@zudojs/http 0.1.0 → 1.1.0

package/dist/httpCsp/internal/httpCsp.internal.js

@@ -0,0 +1,81 @@
+/**
+ * Internal CSP helpers for splitting, normalizing, and freezing directives.
+ */
+import { normalizeDirectiveName } from "../validation/httpCsp.validation.js";
+export function splitPolicy(value) {
+    const result = [];
+    let current = "";
+    for (const character of value) {
+        if (character === ";") {
+            if (current.trim().length > 0) {
+                result.push(current.trim());
+            }
+            current = "";
+            continue;
+        }
+        current += character;
+    }
+    if (current.trim().length > 0) {
+        result.push(current.trim());
+    }
+    return result;
+}
+/**
+ * Characters that must never appear inside a directive value.
+ *
+ * `;` starts a new directive and `,` starts a new policy, so a value carrying
+ * either injects structure into the header — `img-src` set to
+ * `"https://cdn.example; script-src 'unsafe-inline'"` grants inline script.
+ * CR/LF and the other C0 controls are a header-injection primitive.
+ */
+const FORBIDDEN_DIRECTIVE_VALUE = /[;,\u0000-\u001f\u007f]/;
+/**
+ * Splits and trims a directive value, rejecting anything that could change the
+ * shape of the resulting header.
+ *
+ * The check lives here, at the single point every directive value passes
+ * through, so no code path can construct an injected directive object in the
+ * first place — rather than relying on a validator that a caller might skip.
+ */
+export function normalizeDirectiveValues(values) {
+    const result = typeof values === "string"
+        ? values.trim().split(/\s+/)
+        : values.map((value) => value.trim());
+    const filtered = result.filter(Boolean);
+    for (const value of filtered) {
+        if (FORBIDDEN_DIRECTIVE_VALUE.test(value)) {
+            throw new TypeError(`Invalid CSP directive value: ${JSON.stringify(value)}. Values cannot contain ";", "," or control characters.`);
+        }
+    }
+    return filtered;
+}
+export function freezeDirectives(directives) {
+    const result = {};
+    for (const [name, values] of Object.entries(directives)) {
+        result[name] = Object.freeze([...values]);
+    }
+    return Object.freeze(result);
+}
+export function addOptionalDirective(target, name, value) {
+    if (value === undefined) {
+        return;
+    }
+    target[name] = normalizeDirectiveValues(value);
+}
+export function mergeDirectives(target, source) {
+    for (const [rawName, rawValue] of Object.entries(source)) {
+        const name = normalizeDirectiveName(rawName);
+        target[name] = normalizeDirectiveValues(rawValue);
+    }
+}
+export function sourceMatchesHost(configured, requested) {
+    if (configured === requested) {
+        return true;
+    }
+    if (configured.startsWith("*.")) {
+        const suffix = configured.slice(1);
+        return requested.endsWith(suffix);
+    }
+    return false;
+}
+//# sourceMappingURL=httpCsp.internal.js.map

package/dist/httpCsp/internal/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Internal CSP helpers.
+ */
+export { splitPolicy, normalizeDirectiveValues, freezeDirectives, addOptionalDirective, mergeDirectives, sourceMatchesHost, } from "./httpCsp.internal.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/httpCsp/internal/index.js

@@ -0,0 +1,5 @@
+/**
+ * Internal CSP helpers.
+ */
+export { splitPolicy, normalizeDirectiveValues, freezeDirectives, addOptionalDirective, mergeDirectives, sourceMatchesHost, } from "./httpCsp.internal.js";
+//# sourceMappingURL=index.js.map

package/dist/httpCsp/nonce/httpCsp.nonce.d.ts

@@ -0,0 +1,18 @@
+/**
+ * CSP nonce and hash source generation.
+ */
+import type { CSPNonceOptions } from "../types/httpCsp.type.js";
+export declare function isValidNonce(nonce: string): boolean;
+/**
+ * Generates a fresh CSP nonce from the platform CSPRNG.
+ *
+ * **Call this once per response.** A nonce reused across responses is
+ * equivalent to `'unsafe-inline'` for any attacker who has seen one response:
+ * they simply reuse the value in their injected `<script nonce=…>`. There is
+ * no caching in this function and there must not be any in callers — do not
+ * hoist the result into a module-level constant or a per-process cache.
+ */
+export declare function generateCSPNonce(options?: CSPNonceOptions | undefined): string;
+export declare function createNonceSource(nonce: string): string;
+export declare function createHashSource(algorithm: "sha256" | "sha384" | "sha512", base64Hash: string): string;
+//# sourceMappingURL=httpCsp.nonce.d.ts.map

