorizer, ContentDomain, Grant, PortholeServer, ServerOptions, TicketRecord, TicketStore, Upstream, } from "./types.ts";
+export type { Access, ArtifactStore, AuthorizeAnswer, AuthorizeRequest, Authorizer, ContentDomain, EntryState, Grant, PortholeServer, ServerOptions, TicketRecord, TicketStore, Upstream, } from "./types.ts";

package/dist/server/index.js

@@ -9,6 +9,11 @@
  *
  * and calls `issue` from its own authenticated API when a viewer opens served content.
  *
+ * The host kit (P066): `createContentHost` wraps `createServer` with the routing middleware
+ * (`fetch`), the issue endpoint (`issue`), the content domain's parsing and clash guards
+ * (`contentDomain`), and an optional health gate with an opaque fallback. An app writes its four
+ * policy callbacks and its settings; on Node, `@botiverse/porthole/node` adapts it.
+ *
  * Runs on any runtime with web-standard `Request`/`Response` and `crypto.getRandomValues`: Node,
  * Cloudflare Workers (no `nodejs_compat` needed), Deno, Bun (P044). On Workers, keep tickets in D1
  * (`d1TicketStore`, P045).
@@ -28,6 +33,8 @@
  * content without a valid ticket or cookie gets nothing of the content.
  */
 export { createServer } from "./server.js";
+export { createContentHost, HEALTH_PATH, } from "./host.js";
+export { clashOf, contentDomain, ContentDomainError, hostnameOf, } from "./domain.js";
 export { d1TicketSchema, d1TicketStore, memoryTicketStore, } from "./tickets.js";
 export { FRAME_STATUS_METHOD } from "../isolation/types.js";
 export { isHostLabel, prefixedName } from "./naming.js";

package/dist/server/naming.d.ts

@@ -14,7 +14,18 @@ export declare function isHostLabel(label: unknown): label is string;
  * already be label-safe (lowercase letters, digits, inner hyphens); anything else throws rather
  * than being folded into another scope's name.
  */
-export declare function prefixedName(prefix: string): (scope: string) => string;
+/**
+ * How scopes are named (`ContentDomain.name`). A naming that can say which scope a label names
+ * (`scopeOf`) gives every scope clean addresses a redirect entry can open (P068).
+ */
+export interface Naming {
+    (scope: string): string;
+    /** The scope a label names, or null for a label this naming never makes. */
+    readonly scopeOf?: (label: string) => string | null;
+}
+export declare function prefixedName(prefix: string): Naming & {
+    readonly scopeOf: (label: string) => string | null;
+};
 /**
  * Whether a label is reserved (`ContentDomain.reserved`): a whole label, a prefix ending in `*`
  * (`p-*`), or the host's own function. Entries are checked once, here; a function that throws

package/dist/server/naming.js

@@ -13,24 +13,25 @@ export function isHostLabel(label) {
 }
 const PREFIX = /^[a-z][a-z0-9]{0,15}-$/u;
 const ID = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/u;
-/**
- * A naming for `content.name` that puts each scope on `<prefix><scope>` (`prefixedName("a-")`:
- * scope `k3x9` is served on `a-k3x9.<domain>`). One-to-one, so no two scopes share an origin, and
- * no name it makes is a reserved one or a keyed default (those have no hyphen). Scopes must
- * already be label-safe (lowercase letters, digits, inner hyphens); anything else throws rather
- * than being folded into another scope's name.
- */
 export function prefixedName(prefix) {
     if (!PREFIX.test(prefix)) {
         throw new TypeError("A name prefix is a lowercase letter, then letters or digits, then '-' (a-)");
     }
-    return (scope) => {
+    const name = (scope) => {
         const label = `${prefix}${scope}`;
         if (!ID.test(scope) || !isHostLabel(label)) {
             throw new TypeError(`Scope ${JSON.stringify(scope)} can't be named under ${prefix}: lowercase letters, digits and inner hyphens, ${63 - prefix.length} at most`);
         }
         return label;
     };
+    const scopeOf = (label) => {
+        if (!label.startsWith(prefix)) {
+            return null;
+        }
+        const scope = label.slice(prefix.length);
+        return ID.test(scope) && isHostLabel(label) ? scope : null;
+    };
+    return Object.assign(name, { scopeOf });
 }
 const PREFIX_ENTRY = /^[a-z0-9]([a-z0-9-]{0,61})?\*$/u;
 /**

