@veryfront/ext-content-mdx 0.1.1257 → 0.1.1258-rc.18787

package/esm/deno.d.ts

@@ -324,9 +324,12 @@ declare namespace _default {
         "#cli/observability/error-collector": string;
         "#cli/observability/log-buffer": string;
         "#cli/production-error-reporting": string;
+        "#cli/environment-config": string;
+        "#cli/host-api-base": string;
         "#cli/host-runtime": string;
         "#cli/platform-runtime": string;
         "#cli/process-env": string;
+        "#cli/outbound-fetch": string;
         "#cli/process-command": string;
         "#cli/process-lifecycle": string;
         "#cli/logger-config": string;

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.1257",
+    "version": "0.1.1258-rc.18787",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "minimumDependencyAge": {
@@ -395,9 +395,12 @@ export default {
         "#cli/observability/error-collector": "./src/observability/error-collector.ts",
         "#cli/observability/log-buffer": "./src/observability/log-buffer.ts",
         "#cli/production-error-reporting": "./src/server/production-error-reporting.ts",
+        "#cli/environment-config": "./src/config/environment-config.ts",
+        "#cli/host-api-base": "./src/config/host-api-base.ts",
         "#cli/host-runtime": "./src/platform/compat/process/host-runtime.ts",
         "#cli/platform-runtime": "./src/platform/compat/runtime.ts",
         "#cli/process-env": "./src/platform/compat/process/env.ts",
+        "#cli/outbound-fetch": "./src/security/http/outbound-fetch.ts",
         "#cli/process-command": "./src/platform/compat/process/command.ts",
         "#cli/process-lifecycle": "./src/platform/compat/process/lifecycle.ts",
         "#cli/logger-config": "./src/utils/logger/logger.ts",
@@ -530,9 +533,9 @@ export default {
         "verify:quick": "deno task generate:manifests:check && deno task test:layout && deno task fmt:check && deno task lint && deno task lint:ci-typescript && deno task lint:style && deno task lint:chat-composability && deno task lint:chat-ratchets && deno task lint:esm-sh-codemod && deno task lint:cli-boundary && deno task lint:wildcard-exports && deno task lint:barrel-jsdoc && deno task lint:ban-test-only && deno task lint:sanitizer-baseline && deno task lint:skipped-tests && deno task lint:ban-zod && deno task lint:cwd-relative-test-reads && deno task lint:test-semantic-dispositions && deno task lint:anti-slop && deno task lint:render-mode-defaults && deno task lint:core-deps && deno task lint:cross-runtime-jsr && deno task lint:dependency-boundaries && deno task lint:module-boundaries && deno task lint:extension-contracts && deno task lint:extension-capabilities && deno task docs:api-reference:check && deno task docs:errors:check && deno task docs:validate && deno task typecheck",
         "typecheck:consumer": "deno run --allow-read --allow-run --allow-env --allow-write scripts/typecheck/run-consumer-typecheck.ts",
         "codemod:chat": "deno run --frozen --config=scripts/codemods/deno.json --allow-read --allow-write --allow-env=BABEL_TYPES_8_BREAKING scripts/codemods/migrate-chat-composition.ts",
-        "codemod:esm-sh": "deno run --frozen --config=scripts/codemods/deno.json --allow-read --allow-write --allow-env=BABEL_TYPES_8_BREAKING scripts/codemods/migrate-esm-sh-imports.ts",
+        "codemod:esm-sh": "deno run --frozen --config=scripts/codemods/deno.json --allow-read --allow-write --allow-ffi --allow-env=BABEL_TYPES_8_BREAKING scripts/codemods/migrate-esm-sh-imports.ts",
         "lint:chat-ratchets": "deno run --allow-read scripts/lint/ban-chat-antipatterns.ts && deno check --no-config --frozen --lock=deno.lock scripts/codemods/migrate-chat-composition.ts && deno check --config=deno.json --frozen --lock=deno.lock src/react/chat-barrels.check.ts && deno test --frozen --config=scripts/codemods/deno.json --no-check --allow-read --allow-write --allow-env=BABEL_TYPES_8_BREAKING scripts/codemods/migrate-chat-composition.test.ts",
-        "lint:esm-sh-codemod": "deno check --no-config --frozen --lock=deno.lock scripts/codemods/migrate-esm-sh-imports.ts && deno test --frozen --config=scripts/codemods/deno.json --no-check --allow-read --allow-write --allow-env=BABEL_TYPES_8_BREAKING scripts/codemods/migrate-esm-sh-imports.test.ts",
+        "lint:esm-sh-codemod": "deno check --no-config --frozen --lock=deno.lock scripts/codemods/migrate-esm-sh-imports.ts && deno task test:file scripts/codemods/pinned-directory.test.ts && deno test --frozen --config=scripts/codemods/deno.json --no-check --allow-read --allow-write --allow-ffi --allow-env=BABEL_TYPES_8_BREAKING tests/integration/codemods/",
         "lint:test-typecheck": "deno run --allow-read --allow-run scripts/lint/check-test-typecheck-baseline.ts",
         "lint:client-bundle": "deno lint --config=scripts/test.deno.json scripts/lint/client-bundle-graph.ts scripts/lint/audit-client-bundle.ts scripts/lint/client-bundle-graph.test.ts && deno run --allow-read scripts/lint/audit-client-bundle.ts && deno test --frozen --config=scripts/test.deno.json --no-check --allow-read scripts/lint/client-bundle-graph.test.ts",
         "lint:client-bundle:update": "deno run --allow-read --allow-write scripts/lint/audit-client-bundle.ts --update",

