@holo-js/security 0.3.28 → 0.4.0

package/dist/index.d.ts

@@ -1,10 +1,11 @@
-import { NormalizedHoloCorsConfig, NormalizedSecurityLimiterConfig, HoloSecurityConfig, NormalizedHoloSecurityConfig, SecurityRateLimitKeyResolver, SecurityLimiterConfig } from './config.js';
-export { HoloCorsConfig, HoloSecurityCsrfConfig, HoloSecurityRateLimitConfig, NormalizedHoloSecurityCsrfConfig, NormalizedHoloSecurityRateLimitConfig, SecurityRateLimitContext, SecurityRateLimitDriver, SecurityRateLimitFileConfig, SecurityRateLimitMemoryConfig, SecurityRateLimitRedisConfig, defineCorsConfig, defineSecurityConfig, holoCorsDefaults, holoSecurityDefaults, normalizeCorsConfig, normalizeSecurityConfig } from './config.js';
-import { SecurityCsrfField, SecurityCsrfInput, SecurityProtectOptions, SecurityClearRateLimitOptions, SecurityRateLimitCallOptions, SecurityRateLimitHitResult, SecurityRateLimitStore, SecurityRateLimitStoreFactoryOptions, SecurityRateLimitRedisDriverAdapter, SecurityRuntimeBindings, SecurityRuntimeFacade, ip } from './contracts.js';
-export { SecurityClientConfig, SecurityCorsFacade, SecurityCsrfError, SecurityCsrfFacade, SecurityDefaultRateLimitKeyResolver, SecurityRateLimitBucketSnapshot, SecurityRateLimitError, createFileRateLimitStoreConfig, createMemoryRateLimitStoreConfig, createRedisRateLimitStoreConfig, defineRateLimiter, defineSecurityRuntimeBindings, limit, securityInternals } from './contracts.js';
+import { a as NormalizedHoloCorsConfig, b as NormalizedSecurityLimiterConfig, H as HoloSecurityConfig, c as NormalizedHoloSecurityConfig, S as SecurityRateLimitKeyResolver, d as SecurityLimiterConfig } from './config-BK6q6Yh9.js';
+export { e as HoloCorsConfig, f as HoloSecurityCsrfConfig, g as HoloSecurityRateLimitConfig, h as NormalizedHoloSecurityCsrfConfig, i as NormalizedHoloSecurityRateLimitConfig, j as SecurityRateLimitContext, k as SecurityRateLimitDriver, l as SecurityRateLimitFileConfig, m as SecurityRateLimitMemoryConfig, n as SecurityRateLimitRedisConfig, o as SecurityTrustedProxies, p as defineCorsConfig, q as defineSecurityConfig, r as holoCorsDefaults, s as holoSecurityDefaults, t as normalizeCorsConfig, u as normalizeSecurityConfig } from './config-BK6q6Yh9.js';
+import { SecurityCsrfField, SecurityCsrfInput, SecurityProtectOptions, SecurityClearRateLimitOptions, SecurityRateLimitCallOptions, SecurityRateLimitHitResult, SecurityRateLimitStore, SecurityRateLimitStoreFactoryOptions, SecurityRateLimitRedisDriverAdapter, SecurityRuntimeBindings, SecurityRuntimeFacade } from './contracts.js';
+export { SecurityClientConfig, SecurityCorsFacade, SecurityCsrfError, SecurityCsrfFacade, SecurityCsrfSessionAccessor, SecurityDefaultRateLimitKeyResolver, SecurityRateLimitBucketSnapshot, SecurityRateLimitError, createFileRateLimitStoreConfig, createMemoryRateLimitStoreConfig, createRedisRateLimitStoreConfig, defineRateLimiter, defineSecurityRuntimeBindings, limit, securityInternals } from './contracts.js';
 import '@holo-js/kernel';
 
