okengine 0.5.0 → 0.5.1

package/src/plugins/compression.ts

@@ -11,7 +11,7 @@ import {
   withConfigTable,
   type ConfigSource,
 } from "./config-source.ts";
-import { appendVary } from "./headers.ts";
+import { appendVary } from "./response-headers.ts";
 
 /** Options for {@link compression}. */
 export interface CompressionOptions {

package/src/plugins/config-source.test.ts

@@ -19,7 +19,7 @@ import { createPluginRegistry } from "../kernel/registry.ts";
 import { http } from "../kernel/triggers.ts";
 import { configSource, resolvePluginOptions } from "./config-source.ts";
 import { maintenanceMode } from "./maintenance-mode.ts";
-import { securityHeaders } from "./security-headers.ts";
+import { headers } from "./headers.ts";
 
 beforeEach(() => {
   resetBindings();
@@ -74,7 +74,7 @@ describe("configSource — box semantics", () => {
     };
     const fx = createFxContext({ flow: "x.config-sync", effects, storeRuntime: runtime }).fx;
 
-    const table = defineTable("security_headers_config", { key: true, value: true });
+    const table = defineTable("headers_config", { key: true, value: true });
     const sql = fx.store(db) as SqlStoreHandle;
     await sql.ensureTable(table);
     await sql
@@ -83,7 +83,7 @@ describe("configSource — box semantics", () => {
       .execute();
 
     const source = configSource({
-      plugin: "security-headers",
+      plugin: "headers",
       code: { hsts: false },
       db: { store: db },
       kv: cfg,
@@ -110,11 +110,11 @@ describe("configSource — box semantics", () => {
 
     const effects = { reads: ["sql:cfgdb" as const], writes: ["sql:cfgdb" as const] };
     const fx = createFxContext({ flow: "x.config-sync", effects, storeRuntime: runtime }).fx;
-    const table = defineTable("security_headers_config", { key: true, value: true });
+    const table = defineTable("headers_config", { key: true, value: true });
     await (fx.store(db) as SqlStoreHandle).ensureTable(table);
 
     const source = configSource({
-      plugin: "security-headers",
+      plugin: "headers",
       code: { frameOptions: "DENY" as const },
       db: { store: db },
     });
@@ -132,13 +132,13 @@ describe("configSource — box semantics", () => {
 
     const effects = { reads: ["sql:cfgdb" as const], writes: ["sql:cfgdb" as const] };
     const fx = createFxContext({ flow: "x.config-sync", effects, storeRuntime: runtime }).fx;
-    const table = defineTable("security_headers_config", { key: true, value: true });
+    const table = defineTable("headers_config", { key: true, value: true });
     const sql = fx.store(db) as SqlStoreHandle;
     await sql.ensureTable(table);
     await sql.insert(table).values({ key: "config", value: "{not json" }).execute();
 
     const source = configSource({
-      plugin: "security-headers",
+      plugin: "headers",
       code: {},
       db: { store: db },
     });
@@ -171,17 +171,17 @@ describe("configSource — plugin wiring", () => {
   test("DB-backed sources contribute their config table; static options do not", () => {
     const db = store.sql("cfgdb");
     const source = configSource({
-      plugin: "security-headers",
+      plugin: "headers",
       code: {},
       db: { store: db },
     });
 
     const registry = createPluginRegistry();
-    const registration = registry.plug(securityHeaders(source), { kind: "app" });
-    expect(registration?.tables.map((t) => t.name)).toEqual(["security_headers_config"]);
+    const registration = registry.plug(headers(source), { kind: "app" });
+    expect(registration?.tables.map((t) => t.name)).toEqual(["headers_config"]);
 
     const staticRegistry = createPluginRegistry();
-    const staticRegistration = staticRegistry.plug(securityHeaders({}), { kind: "app" });
+    const staticRegistration = staticRegistry.plug(headers({}), { kind: "app" });
     expect(staticRegistration?.tables).toEqual([]);
   });
 