package/esm/src/platform/compat/process/env.d.ts

@@ -1,4 +1,14 @@
 import type { ProjectEnvSnapshot } from "./project-env-contract.js";
+/** Capture operator-owned API routing before project modules can mutate the process. */
+export declare function captureHostApiEnvironment(): void;
+/** @internal Record that an environment value came from a project env file. */
+export declare function markEnvFileValue(key: string): void;
+/** @internal Record that a non-env-file write replaced prior env-file provenance. */
+export declare function clearEnvFileValueSource(key: string): void;
+/** @internal Clear project env provenance alongside the env loader's test reset. */
+export declare function clearEnvFileValueSources(): void;
+/** @internal Report whether the current process value was copied from a project env file. */
+export declare function hasEnvFileValueSource(key: string): boolean;
 export type EnvOverlayStorage = {
     getStore: () => unknown;
     run?: <T>(store: unknown, fn: () => T) => T;
@@ -6,11 +16,43 @@ export type EnvOverlayStorage = {
 };
 /** Read and write process environment variables. */
 export declare function env(): Record<string, string>;
+/**
+ * Register a host-private credential under `key`.
+ *
+ * The value is held in memory only: it never reaches `Deno.env`,
+ * `process.env`, a child process environment, or {@link getEnv}, so project
+ * code running in the same process cannot read it. {@link getHostEnv} resolves
+ * it after the real environment, so an explicitly exported variable still wins.
+ *
+ * Part of the contract for every registered key: a host variable that is
+ * exported but blank (empty or whitespace-only) does not shadow the
+ * credential — {@link getHostEnv} treats such a value as unset for that key
+ * and returns the registered credential instead. Register a credential only
+ * when a blank export must not suppress it; a caller that needs a blank
+ * export to win must not use this store.
+ */
+export declare function setHostSecret(key: string, value: string): void;
+/** Read a host-private credential registered by {@link setHostSecret}. */
+export declare function getHostSecret(key: string): string | undefined;
+/** Forget a host-private credential registered by {@link setHostSecret}. */
+export declare function deleteHostSecret(key: string): void;
 /**
  * Read outside the project snapshot. Test overlays require a captured host DENO_TESTING=1.
  * Tenant project scopes and later global mutations cannot shadow this read.
+ *
+ * Host-private credentials registered with {@link setHostSecret} resolve here
+ * and only here, so framework code reaches them while `getEnv()` — the reader
+ * project code can reach — does not.
+ *
+ * A host value that is defined but blank does not shadow a registered
+ * credential. The CLI normalizes `VERYFRONT_API_TOKEN=""` (or whitespace) to
+ * "unset" when it decides to register the stored login token, so treating that
+ * blank value as authoritative here would strand the credential and leave
+ * `dev`, `start`, workflow, and eval consumers with no usable token.
  */
 export declare function getHostEnv(key: string): string | undefined;
+/** Read host environment while excluding values copied from project env files. */
+export declare function getHostEnvExcludingEnvFile(key: string): string | undefined;
 /**
  * Register the server-owned project environment snapshot bridge.
  *

