@zudojs/http 0.1.0 → 1.1.0

package/dist/httpSecurityHeaders/core/httpSecurityHeader.type.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Security headers types and constants.
+ *
+ * @module httpSecurityHeaders/types
+ */
+export interface SecurityHeadersOptions {
+    readonly contentSecurityPolicy?: boolean | string;
+    readonly strictTransportSecurity?: boolean | {
+        readonly maxAge?: number;
+        readonly includeSubDomains?: boolean;
+        readonly preload?: boolean;
+    };
+    readonly xContentTypeOptions?: boolean;
+    readonly xFrameOptions?: boolean | XFrameOptions;
+    readonly referrerPolicy?: boolean | ReferrerPolicyValue;
+    readonly permissionsPolicy?: boolean | PermissionsPolicy;
+    readonly crossOriginEmbedderPolicy?: boolean | CrossOriginEmbedderPolicy;
+    readonly crossOriginOpenerPolicy?: boolean | CrossOriginOpenerPolicy;
+    readonly crossOriginResourcePolicy?: boolean | CrossOriginResourcePolicy;
+    readonly xPermittedCrossDomainPolicies?: boolean | XPermittedCrossDomainPolicy;
+}
+export type SecurityHeaders = {
+    readonly "content-security-policy"?: string;
+    readonly "strict-transport-security"?: string;
+    readonly "x-content-type-options"?: string;
+    readonly "x-frame-options"?: string;
+    readonly "referrer-policy"?: string;
+    readonly "permissions-policy"?: string;
+    readonly "cross-origin-embedder-policy"?: string;
+    readonly "cross-origin-opener-policy"?: string;
+    readonly "cross-origin-resource-policy"?: string;
+    readonly "x-permitted-cross-domain-policies"?: string;
+};
+export type XFrameOptions = "DENY" | "SAMEORIGIN" | `ALLOW-FROM ${string}`;
+export type ReferrerPolicyValue = "no-referrer" | "no-referrer-when-downgrade" | "origin" | "origin-when-cross-origin" | "same-origin" | "strict-origin" | "strict-origin-when-cross-origin" | "unsafe-url" | "";
+export type CrossOriginEmbedderPolicy = "require-corp" | "credentialless" | "unsafe-none";
+export type CrossOriginOpenerPolicy = "unsafe-none" | "same-origin-allow-popups" | "same-origin" | "restrict-properties" | "restrict-properties-plus-coep";
+export type CrossOriginResourcePolicy = "same-site" | "same-origin" | "cross-origin";
+export type XPermittedCrossDomainPolicy = "none" | "master-only" | "by-content-type" | "all";
+export type PermissionsPolicy = Readonly<Record<string, PermissionsPolicyValue>>;
+export type PermissionsPolicyValue = boolean | readonly string[] | string;
+export declare const SECURITY_HEADER_NAMES: {
+    readonly CSP: "content-security-policy";
+    readonly HSTS: "strict-transport-security";
+    readonly XCTO: "x-content-type-options";
+    readonly XFO: "x-frame-options";
+    readonly RP: "referrer-policy";
+    readonly PP: "permissions-policy";
+    readonly COEP: "cross-origin-embedder-policy";
+    readonly COOP: "cross-origin-opener-policy";
+    readonly CORP: "cross-origin-resource-policy";
+    readonly XPCDP: "x-permitted-cross-domain-policies";
+};
+export declare const DEFAULT_REFERRER_POLICY: ReferrerPolicyValue;
+export declare const DEFAULT_X_CONTENT_TYPE_OPTIONS: "nosniff";
+//# sourceMappingURL=httpSecurityHeader.type.d.ts.map

package/dist/httpSecurityHeaders/core/httpSecurityHeader.type.js

@@ -0,0 +1,20 @@
+/**
+ * Security headers types and constants.
+ *
+ * @module httpSecurityHeaders/types
+ */
+export const SECURITY_HEADER_NAMES = {
+    CSP: "content-security-policy",
+    HSTS: "strict-transport-security",
+    XCTO: "x-content-type-options",
+    XFO: "x-frame-options",
+    RP: "referrer-policy",
+    PP: "permissions-policy",
+    COEP: "cross-origin-embedder-policy",
+    COOP: "cross-origin-opener-policy",
+    CORP: "cross-origin-resource-policy",
+    XPCDP: "x-permitted-cross-domain-policies",
+};
+export const DEFAULT_REFERRER_POLICY = "strict-origin-when-cross-origin";
+export const DEFAULT_X_CONTENT_TYPE_OPTIONS = "nosniff";
+//# sourceMappingURL=httpSecurityHeader.type.js.map

