okengine 0.2.6 → 0.3.2

package/src/plugins/maintenance-mode.ts

@@ -0,0 +1,85 @@
+/**
+ * Official `maintenance-mode` plugin — drain HTTP traffic with one flag.
+ * Uses only the public plugin API (unified-theory §14).
+ */
+
+import { plugin, type PluginDef } from "../kernel/plugin.ts";
+import {
+  isConfigSource,
+  pluginConfigSnapshot,
+  resolvePluginOptions,
+  withConfigTable,
+  type ConfigSource,
+} from "./config-source.ts";
+
+/** Options for {@link maintenanceMode}. */
+export interface MaintenanceModeOptions {
+  /**
+   * Whether the mode is active. Default `true` — plugging the plugin turns
+   * it on. Drive it from the environment to flip without a code change:
+   * `enabled: process.env.MAINTENANCE_MODE === "1"`.
+   */
+  readonly enabled?: boolean;
+  /** `Retry-After` value in seconds on the 503. Omitted unless provided. */
+  readonly retryAfter?: number;
+  /**
+   * Path prefixes that keep serving while the mode is active (e.g.
+   * `["/health"]` so load-balancer checks stay green).
+   */
+  readonly allowPaths?: readonly string[];
+  /**
+   * Operator bypass: requests carrying this header name (any non-empty
+   * value) pass through. Presence-based — an ops convenience, not auth.
+   */
+  readonly bypassHeader?: string;
+  /** Failure message in the envelope. Default `"Service is under maintenance."` */
+  readonly message?: string;
+}
+
+/**
+ * Short-circuit every HTTP invocation at `onRequest` with a 503 failure
+ * envelope (`ServiceUnavailable`) plus an optional `Retry-After`. Excluded
+ * prefixes and the bypass header keep ops paths alive. The 503 still flows
+ * through `onResponse`, so response-shaping plugins (security headers,
+ * compression) apply to it too. Non-HTTP triggers no-op — clock flows and
+ * signal subscribers keep running.
+ *
+ * Accepts static options or a {@link ConfigSource} — the flagship use
+ * case: flip `enabled` from the database and drain traffic without a
+ * redeploy.
+ *
+ * @param options - Flag, retry hint, allow-list, bypass — or a config source
+ */
+export function maintenanceMode(
+  options: MaintenanceModeOptions | ConfigSource<MaintenanceModeOptions> = {},
+): PluginDef {
+  const def = plugin("maintenance-mode", {
+    version: "0.0.2",
+    config: pluginConfigSnapshot(options),
+  }).hook("onRequest", (ctx) => {
+    const resolved = resolvePluginOptions(options);
+    if ((resolved.enabled ?? true) === false || !ctx.request) return;
+    const message = resolved.message ?? "Service is under maintenance.";
+
+    const { pathname } = new URL(ctx.request.url);
+    if (resolved.allowPaths?.some((prefix) => pathname.startsWith(prefix))) return;
+
+    const bypass = resolved.bypassHeader;
+    if (bypass !== undefined) {
+      const value = ctx.request.headers.get(bypass);
+      if (value !== null && value.length > 0) return;
+    }
+
+    const headers: Record<string, string> = {};
+    if (resolved.retryAfter !== undefined) headers["retry-after"] = String(resolved.retryAfter);
+    return Response.json(
+      {
+        data: null,
+        error: { code: "ServiceUnavailable", data: { retryAfter: resolved.retryAfter }, message },
+      },
+      { status: 503, headers },
+    );
+  });
+
+  return isConfigSource(options) ? withConfigTable(def, options) : def;
+}

