@webjsdev/server 0.8.32 → 0.8.34

package/src/csrf.js

@@ -1,47 +1,36 @@
-// Use Web Crypto (globalThis.crypto) for random + hash: works on Node >=20,
-// Deno, Bun, Cloudflare Workers. Avoids the node:crypto import and keeps
-// CSRF portable across runtimes.
-const webCrypto = /** @type {Crypto} */ (globalThis.crypto);
-
 /**
- * Double-submit cookie CSRF protection for `/__webjs/action/*` RPC endpoints.
+ * Cross-origin (CSRF) protection for `/__webjs/action/*` RPC endpoints, via
+ * Fetch-Metadata + Origin verification. This is the model Remix 3's
+ * `cop-middleware` and Go 1.25's `http.CrossOriginProtection` use, and the
+ * spiritual sibling of Next.js / Astro's Origin-vs-Host check.
  *
- * Flow:
- *   1. Every SSR response that lacks the cookie issues a fresh `webjs_csrf`
- *      cookie with `SameSite=Lax; Path=/` (and `Secure` when over HTTPS).
- *      The cookie is readable by JS (not HttpOnly) so the auto-generated
- *      action stub can echo it.
- *   2. The action-stub `fetch` sends the token back in `x-webjs-csrf`.
- *   3. `invokeAction` compares the header to the cookie with constant-time
- *      equality; mismatch → 403.
+ * Why not a token cookie: webjs previously issued a per-request `webjs_csrf`
+ * double-submit cookie on every SSR response. That made SSR HTML
+ * un-cacheable at a CDN (a CDN skips a response with `Set-Cookie`, and a
+ * cached one would share / poison the token across visitors). A header check
+ * needs nothing on the page, so SSR HTML carries no `Set-Cookie` and a page
+ * that opts into a public `Cache-Control` is edge-cacheable.
  *
- * This protects against classic CSRF (a malicious site triggering a POST
- * from a victim browser): cross-origin requests cannot read the cookie, so
- * they cannot set the header to the matching value.
+ * The check, on every state-changing verb (a safe GET is exempt):
+ *   1. `Sec-Fetch-Site` is the primary signal. The browser sets it on every
+ *      request and page JS cannot forge it. `same-origin` / `none` (a direct
+ *      navigation with no initiator) pass; `same-site` / `cross-site` are
+ *      rejected unless the source origin is in `webjs.allowedOrigins`.
+ *   2. When `Sec-Fetch-Site` is absent (an older browser), fall back to
+ *      comparing the `Origin` host to the request host; an absent `Origin`
+ *      can't be checked so it passes (a handcrafted / non-browser request
+ *      can't carry a victim's SameSite cookies cross-site anyway).
  *
- * Notes on scope:
- *   - Applies to internal RPC only. A `route.ts` REST endpoint (hand-written
- *     or via the `route()` adapter) is *not* CSRF-protected because it is
- *     intended for external consumers; such an endpoint should carry its own
- *     auth (bearer token, signed request, API key) the app provides via
- *     middleware.
+ * Scope:
+ *   - Internal RPC only. A `route.ts` REST endpoint (hand-written or via the
+ *     `route()` adapter) is intentionally NOT covered here; it is for external
+ *     consumers and must carry its own auth.
+ *   - Session / auth cookies stay `SameSite=Lax` as defense-in-depth.
  */
 
-export const CSRF_COOKIE = 'webjs_csrf';
-export const CSRF_HEADER = 'x-webjs-csrf';
-const COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 7; // 7 days
-
-/** @returns {string} a 128-bit hex token */
-export function newToken() {
-  const bytes = new Uint8Array(16);
-  webCrypto.getRandomValues(bytes);
-  let s = '';
-  for (const b of bytes) s += b.toString(16).padStart(2, '0');
-  return s;
-}
-
 /**
- * Parse cookies off a standard Request.
+ * Parse cookies off a standard Request. Retained as a general cookie reader
+ * (used by `context.js` for `cookies()`), independent of CSRF.
  * @param {Request} req
  * @returns {Record<string,string>}
  */
@@ -60,37 +49,88 @@ export function parseCookies(req) {
   return out;
 }
 
-/** @param {Request} req */
-export function readToken(req) {
-  return parseCookies(req)[CSRF_COOKIE] || null;
+/** Lower-cased host from a URL-or-origin string, or '' if unparseable. */
+function hostOf(value) {
+  if (!value) return '';
+  try { return new URL(value).host.toLowerCase(); } catch { return ''; }
 }
 
