@xeno-js/core 0.1.2 → 0.1.3

package/dist/index.js

@@ -1365,8 +1365,7 @@ var init_sentry_logger_factory = __esm({
           dsn: sentryConfig.dsn,
           environment: env,
           tracesSampleRate: env === "production" ? 0.1 : 1,
-          sendDefaultPii: false,
-          integrations: [new Sentry.Integrations.Http({ tracing: true })],
+          integrations: [Sentry.httpIntegration()],
           beforeSend(event, hint) {
             const error = hint.originalException;
             if (error instanceof Error && error.name === "ZodError") {
@@ -1509,15 +1508,15 @@ var init_logger_utils = __esm({
        */
       async addLogger(container, opts) {
         const loggerDependencies = [];
-        const { Guards: Guards39, LOG_LEVEL: LOG_LEVEL7, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
-        if (!Guards39.isDefined(opts) || opts.console) {
+        const { Guards: Guards45, LOG_LEVEL: LOG_LEVEL7, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
+        if (!Guards45.isDefined(opts) || opts.console) {
           const { ConsoleLogger: ConsoleLogger2 } = await Promise.resolve().then(() => (init_console_logger(), console_logger_exports));
           container.addSingleton(TOKENS4.CONSOLE_LOGGER, () => new ConsoleLogger2(opts?.level));
           loggerDependencies.push(TOKENS4.CONSOLE_LOGGER);
         }
         const customLoggerFactories = [];
-        if (Guards39.isDefined(opts)) {
-          if (Guards39.isDefined(opts.sentry.config)) {
+        if (Guards45.isDefined(opts)) {
+          if (Guards45.isDefined(opts.sentry.config)) {
             const { SentryLoggerFactory: SentryLoggerFactory2 } = await Promise.resolve().then(() => (init_sentry_logger_factory(), sentry_logger_factory_exports));
             container.addSingleton(TOKENS4.SENTRY_LOGGER, () => {
               const factory = new SentryLoggerFactory2();
@@ -1525,7 +1524,7 @@ var init_logger_utils = __esm({
             });
             loggerDependencies.push(TOKENS4.SENTRY_LOGGER);
           }
-          if (Guards39.isDefined(opts.pino.config)) {
+          if (Guards45.isDefined(opts.pino.config)) {
             const { PinoLoggerFactory: PinoLoggerFactory2 } = await Promise.resolve().then(() => (init_pino_logger_factory(), pino_logger_factory_exports));
             container.addSingleton(TOKENS4.PINO_LOGGER, () => {
               const factory = new PinoLoggerFactory2();
@@ -1533,10 +1532,10 @@ var init_logger_utils = __esm({
             });
             loggerDependencies.push(TOKENS4.PINO_LOGGER);
           }
-          if (!Guards39.isNullOrEmpty(opts.customLoggers)) {
+          if (!Guards45.isNullOrEmpty(opts.customLoggers)) {
             const customLoggers = opts.customLoggers;
             customLoggers.forEach((f) => {
-              if (Guards39.isDefined(f)) {
+              if (Guards45.isDefined(f)) {
                 customLoggerFactories.push(f);
               }
             });
@@ -1556,8 +1555,30 @@ var init_logger_utils = __esm({
   }
 });
 
+// src/infrastructure/cache/inmemory.cache.ts
+var inmemory_cache_exports = {};
+__export(inmemory_cache_exports, {
+  InMemoryCacheExtended: () => InMemoryCacheExtended
+});
+import { Guards as Guards19, InMemoryCache } from "@xeno-js/shared";
+var InMemoryCacheExtended;
+var init_inmemory_cache = __esm({
+  "src/infrastructure/cache/inmemory.cache.ts"() {
+    "use strict";
+    InMemoryCacheExtended = class extends InMemoryCache {
+      async increment(key, ttlSeconds) {
+        const current = await this.get(key) ?? 0;
+        const next = Number(current) + 1;
+        const ttl = Guards19.isDefined(ttlSeconds) ? Number(ttlSeconds) : 60;
+        await this.set(key, next, ttl);
+        return next;
+      }
+    };
+  }
+});
+
 // src/infrastructure/cache/redis.cache.ts
-import { Guards as Guards19, StringHelper } from "@xeno-js/shared";
+import { Guards as Guards20, StringHelper } from "@xeno-js/shared";
 var RedisCache;
 var init_redis_cache = __esm({
   "src/infrastructure/cache/redis.cache.ts"() {
@@ -1577,21 +1598,28 @@ var init_redis_cache = __esm({
         this._redisClient = _redisClient;
       }
       _redisClient;
+      async increment(key, ttlSeconds) {
+        const multi = this._redisClient.multi();
+        multi.incr(key);
+        multi.expire(key, ttlSeconds ?? 60);
+        const results = await multi.exec();
+        return results?.[0]?.[1] ?? 1;
+      }
       async get(key) {
         const value = await this._redisClient.get(key);
-        if (!Guards19.isDefined(value)) {
+        if (!Guards20.isDefined(value)) {
           return void 0;
         }
         return JSON.parse(value);
       }
       async set(key, value, ttl) {
         const stringValue = StringHelper.safeStringify(value);
-        const ttlOption = Guards19.isDefined(ttl) ? ttl : 86400;
+        const ttlOption = Guards20.isDefined(ttl) ? ttl : 86400;
         await this._redisClient.set(key, stringValue, "EX", ttlOption);
       }
       async setIfAbsent(key, value, ttl) {
         const stringValue = StringHelper.safeStringify(value);
-        const ttlOption = Guards19.isDefined(ttl) ? ttl : 300;
+        const ttlOption = Guards20.isDefined(ttl) ? ttl : 300;
         const result = await this._redisClient.set(key, stringValue, "EX", ttlOption, "NX");
         return result === "OK";
       }
@@ -1614,7 +1642,7 @@ var redis_cache_factory_exports = {};
 __export(redis_cache_factory_exports, {
   RedisCacheFactory: () => RedisCacheFactory
 });
-import { Guards as Guards20 } from "@xeno-js/shared";
+import { Guards as Guards21 } from "@xeno-js/shared";
 import { Redis } from "ioredis";
 var RedisCacheFactory;
 var init_redis_cache_factory = __esm({
@@ -1639,10 +1667,10 @@ var init_redis_cache_factory = __esm({
             return delay;
           }
         };
-        if (Guards20.isDefined(password)) {
+        if (Guards21.isDefined(password)) {
           redisOptions.password = password;
         }
-        if (Guards20.isDefined(username)) {
+        if (Guards21.isDefined(username)) {
           redisOptions.username = username;
         }
         if (useTls) {
@@ -1680,8 +1708,8 @@ var init_cache_utils = __esm({
        * @link https://github.com/xeno-js/xeno-js
        */
       async addCache(container, opts) {
-        const { Guards: Guards39, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
-        if (!opts.inMemory && !Guards39.isDefined(opts.redis)) {
+        const { Guards: Guards45, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
+        if (!opts.inMemory && !Guards45.isDefined(opts.redis)) {
           throw new Error(
             "No cache strategies are configured. Please provide at least one cache strategy."
           );
@@ -1691,12 +1719,12 @@ var init_cache_utils = __esm({
           TOKENS4.CACHE_KEY_BUILDER,
           (c) => new CacheKeyBuilder(c.resolve(TOKENS4.IDENTITY_ACCESSOR))
         );
-        if (opts.inMemory || !Guards39.isDefined(opts.redis)) {
-          const { InMemoryCache } = await import("@xeno-js/shared");
-          container.addSingleton(TOKENS4.CACHE, () => new InMemoryCache());
+        if (opts.inMemory || !Guards45.isDefined(opts.redis)) {
+          const { InMemoryCacheExtended: InMemoryCacheExtended2 } = await Promise.resolve().then(() => (init_inmemory_cache(), inmemory_cache_exports));
+          container.addSingleton(TOKENS4.CACHE, () => new InMemoryCacheExtended2());
           return;
         }
-        if (Guards39.isDefined(opts.redis)) {
+        if (Guards45.isDefined(opts.redis)) {
           const { RedisCacheFactory: RedisCacheFactory2 } = await Promise.resolve().then(() => (init_redis_cache_factory(), redis_cache_factory_exports));
           container.addSingleton(TOKENS4.CACHE, () => {
             const config = opts.redis;
@@ -1709,7 +1737,7 @@ var init_cache_utils = __esm({
 });
 
 // src/infrastructure/services/allow_methods/allow-method.service.ts
-import { Guards as Guards21 } from "@xeno-js/shared";
+import { Guards as Guards22 } from "@xeno-js/shared";
 var AllowMethodRegistry;
 var init_allow_method_service = __esm({
   "src/infrastructure/services/allow_methods/allow-method.service.ts"() {
@@ -1729,7 +1757,7 @@ var init_allow_method_service = __esm({
       check(path, method) {
         const cleanPath = this.normalizePath(path.split("?")[0].split("#")[0]);
         const staticMethods = this._staticRoutes.get(cleanPath);
-        if (Guards21.isDefined(staticMethods)) return staticMethods.includes(method);
+        if (Guards22.isDefined(staticMethods)) return staticMethods.includes(method);
         for (const route of this._dynamicRoutes) {
           if (route.pattern.test(cleanPath)) return route.methods.includes(method);
         }
@@ -1766,7 +1794,7 @@ var init_allow_methods = __esm({
 });
 
