@holo-js/security 0.3.20 → 0.3.22

package/dist/{chunk-CTRTL4CO.mjs → chunk-F32JK536.mjs}

@@ -8,7 +8,7 @@ import {
   SECURITY_CLIENT_CONFIG_COOKIE,
   createSecurityClientConfig,
   serializeSecurityClientConfig
-} from "./chunk-FUOZWKHK.mjs";
+} from "./chunk-PC2YCWDH.mjs";
 
 // src/cookie-issuance.ts
 async function prepareCsrfCookies(request, getCookie) {

package/dist/{chunk-FUOZWKHK.mjs → chunk-PC2YCWDH.mjs}

@@ -38,15 +38,15 @@ function createSecurityClientConfig(config) {
   return Object.freeze({
     csrf: Object.freeze({
       field: config.csrf.field,
-      cookie: config.csrf.cookie
+      cookie: config.csrf.cookie,
+      header: config.csrf.header
     })
   });
 }
 function serializeSecurityClientConfig(config) {
   return JSON.stringify(config);
 }
-function readSecurityClientConfigFromCookies(cookieHeader) {
-  const raw = parseCookieHeader(cookieHeader)[SECURITY_CLIENT_CONFIG_COOKIE];
+function parseSecurityClientConfig(raw) {
   if (!raw) {
     return void 0;
   }
@@ -55,18 +55,31 @@ function readSecurityClientConfigFromCookies(cookieHeader) {
     if (!isSecurityClientConfig(parsed)) {
       return void 0;
     }
-    return Object.freeze({
-      csrf: Object.freeze({
-        field: parsed.csrf.field,
-        cookie: parsed.csrf.cookie
-      })
-    });
+    return parsed;
   } catch {
     return void 0;
   }
 }
+function readSecurityClientConfigFromCookies(cookieHeader) {
+  const parsed = parseSecurityClientConfig(parseCookieHeader(cookieHeader)[SECURITY_CLIENT_CONFIG_COOKIE]);
+  return parsed ? Object.freeze({
+    csrf: Object.freeze({
+      field: parsed.csrf.field,
+      cookie: parsed.csrf.cookie,
+      ..."header" in parsed.csrf && typeof parsed.csrf.header === "string" ? { header: parsed.csrf.header } : {}
+    })
+  }) : void 0;
+}
+function getCsrfRequestHeaders(cookieHeader) {
+  const cookies = parseCookieHeader(cookieHeader);
+  const config = parseSecurityClientConfig(cookies[SECURITY_CLIENT_CONFIG_COOKIE]) ?? DEFAULT_SECURITY_CLIENT_CONFIG;
+  const token = cookies[config.csrf.cookie];
+  const header = "header" in config.csrf && typeof config.csrf.header === "string" ? config.csrf.header : "X-CSRF-TOKEN";
+  return token ? { [header]: token } : {};
+}
 var securityClientConfigInternals = {
-  parseCookieHeader
+  parseCookieHeader,
+  getCsrfRequestHeaders
 };
 
 export {

package/dist/client.d.ts

@@ -8,6 +8,7 @@ declare function readSecurityClientConfigFromCookies(cookieHeader: string | null
 declare function getSecurityClientConfig(): SecurityClientConfig;
 declare const securityClientInternals: {
     parseCookieHeader: (header: string | null | undefined) => Readonly<Record<string, string>>;
+    getCsrfRequestHeaders: (cookieHeader: string | undefined) => Readonly<Record<string, string>>;
     getDefaultSecurityClientConfig: typeof getDefaultSecurityClientConfig;
     readSecurityClientConfigFromCookies: typeof readSecurityClientConfigFromCookies;
 };

package/dist/client.mjs

@@ -2,12 +2,13 @@ import {
   getDefaultSecurityClientConfig,
   readSecurityClientConfigFromCookies,
   securityClientConfigInternals
-} from "./chunk-FUOZWKHK.mjs";
+} from "./chunk-PC2YCWDH.mjs";
 
 // src/client.ts
 function getSecurityClientConfig() {
   const runtime = globalThis;
-  return readSecurityClientConfigFromCookies(runtime.document?.cookie) ?? getDefaultSecurityClientConfig();
+  const config = readSecurityClientConfigFromCookies(runtime.document?.cookie) ?? getDefaultSecurityClientConfig();
+  return Object.freeze({ csrf: Object.freeze({ field: config.csrf.field, cookie: config.csrf.cookie }) });
 }
 var securityClientInternals = {
   getDefaultSecurityClientConfig,

package/dist/next/server.mjs

@@ -1,12 +1,12 @@
 import {
   prepareCsrfCookies
-} from "../chunk-CTRTL4CO.mjs";
+} from "../chunk-F32JK536.mjs";
 import {
   cors,
   getSecurityRuntime,
   protect
 } from "../chunk-5SCCUNBO.mjs";
-import "../chunk-FUOZWKHK.mjs";
+import "../chunk-PC2YCWDH.mjs";
 import {
   SecurityCsrfError
 } from "../chunk-FQ4X7X6L.mjs";

package/dist/nuxt/server.mjs

@@ -1,11 +1,11 @@
 import {
   prepareCsrfCookies
-} from "../chunk-CTRTL4CO.mjs";
+} from "../chunk-F32JK536.mjs";
 import {
   cors,
   protect
 } from "../chunk-5SCCUNBO.mjs";
-import "../chunk-FUOZWKHK.mjs";
+import "../chunk-PC2YCWDH.mjs";
 import {
   SecurityCsrfError
 } from "../chunk-FQ4X7X6L.mjs";

package/dist/sveltekit/server.mjs

@@ -1,11 +1,11 @@
 import {
   prepareCsrfCookies
-} from "../chunk-CTRTL4CO.mjs";
+} from "../chunk-F32JK536.mjs";
 import {
   cors,
   protect
 } from "../chunk-5SCCUNBO.mjs";
-import "../chunk-FUOZWKHK.mjs";
+import "../chunk-PC2YCWDH.mjs";
 import {
   SecurityCsrfError
 } from "../chunk-FQ4X7X6L.mjs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/security",
-  "version": "0.3.20",
+  "version": "0.3.22",
   "description": "Holo-JS Framework - CSRF and rate-limit contracts, config, and runtime seams",
   "type": "module",
   "license": "MIT",
@@ -58,8 +58,8 @@
     "test": "vitest --run --coverage"
   },
   "dependencies": {
-    "@holo-js/config": "^0.3.20",
-    "@holo-js/kernel": "^0.3.20"
+    "@holo-js/config": "^0.3.22",
+    "@holo-js/kernel": "^0.3.22"
   },
   "peerDependencies": {
     "h3": "^1.15.11",