-declare function parseCookieHeader(header: string | null | undefined): Readonly<Record<string, string>>;
+declare function ip(request: Request): string;
+
 declare function serializeCookie(name: string, value: string, options?: {
     readonly secure?: boolean;
 }): string;
@@ -13,16 +14,15 @@ declare function matchesPathPattern$1(pathname: string, pattern: string): boolea
 declare function isExcludedPath(request: Request): boolean;
 declare function isSecureRequest(request: Request): boolean;
 declare function createCsrfToken(): string;
-declare function getCsrfSigningKey(): string;
-declare function encodeCsrfToken(nonce: string): string;
-declare function decodeCsrfToken(token: string): {
-    readonly nonce: string;
-    readonly signature: string;
-} | null;
-declare function isValidSignedCsrfToken(token: string): boolean;
-declare function getCookieToken(request: Request): string | undefined;
+declare function encryptCsrfToken(token: string): string;
+declare function decryptCsrfToken(value: string): string | undefined;
 declare function getHeaderToken(request: Request): string | undefined;
-declare function readFormToken(request: Request): Promise<string | undefined>;
+declare function getXsrfHeaderToken(request: Request): string | undefined;
+declare function readInputToken(request: Request): Promise<string | undefined>;
+declare function ensureSessionToken(request: Request): Promise<{
+    readonly token: string;
+    readonly sessionCookies: readonly string[];
+}>;
 declare function token(request: Request): Promise<string>;
 declare function field(request: Request): Promise<SecurityCsrfField>;
 declare function input(request: Request): Promise<SecurityCsrfInput>;
@@ -36,22 +36,22 @@ declare const csrf: Readonly<{
     cookie: typeof cookie;
     verify: typeof verify;
 }>;
+declare function rememberSessionToken(request: Request, token: string): void;
 declare const csrfInternals: {
     createCsrfToken: typeof createCsrfToken;
-    generatedTokenCache: WeakMap<Request, string>;
-    getCookieToken: typeof getCookieToken;
+    rememberSessionToken: typeof rememberSessionToken;
+    ensureSessionToken: typeof ensureSessionToken;
+    requestTokenCache: WeakMap<Request, string>;
     getHeaderToken: typeof getHeaderToken;
+    getXsrfHeaderToken: typeof getXsrfHeaderToken;
     isSecureRequest: typeof isSecureRequest;
-    readFormToken: typeof readFormToken;
+    readInputToken: typeof readInputToken;
     isExcludedPath: typeof isExcludedPath;
     isSafeMethod: typeof isSafeMethod;
     matchesPathPattern: typeof matchesPathPattern$1;
-    parseCookieHeader: typeof parseCookieHeader;
     serializeCookie: typeof serializeCookie;
-    decodeCsrfToken: typeof decodeCsrfToken;
-    encodeCsrfToken: typeof encodeCsrfToken;
-    getCsrfSigningKey: typeof getCsrfSigningKey;
-    isValidSignedCsrfToken: typeof isValidSignedCsrfToken;
+    decryptCsrfToken: typeof decryptCsrfToken;
+    encryptCsrfToken: typeof encryptCsrfToken;
 };
 
 declare function matchesPathPattern(pathname: string, pattern: string): boolean;
@@ -104,63 +104,12 @@ declare const securityStoreInternals: {
     normalizeStoreConfig: typeof normalizeStoreConfig;
 };
 