package/src/plugins/config-source.ts

@@ -35,8 +35,8 @@ export interface ConfigSourceDb {
 /** Options for {@link configSource}. */
 export interface ConfigSourceOptions<T extends object> {
   /**
-   * Plugin id this config belongs to (e.g. `"security-headers"`) — derives
-   * the DB row key, the KV key, and the default table name.
+   * Plugin id this config belongs to (e.g. `"headers"`) — derives the DB
+   * row key, the KV key, and the default table name.
    */
   readonly plugin: string;
   /**

package/src/plugins/cors.ts

@@ -13,7 +13,7 @@ import {
   isConfigSource,
   type ConfigSource,
 } from "./config-source.ts";
-import { appendVary, withHeaders } from "./headers.ts";
+import { appendVary, withHeaders } from "./response-headers.ts";
 
 /** Options for {@link cors}. */
 export interface CorsOptions {

package/src/plugins/{security-headers.test.ts → headers.test.ts}

@@ -1,5 +1,5 @@
 /**
- * `security-headers` plugin — defaults on success, presence on failure,
+ * `headers` plugin — defaults on success, presence on failure,
  * and app-wins override semantics through the real pipeline.
  */
 
@@ -9,17 +9,17 @@ import { flow, resetFlowSeq } from "../kernel/flow.ts";
 import { fail } from "../kernel/index.ts";
 import { on, resetBindings } from "../kernel/on.ts";
 import { http } from "../kernel/triggers.ts";
-import { defaultCspDirectives, securityHeaders } from "./security-headers.ts";
+import { defaultCspDirectives, headers } from "./headers.ts";
 
 beforeEach(() => {
   resetBindings();
   resetFlowSeq();
 });
 
-describe("securityHeaders plugin", () => {
+describe("headers plugin", () => {
   test("sets the default trio on a successful response", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ autoBoot: false, name: "sec" }).plug(securityHeaders());
+    const app = oke({ autoBoot: false, name: "sec" }).plug(headers());
 
     const res = await app.fetch(new Request("http://localhost/x"));
 
@@ -32,7 +32,7 @@ describe("securityHeaders plugin", () => {
 
   test("helmet-parity defaults: agent cluster, dns prefetch, download, cross-domain, xss filter", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ autoBoot: false, name: "sec-parity" }).plug(securityHeaders());
+    const app = oke({ autoBoot: false, name: "sec-parity" }).plug(headers());
 
     const res = await app.fetch(new Request("http://localhost/x"));
 
@@ -46,7 +46,7 @@ describe("securityHeaders plugin", () => {
   test("each parity default can be switched off", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-off" }).plug(
-      securityHeaders({
+      headers({
         originAgentCluster: false,
         dnsPrefetchControl: false,
         downloadOptions: false,
@@ -66,7 +66,7 @@ describe("securityHeaders plugin", () => {
   test("dnsPrefetchControl allow, custom cross-domain policy, COEP stamps when configured", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-tuned" }).plug(
-      securityHeaders({
+      headers({
         dnsPrefetchControl: { allow: true },
         permittedCrossDomainPolicies: "by-content-type",
         crossOriginEmbedderPolicy: "require-corp",
@@ -81,7 +81,7 @@ describe("securityHeaders plugin", () => {
   });
 
   test("x-powered-by is removed by default; a string sets a decoy; false keeps the app's", async () => {
-    const poweredByApp = (options: Parameters<typeof securityHeaders>[0], name: string) => {
+    const poweredByApp = (options: Parameters<typeof headers>[0], name: string) => {
       on(
         http.get("/x"),
         flow({
@@ -92,7 +92,7 @@ describe("securityHeaders plugin", () => {
             }),
         }),
       );
-      return oke({ autoBoot: false, name }).plug(securityHeaders(options));
+      return oke({ autoBoot: false, name }).plug(headers(options));
     };
 
