feat: initial commit - Jhonny Editor

- Adicionado estrutura completa do projeto
- Configurado MCP server para Premiere Pro
- Adicionado documentação e skills
- Configurado Gitignore para o projeto

code/src/http-security.ts

@@ -0,0 +1,48 @@
+import type http from "node:http";
+
+export interface HttpSecurityHeaderOptions {
+  scriptNonce?: string;
+}
+
+export function buildContentSecurityPolicy(options: HttpSecurityHeaderOptions = {}): string {
+  const scriptSource = [
+    "'self'",
+    ...(options.scriptNonce ? [`'nonce-${options.scriptNonce}'`] : []),
+    "https://www.googletagmanager.com",
+  ].join(" ");
+
+  return [
+    "default-src 'self'",
+    "base-uri 'self'",
+    "frame-ancestors 'none'",
+    "object-src 'none'",
+    "form-action 'self'",
+    "img-src 'self' data: https:",
+    "media-src 'self'",
+    "font-src 'self'",
+    "style-src 'self' 'unsafe-inline'",
+    `script-src ${scriptSource}`,
+    "connect-src 'self' https://www.google.com https://www.google-analytics.com https://www.googletagmanager.com https://us.i.posthog.com https://*.posthog.com",
+    "upgrade-insecure-requests",
+  ].join("; ");
+}
+
+export const HTTP_SECURITY_HEADERS = Object.freeze({
+  "Content-Security-Policy": buildContentSecurityPolicy(),
+  "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "strict-origin-when-cross-origin",
+  "Permissions-Policy": "camera=(), microphone=(), geolocation=()",
+  "Cross-Origin-Opener-Policy": "same-origin",
+});
+
+export function applyHttpSecurityHeaders(res: http.ServerResponse, options: HttpSecurityHeaderOptions = {}): void {
+  const headers = {
+    ...HTTP_SECURITY_HEADERS,
+    "Content-Security-Policy": buildContentSecurityPolicy(options),
+  };
+  for (const [name, value] of Object.entries(headers)) {
+    res.setHeader(name, value);
+  }
+}