mates-fullstack 1.0.0-beta.1

package/dist/sanitize.js

@@ -0,0 +1,193 @@
+/**
+ * mates-ssr — sanitize.ts
+ *
+ * Automatic XSS sanitization of parsed JSON request bodies.
+ *
+ * Runs after JSON.parse on every API route body and serverFn arg list.
+ * Walks the object tree and cleans every string value.
+ *
+ * No external dependencies — pure string operations.
+ *
+ * Rules:
+ *   - Only string values are touched
+ *   - Numbers, booleans, null, undefined pass through unchanged
+ *   - Objects and arrays are recursed into
+ *   - Fields in the skip list are never touched
+ *   - Circular references are safely handled
+ */
+// ─── Built-in fields that must never be sanitized ─────────────────────────────
+// Passwords must preserve all characters.
+// Tokens/secrets are cryptographic values.
+// Content/html/markdown fields contain intentional markup.
+const BUILTIN_SKIP = new Set([
+    "password",
+    "passwordConfirm",
+    "confirmPassword",
+    "currentPassword",
+    "newPassword",
+    "oldPassword",
+    "token",
+    "secret",
+    "apiKey",
+    "api_key",
+    "privateKey",
+    "private_key",
+    "accessToken",
+    "access_token",
+    "refreshToken",
+    "refresh_token",
+    "content",
+    "body",
+    "html",
+    "markdown",
+    "rawContent",
+    "raw_content",
+    "template",
+    "source",
+]);
+// ─── HTML detection ───────────────────────────────────────────────────────────
+// Matches opening and closing HTML tags including self-closing
+// e.g. <script>, </div>, <img src="x" onerror="xss">, <!-- comment -->
+const HTML_TAG_REGEX = /<\/?[a-zA-Z][^>]*>|<!--|-->/g;
+// Strict check — does the string contain any HTML tags at all?
+function containsHtml(value) {
+    // Reset lastIndex since we reuse a stateful regex
+    HTML_TAG_REGEX.lastIndex = 0;
+    return HTML_TAG_REGEX.test(value);
+}
+// ─── Sanitizers ───────────────────────────────────────────────────────────────
+/**
+ * Strip all HTML tags from a string.
+ * "<script>alert(1)</script>hello" → "hello"
+ * "<b>bold</b> and <i>italic</i>"  → "bold and italic"
+ */
+function stripHtml(value) {
+    return value.replace(/<\/?[a-zA-Z][^>]*>|<!--|-->/g, "");
+}
+/**
+ * Escape HTML special characters.
+ * Only escapes the five characters that are dangerous in HTML context.
+ * Does NOT mangle normal text — "O'Brien" stays "O&#39;Brien" when escaped,
+ * which round-trips correctly. Use this if you want to preserve the content
+ * but neutralize it for HTML output.
+ */
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+// ─── Core sanitizer ───────────────────────────────────────────────────────────
+export class SanitizeError extends Error {
+    status = 400;
+    code = "XSS_DETECTED";
+    field;
+    constructor(field) {
+        super(`HTML content is not allowed in field: "${field}"`);
+        this.name = "SanitizeError";
+        this.field = field;
+    }
+}
+/**
+ * Sanitize a single string value.
+ * Returns the cleaned string or throws SanitizeError in "reject" mode.
+ */
+export function sanitizeString(value, fieldName, mode) {
+    switch (mode) {
+        case "strip":
+            return stripHtml(value);
+        case "escape":
+            return escapeHtml(value);
+        case "reject":
+            if (containsHtml(value))
+                throw new SanitizeError(fieldName);
+            return value;
+    }
+}
+/**
+ * Recursively sanitize all string values in an object or array.
+ *
+ * @param input     The parsed JSON value (object, array, primitive)
+ * @param config    Sanitize configuration
+ * @param fieldName Current field path (for error messages)
+ * @param seen      WeakSet to detect circular references
+ * @returns         The sanitized value (mutates strings in place for objects)
+ */
+export function sanitizeBody(input, config, fieldName = "body", seen = new WeakSet()) {
+    if (!config.enabled)
+        return input;
+    // Primitives other than string — pass through unchanged
+    if (input === null || input === undefined)
+        return input;
+    if (typeof input === "number")
+        return input;
+    if (typeof input === "boolean")
+        return input;
+    // String — sanitize it
+    if (typeof input === "string") {
+        return sanitizeString(input, fieldName, config.mode);
+    }
+    // Array — recurse into each element
+    if (Array.isArray(input)) {
+        if (seen.has(input))
+            return input;
+        seen.add(input);
+        return input.map((item, i) => sanitizeBody(item, config, `${fieldName}[${i}]`, seen));
+    }
+    // Object — recurse into each value, respecting skip list
+    if (typeof input === "object") {
+        if (seen.has(input))
+            return input;
+        seen.add(input);
+        const skipSet = new Set([...BUILTIN_SKIP, ...config.skip]);
+        const result = {};
+        for (const [key, value] of Object.entries(input)) {
+            // Skip fields in the skip list — return value as-is
+            if (skipSet.has(key)) {
+                result[key] = value;
+            }
+            else {
+                result[key] = sanitizeBody(value, config, fieldName === "body" ? key : `${fieldName}.${key}`, seen);
+            }
+        }
+        return result;
+    }
+    // Anything else — pass through
+    return input;
+}
+/**
+ * Sanitize a WebSocket message.