package/dist/httpCsp/nonce/httpCsp.nonce.js

@@ -0,0 +1,82 @@
+/**
+ * CSP nonce and hash source generation.
+ */
+import { DEFAULT_NONCE_LENGTH } from "../types/httpCsp.constant.js";
+function getCrypto() {
+    if (typeof globalThis !== "undefined" && "crypto" in globalThis) {
+        return globalThis.crypto;
+    }
+    return undefined;
+}
+/**
+ * Fills the buffer from the platform CSPRNG.
+ *
+ * There is deliberately no `Math.random()` fallback: a predictable nonce is
+ * worse than no nonce, because the policy claims protection it does not have.
+ * If no CSPRNG is reachable this throws rather than degrading.
+ */
+function fillRandomBytes(bytes) {
+    const cryptoObject = getCrypto();
+    if (cryptoObject?.getRandomValues) {
+        cryptoObject.getRandomValues(bytes);
+        return;
+    }
+    throw new Error("A cryptographically secure random number generator is required to create a CSP nonce.");
+}
+function toBase64(bytes) {
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    if (typeof btoa === "function") {
+        return btoa(binary);
+    }
+    throw new Error("Base64 encoding is not available in this runtime.");
+}
+function toBase64Url(bytes) {
+    return toBase64(bytes)
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/g, "");
+}
+export function isValidNonce(nonce) {
+    return nonce.length > 0 && /^[A-Za-z0-9+/_=-]+$/.test(nonce);
+}
+function validateNonce(nonce) {
+    if (!isValidNonce(nonce)) {
+        throw new TypeError("Invalid CSP nonce.");
+    }
+}
+/**
+ * Generates a fresh CSP nonce from the platform CSPRNG.
+ *
+ * **Call this once per response.** A nonce reused across responses is
+ * equivalent to `'unsafe-inline'` for any attacker who has seen one response:
+ * they simply reuse the value in their injected `<script nonce=…>`. There is
+ * no caching in this function and there must not be any in callers — do not
+ * hoist the result into a module-level constant or a per-process cache.
+ */
+export function generateCSPNonce(options = {}) {
+    const length = options.length ?? DEFAULT_NONCE_LENGTH;
+    if (!Number.isSafeInteger(length) || length <= 0) {
+        throw new RangeError("CSP nonce length must be a positive safe integer.");
+    }
+    const bytes = new Uint8Array(length);
+    fillRandomBytes(bytes);
+    const encoding = options.encoding ?? "base64url";
+    if (encoding === "base64url") {
+        return toBase64Url(bytes);
+    }
+    return toBase64(bytes);
+}
+export function createNonceSource(nonce) {
+    validateNonce(nonce);
+    return `'nonce-${nonce}'`;
+}
+export function createHashSource(algorithm, base64Hash) {
+    if (!base64Hash) {
+        throw new TypeError("CSP hash cannot be empty.");
+    }
+    return `'${algorithm}-${base64Hash}'`;
+}
+//# sourceMappingURL=httpCsp.nonce.js.map

package/dist/httpCsp/nonce/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * CSP nonce and hash source utilities.
+ */
+export { generateCSPNonce, createNonceSource, createHashSource, isValidNonce, } from "./httpCsp.nonce.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/httpCsp/nonce/index.js

@@ -0,0 +1,5 @@
+/**
+ * CSP nonce and hash source utilities.
+ */
+export { generateCSPNonce, createNonceSource, createHashSource, isValidNonce, } from "./httpCsp.nonce.js";
+//# sourceMappingURL=index.js.map

package/dist/httpCsp/parsing/httpCsp.parsing.d.ts

@@ -0,0 +1,9 @@
+/**
+ * CSP parsing functions.
+ */
+import type { CSPDirectives } from "../types/httpCsp.type.js";
+export declare function parseCSP(value: string | undefined | null): CSPDirectives;
+export declare function getCSPDirective(policy: string | CSPDirectives, directive: string): readonly string[];
+export declare function hasCSPDirective(policy: string | CSPDirectives, directive: string): boolean;
+export declare function getEffectiveDirective(policy: string | CSPDirectives, directive: string): readonly string[];
+//# sourceMappingURL=httpCsp.parsing.d.ts.map

