fix(core): preserve explicit public resource embedding policies

bun.lock

@@ -325,7 +325,7 @@
     },
     "packages/cli": {
       "name": "@wrnexus/cli",
-      "version": "0.8.75",
+      "version": "0.8.76",
       "bin": {
         "wrnexus": "src/index.ts",
       },
@@ -371,7 +371,7 @@
     },
     "packages/core": {
       "name": "@wrnexus/core",
-      "version": "0.8.16",
+      "version": "0.8.17",
     },
     "packages/csr": {
       "name": "@wrnexus/csr",
@@ -390,7 +390,7 @@
     },
     "packages/dev-server": {
       "name": "@wrnexus/dev-server",
-      "version": "0.8.66",
+      "version": "0.8.67",
       "dependencies": {
         "@wrnexus/authz": "workspace:*",
         "@wrnexus/cache": "workspace:*",

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/cli",
-  "version": "0.8.75",
+  "version": "0.8.76",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/core",
-  "version": "0.8.16",
+  "version": "0.8.17",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/core/src/headers.ts

@@ -258,7 +258,12 @@ function applyBaseSecurityHeaders(
   if (referrerPolicy !== false) headers.set("Referrer-Policy", referrerPolicy);
 
   const corp = security?.crossOriginResourcePolicy ?? "same-origin";
-  if (corp !== false) headers.set("Cross-Origin-Resource-Policy", corp);
+  // A handler can deliberately expose a public image for email embedding.
+  // An explicitly configured application policy still takes precedence.
+  const responseCorp = headers.get("Cross-Origin-Resource-Policy");
+  if (corp !== false && (security?.crossOriginResourcePolicy !== undefined || !["same-origin", "same-site", "cross-origin"].includes(responseCorp ?? ""))) {
+    headers.set("Cross-Origin-Resource-Policy", corp);
+  }
   if (security?.originAgentCluster !== false) headers.set("Origin-Agent-Cluster", "?1");
   if (security?.disableDnsPrefetch !== false) headers.set("X-DNS-Prefetch-Control", "off");
 

packages/core/test/public-image-policy.test.ts

@@ -0,0 +1,10 @@
+import {expect,test} from "bun:test";
+import {withSecurityHeaders} from "../src/headers.ts";
+test("explicit response resource policies survive defaults while configured application policy wins",()=>{
+  const req=new Request("https://example.com/image.png");
+  const image=()=>new Response("image",{headers:{"Cross-Origin-Resource-Policy":"cross-origin","Content-Type":"image/png"}});
+  expect(withSecurityHeaders(req,image(),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("cross-origin");
+  expect(withSecurityHeaders(req,new Response("private"),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
+  expect(withSecurityHeaders(req,image(),"production",{crossOriginResourcePolicy:"same-origin"}).headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
+  expect(withSecurityHeaders(req,new Response("x",{headers:{"Cross-Origin-Resource-Policy":"invalid"}}),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
+});

packages/dev-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/dev-server",
-  "version": "0.8.66",
+  "version": "0.8.67",
   "type": "module",
   "main": "src/index.ts",
   "exports": {