package/dist/httpSecurityHeaders/core/httpSecurityHeader.validation.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Security headers validation.
+ *
+ * @module httpSecurityHeaders/validation
+ */
+import type { ReferrerPolicyValue, CrossOriginEmbedderPolicy, CrossOriginOpenerPolicy, CrossOriginResourcePolicy } from "./httpSecurityHeader.type.js";
+/**
+ * Validates a complete set of security headers.
+ */
+export declare function validateSecurityHeaders(headers: Readonly<Record<string, string>>): {
+    readonly valid: boolean;
+    readonly errors: readonly string[];
+};
+/**
+ * Validates a header name.
+ */
+export declare function validateHeaderName(name: string): {
+    readonly valid: boolean;
+    readonly error?: string;
+};
+/**
+ * Validates a header value.
+ */
+export declare function validateHeaderValue(value: string): {
+    readonly valid: boolean;
+    readonly error?: string;
+};
+/**
+ * Validates a Referrer-Policy value.
+ */
+export declare function validateReferrerPolicy(value: string): value is ReferrerPolicyValue;
+/**
+ * Validates a Cross-Origin-Embedder-Policy value.
+ */
+export declare function validateCrossOriginEmbedderPolicy(value: string): value is CrossOriginEmbedderPolicy;
+/**
+ * Validates a Cross-Origin-Opener-Policy value.
+ */
+export declare function validateCrossOriginOpenerPolicy(value: string): value is CrossOriginOpenerPolicy;
+/**
+ * Validates a Cross-Origin-Resource-Policy value.
+ */
+export declare function validateCrossOriginResourcePolicy(value: string): value is CrossOriginResourcePolicy;
+//# sourceMappingURL=httpSecurityHeader.validation.d.ts.map

package/dist/httpSecurityHeaders/core/httpSecurityHeader.validation.js

@@ -0,0 +1,111 @@
+/**
+ * Security headers validation.
+ *
+ * @module httpSecurityHeaders/validation
+ */
+/**
+ * Validates a complete set of security headers.
+ */
+export function validateSecurityHeaders(headers) {
+    const errors = [];
+    const csp = headers["content-security-policy"];
+    if (csp) {
+        if (!csp.includes("default-src")) {
+            errors.push("CSP should include default-src directive");
+        }
+    }
+    const hsts = headers["strict-transport-security"];
+    if (hsts) {
+        const maxAgeMatch = hsts.match(/max-age=(\d+)/);
+        if (!maxAgeMatch) {
+            errors.push("HSTS must include max-age directive");
+        }
+    }
+    const referrerPolicy = headers["referrer-policy"];
+    if (referrerPolicy) {
+        if (!validateReferrerPolicy(referrerPolicy)) {
+            errors.push(`Invalid Referrer-Policy value: ${referrerPolicy}`);
+        }
+    }
+    return {
+        valid: errors.length === 0,
+        errors,
+    };
+}
+/**
+ * Validates a header name.
+ */
+export function validateHeaderName(name) {
+    if (!name || name.length === 0) {
+        return { valid: false, error: "Header name cannot be empty" };
+    }
+    if (/\s/.test(name)) {
+        return { valid: false, error: "Header name cannot contain whitespace" };
+    }
+    if (/[:;=]/.test(name)) {
+        return { valid: false, error: "Header name contains invalid characters" };
+    }
+    return { valid: true };
+}
+/**
+ * Validates a header value.
+ */
+export function validateHeaderValue(value) {
+    if (value.includes("\r") || value.includes("\n")) {
+        return { valid: false, error: "Header value cannot contain CRLF" };
+    }
+    return { valid: true };
+}
+/**
+ * Validates a Referrer-Policy value.
+ */
+export function validateReferrerPolicy(value) {
+    const validPolicies = [
+        "no-referrer",
+        "no-referrer-when-downgrade",
+        "origin",
+        "origin-when-cross-origin",
+        "same-origin",
+        "strict-origin",
+        "strict-origin-when-cross-origin",
+        "unsafe-url",
+        "",
+    ];
+    return validPolicies.includes(value);
+}
+/**
+ * Validates a Cross-Origin-Embedder-Policy value.
+ */
+export function validateCrossOriginEmbedderPolicy(value) {
+    const validPolicies = [
+        "require-corp",
+        "credentialless",
+        "unsafe-none",
+    ];
+    return validPolicies.includes(value);
+}
+/**
+ * Validates a Cross-Origin-Opener-Policy value.
+ */
+export function validateCrossOriginOpenerPolicy(value) {
+    const validPolicies = [
+        "unsafe-none",
+        "same-origin-allow-popups",
+        "same-origin",
+        "restrict-properties",
+        "restrict-properties-plus-coep",
+    ];
+    return validPolicies.includes(value);
+}
+/**
+ * Validates a Cross-Origin-Resource-Policy value.
+ */
+export function validateCrossOriginResourcePolicy(value) {
+    const validPolicies = [
+        "same-site",
+        "same-origin",
+        "cross-origin",
+    ];
+    return validPolicies.includes(value);
+}
+//# sourceMappingURL=httpSecurityHeader.validation.js.map