     const removed = await poweredByApp({}, "sec-pb-off").fetch(new Request("http://localhost/x"));
@@ -113,7 +113,7 @@ describe("securityHeaders plugin", () => {
   test("structured CSP merges over helmet's defaults, camelCase keys, report-only mode", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-csp-builder" }).plug(
-      securityHeaders({
+      headers({
         contentSecurityPolicy: {
           directives: { scriptSrc: ["'self'", "https://cdn.example.com"] },
           reportOnly: true,
@@ -133,7 +133,7 @@ describe("securityHeaders plugin", () => {
   test("structured CSP with useDefaults: false emits exactly the given directives", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-csp-bare" }).plug(
-      securityHeaders({
+      headers({
         contentSecurityPolicy: { useDefaults: false, directives: { "default-src": ["'none'"] } },
       }),
     );
@@ -155,7 +155,7 @@ describe("securityHeaders plugin", () => {
         fail("Forbidden", {}),
       ),
     );
-    const app = oke({ autoBoot: false, name: "sec-fail" }).plug(securityHeaders());
+    const app = oke({ autoBoot: false, name: "sec-fail" }).plug(headers());
 
     const res = await app.fetch(new Request("http://localhost/deny"));
 
@@ -166,7 +166,7 @@ describe("securityHeaders plugin", () => {
   test("adds CSP only when configured", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-csp" }).plug(
-      securityHeaders({ contentSecurityPolicy: "default-src 'self'" }),
+      headers({ contentSecurityPolicy: "default-src 'self'" }),
     );
 
     const res = await app.fetch(new Request("http://localhost/x"));
@@ -176,7 +176,7 @@ describe("securityHeaders plugin", () => {
 
   test("HSTS is off by default", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ autoBoot: false, name: "sec-hsts-off" }).plug(securityHeaders());
+    const app = oke({ autoBoot: false, name: "sec-hsts-off" }).plug(headers());
 
     const res = await app.fetch(new Request("http://localhost/x"));
 
@@ -185,7 +185,7 @@ describe("securityHeaders plugin", () => {
 
   test("hsts: true stamps a one-year max-age", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ autoBoot: false, name: "sec-hsts-on" }).plug(securityHeaders({ hsts: true }));
+    const app = oke({ autoBoot: false, name: "sec-hsts-on" }).plug(headers({ hsts: true }));
 
     const res = await app.fetch(new Request("http://localhost/x"));
 
@@ -195,7 +195,7 @@ describe("securityHeaders plugin", () => {
   test("hsts object tunes max-age, subdomains, preload", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-hsts-tuned" }).plug(
-      securityHeaders({ hsts: { maxAge: 63072000, includeSubDomains: true, preload: true } }),
+      headers({ hsts: { maxAge: 63072000, includeSubDomains: true, preload: true } }),
     );
 
     const res = await app.fetch(new Request("http://localhost/x"));
@@ -208,7 +208,7 @@ describe("securityHeaders plugin", () => {
   test("permissions-policy and cross-origin policies stamp when configured", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
     const app = oke({ autoBoot: false, name: "sec-extra" }).plug(
-      securityHeaders({
+      headers({
         permissionsPolicy: "camera=(), microphone=()",
         crossOriginOpenerPolicy: "same-origin",
         crossOriginResourcePolicy: "same-site",
@@ -234,7 +234,7 @@ describe("securityHeaders plugin", () => {
         headers,
       });
     });
-    app.plug(securityHeaders());
+    app.plug(headers());
 
     const res = await app.fetch(new Request("http://localhost/x"));
 

package/src/plugins/headers.ts

@@ -1,54 +1,253 @@
 /**
- * Shared response-header mutation for HTTP middleware plugins.
- * `Headers` are immutable-in-place on a built `Response` — rebuild instead.
+ * Official `headers` plugin — the complete secure-headers set on every HTTP
+ * response (helmet parity, API-first defaults). Uses only the public plugin
+ * API (unified-theory §14).
  */
 