 /**
- * Serialise a Set-Cookie value for the CSRF token.
- * @param {string} token
- * @param {{ secure?: boolean }} [opts]
+ * The host the request was addressed to. Honors `x-forwarded-host` first
+ * (set by a reverse proxy / CDN like the Cloudflare-in-front-of-Railway
+ * setup), then the `Host` header, then the request URL.
+ *
+ * Trust note: `x-forwarded-host` is only meaningful behind a proxy that
+ * overwrites it. This is NOT a CSRF weakness, because a CSRF attack is
+ * browser-driven and a browser cannot set `x-forwarded-host` (or `Origin`);
+ * only a direct non-browser client can, and such a client carries no victim
+ * SameSite cookies to abuse. The primary `Sec-Fetch-Site` path does not use
+ * this at all.
+ * @param {Request} req
  */
-export function cookieHeader(token, opts = {}) {
-  const parts = [
-    `${CSRF_COOKIE}=${encodeURIComponent(token)}`,
-    'Path=/',
-    'SameSite=Lax',
-    `Max-Age=${COOKIE_MAX_AGE_SECONDS}`,
-  ];
-  if (opts.secure) parts.push('Secure');
-  return parts.join('; ');
+export function requestHost(req) {
+  const xfh = req.headers.get('x-forwarded-host');
+  if (xfh) return xfh.split(',')[0].trim().toLowerCase();
+  const host = req.headers.get('host');
+  if (host) return host.toLowerCase();
+  return hostOf(req.url);
+}
+
+/** Is the request's `Origin` host in the configured allowlist? */
+function originAllowed(req, allowedOrigins) {
+  const origin = req.headers.get('origin');
+  if (!origin || origin === 'null') return false;
+  const h = hostOf(origin);
+  if (!h) return false;
+  const allow = new Set(
+    // A full-origin entry (`https://x.example`) is host-parsed; a bare host
+    // (`x.example` or a copy-pasted `x.example/`) is lower-cased and stripped
+    // of a stray trailing slash so it still matches.
+    allowedOrigins.map((o) => (o.includes('://') ? hostOf(o) : o.toLowerCase().replace(/\/+$/, ''))),
+  );
+  return allow.has(h);
 }
 
 /**
- * Constant-time verification of the double-submit.
+ * Cross-origin (CSRF) verification for a state-changing action request.
  * @param {Request} req
+ * @param {string[]} [allowedOrigins] hosts or full origins allowed cross-site
+ * @returns {{ ok: boolean, reason?: string }}
+ */
+export function verifyOrigin(req, allowedOrigins = []) {
+  // Primary: the Sec-Fetch-Site fetch-metadata header (browser-set, not
+  // forgeable by page JS, sent on every request).
+  const secFetchSite = (req.headers.get('sec-fetch-site') || '').toLowerCase();
+  if (secFetchSite === 'same-origin' || secFetchSite === 'none') return { ok: true };
+  if (secFetchSite) {
+    // 'same-site' or 'cross-site': reject unless the source origin is trusted.
+    return originAllowed(req, allowedOrigins)
+      ? { ok: true }
+      : { ok: false, reason: `cross-origin request (Sec-Fetch-Site: ${secFetchSite})` };
+  }
+  // Fallback (no Sec-Fetch-Site, older browser): compare Origin host to host.
+  const origin = req.headers.get('origin');
+  if (!origin) return { ok: true, reason: 'no-origin' };
+  const sourceHost = origin === 'null' ? 'null' : hostOf(origin);
+  const host = requestHost(req);
+  if (sourceHost && host && sourceHost === host) return { ok: true };
+  return originAllowed(req, allowedOrigins)
+    ? { ok: true }
+    : { ok: false, reason: `origin ${sourceHost || '(none)'} does not match host ${host || '(none)'}` };
+}
+
+/**
+ * Read `webjs.allowedOrigins` (string[]) from a parsed package.json. Pure;
+ * the caller supplies the package.json read (mirrors `readBasePath`).
+ * @param {unknown} pkg
+ * @returns {string[]}
  */
-export function verify(req) {
-  const cookie = readToken(req);
-  const header = req.headers.get(CSRF_HEADER);
-  if (!cookie || !header) return false;
-  if (cookie.length !== header.length) return false;
-  let diff = 0;
-  for (let i = 0; i < cookie.length; i++) diff |= cookie.charCodeAt(i) ^ header.charCodeAt(i);
-  return diff === 0;
+export function readAllowedOrigins(pkg) {
+  const raw =
+    pkg &&
+    typeof pkg === 'object' &&
+    /** @type {any} */ (pkg).webjs &&
+    /** @type {any} */ (pkg).webjs.allowedOrigins;
+  if (!Array.isArray(raw)) return [];
+  return raw.filter((x) => typeof x === 'string' && x.length > 0);
 }