 // src/infrastructure/services/allow_origins/allow-origin.http.ts
-import { Guards as Guards22 } from "@xeno-js/shared";
+import { Guards as Guards23 } from "@xeno-js/shared";
 var AllowOrigin;
 var init_allow_origin_http = __esm({
   "src/infrastructure/services/allow_origins/allow-origin.http.ts"() {
@@ -1777,7 +1805,7 @@ var init_allow_origin_http = __esm({
       }
       _list;
       isAllowed(origin) {
-        if (Guards22.isNullOrEmpty(origin)) return true;
+        if (Guards23.isNullOrEmpty(origin)) return true;
         const cleanOrigin = origin.trim().toLowerCase();
         for (const pattern of this._list) {
           const cleanPattern = pattern.trim().toLowerCase();
@@ -1787,7 +1815,7 @@ var init_allow_origin_http = __esm({
             const domainSuffix = cleanPattern.substring(1);
             if (cleanOrigin.endsWith(domainSuffix)) {
               const prefix = cleanOrigin.slice(0, cleanOrigin.length - domainSuffix.length);
-              if (!Guards22.isNullOrEmpty(prefix) && !prefix.includes(".")) return true;
+              if (!Guards23.isNullOrEmpty(prefix) && !prefix.includes(".")) return true;
             }
           }
         }
@@ -1833,8 +1861,108 @@ var init_concurrency = __esm({
   }
 });
 
+// src/infrastructure/services/crypto/crypto.service.ts
+var EdgeCryptoService;
+var init_crypto_service = __esm({
+  "src/infrastructure/services/crypto/crypto.service.ts"() {
+    "use strict";
+    EdgeCryptoService = class {
+      randomBytes(size) {
+        const buffer = new Uint8Array(size);
+        crypto.getRandomValues(buffer);
+        return buffer;
+      }
+      async hmacSha256(secret, data) {
+        const encoder = new TextEncoder();
+        const keyData = encoder.encode(secret);
+        const messageData = encoder.encode(data);
+        const cryptoKey = await crypto.subtle.importKey(
+          "raw",
+          keyData,
+          { name: "HMAC", hash: "SHA-256" },
+          false,
+          ["sign"]
+        );
+        const signature = await crypto.subtle.sign("HMAC", cryptoKey, messageData);
+        return btoa(String.fromCharCode(...new Uint8Array(signature))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+      }
+      timingSafeEqual(a, b) {
+        if (a.length !== b.length) {
+          return false;
+        }
+        let mismatch = 0;
+        for (let i = 0; i < a.length; i++) {
+          mismatch |= a[i] ^ b[i];
+        }
+        return mismatch === 0;
+      }
+    };
+  }
+});
+
+// src/infrastructure/services/crypto/index.ts
+var init_crypto = __esm({
+  "src/infrastructure/services/crypto/index.ts"() {
+    "use strict";
+    init_crypto_service();
+  }
+});
+
+// src/infrastructure/services/csrf/csrf-token.service.ts
+import { Guards as Guards24 } from "@xeno-js/shared";
+var CsrfTokenService;
+var init_csrf_token_service = __esm({
+  "src/infrastructure/services/csrf/csrf-token.service.ts"() {
+    "use strict";
+    CsrfTokenService = class {
+      constructor(_secret, _cryptoService) {
+        this._secret = _secret;
+        this._cryptoService = _cryptoService;
+      }
+      _secret;
+      _cryptoService;
+      async generate(subject) {
+        const randomBuffer = this._cryptoService.randomBytes(32);
+        const nonce = btoa(String.fromCharCode(...randomBuffer)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+        const signature = await this._cryptoService.hmacSha256(
+          this._secret,
+          `${subject}.${nonce}`
+        );
+        return `${nonce}.${signature}`;
+      }
+      async validate(token, subject) {
+        const separatorIndex = token.indexOf(".");
+        if (separatorIndex <= 0)
+          return false;
+        const nonce = token.slice(0, separatorIndex);
+        const signature = token.slice(separatorIndex + 1);
+        if (Guards24.isNullOrEmpty(nonce) || Guards24.isNullOrEmpty(signature))
+          return false;
+        const expected = await this._cryptoService.hmacSha256(
+          this._secret,
+          `${subject}.${nonce}`
+        );
+        const encoder = new TextEncoder();
+        const actualBuffer = encoder.encode(signature);
+        const expectedBuffer = encoder.encode(expected);
+        if (actualBuffer.length !== expectedBuffer.length)
+          return false;
+        return this._cryptoService.timingSafeEqual(actualBuffer, expectedBuffer);
+      }
+    };
+  }
+});
+
+// src/infrastructure/services/csrf/index.ts
+var init_csrf = __esm({
+  "src/infrastructure/services/csrf/index.ts"() {
+    "use strict";
+    init_csrf_token_service();
+  }
+});
+
 // src/infrastructure/services/extractors/extract-bearer.extractor.ts
-import { Guards as Guards23, StringHelper as StringHelper2 } from "@xeno-js/shared";
+import { Guards as Guards25, StringHelper as StringHelper2 } from "@xeno-js/shared";
 var BearerTokenExtractor;
 var init_extract_bearer_extractor = __esm({
   "src/infrastructure/services/extractors/extract-bearer.extractor.ts"() {
@@ -1842,16 +1970,16 @@ var init_extract_bearer_extractor = __esm({
     BearerTokenExtractor = class {
       extract(headers) {
         const authHeader = StringHelper2.getSingleValue(headers["authorization"]);
-        if (!Guards23.isDefined(authHeader)) {
+        if (!Guards25.isDefined(authHeader)) {
           return void 0;
         }
         if (authHeader.toLowerCase().startsWith("bearer ")) {
           return authHeader.substring(7);
         }
         const cookieHeader = StringHelper2.getSingleValue(headers["cookie"]);
-        if (Guards23.isDefined(cookieHeader)) {
+        if (Guards25.isDefined(cookieHeader)) {
           const match = /sb-access-token=([^;]+)/.exec(cookieHeader);
-          if (!Guards23.isNullOrEmpty(match) && Guards23.isDefined(match[1])) {
+          if (!Guards25.isNullOrEmpty(match) && Guards25.isDefined(match[1])) {
             return match[1].trim();
           }
         }
@@ -1863,7 +1991,7 @@ var init_extract_bearer_extractor = __esm({
 
 // src/infrastructure/services/extractors/extract-ssr-bearer.extractor.ts
 import {
-  Guards as Guards24,
+  Guards as Guards26,
   StringHelper as StringHelper3
 } from "@xeno-js/shared";
 var SupabaseSsrTokenExtractor;
@@ -1873,36 +2001,36 @@ var init_extract_ssr_bearer_extractor = __esm({
     SupabaseSsrTokenExtractor = class {
       extract(headers) {
         const authHeader = StringHelper3.getSingleValue(headers["authorization"]);
-        if (Guards24.isDefined(authHeader) && authHeader.toLowerCase().startsWith("bearer ")) {
+        if (Guards26.isDefined(authHeader) && authHeader.toLowerCase().startsWith("bearer ")) {
           return authHeader.substring(7);
         }
         const cookieHeader = StringHelper3.getSingleValue(headers["cookie"]);
-        if (Guards24.isNullOrEmpty(cookieHeader)) return void 0;
+        if (Guards26.isNullOrEmpty(cookieHeader)) return void 0;
         const cookies = cookieHeader.split(";").map((c) => c.trim());
         const tokenChunks = {};
         let unchunkedToken;
         for (const cookie of cookies) {
           const [name, ...rest] = cookie.split("=");
-          if (!Guards24.isDefined(name) || Guards24.isNullOrEmpty(rest)) continue;
+          if (!Guards26.isDefined(name) || Guards26.isNullOrEmpty(rest)) continue;
           const value = decodeURIComponent(rest.join("="));
-          if (Guards24.isDefined(/^sb-[a-z0-9]+-auth-token$/.exec(name))) {
+          if (Guards26.isDefined(/^sb-[a-z0-9]+-auth-token$/.exec(name))) {
             unchunkedToken = value;
           } else {
             const match = /^sb-[a-z0-9]+-auth-token\.(\d+)$/.exec(name);
-            if (Guards24.isDefined(match)) tokenChunks[parseInt(match[1], 10)] = value;
+            if (Guards26.isDefined(match)) tokenChunks[parseInt(match[1], 10)] = value;
           }
         }
         let fullTokenString = unchunkedToken;
-        if (!Guards24.isDefined(fullTokenString) && Object.keys(tokenChunks).length > 0) {
+        if (!Guards26.isDefined(fullTokenString) && Object.keys(tokenChunks).length > 0) {
           const indices = Object.keys(tokenChunks).map(Number).sort((a, b) => a - b);
           fullTokenString = indices.map((i) => tokenChunks[i]).join("");
         }
-        if (Guards24.isNullOrEmpty(fullTokenString)) return void 0;
+        if (Guards26.isNullOrEmpty(fullTokenString)) return void 0;
         try {
           const parsed = StringHelper3.safeParse(fullTokenString);
-          if (Guards24.isDefined(parsed) && Guards24.isObject(parsed) && "access_token" in parsed) {
+          if (Guards26.isDefined(parsed) && Guards26.isObject(parsed) && "access_token" in parsed) {
             const accessToken = parsed["access_token"];
-            if (Guards24.isString(accessToken)) return accessToken;
+            if (Guards26.isString(accessToken)) return accessToken;
           }
         } catch {
           return void 0;
@@ -1912,9 +2040,39 @@ var init_extract_ssr_bearer_extractor = __esm({
   }
 });
 
