@xeno-js/core 0.1.2 → 0.1.3

package/dist/index.cjs

@@ -1366,8 +1366,7 @@ var init_sentry_logger_factory = __esm({
           dsn: sentryConfig.dsn,
           environment: env,
           tracesSampleRate: env === "production" ? 0.1 : 1,
-          sendDefaultPii: false,
-          integrations: [new Sentry.Integrations.Http({ tracing: true })],
+          integrations: [Sentry.httpIntegration()],
           beforeSend(event, hint) {
             const error = hint.originalException;
             if (error instanceof Error && error.name === "ZodError") {
@@ -1510,15 +1509,15 @@ var init_logger_utils = __esm({
        */
       async addLogger(container, opts) {
         const loggerDependencies = [];
-        const { Guards: Guards39, LOG_LEVEL: LOG_LEVEL7, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
-        if (!Guards39.isDefined(opts) || opts.console) {
+        const { Guards: Guards45, LOG_LEVEL: LOG_LEVEL7, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
+        if (!Guards45.isDefined(opts) || opts.console) {
           const { ConsoleLogger: ConsoleLogger2 } = await Promise.resolve().then(() => (init_console_logger(), console_logger_exports));
           container.addSingleton(TOKENS4.CONSOLE_LOGGER, () => new ConsoleLogger2(opts?.level));
           loggerDependencies.push(TOKENS4.CONSOLE_LOGGER);
         }
         const customLoggerFactories = [];
-        if (Guards39.isDefined(opts)) {
-          if (Guards39.isDefined(opts.sentry.config)) {
+        if (Guards45.isDefined(opts)) {
+          if (Guards45.isDefined(opts.sentry.config)) {
             const { SentryLoggerFactory: SentryLoggerFactory2 } = await Promise.resolve().then(() => (init_sentry_logger_factory(), sentry_logger_factory_exports));
             container.addSingleton(TOKENS4.SENTRY_LOGGER, () => {
               const factory = new SentryLoggerFactory2();
@@ -1526,7 +1525,7 @@ var init_logger_utils = __esm({
             });
             loggerDependencies.push(TOKENS4.SENTRY_LOGGER);
           }
-          if (Guards39.isDefined(opts.pino.config)) {
+          if (Guards45.isDefined(opts.pino.config)) {
             const { PinoLoggerFactory: PinoLoggerFactory2 } = await Promise.resolve().then(() => (init_pino_logger_factory(), pino_logger_factory_exports));
             container.addSingleton(TOKENS4.PINO_LOGGER, () => {
               const factory = new PinoLoggerFactory2();
@@ -1534,10 +1533,10 @@ var init_logger_utils = __esm({
             });
             loggerDependencies.push(TOKENS4.PINO_LOGGER);
           }
-          if (!Guards39.isNullOrEmpty(opts.customLoggers)) {
+          if (!Guards45.isNullOrEmpty(opts.customLoggers)) {
             const customLoggers = opts.customLoggers;
             customLoggers.forEach((f) => {
-              if (Guards39.isDefined(f)) {
+              if (Guards45.isDefined(f)) {
                 customLoggerFactories.push(f);
               }
             });
@@ -1557,12 +1556,34 @@ var init_logger_utils = __esm({
   }
 });
 
+// src/infrastructure/cache/inmemory.cache.ts
+var inmemory_cache_exports = {};
+__export(inmemory_cache_exports, {
+  InMemoryCacheExtended: () => InMemoryCacheExtended
+});
+var import_shared39, InMemoryCacheExtended;
+var init_inmemory_cache = __esm({
+  "src/infrastructure/cache/inmemory.cache.ts"() {
+    "use strict";
+    import_shared39 = require("@xeno-js/shared");
+    InMemoryCacheExtended = class extends import_shared39.InMemoryCache {
+      async increment(key, ttlSeconds) {
+        const current = await this.get(key) ?? 0;
+        const next = Number(current) + 1;
+        const ttl = import_shared39.Guards.isDefined(ttlSeconds) ? Number(ttlSeconds) : 60;
+        await this.set(key, next, ttl);
+        return next;
+      }
+    };
+  }
+});
+
 // src/infrastructure/cache/redis.cache.ts
-var import_shared39, RedisCache;
+var import_shared40, RedisCache;
 var init_redis_cache = __esm({
   "src/infrastructure/cache/redis.cache.ts"() {
     "use strict";
-    import_shared39 = require("@xeno-js/shared");
+    import_shared40 = require("@xeno-js/shared");
     RedisCache = class {
       /**
        * @description Constructs a new instance of the RedisCache class, which takes an instance of the Redis client as a parameter. This client is used to perform caching operations such as setting, getting, and removing values from the Redis database. The constructor initializes the RedisCache with the provided Redis client, allowing it to interact with the Redis server for all caching operations defined in the ICache interface.
@@ -1578,21 +1599,28 @@ var init_redis_cache = __esm({
         this._redisClient = _redisClient;
       }
       _redisClient;
+      async increment(key, ttlSeconds) {
+        const multi = this._redisClient.multi();
+        multi.incr(key);
+        multi.expire(key, ttlSeconds ?? 60);
+        const results = await multi.exec();
+        return results?.[0]?.[1] ?? 1;
+      }
       async get(key) {
         const value = await this._redisClient.get(key);
-        if (!import_shared39.Guards.isDefined(value)) {
+        if (!import_shared40.Guards.isDefined(value)) {
           return void 0;
         }
         return JSON.parse(value);
       }
       async set(key, value, ttl) {
-        const stringValue = import_shared39.StringHelper.safeStringify(value);
-        const ttlOption = import_shared39.Guards.isDefined(ttl) ? ttl : 86400;
+        const stringValue = import_shared40.StringHelper.safeStringify(value);
+        const ttlOption = import_shared40.Guards.isDefined(ttl) ? ttl : 86400;
         await this._redisClient.set(key, stringValue, "EX", ttlOption);
       }
       async setIfAbsent(key, value, ttl) {
-        const stringValue = import_shared39.StringHelper.safeStringify(value);
-        const ttlOption = import_shared39.Guards.isDefined(ttl) ? ttl : 300;
+        const stringValue = import_shared40.StringHelper.safeStringify(value);
+        const ttlOption = import_shared40.Guards.isDefined(ttl) ? ttl : 300;
         const result = await this._redisClient.set(key, stringValue, "EX", ttlOption, "NX");
         return result === "OK";
       }
@@ -1615,11 +1643,11 @@ var redis_cache_factory_exports = {};
 __export(redis_cache_factory_exports, {
   RedisCacheFactory: () => RedisCacheFactory
 });
-var import_shared40, import_ioredis, RedisCacheFactory;
+var import_shared41, import_ioredis, RedisCacheFactory;
 var init_redis_cache_factory = __esm({
   "src/infrastructure/factories/redis-cache.factory.ts"() {
     "use strict";
-    import_shared40 = require("@xeno-js/shared");
+    import_shared41 = require("@xeno-js/shared");
     import_ioredis = require("ioredis");
     init_redis_cache();
     RedisCacheFactory = class {
@@ -1640,10 +1668,10 @@ var init_redis_cache_factory = __esm({
             return delay;
           }
         };
-        if (import_shared40.Guards.isDefined(password)) {
+        if (import_shared41.Guards.isDefined(password)) {
           redisOptions.password = password;
         }
-        if (import_shared40.Guards.isDefined(username)) {
+        if (import_shared41.Guards.isDefined(username)) {
           redisOptions.username = username;
         }
         if (useTls) {
@@ -1681,8 +1709,8 @@ var init_cache_utils = __esm({
        * @link https://github.com/xeno-js/xeno-js
        */
       async addCache(container, opts) {
-        const { Guards: Guards39, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
-        if (!opts.inMemory && !Guards39.isDefined(opts.redis)) {
+        const { Guards: Guards45, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
+        if (!opts.inMemory && !Guards45.isDefined(opts.redis)) {
           throw new Error(
             "No cache strategies are configured. Please provide at least one cache strategy."
           );
@@ -1692,12 +1720,12 @@ var init_cache_utils = __esm({
           TOKENS4.CACHE_KEY_BUILDER,
           (c) => new CacheKeyBuilder(c.resolve(TOKENS4.IDENTITY_ACCESSOR))
         );
-        if (opts.inMemory || !Guards39.isDefined(opts.redis)) {
-          const { InMemoryCache } = await import("@xeno-js/shared");
-          container.addSingleton(TOKENS4.CACHE, () => new InMemoryCache());
+        if (opts.inMemory || !Guards45.isDefined(opts.redis)) {
+          const { InMemoryCacheExtended: InMemoryCacheExtended2 } = await Promise.resolve().then(() => (init_inmemory_cache(), inmemory_cache_exports));
+          container.addSingleton(TOKENS4.CACHE, () => new InMemoryCacheExtended2());
           return;
         }
-        if (Guards39.isDefined(opts.redis)) {
+        if (Guards45.isDefined(opts.redis)) {
           const { RedisCacheFactory: RedisCacheFactory2 } = await Promise.resolve().then(() => (init_redis_cache_factory(), redis_cache_factory_exports));
           container.addSingleton(TOKENS4.CACHE, () => {
             const config = opts.redis;
@@ -1710,11 +1738,11 @@ var init_cache_utils = __esm({
 });
 
 // src/infrastructure/services/allow_methods/allow-method.service.ts
-var import_shared41, AllowMethodRegistry;
+var import_shared42, AllowMethodRegistry;
 var init_allow_method_service = __esm({
   "src/infrastructure/services/allow_methods/allow-method.service.ts"() {
     "use strict";
-    import_shared41 = require("@xeno-js/shared");
+    import_shared42 = require("@xeno-js/shared");
     AllowMethodRegistry = class {
       _staticRoutes = /* @__PURE__ */ new Map();
       _dynamicRoutes = [];
@@ -1730,7 +1758,7 @@ var init_allow_method_service = __esm({
       check(path, method) {
         const cleanPath = this.normalizePath(path.split("?")[0].split("#")[0]);
         const staticMethods = this._staticRoutes.get(cleanPath);
-        if (import_shared41.Guards.isDefined(staticMethods)) return staticMethods.includes(method);
+        if (import_shared42.Guards.isDefined(staticMethods)) return staticMethods.includes(method);
         for (const route of this._dynamicRoutes) {
           if (route.pattern.test(cleanPath)) return route.methods.includes(method);
         }
@@ -1767,18 +1795,18 @@ var init_allow_methods = __esm({
 });
 
 // src/infrastructure/services/allow_origins/allow-origin.http.ts
-var import_shared42, AllowOrigin;
+var import_shared43, AllowOrigin;
 var init_allow_origin_http = __esm({
   "src/infrastructure/services/allow_origins/allow-origin.http.ts"() {
     "use strict";
-    import_shared42 = require("@xeno-js/shared");
+    import_shared43 = require("@xeno-js/shared");
     AllowOrigin = class {
       constructor(_list) {
         this._list = _list;
       }
       _list;
       isAllowed(origin) {
-        if (import_shared42.Guards.isNullOrEmpty(origin)) return true;
+        if (import_shared43.Guards.isNullOrEmpty(origin)) return true;
         const cleanOrigin = origin.trim().toLowerCase();
         for (const pattern of this._list) {
           const cleanPattern = pattern.trim().toLowerCase();
@@ -1788,7 +1816,7 @@ var init_allow_origin_http = __esm({
             const domainSuffix = cleanPattern.substring(1);
             if (cleanOrigin.endsWith(domainSuffix)) {
               const prefix = cleanOrigin.slice(0, cleanOrigin.length - domainSuffix.length);
-              if (!import_shared42.Guards.isNullOrEmpty(prefix) && !prefix.includes(".")) return true;
+              if (!import_shared43.Guards.isNullOrEmpty(prefix) && !prefix.includes(".")) return true;
             }
           }
         }
@@ -1834,25 +1862,125 @@ var init_concurrency = __esm({
   }
 });
 