package/dist/server/pages.d.ts

@@ -9,3 +9,12 @@ export declare function pageScript(pathname: string): Response | null;
 export declare function statusPage(status: number, title: string, detail: string, frameAncestors: string, method?: string, reason?: FrameBlock, hostOrigins?: readonly string[], code?: string): Response;
 /** The page a framed app is entered through (its answer also sets the session cookie). */
 export declare function enterPage(target: string, frameAncestors: string, hostOrigins: readonly string[], cookie: string): Response;
+/**
+ * A redirect entry's page on the app's own origin (P068): why it shows nothing, told to the page
+ * that frames it like a content origin's page. Plain, no app chrome; its one script inline under
+ * its hash (the app origin serves no script of Porthole's).
+ */
+export declare function appStatusPage(status: number, title: string, detail: string, frameAncestors: string, reason: FrameBlock, hostOrigins: readonly string[], link?: {
+    readonly href: string;
+    readonly text: string;
+}, method?: string): Response;

package/dist/server/pages.js

@@ -1,4 +1,5 @@
 import { FRAME_STATUS_METHOD } from "../isolation/types.js";
+import { base64url, sha256, utf8 } from "./crypto.js";
 /**
  * The server's own pages on a content origin: why it shows nothing of the content, and the page a
  * framed app is entered through. Plain, framable only by the host origins, never cached. Each tells
@@ -94,3 +95,34 @@ export function enterPage(target, frameAncestors, hostOrigins, cookie) {
     headers.set("set-cookie", cookie);
     return new Response(body, { status: 200, headers });
 }
+/** The status script's hash, for a page that carries it inline (`script-src 'sha256-…'`). */
+let statusHash = null;
+const hashOfStatus = () => {
+    statusHash ??= base64url(sha256(utf8(STATUS_SCRIPT)))
+        .replace(/-/gu, "+")
+        .replace(/_/gu, "/");
+    const padding = (4 - (statusHash.length % 4)) % 4;
+    return `'sha256-${statusHash}${"=".repeat(padding)}'`;
+};
+/**
+ * A redirect entry's page on the app's own origin (P068): why it shows nothing, told to the page
+ * that frames it like a content origin's page. Plain, no app chrome; its one script inline under
+ * its hash (the app origin serves no script of Porthole's).
+ */
+export function appStatusPage(status, title, detail, frameAncestors, reason, hostOrigins, link, method = "GET") {
+    const more = link === undefined
+        ? ""
+        : `<p><a href="${escape(link.href)}" target="_top" rel="noopener">${escape(link.text)}</a></p>`;
+    const body = `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escape(title)}</title><style>${STYLE}a{color:inherit}</style></head><body><main data-porthole-status="${status}" data-porthole-reason="${escape(reason)}" data-porthole-hosts="${escape(JSON.stringify(hostOrigins))}"><h1>${escape(title)}</h1><p>${escape(detail)}</p>${more}</main><script>${STATUS_SCRIPT}</script></body></html>`;
+    return new Response(method === "HEAD" ? null : body, {
+        status,
+        headers: {
+            "content-type": "text/html; charset=utf-8",
+            "cache-control": "no-store",
+            "content-security-policy": `default-src 'none'; style-src 'unsafe-inline'; script-src ${hashOfStatus()}; base-uri 'none'; form-action 'none'; frame-ancestors ${frameAncestors}`,
+            "referrer-policy": "no-referrer",
+            "x-content-type-options": "nosniff",
+            "x-robots-tag": "noindex, nofollow",
+        },
+    });
+}