package/dist/httpCsp/parsing/httpCsp.parsing.js

@@ -0,0 +1,61 @@
+/**
+ * CSP parsing functions.
+ */
+import { splitPolicy, freezeDirectives } from "../internal/httpCsp.internal.js";
+export function parseCSP(value) {
+    const result = {};
+    if (!value || value.trim().length === 0) {
+        return Object.freeze(result);
+    }
+    for (const directive of splitPolicy(value)) {
+        const parts = directive.trim().split(/\s+/);
+        const name = parts.shift();
+        if (!name) {
+            continue;
+        }
+        const normalized = name.toLowerCase();
+        if (result[normalized]) {
+            result[normalized] = [...result[normalized], ...parts];
+        }
+        else {
+            result[normalized] = parts;
+        }
+    }
+    return freezeDirectives(result);
+}
+export function getCSPDirective(policy, directive) {
+    const directives = typeof policy === "string" ? parseCSP(policy) : policy;
+    return directives[directive.trim().toLowerCase()] ?? [];
+}
+export function hasCSPDirective(policy, directive) {
+    /*
+     * The `length >= 0` conjunct this replaced was always true, so the function
+     * was really just the hasOwnProperty check with a misleading first half.
+     */
+    return Object.prototype.hasOwnProperty.call(typeof policy === "string" ? parseCSP(policy) : policy, directive.trim().toLowerCase());
+}
+function getFallbackDirective(directive) {
+    const map = {
+        "script-src-elem": "script-src",
+        "script-src-attr": "script-src",
+        "style-src-elem": "style-src",
+        "style-src-attr": "style-src",
+        "child-src": "default-src",
+        "worker-src": "child-src",
+        "frame-src": "child-src",
+    };
+    return map[directive];
+}
+export function getEffectiveDirective(policy, directive) {
+    const directives = typeof policy === "string" ? parseCSP(policy) : policy;
+    const normalized = directive.trim().toLowerCase();
+    if (directives[normalized]) {
+        return directives[normalized];
+    }
+    const fallback = getFallbackDirective(normalized);
+    if (fallback && directives[fallback]) {
+        return directives[fallback];
+    }
+    return directives["default-src"] ?? [];
+}
+//# sourceMappingURL=httpCsp.parsing.js.map

package/dist/httpCsp/parsing/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * CSP parsing utilities.
+ */
+export { parseCSP, getCSPDirective, hasCSPDirective, getEffectiveDirective, } from "./httpCsp.parsing.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/httpCsp/parsing/index.js

@@ -0,0 +1,5 @@
+/**
+ * CSP parsing utilities.
+ */
+export { parseCSP, getCSPDirective, hasCSPDirective, getEffectiveDirective, } from "./httpCsp.parsing.js";
+//# sourceMappingURL=index.js.map

package/dist/httpCsp/policies/httpCsp.policies.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Predefined CSP policies.
+ */
+import type { CSPResult } from "../types/httpCsp.type.js";
+export declare function strictCSP(): CSPResult;
+export declare function apiCSP(): CSPResult;
+/**
+ * A browser-facing policy.
+ *
+ * When a nonce is supplied it is applied to **both** `script-src` and
+ * `style-src`, and `style-src` drops `'unsafe-inline'`. Silently keeping
+ * `'unsafe-inline'` alongside a nonce defeats the point of asking for one: a
+ * caller who went to the trouble of generating a nonce has explicitly opted
+ * into strict inline handling.
+ */
+export declare function browserCSP(nonce: string | undefined): CSPResult;
+//# sourceMappingURL=httpCsp.policies.d.ts.map