+// src/infrastructure/services/crypto/crypto.service.ts
+var EdgeCryptoService;
+var init_crypto_service = __esm({
+  "src/infrastructure/services/crypto/crypto.service.ts"() {
+    "use strict";
+    EdgeCryptoService = class {
+      randomBytes(size) {
+        const buffer = new Uint8Array(size);
+        crypto.getRandomValues(buffer);
+        return buffer;
+      }
+      async hmacSha256(secret, data) {
+        const encoder = new TextEncoder();
+        const keyData = encoder.encode(secret);
+        const messageData = encoder.encode(data);
+        const cryptoKey = await crypto.subtle.importKey(
+          "raw",
+          keyData,
+          { name: "HMAC", hash: "SHA-256" },
+          false,
+          ["sign"]
+        );
+        const signature = await crypto.subtle.sign("HMAC", cryptoKey, messageData);
+        return btoa(String.fromCharCode(...new Uint8Array(signature))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+      }
+      timingSafeEqual(a, b) {
+        if (a.length !== b.length) {
+          return false;
+        }
+        let mismatch = 0;
+        for (let i = 0; i < a.length; i++) {
+          mismatch |= a[i] ^ b[i];
+        }
+        return mismatch === 0;
+      }
+    };
+  }
+});
+
+// src/infrastructure/services/crypto/index.ts
+var init_crypto = __esm({
+  "src/infrastructure/services/crypto/index.ts"() {
+    "use strict";
+    init_crypto_service();
+  }
+});
+
+// src/infrastructure/services/csrf/csrf-token.service.ts
+var import_shared44, CsrfTokenService;
+var init_csrf_token_service = __esm({
+  "src/infrastructure/services/csrf/csrf-token.service.ts"() {
+    "use strict";
+    import_shared44 = require("@xeno-js/shared");
+    CsrfTokenService = class {
+      constructor(_secret, _cryptoService) {
+        this._secret = _secret;
+        this._cryptoService = _cryptoService;
+      }
+      _secret;
+      _cryptoService;
+      async generate(subject) {
+        const randomBuffer = this._cryptoService.randomBytes(32);
+        const nonce = btoa(String.fromCharCode(...randomBuffer)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+        const signature = await this._cryptoService.hmacSha256(
+          this._secret,
+          `${subject}.${nonce}`
+        );
+        return `${nonce}.${signature}`;
+      }
+      async validate(token, subject) {
+        const separatorIndex = token.indexOf(".");
+        if (separatorIndex <= 0)
+          return false;
+        const nonce = token.slice(0, separatorIndex);
+        const signature = token.slice(separatorIndex + 1);
+        if (import_shared44.Guards.isNullOrEmpty(nonce) || import_shared44.Guards.isNullOrEmpty(signature))
+          return false;
+        const expected = await this._cryptoService.hmacSha256(
+          this._secret,
+          `${subject}.${nonce}`
+        );
+        const encoder = new TextEncoder();
+        const actualBuffer = encoder.encode(signature);
+        const expectedBuffer = encoder.encode(expected);
+        if (actualBuffer.length !== expectedBuffer.length)
+          return false;
+        return this._cryptoService.timingSafeEqual(actualBuffer, expectedBuffer);
+      }
+    };
+  }
+});
+
+// src/infrastructure/services/csrf/index.ts
+var init_csrf = __esm({
+  "src/infrastructure/services/csrf/index.ts"() {
+    "use strict";
+    init_csrf_token_service();
+  }
+});
+
 // src/infrastructure/services/extractors/extract-bearer.extractor.ts
-var import_shared43, BearerTokenExtractor;
+var import_shared45, BearerTokenExtractor;
 var init_extract_bearer_extractor = __esm({
   "src/infrastructure/services/extractors/extract-bearer.extractor.ts"() {
     "use strict";
-    import_shared43 = require("@xeno-js/shared");
+    import_shared45 = require("@xeno-js/shared");
     BearerTokenExtractor = class {
       extract(headers) {
-        const authHeader = import_shared43.StringHelper.getSingleValue(headers["authorization"]);
-        if (!import_shared43.Guards.isDefined(authHeader)) {
+        const authHeader = import_shared45.StringHelper.getSingleValue(headers["authorization"]);
+        if (!import_shared45.Guards.isDefined(authHeader)) {
           return void 0;
         }
         if (authHeader.toLowerCase().startsWith("bearer ")) {
           return authHeader.substring(7);
         }
-        const cookieHeader = import_shared43.StringHelper.getSingleValue(headers["cookie"]);
-        if (import_shared43.Guards.isDefined(cookieHeader)) {
+        const cookieHeader = import_shared45.StringHelper.getSingleValue(headers["cookie"]);
+        if (import_shared45.Guards.isDefined(cookieHeader)) {
           const match = /sb-access-token=([^;]+)/.exec(cookieHeader);
-          if (!import_shared43.Guards.isNullOrEmpty(match) && import_shared43.Guards.isDefined(match[1])) {
+          if (!import_shared45.Guards.isNullOrEmpty(match) && import_shared45.Guards.isDefined(match[1])) {
             return match[1].trim();
           }
         }
@@ -1863,44 +1991,44 @@ var init_extract_bearer_extractor = __esm({
 });
 
 // src/infrastructure/services/extractors/extract-ssr-bearer.extractor.ts
-var import_shared44, SupabaseSsrTokenExtractor;
+var import_shared46, SupabaseSsrTokenExtractor;
 var init_extract_ssr_bearer_extractor = __esm({
   "src/infrastructure/services/extractors/extract-ssr-bearer.extractor.ts"() {
     "use strict";
-    import_shared44 = require("@xeno-js/shared");
+    import_shared46 = require("@xeno-js/shared");
     SupabaseSsrTokenExtractor = class {
       extract(headers) {
-        const authHeader = import_shared44.StringHelper.getSingleValue(headers["authorization"]);
-        if (import_shared44.Guards.isDefined(authHeader) && authHeader.toLowerCase().startsWith("bearer ")) {
+        const authHeader = import_shared46.StringHelper.getSingleValue(headers["authorization"]);
+        if (import_shared46.Guards.isDefined(authHeader) && authHeader.toLowerCase().startsWith("bearer ")) {
           return authHeader.substring(7);
         }
-        const cookieHeader = import_shared44.StringHelper.getSingleValue(headers["cookie"]);
-        if (import_shared44.Guards.isNullOrEmpty(cookieHeader)) return void 0;
+        const cookieHeader = import_shared46.StringHelper.getSingleValue(headers["cookie"]);
+        if (import_shared46.Guards.isNullOrEmpty(cookieHeader)) return void 0;
         const cookies = cookieHeader.split(";").map((c) => c.trim());
         const tokenChunks = {};
         let unchunkedToken;
         for (const cookie of cookies) {
           const [name, ...rest] = cookie.split("=");
-          if (!import_shared44.Guards.isDefined(name) || import_shared44.Guards.isNullOrEmpty(rest)) continue;
+          if (!import_shared46.Guards.isDefined(name) || import_shared46.Guards.isNullOrEmpty(rest)) continue;
           const value = decodeURIComponent(rest.join("="));
-          if (import_shared44.Guards.isDefined(/^sb-[a-z0-9]+-auth-token$/.exec(name))) {
+          if (import_shared46.Guards.isDefined(/^sb-[a-z0-9]+-auth-token$/.exec(name))) {
             unchunkedToken = value;
           } else {
             const match = /^sb-[a-z0-9]+-auth-token\.(\d+)$/.exec(name);
-            if (import_shared44.Guards.isDefined(match)) tokenChunks[parseInt(match[1], 10)] = value;
+            if (import_shared46.Guards.isDefined(match)) tokenChunks[parseInt(match[1], 10)] = value;
           }
         }
         let fullTokenString = unchunkedToken;
-        if (!import_shared44.Guards.isDefined(fullTokenString) && Object.keys(tokenChunks).length > 0) {
+        if (!import_shared46.Guards.isDefined(fullTokenString) && Object.keys(tokenChunks).length > 0) {
           const indices = Object.keys(tokenChunks).map(Number).sort((a, b) => a - b);
           fullTokenString = indices.map((i) => tokenChunks[i]).join("");
         }
-        if (import_shared44.Guards.isNullOrEmpty(fullTokenString)) return void 0;
+        if (import_shared46.Guards.isNullOrEmpty(fullTokenString)) return void 0;
         try {
-          const parsed = import_shared44.StringHelper.safeParse(fullTokenString);
-          if (import_shared44.Guards.isDefined(parsed) && import_shared44.Guards.isObject(parsed) && "access_token" in parsed) {
+          const parsed = import_shared46.StringHelper.safeParse(fullTokenString);
+          if (import_shared46.Guards.isDefined(parsed) && import_shared46.Guards.isObject(parsed) && "access_token" in parsed) {
             const accessToken = parsed["access_token"];
-            if (import_shared44.Guards.isString(accessToken)) return accessToken;
+            if (import_shared46.Guards.isString(accessToken)) return accessToken;
           }
         } catch {
           return void 0;
@@ -1910,12 +2038,42 @@ var init_extract_ssr_bearer_extractor = __esm({
   }
 });
 
+// src/infrastructure/services/extractors/http-cookie.extractor.ts
+var import_shared47, HttpCookieExtractor;
+var init_http_cookie_extractor = __esm({
+  "src/infrastructure/services/extractors/http-cookie.extractor.ts"() {
+    "use strict";
+    import_shared47 = require("@xeno-js/shared");
+    HttpCookieExtractor = class {
+      extract(cookie) {
+        if (!import_shared47.Guards.isDefined(cookie.header))
+          return void 0;
+        for (const rawCookie of cookie.header.split(";")) {
+          const separatorIndex = rawCookie.indexOf("=");
+          if (separatorIndex <= 0)
+            continue;
+          const name = rawCookie.slice(0, separatorIndex).trim();
+          if (name !== cookie.name)
+            continue;
+          const value = rawCookie.slice(separatorIndex + 1).trim();
+          try {
+            return decodeURIComponent(value);
+          } catch {
+            return void 0;
+          }
+        }
+        return void 0;
+      }
+    };
+  }
+});
+
 // src/infrastructure/services/extractors/http-header.extractor.ts
-var import_shared45, HttpHeaderExtractor;
+var import_shared48, HttpHeaderExtractor;
 var init_http_header_extractor = __esm({
   "src/infrastructure/services/extractors/http-header.extractor.ts"() {
     "use strict";
-    import_shared45 = require("@xeno-js/shared");
+    import_shared48 = require("@xeno-js/shared");
     HttpHeaderExtractor = class {
       /**
        * @description Constructor for HttpHeaderExtractor. It takes an instance of IServiceExtractor for extracting Bearer tokens, allowing for separation of concerns and adherence to the Single Responsibility Principle (SRP). This design enables the HttpHeaderExtractor to focus on general header extraction while delegating the specific logic of Bearer token extraction to a dedicated extractor, promoting code reusability and maintainability.
@@ -1926,32 +2084,43 @@ var init_http_header_extractor = __esm({
        * @since 2025-09-30
        * @link https://github.com/xeno-js/xeno-js 
        */
-      constructor(_bearerExtractor, _trustedIp) {
+      constructor(_bearerExtractor, _cookieExtractor, _trustedIp, _cookieName) {
         this._bearerExtractor = _bearerExtractor;
+        this._cookieExtractor = _cookieExtractor;
         this._trustedIp = _trustedIp;
+        this._cookieName = _cookieName;
       }
       _bearerExtractor;
+      _cookieExtractor;
       _trustedIp;
+      _cookieName;
       extract(headers) {
-        const correlationId = import_shared45.GuidHelper.parse(import_shared45.StringHelper.getSingleValue(headers["x-correlation-id"]));
-        const requestId = import_shared45.GuidHelper.parse(import_shared45.StringHelper.getSingleValue(headers["x-request-id"]));
+        const correlationId = import_shared48.GuidHelper.parse(import_shared48.StringHelper.getSingleValue(headers["x-correlation-id"]));
+        const requestId = import_shared48.GuidHelper.parse(import_shared48.StringHelper.getSingleValue(headers["x-request-id"]));
         const token = this._bearerExtractor.extract(headers);
-        const clientIp = import_shared45.StringHelper.getSingleValue(headers[this._trustedIp?.toLowerCase() ?? "x-forwarded-for"]) ?? import_shared45.StringHelper.getSingleValue(headers["x-real-ip"]);
-        const spanId = import_shared45.GuidHelper.parse(import_shared45.StringHelper.getSingleValue(headers["x-span-id"]));
-        const parentSpanId = import_shared45.StringHelper.getSingleValue(headers["x-parent-span-id"]);
-        const acceptHeader = import_shared45.StringHelper.getSingleValue(headers["accept"]);
-        const contentTypeHeader = import_shared45.StringHelper.getSingleValue(headers["content-type"]);
-        const userAgent = import_shared45.StringHelper.getSingleValue(headers["user-agent"]);
-        const returnAddress = import_shared45.StringHelper.getSingleValue(headers["x-return-address"]);
-        const sequenceId = import_shared45.StringHelper.getSingleValue(headers["x-sequence-id"]);
-        const position = import_shared45.StringHelper.getSingleValue(headers["x-sequence-position"]);
-        const size = import_shared45.StringHelper.getSingleValue(headers["x-sequence-size"]);
-        const expiration = import_shared45.StringHelper.getSingleValue(headers["x-expiration"]);
-        const csrf = import_shared45.StringHelper.getSingleValue(headers["x-requested-with"]);
-        const origin = import_shared45.StringHelper.getSingleValue(headers["origin"]);
-        const cleanOrigin = import_shared45.HttpHelper.sanitizeOriginUrl(origin);
-        const referer = import_shared45.StringHelper.getSingleValue(headers["referer"]);
-        const cleanReferer = import_shared45.HttpHelper.sanitizeOriginUrl(referer);
+        const clientIp = import_shared48.StringHelper.getSingleValue(headers[this._trustedIp?.toLowerCase() ?? "x-forwarded-for"]) ?? import_shared48.StringHelper.getSingleValue(headers["x-real-ip"]);
+        const spanId = import_shared48.GuidHelper.parse(import_shared48.StringHelper.getSingleValue(headers["x-span-id"]));
+        const parentSpanId = import_shared48.StringHelper.getSingleValue(headers["x-parent-span-id"]);
+        const acceptHeader = import_shared48.StringHelper.getSingleValue(headers["accept"]);
+        const contentTypeHeader = import_shared48.StringHelper.getSingleValue(headers["content-type"]);
+        const userAgent = import_shared48.StringHelper.getSingleValue(headers["user-agent"]);
+        const returnAddress = import_shared48.StringHelper.getSingleValue(headers["x-return-address"]);
+        const sequenceId = import_shared48.StringHelper.getSingleValue(headers["x-sequence-id"]);
+        const position = import_shared48.StringHelper.getSingleValue(headers["x-sequence-position"]);
+        const size = import_shared48.StringHelper.getSingleValue(headers["x-sequence-size"]);
+        const expiration = import_shared48.StringHelper.getSingleValue(headers["x-expiration"]);
+        const csrf = import_shared48.StringHelper.getSingleValue(headers["x-csrf-token"]);
+        const cookieHeader = import_shared48.StringHelper.getSingleValue(headers["cookie"]);
+        const csrfCookie = this._cookieExtractor.extract(
+          {
+            header: cookieHeader,
+            name: this._cookieName
+          }
+        );
+        const origin = import_shared48.StringHelper.getSingleValue(headers["origin"]);
+        const cleanOrigin = import_shared48.HttpHelper.sanitizeOriginUrl(origin);
+        const referer = import_shared48.StringHelper.getSingleValue(headers["referer"]);
+        const cleanReferer = import_shared48.HttpHelper.sanitizeOriginUrl(referer);
         const accept = acceptHeader === "*/*" ? void 0 : acceptHeader;
         const formatIndicator = accept ?? contentTypeHeader ?? "application/json";
         const metadata = {
@@ -1965,14 +2134,15 @@ var init_http_header_extractor = __esm({
           userAgent,
           returnAddress,
           csrf,
+          csrfCookie,
           origin: cleanOrigin,
           referer: cleanReferer,
           sequence: {
             sequenceId,
-            position: import_shared45.Guards.isDefined(position) ? import_shared45.MathHelper.toNumber(position) : void 0,
-            size: import_shared45.Guards.isDefined(size) ? import_shared45.MathHelper.toNumber(size) : void 0
+            position: import_shared48.Guards.isDefined(position) ? import_shared48.MathHelper.toNumber(position) : void 0,
+            size: import_shared48.Guards.isDefined(size) ? import_shared48.MathHelper.toNumber(size) : void 0
           },
-          expiration: import_shared45.Guards.isDefined(expiration) ? import_shared45.MathHelper.toNumber(expiration) : void 0
+          expiration: import_shared48.Guards.isDefined(expiration) ? import_shared48.MathHelper.toNumber(expiration) : void 0
         };
         return metadata;
       }
@@ -1986,23 +2156,24 @@ var init_extractors = __esm({
     "use strict";
     init_extract_bearer_extractor();
     init_extract_ssr_bearer_extractor();
+    init_http_cookie_extractor();
     init_http_header_extractor();
   }
 });
 