package/dist/httpSecurityHeaders/core/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Core security headers utilities.
+ *
+ * @module httpSecurityHeaders/core
+ */
+export * from "./httpSecurityHeader.type.js";
+export * from "./httpSecurityHeader.validation.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/httpSecurityHeaders/core/index.js

@@ -0,0 +1,8 @@
+/**
+ * Core security headers utilities.
+ *
+ * @module httpSecurityHeaders/core
+ */
+export * from "./httpSecurityHeader.type.js";
+export * from "./httpSecurityHeader.validation.js";
+//# sourceMappingURL=index.js.map

package/dist/httpSecurityHeaders/httpSecurity.headers.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Security headers for HTTP responses.
+ *
+ * @module httpSecurityHeaders
+ */
+export * from "./core/httpSecurityHeader.type.js";
+export * from "./core/httpSecurityHeader.validation.js";
+export * from "./httpSecurityHeader.individual.js";
+export * from "./httpSecurityHeader.factory.js";
+export * from "./httpSecurityHeader.recommended.js";
+export * from "./httpSecurityHeader.permissionsPolicy.js";
+//# sourceMappingURL=httpSecurity.headers.d.ts.map

package/dist/httpSecurityHeaders/httpSecurity.headers.js

@@ -0,0 +1,12 @@
+/**
+ * Security headers for HTTP responses.
+ *
+ * @module httpSecurityHeaders
+ */
+export * from "./core/httpSecurityHeader.type.js";
+export * from "./core/httpSecurityHeader.validation.js";
+export * from "./httpSecurityHeader.individual.js";
+export * from "./httpSecurityHeader.factory.js";
+export * from "./httpSecurityHeader.recommended.js";
+export * from "./httpSecurityHeader.permissionsPolicy.js";
+//# sourceMappingURL=httpSecurity.headers.js.map

package/dist/httpSecurityHeaders/httpSecurityHeader.factory.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Security headers factory.
+ *
+ * @module httpSecurityHeaders/factory
+ */
+import type { SecurityHeadersOptions, SecurityHeaders } from "./core/httpSecurityHeader.type.js";
+/**
+ * Creates a complete set of security headers.
+ */
+export declare function createSecurityHeaders(options?: SecurityHeadersOptions): SecurityHeaders;
+//# sourceMappingURL=httpSecurityHeader.factory.d.ts.map