package/src/dev.js

@@ -13,7 +13,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { buildRouteTable, matchPage, matchApi } from './router.js';
 import { generateRouteTypes } from './route-types.js';
-import { ssrPage, ssrNotFound } from './ssr.js';
+import { ssrPage, ssrNotFound, setClientRouterEnabled } from './ssr.js';
 import { loadPageAction, runPageAction } from './page-action.js';
 import { handleApi } from './api.js';
 import {
@@ -87,6 +87,7 @@ function shouldAccessLog(pathname) {
 }
 import { setVendorEntries, setCoreInstall, publishBuildId, setBasePath, basePath, setImportAliasEntries, importAliasBrowserEntries } from './importmap.js';
 import { readBasePath, stripBasePath, withBasePath } from './base-path.js';
+import { readAllowedOrigins } from './csrf.js';
 import { setAssetRoots, clearAssetHashCache, setElisionFingerprint, withAssetHash, assetHashFor, versionModuleImports } from './asset-hash.js';
 import { urlFromRequest } from './forwarded.js';
 import { compileHeaderRules, applySecurityHeaders, webRequestIsHttps } from './headers.js';
@@ -267,6 +268,28 @@ export async function readSeedEnabled(appDir) {
   return true;
 }
 
+/**
+ * Read the client-router switch (`webjs.clientRouter`) from the app's
+ * package.json (#629). Default `true`: the client router auto-enables in the
+ * browser whenever `@webjsdev/core` loads (the automatic-navigation thesis).
+ * `{ "webjs": { "clientRouter": false } }` opts the WHOLE app out (pure MPA,
+ * full-page navigation), which the render path signals to the browser so the
+ * core bundle's module-end auto-enable is skipped. Any other value, or an
+ * absent key, keeps the router on. Re-read on every rebuild (alongside elide)
+ * so toggling it takes effect without a server restart.
+ * @param {string} appDir
+ * @returns {Promise<boolean>}
+ */
+export async function readClientRouterEnabled(appDir) {
+  try {
+    const pkg = JSON.parse(await readFile(join(appDir, 'package.json'), 'utf8'));
+    if (pkg && pkg.webjs && pkg.webjs.clientRouter === false) return false;
+  } catch {
+    // No package.json, malformed JSON, or unreadable. Keep the default.
+  }
+  return true;
+}
+
 /**
  * Read the per-path response-header config (`webjs.headers`) from the
  * app's package.json and compile it to URLPattern rules. A missing,
@@ -340,6 +363,24 @@ export async function readBasePathFromApp(appDir) {
   }
 }
 
+/**
+ * Read the cross-origin allowlist (`webjs.allowedOrigins`) from the app's
+ * package.json. These hosts / origins are accepted by the action CSRF check
+ * even when cross-site (reverse-proxy / multi-domain setups). A missing or
+ * unreadable config yields `[]`.
+ *
+ * @param {string} appDir
+ * @returns {Promise<string[]>}
+ */
+export async function readAllowedOriginsFromApp(appDir) {
+  try {
+    const pkg = JSON.parse(await readFile(join(appDir, 'package.json'), 'utf8'));
+    return readAllowedOrigins(pkg);
+  } catch {
+    return [];
+  }
+}
+
 /**
  * Read the CSP config (`webjs.csp`) from the app's package.json and
  * normalize it (issue #233). A missing, malformed, or unreadable config
@@ -473,6 +514,15 @@ export async function createRequestHandler(opts) {
   const basePathValue = await readBasePathFromApp(appDir);
   await setBasePath(basePathValue);
 