package/src/plugins/node-import-scan.ts

@@ -49,9 +49,7 @@ export function scanNodeImportsBypassingFx(
       out.push({
         source: file.path,
         specifier,
-        line: typeof node.start === "number"
-          ? lineAt(file.source, node.start)
-          : null,
+        line: typeof node.start === "number" ? lineAt(file.source, node.start) : null,
       });
     });
   }
@@ -77,8 +75,7 @@ function importSpecifier(node: AstNode): string | null {
     };
     const callee = call.callee;
     const isRequire =
-      callee?.type === "Identifier" &&
-      (callee as { name?: string }).name === "require";
+      callee?.type === "Identifier" && (callee as { name?: string }).name === "require";
     if (!isRequire) return null;
     const arg0 = call.arguments?.[0];
     if (arg0 && (arg0.type === "Literal" || arg0.type === "StringLiteral")) {

package/src/plugins/security-headers.test.ts

@@ -0,0 +1,243 @@
+/**
+ * `security-headers` plugin — defaults on success, presence on failure,
+ * and app-wins override semantics through the real pipeline.
+ */
+
+import { beforeEach, describe, expect, test } from "bun:test";
+import { oke } from "../kernel/app.ts";
+import { flow, resetFlowSeq } from "../kernel/flow.ts";
+import { fail } from "../kernel/index.ts";
+import { on, resetBindings } from "../kernel/on.ts";
+import { http } from "../kernel/triggers.ts";
+import { defaultCspDirectives, securityHeaders } from "./security-headers.ts";
+
+beforeEach(() => {
+  resetBindings();
+  resetFlowSeq();
+});
+
+describe("securityHeaders plugin", () => {
+  test("sets the default trio on a successful response", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "sec" }).plug(securityHeaders());
+
+    const res = await app.fetch(new Request("http://localhost/x"));
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get("x-content-type-options")).toBe("nosniff");
+    expect(res.headers.get("x-frame-options")).toBe("DENY");
+    expect(res.headers.get("referrer-policy")).toBe("no-referrer");
+    expect(res.headers.get("content-security-policy")).toBeNull();
+  });
+
+  test("helmet-parity defaults: agent cluster, dns prefetch, download, cross-domain, xss filter", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "sec-parity" }).plug(securityHeaders());
+
+    const res = await app.fetch(new Request("http://localhost/x"));
+
+    expect(res.headers.get("origin-agent-cluster")).toBe("?1");
+    expect(res.headers.get("x-dns-prefetch-control")).toBe("off");
+    expect(res.headers.get("x-download-options")).toBe("noopen");
+    expect(res.headers.get("x-permitted-cross-domain-policies")).toBe("none");
+    expect(res.headers.get("x-xss-protection")).toBe("0");
+  });
+
+  test("each parity default can be switched off", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "sec-off" }).plug(
+      securityHeaders({
+        originAgentCluster: false,
+        dnsPrefetchControl: false,
+        downloadOptions: false,
+        xssProtection: false,
+      }),
+    );
+
+    const res = await app.fetch(new Request("http://localhost/x"));
+
+    expect(res.headers.get("origin-agent-cluster")).toBeNull();
+    expect(res.headers.get("x-dns-prefetch-control")).toBeNull();
+    expect(res.headers.get("x-download-options")).toBeNull();
+    expect(res.headers.get("x-xss-protection")).toBeNull();
+    expect(res.headers.get("x-permitted-cross-domain-policies")).toBe("none");
+  });
+
+  test("dnsPrefetchControl allow, custom cross-domain policy, COEP stamps when configured", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "sec-tuned" }).plug(
+      securityHeaders({
+        dnsPrefetchControl: { allow: true },
+        permittedCrossDomainPolicies: "by-content-type",
+        crossOriginEmbedderPolicy: "require-corp",
+      }),
+    );
+
+    const res = await app.fetch(new Request("http://localhost/x"));
+
+    expect(res.headers.get("x-dns-prefetch-control")).toBe("on");
+    expect(res.headers.get("x-permitted-cross-domain-policies")).toBe("by-content-type");
+    expect(res.headers.get("cross-origin-embedder-policy")).toBe("require-corp");
+  });
+
+  test("x-powered-by is removed by default; a string sets a decoy; false keeps the app's", async () => {
+    const poweredByApp = (options: Parameters<typeof securityHeaders>[0], name: string) => {
+      on(
+        http.get("/x"),
+        flow({
+          name: "x.get",
+          do: () =>
+            new Response("{}", {
+              headers: { "content-type": "application/json", "x-powered-by": "Express" },
+            }),
+        }),
+      );
+      return oke({ name }).plug(securityHeaders(options));
+    };
+
+    const removed = await poweredByApp({}, "sec-pb-off").fetch(new Request("http://localhost/x"));
+    expect(removed.headers.get("x-powered-by")).toBeNull();
+
+    const decoy = await poweredByApp(
+      { poweredBy: "PHP 4.2.0", override: true },
+      "sec-pb-decoy",
+    ).fetch(new Request("http://localhost/x"));
+    expect(decoy.headers.get("x-powered-by")).toBe("PHP 4.2.0");
+