+// src/infrastructure/services/extractors/http-cookie.extractor.ts
+import { Guards as Guards27 } from "@xeno-js/shared";
+var HttpCookieExtractor;
+var init_http_cookie_extractor = __esm({
+  "src/infrastructure/services/extractors/http-cookie.extractor.ts"() {
+    "use strict";
+    HttpCookieExtractor = class {
+      extract(cookie) {
+        if (!Guards27.isDefined(cookie.header))
+          return void 0;
+        for (const rawCookie of cookie.header.split(";")) {
+          const separatorIndex = rawCookie.indexOf("=");
+          if (separatorIndex <= 0)
+            continue;
+          const name = rawCookie.slice(0, separatorIndex).trim();
+          if (name !== cookie.name)
+            continue;
+          const value = rawCookie.slice(separatorIndex + 1).trim();
+          try {
+            return decodeURIComponent(value);
+          } catch {
+            return void 0;
+          }
+        }
+        return void 0;
+      }
+    };
+  }
+});
+
 // src/infrastructure/services/extractors/http-header.extractor.ts
 import {
-  Guards as Guards25,
+  Guards as Guards28,
   GuidHelper as GuidHelper4,
   HttpHelper,
   MathHelper,
@@ -1934,12 +2092,16 @@ var init_http_header_extractor = __esm({
        * @since 2025-09-30
        * @link https://github.com/xeno-js/xeno-js 
        */
-      constructor(_bearerExtractor, _trustedIp) {
+      constructor(_bearerExtractor, _cookieExtractor, _trustedIp, _cookieName) {
         this._bearerExtractor = _bearerExtractor;
+        this._cookieExtractor = _cookieExtractor;
         this._trustedIp = _trustedIp;
+        this._cookieName = _cookieName;
       }
       _bearerExtractor;
+      _cookieExtractor;
       _trustedIp;
+      _cookieName;
       extract(headers) {
         const correlationId = GuidHelper4.parse(StringHelper4.getSingleValue(headers["x-correlation-id"]));
         const requestId = GuidHelper4.parse(StringHelper4.getSingleValue(headers["x-request-id"]));
@@ -1955,7 +2117,14 @@ var init_http_header_extractor = __esm({
         const position = StringHelper4.getSingleValue(headers["x-sequence-position"]);
         const size = StringHelper4.getSingleValue(headers["x-sequence-size"]);
         const expiration = StringHelper4.getSingleValue(headers["x-expiration"]);
-        const csrf = StringHelper4.getSingleValue(headers["x-requested-with"]);
+        const csrf = StringHelper4.getSingleValue(headers["x-csrf-token"]);
+        const cookieHeader = StringHelper4.getSingleValue(headers["cookie"]);
+        const csrfCookie = this._cookieExtractor.extract(
+          {
+            header: cookieHeader,
+            name: this._cookieName
+          }
+        );
         const origin = StringHelper4.getSingleValue(headers["origin"]);
         const cleanOrigin = HttpHelper.sanitizeOriginUrl(origin);
         const referer = StringHelper4.getSingleValue(headers["referer"]);
@@ -1973,14 +2142,15 @@ var init_http_header_extractor = __esm({
           userAgent,
           returnAddress,
           csrf,
+          csrfCookie,
           origin: cleanOrigin,
           referer: cleanReferer,
           sequence: {
             sequenceId,
-            position: Guards25.isDefined(position) ? MathHelper.toNumber(position) : void 0,
-            size: Guards25.isDefined(size) ? MathHelper.toNumber(size) : void 0
+            position: Guards28.isDefined(position) ? MathHelper.toNumber(position) : void 0,
+            size: Guards28.isDefined(size) ? MathHelper.toNumber(size) : void 0
           },
-          expiration: Guards25.isDefined(expiration) ? MathHelper.toNumber(expiration) : void 0
+          expiration: Guards28.isDefined(expiration) ? MathHelper.toNumber(expiration) : void 0
         };
         return metadata;
       }
@@ -1994,6 +2164,7 @@ var init_extractors = __esm({
     "use strict";
     init_extract_bearer_extractor();
     init_extract_ssr_bearer_extractor();
+    init_http_cookie_extractor();
     init_http_header_extractor();
   }
 });
@@ -2025,12 +2196,82 @@ var init_resiliences = __esm({
   }
 });
 
+// src/infrastructure/services/resolver/utils/socket.utils.ts
+import { Guards as Guards29 } from "@xeno-js/shared";
+var SocketIpExtractor;
+var init_socket_utils = __esm({
+  "src/infrastructure/services/resolver/utils/socket.utils.ts"() {
+    "use strict";
+    SocketIpExtractor = Object.freeze({
+      /**
+       * @description Extracts the IP address of the remote socket from an incoming request.
+       * @param req The incoming request object.
+       * @returns The IP address of the remote socket, or undefined if not available.
+       */
+      extract(req) {
+        if (Guards29.isDefined(req) && Guards29.isObject(req)) {
+          const candidate = req;
+          return candidate.socket?.remoteAddress ?? candidate.connection?.remoteAddress;
+        }
+        return void 0;
+      }
+    });
+  }
+});
+
+// src/infrastructure/services/resolver/utils/index.ts
+var init_utils = __esm({
+  "src/infrastructure/services/resolver/utils/index.ts"() {
+    "use strict";
+    init_socket_utils();
+  }
+});
+
+// src/infrastructure/services/resolver/client-ip.resolver.ts
+import { Guards as Guards30 } from "@xeno-js/shared";
+var ClientIpResolver;
+var init_client_ip_resolver = __esm({
+  "src/infrastructure/services/resolver/client-ip.resolver.ts"() {
+    "use strict";
+    init_utils();
+    ClientIpResolver = class {
+      constructor(_trustedProxies = []) {
+        this._trustedProxies = _trustedProxies;
+      }
+      _trustedProxies;
+      resolve(req, clientIp) {
+        const socketIp = SocketIpExtractor.extract(req);
+        if (!Guards30.isDefined(socketIp))
+          return !Guards30.isNullOrEmpty(clientIp) ? clientIp.split(",")[0].trim() : void 0;
+        const isTrustedProxy = this._trustedProxies.includes(socketIp);
+        if (!isTrustedProxy)
+          return socketIp;
+        if (Guards30.isDefined(clientIp))
+          return clientIp.split(",")[0].trim();
+        return socketIp;
+      }
+    };
+  }
+});
+
+// src/infrastructure/services/resolver/index.ts
+var init_resolver = __esm({
+  "src/infrastructure/services/resolver/index.ts"() {
+    "use strict";
+    init_client_ip_resolver();
+  }
+});
+
 // src/infrastructure/services/index.ts
 var services_exports = {};
 __export(services_exports, {
   AllowMethodRegistry: () => AllowMethodRegistry,
   AllowOrigin: () => AllowOrigin,
   BearerTokenExtractor: () => BearerTokenExtractor,
+  ClientIpResolver: () => ClientIpResolver,
+  CsrfTokenService: () => CsrfTokenService,
+  EdgeCryptoService: () => EdgeCryptoService,
+  HttpCookieExtractor: () => HttpCookieExtractor,
   HttpHeaderExtractor: () => HttpHeaderExtractor,
   PLimitConcurrencyService: () => PLimitConcurrencyService,
   ServiceResilience: () => ServiceResilience,
@@ -2042,8 +2283,11 @@ var init_services = __esm({
     init_allow_methods();
     init_allow_origins();
     init_concurrency();
+    init_crypto();
+    init_csrf();
     init_extractors();
     init_resiliences();
+    init_resolver();
   }
 });
 
@@ -2106,7 +2350,7 @@ var init_axios_factory = __esm({
 });
 
