From ff1065fb273d32a1c85dbfdb09ff1053cbe2063b Mon Sep 17 00:00:00 2001
From: Ajay Ghanwat <ghanwat.ajay@workroot.in>
Date: Thu, 1 Oct 2026 22:33:24 +0530
Subject: [PATCH] fix(core): preserve explicit public resource embedding
 policies

---
 bun.lock                                       |  6 +++---
 packages/cli/package.json                      |  2 +-
 packages/core/package.json                     |  2 +-
 packages/core/src/headers.ts                   |  7 ++++++-
 packages/core/test/public-image-policy.test.ts | 10 ++++++++++
 packages/dev-server/package.json               |  2 +-
 6 files changed, 22 insertions(+), 7 deletions(-)
 create mode 100644 packages/core/test/public-image-policy.test.ts

diff --git a/bun.lock b/bun.lock
index 2093fc71..32e61c48 100644
--- a/bun.lock
+++ b/bun.lock
@@ -325,7 +325,7 @@
     },
     "packages/cli": {
       "name": "@wrnexus/cli",
-      "version": "0.8.75",
+      "version": "0.8.76",
       "bin": {
         "wrnexus": "src/index.ts",
       },
@@ -371,7 +371,7 @@
     },
     "packages/core": {
       "name": "@wrnexus/core",
-      "version": "0.8.16",
+      "version": "0.8.17",
     },
     "packages/csr": {
       "name": "@wrnexus/csr",
@@ -390,7 +390,7 @@
     },
     "packages/dev-server": {
       "name": "@wrnexus/dev-server",
-      "version": "0.8.66",
+      "version": "0.8.67",
       "dependencies": {
         "@wrnexus/authz": "workspace:*",
         "@wrnexus/cache": "workspace:*",
diff --git a/packages/cli/package.json b/packages/cli/package.json
index b6bd4376..50ed0a0e 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/cli",
-  "version": "0.8.75",
+  "version": "0.8.76",
   "type": "module",
   "main": "src/index.ts",
   "exports": {
diff --git a/packages/core/package.json b/packages/core/package.json
index 86dcbf21..1a11bcfd 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/core",
-  "version": "0.8.16",
+  "version": "0.8.17",
   "type": "module",
   "main": "src/index.ts",
   "exports": {
diff --git a/packages/core/src/headers.ts b/packages/core/src/headers.ts
index 59fca950..ae0a18b0 100644
--- a/packages/core/src/headers.ts
+++ b/packages/core/src/headers.ts
@@ -258,7 +258,12 @@ function applyBaseSecurityHeaders(
   if (referrerPolicy !== false) headers.set("Referrer-Policy", referrerPolicy);
 
   const corp = security?.crossOriginResourcePolicy ?? "same-origin";
-  if (corp !== false) headers.set("Cross-Origin-Resource-Policy", corp);
+  // A handler can deliberately expose a public image for email embedding.
+  // An explicitly configured application policy still takes precedence.
+  const responseCorp = headers.get("Cross-Origin-Resource-Policy");
+  if (corp !== false && (security?.crossOriginResourcePolicy !== undefined || !["same-origin", "same-site", "cross-origin"].includes(responseCorp ?? ""))) {
+    headers.set("Cross-Origin-Resource-Policy", corp);
+  }
   if (security?.originAgentCluster !== false) headers.set("Origin-Agent-Cluster", "?1");
   if (security?.disableDnsPrefetch !== false) headers.set("X-DNS-Prefetch-Control", "off");
 
diff --git a/packages/core/test/public-image-policy.test.ts b/packages/core/test/public-image-policy.test.ts
new file mode 100644
index 00000000..b58d564b
--- /dev/null
+++ b/packages/core/test/public-image-policy.test.ts
@@ -0,0 +1,10 @@
+import {expect,test} from "bun:test";
+import {withSecurityHeaders} from "../src/headers.ts";
+test("explicit response resource policies survive defaults while configured application policy wins",()=>{
+  const req=new Request("https://example.com/image.png");
+  const image=()=>new Response("image",{headers:{"Cross-Origin-Resource-Policy":"cross-origin","Content-Type":"image/png"}});
+  expect(withSecurityHeaders(req,image(),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("cross-origin");
+  expect(withSecurityHeaders(req,new Response("private"),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
+  expect(withSecurityHeaders(req,image(),"production",{crossOriginResourcePolicy:"same-origin"}).headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
+  expect(withSecurityHeaders(req,new Response("x",{headers:{"Cross-Origin-Resource-Policy":"invalid"}}),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
+});
diff --git a/packages/dev-server/package.json b/packages/dev-server/package.json
index e550b77f..90b1279f 100644
--- a/packages/dev-server/package.json
+++ b/packages/dev-server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/dev-server",
-  "version": "0.8.66",
+  "version": "0.8.67",
   "type": "module",
   "main": "src/index.ts",
   "exports": {