feat: release design system engine, studio and component contracts

packages/dev-server/test/rpc-csrf.test.ts

@@ -8,6 +8,31 @@ function request(headers: Record<string, string> = {}): Request {
   });
 }
 
+test("RPC CSRF rejects cross-site fetch metadata even with matching tokens", () => {
+  expect(
+    validateRpcCsrf(
+      request({
+        cookie: "wrn-csrf=token",
+        "x-csrf-token": "token",
+        "sec-fetch-site": "cross-site",
+      }),
+    ),
+  ).toBe(false);
+});
+
+test("RPC CSRF rejects malformed cookie encoding without throwing", () => {
+  for (const cookieName of ["wrn-csrf", "wrnexus_csrf"]) {
+    expect(
+      validateRpcCsrf(
+        request({
+          cookie: `${cookieName}=%E0%A4%A`,
+          "x-csrf-token": "%E0%A4%A",
+        }),
+      ),
+    ).toBe(false);
+  }
+});
+
 test("RPC CSRF requires a matching cookie and header from the same origin", () => {
   expect(validateRpcCsrf(request())).toBe(false);
   expect(validateRpcCsrf(request({ cookie: "wrn-csrf=token" }))).toBe(false);