docs: clarify pre-authentication action CSRF

[smiggleworth]

Summary

• document that action CSRF intentionally requires a stable authenticated or pre-authentication session identity
• clarify on ActionRegistryOptions.csrf and sessionId that anonymous pages receive no token and submissions return 403 when the resolver returns undefined
• add a safe pre-authentication session wiring example and warn against fixed identities or disabling CSRF for credential forms
• add regressions for both the anonymous rejection path and a custom middleware-provided guest session
• prepare @askrjs/[email protected]

Decision

This keeps the existing security boundary: the framework signs tokens against an application-owned session identity but does not silently mint or persist anonymous sessions. Session lifetime, cookie policy, rotation, and storage belong to the application/session layer. The newly explicit contract makes login, signup, and password-reset setup discoverable without weakening CSRF behavior.

Verification

• npm run check
• 18 unit files / 203 tests pass
• public type consumer, build, publint, and package artifact checks pass

Closes #1

[Copilot]

Pull request overview

This PR clarifies and codifies the framework’s CSRF contract for page actions: CSRF tokens are tied to an application-owned session identity and the framework will not implicitly mint/persist anonymous sessions for pre-authentication flows.

Changes:

• Adds documentation explaining that anonymous pages receive no CSRF token by default and submissions are rejected with 403 unless a stable session identity is provided.
• Extracts ActionRegistryOptions into a dedicated module and re-exports it for consumers.
• Adds regression tests covering (1) anonymous rejection when no session identity exists and (2) a guest/pre-auth session identity provided via middleware.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tests/actions.test.ts	Adds regression tests for anonymous CSRF rejection and custom pre-auth guest session support.
src/askr/actions.ts	Moves ActionRegistryOptions type out to a separate module and re-exports it.
src/askr/action-options.ts	New, documented home for ActionRegistryOptions, clarifying the CSRF/session identity contract.
README.md	Documents the default csrf.sessionId behavior and provides a safe pre-auth session wiring example.
package.json	Bumps package version to 0.0.7.
package-lock.json	Updates lockfile version fields to 0.0.7.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.