Ship file viewer, editor improvements, and private package releases

packages/core/test/framing.test.ts

@@ -0,0 +1,21 @@
+import { expect, test } from "bun:test";
+import { withSecurityHeaders } from "../src/headers.ts";
+test("default framing permits self but not cross-origin ancestors", () => {
+  const headers = withSecurityHeaders(
+    new Request("https://app.test"),
+    new Response("ok"),
+    "production",
+  ).headers;
+  expect(headers.get("x-frame-options")).toBe("SAMEORIGIN");
+  expect(headers.get("content-security-policy")).toContain("frame-ancestors 'self'");
+});
+test("explicit DENY keeps both framing policies restrictive", () => {
+  const headers = withSecurityHeaders(
+    new Request("https://app.test"),
+    new Response("ok"),
+    "production",
+    { frameOptions: "DENY" },
+  ).headers;
+  expect(headers.get("x-frame-options")).toBe("DENY");
+  expect(headers.get("content-security-policy")).toContain("frame-ancestors 'none'");
+});