+  // Cross-origin allowlist for the action CSRF check (#659), read once.
+  const allowedOriginsValue = await readAllowedOriginsFromApp(appDir);
+
+  // Client-router opt-out (#629): bind it eagerly at handler construction (the
+  // same timing as setBasePath above), so a handler's module-global is set
+  // before any render even if a request arrives before the first warm. The
+  // analysis pass re-reads it each rebuild so a dev toggle takes effect live.
+  setClientRouterEnabled(await readClientRouterEnabled(appDir));
+
   const coreDir = locateCoreDir(appDir);
   // Switch the importmap between dist/ bundles and src/ per-file
   // URLs depending on whether the resolved @webjsdev/core install
@@ -638,6 +688,7 @@ export async function createRequestHandler(opts) {
     moduleGraph: null,
     elidableComponents: new Set(),
     inertRouteModules: new Set(),
+    importOnlyRouteModules: new Map(),
     browserBoundFiles: null,
     // Transformed-source cache (stripped TS + applied elision). Per-handler,
     // NOT module-global: the cached bytes bake in THIS handler's elision
@@ -742,12 +793,16 @@ export async function createRequestHandler(opts) {
             t.actions = now() - m; m = now();
             state.middleware = await loadMiddleware(appDir, dev, logger);
             t.middleware = now() - m; m = now();
+            // Client-router opt-out (#629): re-read each pass so toggling
+            // `webjs.clientRouter` takes effect on rebuild without a restart.
+            setClientRouterEnabled(await readClientRouterEnabled(appDir));
             const r = (await readElideEnabled(appDir))
               ? await analyzeElision(components, collectRouteModules(state.routeTable),
                   state.moduleGraph, (f) => readFile(f, 'utf8'), appDir)
-              : { elidableComponents: new Set(), inertRouteModules: new Set() };
+              : { elidableComponents: new Set(), inertRouteModules: new Set(), importOnlyRouteModules: new Map() };
             state.elidableComponents = r.elidableComponents;
             state.inertRouteModules = r.inertRouteModules;
+            state.importOnlyRouteModules = r.importOnlyRouteModules;
             // Fold the elision verdict into app-module content hashes (#243): an
             // app module's served body is elision-transformed, so a verdict flip
             // must bust its `?v` even when its source is byte-identical. A stable
@@ -764,6 +819,10 @@ export async function createRequestHandler(opts) {
               const elidedPaths = [
                 ...state.elidableComponents,
                 ...state.inertRouteModules,
+                // An import-only module is dropped from the boot (replaced by its
+                // component imports), so a flip in / out of that class must bust
+                // the importer's `?v` too.
+                ...state.importOnlyRouteModules.keys(),
               ].map(rel).sort();
               setElisionFingerprint(elidedPaths.length ? elidedPaths.join('\n') : '');
             }
@@ -871,7 +930,7 @@ export async function createRequestHandler(opts) {
     if (vendorResolveInFlight) return vendorResolveInFlight;
     vendorResolveInFlight = (async () => {
       try {
-        const scan = () => scanBareImports(appDir, new Set([...state.elidableComponents, ...state.inertRouteModules]));
+        const scan = () => scanBareImports(appDir, new Set([...state.elidableComponents, ...state.inertRouteModules, ...state.importOnlyRouteModules.keys()]));
         const v = await resolveVendorImports(appDir, scan);
         let { imports, integrity } = v;
         if (bootVendorPinned) {
@@ -1269,7 +1328,7 @@ export async function createRequestHandler(opts) {
       // Build all whole-app analysis on the first request (memoized), before
       // any SSR, module serve, gate check, action dispatch, or middleware runs.
       await ensureReady();
-      const next = () => handleCore(req, { state, appDir, coreDir, dev, reportError, reportDevError, cspEnabled: cspConfig.enabled });
+      const next = () => handleCore(req, { state, appDir, coreDir, dev, reportError, reportDevError, cspEnabled: cspConfig.enabled, allowedOrigins: allowedOriginsValue });
       if (state.middleware) {
         try {
           return await state.middleware(req, next);
@@ -1303,7 +1362,21 @@ export async function createRequestHandler(opts) {
     if (matchPathname === null) return null;
     const page = matchPage(state.routeTable, matchPathname);
     if (!page) return null;
-    const moduleUrls = [page.route.file, ...page.route.layouts].map((f) => {
+    // Mirror ssr.js's boot assembly EXACTLY: drop inert route modules, and
+    // splice an import-only module's component imports in place of the module
+    // (#605). Otherwise the 103 Early Hints would preload the page / layout
+    // modules the body no longer imports (a wasted hint) and miss the component
+    // modules it actually fetches (a double-fetch on the real module).
+    const inert = state.inertRouteModules;
+    const importOnly = state.importOnlyRouteModules;
+    const files = [];
+    const seenFiles = new Set();
+    for (const f of [page.route.file, ...page.route.layouts]) {
+      if (inert && inert.has(f)) continue;
+      const emit = importOnly && importOnly.get(f);
+      for (const t of emit || [f]) if (!seenFiles.has(t)) { seenFiles.add(t); files.push(t); }
+    }
+    const moduleUrls = files.map((f) => {
       let rel = f.startsWith(appDir) ? f.slice(appDir.length) : f;
       const url = rel.split('\\').join('/').replace(/^\/?/, '/');
       // Mirror ssr.js's emit (basePath THEN `?v`) so the 103 Early Hints preload
@@ -1689,7 +1762,7 @@ async function tryServeFrameworkStatic(path, method, ctx) {
 }
 
