@capixjs/plugin-helmet 0.1.0-alpha.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Capix Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,53 @@
+# @capixjs/plugin-helmet
+
+Security headers plugin for Capix. Sets Content-Security-Policy, X-Frame-Options, and other protective headers on all responses.
+
+## Install
+
+```bash
+npm install @capixjs/plugin-helmet
+```
+
+## Usage
+
+```ts
+import { createServer } from '@capixjs/core';
+import { restTransport } from '@capixjs/transport-rest';
+import { helmetPlugin } from '@capixjs/plugin-helmet';
+
+createServer({
+  capabilities: { ... },
+  plugins: [helmetPlugin()],
+  transports: [restTransport({ port: 3000 })],
+}).start();
+```
+
+## Default headers
+
+| Header | Default value |
+|---|---|
+| `Content-Security-Policy` | `default-src 'self'` |
+| `X-Frame-Options` | `DENY` |
+| `X-Content-Type-Options` | `nosniff` |
+| `Referrer-Policy` | `no-referrer` |
+| `X-Download-Options` | `noopen` |
+| `X-DNS-Prefetch-Control` | `off` |
+| `X-Permitted-Cross-Domain-Policies` | `none` |
+
+## Options
+
+```ts
+helmetPlugin({
+  // Override or disable individual headers
+  contentSecurityPolicy: "default-src 'self'; img-src *",
+  contentSecurityPolicy: false,  // disable this header
+  frameOptions: 'SAMEORIGIN',
+  frameOptions: false,           // disable X-Frame-Options
+})
+```
+
+Passing `false` for any option omits that header entirely.
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,29 @@
+import type { RestTransportOptions } from '@capixjs/transport-rest';
+export type HelmetOptions = {
+    /** Content-Security-Policy value (false to disable) */
+    readonly contentSecurityPolicy?: string | false;
+    /** X-Frame-Options value (false to disable, default: SAMEORIGIN) */
+    readonly frameOptions?: 'DENY' | 'SAMEORIGIN' | false;
+    /** Strict-Transport-Security value (false to disable) */
+    readonly hsts?: string | false;
+    /** X-Content-Type-Options (false to disable, default: nosniff) */
+    readonly noSniff?: boolean;
+    /** Referrer-Policy value (false to disable) */
+    readonly referrerPolicy?: string | false;
+    /** Permissions-Policy value (false to disable) */
+    readonly permissionsPolicy?: string | false;
+};
+/**
+ * Returns RestTransportOptions hooks that set common security headers.
+ * Merge the returned object with your restTransport options.
+ *
+ * @example
+ * restTransport({ port: 3000, ...helmet() })
+ */
+export declare function helmet(options?: HelmetOptions): Pick<RestTransportOptions, 'hooks'>;
+/**
+ * Merges multiple RestTransportOptions hook sets into one.
+ * Use when combining cors() + helmet() hooks.
+ */
+export declare function mergeHooks(...hookSets: Array<Pick<RestTransportOptions, 'hooks'>>): Pick<RestTransportOptions, 'hooks'>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,MAAM,MAAM,aAAa,GAAG;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAChD,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,KAAK,CAAC;IACtD,yDAAyD;IACzD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACzC,kDAAkD;IAClD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CAC7C,CAAC;AAWF;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,OAAO,GAAE,aAAkB,GAAG,IAAI,CAAC,oBAAoB,EAAE,OAAO,CAAC,CA2BvF;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,GAAG,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,GACtD,IAAI,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAarC"}

package/dist/index.js

@@ -0,0 +1,62 @@
+const DEFAULTS = {
+    contentSecurityPolicy: "default-src 'self'",
+    frameOptions: 'SAMEORIGIN',
+    hsts: 'max-age=31536000; includeSubDomains',
+    noSniff: true,
+    referrerPolicy: 'no-referrer',
+    permissionsPolicy: false,
+};
+/**
+ * Returns RestTransportOptions hooks that set common security headers.
+ * Merge the returned object with your restTransport options.
+ *
+ * @example
+ * restTransport({ port: 3000, ...helmet() })
+ */
+export function helmet(options = {}) {
+    const merged = { ...DEFAULTS, ...options };
+    return {
+        hooks: {
+            onRequest: (_req, res) => {
+                if (merged.contentSecurityPolicy !== false) {
+                    res.setHeader('Content-Security-Policy', merged.contentSecurityPolicy);
+                }
+                if (merged.frameOptions !== false) {
+                    res.setHeader('X-Frame-Options', merged.frameOptions);
+                }
+                if (merged.hsts !== false) {
+                    res.setHeader('Strict-Transport-Security', merged.hsts);
+                }
+                if (merged.noSniff) {
+                    res.setHeader('X-Content-Type-Options', 'nosniff');
+                }
+                if (merged.referrerPolicy !== false) {
+                    res.setHeader('Referrer-Policy', merged.referrerPolicy);
+                }
+                if (merged.permissionsPolicy !== false) {
+                    res.setHeader('Permissions-Policy', merged.permissionsPolicy);
+                }
+            },
+        },
+    };
+}
+/**
+ * Merges multiple RestTransportOptions hook sets into one.
+ * Use when combining cors() + helmet() hooks.
+ */
+export function mergeHooks(...hookSets) {
+    const fns = hookSets
+        .map((h) => h.hooks?.onRequest)
+        .filter((fn) => fn !== undefined);
+    if (fns.length === 0)
+        return {};
+    return {
+        hooks: {
+            onRequest: (req, res) => {
+                for (const fn of fns)
+                    fn(req, res);
+            },
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAkBA,MAAM,QAAQ,GAA4B;IACxC,qBAAqB,EAAE,oBAAoB;IAC3C,YAAY,EAAE,YAAY;IAC1B,IAAI,EAAE,qCAAqC;IAC3C,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,aAAa;IAC7B,iBAAiB,EAAE,KAAK;CACzB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CAAC,UAAyB,EAAE;IAChD,MAAM,MAAM,GAA4B,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;IAEpE,OAAO;QACL,KAAK,EAAE;YACL,SAAS,EAAE,CAAC,IAAI,EAAE,GAAmB,EAAE,EAAE;gBACvC,IAAI,MAAM,CAAC,qBAAqB,KAAK,KAAK,EAAE,CAAC;oBAC3C,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;gBACzE,CAAC;gBACD,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;oBAClC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;gBACxD,CAAC;gBACD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBAC1B,GAAG,CAAC,SAAS,CAAC,2BAA2B,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC1D,CAAC;gBACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;gBACrD,CAAC;gBACD,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;oBACpC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC1D,CAAC;gBACD,IAAI,MAAM,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;oBACvC,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,GAAG,QAAoD;IAEvD,MAAM,GAAG,GAAG,QAAQ;SACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC;SAC9B,MAAM,CAAC,CAAC,EAAE,EAAgC,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IAElE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO;QACL,KAAK,EAAE;YACL,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACtB,KAAK,MAAM,EAAE,IAAI,GAAG;oBAAE,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrC,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@capixjs/plugin-helmet",
+  "version": "0.1.0-alpha.1",
+  "description": "Security headers plugin for Capix",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "LICENSE"
+  ],
+  "keywords": [
+    "capix",
+    "helmet",
+    "security",
+    "headers",
+    "csp",
+    "plugin",
+    "typescript"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit"
+  },
+  "peerDependencies": {
+    "@capixjs/transport-rest": ">=0.1.0-0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.5.0",
+    "@capixjs/transport-rest": "workspace:*"
+  }
+}