-type FileRateLimitBucket = {
-    namespaceHash: string;
-    keyHash: string;
-    prefixHashes: readonly string[];
-    attempts: number;
-    expiresAt: Date;
-};
-type FileBucketLock = {
-    readonly ownerId: string;
-    readonly path: string;
-};
 interface FileRateLimitStoreOptions {
     readonly now?: () => Date;
     readonly lockRetryDelayMs?: number;
     readonly lockTimeoutMs?: number;
 }
-declare function createBucketHash(key: string): string;
-declare function getBucketPath(root: string, key: string): string;
-declare function serializeBucket(bucket: FileRateLimitBucket): string;
-declare function deserializeBucket(raw: string): FileRateLimitBucket;
-declare function readBucket(path: string): Promise<FileRateLimitBucket | null>;
-declare function isExpired$1(bucket: FileRateLimitBucket, now: Date): boolean;
-declare function writeBucket(path: string, bucket: FileRateLimitBucket): Promise<void>;
-declare function deleteBucket(path: string): Promise<void>;
-declare function getBucketLockPath(path: string): string;
-declare function sleep(delayMs: number): Promise<void>;
-declare function removeOwnedBucketLock(lock: FileBucketLock): Promise<void>;
-declare function reclaimStaleBucketLock(lockPath: string, timeoutMs: number): Promise<boolean>;
-declare function acquireBucketLock(lockPath: string, options: {
-    readonly retryDelayMs: number;
-    readonly timeoutMs: number;
-}): Promise<FileBucketLock>;
-declare function withBucketLock<TValue>(path: string, options: {
-    readonly retryDelayMs: number;
-    readonly timeoutMs: number;
-}, operation: () => Promise<TValue>): Promise<TValue>;
-declare function listBucketPaths(root: string): Promise<string[]>;
-declare function createSnapshot$2(key: string, bucket: FileRateLimitBucket, maxAttempts: number): SecurityRateLimitHitResult['snapshot'];
 declare function createFileRateLimitStore(root: string, options?: FileRateLimitStoreOptions): SecurityRateLimitStore;
-declare const fileRateLimitDriverInternals: {
-    createBucketHash: typeof createBucketHash;
-    createSnapshot: typeof createSnapshot$2;
-    deleteBucket: typeof deleteBucket;
-    deserializeBucket: typeof deserializeBucket;
-    getBucketPath: typeof getBucketPath;
-    isExpired: typeof isExpired$1;
-    listBucketPaths: typeof listBucketPaths;
-    readBucket: typeof readBucket;
-    serializeBucket: typeof serializeBucket;
-    sleep: typeof sleep;
-    getBucketLockPath: typeof getBucketLockPath;
-    acquireBucketLock: typeof acquireBucketLock;
-    reclaimStaleBucketLock: typeof reclaimStaleBucketLock;
-    removeOwnedBucketLock: typeof removeOwnedBucketLock;
-    withBucketLock: typeof withBucketLock;
-    writeBucket: typeof writeBucket;
-};
 
 type MemoryRateLimitBucket = {
     key: string;
@@ -261,4 +210,5 @@ declare const security: Readonly<{
     verifySignedToken: typeof verifySignedToken;
 }>;
 