 async function handleCore(req, ctx) {
-  const { state, appDir, coreDir, dev, reportError, reportDevError, cspEnabled } = ctx;
+  const { state, appDir, coreDir, dev, reportError, reportDevError, cspEnabled, allowedOrigins } = ctx;
   const url = new URL(req.url);
   // Decode percent-encoded characters so filesystem lookups match real
   // filenames. Dynamic route segments like `[slug]` and route groups like
@@ -1727,7 +1800,7 @@ async function handleCore(req, ctx) {
     // Pass the onError sink (issue #239): a server action that throws
     // unexpectedly is reported to the APM hook before the sanitized 500.
     const onActionError = reportError ? (e) => reportError(e, req, 'action') : undefined;
-    return invokeAction(state.actionIndex, actMatch[1], actMatch[2], req, onActionError);
+    return invokeAction(state.actionIndex, actMatch[1], actMatch[2], req, onActionError, allowedOrigins);
   }
 
   // Static: /public/*
@@ -1880,6 +1953,7 @@ async function handleCore(req, ctx) {
         serverFiles: state.actionIndex.fileToHash,
         elidableComponents: state.elidableComponents,
         inertRouteModules: state.inertRouteModules,
+        importOnlyRouteModules: state.importOnlyRouteModules,
         notFoundFile: state.routeTable.notFound,
         // Server HTML cache (#241): a CSP-enabled page emits a fresh
         // per-request nonce into its body, so its bytes vary per request and

package/src/elision-report.js

@@ -0,0 +1,89 @@
+/**
+ * App-level elision report (#646).
+ *
+ * A reporting layer over the `analyzeElision` verdict, NOT a second analysis
+ * and NOT a build (webjs is no-build; elision is the server's analysis pass,
+ * run at dev-server start and re-derived after each fs.watch rebuild). It
+ * builds the module graph, runs `analyzeElision`, and returns the page / layout
+ * route modules that SHIP WHOLE to the browser, each with the first
+ * client-effecting blocker that pins it (or its own signal when the module
+ * itself is the cause).
+ *
+ * Consumed by `webjs doctor` to ADVISE why a page/layout is not elided (an
+ * import-only #605 / inert #179 carrier stays out of the browser; a module that
+ * ships whole does not). Advisory only: a page legitimately MAY ship, and the
+ * analyser is biased toward shipping by design (server AGENTS invariant 7), so
+ * this never fails anything.
+ */
+import { readFile, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+
+import { buildModuleGraph } from './module-graph.js';
+import { scanComponents } from './component-scanner.js';
+import { buildRouteTable } from './router.js';
+import { analyzeElision } from './component-elision.js';
+
+/**
+ * @param {string} appDir
+ * @returns {Promise<{ analysed: boolean, shipped: Array<{ file: string, blocker: string|null, reason: string }> }>}
+ */
+export async function analyzeAppElision(appDir) {
+  // No `app/` means this is not a routable app (a bare component library, a
+  // lib-only fixture); nothing ships, so there is nothing to advise on.
+  if (!(await pathExists(join(appDir, 'app')))) return { analysed: false, shipped: [] };
+  // Elision off (opt-out) ships everything by design, so the advisory is moot.
+  if (!(await readElideEnabled(appDir))) return { analysed: false, shipped: [] };
+
+  let moduleGraph, components, routeTable;
+  try {
+    moduleGraph = await buildModuleGraph(appDir);
+    components = await scanComponents(appDir);
+    routeTable = await buildRouteTable(appDir);
+  } catch {
+    // A malformed app the analysis cannot process degrades to no advice (the
+    // dev server and `webjs check` surface the real problem).
+    return { analysed: false, shipped: [] };
+  }
+
+  // Exactly the page + layout set the dev server feeds to analyzeElision, so
+  // the verdict matches (error / loading / not-found modules always ship and
+  // are never elision candidates, so they are not in scope here).
+  const routeModuleSet = new Set();
+  for (const page of routeTable.pages || []) {
+    if (page.file) routeModuleSet.add(page.file);
+    for (const f of page.layouts || []) routeModuleSet.add(f);
+  }
+
+  const { shippedRouteModules } = await analyzeElision(
+    components, [...routeModuleSet], moduleGraph, (f) => readFile(f, 'utf8'), appDir,
+  );
+
+  const shipped = [...shippedRouteModules.entries()].map(([file, v]) => ({
+    file,
+    blocker: v.blocker,
+    reason: v.reason,
+  }));
+  return { analysed: true, shipped };
+}
+
+/** Mirror of the dev server's elide flag: WEBJS_ELIDE override, then webjs.elide. */
+async function readElideEnabled(appDir) {
+  const raw = process.env.WEBJS_ELIDE;
+  if (raw != null) {
+    const v = raw.trim().toLowerCase();
+    if (v === '0' || v === 'false' || v === 'off' || v === 'no') return false;
+    if (v === '1' || v === 'true' || v === 'on' || v === 'yes') return true;
+  }
+  try {
+    const pkg = JSON.parse(await readFile(join(appDir, 'package.json'), 'utf8'));
+    if (pkg && pkg.webjs && pkg.webjs.elide === false) return false;
+  } catch {
+    // No package.json, malformed JSON, or unreadable: keep the default (on).
+  }
+  return true;
+}
+
+/** @param {string} p @returns {Promise<boolean>} */
+async function pathExists(p) {
+  try { await stat(p); return true; } catch { return false; }
+}

