Danijel Martinek
96274ba856
Adds framework-agnostic security headers module to core-shared/security: - SecurityHeadersConfig + CspMode types - generateNonce() using crypto.randomBytes(16) - buildSecurityHeaders() emitting all six headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CSP) with prod (strict-dynamic + nonce threading) and dev (unsafe-inline/eval + ws/localhost) CSP modes; URL validation throwing InvalidSecurityHeadersConfig on malformed allowedConnect/Img/FontOrigins - Full unit test suite (24 tests, 100% coverage on runtime files) - Exported from core-shared barrel and ./security subpath Blocks story 07 (framework adapters) and stories 08-09 (app wiring). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
8 lines
240 B
TypeScript
8 lines
240 B
TypeScript
export { requireEnv } from "./lib/env";
|
|
export { toIsoString } from "./lib/date";
|
|
export * from "./audit";
|
|
export * from "./di";
|
|
export * from "./instrumentation/index";
|
|
export * from "./rate-limit/index";
|
|
export * from "./security/index";
|