-/**
- * Rebuild a response with headers mutated by `fn`.
- *
- * @param response - Original response
- * @param fn - Header mutation
- */
-export function withHeaders(response: Response, fn: (headers: Headers) => void): Response {
-  const headers = new Headers(response.headers);
-  fn(headers);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers,
-  });
+import { plugin, type PluginDef } from "../kernel/plugin.ts";
+import {
+  isConfigSource,
+  pluginConfigSnapshot,
+  resolvePluginOptions,
+  withConfigTable,
+  type ConfigSource,
+} from "./config-source.ts";
+import { setUnlessPresent, withHeaders } from "./response-headers.ts";
+
+/** HSTS value options (see {@link HeadersOptions.hsts}). */
+export interface HstsOptions {
+  /** `max-age` in seconds. Default `31536000` (one year). */
+  readonly maxAge?: number;
+  /** Append `includeSubDomains`. Default `false`. */
+  readonly includeSubDomains?: boolean;
+  /** Append `preload`. Only meaningful with subdomains + a ≥1-year max-age. */
+  readonly preload?: boolean;
+}
+
+/** Structured CSP (see {@link HeadersOptions.contentSecurityPolicy}). */
+export interface CspOptions {
+  /**
+   * Directive map — kebab-case (`script-src`) or camelCase (`scriptSrc`)
+   * keys, values as string arrays. An empty array emits a bare directive
+   * (e.g. `upgrade-insecure-requests`).
+   */
+  readonly directives: Readonly<Record<string, readonly string[]>>;
+  /** Merge over {@link defaultCspDirectives}. Default `true`. */
+  readonly useDefaults?: boolean;
+  /** Emit as `Content-Security-Policy-Report-Only`. Default `false`. */
+  readonly reportOnly?: boolean;
 }
 