package/dist/httpCsp/policies/httpCsp.policies.js

@@ -0,0 +1,52 @@
+/**
+ * Predefined CSP policies.
+ */
+import { createCSP } from "../formatting/httpCsp.formatting.js";
+import { createNonceSource } from "../nonce/httpCsp.nonce.js";
+export function strictCSP() {
+    return createCSP({
+        defaultSrc: ["'self'"],
+        baseUri: ["'self'"],
+        objectSrc: ["'none'"],
+        frameAncestors: ["'none'"],
+        formAction: ["'self'"],
+        upgradeInsecureRequests: true,
+    });
+}
+export function apiCSP() {
+    return createCSP({
+        defaultSrc: ["'none'"],
+        frameAncestors: ["'none'"],
+        baseUri: ["'none'"],
+    });
+}
+/**
+ * A browser-facing policy.
+ *
+ * When a nonce is supplied it is applied to **both** `script-src` and
+ * `style-src`, and `style-src` drops `'unsafe-inline'`. Silently keeping
+ * `'unsafe-inline'` alongside a nonce defeats the point of asking for one: a
+ * caller who went to the trouble of generating a nonce has explicitly opted
+ * into strict inline handling.
+ */
+export function browserCSP(nonce) {
+    const nonceSource = nonce ? createNonceSource(nonce) : undefined;
+    const scriptSrc = nonceSource ? ["'self'", nonceSource] : ["'self'"];
+    const styleSrc = nonceSource
+        ? ["'self'", nonceSource]
+        : ["'self'", "'unsafe-inline'"];
+    return createCSP({
+        defaultSrc: ["'self'"],
+        scriptSrc,
+        styleSrc,
+        imgSrc: ["'self'", "data:", "https:"],
+        fontSrc: ["'self'", "https:", "data:"],
+        connectSrc: ["'self'", "https:"],
+        objectSrc: ["'none'"],
+        baseUri: ["'self'"],
+        frameAncestors: ["'none'"],
+        formAction: ["'self'"],
+        upgradeInsecureRequests: true,
+    });
+}
+//# sourceMappingURL=httpCsp.policies.js.map

package/dist/httpCsp/policies/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Predefined CSP policy helpers.
+ */
+export { strictCSP, apiCSP, browserCSP } from "./httpCsp.policies.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/httpCsp/policies/index.js

@@ -0,0 +1,5 @@
+/**
+ * Predefined CSP policy helpers.
+ */
+export { strictCSP, apiCSP, browserCSP } from "./httpCsp.policies.js";
+//# sourceMappingURL=index.js.map

package/dist/httpCsp/reportOnly/httpCsp.reportOnly.d.ts

@@ -0,0 +1,7 @@
+/**
+ * CSP Report-Only header helpers.
+ */
+import type { CSPOptions } from "../types/httpCsp.type.js";
+export declare function createCSPReportOnly(options: CSPOptions): string;
+export declare function createCSPHeaders(options: CSPOptions, reportOnly?: boolean): Readonly<Record<string, string>>;
+//# sourceMappingURL=httpCsp.reportOnly.d.ts.map

package/dist/httpCsp/reportOnly/httpCsp.reportOnly.js

@@ -0,0 +1,17 @@
+/**
+ * CSP Report-Only header helpers.
+ */
+import { CONTENT_SECURITY_POLICY_HEADER, CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER, } from "../types/httpCsp.constant.js";
+import { createCSP } from "../formatting/httpCsp.formatting.js";
+export function createCSPReportOnly(options) {
+    return createCSP(options).policy;
+}
+export function createCSPHeaders(options, reportOnly = false) {
+    const policy = createCSP(options).policy;
+    return {
+        [reportOnly
+            ? CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER
+            : CONTENT_SECURITY_POLICY_HEADER]: policy,
+    };
+}
+//# sourceMappingURL=httpCsp.reportOnly.js.map

package/dist/httpCsp/reportOnly/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * CSP Report-Only header utilities.
+ */
+export { createCSPReportOnly, createCSPHeaders } from "./httpCsp.reportOnly.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/httpCsp/reportOnly/index.js

@@ -0,0 +1,5 @@
+/**
+ * CSP Report-Only header utilities.
+ */
+export { createCSPReportOnly, createCSPHeaders } from "./httpCsp.reportOnly.js";
+//# sourceMappingURL=index.js.map

package/dist/httpCsp/sources/httpCsp.sources.d.ts

@@ -0,0 +1,10 @@
+/**
+ * CSP source type detection helpers.
+ */
+export declare function isSelfSource(source: string): boolean;
+export declare function isNoneSource(source: string): boolean;
+export declare function isUnsafeInlineSource(source: string): boolean;
+export declare function isUnsafeEvalSource(source: string): boolean;
+export declare function isNonceSource(source: string): boolean;
+export declare function isHashSource(source: string): boolean;
+//# sourceMappingURL=httpCsp.sources.d.ts.map

package/dist/httpCsp/sources/httpCsp.sources.js

@@ -0,0 +1,22 @@
+/**
+ * CSP source type detection helpers.
+ */
+export function isSelfSource(source) {
+    return source.trim() === "'self'";
+}
+export function isNoneSource(source) {
+    return source.trim() === "'none'";
+}
+export function isUnsafeInlineSource(source) {
+    return source.trim() === "'unsafe-inline'";
+}
+export function isUnsafeEvalSource(source) {
+    return source.trim() === "'unsafe-eval'";
+}
+export function isNonceSource(source) {
+    return /^'nonce-[^']+'$/i.test(source.trim());
+}
+export function isHashSource(source) {
+    return /^'(sha256|sha384|sha512)-[^']+'$/i.test(source.trim());
+}
+//# sourceMappingURL=httpCsp.sources.js.map

package/dist/httpCsp/sources/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * CSP source type detection utilities.
+ */
+export { isSelfSource, isNoneSource, isUnsafeInlineSource, isUnsafeEvalSource, isNonceSource, isHashSource, } from "./httpCsp.sources.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/httpCsp/sources/index.js