package/dist/httpSecurityHeaders/httpSecurityHeader.factory.js

@@ -0,0 +1,71 @@
+/**
+ * Security headers factory.
+ *
+ * @module httpSecurityHeaders/factory
+ */
+import { SECURITY_HEADER_NAMES, DEFAULT_REFERRER_POLICY, } from "./core/httpSecurityHeader.type.js";
+import { contentSecurityPolicyHeader, strictTransportSecurityHeader, xContentTypeOptionsHeader, xFrameOptionsHeader, referrerPolicyHeader, permissionsPolicyHeader, crossOriginEmbedderPolicyHeader, crossOriginOpenerPolicyHeader, crossOriginResourcePolicyHeader, xPermittedCrossDomainPoliciesHeader, } from "./httpSecurityHeader.individual.js";
+import { createDefaultCSPOptions, createDefaultHSTSOptions, createDefaultPermissionsPolicy, } from "./httpSecurityHeader.recommended.js";
+/**
+ * Creates a complete set of security headers.
+ */
+export function createSecurityHeaders(options = {}) {
+    const headers = {};
+    /*
+     * `contentSecurityPolicy: true` used to format `{}` into the empty string,
+     * emitting `content-security-policy:` with no directives — a policy that
+     * restricts nothing while looking present to a scanner or reviewer. The
+     * boolean form now means "the recommended default policy", which is what
+     * `createDefaultCSPOptions` was written for and never called for.
+     */
+    if (options.contentSecurityPolicy) {
+        headers[SECURITY_HEADER_NAMES.CSP] = contentSecurityPolicyHeader(typeof options.contentSecurityPolicy === "string"
+            ? options.contentSecurityPolicy
+            : createDefaultCSPOptions());
+    }
+    if (options.strictTransportSecurity) {
+        headers[SECURITY_HEADER_NAMES.HSTS] = strictTransportSecurityHeader(typeof options.strictTransportSecurity === "object"
+            ? options.strictTransportSecurity
+            : createDefaultHSTSOptions());
+    }
+    if (options.xContentTypeOptions) {
+        headers[SECURITY_HEADER_NAMES.XCTO] = xContentTypeOptionsHeader();
+    }
+    if (options.xFrameOptions) {
+        headers[SECURITY_HEADER_NAMES.XFO] = xFrameOptionsHeader(typeof options.xFrameOptions === "string"
+            ? options.xFrameOptions
+            : "DENY");
+    }
+    if (options.referrerPolicy) {
+        headers[SECURITY_HEADER_NAMES.RP] = referrerPolicyHeader(typeof options.referrerPolicy === "string"
+            ? options.referrerPolicy
+            : DEFAULT_REFERRER_POLICY);
+    }
+    if (options.permissionsPolicy) {
+        headers[SECURITY_HEADER_NAMES.PP] = permissionsPolicyHeader(typeof options.permissionsPolicy === "object"
+            ? options.permissionsPolicy
+            : createDefaultPermissionsPolicy());
+    }
+    if (options.crossOriginEmbedderPolicy) {
+        headers[SECURITY_HEADER_NAMES.COEP] = crossOriginEmbedderPolicyHeader(typeof options.crossOriginEmbedderPolicy === "string"
+            ? options.crossOriginEmbedderPolicy
+            : "require-corp");
+    }
+    if (options.crossOriginOpenerPolicy) {
+        headers[SECURITY_HEADER_NAMES.COOP] = crossOriginOpenerPolicyHeader(typeof options.crossOriginOpenerPolicy === "string"
+            ? options.crossOriginOpenerPolicy
+            : "same-origin");
+    }
+    if (options.crossOriginResourcePolicy) {
+        headers[SECURITY_HEADER_NAMES.CORP] = crossOriginResourcePolicyHeader(typeof options.crossOriginResourcePolicy === "string"
+            ? options.crossOriginResourcePolicy
+            : "same-site");
+    }
+    if (options.xPermittedCrossDomainPolicies) {
+        headers[SECURITY_HEADER_NAMES.XPCDP] = xPermittedCrossDomainPoliciesHeader(typeof options.xPermittedCrossDomainPolicies === "string"
+            ? options.xPermittedCrossDomainPolicies
+            : "none");
+    }
+    return headers;
+}
+//# sourceMappingURL=httpSecurityHeader.factory.js.map