package/esm/src/platform/compat/process/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/src/platform/compat/process/env.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AA0BpE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,MAAM,OAAO,CAAC;IACxB,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC,CAAC;AAoBF,oDAAoD;AACpD,wBAAgB,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA4B5C;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiC1D;AAoED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,MAAM,kBAAkB,GAAG,SAAS,GAC3C,IAAI,CAWN;AAED,0EAA0E;AAC1E,wBAAgB,4BAA4B,IAAI,kBAAkB,GAAG,SAAS,CAE7E;AAED,kEAAkE;AAClE,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYtD;AAKD,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAUD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAC9D,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;AAOpE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAC9D,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;AAapE,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,QAAQ,UAAQ,EAChB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAmBT;AAED,gBAAgB;AAChB,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CA0BvD;AAED,6CAA6C;AAC7C,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAwB3C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,GAAG,IAAI,CAS/D"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../../src/src/platform/compat/process/env.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAmEpE,wFAAwF;AACxF,wBAAgB,yBAAyB,IAAI,IAAI,CAMhD;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAElD;AAED,qFAAqF;AACrF,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CASzD;AAED,oFAAoF;AACpF,wBAAgB,wBAAwB,IAAI,IAAI,CAG/C;AAED,6FAA6F;AAC7F,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAqB1D;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,MAAM,OAAO,CAAC;IACxB,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC,CAAC;AAoBF,oDAAoD;AACpD,wBAAgB,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA4B5C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAK9D;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE7D;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAKlD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAO1D;AAED,kFAAkF;AAClF,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ1E;AAwGD;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,MAAM,kBAAkB,GAAG,SAAS,GAC3C,IAAI,CAWN;AAED,0EAA0E;AAC1E,wBAAgB,4BAA4B,IAAI,kBAAkB,GAAG,SAAS,CAE7E;AAED,kEAAkE;AAClE,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAetD;AAKD,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAUD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAC9D,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;AAOpE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAC9D,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;AAapE,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,QAAQ,UAAQ,EAChB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAmBT;AAED,gBAAgB;AAChB,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CA0BvD;AAED,6CAA6C;AAC7C,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAwB3C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,GAAG,IAAI,CAS/D"}