@@ -0,0 +1,5 @@
+/**
+ * CSP source type detection utilities.
+ */
+export { isSelfSource, isNoneSource, isUnsafeInlineSource, isUnsafeEvalSource, isNonceSource, isHashSource, } from "./httpCsp.sources.js";
+//# sourceMappingURL=index.js.map

package/dist/httpCsp/types/httpCsp.constant.d.ts

@@ -0,0 +1,9 @@
+/**
+ * CSP constants and directive names.
+ */
+export declare const CONTENT_SECURITY_POLICY_HEADER = "Content-Security-Policy";
+export declare const CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER = "Content-Security-Policy-Report-Only";
+export declare const DEFAULT_NONCE_LENGTH = 16;
+export declare const CSP_DIRECTIVES: readonly ["default-src", "script-src", "script-src-elem", "script-src-attr", "style-src", "style-src-elem", "style-src-attr", "img-src", "font-src", "connect-src", "media-src", "object-src", "frame-src", "child-src", "worker-src", "manifest-src", "prefetch-src", "navigate-to", "base-uri", "form-action", "frame-ancestors", "plugin-types", "sandbox", "report-uri", "report-to", "upgrade-insecure-requests", "block-all-mixed-content", "require-sri-for", "require-trusted-types-for", "trusted-types"];
+export type CSPDirectiveName = (typeof CSP_DIRECTIVES)[number];
+//# sourceMappingURL=httpCsp.constant.d.ts.map

package/dist/httpCsp/types/httpCsp.constant.js

@@ -0,0 +1,39 @@
+/**
+ * CSP constants and directive names.
+ */
+export const CONTENT_SECURITY_POLICY_HEADER = "Content-Security-Policy";
+export const CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER = "Content-Security-Policy-Report-Only";
+export const DEFAULT_NONCE_LENGTH = 16;
+export const CSP_DIRECTIVES = Object.freeze([
+    "default-src",
+    "script-src",
+    "script-src-elem",
+    "script-src-attr",
+    "style-src",
+    "style-src-elem",
+    "style-src-attr",
+    "img-src",
+    "font-src",
+    "connect-src",
+    "media-src",
+    "object-src",
+    "frame-src",
+    "child-src",
+    "worker-src",
+    "manifest-src",
+    "prefetch-src",
+    "navigate-to",
+    "base-uri",
+    "form-action",
+    "frame-ancestors",
+    "plugin-types",
+    "sandbox",
+    "report-uri",
+    "report-to",
+    "upgrade-insecure-requests",
+    "block-all-mixed-content",
+    "require-sri-for",
+    "require-trusted-types-for",
+    "trusted-types",
+]);
+//# sourceMappingURL=httpCsp.constant.js.map

package/dist/httpCsp/types/httpCsp.type.d.ts

@@ -0,0 +1,43 @@
+/**
+ * CSP type definitions.
+ */
+export type CSPDirectiveValue = string | readonly string[];
+export interface CSPDirectives {
+    readonly [directive: string]: readonly string[];
+}
+export interface CSPOptions {
+    readonly directives?: Readonly<Record<string, CSPDirectiveValue>>;
+    readonly defaultSrc?: CSPDirectiveValue;
+    readonly scriptSrc?: CSPDirectiveValue;
+    readonly styleSrc?: CSPDirectiveValue;
+    readonly imgSrc?: CSPDirectiveValue;
+    readonly fontSrc?: CSPDirectiveValue;
+    readonly connectSrc?: CSPDirectiveValue;
+    readonly mediaSrc?: CSPDirectiveValue;
+    readonly objectSrc?: CSPDirectiveValue;
+    readonly frameSrc?: CSPDirectiveValue;
+    readonly childSrc?: CSPDirectiveValue;
+    readonly workerSrc?: CSPDirectiveValue;
+    readonly manifestSrc?: CSPDirectiveValue;
+    readonly baseUri?: CSPDirectiveValue;
+    readonly formAction?: CSPDirectiveValue;
+    readonly frameAncestors?: CSPDirectiveValue;
+    readonly navigateTo?: CSPDirectiveValue;
+    readonly reportUri?: CSPDirectiveValue;
+    readonly reportTo?: CSPDirectiveValue;
+    readonly sandbox?: CSPDirectiveValue;
+    readonly upgradeInsecureRequests?: boolean;
+    readonly blockAllMixedContent?: boolean;
+    readonly requireTrustedTypesFor?: CSPDirectiveValue;
+    readonly trustedTypes?: CSPDirectiveValue;
+}
+export interface CSPNonceOptions {
+    readonly length?: number;
+    readonly encoding?: "base64" | "base64url";
+}
+export interface CSPResult {
+    readonly policy: string;
+    readonly header: string;
+    readonly directives: CSPDirectives;
+}
+//# sourceMappingURL=httpCsp.type.d.ts.map