 // src/infrastructure/services/resiliences/resilience.service.ts
-var import_shared46, ServiceResilience;
+var import_shared49, ServiceResilience;
 var init_resilience_service = __esm({
   "src/infrastructure/services/resiliences/resilience.service.ts"() {
     "use strict";
-    import_shared46 = require("@xeno-js/shared");
+    import_shared49 = require("@xeno-js/shared");
     ServiceResilience = class {
       constructor(policy) {
         this.policy = policy;
       }
       policy;
       async execute(operation, signal) {
-        import_shared46.AppError.throwIfAborted(signal, "ServiceResilience.execute");
+        import_shared49.AppError.throwIfAborted(signal, "ServiceResilience.execute");
         return this.policy.execute(() => operation(), signal);
       }
     };
@@ -2017,12 +2188,82 @@ var init_resiliences = __esm({
   }
 });
 
+// src/infrastructure/services/resolver/utils/socket.utils.ts
+var import_shared50, SocketIpExtractor;
+var init_socket_utils = __esm({
+  "src/infrastructure/services/resolver/utils/socket.utils.ts"() {
+    "use strict";
+    import_shared50 = require("@xeno-js/shared");
+    SocketIpExtractor = Object.freeze({
+      /**
+       * @description Extracts the IP address of the remote socket from an incoming request.
+       * @param req The incoming request object.
+       * @returns The IP address of the remote socket, or undefined if not available.
+       */
+      extract(req) {
+        if (import_shared50.Guards.isDefined(req) && import_shared50.Guards.isObject(req)) {
+          const candidate = req;
+          return candidate.socket?.remoteAddress ?? candidate.connection?.remoteAddress;
+        }
+        return void 0;
+      }
+    });
+  }
+});
+
+// src/infrastructure/services/resolver/utils/index.ts
+var init_utils = __esm({
+  "src/infrastructure/services/resolver/utils/index.ts"() {
+    "use strict";
+    init_socket_utils();
+  }
+});
+
+// src/infrastructure/services/resolver/client-ip.resolver.ts
+var import_shared51, ClientIpResolver;
+var init_client_ip_resolver = __esm({
+  "src/infrastructure/services/resolver/client-ip.resolver.ts"() {
+    "use strict";
+    import_shared51 = require("@xeno-js/shared");
+    init_utils();
+    ClientIpResolver = class {
+      constructor(_trustedProxies = []) {
+        this._trustedProxies = _trustedProxies;
+      }
+      _trustedProxies;
+      resolve(req, clientIp) {
+        const socketIp = SocketIpExtractor.extract(req);
+        if (!import_shared51.Guards.isDefined(socketIp))
+          return !import_shared51.Guards.isNullOrEmpty(clientIp) ? clientIp.split(",")[0].trim() : void 0;
+        const isTrustedProxy = this._trustedProxies.includes(socketIp);
+        if (!isTrustedProxy)
+          return socketIp;
+        if (import_shared51.Guards.isDefined(clientIp))
+          return clientIp.split(",")[0].trim();
+        return socketIp;
+      }
+    };
+  }
+});
+
+// src/infrastructure/services/resolver/index.ts
+var init_resolver = __esm({
+  "src/infrastructure/services/resolver/index.ts"() {
+    "use strict";
+    init_client_ip_resolver();
+  }
+});
+
 // src/infrastructure/services/index.ts
 var services_exports = {};
 __export(services_exports, {
   AllowMethodRegistry: () => AllowMethodRegistry,
   AllowOrigin: () => AllowOrigin,
   BearerTokenExtractor: () => BearerTokenExtractor,
+  ClientIpResolver: () => ClientIpResolver,
+  CsrfTokenService: () => CsrfTokenService,
+  EdgeCryptoService: () => EdgeCryptoService,
+  HttpCookieExtractor: () => HttpCookieExtractor,
   HttpHeaderExtractor: () => HttpHeaderExtractor,
   PLimitConcurrencyService: () => PLimitConcurrencyService,
   ServiceResilience: () => ServiceResilience,
@@ -2034,8 +2275,11 @@ var init_services = __esm({
     init_allow_methods();
     init_allow_origins();
     init_concurrency();
+    init_crypto();
+    init_csrf();
     init_extractors();
     init_resiliences();
+    init_resolver();
   }
 });
 
@@ -2058,15 +2302,15 @@ var init_allow_method_factory = __esm({
 });
 
 // src/infrastructure/factories/axios.factory.ts
-var import_node_http, import_node_https, import_shared47, import_axios, NodeAxiosFactory;
+var import_node_http, import_node_https, import_shared52, import_axios, NodeAxiosFactory;
 var init_axios_factory = __esm({
   "src/infrastructure/factories/axios.factory.ts"() {
     "use strict";
     import_node_http = __toESM(require("http"), 1);
     import_node_https = __toESM(require("https"), 1);
-    import_shared47 = require("@xeno-js/shared");
+    import_shared52 = require("@xeno-js/shared");
     import_axios = __toESM(require("axios"), 1);
-    NodeAxiosFactory = class extends import_shared47.AxiosFactory {
+    NodeAxiosFactory = class extends import_shared52.AxiosFactory {
       create(config) {
         const isKeepAlive = config.keepAlive ?? true;
         const maxSockets = config.maxSockets ?? 100;
@@ -2091,18 +2335,18 @@ var init_axios_factory = __esm({
           proxy: config.proxy,
           withCredentials: config.withCredentials
         });
-        return new import_shared47.AxiosHttpClient(axiosInstance);
+        return new import_shared52.AxiosHttpClient(axiosInstance);
       }
     };
   }
 });
 
 // src/infrastructure/factories/cockatiel-resilience.factory.ts
-var import_shared48, import_cockatiel, CockatielResilienceFactory;
+var import_shared53, import_cockatiel, CockatielResilienceFactory;
 var init_cockatiel_resilience_factory = __esm({
   "src/infrastructure/factories/cockatiel-resilience.factory.ts"() {
     "use strict";
-    import_shared48 = require("@xeno-js/shared");
+    import_shared53 = require("@xeno-js/shared");
     import_cockatiel = require("cockatiel");
     init_resilience_service();
     CockatielResilienceFactory = class {
@@ -2112,36 +2356,36 @@ var init_cockatiel_resilience_factory = __esm({
           retry: {
             attempts: this.checkConfigValue(
               config.retry.attempts,
-              import_shared48.RESILIENCE_DEFAULTS.RETRY.ATTEMPTS,
+              import_shared53.RESILIENCE_DEFAULTS.RETRY.ATTEMPTS,
               message
             ),
             baseDelayMs: this.checkConfigValue(
               config.retry.baseDelayMs,
-              import_shared48.RESILIENCE_DEFAULTS.RETRY.BASE_DELAY_MS,
+              import_shared53.RESILIENCE_DEFAULTS.RETRY.BASE_DELAY_MS,
               message
             ),
             maxDelayMs: this.checkConfigValue(
               config.retry.maxDelayMs,
-              import_shared48.RESILIENCE_DEFAULTS.RETRY.MAX_DELAY_MS,
+              import_shared53.RESILIENCE_DEFAULTS.RETRY.MAX_DELAY_MS,
               message
             )
           },
           circuitBreaker: {
             consecutiveFailures: this.checkConfigValue(
               config.circuitBreaker.consecutiveFailures,
-              import_shared48.RESILIENCE_DEFAULTS.CIRCUIT_BREAKER.CONSECUTIVE_FAILURES,
+              import_shared53.RESILIENCE_DEFAULTS.CIRCUIT_BREAKER.CONSECUTIVE_FAILURES,
               message
             ),
             halfOpenTimeoutMs: this.checkConfigValue(
               config.circuitBreaker.halfOpenTimeoutMs,
-              import_shared48.RESILIENCE_DEFAULTS.CIRCUIT_BREAKER.HALF_OPEN_TIMEOUT_MS,
+              import_shared53.RESILIENCE_DEFAULTS.CIRCUIT_BREAKER.HALF_OPEN_TIMEOUT_MS,
               message
             )
           },
           bulkhead: {
             maxConcurrent: this.checkConfigValue(
               config.bulkhead.maxConcurrent,
-              import_shared48.RESILIENCE_DEFAULTS.BULKHEAD.MAX_CONCURRENT,
+              import_shared53.RESILIENCE_DEFAULTS.BULKHEAD.MAX_CONCURRENT,
               message
             )
           }
@@ -2167,13 +2411,13 @@ var init_cockatiel_resilience_factory = __esm({
         return new ServiceResilience((0, import_cockatiel.wrap)(bulkheadPolicy, circuitBreakerPolicy, retryPolicy));
       }
       isTransientError(error) {
-        if (!import_shared48.Guards.isDefined(error) || !import_shared48.Guards.isObject(error)) return false;
+        if (!import_shared53.Guards.isDefined(error) || !import_shared53.Guards.isObject(error)) return false;
         let status;
         let isNetworkError = false;
-        if (error instanceof import_shared48.AppError) {
+        if (error instanceof import_shared53.AppError) {
           status = error.status;
           const cause = error.cause;
-          if (import_shared48.Guards.isDefined(cause) && import_shared48.Guards.isString(cause.code)) {
+          if (import_shared53.Guards.isDefined(cause) && import_shared53.Guards.isString(cause.code)) {
             isNetworkError = [
               "ECONNABORTED",
               "ECONNRESET",
@@ -2185,7 +2429,7 @@ var init_cockatiel_resilience_factory = __esm({
         } else {
           const err = error;
           status = err.status;
-          if (import_shared48.Guards.isString(err.code)) {
+          if (import_shared53.Guards.isString(err.code)) {
             isNetworkError = [
               "ECONNABORTED",
               "ECONNRESET",
@@ -2196,7 +2440,7 @@ var init_cockatiel_resilience_factory = __esm({
           }
         }
         if (isNetworkError) return true;
-        if (import_shared48.Guards.isDefined(status)) {
+        if (import_shared53.Guards.isDefined(status)) {
           return status === 408 || status === 429 || status >= 500 && status < 600;
         }
         return false;
@@ -2204,24 +2448,24 @@ var init_cockatiel_resilience_factory = __esm({
       isTransientAndIdempotent(error) {
         if (!this.isTransientError(error)) return false;
         let method;
-        if (error instanceof import_shared48.AppError) {
+        if (error instanceof import_shared53.AppError) {
           const cause = error.cause;
-          if (import_shared48.Guards.isDefined(cause) && import_shared48.Guards.isDefined(cause.config) && import_shared48.Guards.isString(cause.config.method)) {
+          if (import_shared53.Guards.isDefined(cause) && import_shared53.Guards.isDefined(cause.config) && import_shared53.Guards.isString(cause.config.method)) {
             method = cause.config.method.toUpperCase();
           }
         } else {
           const err = error;
-          if (import_shared48.Guards.isDefined(err.config) && import_shared48.Guards.isString(err.config.method)) {
+          if (import_shared53.Guards.isDefined(err.config) && import_shared53.Guards.isString(err.config.method)) {
             method = err.config.method.toUpperCase();
           }
         }
-        if (import_shared48.Guards.isNullOrEmpty(method)) return false;
+        if (import_shared53.Guards.isNullOrEmpty(method)) return false;
         const idempotentMethods = ["GET", "PUT", "DELETE", "HEAD", "OPTIONS"];
         return idempotentMethods.includes(method);
       }
       checkConfigValue(value, defaultValue, message) {
-        if (import_shared48.Guards.isDefined(value)) {
-          import_shared48.Guards.throwIfNegative(value, message);
+        if (import_shared53.Guards.isDefined(value)) {
+          import_shared53.Guards.throwIfNegative(value, message);
           return value;
         }
         return defaultValue;
@@ -2253,11 +2497,11 @@ var init_db_client_factory = __esm({
 });
 