-export { HoloSecurityConfig, NormalizedHoloCorsConfig, NormalizedHoloSecurityConfig, NormalizedSecurityLimiterConfig, SecurityClearRateLimitOptions, SecurityCsrfField, SecurityCsrfInput, SecurityLimiterConfig, SecurityProtectOptions, SecurityRateLimitCallOptions, SecurityRateLimitHitResult, SecurityRateLimitKeyResolver, SecurityRateLimitRedisDriverAdapter, SecurityRateLimitStore, SecurityRateLimitStoreFactoryOptions, SecurityRuntimeBindings, SecurityRuntimeFacade, SecurityRuntimeNotConfiguredError, type SecuritySignedTokenOptions, type SecuritySignedTokenPayload, type SecuritySignedTokenPrimitive, type SecuritySignedTokenValue, apply as applyCors, clearRateLimit, configureSecurityRuntime, cors, corsInternals, headers as createCorsHeaders, preflight as createCorsPreflightResponse, cookie as createCsrfCookie, field as createCsrfField, input as createCsrfInput, token as createCsrfToken, createFileRateLimitStore, createMemoryRateLimitStore, createRateLimitStoreFromConfig, createRedisRateLimitStore, createSignedToken, csrf, csrfInternals, security as default, defaultRateLimitKey, fileRateLimitDriverInternals, getSecurityRuntime, getSecurityRuntimeBindings, ip, isSecureRequest, memoryRateLimitDriverInternals, protect, rateLimit, rateLimitInternals, redisRateLimitDriverInternals, resetSecurityRuntime, securityRuntimeInternals, securityStoreInternals, verify as verifyCsrfRequest, verifySignedToken };
+export { HoloSecurityConfig, NormalizedHoloCorsConfig, NormalizedHoloSecurityConfig, NormalizedSecurityLimiterConfig, SecurityClearRateLimitOptions, SecurityCsrfField, SecurityCsrfInput, SecurityLimiterConfig, SecurityProtectOptions, SecurityRateLimitCallOptions, SecurityRateLimitHitResult, SecurityRateLimitKeyResolver, SecurityRateLimitRedisDriverAdapter, SecurityRateLimitStore, SecurityRateLimitStoreFactoryOptions, SecurityRuntimeBindings, SecurityRuntimeFacade, SecurityRuntimeNotConfiguredError, apply as applyCors, clearRateLimit, configureSecurityRuntime, cors, corsInternals, headers as createCorsHeaders, preflight as createCorsPreflightResponse, cookie as createCsrfCookie, field as createCsrfField, input as createCsrfInput, token as createCsrfToken, createFileRateLimitStore, createMemoryRateLimitStore, createRateLimitStoreFromConfig, createRedisRateLimitStore, createSignedToken, csrf, csrfInternals, security as default, defaultRateLimitKey, getSecurityRuntime, getSecurityRuntimeBindings, ip, isSecureRequest, memoryRateLimitDriverInternals, protect, rateLimit, rateLimitInternals, redisRateLimitDriverInternals, resetSecurityRuntime, securityRuntimeInternals, securityStoreInternals, verify as verifyCsrfRequest, verifySignedToken };
+export type { SecuritySignedTokenOptions, SecuritySignedTokenPayload, SecuritySignedTokenPrimitive, SecuritySignedTokenValue };

package/dist/index.mjs

@@ -15,11 +15,11 @@ import {
   csrfInternals,
   defaultRateLimitKey,
   field,
-  fileRateLimitDriverInternals,
   getSecurityRuntime,
   getSecurityRuntimeBindings,
   headers,
   input,
+  ip,
   isSecureRequest,
   memoryRateLimitDriverInternals,
   preflight,
@@ -34,7 +34,8 @@ import {
   token,
   verify,
   verifySignedToken
-} from "./chunk-26IYURJG.mjs";
+} from "./chunk-RYQLS2OO.mjs";
+import "./chunk-EINZXLC2.mjs";
 import {
   SecurityCsrfError,
   SecurityRateLimitError,
@@ -43,10 +44,9 @@ import {
   createRedisRateLimitStoreConfig,
   defineRateLimiter,
   defineSecurityRuntimeBindings,
-  ip,
   limit,
   securityInternals
-} from "./chunk-FQ4X7X6L.mjs";
+} from "./chunk-U25HSHLJ.mjs";
 import {
   defineCorsConfig,
   defineSecurityConfig,
@@ -54,7 +54,7 @@ import {
   holoSecurityDefaults,
   normalizeCorsConfig,
   normalizeSecurityConfig
-} from "./chunk-WRMZRO77.mjs";
+} from "./chunk-D3ZN5MLJ.mjs";
 export {
   SecurityCsrfError,
   SecurityRateLimitError,
@@ -86,7 +86,6 @@ export {
   defineRateLimiter,
   defineSecurityConfig,
   defineSecurityRuntimeBindings,
-  fileRateLimitDriverInternals,
   getSecurityRuntime,
   getSecurityRuntimeBindings,
   holoCorsDefaults,

package/dist/next/server.d.ts

@@ -13,4 +13,5 @@ declare const nextSecurityInternals: {
     issueCsrfCookie: typeof issueCsrfCookie;
 };
 