+    const kept = await poweredByApp({ poweredBy: false }, "sec-pb-keep").fetch(
+      new Request("http://localhost/x"),
+    );
+    expect(kept.headers.get("x-powered-by")).toBe("Express");
+  });
+
+  test("structured CSP merges over helmet's defaults, camelCase keys, report-only mode", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "sec-csp-builder" }).plug(
+      securityHeaders({
+        contentSecurityPolicy: {
+          directives: { scriptSrc: ["'self'", "https://cdn.example.com"] },
+          reportOnly: true,
+        },
+      }),
+    );
+
+    const res = await app.fetch(new Request("http://localhost/x"));
+
+    expect(res.headers.get("content-security-policy")).toBeNull();
+    const reportOnly = res.headers.get("content-security-policy-report-only");
+    expect(reportOnly).toContain("script-src 'self' https://cdn.example.com");
+    expect(reportOnly).toContain("default-src 'self'");
+    expect(reportOnly).toContain("upgrade-insecure-requests");
+  });
+
+  test("structured CSP with useDefaults: false emits exactly the given directives", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "sec-csp-bare" }).plug(
+      securityHeaders({
+        contentSecurityPolicy: { useDefaults: false, directives: { "default-src": ["'none'"] } },
+      }),
+    );
+
+    const res = await app.fetch(new Request("http://localhost/x"));
+    expect(res.headers.get("content-security-policy")).toBe("default-src 'none'");
+  });
+
+  test("defaultCspDirectives matches helmet's documented default policy", () => {
+    expect(defaultCspDirectives["upgrade-insecure-requests"]).toEqual([]);
+    expect(defaultCspDirectives["script-src-attr"]).toEqual(["'none'"]);
+    expect(Object.keys(defaultCspDirectives)).toHaveLength(11);
+  });
+
+  test("headers land on failures too (onResponse runs after onError)", async () => {
+    on(
+      http.get("/deny"),
+      flow({ name: "x.deny", do: () => ({ ok: true }) }).hook("beforeHandle", () =>
+        fail("Forbidden", {}),
+      ),
+    );
+    const app = oke({ name: "sec-fail" }).plug(securityHeaders());
+
+    const res = await app.fetch(new Request("http://localhost/deny"));
+
+    expect(res.status).not.toBe(200);
+    expect(res.headers.get("x-content-type-options")).toBe("nosniff");
+  });
+
+  test("adds CSP only when configured", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "sec-csp" }).plug(
+      securityHeaders({ contentSecurityPolicy: "default-src 'self'" }),
+    );
+
+    const res = await app.fetch(new Request("http://localhost/x"));
+
+    expect(res.headers.get("content-security-policy")).toBe("default-src 'self'");
+  });
+
+  test("HSTS is off by default", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "sec-hsts-off" }).plug(securityHeaders());
+
+    const res = await app.fetch(new Request("http://localhost/x"));
+
+    expect(res.headers.get("strict-transport-security")).toBeNull();
+  });
+
+  test("hsts: true stamps a one-year max-age", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "sec-hsts-on" }).plug(securityHeaders({ hsts: true }));
+
+    const res = await app.fetch(new Request("http://localhost/x"));
+
+    expect(res.headers.get("strict-transport-security")).toBe("max-age=31536000");
+  });
+
+  test("hsts object tunes max-age, subdomains, preload", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "sec-hsts-tuned" }).plug(
+      securityHeaders({ hsts: { maxAge: 63072000, includeSubDomains: true, preload: true } }),
+    );
+
+    const res = await app.fetch(new Request("http://localhost/x"));
+
+    expect(res.headers.get("strict-transport-security")).toBe(
+      "max-age=63072000; includeSubDomains; preload",
+    );
+  });
+
+  test("permissions-policy and cross-origin policies stamp when configured", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "sec-extra" }).plug(
+      securityHeaders({
+        permissionsPolicy: "camera=(), microphone=()",
+        crossOriginOpenerPolicy: "same-origin",
+        crossOriginResourcePolicy: "same-site",
+      }),
+    );
+
+    const res = await app.fetch(new Request("http://localhost/x"));
+
+    expect(res.headers.get("permissions-policy")).toBe("camera=(), microphone=()");
+    expect(res.headers.get("cross-origin-opener-policy")).toBe("same-origin");
+    expect(res.headers.get("cross-origin-resource-policy")).toBe("same-site");
+  });
+
+  test("an explicit app-set value wins by default", async () => {
+    on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
+    const app = oke({ name: "sec-keep" });
+    app.hook("onResponse", (ctx) => {
+      if (!ctx.response) return;
+      const headers = new Headers(ctx.response.headers);
+      headers.set("x-frame-options", "SAMEORIGIN");
+      ctx.response = new Response(ctx.response.body, {
+        status: ctx.response.status,
+        headers,
+      });
+    });
+    app.plug(securityHeaders());
+
+    const res = await app.fetch(new Request("http://localhost/x"));
+
+    expect(res.headers.get("x-frame-options")).toBe("SAMEORIGIN");
+  });
+});