+ * Parses JSON if the message is a string, sanitizes all string fields,
+ * and returns the cleaned object (or the original string if not JSON).
+ *
+ * @param msg     Raw WebSocket message (string or Buffer)
+ * @param config  Sanitize config
+ * @returns       { parsed: any, raw: string } — parsed is the sanitized object,
+ *                raw is the original string for pass-through if needed
+ */
+export function sanitizeWsMessage(msg, config) {
+    const raw = typeof msg === "string" ? msg : msg.toString("utf-8");
+    if (!config.enabled)
+        return { parsed: raw, raw, isJson: false };
+    // Try to parse as JSON
+    let parsed;
+    let isJson = false;
+    try {
+        parsed = JSON.parse(raw);
+        isJson = true;
+    }
+    catch {
+        // Not JSON — treat as plain string and sanitize it directly
+        return {
+            parsed: sanitizeString(raw, "message", config.mode),
+            raw,
+            isJson: false,
+        };
+    }
+    // JSON parsed — sanitize all string values
+    const sanitized = sanitizeBody(parsed, config, "message");
+    return { parsed: sanitized, raw, isJson: true };
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,iFAAiF;AACjF,0CAA0C;AAC1C,2CAA2C;AAC3C,2DAA2D;AAE3D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,UAAU;IACV,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,aAAa;IACb,aAAa;IACb,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,SAAS;IACT,MAAM;IACN,MAAM;IACN,UAAU;IACV,YAAY;IACZ,aAAa;IACb,UAAU;IACV,QAAQ;CACT,CAAC,CAAC;AAUH,iFAAiF;AAEjF,+DAA+D;AAC/D,uEAAuE;AACvE,MAAM,cAAc,GAAG,8BAA8B,CAAC;AAEtD,+DAA+D;AAC/D,SAAS,YAAY,CAAC,KAAa;IACjC,kDAAkD;IAClD,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7B,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,iFAAiF;AAEjF,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,MAAM,GAAG,GAAG,CAAC;IACb,IAAI,GAAG,cAAc,CAAC;IACtB,KAAK,CAAS;IAEvB,YAAY,KAAa;QACvB,KAAK,CAAC,0CAA0C,KAAK,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,SAAiB,EACjB,IAAkB;IAElB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1B,KAAK,QAAQ;YACX,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;QAC3B,KAAK,QAAQ;YACX,IAAI,YAAY,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;YAC5D,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAc,EACd,MAAsB,EACtB,SAAS,GAAG,MAAM,EAClB,OAAO,IAAI,OAAO,EAAU;IAE5B,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAElC,wDAAwD;IACxD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7C,uBAAuB;IACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,oCAAoC;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAC3B,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CACvD,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;QAE1B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,MAAM,MAAM,GAA4B,EAAE,CAAC;QAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CACvC,KAAgC,CACjC,EAAE,CAAC;YACF,oDAAoD;YACpD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CACxB,KAAK,EACL,MAAM,EACN,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,GAAG,EAAE,EAClD,IAAI,CACL,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,+BAA+B;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAoB,EACpB,MAAsB;IAEtB,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAElE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAEhE,uBAAuB;IACvB,IAAI,MAAe,CAAC;IACpB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,OAAO;YACL,MAAM,EAAE,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC;YACnD,GAAG;YACH,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClD,CAAC"}

package/dist/security-headers.d.ts

@@ -0,0 +1,114 @@
+/**
+ * mates-fullstack — security-headers.ts
+ *
+ * Sets all standard security response headers in one call.
+ * Every header is on by default and individually overridable or disableable.
+ *
+ * Covers the full helmet header set plus Permissions-Policy.
+ */
+export interface SecurityHeadersOptions {
+    /**
+     * Strict-Transport-Security.