-export { type NextCsrfMiddleware, csrfProtection, nextSecurityInternals };
+export { csrfProtection, nextSecurityInternals };
+export type { NextCsrfMiddleware };

package/dist/next/server.mjs

@@ -2,17 +2,18 @@ import {
   createSecurityRejectionResponse,
   isSecurityRejection,
   prepareCsrfCookies
-} from "../chunk-PHPA3C6L.mjs";
+} from "../chunk-Q3PK4AGL.mjs";
 import {
   cors,
   getSecurityRuntime,
   protect
-} from "../chunk-26IYURJG.mjs";
-import "../chunk-PC2YCWDH.mjs";
-import "../chunk-FQ4X7X6L.mjs";
-import "../chunk-WRMZRO77.mjs";
+} from "../chunk-RYQLS2OO.mjs";
+import "../chunk-EINZXLC2.mjs";
+import "../chunk-U25HSHLJ.mjs";
+import "../chunk-D3ZN5MLJ.mjs";
 
 // src/next/server.ts
+import { HoloRequestBodyTooLargeError, readBoundedRequestFormData } from "@holo-js/kernel";
 function getRequestCookie(request, name) {
   const cookie = request.cookies?.get(name);
   if (typeof cookie === "string") {
@@ -21,22 +22,38 @@ function getRequestCookie(request, name) {
   return typeof cookie?.value === "string" ? cookie.value : void 0;
 }
 async function issueCsrfCookie(request) {
-  const cookies = await prepareCsrfCookies(request, (name) => getRequestCookie(request, name));
-  if (cookies.length === 0) {
+  const { cookies, sessionCookies } = await prepareCsrfCookies(request, (name) => getRequestCookie(request, name));
+  if (cookies.length === 0 && sessionCookies.length === 0) {
     return void 0;
   }
   const { NextResponse } = await import("next/server.js");
-  const response = NextResponse.next();
+  let requestHeaders;
+  if (sessionCookies.length > 0) {
+    requestHeaders = new Headers(request.headers);
+    const forwardedCookies = /* @__PURE__ */ new Map();
+    for (const cookie of [
+      ...(request.headers.get("cookie") ?? "").split(";"),
+      ...sessionCookies.map((cookie2) => cookie2.split(";", 1)[0] ?? "")
+    ]) {
+      const separator = cookie.indexOf("=");
+      if (separator > 0) forwardedCookies.set(cookie.slice(0, separator).trim(), cookie.slice(separator + 1).trim());
+    }
+    requestHeaders.set("cookie", [...forwardedCookies].map(([name, value]) => `${name}=${value}`).join("; "));
+  }
+  const response = NextResponse.next(requestHeaders ? { request: { headers: requestHeaders } } : void 0);
   for (const cookie of cookies) {
     response.cookies.set(cookie.name, cookie.value, cookie.options);
   }
+  for (const sessionCookie of sessionCookies) {
+    response.headers.append("Set-Cookie", sessionCookie);
+  }
   return response;
 }
 async function actionRequest(request) {
   const { field, header } = getSecurityRuntime().config.csrf;
   if (!request.headers.has("next-action") || request.headers.get(header)?.trim() || !request.headers.get("content-type")?.startsWith("multipart/form-data")) return request;
   try {
-    const data = await request.clone().formData();
+    const data = await readBoundedRequestFormData(request.clone());
     const root = data.get("0");
     if (typeof root !== "string") return request;
     const args = JSON.parse(root);
@@ -51,7 +68,8 @@ async function actionRequest(request) {
       headers.set(header, token);
       return new Request(request.clone(), { headers });
     }
-  } catch {
+  } catch (error) {
+    if (error instanceof HoloRequestBodyTooLargeError) throw error;
     return request;
   }
   return request;

package/dist/nuxt/server.mjs

@@ -1,24 +1,27 @@
 import {
   isSecurityRejection,
   prepareCsrfCookies
-} from "../chunk-PHPA3C6L.mjs";
+} from "../chunk-Q3PK4AGL.mjs";
 import {
   cors,
+  csrfInternals,
   protect
-} from "../chunk-26IYURJG.mjs";
-import "../chunk-PC2YCWDH.mjs";
-import "../chunk-FQ4X7X6L.mjs";
-import "../chunk-WRMZRO77.mjs";
+} from "../chunk-RYQLS2OO.mjs";
+import "../chunk-EINZXLC2.mjs";
+import "../chunk-U25HSHLJ.mjs";
+import "../chunk-D3ZN5MLJ.mjs";
 