package/src/plugins/security-headers.ts

@@ -0,0 +1,255 @@
+/**
+ * Official `security-headers` plugin — the complete secure-headers set on
+ * every HTTP response (helmet parity, API-first defaults). Uses only the
+ * public plugin API (unified-theory §14).
+ */
+
+import { plugin, type PluginDef } from "../kernel/plugin.ts";
+import {
+  isConfigSource,
+  pluginConfigSnapshot,
+  resolvePluginOptions,
+  withConfigTable,
+  type ConfigSource,
+} from "./config-source.ts";
+import { setUnlessPresent, withHeaders } from "./headers.ts";
+
+/** HSTS value options (see {@link SecurityHeadersOptions.hsts}). */
+export interface HstsOptions {
+  /** `max-age` in seconds. Default `31536000` (one year). */
+  readonly maxAge?: number;
+  /** Append `includeSubDomains`. Default `false`. */
+  readonly includeSubDomains?: boolean;
+  /** Append `preload`. Only meaningful with subdomains + a ≥1-year max-age. */
+  readonly preload?: boolean;
+}
+
+/** Structured CSP (see {@link SecurityHeadersOptions.contentSecurityPolicy}). */
+export interface CspOptions {
+  /**
+   * Directive map — kebab-case (`script-src`) or camelCase (`scriptSrc`)
+   * keys, values as string arrays. An empty array emits a bare directive
+   * (e.g. `upgrade-insecure-requests`).
+   */
+  readonly directives: Readonly<Record<string, readonly string[]>>;
+  /** Merge over {@link defaultCspDirectives}. Default `true`. */
+  readonly useDefaults?: boolean;
+  /** Emit as `Content-Security-Policy-Report-Only`. Default `false`. */
+  readonly reportOnly?: boolean;
+}
+
+/**
+ * Helmet's default CSP — the baseline `directives` merge over unless
+ * `useDefaults: false`.
+ */
+export const defaultCspDirectives: Readonly<Record<string, readonly string[]>> = {
+  "default-src": ["'self'"],
+  "base-uri": ["'self'"],
+  "font-src": ["'self'", "https:", "data:"],
+  "form-action": ["'self'"],
+  "frame-ancestors": ["'self'"],
+  "img-src": ["'self'", "data:"],
+  "object-src": ["'none'"],
+  "script-src": ["'self'"],
+  "script-src-attr": ["'none'"],
+  "style-src": ["'self'", "https:", "'unsafe-inline'"],
+  "upgrade-insecure-requests": [],
+};
+
+/** Options for {@link securityHeaders}. */
+export interface SecurityHeadersOptions {
+  /**
+   * Content-Security-Policy — a raw header string, or a structured
+   * {@link CspOptions} (directive builder over helmet's defaults, optional
+   * report-only mode). Omitted unless provided.
+   */
+  readonly contentSecurityPolicy?: string | CspOptions;
+  /** X-Frame-Options value. Default `"DENY"`. */
+  readonly frameOptions?: "DENY" | "SAMEORIGIN";
+  /** Referrer-Policy value. Default `"no-referrer"`. */
+  readonly referrerPolicy?: string;
+  /**
+   * Strict-Transport-Security. `true` → one-year `max-age`; pass an object
+   * to tune. Default off — HSTS is sticky, and local dev is plain HTTP, so
+   * enable it deliberately for HTTPS deployments.
+   */
+  readonly hsts?: boolean | HstsOptions;
+  /** Permissions-Policy value (e.g. `"camera=(), microphone=()"`). Omitted unless provided. */
+  readonly permissionsPolicy?: string;
+  /**
+   * Cross-Origin-Opener-Policy value. Omitted unless provided — opt-in
+   * because OKE serves APIs, where cross-origin clients are legitimate
+   * (helmet targets web pages and defaults it on).
+   */
+  readonly crossOriginOpenerPolicy?: "same-origin" | "same-origin-allow-popups" | "unsafe-none";