package/dist/httpCsp/types/httpCsp.type.js

@@ -0,0 +1,5 @@
+/**
+ * CSP type definitions.
+ */
+export {};
+//# sourceMappingURL=httpCsp.type.js.map

package/dist/httpCsp/types/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * CSP types, constants, and directive names.
+ */
+export type { CSPDirectiveValue, CSPDirectives, CSPOptions, CSPNonceOptions, CSPResult, } from "./httpCsp.type.js";
+export { CONTENT_SECURITY_POLICY_HEADER, CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER, DEFAULT_NONCE_LENGTH, CSP_DIRECTIVES, } from "./httpCsp.constant.js";
+export type { CSPDirectiveName } from "./httpCsp.constant.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/httpCsp/types/index.js

@@ -0,0 +1,5 @@
+/**
+ * CSP types, constants, and directive names.
+ */
+export { CONTENT_SECURITY_POLICY_HEADER, CONTENT_SECURITY_POLICY_REPORT_ONLY_HEADER, DEFAULT_NONCE_LENGTH, CSP_DIRECTIVES, } from "./httpCsp.constant.js";
+//# sourceMappingURL=index.js.map

package/dist/httpCsp/validation/httpCsp.validate.d.ts

@@ -0,0 +1,6 @@
+/**
+ * CSP policy validation.
+ */
+import type { CSPDirectives } from "../types/httpCsp.type.js";
+export declare function validateCSP(policy: string | CSPDirectives): boolean;
+//# sourceMappingURL=httpCsp.validate.d.ts.map

package/dist/httpCsp/validation/httpCsp.validate.js

@@ -0,0 +1,23 @@
+/**
+ * CSP policy validation.
+ */
+import { parseCSP } from "../parsing/httpCsp.parsing.js";
+import { isValidDirectiveName } from "./httpCsp.validation.js";
+export function validateCSP(policy) {
+    const directives = typeof policy === "string" ? parseCSP(policy) : policy;
+    for (const [name, values] of Object.entries(directives)) {
+        if (!isValidDirectiveName(name)) {
+            return false;
+        }
+        for (const value of values) {
+            if (value.includes(";")) {
+                return false;
+            }
+            if (value.includes("\r") || value.includes("\n")) {
+                return false;
+            }
+        }
+    }
+    return true;
+}
+//# sourceMappingURL=httpCsp.validate.js.map

package/dist/httpCsp/validation/httpCsp.validation.d.ts

@@ -0,0 +1,6 @@
+/**
+ * CSP directive name validation.
+ */
+export declare function isValidDirectiveName(name: string): boolean;
+export declare function normalizeDirectiveName(name: string): string;
+//# sourceMappingURL=httpCsp.validation.d.ts.map

package/dist/httpCsp/validation/httpCsp.validation.js

@@ -0,0 +1,14 @@
+/**
+ * CSP directive name validation.
+ */
+export function isValidDirectiveName(name) {
+    return /^[a-z][a-z0-9-]*$/i.test(name.trim());
+}
+export function normalizeDirectiveName(name) {
+    const normalized = name.trim().toLowerCase();
+    if (!isValidDirectiveName(normalized)) {
+        throw new TypeError(`Invalid CSP directive name: ${name}`);
+    }
+    return normalized;
+}
+//# sourceMappingURL=httpCsp.validation.js.map

package/dist/httpCsp/validation/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * CSP validation utilities.
+ */
+export { isValidDirectiveName, normalizeDirectiveName, } from "./httpCsp.validation.js";
+export { validateCSP } from "./httpCsp.validate.js";
+//# sourceMappingURL=index.d.ts.map