 // src/infrastructure/factories/cockatiel-resilience.factory.ts
-import { AppError as AppError13, Guards as Guards26, RESILIENCE_DEFAULTS } from "@xeno-js/shared";
+import { AppError as AppError13, Guards as Guards31, RESILIENCE_DEFAULTS } from "@xeno-js/shared";
 import {
   bulkhead,
   circuitBreaker,
@@ -2183,13 +2427,13 @@ var init_cockatiel_resilience_factory = __esm({
         return new ServiceResilience(wrap(bulkheadPolicy, circuitBreakerPolicy, retryPolicy));
       }
       isTransientError(error) {
-        if (!Guards26.isDefined(error) || !Guards26.isObject(error)) return false;
+        if (!Guards31.isDefined(error) || !Guards31.isObject(error)) return false;
         let status;
         let isNetworkError = false;
         if (error instanceof AppError13) {
           status = error.status;
           const cause = error.cause;
-          if (Guards26.isDefined(cause) && Guards26.isString(cause.code)) {
+          if (Guards31.isDefined(cause) && Guards31.isString(cause.code)) {
             isNetworkError = [
               "ECONNABORTED",
               "ECONNRESET",
@@ -2201,7 +2445,7 @@ var init_cockatiel_resilience_factory = __esm({
         } else {
           const err = error;
           status = err.status;
-          if (Guards26.isString(err.code)) {
+          if (Guards31.isString(err.code)) {
             isNetworkError = [
               "ECONNABORTED",
               "ECONNRESET",
@@ -2212,7 +2456,7 @@ var init_cockatiel_resilience_factory = __esm({
           }
         }
         if (isNetworkError) return true;
-        if (Guards26.isDefined(status)) {
+        if (Guards31.isDefined(status)) {
           return status === 408 || status === 429 || status >= 500 && status < 600;
         }
         return false;
@@ -2222,22 +2466,22 @@ var init_cockatiel_resilience_factory = __esm({
         let method;
         if (error instanceof AppError13) {
           const cause = error.cause;
-          if (Guards26.isDefined(cause) && Guards26.isDefined(cause.config) && Guards26.isString(cause.config.method)) {
+          if (Guards31.isDefined(cause) && Guards31.isDefined(cause.config) && Guards31.isString(cause.config.method)) {
             method = cause.config.method.toUpperCase();
           }
         } else {
           const err = error;
-          if (Guards26.isDefined(err.config) && Guards26.isString(err.config.method)) {
+          if (Guards31.isDefined(err.config) && Guards31.isString(err.config.method)) {
             method = err.config.method.toUpperCase();
           }
         }
-        if (Guards26.isNullOrEmpty(method)) return false;
+        if (Guards31.isNullOrEmpty(method)) return false;
         const idempotentMethods = ["GET", "PUT", "DELETE", "HEAD", "OPTIONS"];
         return idempotentMethods.includes(method);
       }
       checkConfigValue(value, defaultValue, message) {
-        if (Guards26.isDefined(value)) {
-          Guards26.throwIfNegative(value, message);
+        if (Guards31.isDefined(value)) {
+          Guards31.throwIfNegative(value, message);
           return value;
         }
         return defaultValue;
@@ -2269,7 +2513,7 @@ var init_db_client_factory = __esm({
 });
 
