feat: release design system engine, studio and component contracts

packages/core/test/public-image-policy.test.ts

@@ -1,10 +1,29 @@
-import {expect,test} from "bun:test";
-import {withSecurityHeaders} from "../src/headers.ts";
-test("explicit response resource policies survive defaults while configured application policy wins",()=>{
-  const req=new Request("https://example.com/image.png");
-  const image=()=>new Response("image",{headers:{"Cross-Origin-Resource-Policy":"cross-origin","Content-Type":"image/png"}});
-  expect(withSecurityHeaders(req,image(),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("cross-origin");
-  expect(withSecurityHeaders(req,new Response("private"),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
-  expect(withSecurityHeaders(req,image(),"production",{crossOriginResourcePolicy:"same-origin"}).headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
-  expect(withSecurityHeaders(req,new Response("x",{headers:{"Cross-Origin-Resource-Policy":"invalid"}}),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
+import { expect, test } from "bun:test";
+import { withSecurityHeaders } from "../src/headers.ts";
+test("explicit response resource policies survive defaults while configured application policy wins", () => {
+  const req = new Request("https://example.com/image.png");
+  const image = () =>
+    new Response("image", {
+      headers: { "Cross-Origin-Resource-Policy": "cross-origin", "Content-Type": "image/png" },
+    });
+  expect(
+    withSecurityHeaders(req, image(), "production").headers.get("Cross-Origin-Resource-Policy"),
+  ).toBe("cross-origin");
+  expect(
+    withSecurityHeaders(req, new Response("private"), "production").headers.get(
+      "Cross-Origin-Resource-Policy",
+    ),
+  ).toBe("same-origin");
+  expect(
+    withSecurityHeaders(req, image(), "production", {
+      crossOriginResourcePolicy: "same-origin",
+    }).headers.get("Cross-Origin-Resource-Policy"),
+  ).toBe("same-origin");
+  expect(
+    withSecurityHeaders(
+      req,
+      new Response("x", { headers: { "Cross-Origin-Resource-Policy": "invalid" } }),
+      "production",
+    ).headers.get("Cross-Origin-Resource-Policy"),
+  ).toBe("same-origin");
 });