two-stroke 5.8.0 → 6.0.0

package/package.json

@@ -52,7 +52,7 @@
   "name": "two-stroke",
   "packageManager": "yarn@4.6.0",
   "type": "module",
-  "version": "5.8.0",
+  "version": "6.0.0",
   "devDependencies": {
     "@types/eslint": "^9.6.1",
     "eslint": "^9.33.0",

package/src/index.ts

@@ -1,9 +1,9 @@
 import { verify as jwkVerify } from "jwk-subtle";
 import { verify as pbkdfVerify } from "pbkdf-subtle";
 import { Toucan } from "toucan-js";
-import { ZodSafeParseResult, ZodObject, z, ZodType } from "zod/v4";
+import { type ZodSafeParseResult, ZodObject, z, ZodType } from "zod/v4";
 import { openAPI } from "./open-api";
-import { Env, Handler, Route } from "./types";
+import { type Env, type Handler, type Route } from "./types";
 
 // eslint-disable-next-line @typescript-eslint/require-await
 const noAuth = async () => null;
@@ -196,6 +196,10 @@ export function twoStroke<T extends Env>(
             Object.entries({
               ...defaultHeaders,
               "Content-Type": "application/json",
+              "Strict-Transport-Security":
+                "max-age=15552000; includeSubDomains",
+              "X-Content-Type-Options": "nosniff",
+              "Content-Security-Policy": "default-src 'self'",
             }).forEach(([k, v]) => {
               if (!responseWithHeaders.headers.has(k))
                 responseWithHeaders.headers.set(k, v);

package/src/open-api.ts

@@ -1,5 +1,5 @@
 import { z, ZodType } from "zod/v4";
-import { Env, Route } from "./types";
+import { type Env, type Route } from "./types";
 
 export const openAPI =
   <T extends Env, A>(

package/src/test.ts

@@ -1,4 +1,4 @@
-import { JWTPayload, SignJWT, exportJWK, generateKeyPair } from "jose";
+import { type JWTPayload, SignJWT, exportJWK, generateKeyPair } from "jose";
 import { fetchMock, SELF, env } from "cloudflare:test";
 import createClient from "openapi-fetch";