package/src/html-cache.js

@@ -190,10 +190,10 @@ export async function writeHtmlCache(url, rec, revalidateSeconds) {
  *  - status 200 (an error / redirect / 404 is request-specific)
  *  - NOT a streamed Suspense body (it cannot be buffered cheaply, and an
  *    unflushed stream has no stable bytes to cache)
- *  - NO non-framework Set-Cookie. A page that sets a session / per-user
- *    cookie is per-user output and must not be shared. The framework's own
- *    CSRF cookie (`webjs_csrf`) is allowed and re-minted per response on a
- *    cache hit, so its presence does not block caching.
+ *  - NO Set-Cookie at all. A page that sets a session / per-user cookie is
+ *    per-user output and must not be shared. SSR responses no longer carry a
+ *    framework cookie (action CSRF is an Origin / Sec-Fetch-Site check, not a
+ *    token cookie), so ANY Set-Cookie means per-user, do not cache.
  *  - CSP is OFF. With CSP enabled the inline boot script carries a fresh
  *    per-request nonce, so the body varies per request and a cached body
  *    would replay a stale nonce that the response's CSP header rejects.
@@ -206,36 +206,10 @@ export function isCacheableResponse(res, guards = {}) {
   if (res.status !== 200) return false;
   if (res.headers.has(STREAM_MARKER)) return false;
   if (guards.cspEnabled) return false;
-  if (hasNonFrameworkSetCookie(res)) return false;
+  if (res.headers.has('set-cookie')) return false;
   return true;
 }
 
-/**
- * True when the response carries a Set-Cookie OTHER than the framework's
- * own CSRF cookie. Reads each cookie individually via `getSetCookie()`, the
- * only correct way to enumerate multiple Set-Cookie values (a combined
- * `get('set-cookie')` cannot be split safely, since a cookie value or an
- * Expires date can contain a comma). When `getSetCookie` is unavailable
- * (a runtime older than Node 24) this FAILS SAFE: it reports a
- * non-framework cookie (do not cache) rather than parsing only the first of
- * a combined header and wrongly judging it framework-only.
- *
- * @param {Response} res
- * @returns {boolean}
- */
-function hasNonFrameworkSetCookie(res) {
-  const h = res.headers;
-  if (typeof h.getSetCookie !== 'function') {
-    // No reliable per-cookie enumeration: fail safe (treat as per-user).
-    return h.has('set-cookie');
-  }
-  for (const c of h.getSetCookie()) {
-    const name = c.split('=', 1)[0].trim().toLowerCase();
-    if (name !== 'webjs_csrf') return true;
-  }
-  return false;
-}
-
 /**
  * Evict the cached HTML for one path (server-side, on-demand
  * revalidation: the no-build ISR revalidation hook). A server action that