 // src/nuxt/server.ts
+import { readBoundedBufferedBody, readBoundedNodeRequestBody, requestBodyLimitFor } from "@holo-js/kernel";
 import {
   createError,
   defineEventHandler,
+  appendResponseHeader,
   getCookie,
   getMethod,
+  getRequestHeader,
   getRequestHeaders,
   getRequestURL,
-  readRawBody,
   setCookie,
   setResponseHeader
 } from "h3";
@@ -43,6 +46,22 @@ function createRequestBody(body) {
   copy.set(body);
   return copy.buffer;
 }
+var h3RawBodySymbol = /* @__PURE__ */ Symbol.for("h3RawBody");
+async function readBoundedEventBody(event) {
+  const limit = requestBodyLimitFor(getRequestHeader(event, "content-type"));
+  const node = event.node.req;
+  const buffered = await readBoundedBufferedBody(
+    event._requestBody || event.web?.request?.body || node[h3RawBodySymbol] || node.rawBody || node.body,
+    limit
+  );
+  const bytes = buffered?.bytes ?? await readBoundedNodeRequestBody(event.node.req, limit, getRequestHeader(event, "content-length"));
+  event._requestBody = bytes;
+  Object.assign(event.node.req, { [h3RawBodySymbol]: bytes });
+  if (buffered?.contentType) {
+    event.node.req.headers["content-type"] = buffered.contentType;
+  }
+  return { bytes, contentType: buffered?.contentType };
+}
 async function createRequest(event) {
   if (event.web?.request) {
     const request = event.web.request.clone();
@@ -51,18 +70,35 @@ async function createRequest(event) {
   }
   const method = getMethod(event);
   const headers = createHeaders(event);
-  const body = isSafeMethod(method) ? void 0 : await readRawBody(event, false);
-  return new Request(getRequestURL(event), {
+  const buffered = isSafeMethod(method) ? void 0 : await readBoundedEventBody(event);
+  if (buffered?.contentType) {
+    headers.set("content-type", buffered.contentType);
+  }
+  return new Request(getRequestURL(event, { xForwardedProto: false }), {
     method,
     headers,
-    body: createRequestBody(body)
+    body: createRequestBody(buffered?.bytes)
   });
 }
+function shareSessionWithHandlers(event, token, sessionCookies) {
+  const cookie = [event.headers.get("cookie"), ...sessionCookies.map((sessionCookie) => sessionCookie.split(";", 1)[0])].filter(Boolean).join("; ");
+  event.headers.set("cookie", cookie);
+  event.node.req.headers.cookie = cookie;
+  if (event.web?.request) {
+    csrfInternals.rememberSessionToken(event.web.request, token);
+  }
+}
 async function issueCsrfCookie(event, request) {
-  const cookies = await prepareCsrfCookies(request, (name) => getCookie(event, name));
+  const { token, cookies, sessionCookies } = await prepareCsrfCookies(request, (name) => getCookie(event, name));
   for (const cookie of cookies) {
     setCookie(event, cookie.name, cookie.value, cookie.options);
   }
+  for (const sessionCookie of sessionCookies) {
+    appendResponseHeader(event, "set-cookie", sessionCookie);
+  }
+  if (token && sessionCookies.length > 0) {
+    shareSessionWithHandlers(event, token, sessionCookies);
+  }
 }
 function csrfProtection() {
   return defineEventHandler(async (event) => {
@@ -72,11 +108,11 @@ function csrfProtection() {
         headers: { Allow: "GET, HEAD, OPTIONS, POST, PUT, PATCH, DELETE" }
       });
     }
-    const request = await createRequest(event);
-    const preflight = cors.preflight(request);
-    if (preflight) return preflight;
-    cors.headers(request).forEach((value, name) => setResponseHeader(event, name, value));
     try {
+      const request = await createRequest(event);
+      const preflight = cors.preflight(request);
+      if (preflight) return preflight;
+      cors.headers(request).forEach((value, name) => setResponseHeader(event, name, value));
       await protect(request);
       await issueCsrfCookie(event, request);
     } catch (error) {