package/esm/src/platform/compat/process/env.js

@@ -20,9 +20,105 @@ const allowHostEnvTestOverlay = (() => {
     return hostProcessEnv?.DENO_TESTING === "1";
 })();
 const MapConstructor = Map;
+const mapDelete = Map.prototype.delete;
 const mapEntries = Map.prototype.entries;
 const mapGet = Map.prototype.get;
 const mapHas = Map.prototype.has;
+const mapSet = Map.prototype.set;
+const SetConstructor = Set;
+const setAdd = Set.prototype.add;
+const setClear = Set.prototype.clear;
+const setDelete = Set.prototype.delete;
+const setForEach = Set.prototype.forEach;
+const setHas = Set.prototype.has;
+// Captured before project code runs: `getHostEnv` is on the credential path,
+// so a project that replaces `String.prototype.trim` must not observe — or
+// influence — how a host value is classified as blank.
+const stringTrim = String.prototype.trim;
+const stringToLowerCase = String.prototype.toLowerCase;
+/**
+ * Host-private credentials, deliberately kept out of the process environment.
+ *
+ * The CLI resolves the developer's stored login token before it starts a
+ * server. In local development project route modules are imported into that
+ * same process, so anything placed in the environment — `Deno.env`,
+ * `process.env`, a spawned child's inherited env, or `getEnv()` — is readable
+ * by project-authored code, and a hostile project could exfiltrate the token
+ * just by being served. Values registered here are resolved only through
+ * {@link getHostEnv}, which the public `veryfront/*` entry points do not
+ * export, so framework code can still read them while project code reaching
+ * for a supported export cannot.
+ *
+ * The boundary is the export surface, not a realm: project modules are loaded
+ * with a plain dynamic `import()` into this same process, so code that
+ * resolves this file directly rather than through a `veryfront/*` entry shares
+ * the module instance and can still call {@link getHostSecret}. The import map
+ * and the module-boundary lint are what keep that path closed, exactly as for
+ * {@link registerTrustedProjectEnvSnapshot}. What this store buys is that the
+ * credential is no longer reachable through the ordinary, fully supported
+ * readers — `Deno.env`, `process.env`, {@link getEnv}, and a spawned child's
+ * inherited environment.
+ */
+const hostSecrets = new MapConstructor();
+const envFileValueKeys = new SetConstructor();
+const hostApiEnvSnapshot = new MapConstructor();
+const HOST_API_ENV_KEYS = ["VERYFRONT_API_URL", "VERYFRONT_API_BASE_URL"];
+/** Capture operator-owned API routing before project modules can mutate the process. */
+export function captureHostApiEnvironment() {
+    for (const apiKey of HOST_API_ENV_KEYS) {
+        if (apply(mapHas, hostApiEnvSnapshot, [apiKey]))
+            continue;
+        const trustedValue = hasEnvFileValueSource(apiKey) ? undefined : readHostProcessEnv(apiKey);
+        apply(mapSet, hostApiEnvSnapshot, [apiKey, trustedValue]);
+    }
+}
+/** @internal Record that an environment value came from a project env file. */
+export function markEnvFileValue(key) {
+    apply(setAdd, envFileValueKeys, [key]);
+}
+/** @internal Record that a non-env-file write replaced prior env-file provenance. */
+export function clearEnvFileValueSource(key) {
+    const foldedKey = apply(stringToLowerCase, key, []);
+    apply(setForEach, envFileValueKeys, [
+        (recordedKey) => {
+            if (apply(stringToLowerCase, recordedKey, []) === foldedKey) {
+                apply(setDelete, envFileValueKeys, [recordedKey]);
+            }
+        },
+    ]);
+}
+/** @internal Clear project env provenance alongside the env loader's test reset. */
+export function clearEnvFileValueSources() {
+    if (!allowHostEnvTestOverlay)
+        return;
+    apply(setClear, envFileValueKeys, []);
+}
+/** @internal Report whether the current process value was copied from a project env file. */
+export function hasEnvFileValueSource(key) {
+    if (apply(setHas, envFileValueKeys, [key]))
+        return true;
+    // Windows aliases environment names case-insensitively, while the env
+    // loader records the spelling used in the file. Confirm an alias against
+    // the live value before accepting it. Running the verified check on every
+    // host is conservative: on a case-sensitive host it can only classify two
+    // differently cased keys as the same source when their values are equal.
+    const value = readHostProcessEnv(key);
+    if (value === undefined)
+        return false;
+    const foldedKey = apply(stringToLowerCase, key, []);
+    let matchesAlias = false;
+    apply(setForEach, envFileValueKeys, [
+        (recordedKey) => {
+            if (matchesAlias || recordedKey === key)
+                return;
+            const foldedRecordedKey = apply(stringToLowerCase, recordedKey, []);
+            if (foldedRecordedKey !== foldedKey)
+                return;
+            matchesAlias = readHostProcessEnv(recordedKey) === value;
+        },
+    ]);
+    return matchesAlias;
+}
 function getEnvOverlayStore() {
     const storage = getEnvOverlayStorage();
     const store = storage?.getStore();
@@ -63,11 +159,73 @@ export function env() {
     }
     return base;
 }
+/**
+ * Register a host-private credential under `key`.
+ *
+ * The value is held in memory only: it never reaches `Deno.env`,
+ * `process.env`, a child process environment, or {@link getEnv}, so project
+ * code running in the same process cannot read it. {@link getHostEnv} resolves
+ * it after the real environment, so an explicitly exported variable still wins.
+ *
+ * Part of the contract for every registered key: a host variable that is
+ * exported but blank (empty or whitespace-only) does not shadow the
+ * credential — {@link getHostEnv} treats such a value as unset for that key
+ * and returns the registered credential instead. Register a credential only
+ * when a blank export must not suppress it; a caller that needs a blank
+ * export to win must not use this store.
+ */
+export function setHostSecret(key, value) {
+    if (key === "VERYFRONT_API_TOKEN") {
+        captureHostApiEnvironment();
+    }
+    apply(mapSet, hostSecrets, [key, value]);
+}
+/** Read a host-private credential registered by {@link setHostSecret}. */
+export function getHostSecret(key) {
+    return apply(mapGet, hostSecrets, [key]);
+}
+/** Forget a host-private credential registered by {@link setHostSecret}. */
+export function deleteHostSecret(key) {
+    apply(mapDelete, hostSecrets, [key]);
+    if (key === "VERYFRONT_API_TOKEN") {
+        for (const apiKey of HOST_API_ENV_KEYS)
+            apply(mapDelete, hostApiEnvSnapshot, [apiKey]);
+    }
+}
 /**
  * Read outside the project snapshot. Test overlays require a captured host DENO_TESTING=1.
  * Tenant project scopes and later global mutations cannot shadow this read.
+ *
+ * Host-private credentials registered with {@link setHostSecret} resolve here
+ * and only here, so framework code reaches them while `getEnv()` — the reader
+ * project code can reach — does not.
+ *
+ * A host value that is defined but blank does not shadow a registered
+ * credential. The CLI normalizes `VERYFRONT_API_TOKEN=""` (or whitespace) to
+ * "unset" when it decides to register the stored login token, so treating that
+ * blank value as authoritative here would strand the credential and leave
+ * `dev`, `start`, workflow, and eval consumers with no usable token.
  */
 export function getHostEnv(key) {
+    const value = readHostProcessEnv(key);
+    if (value !== undefined && apply(stringTrim, value, []) !== "")
+        return value;
+    // Only a registered credential displaces the blank host value; without one
+    // the host environment is still reported verbatim.
+    const secret = getHostSecret(key);
+    return secret !== undefined ? secret : value;
+}
+/** Read host environment while excluding values copied from project env files. */
+export function getHostEnvExcludingEnvFile(key) {
+    if (getHostSecret("VERYFRONT_API_TOKEN") !== undefined && apply(mapHas, hostApiEnvSnapshot, [key])) {
+        return apply(mapGet, hostApiEnvSnapshot, [key]);
+    }
+    if (hasEnvFileValueSource(key))
+        return getHostSecret(key);
+    return getHostEnv(key);
+}
+/** The host process environment alone, without host-private credentials. */
+function readHostProcessEnv(key) {
     if (denoRuntime && denoEnv && denoEnvGet) {
         let value;
         try {
@@ -191,7 +349,10 @@ export function getEnv(key) {
         // the raw object resolve a key by the same rule, writes included.
         return readProjectScopedEnv(projectEnv, key);
     }
-    return getHostEnv(key);
+    // Host process environment only. Host-private credentials stay out of this
+    // reader: local development imports project route modules into this process,
+    // and `getEnv()` is the accessor those modules can call.
+    return readHostProcessEnv(key);
 }
 const DEFAULT_ENV_TRUE_VALUES = ["1", "true", "yes"];
 const DEFAULT_ENV_FALSE_VALUES = ["0", "false", "no"];

