fix(core): preserve explicit public resource embedding policies

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/core",
-  "version": "0.8.16",
+  "version": "0.8.17",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/core/src/headers.ts

@@ -258,7 +258,12 @@ function applyBaseSecurityHeaders(
   if (referrerPolicy !== false) headers.set("Referrer-Policy", referrerPolicy);
 
   const corp = security?.crossOriginResourcePolicy ?? "same-origin";
-  if (corp !== false) headers.set("Cross-Origin-Resource-Policy", corp);
+  // A handler can deliberately expose a public image for email embedding.
+  // An explicitly configured application policy still takes precedence.
+  const responseCorp = headers.get("Cross-Origin-Resource-Policy");
+  if (corp !== false && (security?.crossOriginResourcePolicy !== undefined || !["same-origin", "same-site", "cross-origin"].includes(responseCorp ?? ""))) {
+    headers.set("Cross-Origin-Resource-Policy", corp);
+  }
   if (security?.originAgentCluster !== false) headers.set("Origin-Agent-Cluster", "?1");
   if (security?.disableDnsPrefetch !== false) headers.set("X-DNS-Prefetch-Control", "off");
 

packages/core/test/public-image-policy.test.ts

@@ -0,0 +1,10 @@
+import {expect,test} from "bun:test";
+import {withSecurityHeaders} from "../src/headers.ts";
+test("explicit response resource policies survive defaults while configured application policy wins",()=>{
+  const req=new Request("https://example.com/image.png");
+  const image=()=>new Response("image",{headers:{"Cross-Origin-Resource-Policy":"cross-origin","Content-Type":"image/png"}});
+  expect(withSecurityHeaders(req,image(),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("cross-origin");
+  expect(withSecurityHeaders(req,new Response("private"),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
+  expect(withSecurityHeaders(req,image(),"production",{crossOriginResourcePolicy:"same-origin"}).headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
+  expect(withSecurityHeaders(req,new Response("x",{headers:{"Cross-Origin-Resource-Policy":"invalid"}}),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
+});