feat: release design system engine, studio and component contracts

packages/dev-server/src/rpc-shared.ts

@@ -15,6 +15,7 @@ import { createContext, runWithRequestContext } from "@wrnexus/core";
  * cookie pattern.
  */
 export function validateRpcCsrf(request: Request): boolean {
+  if (request.headers.get("sec-fetch-site") === "cross-site") return false;
   const url = new URL(request.url);
   const origin = request.headers.get("origin");
   if (origin && origin !== url.origin) return false;
@@ -23,7 +24,18 @@ export function validateRpcCsrf(request: Request): boolean {
     /(?:^|;\s*)wrn-csrf=([^;]+)/.exec(cookieHeader)?.[1] ??
     /(?:^|;\s*)wrnexus_csrf=([^;]+)/.exec(cookieHeader)?.[1];
   const headerToken = request.headers.get("x-csrf-token") ?? request.headers.get("x-wrnexus-csrf");
-  return Boolean(cookieToken && headerToken && decodeURIComponent(cookieToken) === headerToken);
+  if (!cookieToken || !headerToken) return false;
+  let decodedToken: string;
+  try {
+    decodedToken = decodeURIComponent(cookieToken);
+  } catch {
+    return false;
+  }
+  let diff = decodedToken.length ^ headerToken.length;
+  for (let i = 0; i < Math.max(decodedToken.length, headerToken.length); i++) {
+    diff |= decodedToken.charCodeAt(i) ^ headerToken.charCodeAt(i);
+  }
+  return diff === 0;
 }
 
 /**