 /**
- * Set a header only when absent (or when `override` is on).
- *
- * @param headers - Mutable headers
- * @param name - Header name
- * @param value - Header value
- * @param override - Replace an app-set value
+ * Helmet's default CSP — the baseline `directives` merge over unless
+ * `useDefaults: false`.
  */
-export function setUnlessPresent(
-  headers: Headers,
-  name: string,
-  value: string,
-  override: boolean,
-): void {
-  if (!override && headers.has(name)) return;
-  headers.set(name, value);
+export const defaultCspDirectives: Readonly<Record<string, readonly string[]>> = {
+  "default-src": ["'self'"],
+  "base-uri": ["'self'"],
+  "font-src": ["'self'", "https:", "data:"],
+  "form-action": ["'self'"],
+  "frame-ancestors": ["'self'"],
+  "img-src": ["'self'", "data:"],
+  "object-src": ["'none'"],
+  "script-src": ["'self'"],
+  "script-src-attr": ["'none'"],
+  "style-src": ["'self'", "https:", "'unsafe-inline'"],
+  "upgrade-insecure-requests": [],
+};
+
+/** Options for {@link headers}. */
+export interface HeadersOptions {
+  /**
+   * Content-Security-Policy — a raw header string, or a structured
+   * {@link CspOptions} (directive builder over helmet's defaults, optional
+   * report-only mode). Omitted unless provided.
+   */
+  readonly contentSecurityPolicy?: string | CspOptions;
+  /** X-Frame-Options value. Default `"DENY"`. */
+  readonly frameOptions?: "DENY" | "SAMEORIGIN";
+  /** Referrer-Policy value. Default `"no-referrer"`. */
+  readonly referrerPolicy?: string;
+  /**
+   * Strict-Transport-Security. `true` → one-year `max-age`; pass an object
+   * to tune. Default off — HSTS is sticky, and local dev is plain HTTP, so
+   * enable it deliberately for HTTPS deployments.
+   */
+  readonly hsts?: boolean | HstsOptions;
+  /** Permissions-Policy value (e.g. `"camera=(), microphone=()"`). Omitted unless provided. */
+  readonly permissionsPolicy?: string;
+  /**
+   * Cross-Origin-Opener-Policy value. Omitted unless provided — opt-in
+   * because OKE serves APIs, where cross-origin clients are legitimate
+   * (helmet targets web pages and defaults it on).
+   */
+  readonly crossOriginOpenerPolicy?: "same-origin" | "same-origin-allow-popups" | "unsafe-none";
+  /** Cross-Origin-Resource-Policy value. Omitted unless provided (same API rationale). */
+  readonly crossOriginResourcePolicy?: "same-origin" | "same-site" | "cross-origin";
+  /** Cross-Origin-Embedder-Policy value. Omitted unless provided (helmet also defaults it off). */
+  readonly crossOriginEmbedderPolicy?: "require-corp" | "credentialless";
+  /** Origin-Agent-Cluster header. Default `true` → `?1`. */
+  readonly originAgentCluster?: boolean;
+  /**
+   * X-DNS-Prefetch-Control. Default `true` → `off` (privacy-preserving);
+   * `{ allow: true }` → `on`; `false` omits the header.
+   */
+  readonly dnsPrefetchControl?: boolean | { readonly allow: boolean };
+  /** X-Download-Options: noopen (legacy IE8 mitigation, helmet parity). Default `true`. */
+  readonly downloadOptions?: boolean;
+  /** X-Permitted-Cross-Domain-Policies value. Default `"none"`. */
+  readonly permittedCrossDomainPolicies?: "none" | "master-only" | "by-content-type" | "all";
+  /**
+   * X-Powered-By handling. Default `true` → remove the header (it leaks
+   * framework fingerprints). A string sets a custom value; `false` keeps it.
+   */
+  readonly poweredBy?: boolean | string;
+  /**
+   * X-XSS-Protection: 0 — disables the legacy, buggy browser XSS auditor
+   * (helmet parity; modern defense is CSP). Default `true`.
+   */
+  readonly xssProtection?: boolean;
+  /**
+   * Replace headers the app already set. Default `false` — an explicit
+   * app-level value always wins.
+   */
+  readonly override?: boolean;
+}
+
+/** Render the Strict-Transport-Security header value. */
+function hstsValue(hsts: boolean | HstsOptions): string {
+  const opts: HstsOptions = typeof hsts === "object" ? hsts : {};
+  let value = `max-age=${opts.maxAge ?? 31536000}`;
+  if (opts.includeSubDomains) value += "; includeSubDomains";
+  if (opts.preload) value += "; preload";
+  return value;
+}
+
+/** camelCase directive keys → kebab-case (`scriptSrc` → `script-src`). */
+function directiveName(name: string): string {
+  return name.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`);
+}
+
+/** Build a CSP header value from a directive map. */
+function buildCsp(directives: Readonly<Record<string, readonly string[]>>): string {
+  return Object.entries(directives)
+    .map(([name, values]) => {
+      const kebab = directiveName(name);
+      return values.length === 0 ? kebab : `${kebab} ${values.join(" ")}`;
+    })
+    .join("; ");
+}
+
+/** Resolve the CSP option into header name + value. */
+function cspEntry(option: string | CspOptions): { readonly name: string; readonly value: string } {
+  if (typeof option === "string") return { name: "content-security-policy", value: option };
+  const useDefaults = option.useDefaults ?? true;
+  const merged: Record<string, readonly string[]> = useDefaults
+    ? { ...defaultCspDirectives, ...option.directives }
+    : { ...option.directives };
+  return {
+    name:
+      (option.reportOnly ?? false)
+        ? "content-security-policy-report-only"
+        : "content-security-policy",
+    value: buildCsp(merged),
+  };
 }
 