 // src/infrastructure/context/request-context.ts
-var import_shared49, NodeRequestContext;
+var import_shared54, NodeRequestContext;
 var init_request_context = __esm({
   "src/infrastructure/context/request-context.ts"() {
     "use strict";
-    import_shared49 = require("@xeno-js/shared");
+    import_shared54 = require("@xeno-js/shared");
     NodeRequestContext = class {
       /**
        * @description Constructs a new instance of the NodeRequestContext class, which requires an instance of AsyncLocalStorage to manage the request context. The AsyncLocalStorage instance is used to create and access the context for each request, allowing for the storage of identity information and other relevant data that needs to be accessible across asynchronous operations. This constructor initializes the NodeRequestContext with the provided AsyncLocalStorage, enabling it to implement the methods defined in the IRequestContext interface for managing request-specific context data.
@@ -2285,7 +2529,7 @@ var init_request_context = __esm({
       }
       updateIdentity(identity) {
         const store = this._storage.getStore();
-        if (import_shared49.Guards.isDefined(store) && import_shared49.Guards.isDefined(store.context)) {
+        if (import_shared54.Guards.isDefined(store) && import_shared54.Guards.isDefined(store.context)) {
           store.context = Object.freeze({
             ...store.context,
             identity: Object.freeze(identity)
@@ -2294,23 +2538,23 @@ var init_request_context = __esm({
       }
       getContext() {
         const store = this._storage.getStore();
-        if (!import_shared49.Guards.isDefined(store)) return void 0;
+        if (!import_shared54.Guards.isDefined(store)) return void 0;
         const context = store.context;
         return Object.freeze(context);
       }
       getIdentity() {
         const store = this._storage.getStore();
-        if (!import_shared49.Guards.isDefined(store)) return void 0;
+        if (!import_shared54.Guards.isDefined(store)) return void 0;
         return Object.freeze(store.context?.identity);
       }
       getScope() {
         const store = this._storage.getStore();
-        if (!import_shared49.Guards.isDefined(store)) return void 0;
+        if (!import_shared54.Guards.isDefined(store)) return void 0;
         return store.scope;
       }
       getNetworkContext() {
         const store = this._storage.getStore();
-        if (!import_shared49.Guards.isDefined(store)) return void 0;
+        if (!import_shared54.Guards.isDefined(store)) return void 0;
         return Object.freeze(store.context?.network);
       }
     };
@@ -2383,18 +2627,18 @@ var init_sql_light_db_client_factory = __esm({
 });
 
 // src/infrastructure/factories/supabase.factory.ts
-var import_ssr, import_shared50, SupabaseServerAuthFactory;
+var import_ssr, import_shared55, SupabaseServerAuthFactory;
 var init_supabase_factory = __esm({
   "src/infrastructure/factories/supabase.factory.ts"() {
     "use strict";
     import_ssr = require("@supabase/ssr");
-    import_shared50 = require("@xeno-js/shared");
+    import_shared55 = require("@xeno-js/shared");
     SupabaseServerAuthFactory = class {
       create({
         config,
         container
       }) {
-        if (!import_shared50.Guards.isDefined(config.ssrOpts)) {
+        if (!import_shared55.Guards.isDefined(config.ssrOpts)) {
           throw new Error("ISsrCookieHandler is required for @supabase/ssr initialization.");
         }
         const cookieService = config.ssrOpts(container);
@@ -2409,9 +2653,9 @@ var init_supabase_factory = __esm({
             }
           }
         });
-        const mapper = new import_shared50.SupabaseClaimsMapper();
-        const sessionMapper = new import_shared50.SupabaseSessionMapper(mapper);
-        return new import_shared50.SupabaseAuthService(client, mapper, sessionMapper, config);
+        const mapper = new import_shared55.SupabaseClaimsMapper();
+        const sessionMapper = new import_shared55.SupabaseSessionMapper(mapper);
+        return new import_shared55.SupabaseAuthService(client, mapper, sessionMapper, config);
       }
     };
   }
@@ -2422,11 +2666,11 @@ var user_context_factory_exports = {};
 __export(user_context_factory_exports, {
   UserContextFactory: () => UserContextFactory
 });
-var import_shared51, UserContextFactory;
+var import_shared56, UserContextFactory;
 var init_user_context_factory = __esm({
   "src/infrastructure/factories/user-context.factory.ts"() {
     "use strict";
-    import_shared51 = require("@xeno-js/shared");
+    import_shared56 = require("@xeno-js/shared");
     UserContextFactory = class {
       /**
        * @description Constructs an instance of UserContextFactory.
@@ -2447,7 +2691,7 @@ var init_user_context_factory = __esm({
           tenantId: void 0
         };
         const identity = this._identityFactory.getIdentity();
-        if (import_shared51.Guards.isDefined(identity)) {
+        if (import_shared56.Guards.isDefined(identity)) {
           output.userId = identity.userId;
           output.tenantId = identity.tenantId;
         }
@@ -2462,14 +2706,14 @@ var zod_validator_factory_exports = {};
 __export(zod_validator_factory_exports, {
   ZodValidatorFactory: () => ZodValidatorFactory
 });
-var import_shared52, ZodValidatorFactory;
+var import_shared57, ZodValidatorFactory;
 var init_zod_validator_factory = __esm({
   "src/infrastructure/factories/zod-validator.factory.ts"() {
     "use strict";
-    import_shared52 = require("@xeno-js/shared");
+    import_shared57 = require("@xeno-js/shared");
     ZodValidatorFactory = class {
       create(opts) {
-        const validatorService = new import_shared52.ZodValidatorService(/* @__PURE__ */ new Map(), opts.logger);
+        const validatorService = new import_shared57.ZodValidatorService(/* @__PURE__ */ new Map(), opts.logger);
         for (const [intentKey, schema] of Object.entries(opts.schemas)) {
           validatorService.addSchema(intentKey, schema);
         }
@@ -2540,8 +2784,8 @@ var init_auth_utils = __esm({
         const { TOKENS: TOKENS4 } = await import("@xeno-js/shared");
         const pipelines = [];
         const strategies = [];
-        const { Guards: Guards39 } = await import("@xeno-js/shared");
-        if (Guards39.isDefined(opts.policies)) {
+        const { Guards: Guards45 } = await import("@xeno-js/shared");
+        if (Guards45.isDefined(opts.policies)) {
           const { PolicyRegistry: PolicyRegistry2 } = await Promise.resolve().then(() => (init_application(), application_exports));
           container.addSingleton(TOKENS4.POLICY_REGISTRY, () => new PolicyRegistry2());
           const policyRegistry = opts.policies;
@@ -2550,16 +2794,16 @@ var init_auth_utils = __esm({
           for (const [intent, policy] of Object.entries(policyRegistry)) {
             const intentLower = intent.toLowerCase();
             registryInstance.addPolicy(intentLower, policy);
-            if (!Guards39.isNullOrEmpty(policy.roles)) {
+            if (!Guards45.isNullOrEmpty(policy.roles)) {
               Policies.add("roles");
             }
-            if (!Guards39.isNullOrEmpty(policy.permissions)) {
+            if (!Guards45.isNullOrEmpty(policy.permissions)) {
               Policies.add("permissions");
             }
-            if (!Guards39.isNullOrEmpty(policy.userId)) {
+            if (!Guards45.isNullOrEmpty(policy.userId)) {
               Policies.add("userId");
             }
-            if (!Guards39.isNullOrEmpty(policy.tenantId)) {
+            if (!Guards45.isNullOrEmpty(policy.tenantId)) {
               Policies.add("tenantId");
             }
           }
@@ -2608,10 +2852,10 @@ var init_auth_utils = __esm({
             strategies.push(TOKENS4.TENANT_AUTHORIZATION_PIPELINE);
           }
         }
-        if (!Guards39.isNullOrEmpty(opts.customAuthorizationStrategy)) {
+        if (!Guards45.isNullOrEmpty(opts.customAuthorizationStrategy)) {
           const customStrategies = opts.customAuthorizationStrategy;
           customStrategies.forEach((strategyToken, index) => {
-            if (Guards39.isDefined(strategyToken)) {
+            if (Guards45.isDefined(strategyToken)) {
               const token = `CUSTOM_AUTHORIZATION_STRATEGY_${index}`;
               container.addSingleton(token, (c) => {
                 return strategyToken(c);
@@ -2753,12 +2997,12 @@ var unit_of_work_exports = {};
 __export(unit_of_work_exports, {
   UnitOfWork: () => UnitOfWork
 });
-var import_shared53, import_shared54, UnitOfWork;
+var import_shared58, import_shared59, UnitOfWork;
 var init_unit_of_work = __esm({
   "src/infrastructure/transaction/unit-of-work.ts"() {
     "use strict";
-    import_shared53 = require("@xeno-js/shared");
-    import_shared54 = require("@xeno-js/shared");
+    import_shared58 = require("@xeno-js/shared");
+    import_shared59 = require("@xeno-js/shared");
     UnitOfWork = class {
       /**
        * Creates an instance of UnitOfWork.
@@ -2777,7 +3021,7 @@ var init_unit_of_work = __esm({
       _dbContext;
       _ttx;
       async runInTransaction(callback, signal) {
-        import_shared53.AppError.throwIfAborted(signal, "UnitOfWork.runInTransaction");
+        import_shared58.AppError.throwIfAborted(signal, "UnitOfWork.runInTransaction");
         return this._dbContext.transaction(async (tx) => {
           this._ttx.state = tx;
           try {
@@ -2789,9 +3033,9 @@ var init_unit_of_work = __esm({
         });
       }
       async dispose() {
-        if (import_shared54.Guards.isDefined(this._ttx.state)) {
+        if (import_shared59.Guards.isDefined(this._ttx.state)) {
           try {
-            if (import_shared54.Guards.hasMethod(this._ttx.state, "rollback")) {
+            if (import_shared59.Guards.hasMethod(this._ttx.state, "rollback")) {
               await this._ttx.state.rollback();
             }
           } finally {
@@ -2814,7 +3058,7 @@ var init_db_module = __esm({
     "use strict";
     DbModule = class {
       async configure(container, opts) {
-        const { Guards: Guards39, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
+        const { Guards: Guards45, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
         const { DbUtils: DbUtils2 } = await Promise.resolve().then(() => (init_db_utils(), db_utils_exports));
         const db = opts.enableSqlLite ? await DbUtils2.addSqlLite(opts) : await DbUtils2.addDbClient(opts);
         const { TransactionState: TransactionState2 } = await Promise.resolve().then(() => (init_transaction_state(), transaction_state_exports));
@@ -2831,7 +3075,7 @@ var init_db_module = __esm({
           return new Proxy(db, {
             get(_target, prop, receiver) {
               const activeState = ttx.state;
-              if (Guards39.isDefined(activeState)) {
+              if (Guards45.isDefined(activeState)) {
                 if (prop === "transaction") {
                   return activeState.transaction.bind(activeState);
                 }
@@ -2868,14 +3112,14 @@ var init_http_utils = __esm({
        */
       async addAxios(container, opts) {
         const { NodeAxiosFactory: NodeAxiosFactory2 } = await Promise.resolve().then(() => (init_factories(), factories_exports));
-        const { Guards: Guards39 } = await import("@xeno-js/shared");
-        if (!Guards39.isDefined(opts.token)) {
+        const { Guards: Guards45 } = await import("@xeno-js/shared");
+        if (!Guards45.isDefined(opts.token)) {
           throw new Error("HttpConfig.token is required and must be defined.");
         }
         container.addSingleton(opts.token, () => {
           const factory = new NodeAxiosFactory2();
           const instance = factory.create(opts.client);
-          if (!Guards39.hasMethod(instance, "get") || !Guards39.hasMethod(instance, "post") || !Guards39.hasMethod(instance, "put") || !Guards39.hasMethod(instance, "patch") || !Guards39.hasMethod(instance, "delete")) {
+          if (!Guards45.hasMethod(instance, "get") || !Guards45.hasMethod(instance, "post") || !Guards45.hasMethod(instance, "put") || !Guards45.hasMethod(instance, "patch") || !Guards45.hasMethod(instance, "delete")) {
             throw new Error(
               "The created HTTP client instance does not implement the required methods of IHttpClient."
             );
@@ -2902,8 +3146,8 @@ var init_http_utils = __esm({
         });
       },
       async addAllowOrigin(container, opts) {
-        const { Guards: Guards39 } = await import("@xeno-js/shared");
-        if (Guards39.isNullOrEmpty(opts)) throw new Error("At least an allow origin must be passed");
+        const { Guards: Guards45 } = await import("@xeno-js/shared");
+        if (Guards45.isNullOrEmpty(opts)) throw new Error("At least an allow origin must be passed");
         const { TOKENS: TOKENS4 } = await import("@xeno-js/shared");
         const { AllowOrigin: AllowOrigin2 } = await Promise.resolve().then(() => (init_services(), services_exports));
         const allowOrigin = [];
@@ -2963,13 +3207,13 @@ var init_validation_utils = __esm({
        * @link https://github.com/xeno-js/xeno-js
        */
       async addValidation(container, opts, logger) {
-        const { Guards: Guards39, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
-        if (!Guards39.isDefined(opts.zod) && Guards39.isNullOrEmpty(opts.customValidationStrategy)) {
+        const { Guards: Guards45, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
+        if (!Guards45.isDefined(opts.zod) && Guards45.isNullOrEmpty(opts.customValidationStrategy)) {
           return [];
         }
         const pipelines = [];
         const validationStrategies = [];
-        if (Guards39.isDefined(opts.zod)) {
+        if (Guards45.isDefined(opts.zod)) {
           const config = opts.zod;
           const { ZodValidatorFactory: ZodValidatorFactory2 } = await Promise.resolve().then(() => (init_zod_validator_factory(), zod_validator_factory_exports));
           container.addSingleton(TOKENS4.ZOD_VALIDATOR, () => {
@@ -2983,9 +3227,9 @@ var init_validation_utils = __esm({
           validationStrategies.push(TOKENS4.SCHEMA_VALIDATION_STRATEGY);
         }
         const customValidationFactory = [];
-        if (!Guards39.isNullOrEmpty(opts.customValidationStrategy)) {
+        if (!Guards45.isNullOrEmpty(opts.customValidationStrategy)) {
           for (const strategyToken of opts.customValidationStrategy) {
-            if (Guards39.isDefined(strategyToken)) {
+            if (Guards45.isDefined(strategyToken)) {
               customValidationFactory.push(strategyToken);
             }
           }
@@ -3010,11 +3254,11 @@ var idempotency_store_exports = {};
 __export(idempotency_store_exports, {
   IdempotencyStore: () => IdempotencyStore
 });
-var import_shared55, IdempotencyStore;
+var import_shared60, IdempotencyStore;
 var init_idempotency_store = __esm({
   "src/infrastructure/idempotency/idempotency-store.ts"() {
     "use strict";
-    import_shared55 = require("@xeno-js/shared");
+    import_shared60 = require("@xeno-js/shared");
     IdempotencyStore = class {
       /**
        * @description Constructs a new instance of IdempotencyStore, accepting an instance of ICache for accessing the caching system and an instance of IIdentityAccessor for obtaining the user's identity context. The IdempotencyStore uses the caching system to manage locks and results of idempotent commands, ensuring that commands with the same ID are processed only once. The identity context is used to build contextual keys, allowing for more granular management of idempotent commands in multi-tenant scenarios.
@@ -3036,31 +3280,31 @@ var init_idempotency_store = __esm({
       async acquireLock(requestId, ttlSeconds) {
         const key = this._cacheKeyBuilder.buildContextualKey(`command:${requestId}`);
         return await this._cache.setIfAbsent(
-          `${import_shared55.IDEMPOTENCY_CONSTANTS.LOCK_KEY_PREFIX}${key}`,
-          import_shared55.IDEMPOTENCY_CONSTANTS.LOCKED_VALUE,
+          `${import_shared60.IDEMPOTENCY_CONSTANTS.LOCK_KEY_PREFIX}${key}`,
+          import_shared60.IDEMPOTENCY_CONSTANTS.LOCKED_VALUE,
           ttlSeconds
         );
       }
       async hasBeenProcessed(commandId) {
         const key = this._cacheKeyBuilder.buildContextualKey(`command:${commandId}`);
-        return await this._cache.has(`${import_shared55.IDEMPOTENCY_CONSTANTS.PROCESSED_KEY_PREFIX}${key}`);
+        return await this._cache.has(`${import_shared60.IDEMPOTENCY_CONSTANTS.PROCESSED_KEY_PREFIX}${key}`);
       }
       async markAsProcessed(commandId, payload, ttlSeconds) {
         const key = this._cacheKeyBuilder.buildContextualKey(`command:${commandId}`);
         await this._cache.set(
-          `${import_shared55.IDEMPOTENCY_CONSTANTS.PROCESSED_KEY_PREFIX}${key}`,
+          `${import_shared60.IDEMPOTENCY_CONSTANTS.PROCESSED_KEY_PREFIX}${key}`,
           payload,
           ttlSeconds
         );
       }
       async getPayload(commandId) {
         const key = this._cacheKeyBuilder.buildContextualKey(`command:${commandId}`);
-        const payload = await this._cache.get(`${import_shared55.IDEMPOTENCY_CONSTANTS.PROCESSED_KEY_PREFIX}${key}`);
+        const payload = await this._cache.get(`${import_shared60.IDEMPOTENCY_CONSTANTS.PROCESSED_KEY_PREFIX}${key}`);
         return payload;
       }
       async releaseLock(commandId) {
         const key = this._cacheKeyBuilder.buildContextualKey(`command:${commandId}`);
-        await this._cache.remove(`${import_shared55.IDEMPOTENCY_CONSTANTS.LOCK_KEY_PREFIX}${key}`);
+        await this._cache.remove(`${import_shared60.IDEMPOTENCY_CONSTANTS.LOCK_KEY_PREFIX}${key}`);
       }
     };
   }
@@ -3088,8 +3332,8 @@ var init_pipeline_utils = __esm({
        */
       async addCommand(container, opts) {
         const pipelines = [];
-        const { Guards: Guards39, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
-        if (Guards39.isDefined(opts.idempotency)) {
+        const { Guards: Guards45, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
+        if (Guards45.isDefined(opts.idempotency)) {
           const { IdempotencyStore: IdempotencyStore2 } = await Promise.resolve().then(() => (init_idempotency_store(), idempotency_store_exports));
           container.addSingleton(
             TOKENS4.IDEMPOTENCY_STORE,
@@ -3109,7 +3353,7 @@ var init_pipeline_utils = __esm({
           });
           pipelines.push(TOKENS4.IDEMPOTENCY_PIPELINE);
         }
-        if (Guards39.isDefined(opts.concurrency)) {
+        if (Guards45.isDefined(opts.concurrency)) {
           const { ConcurrencyRetryPipeline: ConcurrencyRetryPipeline2 } = await Promise.resolve().then(() => (init_application(), application_exports));
           container.addSingleton(TOKENS4.CONCURRENCY_RETRY_PIPELINE, () => {
             const config = opts.concurrency;
@@ -3189,13 +3433,13 @@ var init_cqrs_module = __esm({
           return new PerformancePipeline2(logger, thresholdMs);
         });
         pipelines.push(TOKENS4.PERFORMANCE_PIPELINE);
-        const { Guards: Guards39 } = await import("@xeno-js/shared");
-        if (Guards39.isDefined(opts.authorization.policies) || Guards39.isDefined(opts.authorization.customAuthorizationStrategy)) {
+        const { Guards: Guards45 } = await import("@xeno-js/shared");
+        if (Guards45.isDefined(opts.authorization.policies) || Guards45.isDefined(opts.authorization.customAuthorizationStrategy)) {
           const { AuthUtils: AuthUtils2 } = await Promise.resolve().then(() => (init_auth_utils(), auth_utils_exports));
           const authPipelines = await AuthUtils2.addAuthZ(container, opts.authorization);
           pipelines.push(...authPipelines);
         }
-        if (Guards39.isDefined(opts.validation.zod) || Guards39.isDefined(opts.validation.customValidationStrategy)) {
+        if (Guards45.isDefined(opts.validation.zod) || Guards45.isDefined(opts.validation.customValidationStrategy)) {
           const { ValidationUtils: ValidationUtils2 } = await Promise.resolve().then(() => (init_validation_utils(), validation_utils_exports));
           const logger = container.resolve(TOKENS4.LOGGER);
           const validationPipelines = await ValidationUtils2.addValidation(
@@ -3207,11 +3451,11 @@ var init_cqrs_module = __esm({
         }
         const commandPipelines = pipelines;
         const queryPipelines = pipelines;
-        if ((Guards39.isDefined(opts.commandBus.idempotency) || opts.queryBus.isEnabled) && opts.isCache) {
+        if ((Guards45.isDefined(opts.commandBus.idempotency) || opts.queryBus.isEnabled) && opts.isCache) {
           const { CacheUtils: CacheUtils2 } = await Promise.resolve().then(() => (init_cache_utils(), cache_utils_exports));
           await CacheUtils2.addCache(container, { inMemory: true, redis: void 0 });
         }
-        if (Guards39.isDefined(opts.commandBus.idempotency) || Guards39.isDefined(opts.commandBus.concurrency)) {
+        if (Guards45.isDefined(opts.commandBus.idempotency) || Guards45.isDefined(opts.commandBus.concurrency)) {
           const { PipelineUtils: PipelineUtils2 } = await Promise.resolve().then(() => (init_pipeline_utils(), pipeline_utils_exports));
           const newCommandPipelines = await PipelineUtils2.addCommand(container, {
             ...opts.commandBus,
@@ -3244,11 +3488,11 @@ var init_cqrs_module = __esm({
 });
 