+     * Default in production: "max-age=31536000; includeSubDomains".
+     * Disabled in development by default.
+     * Set to false to always omit.
+     */
+    hsts?: string | false;
+    /**
+     * X-Frame-Options — controls whether the page can be embedded in an iframe.
+     * Default: "SAMEORIGIN". Set to false to omit.
+     */
+    xFrameOptions?: "DENY" | "SAMEORIGIN" | false;
+    /**
+     * Cross-Origin-Opener-Policy — isolates the browsing context group.
+     * Default: "same-origin". Set to false to omit.
+     */
+    crossOriginOpenerPolicy?: string | false;
+    /**
+     * Cross-Origin-Embedder-Policy — requires resources to opt in to being loaded.
+     * Needed for SharedArrayBuffer / high-res timers.
+     * Default: "require-corp". Set to false or "unsafe-none" to disable.
+     *
+     * Note: "require-corp" will block third-party resources (CDN fonts, images, etc.)
+     * that do not send CORP or CORS headers. Set to false if your app loads
+     * resources from external origins without CORS headers.
+     */
+    crossOriginEmbedderPolicy?: string | false;
+    /**
+     * Cross-Origin-Resource-Policy — prevents other origins from loading your resources.
+     * Default: "same-origin". Set to false to omit.
+     */
+    crossOriginResourcePolicy?: string | false;
+    /**
+     * X-Content-Type-Options: nosniff — prevents MIME-type sniffing.
+     * Default: true.
+     */
+    xContentTypeOptions?: boolean;
+    /**
+     * X-XSS-Protection: 0 — explicitly disables the legacy XSS filter.
+     * Disabling it is the modern recommendation (the filter can introduce vulnerabilities).
+     * Default: true (sends "0").
+     */
+    xXssProtection?: boolean;
+    /**
+     * Referrer-Policy.
+     * Default: "no-referrer". Set to false to omit.
+     */
+    referrerPolicy?: string | false;
+    /**
+     * X-DNS-Prefetch-Control — disables browser DNS prefetching.
+     * Default: "off". Set to false to omit.
+     */
+    xDnsPrefetchControl?: "on" | "off" | false;
+    /**
+     * X-Permitted-Cross-Domain-Policies — disallows Adobe Flash/Acrobat cross-domain requests.
+     * Default: "none". Set to false to omit.
+     */
+    xPermittedCrossDomainPolicies?: string | false;
+    /**
+     * X-Download-Options: noopen — prevents IE from executing downloads in site context.
+     * Default: true. Set to false to omit.
+     */
+    xDownloadOptions?: boolean;
+    /**
+     * Origin-Agent-Cluster: ?1 — hints the browser to isolate this origin in its own agent cluster.
+     * Default: true. Set to false to omit.
+     */
+    originAgentCluster?: boolean;
+    /**
+     * Content-Security-Policy.
+     * Not set by default — CSP is highly application-specific.
+     * Set to false to explicitly omit.
+     */
+    contentSecurityPolicy?: string | false;
+    /**
+     * Permissions-Policy (formerly Feature-Policy).
+     * Not set by default — policy is application-specific.
+     * Set to false to explicitly omit.
+     */
+    permissionsPolicy?: string | false;
+}
+/**
+ * Register all standard security headers on every response.
+ *
+ * Call once at module level in server/main.ts.
+ * Every header has a safe default — pass options to override or disable individual headers.
+ *
+ * @example
+ * // All defaults
+ * useSecurityHeaders();
+ *
+ * // Custom CSP + preload HSTS
+ * useSecurityHeaders({
+ *   contentSecurityPolicy: "default-src 'self'",
+ *   hsts: "max-age=63072000; includeSubDomains; preload",
+ * });
+ *
+ * // Disable COEP for apps that load cross-origin resources without CORS headers
+ * useSecurityHeaders({ crossOriginEmbedderPolicy: false });
+ *
+ * // Disable a header entirely
+ * useSecurityHeaders({ xFrameOptions: false });
+ */
+export declare function useSecurityHeaders(options?: SecurityHeadersOptions): void;
+//# sourceMappingURL=security-headers.d.ts.map

package/dist/security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../src/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,WAAW,sBAAsB;IAGrC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAItB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,KAAK,CAAC;IAE9C;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAEzC;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAE3C;;;OAGG;IACH,yBAAyB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAI3C;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAIzB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAEhC;;;OAGG;IACH,mBAAmB,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,KAAK,CAAC;IAI3C;;;OAGG;IACH,6BAA6B,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAE/C;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAI7B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAEvC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,sBAA2B,GAAG,IAAI,CA+G7E"}

package/dist/security-headers.js

@@ -0,0 +1,121 @@
+/**
+ * mates-fullstack — security-headers.ts
+ *
+ * Sets all standard security response headers in one call.