 /**
- * Append a token to `Vary` without duplicating it.
+ * Apply the complete secure-headers set to every HTTP response, including
+ * failures (runs at `onResponse`, which fires after `onError` too). Covers
+ * every helmet.js middleware; API-first deviations (opt-in HSTS, COOP,
+ * CORP) are documented per option.
+ *
+ * Accepts static options or a {@link ConfigSource} for DB-driven config
+ * (e.g. flip `hsts` from the database without a redeploy).
  *
- * @param headers - Mutable headers
- * @param token - Vary token (e.g. `"origin"`)
+ * @param options - Header values, or a config source
  */
-export function appendVary(headers: Headers, token: string): void {
-  const vary = headers.get("vary");
-  if (vary === null) {
-    headers.set("vary", token);
-    return;
-  }
-  const pattern = new RegExp(`\\b${token.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`, "i");
-  if (!pattern.test(vary)) headers.set("vary", `${vary}, ${token}`);
+export function headers(options: HeadersOptions | ConfigSource<HeadersOptions> = {}): PluginDef {
+  const def = plugin("headers", {
+    version: "0.1.0",
+    config: pluginConfigSnapshot(options),
+  }).hook("onResponse", (ctx) => {
+    if (!ctx.response) return;
+    const resolved = resolvePluginOptions(options);
+    const override = resolved.override ?? false;
+
+    ctx.response = withHeaders(ctx.response, (headers) => {
+      setUnlessPresent(headers, "x-content-type-options", "nosniff", override);
+      setUnlessPresent(headers, "x-frame-options", resolved.frameOptions ?? "DENY", override);
+      setUnlessPresent(
+        headers,
+        "referrer-policy",
+        resolved.referrerPolicy ?? "no-referrer",
+        override,
+      );
+
+      if (resolved.originAgentCluster ?? true) {
+        setUnlessPresent(headers, "origin-agent-cluster", "?1", override);
+      }
+      const dns = resolved.dnsPrefetchControl ?? true;
+      if (dns !== false) {
+        const allow = typeof dns === "object" ? dns.allow : false;
+        setUnlessPresent(headers, "x-dns-prefetch-control", allow ? "on" : "off", override);
+      }
+      if (resolved.downloadOptions ?? true) {
+        setUnlessPresent(headers, "x-download-options", "noopen", override);
+      }
+      setUnlessPresent(
+        headers,
+        "x-permitted-cross-domain-policies",
+        resolved.permittedCrossDomainPolicies ?? "none",
+        override,
+      );
+      if (resolved.xssProtection ?? true) {
+        setUnlessPresent(headers, "x-xss-protection", "0", override);
+      }
+
+      const poweredBy = resolved.poweredBy ?? true;
+      if (poweredBy === true) {
+        headers.delete("x-powered-by");
+      } else if (typeof poweredBy === "string") {
+        setUnlessPresent(headers, "x-powered-by", poweredBy, override);
+      }
+
+      if (resolved.contentSecurityPolicy !== undefined) {
+        const csp = cspEntry(resolved.contentSecurityPolicy);
+        setUnlessPresent(headers, csp.name, csp.value, override);
+      }
+      if (resolved.hsts !== undefined && resolved.hsts !== false) {
+        setUnlessPresent(headers, "strict-transport-security", hstsValue(resolved.hsts), override);
+      }
+      if (resolved.permissionsPolicy !== undefined) {
+        setUnlessPresent(headers, "permissions-policy", resolved.permissionsPolicy, override);
+      }
+      if (resolved.crossOriginOpenerPolicy !== undefined) {
+        setUnlessPresent(
+          headers,
+          "cross-origin-opener-policy",
+          resolved.crossOriginOpenerPolicy,
+          override,
+        );
+      }
+      if (resolved.crossOriginResourcePolicy !== undefined) {
+        setUnlessPresent(
+          headers,
+          "cross-origin-resource-policy",
+          resolved.crossOriginResourcePolicy,
+          override,
+        );
+      }
+      if (resolved.crossOriginEmbedderPolicy !== undefined) {
+        setUnlessPresent(
+          headers,
+          "cross-origin-embedder-policy",
+          resolved.crossOriginEmbedderPolicy,
+          override,
+        );
+      }
+    });
+  });
+
+  return isConfigSource(options) ? withConfigTable(def, options) : def;
 }

package/src/plugins/index.ts

@@ -27,6 +27,14 @@ export {
   type PasskeyOptions,
   type PasskeyStore,
 } from "./passkey.ts";
+export {
+  b64urlDecode,
+  b64urlEncode,
+  buildAuthenticatorData,
+  signWebAuthnAssertion,
+  verifyWebAuthnCeremony,
+  type WebAuthnVerifyOptions,
+} from "./passkey-webauthn.ts";
 export {
   createPhoneStore,
   phoneNumber,
@@ -35,11 +43,11 @@ export {
 } from "./phone-number.ts";
 export {
   defaultCspDirectives,
-  securityHeaders,
+  headers,
   type CspOptions,
+  type HeadersOptions,
   type HstsOptions,
-  type SecurityHeadersOptions,
-} from "./security-headers.ts";
+} from "./headers.ts";
 export {
   createTwoFactorStore,
   twoFactor,