 // src/infrastructure/context/request-context.ts
-import { Guards as Guards27 } from "@xeno-js/shared";
+import { Guards as Guards32 } from "@xeno-js/shared";
 var NodeRequestContext;
 var init_request_context = __esm({
   "src/infrastructure/context/request-context.ts"() {
@@ -2301,7 +2545,7 @@ var init_request_context = __esm({
       }
       updateIdentity(identity) {
         const store = this._storage.getStore();
-        if (Guards27.isDefined(store) && Guards27.isDefined(store.context)) {
+        if (Guards32.isDefined(store) && Guards32.isDefined(store.context)) {
           store.context = Object.freeze({
             ...store.context,
             identity: Object.freeze(identity)
@@ -2310,23 +2554,23 @@ var init_request_context = __esm({
       }
       getContext() {
         const store = this._storage.getStore();
-        if (!Guards27.isDefined(store)) return void 0;
+        if (!Guards32.isDefined(store)) return void 0;
         const context = store.context;
         return Object.freeze(context);
       }
       getIdentity() {
         const store = this._storage.getStore();
-        if (!Guards27.isDefined(store)) return void 0;
+        if (!Guards32.isDefined(store)) return void 0;
         return Object.freeze(store.context?.identity);
       }
       getScope() {
         const store = this._storage.getStore();
-        if (!Guards27.isDefined(store)) return void 0;
+        if (!Guards32.isDefined(store)) return void 0;
         return store.scope;
       }
       getNetworkContext() {
         const store = this._storage.getStore();
-        if (!Guards27.isDefined(store)) return void 0;
+        if (!Guards32.isDefined(store)) return void 0;
         return Object.freeze(store.context?.network);
       }
     };
@@ -2401,7 +2645,7 @@ var init_sql_light_db_client_factory = __esm({
 // src/infrastructure/factories/supabase.factory.ts
 import { createServerClient } from "@supabase/ssr";
 import {
-  Guards as Guards28,
+  Guards as Guards33,
   SupabaseAuthService,
   SupabaseClaimsMapper,
   SupabaseSessionMapper
@@ -2415,7 +2659,7 @@ var init_supabase_factory = __esm({
         config,
         container
       }) {
-        if (!Guards28.isDefined(config.ssrOpts)) {
+        if (!Guards33.isDefined(config.ssrOpts)) {
           throw new Error("ISsrCookieHandler is required for @supabase/ssr initialization.");
         }
         const cookieService = config.ssrOpts(container);
@@ -2443,7 +2687,7 @@ var user_context_factory_exports = {};
 __export(user_context_factory_exports, {
   UserContextFactory: () => UserContextFactory
 });
-import { Guards as Guards29 } from "@xeno-js/shared";
+import { Guards as Guards34 } from "@xeno-js/shared";
 var UserContextFactory;
 var init_user_context_factory = __esm({
   "src/infrastructure/factories/user-context.factory.ts"() {
@@ -2468,7 +2712,7 @@ var init_user_context_factory = __esm({
           tenantId: void 0
         };
         const identity = this._identityFactory.getIdentity();
-        if (Guards29.isDefined(identity)) {
+        if (Guards34.isDefined(identity)) {
           output.userId = identity.userId;
           output.tenantId = identity.tenantId;
         }
@@ -2561,8 +2805,8 @@ var init_auth_utils = __esm({
         const { TOKENS: TOKENS4 } = await import("@xeno-js/shared");
         const pipelines = [];
         const strategies = [];
-        const { Guards: Guards39 } = await import("@xeno-js/shared");
-        if (Guards39.isDefined(opts.policies)) {
+        const { Guards: Guards45 } = await import("@xeno-js/shared");
+        if (Guards45.isDefined(opts.policies)) {
           const { PolicyRegistry: PolicyRegistry2 } = await Promise.resolve().then(() => (init_application(), application_exports));
           container.addSingleton(TOKENS4.POLICY_REGISTRY, () => new PolicyRegistry2());
           const policyRegistry = opts.policies;
@@ -2571,16 +2815,16 @@ var init_auth_utils = __esm({
           for (const [intent, policy] of Object.entries(policyRegistry)) {
             const intentLower = intent.toLowerCase();
             registryInstance.addPolicy(intentLower, policy);
-            if (!Guards39.isNullOrEmpty(policy.roles)) {
+            if (!Guards45.isNullOrEmpty(policy.roles)) {
               Policies.add("roles");
             }
-            if (!Guards39.isNullOrEmpty(policy.permissions)) {
+            if (!Guards45.isNullOrEmpty(policy.permissions)) {
               Policies.add("permissions");
             }
-            if (!Guards39.isNullOrEmpty(policy.userId)) {
+            if (!Guards45.isNullOrEmpty(policy.userId)) {
               Policies.add("userId");
             }
-            if (!Guards39.isNullOrEmpty(policy.tenantId)) {
+            if (!Guards45.isNullOrEmpty(policy.tenantId)) {
               Policies.add("tenantId");
             }
           }
@@ -2629,10 +2873,10 @@ var init_auth_utils = __esm({
             strategies.push(TOKENS4.TENANT_AUTHORIZATION_PIPELINE);
           }
         }
-        if (!Guards39.isNullOrEmpty(opts.customAuthorizationStrategy)) {
+        if (!Guards45.isNullOrEmpty(opts.customAuthorizationStrategy)) {
           const customStrategies = opts.customAuthorizationStrategy;
           customStrategies.forEach((strategyToken, index) => {
-            if (Guards39.isDefined(strategyToken)) {
+            if (Guards45.isDefined(strategyToken)) {
               const token = `CUSTOM_AUTHORIZATION_STRATEGY_${index}`;
               container.addSingleton(token, (c) => {
                 return strategyToken(c);
@@ -2775,7 +3019,7 @@ __export(unit_of_work_exports, {
   UnitOfWork: () => UnitOfWork
 });
 import { AppError as AppError14 } from "@xeno-js/shared";
-import { Guards as Guards30 } from "@xeno-js/shared";
+import { Guards as Guards35 } from "@xeno-js/shared";
 var UnitOfWork;
 var init_unit_of_work = __esm({
   "src/infrastructure/transaction/unit-of-work.ts"() {
@@ -2810,9 +3054,9 @@ var init_unit_of_work = __esm({
         });
       }
       async dispose() {
-        if (Guards30.isDefined(this._ttx.state)) {
+        if (Guards35.isDefined(this._ttx.state)) {
           try {
-            if (Guards30.hasMethod(this._ttx.state, "rollback")) {
+            if (Guards35.hasMethod(this._ttx.state, "rollback")) {
               await this._ttx.state.rollback();
             }
           } finally {
@@ -2835,7 +3079,7 @@ var init_db_module = __esm({
     "use strict";
     DbModule = class {
       async configure(container, opts) {
-        const { Guards: Guards39, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
+        const { Guards: Guards45, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
         const { DbUtils: DbUtils2 } = await Promise.resolve().then(() => (init_db_utils(), db_utils_exports));
         const db = opts.enableSqlLite ? await DbUtils2.addSqlLite(opts) : await DbUtils2.addDbClient(opts);
         const { TransactionState: TransactionState2 } = await Promise.resolve().then(() => (init_transaction_state(), transaction_state_exports));
@@ -2852,7 +3096,7 @@ var init_db_module = __esm({
           return new Proxy(db, {
             get(_target, prop, receiver) {
               const activeState = ttx.state;
-              if (Guards39.isDefined(activeState)) {
+              if (Guards45.isDefined(activeState)) {
                 if (prop === "transaction") {
                   return activeState.transaction.bind(activeState);
                 }
@@ -2889,14 +3133,14 @@ var init_http_utils = __esm({
        */
       async addAxios(container, opts) {
         const { NodeAxiosFactory: NodeAxiosFactory2 } = await Promise.resolve().then(() => (init_factories(), factories_exports));
-        const { Guards: Guards39 } = await import("@xeno-js/shared");
-        if (!Guards39.isDefined(opts.token)) {
+        const { Guards: Guards45 } = await import("@xeno-js/shared");
+        if (!Guards45.isDefined(opts.token)) {
           throw new Error("HttpConfig.token is required and must be defined.");
         }
         container.addSingleton(opts.token, () => {
           const factory = new NodeAxiosFactory2();
           const instance = factory.create(opts.client);
-          if (!Guards39.hasMethod(instance, "get") || !Guards39.hasMethod(instance, "post") || !Guards39.hasMethod(instance, "put") || !Guards39.hasMethod(instance, "patch") || !Guards39.hasMethod(instance, "delete")) {
+          if (!Guards45.hasMethod(instance, "get") || !Guards45.hasMethod(instance, "post") || !Guards45.hasMethod(instance, "put") || !Guards45.hasMethod(instance, "patch") || !Guards45.hasMethod(instance, "delete")) {
             throw new Error(
               "The created HTTP client instance does not implement the required methods of IHttpClient."
             );
@@ -2923,8 +3167,8 @@ var init_http_utils = __esm({
         });
       },
       async addAllowOrigin(container, opts) {
-        const { Guards: Guards39 } = await import("@xeno-js/shared");
-        if (Guards39.isNullOrEmpty(opts)) throw new Error("At least an allow origin must be passed");
+        const { Guards: Guards45 } = await import("@xeno-js/shared");
+        if (Guards45.isNullOrEmpty(opts)) throw new Error("At least an allow origin must be passed");
         const { TOKENS: TOKENS4 } = await import("@xeno-js/shared");
         const { AllowOrigin: AllowOrigin2 } = await Promise.resolve().then(() => (init_services(), services_exports));
         const allowOrigin = [];
@@ -2984,13 +3228,13 @@ var init_validation_utils = __esm({
        * @link https://github.com/xeno-js/xeno-js
        */
       async addValidation(container, opts, logger) {
-        const { Guards: Guards39, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
-        if (!Guards39.isDefined(opts.zod) && Guards39.isNullOrEmpty(opts.customValidationStrategy)) {
+        const { Guards: Guards45, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
+        if (!Guards45.isDefined(opts.zod) && Guards45.isNullOrEmpty(opts.customValidationStrategy)) {
           return [];
         }
         const pipelines = [];
         const validationStrategies = [];
-        if (Guards39.isDefined(opts.zod)) {
+        if (Guards45.isDefined(opts.zod)) {
           const config = opts.zod;
           const { ZodValidatorFactory: ZodValidatorFactory2 } = await Promise.resolve().then(() => (init_zod_validator_factory(), zod_validator_factory_exports));
           container.addSingleton(TOKENS4.ZOD_VALIDATOR, () => {
@@ -3004,9 +3248,9 @@ var init_validation_utils = __esm({
           validationStrategies.push(TOKENS4.SCHEMA_VALIDATION_STRATEGY);
         }
         const customValidationFactory = [];
-        if (!Guards39.isNullOrEmpty(opts.customValidationStrategy)) {
+        if (!Guards45.isNullOrEmpty(opts.customValidationStrategy)) {
           for (const strategyToken of opts.customValidationStrategy) {
-            if (Guards39.isDefined(strategyToken)) {
+            if (Guards45.isDefined(strategyToken)) {
               customValidationFactory.push(strategyToken);
             }
           }
@@ -3109,8 +3353,8 @@ var init_pipeline_utils = __esm({
        */
       async addCommand(container, opts) {
         const pipelines = [];
-        const { Guards: Guards39, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
-        if (Guards39.isDefined(opts.idempotency)) {
+        const { Guards: Guards45, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
+        if (Guards45.isDefined(opts.idempotency)) {
           const { IdempotencyStore: IdempotencyStore2 } = await Promise.resolve().then(() => (init_idempotency_store(), idempotency_store_exports));
           container.addSingleton(
             TOKENS4.IDEMPOTENCY_STORE,
@@ -3130,7 +3374,7 @@ var init_pipeline_utils = __esm({
           });
           pipelines.push(TOKENS4.IDEMPOTENCY_PIPELINE);
         }
-        if (Guards39.isDefined(opts.concurrency)) {
+        if (Guards45.isDefined(opts.concurrency)) {
           const { ConcurrencyRetryPipeline: ConcurrencyRetryPipeline2 } = await Promise.resolve().then(() => (init_application(), application_exports));
           container.addSingleton(TOKENS4.CONCURRENCY_RETRY_PIPELINE, () => {
             const config = opts.concurrency;
@@ -3210,13 +3454,13 @@ var init_cqrs_module = __esm({
           return new PerformancePipeline2(logger, thresholdMs);
         });
         pipelines.push(TOKENS4.PERFORMANCE_PIPELINE);
-        const { Guards: Guards39 } = await import("@xeno-js/shared");
-        if (Guards39.isDefined(opts.authorization.policies) || Guards39.isDefined(opts.authorization.customAuthorizationStrategy)) {
+        const { Guards: Guards45 } = await import("@xeno-js/shared");
+        if (Guards45.isDefined(opts.authorization.policies) || Guards45.isDefined(opts.authorization.customAuthorizationStrategy)) {
           const { AuthUtils: AuthUtils2 } = await Promise.resolve().then(() => (init_auth_utils(), auth_utils_exports));
           const authPipelines = await AuthUtils2.addAuthZ(container, opts.authorization);
           pipelines.push(...authPipelines);
         }
-        if (Guards39.isDefined(opts.validation.zod) || Guards39.isDefined(opts.validation.customValidationStrategy)) {
+        if (Guards45.isDefined(opts.validation.zod) || Guards45.isDefined(opts.validation.customValidationStrategy)) {
           const { ValidationUtils: ValidationUtils2 } = await Promise.resolve().then(() => (init_validation_utils(), validation_utils_exports));
           const logger = container.resolve(TOKENS4.LOGGER);
           const validationPipelines = await ValidationUtils2.addValidation(
@@ -3228,11 +3472,11 @@ var init_cqrs_module = __esm({
         }
         const commandPipelines = pipelines;
         const queryPipelines = pipelines;
-        if ((Guards39.isDefined(opts.commandBus.idempotency) || opts.queryBus.isEnabled) && opts.isCache) {
+        if ((Guards45.isDefined(opts.commandBus.idempotency) || opts.queryBus.isEnabled) && opts.isCache) {
           const { CacheUtils: CacheUtils2 } = await Promise.resolve().then(() => (init_cache_utils(), cache_utils_exports));
           await CacheUtils2.addCache(container, { inMemory: true, redis: void 0 });
         }
-        if (Guards39.isDefined(opts.commandBus.idempotency) || Guards39.isDefined(opts.commandBus.concurrency)) {
+        if (Guards45.isDefined(opts.commandBus.idempotency) || Guards45.isDefined(opts.commandBus.concurrency)) {
           const { PipelineUtils: PipelineUtils2 } = await Promise.resolve().then(() => (init_pipeline_utils(), pipeline_utils_exports));
           const newCommandPipelines = await PipelineUtils2.addCommand(container, {
             ...opts.commandBus,
@@ -3554,7 +3798,7 @@ var init_composite_middleware = __esm({
 });
 