+ * Every header is on by default and individually overridable or disableable.
+ *
+ * Covers the full helmet header set plus Permissions-Policy.
+ */
+import { onRequest } from "./middleware.js";
+/**
+ * Register all standard security headers on every response.
+ *
+ * Call once at module level in server/main.ts.
+ * Every header has a safe default — pass options to override or disable individual headers.
+ *
+ * @example
+ * // All defaults
+ * useSecurityHeaders();
+ *
+ * // Custom CSP + preload HSTS
+ * useSecurityHeaders({
+ *   contentSecurityPolicy: "default-src 'self'",
+ *   hsts: "max-age=63072000; includeSubDomains; preload",
+ * });
+ *
+ * // Disable COEP for apps that load cross-origin resources without CORS headers
+ * useSecurityHeaders({ crossOriginEmbedderPolicy: false });
+ *
+ * // Disable a header entirely
+ * useSecurityHeaders({ xFrameOptions: false });
+ */
+export function useSecurityHeaders(options = {}) {
+    const isProd = process.env.NODE_ENV === "production";
+    const resolved = {};
+    // X-Content-Type-Options
+    if (options.xContentTypeOptions !== false) {
+        resolved["x-content-type-options"] = "nosniff";
+    }
+    // X-Frame-Options
+    const xFrame = options.xFrameOptions !== undefined ? options.xFrameOptions : "SAMEORIGIN";
+    if (xFrame !== false) {
+        resolved["x-frame-options"] = xFrame;
+    }
+    // X-XSS-Protection: 0 (disable the legacy filter)
+    if (options.xXssProtection !== false) {
+        resolved["x-xss-protection"] = "0";
+    }
+    // X-DNS-Prefetch-Control
+    const dns = options.xDnsPrefetchControl !== undefined
+        ? options.xDnsPrefetchControl
+        : "off";
+    if (dns !== false) {
+        resolved["x-dns-prefetch-control"] = dns;
+    }
+    // X-Download-Options
+    if (options.xDownloadOptions !== false) {
+        resolved["x-download-options"] = "noopen";
+    }
+    // X-Permitted-Cross-Domain-Policies
+    const xPdp = options.xPermittedCrossDomainPolicies !== undefined
+        ? options.xPermittedCrossDomainPolicies
+        : "none";
+    if (xPdp !== false) {
+        resolved["x-permitted-cross-domain-policies"] = xPdp;
+    }
+    // Referrer-Policy
+    const referrer = options.referrerPolicy !== undefined
+        ? options.referrerPolicy
+        : "no-referrer";
+    if (referrer !== false) {
+        resolved["referrer-policy"] = referrer;
+    }
+    // Strict-Transport-Security — production only by default
+    const hsts = options.hsts !== undefined
+        ? options.hsts
+        : isProd
+            ? "max-age=31536000; includeSubDomains"
+            : false;
+    if (hsts !== false) {
+        resolved["strict-transport-security"] = hsts;
+    }
+    // Origin-Agent-Cluster
+    if (options.originAgentCluster !== false) {
+        resolved["origin-agent-cluster"] = "?1";
+    }
+    // Cross-Origin-Opener-Policy
+    const coop = options.crossOriginOpenerPolicy !== undefined
+        ? options.crossOriginOpenerPolicy
+        : "same-origin";
+    if (coop !== false) {
+        resolved["cross-origin-opener-policy"] = coop;
+    }
+    // Cross-Origin-Embedder-Policy
+    const coep = options.crossOriginEmbedderPolicy !== undefined
+        ? options.crossOriginEmbedderPolicy
+        : "require-corp";
+    if (coep !== false) {
+        resolved["cross-origin-embedder-policy"] = coep;
+    }
+    // Cross-Origin-Resource-Policy
+    const corp = options.crossOriginResourcePolicy !== undefined
+        ? options.crossOriginResourcePolicy
+        : "same-origin";
+    if (corp !== false) {
+        resolved["cross-origin-resource-policy"] = corp;
+    }
