Jakob Wennberg
ec27228a8e
Em dashes (—) and en dashes (–) had spread across comments, docs, tests, and a few UI strings, reading as AI-generated boilerplate rather than house style. Replaced each with punctuation matching its context: colon for explanatory clauses, comma for asides, plain hyphen for numeric/legal ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for paired-dash asides. messages/en.json and messages/sv.json were fixed by hand together to keep sv/en in sync. Left untouched where the dash is the functional subject rather than decorative punctuation: date-range-parser.ts's separator regex, charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the agent system-prompt files that already instruct against em dashes, and a golden iXBRL test fixture compared byte-for-byte. Also fixes two bugs surfaced along the way: an off-by-one in ApiKeysPanel's scope-label split (a leftover from an earlier partial pass), and a charset-repair test that had lost the literal en-dash it exists to verify. Regenerated the agent atom seed migration (skills:generate) since 27 SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes, with an explicit carve-out for the functional-dash cases above. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
57 lines
2.5 KiB
TypeScript
57 lines
2.5 KiB
TypeScript
/**
|
|
* Common security headers for public v1 responses.
|
|
*
|
|
* Applied to discovery routes (`/llms.txt`, `/.well-known/skills/index.json`,
|
|
* `/api/v1/openapi.json`) that bypass the auth wrapper.
|
|
*
|
|
* The wrapped routes don't need these explicitly: NextResponse's defaults +
|
|
* the auth wrapper's stamping cover them. Public routes are an exception
|
|
* because they're plain `NextResponse.json/text` returns with caching.
|
|
*
|
|
* X-Content-Type-Options: nosniff : block MIME sniffing on text/json
|
|
* Referrer-Policy: strict-origin...: limit referrer leakage if a link is
|
|
* embedded somewhere unexpected
|
|
* X-Frame-Options: DENY : discovery surfaces should never
|
|
* legitimately render in a frame
|
|
*/
|
|
|
|
/**
|
|
* Headers applied to BOTH public discovery routes and authenticated v1
|
|
* responses. Includes CSP, HSTS, and frame/sniff/referrer protections, but
|
|
* NOT X-Robots-Tag: discovery routes (llms.txt, skills index, OpenAPI)
|
|
* exist to be crawled by AI agents; authenticated routes get an additional
|
|
* X-Robots-Tag at the wrapper level via WRAPPED_RESPONSE_NOAI_HEADERS.
|
|
*/
|
|
export const PUBLIC_SECURITY_HEADERS: Record<string, string> = {
|
|
'X-Content-Type-Options': 'nosniff',
|
|
'Referrer-Policy': 'strict-origin-when-cross-origin',
|
|
'X-Frame-Options': 'DENY',
|
|
// Discovery routes return JSON or plain text: no script, style, image, or
|
|
// form contexts. `default-src 'none'` is the strictest possible CSP and
|
|
// costs nothing here.
|
|
'Content-Security-Policy': "default-src 'none'; frame-ancestors 'none'",
|
|
// HSTS: every Accounted deployment is HTTPS-only. 1 year is the standard
|
|
// production value; includeSubDomains because the apex serves everything.
|
|
'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
|
|
}
|
|
|
|
/**
|
|
* Additional headers applied ONLY to authenticated v1 responses. AI bots
|
|
* that respect X-Robots-Tag (Claude, ChatGPT, Perplexity, Google-Extended)
|
|
* will skip these payloads for training; others will ignore the hint.
|
|
* Public discovery routes deliberately omit this so they remain
|
|
* AI-discoverable.
|
|
*/
|
|
export const WRAPPED_RESPONSE_HEADERS: Record<string, string> = {
|
|
...PUBLIC_SECURITY_HEADERS,
|
|
'X-Robots-Tag': 'noai, noimageai',
|
|
}
|
|
|
|
/**
|
|
* Merge the public security headers onto an arbitrary header dict so callers
|
|
* can keep their own Content-Type / Cache-Control entries.
|
|
*/
|
|
export function withPublicSecurityHeaders(extra: Record<string, string> = {}): Record<string, string> {
|
|
return { ...PUBLIC_SECURITY_HEADERS, ...extra }
|
|
}
|