package/dist/sveltekit/server.d.ts

@@ -28,10 +28,11 @@ type SvelteKitCsrfHandleInput<TEvent extends SvelteKitCsrfEvent = SvelteKitCsrfE
     readonly resolve: (event: TEvent, options?: SvelteKitResolveOptions) => Response | Promise<Response>;
 };
 type SvelteKitCsrfHandle = <TEvent extends SvelteKitCsrfEvent>(input: SvelteKitCsrfHandleInput<TEvent>) => Response | Promise<Response>;
-declare function issueCsrfCookie(event: SvelteKitCsrfEvent): Promise<void>;
+declare function issueCsrfCookie(event: SvelteKitCsrfEvent): Promise<readonly string[]>;
 declare function csrfProtection(): SvelteKitCsrfHandle;
 declare const svelteKitSecurityInternals: {
     issueCsrfCookie: typeof issueCsrfCookie;
 };
 
-export { type SvelteKitCsrfHandle, type SvelteKitCsrfHandleInput, csrfProtection, svelteKitSecurityInternals };
+export { csrfProtection, svelteKitSecurityInternals };
+export type { SvelteKitCsrfHandle, SvelteKitCsrfHandleInput };

package/dist/sveltekit/server.mjs

@@ -1,22 +1,24 @@
 import {
+  appendSetCookies,
   createSecurityRejectionResponse,
   isSecurityRejection,
   prepareCsrfCookies
-} from "../chunk-PHPA3C6L.mjs";
+} from "../chunk-Q3PK4AGL.mjs";
 import {
   cors,
   protect
-} from "../chunk-26IYURJG.mjs";
-import "../chunk-PC2YCWDH.mjs";
-import "../chunk-FQ4X7X6L.mjs";
-import "../chunk-WRMZRO77.mjs";
+} from "../chunk-RYQLS2OO.mjs";
+import "../chunk-EINZXLC2.mjs";
+import "../chunk-U25HSHLJ.mjs";
+import "../chunk-D3ZN5MLJ.mjs";
 
 // src/sveltekit/server.ts
 async function issueCsrfCookie(event) {
-  const cookies = await prepareCsrfCookies(event.request, (name) => event.cookies.get(name));
+  const { cookies, sessionCookies } = await prepareCsrfCookies(event.request, (name) => event.cookies.get(name));
   for (const cookie of cookies) {
     event.cookies.set(cookie.name, cookie.value, cookie.options);
   }
+  return sessionCookies;
 }
 function csrfProtection() {
   return async ({ event, resolve }) => {
@@ -28,16 +30,17 @@ function csrfProtection() {
         headers: { Allow: "GET, HEAD, OPTIONS, POST, PUT, PATCH, DELETE" }
       });
     }
+    let sessionCookies;
     try {
       await protect(event.request);
-      await issueCsrfCookie(event);
+      sessionCookies = await issueCsrfCookie(event);
     } catch (error) {
       if (isSecurityRejection(error)) {
         return cors.apply(event.request, createSecurityRejectionResponse(error));
       }
       throw error;
     }
-    return cors.apply(event.request, await resolve(event));
+    return appendSetCookies(cors.apply(event.request, await resolve(event)), sessionCookies);
   };
 }
 var svelteKitSecurityInternals = {