+  /** Cross-Origin-Resource-Policy value. Omitted unless provided (same API rationale). */
+  readonly crossOriginResourcePolicy?: "same-origin" | "same-site" | "cross-origin";
+  /** Cross-Origin-Embedder-Policy value. Omitted unless provided (helmet also defaults it off). */
+  readonly crossOriginEmbedderPolicy?: "require-corp" | "credentialless";
+  /** Origin-Agent-Cluster header. Default `true` → `?1`. */
+  readonly originAgentCluster?: boolean;
+  /**
+   * X-DNS-Prefetch-Control. Default `true` → `off` (privacy-preserving);
+   * `{ allow: true }` → `on`; `false` omits the header.
+   */
+  readonly dnsPrefetchControl?: boolean | { readonly allow: boolean };
+  /** X-Download-Options: noopen (legacy IE8 mitigation, helmet parity). Default `true`. */
+  readonly downloadOptions?: boolean;
+  /** X-Permitted-Cross-Domain-Policies value. Default `"none"`. */
+  readonly permittedCrossDomainPolicies?: "none" | "master-only" | "by-content-type" | "all";
+  /**
+   * X-Powered-By handling. Default `true` → remove the header (it leaks
+   * framework fingerprints). A string sets a custom value; `false` keeps it.
+   */
+  readonly poweredBy?: boolean | string;
+  /**
+   * X-XSS-Protection: 0 — disables the legacy, buggy browser XSS auditor
+   * (helmet parity; modern defense is CSP). Default `true`.
+   */
+  readonly xssProtection?: boolean;
+  /**
+   * Replace headers the app already set. Default `false` — an explicit
+   * app-level value always wins.
+   */
+  readonly override?: boolean;
+}
+
+/** Render the Strict-Transport-Security header value. */
+function hstsValue(hsts: boolean | HstsOptions): string {
+  const opts: HstsOptions = typeof hsts === "object" ? hsts : {};
+  let value = `max-age=${opts.maxAge ?? 31536000}`;
+  if (opts.includeSubDomains) value += "; includeSubDomains";
+  if (opts.preload) value += "; preload";
+  return value;
+}
+
+/** camelCase directive keys → kebab-case (`scriptSrc` → `script-src`). */
+function directiveName(name: string): string {
+  return name.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`);
+}
+
+/** Build a CSP header value from a directive map. */
+function buildCsp(directives: Readonly<Record<string, readonly string[]>>): string {
+  return Object.entries(directives)
+    .map(([name, values]) => {
+      const kebab = directiveName(name);
+      return values.length === 0 ? kebab : `${kebab} ${values.join(" ")}`;
+    })
+    .join("; ");
+}
+
+/** Resolve the CSP option into header name + value. */
+function cspEntry(option: string | CspOptions): { readonly name: string; readonly value: string } {
+  if (typeof option === "string") return { name: "content-security-policy", value: option };
+  const useDefaults = option.useDefaults ?? true;
+  const merged: Record<string, readonly string[]> = useDefaults
+    ? { ...defaultCspDirectives, ...option.directives }
+    : { ...option.directives };
+  return {
+    name:
+      (option.reportOnly ?? false)
+        ? "content-security-policy-report-only"
+        : "content-security-policy",
+    value: buildCsp(merged),
+  };
+}
+
+/**
+ * Apply the complete secure-headers set to every HTTP response, including
+ * failures (runs at `onResponse`, which fires after `onError` too). Covers
+ * every helmet.js middleware; API-first deviations (opt-in HSTS, COOP,
+ * CORP) are documented per option.
+ *
+ * Accepts static options or a {@link ConfigSource} for DB-driven config