+    // Content-Security-Policy (opt-in — too app-specific for a default)
+    if (options.contentSecurityPolicy) {
+        resolved["content-security-policy"] = options.contentSecurityPolicy;
+    }
+    // Permissions-Policy (opt-in — too app-specific for a default)
+    if (options.permissionsPolicy) {
+        resolved["permissions-policy"] = options.permissionsPolicy;
+    }
+    onRequest((c) => {
+        for (const [key, value] of Object.entries(resolved)) {
+            c.resHeaders[key] = value;
+        }
+    });
+}
+//# sourceMappingURL=security-headers.js.map

package/dist/security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../src/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AA8G5C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkC,EAAE;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IACrD,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,yBAAyB;IACzB,IAAI,OAAO,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;QAC1C,QAAQ,CAAC,wBAAwB,CAAC,GAAG,SAAS,CAAC;IACjD,CAAC;IAED,kBAAkB;IAClB,MAAM,MAAM,GACV,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7E,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,QAAQ,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC;IACvC,CAAC;IAED,kDAAkD;IAClD,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACrC,QAAQ,CAAC,kBAAkB,CAAC,GAAG,GAAG,CAAC;IACrC,CAAC;IAED,yBAAyB;IACzB,MAAM,GAAG,GACP,OAAO,CAAC,mBAAmB,KAAK,SAAS;QACvC,CAAC,CAAC,OAAO,CAAC,mBAAmB;QAC7B,CAAC,CAAC,KAAK,CAAC;IACZ,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,QAAQ,CAAC,wBAAwB,CAAC,GAAG,GAAG,CAAC;IAC3C,CAAC;IAED,qBAAqB;IACrB,IAAI,OAAO,CAAC,gBAAgB,KAAK,KAAK,EAAE,CAAC;QACvC,QAAQ,CAAC,oBAAoB,CAAC,GAAG,QAAQ,CAAC;IAC5C,CAAC;IAED,oCAAoC;IACpC,MAAM,IAAI,GACR,OAAO,CAAC,6BAA6B,KAAK,SAAS;QACjD,CAAC,CAAC,OAAO,CAAC,6BAA6B;QACvC,CAAC,CAAC,MAAM,CAAC;IACb,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,QAAQ,CAAC,mCAAmC,CAAC,GAAG,IAAI,CAAC;IACvD,CAAC;IAED,kBAAkB;IAClB,MAAM,QAAQ,GACZ,OAAO,CAAC,cAAc,KAAK,SAAS;QAClC,CAAC,CAAC,OAAO,CAAC,cAAc;QACxB,CAAC,CAAC,aAAa,CAAC;IACpB,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,QAAQ,CAAC,iBAAiB,CAAC,GAAG,QAAQ,CAAC;IACzC,CAAC;IAED,yDAAyD;IACzD,MAAM,IAAI,GACR,OAAO,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,CAAC,OAAO,CAAC,IAAI;QACd,CAAC,CAAC,MAAM;YACN,CAAC,CAAC,qCAAqC;YACvC,CAAC,CAAC,KAAK,CAAC;IACd,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,QAAQ,CAAC,2BAA2B,CAAC,GAAG,IAAI,CAAC;IAC/C,CAAC;IAED,uBAAuB;IACvB,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;QACzC,QAAQ,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC;IAC1C,CAAC;IAED,6BAA6B;IAC7B,MAAM,IAAI,GACR,OAAO,CAAC,uBAAuB,KAAK,SAAS;QAC3C,CAAC,CAAC,OAAO,CAAC,uBAAuB;QACjC,CAAC,CAAC,aAAa,CAAC;IACpB,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,QAAQ,CAAC,4BAA4B,CAAC,GAAG,IAAI,CAAC;IAChD,CAAC;IAED,+BAA+B;IAC/B,MAAM,IAAI,GACR,OAAO,CAAC,yBAAyB,KAAK,SAAS;QAC7C,CAAC,CAAC,OAAO,CAAC,yBAAyB;QACnC,CAAC,CAAC,cAAc,CAAC;IACrB,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,QAAQ,CAAC,8BAA8B,CAAC,GAAG,IAAI,CAAC;IAClD,CAAC;IAED,+BAA+B;IAC/B,MAAM,IAAI,GACR,OAAO,CAAC,yBAAyB,KAAK,SAAS;QAC7C,CAAC,CAAC,OAAO,CAAC,yBAAyB;QACnC,CAAC,CAAC,aAAa,CAAC;IACpB,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,QAAQ,CAAC,8BAA8B,CAAC,GAAG,IAAI,CAAC;IAClD,CAAC;IAED,oEAAoE;IACpE,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;QAClC,QAAQ,CAAC,yBAAyB,CAAC,GAAG,OAAO,CAAC,qBAAqB,CAAC;IACtE,CAAC;IAED,+DAA+D;IAC/D,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,QAAQ,CAAC,oBAAoB,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAC7D,CAAC;IAED,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;QACd,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}