package/package.json

@@ -1,9 +1,14 @@
 {
   "name": "@holo-js/security",
-  "version": "0.3.28",
+  "version": "0.4.0",
   "description": "Holo-JS Framework - CSRF and rate-limit contracts, config, and runtime seams",
   "type": "module",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cobraprojects/holo-js.git",
+    "directory": "packages/security"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -49,7 +54,8 @@
   "main": "./dist/index.mjs",
   "types": "./dist/index.d.ts",
   "files": [
-    "dist"
+    "dist",
+    "LICENSE"
   ],
   "scripts": {
     "build": "tsup",
@@ -58,13 +64,13 @@
     "test": "vitest --run --coverage"
   },
   "dependencies": {
-    "@holo-js/config": "^0.3.28",
-    "@holo-js/kernel": "^0.3.28"
+    "@holo-js/config": "^0.4.0",
+    "@holo-js/kernel": "^0.4.0"
   },
   "peerDependencies": {
     "h3": "^1.15.11",
-    "next": "^16.3.5",
-    "ioredis": "^5.4.2"
+    "next": "^16.4.3",
+    "ioredis": "^6.0.0"
   },
   "peerDependenciesMeta": {
     "h3": {
@@ -78,15 +84,15 @@
     }
   },
   "devDependencies": {
-    "@types/node": "^22.10.2",
+    "@types/node": "^22.20.5",
     "h3": "^1.15.11",
-    "ioredis": "^5.4.2",
-    "next": "^16.3.5",
-    "tsup": "^8.3.5",
-    "typescript": "^5.7.2",
-    "vitest": "^4.1.5"
+    "ioredis": "^6.0.0",
+    "next": "^16.4.3",
+    "tsup": "^9.0.0",
+    "typescript": "^6.0.3",
+    "vitest": "^5.0.5"
   },
   "engines": {
-    "node": "^22.12.0 || ^24.0.0 || ^26.0.0"
+    "node": "^22.18.0 || ^24.0.0 || ^26.0.0"
   }
 }

package/dist/chunk-PHPA3C6L.mjs

@@ -1,64 +0,0 @@
-import {
-  csrfInternals,
-  getSecurityRuntime,
-  isSecureRequest,
-  token
-} from "./chunk-26IYURJG.mjs";
-import {
-  SECURITY_CLIENT_CONFIG_COOKIE,
-  createSecurityClientConfig,
-  serializeSecurityClientConfig
-} from "./chunk-PC2YCWDH.mjs";
-import {
-  SecurityCsrfError
-} from "./chunk-FQ4X7X6L.mjs";
-
-// src/cookie-issuance.ts
-async function prepareCsrfCookies(request, getCookie) {
-  const { config } = getSecurityRuntime();
-  const method = request.method.trim().toUpperCase();
-  if (!config.csrf.enabled || method !== "GET" && method !== "HEAD") {
-    return [];
-  }
-  const existingToken = getCookie(config.csrf.cookie);
-  const clientConfig = serializeSecurityClientConfig(createSecurityClientConfig(config));
-  const shouldIssueToken = !existingToken || !csrfInternals.isValidSignedCsrfToken(existingToken);
-  const shouldIssueClientConfig = getCookie(SECURITY_CLIENT_CONFIG_COOKIE) !== clientConfig;
-  if (!shouldIssueToken && !shouldIssueClientConfig) {
-    return [];
-  }
-  const options = {
-    httpOnly: false,
-    path: "/",
-    sameSite: "lax",
-    secure: isSecureRequest(request)
-  };
-  const cookies = [];
-  if (shouldIssueToken) {
-    cookies.push({ name: config.csrf.cookie, value: await token(request), options });
-  }
-  if (shouldIssueClientConfig) {
-    cookies.push({ name: SECURITY_CLIENT_CONFIG_COOKIE, value: clientConfig, options });
-  }
-  return cookies;
-}
-
-// src/rejection-response.ts
-import { HoloRequestUrlError } from "@holo-js/kernel";
-function isSecurityRejection(error) {
-  return error instanceof SecurityCsrfError || error instanceof HoloRequestUrlError;
-}
-function createSecurityRejectionResponse(error) {
-  return new Response(error.message, {
-    status: error.status,
-    headers: {
-      "content-type": "text/plain; charset=utf-8"
-    }
-  });
-}
-
-export {
-  prepareCsrfCookies,
-  isSecurityRejection,
-  createSecurityRejectionResponse
-};