export function securityHeaders(): Record<string, string> {
  return {
    "x-content-type-options": "nosniff",
    "referrer-policy": "no-referrer",
  };
}

export function json(data: unknown, status = 200, headers: Record<string, string> = {}): Response {
  return new Response(JSON.stringify(data), {
    status,
    headers: { "content-type": "application/json; charset=utf-8", ...securityHeaders(), ...headers },
  });
}

export function jsonError(status: number, message: string): Response {
  return json({ error: message }, status);
}

export function notFound(): Response {
  return jsonError(404, "not found");
}