 // src/presentation/controllers/base.controller.ts
-var import_shared56, BaseController;
+var import_shared61, BaseController;
 var init_base_controller = __esm({
   "src/presentation/controllers/base.controller.ts"() {
     "use strict";
-    import_shared56 = require("@xeno-js/shared");
+    import_shared61 = require("@xeno-js/shared");
     BaseController = class {
       /**
        * Constructs a new instance of the BaseController class.
@@ -3280,7 +3524,7 @@ var init_base_controller = __esm({
        * @link https://github.com/xeno-js/xeno-js
        */
       ok(data, status = 200, meta = {}, headers = {}) {
-        return import_shared56.HttpHelper.success(data, status, meta, headers);
+        return import_shared61.HttpHelper.success(data, status, meta, headers);
       }
       /**
        * Helper to automatically map a failed Result (from the CQRS pipeline)
@@ -3298,7 +3542,7 @@ var init_base_controller = __esm({
       fail(error, details = void 0, headers = {}) {
         const context = this._requestContext.getContext();
         const customHeaders = error["header"];
-        return import_shared56.HttpHelper.error(
+        return import_shared61.HttpHelper.error(
           {
             success: false,
             error: {
@@ -3307,9 +3551,9 @@ var init_base_controller = __esm({
               path: context?.network.path,
               details: details ?? error.message
             },
-            correlationId: context?.tracing.correlationId ?? import_shared56.GuidHelper.generate(),
-            requestId: context?.network.requestId ?? import_shared56.GuidHelper.generate(),
-            spanId: context?.tracing.spanId ?? import_shared56.GuidHelper.generate(),
+            correlationId: context?.tracing.correlationId ?? import_shared61.GuidHelper.generate(),
+            requestId: context?.network.requestId ?? import_shared61.GuidHelper.generate(),
+            spanId: context?.tracing.spanId ?? import_shared61.GuidHelper.generate(),
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           },
           error.status,
@@ -3364,11 +3608,11 @@ var init_controllers = __esm({
 });
 
 // src/presentation/middlewares/allow-method.middleware.ts
-var import_shared57, MethodCheckMiddleware;
+var import_shared62, MethodCheckMiddleware;
 var init_allow_method_middleware = __esm({
   "src/presentation/middlewares/allow-method.middleware.ts"() {
     "use strict";
-    import_shared57 = require("@xeno-js/shared");
+    import_shared62 = require("@xeno-js/shared");
     MethodCheckMiddleware = class {
       constructor(_requestContext, _allowMethod) {
         this._requestContext = _requestContext;
@@ -3380,21 +3624,21 @@ var init_allow_method_middleware = __esm({
         const isAllowed = this._allowMethod.check(req.path, req.method);
         if (!isAllowed) {
           const { network, tracing } = this._requestContext.getContext() ?? {};
-          return import_shared57.HttpHelper.error(
+          return import_shared62.HttpHelper.error(
             {
               success: false,
               error: {
-                code: import_shared57.ERROR_CODES.NOT_ALLOWED,
-                message: import_shared57.ERROR_CODE_MESSAGES[import_shared57.ERROR_CODES.NOT_ALLOWED],
+                code: import_shared62.ERROR_CODES.NOT_ALLOWED,
+                message: import_shared62.ERROR_CODE_MESSAGES[import_shared62.ERROR_CODES.NOT_ALLOWED],
                 details: `Operation blocked by allow method middleware`,
                 path: req.path
               },
-              correlationId: tracing?.correlationId ?? import_shared57.GuidHelper.generate(),
-              requestId: network?.requestId ?? import_shared57.GuidHelper.generate(),
-              spanId: tracing?.spanId ?? import_shared57.GuidHelper.generate(),
+              correlationId: tracing?.correlationId ?? import_shared62.GuidHelper.generate(),
+              requestId: network?.requestId ?? import_shared62.GuidHelper.generate(),
+              spanId: tracing?.spanId ?? import_shared62.GuidHelper.generate(),
               timestamp: (/* @__PURE__ */ new Date()).toISOString()
             },
-            import_shared57.STATUS_CODES.NOT_ALLOWED
+            import_shared62.STATUS_CODES.NOT_ALLOWED
           );
         }
         return await next();
@@ -3404,11 +3648,11 @@ var init_allow_method_middleware = __esm({
 });
 
 // src/presentation/middlewares/allow-origin.middleware.ts
-var import_shared58, AllowOriginMiddleware;
+var import_shared63, AllowOriginMiddleware;
 var init_allow_origin_middleware = __esm({
   "src/presentation/middlewares/allow-origin.middleware.ts"() {
     "use strict";
-    import_shared58 = require("@xeno-js/shared");
+    import_shared63 = require("@xeno-js/shared");
     AllowOriginMiddleware = class {
       constructor(_allowOrigin, _requestContext, _logger) {
         this._allowOrigin = _allowOrigin;
@@ -3423,21 +3667,21 @@ var init_allow_origin_middleware = __esm({
         const origin = network?.origin;
         if (!this._allowOrigin.isAllowed(origin)) {
           this._logger.warn(`Access denied by AllowOrigin policy for origin: ${origin ?? "unknown"}`);
-          return import_shared58.HttpHelper.error(
+          return import_shared63.HttpHelper.error(
             {
               success: false,
               error: {
-                code: import_shared58.ERROR_CODES.FORBIDDEN,
-                message: import_shared58.ERROR_CODE_MESSAGES[import_shared58.ERROR_CODES.FORBIDDEN],
+                code: import_shared63.ERROR_CODES.FORBIDDEN,
+                message: import_shared63.ERROR_CODE_MESSAGES[import_shared63.ERROR_CODES.FORBIDDEN],
                 details: `The origin '${origin ?? "unknown"}' is not allowed to access this resource.`,
                 path: req.path
               },
-              correlationId: tracing?.correlationId ?? import_shared58.GuidHelper.generate(),
-              requestId: network?.requestId ?? import_shared58.GuidHelper.generate(),
-              spanId: tracing?.spanId ?? import_shared58.GuidHelper.generate(),
+              correlationId: tracing?.correlationId ?? import_shared63.GuidHelper.generate(),
+              requestId: network?.requestId ?? import_shared63.GuidHelper.generate(),
+              spanId: tracing?.spanId ?? import_shared63.GuidHelper.generate(),
               timestamp: (/* @__PURE__ */ new Date()).toISOString()
             },
-            import_shared58.STATUS_CODES.FORBIDDEN
+            import_shared63.STATUS_CODES.FORBIDDEN
           );
         }
         return next();
@@ -3447,11 +3691,11 @@ var init_allow_origin_middleware = __esm({
 });
 