 // src/presentation/middlewares/cors.middleware.ts
-import { Guards as Guards31 } from "@xeno-js/shared";
+import { Guards as Guards36 } from "@xeno-js/shared";
 var CORSMiddleware;
 var init_cors_middleware = __esm({
   "src/presentation/middlewares/cors.middleware.ts"() {
@@ -3568,7 +3812,7 @@ var init_cors_middleware = __esm({
         const { network } = this._requestContext.getContext() ?? {};
         const origin = network?.origin;
         const response = await next();
-        if (Guards31.isDefined(origin))
+        if (Guards36.isDefined(origin))
           response.headers = {
             ...response.headers ?? {},
             "Access-Control-Allow-Origin": origin,
@@ -3585,7 +3829,7 @@ var init_cors_middleware = __esm({
 import {
   ERROR_CODE_MESSAGES as ERROR_CODE_MESSAGES5,
   ERROR_CODES as ERROR_CODES6,
-  Guards as Guards32,
+  Guards as Guards37,
   GuidHelper as GuidHelper9,
   HttpHelper as HttpHelper6,
   STATUS_CODES as STATUS_CODES7
@@ -3595,30 +3839,72 @@ var init_csrf_middleware = __esm({
   "src/presentation/middlewares/csrf.middleware.ts"() {
     "use strict";
     CsrfMiddleware = class {
-      constructor(_requestContext, _csrf) {
+      constructor(_requestContext, _csrfTokenService) {
         this._requestContext = _requestContext;
-        this._csrf = _csrf;
+        this._csrfTokenService = _csrfTokenService;
       }
       _requestContext;
-      _csrf;
-      /**
-       * @param requestContext Dati base della richiesta (metodo, path)
-       * @param headers Header HTTP della richiesta
-       * @param next Funzione delegata per passare al middleware successivo
-       */
+      _csrfTokenService;
       async execute(req, _headers, next) {
         const method = req.method.toUpperCase();
         const isStateChanging = ["POST", "PUT", "DELETE", "PATCH"].includes(method);
         if (isStateChanging) {
-          const { network, tracing } = this._requestContext.getContext() ?? {};
-          if (!Guards32.isDefined(network?.csrf) || network.csrf.toLowerCase() !== this._csrf.toLowerCase()) {
+          const { network, tracing, identity } = this._requestContext.getContext() ?? {};
+          const headerToken = network?.csrf;
+          const cookieToken = network?.csrfCookie;
+          if (!Guards37.isDefined(headerToken) || !Guards37.isDefined(cookieToken)) {
             return HttpHelper6.error(
               {
                 success: false,
                 error: {
                   code: ERROR_CODES6.FORBIDDEN,
                   message: ERROR_CODE_MESSAGES5[ERROR_CODES6.FORBIDDEN],
-                  details: "CSRF header is missing or invalid",
+                  details: "CSRF token missing",
+                  path: req.path
+                },
+                correlationId: tracing?.correlationId ?? GuidHelper9.generate(),
+                requestId: network?.requestId ?? GuidHelper9.generate(),
+                spanId: tracing?.spanId ?? GuidHelper9.generate(),
+                timestamp: (/* @__PURE__ */ new Date()).toISOString()
+              },
+              STATUS_CODES7.FORBIDDEN,
+              {
+                "Content-Type": [network?.formatIndicator ?? "application/json"]
+              }
+            );
+          }
+          if (headerToken !== cookieToken) {
+            return HttpHelper6.error(
+              {
+                success: false,
+                error: {
+                  code: ERROR_CODES6.FORBIDDEN,
+                  message: ERROR_CODE_MESSAGES5[ERROR_CODES6.FORBIDDEN],
+                  details: "CSRF token mismatch",
+                  path: req.path
+                },
+                correlationId: tracing?.correlationId ?? GuidHelper9.generate(),
+                requestId: network?.requestId ?? GuidHelper9.generate(),
+                spanId: tracing?.spanId ?? GuidHelper9.generate(),
+                timestamp: (/* @__PURE__ */ new Date()).toISOString()
+              },
+              STATUS_CODES7.FORBIDDEN,
+              {
+                "Content-Type": [network?.formatIndicator ?? "application/json"]
+              }
+            );
+          }
+          if (!Guards37.isDefined(identity?.userId) || !await this._csrfTokenService.validate(
+            headerToken,
+            identity?.userId
+          )) {
+            return HttpHelper6.error(
+              {
+                success: false,
+                error: {
+                  code: ERROR_CODES6.FORBIDDEN,
+                  message: ERROR_CODE_MESSAGES5[ERROR_CODES6.FORBIDDEN],
+                  details: "CSRF token invalid",
                   path: req.path
                 },
                 correlationId: tracing?.correlationId ?? GuidHelper9.generate(),
@@ -3639,8 +3925,51 @@ var init_csrf_middleware = __esm({
   }
 });
 
+// src/presentation/middlewares/csrf-cookie.middleware.ts
+import { Guards as Guards38 } from "@xeno-js/shared";
+var CsrfCookieMiddleware;
+var init_csrf_cookie_middleware = __esm({
+  "src/presentation/middlewares/csrf-cookie.middleware.ts"() {
+    "use strict";
+    CsrfCookieMiddleware = class {
+      constructor(_requestContext, _csrfTokenService, _csrf) {
+        this._requestContext = _requestContext;
+        this._csrfTokenService = _csrfTokenService;
+        this._csrf = _csrf;
+      }
+      _requestContext;
+      _csrfTokenService;
+      _csrf;
+      async execute(_req, _headers, next) {
+        const response = await next();
+        const context = this._requestContext.getContext();
+        const identity = context?.identity;
+        const network = context?.network;
+        if (!Guards38.isDefined(identity?.userId))
+          return response;
+        if (Guards38.isDefined(network?.csrfCookie))
+          return response;
+        const token = await this._csrfTokenService.generate(identity.userId);
+        const cookieName = this._csrf.cookieName ?? "__Host-xeno-csrf";
+        const maxAge = this._csrf.cookieMaxAgeSeconds ?? 3600;
+        const sameSite = this._csrf.sameSite ?? "lax";
+        const cookie = `${cookieName}=${encodeURIComponent(token)}; Path=/; Secure; SameSite=${sameSite}; Max-Age=${maxAge}`;
+        const existingCookies = response.headers["Set-Cookie"];
+        response.headers = {
+          ...response.headers ?? {},
+          "Set-Cookie": [
+            ...existingCookies ?? [],
+            cookie
+          ]
+        };
+        return response;
+      }
+    };
+  }
+});
+
 // src/presentation/middlewares/options.middleware.ts
-import { Guards as Guards33, HttpHelper as HttpHelper7, STATUS_CODES as STATUS_CODES8 } from "@xeno-js/shared";
+import { Guards as Guards39, HttpHelper as HttpHelper7, STATUS_CODES as STATUS_CODES8 } from "@xeno-js/shared";
 var OptionsMiddleware;
 var init_options_middleware = __esm({
   "src/presentation/middlewares/options.middleware.ts"() {
@@ -3655,13 +3984,13 @@ var init_options_middleware = __esm({
           const network = this._requestContext.getNetworkContext();
           const origin = network?.origin;
           const headers = {};
-          if (Guards33.isDefined(origin)) {
+          if (Guards39.isDefined(origin)) {
             headers["Access-Control-Allow-Origin"] = origin;
             headers["Access-Control-Allow-Credentials"] = "true";
             headers["Vary"] = "Origin";
           }
-          headers["Access-Control-Allow-Methods"] = "POST,GET,PUT,DELETE,OPTIONS";
-          headers["Access-Control-Allow-Headers"] = "X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Type, Authorization, X-Correlation-Id";
+          headers["Access-Control-Allow-Methods"] = "POST,GET,PUT,PATCH,DELETE,OPTIONS";
+          headers["Access-Control-Allow-Headers"] = "X-CSRF-Token, Accept, Accept-Version, Content-Type, Authorization, X-Correlation-Id";
           return HttpHelper7.success(null, STATUS_CODES8.NO_CONTENT, {}, headers);
         }
         return await next();
@@ -3687,12 +4016,12 @@ var init_rate_limiter_middleware = __esm({
       _cache;
       _logger;
       _opts;
-      async execute(req, headers, next) {
+      async execute(req, _headers, next) {
         const { network, tracing } = this._ctxAccessor.getContext() ?? {};
         const clientIp = network?.clientIp;
         const cacheKey = `rate_limit:${clientIp}`;
-        const currentHits = await this._cache.get(cacheKey) ?? 0;
-        if (currentHits >= this._opts.maxRequests) {
+        const currentHits = await this._cache.increment(cacheKey, this._opts.windowSeconds);
+        if (currentHits > this._opts.maxRequests) {
           this._logger.warn(`[RateLimit] IP ${clientIp} blocked on ${req.path}`);
           return HttpHelper8.error(
             {
@@ -3715,7 +4044,6 @@ var init_rate_limiter_middleware = __esm({
             }
           );
         }
-        await this._cache.set(cacheKey, currentHits + 1, this._opts.windowSeconds);
         return next();
       }
     };
@@ -3723,10 +4051,10 @@ var init_rate_limiter_middleware = __esm({
 });
 