+ * (e.g. flip `hsts` from the database without a redeploy).
+ *
+ * @param options - Header values, or a config source
+ */
+export function securityHeaders(
+  options: SecurityHeadersOptions | ConfigSource<SecurityHeadersOptions> = {},
+): PluginDef {
+  const def = plugin("security-headers", {
+    version: "0.1.0",
+    config: pluginConfigSnapshot(options),
+  }).hook("onResponse", (ctx) => {
+    if (!ctx.response) return;
+    const resolved = resolvePluginOptions(options);
+    const override = resolved.override ?? false;
+
+    ctx.response = withHeaders(ctx.response, (headers) => {
+      setUnlessPresent(headers, "x-content-type-options", "nosniff", override);
+      setUnlessPresent(headers, "x-frame-options", resolved.frameOptions ?? "DENY", override);
+      setUnlessPresent(
+        headers,
+        "referrer-policy",
+        resolved.referrerPolicy ?? "no-referrer",
+        override,
+      );
+
+      if (resolved.originAgentCluster ?? true) {
+        setUnlessPresent(headers, "origin-agent-cluster", "?1", override);
+      }
+      const dns = resolved.dnsPrefetchControl ?? true;
+      if (dns !== false) {
+        const allow = typeof dns === "object" ? dns.allow : false;
+        setUnlessPresent(headers, "x-dns-prefetch-control", allow ? "on" : "off", override);
+      }
+      if (resolved.downloadOptions ?? true) {
+        setUnlessPresent(headers, "x-download-options", "noopen", override);
+      }
+      setUnlessPresent(
+        headers,
+        "x-permitted-cross-domain-policies",
+        resolved.permittedCrossDomainPolicies ?? "none",
+        override,
+      );
+      if (resolved.xssProtection ?? true) {
+        setUnlessPresent(headers, "x-xss-protection", "0", override);
+      }
+
+      const poweredBy = resolved.poweredBy ?? true;
+      if (poweredBy === true) {
+        headers.delete("x-powered-by");
+      } else if (typeof poweredBy === "string") {
+        setUnlessPresent(headers, "x-powered-by", poweredBy, override);
+      }
+
+      if (resolved.contentSecurityPolicy !== undefined) {
+        const csp = cspEntry(resolved.contentSecurityPolicy);
+        setUnlessPresent(headers, csp.name, csp.value, override);
+      }
+      if (resolved.hsts !== undefined && resolved.hsts !== false) {
+        setUnlessPresent(headers, "strict-transport-security", hstsValue(resolved.hsts), override);
+      }
+      if (resolved.permissionsPolicy !== undefined) {
+        setUnlessPresent(headers, "permissions-policy", resolved.permissionsPolicy, override);
+      }
+      if (resolved.crossOriginOpenerPolicy !== undefined) {
+        setUnlessPresent(
+          headers,
+          "cross-origin-opener-policy",
+          resolved.crossOriginOpenerPolicy,
+          override,
+        );
+      }
+      if (resolved.crossOriginResourcePolicy !== undefined) {
+        setUnlessPresent(
+          headers,
+          "cross-origin-resource-policy",
+          resolved.crossOriginResourcePolicy,
+          override,
+        );
+      }
+      if (resolved.crossOriginEmbedderPolicy !== undefined) {
+        setUnlessPresent(
+          headers,
+          "cross-origin-embedder-policy",
+          resolved.crossOriginEmbedderPolicy,
+          override,
+        );
+      }
+    });
+  });
+
+  return isConfigSource(options) ? withConfigTable(def, options) : def;
+}