 // src/presentation/middlewares/auth.middleware.ts
-var import_shared59, AuthenticationMiddleware;
+var import_shared64, AuthenticationMiddleware;
 var init_auth_middleware = __esm({
   "src/presentation/middlewares/auth.middleware.ts"() {
     "use strict";
-    import_shared59 = require("@xeno-js/shared");
+    import_shared64 = require("@xeno-js/shared");
     AuthenticationMiddleware = class {
       constructor(_requestContext, _tokenExtractor, _gateKeeper, _logger) {
         this._requestContext = _requestContext;
@@ -3472,7 +3716,7 @@ var init_auth_middleware = __esm({
             `Authentication failed for request on path: ${req.path}. Code: ${error.code}. Error: ${error}`
           );
           const { network, tracing } = this._requestContext.getContext() ?? {};
-          return import_shared59.HttpHelper.error(
+          return import_shared64.HttpHelper.error(
             {
               success: false,
               error: {
@@ -3481,12 +3725,12 @@ var init_auth_middleware = __esm({
                 details: `[Authentication Error] Failed to authenticate request on path: ${req.path}`,
                 path: req.path
               },
-              correlationId: tracing?.correlationId ?? import_shared59.GuidHelper.generate(),
-              requestId: network?.requestId ?? import_shared59.GuidHelper.generate(),
-              spanId: tracing?.spanId ?? import_shared59.GuidHelper.generate(),
+              correlationId: tracing?.correlationId ?? import_shared64.GuidHelper.generate(),
+              requestId: network?.requestId ?? import_shared64.GuidHelper.generate(),
+              spanId: tracing?.spanId ?? import_shared64.GuidHelper.generate(),
               timestamp: (/* @__PURE__ */ new Date()).toISOString()
             },
-            error.status ?? import_shared59.STATUS_CODES.UNAUTHORIZED,
+            error.status ?? import_shared64.STATUS_CODES.UNAUTHORIZED,
             { "Content-Type": [network?.formatIndicator ?? "application/json"] }
           );
         }
@@ -3521,11 +3765,11 @@ var init_composite_middleware = __esm({
 });
 
 // src/presentation/middlewares/cors.middleware.ts
-var import_shared60, CORSMiddleware;
+var import_shared65, CORSMiddleware;
 var init_cors_middleware = __esm({
   "src/presentation/middlewares/cors.middleware.ts"() {
     "use strict";
-    import_shared60 = require("@xeno-js/shared");
+    import_shared65 = require("@xeno-js/shared");
     CORSMiddleware = class {
       constructor(_requestContext) {
         this._requestContext = _requestContext;
@@ -3535,7 +3779,7 @@ var init_cors_middleware = __esm({
         const { network } = this._requestContext.getContext() ?? {};
         const origin = network?.origin;
         const response = await next();
-        if (import_shared60.Guards.isDefined(origin))
+        if (import_shared65.Guards.isDefined(origin))
           response.headers = {
             ...response.headers ?? {},
             "Access-Control-Allow-Origin": origin,
@@ -3549,44 +3793,86 @@ var init_cors_middleware = __esm({
 });
 
 // src/presentation/middlewares/csrf.middleware.ts
-var import_shared61, CsrfMiddleware;
+var import_shared66, CsrfMiddleware;
 var init_csrf_middleware = __esm({
   "src/presentation/middlewares/csrf.middleware.ts"() {
     "use strict";
-    import_shared61 = require("@xeno-js/shared");
+    import_shared66 = require("@xeno-js/shared");
     CsrfMiddleware = class {
-      constructor(_requestContext, _csrf) {
+      constructor(_requestContext, _csrfTokenService) {
         this._requestContext = _requestContext;
-        this._csrf = _csrf;
+        this._csrfTokenService = _csrfTokenService;
       }
       _requestContext;
-      _csrf;
-      /**
-       * @param requestContext Dati base della richiesta (metodo, path)
-       * @param headers Header HTTP della richiesta
-       * @param next Funzione delegata per passare al middleware successivo
-       */
+      _csrfTokenService;
       async execute(req, _headers, next) {
         const method = req.method.toUpperCase();
         const isStateChanging = ["POST", "PUT", "DELETE", "PATCH"].includes(method);
         if (isStateChanging) {
-          const { network, tracing } = this._requestContext.getContext() ?? {};
-          if (!import_shared61.Guards.isDefined(network?.csrf) || network.csrf.toLowerCase() !== this._csrf.toLowerCase()) {
-            return import_shared61.HttpHelper.error(
+          const { network, tracing, identity } = this._requestContext.getContext() ?? {};
+          const headerToken = network?.csrf;
+          const cookieToken = network?.csrfCookie;
+          if (!import_shared66.Guards.isDefined(headerToken) || !import_shared66.Guards.isDefined(cookieToken)) {
+            return import_shared66.HttpHelper.error(
+              {
+                success: false,
+                error: {
+                  code: import_shared66.ERROR_CODES.FORBIDDEN,
+                  message: import_shared66.ERROR_CODE_MESSAGES[import_shared66.ERROR_CODES.FORBIDDEN],
+                  details: "CSRF token missing",
+                  path: req.path
+                },
+                correlationId: tracing?.correlationId ?? import_shared66.GuidHelper.generate(),
+                requestId: network?.requestId ?? import_shared66.GuidHelper.generate(),
+                spanId: tracing?.spanId ?? import_shared66.GuidHelper.generate(),
+                timestamp: (/* @__PURE__ */ new Date()).toISOString()
+              },
+              import_shared66.STATUS_CODES.FORBIDDEN,
+              {
+                "Content-Type": [network?.formatIndicator ?? "application/json"]
+              }
+            );
+          }
+          if (headerToken !== cookieToken) {
+            return import_shared66.HttpHelper.error(
+              {
+                success: false,
+                error: {
+                  code: import_shared66.ERROR_CODES.FORBIDDEN,
+                  message: import_shared66.ERROR_CODE_MESSAGES[import_shared66.ERROR_CODES.FORBIDDEN],
+                  details: "CSRF token mismatch",
+                  path: req.path
+                },
+                correlationId: tracing?.correlationId ?? import_shared66.GuidHelper.generate(),
+                requestId: network?.requestId ?? import_shared66.GuidHelper.generate(),
+                spanId: tracing?.spanId ?? import_shared66.GuidHelper.generate(),
+                timestamp: (/* @__PURE__ */ new Date()).toISOString()
+              },
+              import_shared66.STATUS_CODES.FORBIDDEN,
+              {
+                "Content-Type": [network?.formatIndicator ?? "application/json"]
+              }
+            );
+          }
+          if (!import_shared66.Guards.isDefined(identity?.userId) || !await this._csrfTokenService.validate(
+            headerToken,
+            identity?.userId
+          )) {
+            return import_shared66.HttpHelper.error(
               {
                 success: false,
                 error: {
-                  code: import_shared61.ERROR_CODES.FORBIDDEN,
-                  message: import_shared61.ERROR_CODE_MESSAGES[import_shared61.ERROR_CODES.FORBIDDEN],
-                  details: "CSRF header is missing or invalid",
+                  code: import_shared66.ERROR_CODES.FORBIDDEN,
+                  message: import_shared66.ERROR_CODE_MESSAGES[import_shared66.ERROR_CODES.FORBIDDEN],
+                  details: "CSRF token invalid",
                   path: req.path
                 },
-                correlationId: tracing?.correlationId ?? import_shared61.GuidHelper.generate(),
-                requestId: network?.requestId ?? import_shared61.GuidHelper.generate(),
-                spanId: tracing?.spanId ?? import_shared61.GuidHelper.generate(),
+                correlationId: tracing?.correlationId ?? import_shared66.GuidHelper.generate(),
+                requestId: network?.requestId ?? import_shared66.GuidHelper.generate(),
+                spanId: tracing?.spanId ?? import_shared66.GuidHelper.generate(),
                 timestamp: (/* @__PURE__ */ new Date()).toISOString()
               },
-              import_shared61.STATUS_CODES.FORBIDDEN,
+              import_shared66.STATUS_CODES.FORBIDDEN,
               {
                 "Content-Type": [network?.formatIndicator ?? "application/json"]
               }
@@ -3599,12 +3885,55 @@ var init_csrf_middleware = __esm({
   }
 });
 
+// src/presentation/middlewares/csrf-cookie.middleware.ts
+var import_shared67, CsrfCookieMiddleware;
+var init_csrf_cookie_middleware = __esm({
+  "src/presentation/middlewares/csrf-cookie.middleware.ts"() {
+    "use strict";
+    import_shared67 = require("@xeno-js/shared");
+    CsrfCookieMiddleware = class {
+      constructor(_requestContext, _csrfTokenService, _csrf) {
+        this._requestContext = _requestContext;
+        this._csrfTokenService = _csrfTokenService;
+        this._csrf = _csrf;
+      }
+      _requestContext;
+      _csrfTokenService;
+      _csrf;
+      async execute(_req, _headers, next) {
+        const response = await next();
+        const context = this._requestContext.getContext();
+        const identity = context?.identity;
+        const network = context?.network;
+        if (!import_shared67.Guards.isDefined(identity?.userId))
+          return response;
+        if (import_shared67.Guards.isDefined(network?.csrfCookie))
+          return response;
+        const token = await this._csrfTokenService.generate(identity.userId);
+        const cookieName = this._csrf.cookieName ?? "__Host-xeno-csrf";
+        const maxAge = this._csrf.cookieMaxAgeSeconds ?? 3600;
+        const sameSite = this._csrf.sameSite ?? "lax";
+        const cookie = `${cookieName}=${encodeURIComponent(token)}; Path=/; Secure; SameSite=${sameSite}; Max-Age=${maxAge}`;
+        const existingCookies = response.headers["Set-Cookie"];
+        response.headers = {
+          ...response.headers ?? {},
+          "Set-Cookie": [
+            ...existingCookies ?? [],
+            cookie
+          ]
+        };
+        return response;
+      }
+    };
+  }
+});
+
 // src/presentation/middlewares/options.middleware.ts
-var import_shared62, OptionsMiddleware;
+var import_shared68, OptionsMiddleware;
 var init_options_middleware = __esm({
   "src/presentation/middlewares/options.middleware.ts"() {
     "use strict";
-    import_shared62 = require("@xeno-js/shared");
+    import_shared68 = require("@xeno-js/shared");
     OptionsMiddleware = class {
       constructor(_requestContext) {
         this._requestContext = _requestContext;
@@ -3615,14 +3944,14 @@ var init_options_middleware = __esm({
           const network = this._requestContext.getNetworkContext();
           const origin = network?.origin;
           const headers = {};
-          if (import_shared62.Guards.isDefined(origin)) {
+          if (import_shared68.Guards.isDefined(origin)) {
             headers["Access-Control-Allow-Origin"] = origin;
             headers["Access-Control-Allow-Credentials"] = "true";
             headers["Vary"] = "Origin";
           }
-          headers["Access-Control-Allow-Methods"] = "POST,GET,PUT,DELETE,OPTIONS";
-          headers["Access-Control-Allow-Headers"] = "X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Type, Authorization, X-Correlation-Id";
-          return import_shared62.HttpHelper.success(null, import_shared62.STATUS_CODES.NO_CONTENT, {}, headers);
+          headers["Access-Control-Allow-Methods"] = "POST,GET,PUT,PATCH,DELETE,OPTIONS";
+          headers["Access-Control-Allow-Headers"] = "X-CSRF-Token, Accept, Accept-Version, Content-Type, Authorization, X-Correlation-Id";
+          return import_shared68.HttpHelper.success(null, import_shared68.STATUS_CODES.NO_CONTENT, {}, headers);
         }
         return await next();
       }
@@ -3631,11 +3960,11 @@ var init_options_middleware = __esm({
 });
 