 // src/presentation/mappers/context.mapper.ts
-import { Guards as Guards34 } from "@xeno-js/shared";
+import { Guards as Guards40 } from "@xeno-js/shared";
 function _buildMessagingContext(meta) {
-  const hasSequenceData = Guards34.isDefined(meta.sequence?.sequenceId) || Guards34.isDefined(meta.sequence?.position) || Guards34.isDefined(meta.sequence?.size);
-  const hasMessagingData = hasSequenceData || Guards34.isDefined(meta.expiration) || Guards34.isDefined(meta.returnAddress);
+  const hasSequenceData = Guards40.isDefined(meta.sequence?.sequenceId) || Guards40.isDefined(meta.sequence?.position) || Guards40.isDefined(meta.sequence?.size);
+  const hasMessagingData = hasSequenceData || Guards40.isDefined(meta.expiration) || Guards40.isDefined(meta.returnAddress);
   const messaging = hasMessagingData ? {
     returnAddress: meta.returnAddress,
     expiration: meta.expiration,
@@ -3757,6 +4085,7 @@ var init_context_mapper = __esm({
           path,
           transport,
           csrf: metadata.csrf,
+          csrfCookie: metadata.csrfCookie,
           origin: metadata.origin
         };
         const tracing = {
@@ -3805,13 +4134,15 @@ var init_request_middleware = __esm({
        * @since 2025-09-30
        * @link https://github.com/xeno-js/xeno-js
        */
-      constructor(_requestContext, _extractor, _logger) {
+      constructor(_requestContext, _extractor, _resolver, _logger) {
         this._requestContext = _requestContext;
         this._extractor = _extractor;
+        this._resolver = _resolver;
         this._logger = _logger;
       }
       _requestContext;
       _extractor;
+      _resolver;
       _logger;
       async execute(req, headers, next) {
         const correlationId = GuidHelper11.generate();
@@ -3820,8 +4151,10 @@ var init_request_middleware = __esm({
         const formatIndicator = "application/json";
         try {
           const meta = this._extractor.extract(headers);
+          const clientIp = this._resolver.resolve(req.transport.req, meta.clientIp);
           const metadata = {
             ...meta,
+            clientIp,
             correlationId: meta.correlationId ?? correlationId,
             requestId: meta.requestId ?? requestId,
             spanId: meta.spanId ?? spanId,
@@ -3874,6 +4207,7 @@ var init_middlewares = __esm({
     init_composite_middleware();
     init_cors_middleware();
     init_csrf_middleware();
+    init_csrf_cookie_middleware();
     init_options_middleware();
     init_rate_limiter_middleware();
     init_request_middleware();
@@ -3888,6 +4222,7 @@ __export(presentation_exports, {
   BaseController: () => BaseController,
   CORSMiddleware: () => CORSMiddleware,
   CompositeMiddleware: () => CompositeMiddleware,
+  CsrfCookieMiddleware: () => CsrfCookieMiddleware,
   CsrfMiddleware: () => CsrfMiddleware,
   MethodCheckMiddleware: () => MethodCheckMiddleware,
   OptionsMiddleware: () => OptionsMiddleware,
@@ -3907,7 +4242,7 @@ var middleware_module_exports = {};
 __export(middleware_module_exports, {
   MiddlewareModule: () => MiddlewareModule
 });
-import { Guards as Guards35 } from "@xeno-js/shared";
+import { Guards as Guards41 } from "@xeno-js/shared";
 var MiddlewareModule;
 var init_middleware_module = __esm({
   "src/infrastructure/modules/middleware.module.ts"() {
@@ -3926,15 +4261,19 @@ var init_middleware_module = __esm({
           const { BearerTokenExtractor: BearerTokenExtractor2 } = await Promise.resolve().then(() => (init_services(), services_exports));
           container.addSingleton(TOKENS4.BEARER_TOKEN_EXTRACTOR, () => new BearerTokenExtractor2());
         }
+        const { HttpCookieExtractor: HttpCookieExtractor2 } = await Promise.resolve().then(() => (init_services(), services_exports));
+        container.addSingleton("COOKIE_EXTRACTOR", () => new HttpCookieExtractor2());
         const { HttpHeaderExtractor: HttpHeaderExtractor2 } = await Promise.resolve().then(() => (init_services(), services_exports));
         container.addSingleton(
           TOKENS4.SERVICE_EXTRACTOR,
-          (c) => new HttpHeaderExtractor2(c.resolve(TOKENS4.BEARER_TOKEN_EXTRACTOR), opts.trustedIpHeader)
+          (c) => new HttpHeaderExtractor2(c.resolve(TOKENS4.BEARER_TOKEN_EXTRACTOR), c.resolve("COOKIE_EXTRACTOR"), opts.trustedIpHeader, opts.csrf?.cookieName ?? "__Host-xeno-csrf")
         );
         if (!opts.isLogger) {
           const { LoggerUtils: LoggerUtils2 } = await Promise.resolve().then(() => (init_logger_utils(), logger_utils_exports));
           await LoggerUtils2.addLogger(container, void 0);
         }
+        const { ClientIpResolver: ClientIpResolver2 } = await Promise.resolve().then(() => (init_services(), services_exports));
+        container.addSingleton("IP_RESOLVER", () => new ClientIpResolver2(opts.trustedProxies));
         const middlewares = [TOKENS4.REQUEST_CONTEXT_MIDDLEWARE];
         const { RequestContextMiddleware: RequestContextMiddleware2 } = await Promise.resolve().then(() => (init_presentation(), presentation_exports));
         container.addSingleton(
@@ -3942,6 +4281,7 @@ var init_middleware_module = __esm({
           (c) => new RequestContextMiddleware2(
             c.resolve(TOKENS4.REQUEST_CONTEXT),
             c.resolve(TOKENS4.SERVICE_EXTRACTOR),
+            c.resolve("IP_RESOLVER"),
             c.resolve(TOKENS4.LOGGER)
           )
         );
@@ -3953,7 +4293,9 @@ var init_middleware_module = __esm({
           );
           middlewares.push(TOKENS4.OPTIONS_MIDDLEWARE);
         }
-        if (!Guards35.isNullOrEmpty(opts.allowOrigins)) {
+        if (!Guards41.isNullOrEmpty(opts.allowOrigins)) {
+          if (Guards41.isDefined(opts.httpConfig.withCredentials) && opts.allowOrigins.includes("*"))
+            throw new Error("Wildcard CORS origin is not allowed when withCredentials is set to true");
           const { AllowOrigin: AllowOrigin2 } = await Promise.resolve().then(() => (init_services(), services_exports));
           container.addSingleton("ALLOW_ORIGIN", () => {
             return new AllowOrigin2(opts.allowOrigins);
@@ -3975,7 +4317,7 @@ var init_middleware_module = __esm({
           });
           middlewares.push(TOKENS4.CORS_MIDDLEWARE);
         }
-        if (Guards35.isDefined(opts.routeRegistry)) {
+        if (Guards41.isDefined(opts.routeRegistry)) {
           const registry = opts.routeRegistry;
           const { AllowMethodFactory: AllowMethodFactory2 } = await Promise.resolve().then(() => (init_factories(), factories_exports));
           container.addSingleton(TOKENS4.ALLOW_METHOD, () => new AllowMethodFactory2().create(registry));
@@ -3989,21 +4331,42 @@ var init_middleware_module = __esm({
           );
           middlewares.push(TOKENS4.METHOD_CHECK_MIDDLEWARE);
         }
-        if (Guards35.isDefined(opts.csrf)) {
+        const { AuthenticationMiddleware: AuthenticationMiddleware2 } = await Promise.resolve().then(() => (init_presentation(), presentation_exports));
+        container.addSingleton(TOKENS4.AUTH_MIDDLEWARE, (c) => {
+          return new AuthenticationMiddleware2(
+            c.resolve(TOKENS4.REQUEST_CONTEXT),
+            c.resolve(TOKENS4.BEARER_TOKEN_EXTRACTOR),
+            c.resolve(TOKENS4.GATE_KEEPER),
+            c.resolve(TOKENS4.LOGGER)
+          );
+        });
+        middlewares.push(TOKENS4.AUTH_MIDDLEWARE);
+        if (Guards41.isDefined(opts.csrf)) {
           const csrf = opts.csrf;
+          const { CsrfTokenService: CsrfTokenService2 } = await Promise.resolve().then(() => (init_services(), services_exports));
+          container.addSingleton("CSRF_TOKEN_SERVICE", (c) => {
+            return new CsrfTokenService2(
+              csrf.secret,
+              c.resolve("CRYPTO_SERVICE")
+            );
+          });
+          const { CsrfCookieMiddleware: CsrfCookieMiddleware2 } = await Promise.resolve().then(() => (init_presentation(), presentation_exports));
+          container.addSingleton("CSRF_COOKIE_MIDDLEWARE", (c) => {
+            return new CsrfCookieMiddleware2(c.resolve(TOKENS4.REQUEST_CONTEXT), c.resolve("CSRF_TOKEN_SERVICE"), csrf);
+          });
           const { CsrfMiddleware: CsrfMiddleware2 } = await Promise.resolve().then(() => (init_presentation(), presentation_exports));
           container.addSingleton(TOKENS4.CSRF_MIDDLEWARE, (c) => {
-            return new CsrfMiddleware2(c.resolve(TOKENS4.REQUEST_CONTEXT), csrf);
+            return new CsrfMiddleware2(c.resolve(TOKENS4.REQUEST_CONTEXT), c.resolve("CSRF_TOKEN_SERVICE"));
           });
           middlewares.push(TOKENS4.CSRF_MIDDLEWARE);
         }
-        if (Guards35.isDefined(opts.rateLimite.maxRequests) || Guards35.isDefined(opts.rateLimite.windowSeconds)) {
+        if (Guards41.isDefined(opts.rateLimite.maxRequests) || Guards41.isDefined(opts.rateLimite.windowSeconds)) {
           const maxRequests = opts.rateLimite.maxRequests ?? 30;
-          Guards35.throwIfNegative(maxRequests, "MaxRequests must be positive");
-          Guards35.throwIfNotInteger(maxRequests, "MaxRequests must be an integer");
+          Guards41.throwIfNegative(maxRequests, "MaxRequests must be positive");
+          Guards41.throwIfNotInteger(maxRequests, "MaxRequests must be an integer");
           const windowSeconds = opts.rateLimite.windowSeconds ?? 30;
-          Guards35.throwIfNegative(windowSeconds, "WindowSeconds must be positive");
-          Guards35.throwIfNotInteger(windowSeconds, "WindowSeconds must be an integer");
+          Guards41.throwIfNegative(windowSeconds, "WindowSeconds must be positive");
+          Guards41.throwIfNotInteger(windowSeconds, "WindowSeconds must be an integer");
           if (!opts.isCache) {
             const { CacheUtils: CacheUtils2 } = await Promise.resolve().then(() => (init_cache_utils(), cache_utils_exports));
             await CacheUtils2.addCache(container, { inMemory: true, redis: void 0 });
@@ -4022,16 +4385,6 @@ var init_middleware_module = __esm({
           });
           middlewares.push(TOKENS4.RATE_LIMITER_MIDDLEWARE);
         }
-        const { AuthenticationMiddleware: AuthenticationMiddleware2 } = await Promise.resolve().then(() => (init_presentation(), presentation_exports));
-        container.addSingleton(TOKENS4.AUTH_MIDDLEWARE, (c) => {
-          return new AuthenticationMiddleware2(
-            c.resolve(TOKENS4.REQUEST_CONTEXT),
-            c.resolve(TOKENS4.BEARER_TOKEN_EXTRACTOR),
-            c.resolve(TOKENS4.GATE_KEEPER),
-            c.resolve(TOKENS4.LOGGER)
-          );
-        });
-        middlewares.push(TOKENS4.AUTH_MIDDLEWARE);
         const { CompositeMiddleware: CompositeMiddleware2 } = await Promise.resolve().then(() => (init_presentation(), presentation_exports));
         container.addSingleton(TOKENS4.MIDDLEWARE, (c) => {
           const resolvedMiddleware = middlewares.map(
@@ -4101,7 +4454,7 @@ __export(index_exports, {
 init_application();
 