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.1257";
+export declare const VERSION = "0.1.1258-rc.18787";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version-constant.d.ts","sourceRoot":"","sources":["../../../src/src/utils/version-constant.ts"],"names":[],"mappings":"AAEA,4BAA4B;AAC5B,eAAO,MAAM,OAAO,aAAa,CAAC"}
+{"version":3,"file":"version-constant.d.ts","sourceRoot":"","sources":["../../../src/src/utils/version-constant.ts"],"names":[],"mappings":"AAEA,4BAA4B;AAC5B,eAAO,MAAM,OAAO,sBAAsB,CAAC"}

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.1257";
+export const VERSION = "0.1.1258-rc.18787";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@veryfront/ext-content-mdx",
-  "version": "0.1.1257",
+  "version": "0.1.1258-rc.18787",
   "description": "Veryfront first-party extension package for ext-content-mdx",
   "keywords": [
     "veryfront",
@@ -53,7 +53,7 @@
     "@types/hast": "3.0.3",
     "@types/mdast": "4.0.3",
     "@types/unist": "3.0.2",
-    "@veryfront/ext-parser-babel": "0.1.1257",
+    "@veryfront/ext-parser-babel": "0.1.1258-rc.18787",
     "acorn": "8.17.0",
     "acorn-jsx": "5.3.2",
     "github-slugger": "2.0.0",
@@ -82,7 +82,7 @@
     "vfile": "6.0.3"
   },
   "peerDependencies": {
-    "veryfront": "^0.1.1257"
+    "veryfront": "^0.1.1258-rc.18787"
   },
   "type": "module",
   "types": "./esm/extensions/ext-content-mdx/src/index.d.ts",
@@ -92,5 +92,5 @@
     "NOTICE",
     "README.md"
   ],
-  "gitHead": "62a239037b0deb0e54685b684ff074264f9e9138"
+  "gitHead": "f1ce510fe0df2a7a6646a13e192feb81927b75ec"
 }