 // src/presentation/middlewares/rate-limiter.middleware.ts
-var import_shared63, RateLimitMiddleware;
+var import_shared69, RateLimitMiddleware;
 var init_rate_limiter_middleware = __esm({
   "src/presentation/middlewares/rate-limiter.middleware.ts"() {
     "use strict";
-    import_shared63 = require("@xeno-js/shared");
+    import_shared69 = require("@xeno-js/shared");
     RateLimitMiddleware = class {
       constructor(_ctxAccessor, _cache, _logger, _opts) {
         this._ctxAccessor = _ctxAccessor;
@@ -3647,25 +3976,25 @@ var init_rate_limiter_middleware = __esm({
       _cache;
       _logger;
       _opts;
-      async execute(req, headers, next) {
+      async execute(req, _headers, next) {
         const { network, tracing } = this._ctxAccessor.getContext() ?? {};
         const clientIp = network?.clientIp;
         const cacheKey = `rate_limit:${clientIp}`;
-        const currentHits = await this._cache.get(cacheKey) ?? 0;
-        if (currentHits >= this._opts.maxRequests) {
+        const currentHits = await this._cache.increment(cacheKey, this._opts.windowSeconds);
+        if (currentHits > this._opts.maxRequests) {
           this._logger.warn(`[RateLimit] IP ${clientIp} blocked on ${req.path}`);
-          return import_shared63.HttpHelper.error(
+          return import_shared69.HttpHelper.error(
             {
               success: false,
               error: {
-                code: import_shared63.ERROR_CODES.TOO_MANY_REQUESTS,
+                code: import_shared69.ERROR_CODES.TOO_MANY_REQUESTS,
                 message: "Rate limit exceeded.",
                 details: `IP ${clientIp} throttled.`,
                 path: req.path
               },
-              correlationId: tracing?.correlationId ?? import_shared63.GuidHelper.generate(),
-              requestId: network?.requestId ?? import_shared63.GuidHelper.generate(),
-              spanId: tracing?.spanId ?? import_shared63.GuidHelper.generate(),
+              correlationId: tracing?.correlationId ?? import_shared69.GuidHelper.generate(),
+              requestId: network?.requestId ?? import_shared69.GuidHelper.generate(),
+              spanId: tracing?.spanId ?? import_shared69.GuidHelper.generate(),
               timestamp: (/* @__PURE__ */ new Date()).toISOString()
             },
             429,
@@ -3675,7 +4004,6 @@ var init_rate_limiter_middleware = __esm({
             }
           );
         }
-        await this._cache.set(cacheKey, currentHits + 1, this._opts.windowSeconds);
         return next();
       }
     };
@@ -3684,8 +4012,8 @@ var init_rate_limiter_middleware = __esm({
 
 // src/presentation/mappers/context.mapper.ts
 function _buildMessagingContext(meta) {
-  const hasSequenceData = import_shared64.Guards.isDefined(meta.sequence?.sequenceId) || import_shared64.Guards.isDefined(meta.sequence?.position) || import_shared64.Guards.isDefined(meta.sequence?.size);
-  const hasMessagingData = hasSequenceData || import_shared64.Guards.isDefined(meta.expiration) || import_shared64.Guards.isDefined(meta.returnAddress);
+  const hasSequenceData = import_shared70.Guards.isDefined(meta.sequence?.sequenceId) || import_shared70.Guards.isDefined(meta.sequence?.position) || import_shared70.Guards.isDefined(meta.sequence?.size);
+  const hasMessagingData = hasSequenceData || import_shared70.Guards.isDefined(meta.expiration) || import_shared70.Guards.isDefined(meta.returnAddress);
   const messaging = hasMessagingData ? {
     returnAddress: meta.returnAddress,
     expiration: meta.expiration,
@@ -3693,11 +4021,11 @@ function _buildMessagingContext(meta) {
   } : void 0;
   return messaging;
 }
-var import_shared64, ContextMapper;
+var import_shared70, ContextMapper;
 var init_context_mapper = __esm({
   "src/presentation/mappers/context.mapper.ts"() {
     "use strict";
-    import_shared64 = require("@xeno-js/shared");
+    import_shared70 = require("@xeno-js/shared");
     ContextMapper = Object.freeze({
       /**
        * @description Maps to RequestContext. It extracts relevant information from the object, such as correlation ID, request ID, authentication token, client IP, user agent, format indicator, and messaging context (if available). The method constructs a RequestContext object that encapsulates all this information, providing a structured representation of the request context for further processing in the application.
@@ -3717,6 +4045,7 @@ var init_context_mapper = __esm({
           path,
           transport,
           csrf: metadata.csrf,
+          csrfCookie: metadata.csrfCookie,
           origin: metadata.origin
         };
         const tracing = {
@@ -3740,11 +4069,11 @@ var init_context_mapper = __esm({
 });
 
 // src/presentation/middlewares/request.middleware.ts
-var import_shared65, RequestContextMiddleware;
+var import_shared71, RequestContextMiddleware;
 var init_request_middleware = __esm({
   "src/presentation/middlewares/request.middleware.ts"() {
     "use strict";
-    import_shared65 = require("@xeno-js/shared");
+    import_shared71 = require("@xeno-js/shared");
     init_context_mapper();
     RequestContextMiddleware = class {
       /**
@@ -3758,23 +4087,27 @@ var init_request_middleware = __esm({
        * @since 2025-09-30
        * @link https://github.com/xeno-js/xeno-js
        */
-      constructor(_requestContext, _extractor, _logger) {
+      constructor(_requestContext, _extractor, _resolver, _logger) {
         this._requestContext = _requestContext;
         this._extractor = _extractor;
+        this._resolver = _resolver;
         this._logger = _logger;
       }
       _requestContext;
       _extractor;
+      _resolver;
       _logger;
       async execute(req, headers, next) {
-        const correlationId = import_shared65.GuidHelper.generate();
-        const requestId = import_shared65.GuidHelper.generate();
+        const correlationId = import_shared71.GuidHelper.generate();
+        const requestId = import_shared71.GuidHelper.generate();
         const spanId = correlationId;
         const formatIndicator = "application/json";
         try {
           const meta = this._extractor.extract(headers);
+          const clientIp = this._resolver.resolve(req.transport.req, meta.clientIp);
           const metadata = {
             ...meta,
+            clientIp,
             correlationId: meta.correlationId ?? correlationId,
             requestId: meta.requestId ?? requestId,
             spanId: meta.spanId ?? spanId,
@@ -3782,7 +4115,7 @@ var init_request_middleware = __esm({
           };
           const tmpContext = ContextMapper.map({
             metadata,
-            identity: import_shared65.GUEST,
+            identity: import_shared71.GUEST,
             path: req.path,
             transport: req.transport
           });
@@ -3794,12 +4127,12 @@ var init_request_middleware = __esm({
           return result;
         } catch (error) {
           this._logger.error("RequestContextMiddleware encountered an error", error);
-          return import_shared65.HttpHelper.error(
+          return import_shared71.HttpHelper.error(
             {
               success: false,
               error: {
-                code: import_shared65.ERROR_CODES.SYSTEM_ERROR,
-                message: import_shared65.ERROR_CODE_MESSAGES[import_shared65.ERROR_CODES.SYSTEM_ERROR],
+                code: import_shared71.ERROR_CODES.SYSTEM_ERROR,
+                message: import_shared71.ERROR_CODE_MESSAGES[import_shared71.ERROR_CODES.SYSTEM_ERROR],
                 details: `[Fatal System Error] Exception caught during request handling on path: ${req.path}`,
                 path: req.path
               },
@@ -3808,7 +4141,7 @@ var init_request_middleware = __esm({
               spanId,
               timestamp: (/* @__PURE__ */ new Date()).toISOString()
             },
-            import_shared65.STATUS_CODES.INTERNAL_SERVER_ERROR,
+            import_shared71.STATUS_CODES.INTERNAL_SERVER_ERROR,
             { "Content-Type": [formatIndicator] }
           );
         }
@@ -3827,6 +4160,7 @@ var init_middlewares = __esm({
     init_composite_middleware();
     init_cors_middleware();
     init_csrf_middleware();
+    init_csrf_cookie_middleware();
     init_options_middleware();
     init_rate_limiter_middleware();
     init_request_middleware();
@@ -3841,6 +4175,7 @@ __export(presentation_exports, {
   BaseController: () => BaseController,
   CORSMiddleware: () => CORSMiddleware,
   CompositeMiddleware: () => CompositeMiddleware,
+  CsrfCookieMiddleware: () => CsrfCookieMiddleware,
   CsrfMiddleware: () => CsrfMiddleware,
   MethodCheckMiddleware: () => MethodCheckMiddleware,
   OptionsMiddleware: () => OptionsMiddleware,
@@ -3860,11 +4195,11 @@ var middleware_module_exports = {};
 __export(middleware_module_exports, {
   MiddlewareModule: () => MiddlewareModule
 });
-var import_shared66, MiddlewareModule;
+var import_shared72, MiddlewareModule;
 var init_middleware_module = __esm({
   "src/infrastructure/modules/middleware.module.ts"() {
     "use strict";
-    import_shared66 = require("@xeno-js/shared");
+    import_shared72 = require("@xeno-js/shared");
     MiddlewareModule = class {
       async configure(container, opts) {
         const { TOKENS: TOKENS4 } = await import("@xeno-js/shared");
@@ -3879,15 +4214,19 @@ var init_middleware_module = __esm({
           const { BearerTokenExtractor: BearerTokenExtractor2 } = await Promise.resolve().then(() => (init_services(), services_exports));
           container.addSingleton(TOKENS4.BEARER_TOKEN_EXTRACTOR, () => new BearerTokenExtractor2());
         }
+        const { HttpCookieExtractor: HttpCookieExtractor2 } = await Promise.resolve().then(() => (init_services(), services_exports));
+        container.addSingleton("COOKIE_EXTRACTOR", () => new HttpCookieExtractor2());
         const { HttpHeaderExtractor: HttpHeaderExtractor2 } = await Promise.resolve().then(() => (init_services(), services_exports));
         container.addSingleton(
           TOKENS4.SERVICE_EXTRACTOR,
-          (c) => new HttpHeaderExtractor2(c.resolve(TOKENS4.BEARER_TOKEN_EXTRACTOR), opts.trustedIpHeader)
+          (c) => new HttpHeaderExtractor2(c.resolve(TOKENS4.BEARER_TOKEN_EXTRACTOR), c.resolve("COOKIE_EXTRACTOR"), opts.trustedIpHeader, opts.csrf?.cookieName ?? "__Host-xeno-csrf")
         );
         if (!opts.isLogger) {
           const { LoggerUtils: LoggerUtils2 } = await Promise.resolve().then(() => (init_logger_utils(), logger_utils_exports));
           await LoggerUtils2.addLogger(container, void 0);
         }
+        const { ClientIpResolver: ClientIpResolver2 } = await Promise.resolve().then(() => (init_services(), services_exports));
+        container.addSingleton("IP_RESOLVER", () => new ClientIpResolver2(opts.trustedProxies));
         const middlewares = [TOKENS4.REQUEST_CONTEXT_MIDDLEWARE];
         const { RequestContextMiddleware: RequestContextMiddleware2 } = await Promise.resolve().then(() => (init_presentation(), presentation_exports));
         container.addSingleton(
@@ -3895,6 +4234,7 @@ var init_middleware_module = __esm({
           (c) => new RequestContextMiddleware2(
             c.resolve(TOKENS4.REQUEST_CONTEXT),
             c.resolve(TOKENS4.SERVICE_EXTRACTOR),
+            c.resolve("IP_RESOLVER"),
             c.resolve(TOKENS4.LOGGER)
           )
         );
@@ -3906,7 +4246,9 @@ var init_middleware_module = __esm({
           );
           middlewares.push(TOKENS4.OPTIONS_MIDDLEWARE);
         }
-        if (!import_shared66.Guards.isNullOrEmpty(opts.allowOrigins)) {
+        if (!import_shared72.Guards.isNullOrEmpty(opts.allowOrigins)) {
+          if (import_shared72.Guards.isDefined(opts.httpConfig.withCredentials) && opts.allowOrigins.includes("*"))
+            throw new Error("Wildcard CORS origin is not allowed when withCredentials is set to true");
           const { AllowOrigin: AllowOrigin2 } = await Promise.resolve().then(() => (init_services(), services_exports));
           container.addSingleton("ALLOW_ORIGIN", () => {
             return new AllowOrigin2(opts.allowOrigins);
@@ -3928,7 +4270,7 @@ var init_middleware_module = __esm({
           });
           middlewares.push(TOKENS4.CORS_MIDDLEWARE);
         }
-        if (import_shared66.Guards.isDefined(opts.routeRegistry)) {
+        if (import_shared72.Guards.isDefined(opts.routeRegistry)) {
           const registry = opts.routeRegistry;
           const { AllowMethodFactory: AllowMethodFactory2 } = await Promise.resolve().then(() => (init_factories(), factories_exports));
           container.addSingleton(TOKENS4.ALLOW_METHOD, () => new AllowMethodFactory2().create(registry));
@@ -3942,21 +4284,42 @@ var init_middleware_module = __esm({
           );
           middlewares.push(TOKENS4.METHOD_CHECK_MIDDLEWARE);
         }
-        if (import_shared66.Guards.isDefined(opts.csrf)) {
+        const { AuthenticationMiddleware: AuthenticationMiddleware2 } = await Promise.resolve().then(() => (init_presentation(), presentation_exports));
+        container.addSingleton(TOKENS4.AUTH_MIDDLEWARE, (c) => {
+          return new AuthenticationMiddleware2(
+            c.resolve(TOKENS4.REQUEST_CONTEXT),
+            c.resolve(TOKENS4.BEARER_TOKEN_EXTRACTOR),
+            c.resolve(TOKENS4.GATE_KEEPER),
+            c.resolve(TOKENS4.LOGGER)
+          );
+        });
+        middlewares.push(TOKENS4.AUTH_MIDDLEWARE);
+        if (import_shared72.Guards.isDefined(opts.csrf)) {
           const csrf = opts.csrf;
+          const { CsrfTokenService: CsrfTokenService2 } = await Promise.resolve().then(() => (init_services(), services_exports));
+          container.addSingleton("CSRF_TOKEN_SERVICE", (c) => {
+            return new CsrfTokenService2(
+              csrf.secret,
+              c.resolve("CRYPTO_SERVICE")
+            );
+          });
+          const { CsrfCookieMiddleware: CsrfCookieMiddleware2 } = await Promise.resolve().then(() => (init_presentation(), presentation_exports));
+          container.addSingleton("CSRF_COOKIE_MIDDLEWARE", (c) => {
+            return new CsrfCookieMiddleware2(c.resolve(TOKENS4.REQUEST_CONTEXT), c.resolve("CSRF_TOKEN_SERVICE"), csrf);
+          });
           const { CsrfMiddleware: CsrfMiddleware2 } = await Promise.resolve().then(() => (init_presentation(), presentation_exports));
           container.addSingleton(TOKENS4.CSRF_MIDDLEWARE, (c) => {
-            return new CsrfMiddleware2(c.resolve(TOKENS4.REQUEST_CONTEXT), csrf);
+            return new CsrfMiddleware2(c.resolve(TOKENS4.REQUEST_CONTEXT), c.resolve("CSRF_TOKEN_SERVICE"));
           });
           middlewares.push(TOKENS4.CSRF_MIDDLEWARE);
         }
-        if (import_shared66.Guards.isDefined(opts.rateLimite.maxRequests) || import_shared66.Guards.isDefined(opts.rateLimite.windowSeconds)) {
+        if (import_shared72.Guards.isDefined(opts.rateLimite.maxRequests) || import_shared72.Guards.isDefined(opts.rateLimite.windowSeconds)) {
           const maxRequests = opts.rateLimite.maxRequests ?? 30;
-          import_shared66.Guards.throwIfNegative(maxRequests, "MaxRequests must be positive");
-          import_shared66.Guards.throwIfNotInteger(maxRequests, "MaxRequests must be an integer");
+          import_shared72.Guards.throwIfNegative(maxRequests, "MaxRequests must be positive");
+          import_shared72.Guards.throwIfNotInteger(maxRequests, "MaxRequests must be an integer");
           const windowSeconds = opts.rateLimite.windowSeconds ?? 30;
-          import_shared66.Guards.throwIfNegative(windowSeconds, "WindowSeconds must be positive");
-          import_shared66.Guards.throwIfNotInteger(windowSeconds, "WindowSeconds must be an integer");
+          import_shared72.Guards.throwIfNegative(windowSeconds, "WindowSeconds must be positive");
+          import_shared72.Guards.throwIfNotInteger(windowSeconds, "WindowSeconds must be an integer");
           if (!opts.isCache) {
             const { CacheUtils: CacheUtils2 } = await Promise.resolve().then(() => (init_cache_utils(), cache_utils_exports));
             await CacheUtils2.addCache(container, { inMemory: true, redis: void 0 });
@@ -3975,16 +4338,6 @@ var init_middleware_module = __esm({
           });
           middlewares.push(TOKENS4.RATE_LIMITER_MIDDLEWARE);
         }
-        const { AuthenticationMiddleware: AuthenticationMiddleware2 } = await Promise.resolve().then(() => (init_presentation(), presentation_exports));
-        container.addSingleton(TOKENS4.AUTH_MIDDLEWARE, (c) => {
-          return new AuthenticationMiddleware2(
-            c.resolve(TOKENS4.REQUEST_CONTEXT),
-            c.resolve(TOKENS4.BEARER_TOKEN_EXTRACTOR),
-            c.resolve(TOKENS4.GATE_KEEPER),
-            c.resolve(TOKENS4.LOGGER)
-          );
-        });
-        middlewares.push(TOKENS4.AUTH_MIDDLEWARE);
         const { CompositeMiddleware: CompositeMiddleware2 } = await Promise.resolve().then(() => (init_presentation(), presentation_exports));
         container.addSingleton(TOKENS4.MIDDLEWARE, (c) => {
           const resolvedMiddleware = middlewares.map(
@@ -4044,7 +4397,7 @@ __export(index_exports, {
   BaseAuthorizationStrategy: () => BaseAuthorizationStrategy,
   BaseController: () => BaseController,
   BaseHandler: () => BaseHandler,
-  BaseQuery: () => import_shared73.Query,
+  BaseQuery: () => import_shared79.Query,
   ContainerUtils: () => ContainerUtils,
   ReadDao: () => ReadDao,
   Repository: () => Repository,
@@ -4055,7 +4408,7 @@ module.exports = __toCommonJS(index_exports);
 init_application();
 