package/dist/httpSecurityHeaders/httpSecurityHeader.individual.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Individual security header builders.
+ *
+ * @module httpSecurityHeaders/individual
+ */
+import type { XFrameOptions, ReferrerPolicyValue, CrossOriginEmbedderPolicy, CrossOriginOpenerPolicy, CrossOriginResourcePolicy, PermissionsPolicy, XPermittedCrossDomainPolicy } from "./core/httpSecurityHeader.type.js";
+/**
+ * Creates a Content-Security-Policy header.
+ *
+ * Delegates to `httpCsp`. This module previously formatted the policy itself
+ * with `Object.entries(...).join("; ")`, which applied none of `httpCsp`'s
+ * directive-name validation and none of its value checks — so a value
+ * containing `;` injected a directive, and a value containing a newline
+ * injected a header. There is now one CSP formatter in the package.
+ */
+export declare function contentSecurityPolicyHeader(directives: string | Record<string, readonly string[]>): string;
+/**
+ * Creates a Strict-Transport-Security header.
+ *
+ * Delegates to `httpHsts`. The previous local implementation accepted any
+ * `maxAge` (including a negative or fractional one, which browsers discard,
+ * silently leaving the site unprotected) and would happily emit
+ * `preload` without `includeSubDomains` or with a `max-age` below the
+ * preload-list minimum — a policy the preload list rejects, so the operator
+ * believes they are preloaded and are not. `createHSTSHeader` validates all of
+ * that.
+ */
+export declare function strictTransportSecurityHeader(options?: {
+    readonly maxAge?: number;
+    readonly includeSubDomains?: boolean;
+    readonly preload?: boolean;
+}): string;
+/**
+ * Creates an X-Content-Type-Options header.
+ */
+export declare function xContentTypeOptionsHeader(): string;
+/**
+ * Creates an X-Frame-Options header.
+ */
+export declare function xFrameOptionsHeader(option?: XFrameOptions): string;
+/**
+ * Creates a Referrer-Policy header.
+ */
+export declare function referrerPolicyHeader(policy?: ReferrerPolicyValue): string;
+/**
+ * Creates a Permissions-Policy header.
+ */
+export declare function permissionsPolicyHeader(policy: PermissionsPolicy): string;
+/**
+ * Creates a Cross-Origin-Embedder-Policy header.
+ */
+export declare function crossOriginEmbedderPolicyHeader(policy?: CrossOriginEmbedderPolicy): string;
+/**
+ * Creates a Cross-Origin-Opener-Policy header.
+ */
+export declare function crossOriginOpenerPolicyHeader(policy?: CrossOriginOpenerPolicy): string;
+/**
+ * Creates a Cross-Origin-Resource-Policy header.
+ */
+export declare function crossOriginResourcePolicyHeader(policy?: CrossOriginResourcePolicy): string;
+/**
+ * Creates an X-Permitted-Cross-Domain-Policies header.
+ */
+export declare function xPermittedCrossDomainPoliciesHeader(policy?: XPermittedCrossDomainPolicy): string;
+//# sourceMappingURL=httpSecurityHeader.individual.d.ts.map

package/dist/httpSecurityHeaders/httpSecurityHeader.individual.js

@@ -0,0 +1,123 @@
+/**
+ * Individual security header builders.
+ *
+ * @module httpSecurityHeaders/individual
+ */
+import { createCSP, parseCSP, validateCSP } from "../httpCsp/index.js";
+import { createHSTSHeader } from "../httpHsts/index.js";
+import { assertSafeHeaderValue } from "../httpHeaders/security/index.js";
+/**
+ * Creates a Content-Security-Policy header.
+ *
+ * Delegates to `httpCsp`. This module previously formatted the policy itself
+ * with `Object.entries(...).join("; ")`, which applied none of `httpCsp`'s
+ * directive-name validation and none of its value checks — so a value
+ * containing `;` injected a directive, and a value containing a newline
+ * injected a header. There is now one CSP formatter in the package.
+ */
+export function contentSecurityPolicyHeader(directives) {
+    if (typeof directives === "string") {
+        if (!validateCSP(parseCSP(directives))) {
+            throw new TypeError("Invalid Content-Security-Policy: a directive name or value is malformed.");
+        }
+        assertSafeHeaderValue(directives);
+        return directives;
+    }
+    return createCSP({ directives }).policy;
+}
+/**
+ * Creates a Strict-Transport-Security header.
+ *
+ * Delegates to `httpHsts`. The previous local implementation accepted any
+ * `maxAge` (including a negative or fractional one, which browsers discard,
+ * silently leaving the site unprotected) and would happily emit
+ * `preload` without `includeSubDomains` or with a `max-age` below the
+ * preload-list minimum — a policy the preload list rejects, so the operator
+ * believes they are preloaded and are not. `createHSTSHeader` validates all of
+ * that.
+ */
+export function strictTransportSecurityHeader(options = {}) {
+    return createHSTSHeader(options);
+}
+/**
+ * Creates an X-Content-Type-Options header.
+ */
+export function xContentTypeOptionsHeader() {
+    return "nosniff";
+}
+/**
+ * Creates an X-Frame-Options header.
+ */
+export function xFrameOptionsHeader(option = "DENY") {
+    return option;
+}
+/**
+ * Creates a Referrer-Policy header.
+ */
+export function referrerPolicyHeader(policy = "strict-origin-when-cross-origin") {
+    return policy;
+}
+/**
+ * Creates a Permissions-Policy header.
+ */
+export function permissionsPolicyHeader(policy) {
+    const parts = Object.entries(policy).map(([feature, value]) => {
+        if (!/^[a-z][a-z0-9-]*$/i.test(feature.trim())) {
+            throw new TypeError(`Invalid Permissions-Policy feature: ${feature}`);
+        }
+        const name = feature.trim().toLowerCase();
+        if (typeof value === "boolean") {
+            return `${name}=${value ? "*" : "()"}`;
+        }
+        const allowlist = Array.isArray(value) ? value : [value];
+        for (const entry of allowlist) {
+            assertPermissionsPolicyOrigin(entry);
+        }
+        return `${name}=(${allowlist.join(" ")})`;
+    });
+    const header = parts.join(", ");
+    assertSafeHeaderValue(header);
+    return header;
+}
+/**
+ * A Permissions-Policy allowlist entry is `*`, `self`, `src`, `none`, or a
+ * quoted origin. Anything containing a separator would restructure the header.
+ */
+function assertPermissionsPolicyOrigin(value) {
+    const trimmed = value.trim();
+    if (trimmed === "*" ||
+        trimmed === "self" ||
+        trimmed === "src" ||
+        trimmed === "none") {
+        return;
+    }
+    if (/^"https?:\/\/[^"\s,;()]+"$/.test(trimmed)) {
+        return;
+    }
+    throw new TypeError(`Invalid Permissions-Policy allowlist entry: ${JSON.stringify(value)}. Expected *, self, src, none, or a quoted http(s) origin.`);
+}
+/**
+ * Creates a Cross-Origin-Embedder-Policy header.
+ */
+export function crossOriginEmbedderPolicyHeader(policy = "require-corp") {
+    return policy;
+}
+/**
+ * Creates a Cross-Origin-Opener-Policy header.
+ */
+export function crossOriginOpenerPolicyHeader(policy = "same-origin") {
+    return policy;
+}
+/**
+ * Creates a Cross-Origin-Resource-Policy header.
+ */
+export function crossOriginResourcePolicyHeader(policy = "same-site") {
+    return policy;
+}
+/**
+ * Creates an X-Permitted-Cross-Domain-Policies header.
+ */
+export function xPermittedCrossDomainPoliciesHeader(policy = "none") {
+    return policy;
+}
+//# sourceMappingURL=httpSecurityHeader.individual.js.map