package/src/plugins/supply-chain.ts

@@ -248,9 +248,7 @@ export function projectSupplyChainSync(
   };
 }
 
-function projectLifecycle(
-  pkg: PackageJsonProbe | null,
-): LifecycleScriptsSignal {
+function projectLifecycle(pkg: PackageJsonProbe | null): LifecycleScriptsSignal {
   if (!pkg) {
     return {
       state: "unknown",
@@ -335,9 +333,7 @@ function projectNodeScan(
   };
 }
 
-async function projectProvenance(
-  options: ProjectSupplyChainOptions,
-): Promise<NpmProvenanceSignal> {
+async function projectProvenance(options: ProjectSupplyChainOptions): Promise<NpmProvenanceSignal> {
   if (options.provenance === "attested") {
     return { state: "pass", detail: "npm provenance attestation present" };
   }
@@ -385,10 +381,7 @@ function projectBootConflicts(
   };
 }
 
-async function readPackageJson(
-  cwd: string,
-  packageName: string,
-): Promise<PackageJsonProbe | null> {
+async function readPackageJson(cwd: string, packageName: string): Promise<PackageJsonProbe | null> {
   const path = resolve(cwd, "node_modules", ...packageName.split("/"), "package.json");
   try {
     const file = Bun.file(path);
@@ -422,9 +415,7 @@ async function fetchPublishedAt(
   }
 }
 
-async function fetchNpmProvenance(
-  packageName: string,
-): Promise<NpmProvenanceSignal> {
+async function fetchNpmProvenance(packageName: string): Promise<NpmProvenanceSignal> {
   try {
     const res = await fetch(`https://registry.npmjs.org/${packageName}`, {
       headers: { Accept: "application/json" },
@@ -437,10 +428,7 @@ async function fetchNpmProvenance(
     }
     const body = (await res.json()) as {
       "dist-tags"?: { latest?: string };
-      versions?: Record<
-        string,
-        { dist?: { attestations?: unknown; signatures?: unknown } }
-      >;
+      versions?: Record<string, { dist?: { attestations?: unknown; signatures?: unknown } }>;
     };
     const latest = body["dist-tags"]?.latest;
     const dist = latest ? body.versions?.[latest]?.dist : undefined;