 // src/infrastructure/builder/app.builder.ts
-import { Guards as Guards36, LOG_LEVEL as LOG_LEVEL6, TOKENS as TOKENS3 } from "@xeno-js/shared";
+import { Guards as Guards42, LOG_LEVEL as LOG_LEVEL6, TOKENS as TOKENS3 } from "@xeno-js/shared";
 
 // src/infrastructure/configuration/configuration.ts
 import { Guards as Guards13 } from "@xeno-js/shared";
@@ -4377,6 +4730,7 @@ var AppBuilder = class {
       () => new EnvironmentConfigurationService()
     );
     this._configuration = this._container.resolve(TOKENS3.CONFIGURATION_SERVICE);
+    this._middlewareConfig.allowOrigins?.push(this._configuration.get("APP_URL") ?? `http://localhost:${this._configuration.getNumber("PORT", 3e3)}`);
   }
   // --- Module Configurations ---
   _modules = [];
@@ -4408,7 +4762,8 @@ var AppBuilder = class {
     optionsMiddleware: false,
     routeRegistry: void 0,
     trustedIpHeader: void 0,
-    allowOrigins: ["*"],
+    trustedProxies: [],
+    allowOrigins: [],
     cors: true
   };
   _httpConfig = {
@@ -4491,7 +4846,7 @@ var AppBuilder = class {
       pino: { config: void 0 },
       customLoggers: void 0
     };
-    if (Guards36.isDefined(setupAction) && Guards36.isDefined(config))
+    if (Guards42.isDefined(setupAction) && Guards42.isDefined(config))
       setupAction(config, this._configuration);
     this._modules.push({
       priority: 3,
@@ -4517,7 +4872,7 @@ var AppBuilder = class {
   addCache(setupAction) {
     if (this._isCacheModuleQueued) return this;
     this._isCacheModuleQueued = true;
-    if (Guards36.isDefined(setupAction)) setupAction(this._config, this._configuration);
+    if (Guards42.isDefined(setupAction)) setupAction(this._config, this._configuration);
     this._modules.push({
       priority: 3,
       name: "CacheModule",
@@ -4626,7 +4981,7 @@ var AppBuilder = class {
    * @link https://github.com/xeno-js/xeno-js 
    */
   addPipeline(setupAction) {
-    if (Guards36.isDefined(setupAction)) {
+    if (Guards42.isDefined(setupAction)) {
       setupAction(this._pipelineConfig, this._configuration);
     }
     this._queuePipelineModule();
@@ -4760,7 +5115,7 @@ var AppBuilder = class {
         console.error(`\u{1F449} Module: **${queued.name}**`);
         console.error(`\u{1F4DD} Reason: ${errorMessage}
 `);
-        if (error instanceof Error && Guards36.isDefined(error.stack)) {
+        if (error instanceof Error && Guards42.isDefined(error.stack)) {
           console.error(error.stack);
         }
         throw new Error(`Bootstrap failed at [${queued.name}]: ${errorMessage}`, { cause: error });
@@ -4822,7 +5177,8 @@ var AppBuilder = class {
           ...this._middlewareConfig,
           isAuth: this._isAuthModuleQueued,
           isLogger: this._isLoggerModuleQueued,
-          isCache: this._isCacheModuleQueued || this._isPipelineModuleQueued
+          isCache: this._isCacheModuleQueued || this._isPipelineModuleQueued,
+          httpConfig: this._httpConfig.http.client
         });
       }
     });
@@ -4889,7 +5245,7 @@ init_validation_utils();
 
 // src/infrastructure/repositories/read-dao.ts
 import { AppError as AppError16, Result as Result17 } from "@xeno-js/shared";
-import { Guards as Guards37 } from "@xeno-js/shared";
+import { Guards as Guards43 } from "@xeno-js/shared";
 var ReadDao = class {
   /**
    * Constructs a new ReadDao instance.
@@ -4911,7 +5267,7 @@ var ReadDao = class {
   async findById(id, ctx, signal) {
     AppError16.throwIfAborted(signal, "ReadDao.findById");
     const result = await this._dataSource.findById(id, ctx, signal);
-    if (Guards37.isNullOrEmpty(result)) return Result17.ok();
+    if (Guards43.isNullOrEmpty(result)) return Result17.ok();
     const entity = this._mapper.toEntity(result);
     return Result17.ok(entity);
   }
@@ -4925,7 +5281,7 @@ var ReadDao = class {
 
 // src/infrastructure/repositories/repository.ts
 import { AppError as AppError17, Result as Result18 } from "@xeno-js/shared";
-import { Guards as Guards38 } from "@xeno-js/shared";
+import { Guards as Guards44 } from "@xeno-js/shared";
 var Repository = class {
   /**
    * Constructs a new Repository instance.
@@ -4947,7 +5303,7 @@ var Repository = class {
   async findById(id, ctx, signal) {
     AppError17.throwIfAborted(signal, "Repository.findById");
     const result = await this._dataSource.findById(id, ctx, signal);
-    if (Guards38.isNullOrEmpty(result)) return Result18.ok();
+    if (Guards44.isNullOrEmpty(result)) return Result18.ok();
     const entity = this._mapper.toEntity(result);
     return Result18.ok(entity);
   }
@@ -5005,4 +5361,13 @@ export {
   Specification,
   SupabaseServerAuthFactory
 };
+/**
+ * @description The CsrfCookieMiddleware class implements the IMiddleware interface, providing a concrete implementation for handling CSRF token validation and cookie management. It checks the incoming request for a valid CSRF token and sets a CSRF cookie if necessary.
+ *
+ * @author Xeno
+ * @version 1.0.0
+ * @since 2025-09-30
+ * @link https://github.com/xeno-js/xeno-js
+ * @license MIT
+ */
 //# sourceMappingURL=index.js.map