package/dist/httpSecurityHeaders/httpSecurityHeader.permissionsPolicy.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Permissions policy utilities.
+ *
+ * @module httpSecurityHeaders/permissionsPolicy
+ */
+import type { PermissionsPolicy } from "./core/httpSecurityHeader.type.js";
+/**
+ * Formats a PermissionsPolicy object into a header string.
+ */
+export declare function formatPermissionsPolicy(policy: PermissionsPolicy): string;
+/**
+ * Parses a Permissions-Policy header string.
+ */
+export declare function parsePermissionsPolicy(header: string | undefined): PermissionsPolicy;
+//# sourceMappingURL=httpSecurityHeader.permissionsPolicy.d.ts.map

package/dist/httpSecurityHeaders/httpSecurityHeader.permissionsPolicy.js

@@ -0,0 +1,59 @@
+/**
+ * Permissions policy utilities.
+ *
+ * @module httpSecurityHeaders/permissionsPolicy
+ */
+/**
+ * Formats a PermissionsPolicy object into a header string.
+ */
+export function formatPermissionsPolicy(policy) {
+    return Object.entries(policy)
+        .map(([feature, value]) => {
+        if (typeof value === "boolean") {
+            return `${feature}=${value ? "*" : "()"}`;
+        }
+        if (Array.isArray(value)) {
+            return `${feature}=(${value.join(" ")})`;
+        }
+        return `${feature}=${value}`;
+    })
+        .join(", ");
+}
+/**
+ * Parses a Permissions-Policy header string.
+ */
+export function parsePermissionsPolicy(header) {
+    if (!header) {
+        return {};
+    }
+    const policy = {};
+    const directives = header.split(",");
+    for (const directive of directives) {
+        const trimmed = directive.trim();
+        const eqIndex = trimmed.indexOf("=");
+        if (eqIndex === -1) {
+            continue;
+        }
+        const feature = trimmed.slice(0, eqIndex).trim();
+        const valueStr = trimmed.slice(eqIndex + 1).trim();
+        if (valueStr === "*") {
+            policy[feature] = true;
+        }
+        else if (valueStr === "()") {
+            policy[feature] = false;
+        }
+        else if (valueStr.startsWith("(") && valueStr.endsWith(")")) {
+            const origins = valueStr
+                .slice(1, -1)
+                .split(" ")
+                .map((s) => s.trim())
+                .filter(Boolean);
+            policy[feature] = origins;
+        }
+        else {
+            policy[feature] = valueStr;
+        }
+    }
+    return policy;
+}
+//# sourceMappingURL=httpSecurityHeader.permissionsPolicy.js.map