 // src/infrastructure/builder/app.builder.ts
-var import_shared67 = require("@xeno-js/shared");
+var import_shared73 = require("@xeno-js/shared");
 
 // src/infrastructure/configuration/configuration.ts
 var import_shared32 = require("@xeno-js/shared");
@@ -4327,10 +4680,11 @@ var AppBuilder = class {
   constructor(container) {
     this._container = container ?? new ServiceContainer();
     this._container.addSingleton(
-      import_shared67.TOKENS.CONFIGURATION_SERVICE,
+      import_shared73.TOKENS.CONFIGURATION_SERVICE,
       () => new EnvironmentConfigurationService()
     );
-    this._configuration = this._container.resolve(import_shared67.TOKENS.CONFIGURATION_SERVICE);
+    this._configuration = this._container.resolve(import_shared73.TOKENS.CONFIGURATION_SERVICE);
+    this._middlewareConfig.allowOrigins?.push(this._configuration.get("APP_URL") ?? `http://localhost:${this._configuration.getNumber("PORT", 3e3)}`);
   }
   // --- Module Configurations ---
   _modules = [];
@@ -4362,7 +4716,8 @@ var AppBuilder = class {
     optionsMiddleware: false,
     routeRegistry: void 0,
     trustedIpHeader: void 0,
-    allowOrigins: ["*"],
+    trustedProxies: [],
+    allowOrigins: [],
     cors: true
   };
   _httpConfig = {
@@ -4439,13 +4794,13 @@ var AppBuilder = class {
     if (this._isLoggerModuleQueued) return this;
     this._isLoggerModuleQueued = true;
     const config = {
-      level: import_shared67.LOG_LEVEL.DEBUG,
+      level: import_shared73.LOG_LEVEL.DEBUG,
       console: true,
       sentry: { config: void 0 },
       pino: { config: void 0 },
       customLoggers: void 0
     };
-    if (import_shared67.Guards.isDefined(setupAction) && import_shared67.Guards.isDefined(config))
+    if (import_shared73.Guards.isDefined(setupAction) && import_shared73.Guards.isDefined(config))
       setupAction(config, this._configuration);
     this._modules.push({
       priority: 3,
@@ -4471,7 +4826,7 @@ var AppBuilder = class {
   addCache(setupAction) {
     if (this._isCacheModuleQueued) return this;
     this._isCacheModuleQueued = true;
-    if (import_shared67.Guards.isDefined(setupAction)) setupAction(this._config, this._configuration);
+    if (import_shared73.Guards.isDefined(setupAction)) setupAction(this._config, this._configuration);
     this._modules.push({
       priority: 3,
       name: "CacheModule",
@@ -4580,7 +4935,7 @@ var AppBuilder = class {
    * @link https://github.com/xeno-js/xeno-js 
    */
   addPipeline(setupAction) {
-    if (import_shared67.Guards.isDefined(setupAction)) {
+    if (import_shared73.Guards.isDefined(setupAction)) {
       setupAction(this._pipelineConfig, this._configuration);
     }
     this._queuePipelineModule();
@@ -4714,7 +5069,7 @@ var AppBuilder = class {
         console.error(`\u{1F449} Module: **${queued.name}**`);
         console.error(`\u{1F4DD} Reason: ${errorMessage}
 `);
-        if (error instanceof Error && import_shared67.Guards.isDefined(error.stack)) {
+        if (error instanceof Error && import_shared73.Guards.isDefined(error.stack)) {
           console.error(error.stack);
         }
         throw new Error(`Bootstrap failed at [${queued.name}]: ${errorMessage}`, { cause: error });
@@ -4776,7 +5131,8 @@ var AppBuilder = class {
           ...this._middlewareConfig,
           isAuth: this._isAuthModuleQueued,
           isLogger: this._isLoggerModuleQueued,
-          isCache: this._isCacheModuleQueued || this._isPipelineModuleQueued
+          isCache: this._isCacheModuleQueued || this._isPipelineModuleQueued,
+          httpConfig: this._httpConfig.http.client
         });
       }
     });
@@ -4812,7 +5168,7 @@ init_redis_cache();
 init_request_context();
 
 // src/infrastructure/datasources/remote.datasource.ts
-var import_shared68 = require("@xeno-js/shared");
+var import_shared74 = require("@xeno-js/shared");
 
 // src/infrastructure/index.ts
 init_factories();
@@ -4842,8 +5198,8 @@ init_pipeline_utils();
 init_validation_utils();
 
 // src/infrastructure/repositories/read-dao.ts
-var import_shared69 = require("@xeno-js/shared");
-var import_shared70 = require("@xeno-js/shared");
+var import_shared75 = require("@xeno-js/shared");
+var import_shared76 = require("@xeno-js/shared");
 var ReadDao = class {
   /**
    * Constructs a new ReadDao instance.
@@ -4863,23 +5219,23 @@ var ReadDao = class {
   _dataSource;
   _mapper;
   async findById(id, ctx, signal) {
-    import_shared69.AppError.throwIfAborted(signal, "ReadDao.findById");
+    import_shared75.AppError.throwIfAborted(signal, "ReadDao.findById");
     const result = await this._dataSource.findById(id, ctx, signal);
-    if (import_shared70.Guards.isNullOrEmpty(result)) return import_shared69.Result.ok();
+    if (import_shared76.Guards.isNullOrEmpty(result)) return import_shared75.Result.ok();
     const entity = this._mapper.toEntity(result);
-    return import_shared69.Result.ok(entity);
+    return import_shared75.Result.ok(entity);
   }
   async findAll(ctx, signal) {
-    import_shared69.AppError.throwIfAborted(signal, "ReadDao.findAll");
+    import_shared75.AppError.throwIfAborted(signal, "ReadDao.findAll");
     const results = await this._dataSource.findAll(ctx, signal);
     const entities = results.map((result) => this._mapper.toEntity(result));
-    return import_shared69.Result.ok(entities);
+    return import_shared75.Result.ok(entities);
   }
 };
 
 // src/infrastructure/repositories/repository.ts
-var import_shared71 = require("@xeno-js/shared");
-var import_shared72 = require("@xeno-js/shared");
+var import_shared77 = require("@xeno-js/shared");
+var import_shared78 = require("@xeno-js/shared");
 var Repository = class {
   /**
    * Constructs a new Repository instance.
@@ -4899,35 +5255,35 @@ var Repository = class {
   _dataSource;
   _mapper;
   async findById(id, ctx, signal) {
-    import_shared71.AppError.throwIfAborted(signal, "Repository.findById");
+    import_shared77.AppError.throwIfAborted(signal, "Repository.findById");
     const result = await this._dataSource.findById(id, ctx, signal);
-    if (import_shared72.Guards.isNullOrEmpty(result)) return import_shared71.Result.ok();
+    if (import_shared78.Guards.isNullOrEmpty(result)) return import_shared77.Result.ok();
     const entity = this._mapper.toEntity(result);
-    return import_shared71.Result.ok(entity);
+    return import_shared77.Result.ok(entity);
   }
   async findAll(ctx, signal) {
-    import_shared71.AppError.throwIfAborted(signal, "Repository.findAll");
+    import_shared77.AppError.throwIfAborted(signal, "Repository.findAll");
     const results = await this._dataSource.findAll(ctx, signal);
     const entities = results.map((result) => this._mapper.toEntity(result));
-    return import_shared71.Result.ok(entities);
+    return import_shared77.Result.ok(entities);
   }
   async save(entity, signal) {
     const dto = this._mapper.toDto(entity);
-    import_shared71.AppError.throwIfAborted(signal, "Repository.save");
+    import_shared77.AppError.throwIfAborted(signal, "Repository.save");
     await this._dataSource.insert(dto, signal);
-    return import_shared71.Result.ok();
+    return import_shared77.Result.ok();
   }
   async delete(entity, ctx, signal) {
     const dto = this._mapper.toDto(entity);
-    import_shared71.AppError.throwIfAborted(signal, "Repository.delete");
+    import_shared77.AppError.throwIfAborted(signal, "Repository.delete");
     await this._dataSource.delete(dto, ctx, signal);
-    return import_shared71.Result.ok();
+    return import_shared77.Result.ok();
   }
   async update(id, entity, ctx, signal) {
     const dto = this._mapper.toPartialDto(entity);
-    import_shared71.AppError.throwIfAborted(signal, "Repository.update");
+    import_shared77.AppError.throwIfAborted(signal, "Repository.update");
     await this._dataSource.update(id, dto, ctx, signal);
-    return import_shared71.Result.ok();
+    return import_shared77.Result.ok();
   }
 };
 
@@ -4945,7 +5301,7 @@ __reExport(drizzle_types_exports, require("drizzle-orm"));
 __reExport(index_exports, drizzle_types_exports, module.exports);
 init_presentation();
 __reExport(index_exports, require("@xeno-js/shared"), module.exports);
-var import_shared73 = require("@xeno-js/shared");
+var import_shared79 = require("@xeno-js/shared");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AppBuilder,
@@ -4960,4 +5316,13 @@ var import_shared73 = require("@xeno-js/shared");
   SupabaseServerAuthFactory,
   ...require("@xeno-js/shared")
 });
+/**
+ * @description The CsrfCookieMiddleware class implements the IMiddleware interface, providing a concrete implementation for handling CSRF token validation and cookie management. It checks the incoming request for a valid CSRF token and sets a CSRF cookie if necessary.
+ *
+ * @author Xeno
+ * @version 1.0.0
+ * @since 2025-09-30
+ * @link https://github.com/xeno-js/xeno-js
+ * @license MIT
+ */
 //# sourceMappingURL=index.cjs.map