@vesk/adapter 0.1.1 → 0.2.8

package/dist/hmr.js

@@ -3,8 +3,9 @@ import { readFileSync, existsSync, writeFileSync } from 'node:fs';
 import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { compileClient } from '@vesk/compiler/src/client-codegen';
-import { resolveComponentName } from '@vesk/compiler/src/server-codegen';
+import { resolveComponentName, randomToken } from '@vesk/compiler/src/server-codegen';
 import { resolveErrorFile } from '@vesk/adapter/src/ssr-function';
+import { isAllowedWsUpgrade } from '@vesk/adapter/src/paths';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 function findRouteForSource(routeTree, sourceDir) {
     for (const node of routeTree) {
@@ -297,15 +298,30 @@ function regenerateSsrFunction(routeNode, appDir, outDir, componentMap, options)
     writeFileSync(funcPath, funcCode, 'utf-8');
 }
 export function createHmrServer(httpServer, appDir, devDir, componentMap) {
-    const wss = new WebSocketServer({ server: httpServer, path: '/_vesk/hmr' });
+    // Per-session nonce gating the client-side HMR eval hook (see
+    // appendHmrGlobals in client-bundle.ts). Broadcast with every update.
+    const hmrNonce = randomToken(16);
+    globalThis.__vesk_hmr_nonce = hmrNonce;
+    const wss = new WebSocketServer({ noServer: true });
     const clients = new Set();
+    // Origin-checked upgrade: cross-site pages always attach an Origin header
+    // to WebSocket handshakes, so a mismatch means a CSWS attempt — destroy it.
+    httpServer.on('upgrade', (req, socket, head) => {
+        if (req.url !== '/_vesk/hmr' || !isAllowedWsUpgrade(req.headers)) {
+            socket.destroy();
+            return;
+        }
+        wss.handleUpgrade(req, socket, head, (ws) => {
+            wss.emit('connection', ws, req);
+        });
+    });
     wss.on('connection', (ws) => {
         clients.add(ws);
         ws.on('close', () => clients.delete(ws));
         ws.on('error', () => clients.delete(ws));
     });
     function broadcast(type, data) {
-        const msg = JSON.stringify({ type, ...data });
+        const msg = JSON.stringify({ type, nonce: hmrNonce, ...data });
         for (const ws of clients) {
             try {
                 ws.send(msg);

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACe,YAAY,EAAE,WAAW,EAEnD,MAAM,yBAAyB,CAAC;AAgBjC,wBAAsB,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAwSpG;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACe,YAAY,EAAE,WAAW,EAEnD,MAAM,yBAAyB,CAAC;AAgBjC,wBAAsB,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CA+SpG;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/index.js

@@ -27,6 +27,12 @@ export async function build(appDir, options) {
     const outDir = resolve(options?.outDir || resolve(appDir, '..', '.vesk'));
     const publicDir = options?.publicDir || resolve(appDir, '..', 'public');
     const plugins = options?.plugins || [];
+    // Apply the Markdown policy for this build so SSG prerendering renders
+    // (and warns about) raw HTML exactly like the running server will.
+    if (options?.md) {
+        const { configureMd } = await import('@vesk/runtime/src/md');
+        configureMd(options.md);
+    }
     for (const plugin of plugins) {
         if (typeof plugin.onBuildStart === 'function') {
             await plugin.onBuildStart();

package/dist/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAA2B,MAAM,yBAAyB,CAAC;AAS5F,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA6ChG;AAED,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CA2C5E"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAA2B,MAAM,yBAAyB,CAAC;AAS5F,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgDhG;AAED,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CA8C5E"}

package/dist/middleware.js

@@ -33,14 +33,17 @@ export function compileMiddleware(mwChain, _appDir) {
         '    if (index >= chain.length) return null;',
         '    const fn = chain[index];',
         '    let nextCalled = false;',
+        '    let nextResult = null;',
         '    async function next(rewrite) {',
         '      if (nextCalled) return null;',
         '      nextCalled = true;',
         '      if (rewrite) rewriteUrl = rewrite;',
-        '      return run(index + 1);',
+        '      nextResult = await run(index + 1);',
+        '      return nextResult;',
         '    }',
         '    const result = await fn(ctx, next);',
         '    if (result instanceof Response) return result;',
+        '    if (nextResult instanceof Response) return nextResult;',
         '    if (!nextCalled) return run(index + 1);',
         '    return null;',
         '  }',
@@ -76,14 +79,17 @@ export function compileMiddlewareCode(mwSourceTexts) {
         '    if (index >= __mwChain.length) return null;',
         '    const fn = __mwChain[index];',
         '    let nc = false;',
+        '    let ncResult = null;',
         '    async function next(rewrite) {',
         '      if (nc) return null;',
         '      nc = true;',
         '      if (rewrite) rewriteUrl = rewrite;',
-        '      return run(index + 1);',
+        '      ncResult = await run(index + 1);',
+        '      return ncResult;',
         '    }',
         '    const result = await fn(ctx, next);',
         '    if (result instanceof Response) return result;',
+        '    if (ncResult instanceof Response) return ncResult;',
         '    if (!nc) return run(index + 1);',
         '    return null;',
         '  }',

package/dist/paths.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Resolves `relPath` against `baseDir` and returns the absolute path ONLY if
+ * it stays strictly inside `baseDir` (never the directory itself, never a
+ * sibling). Returns null otherwise. Single source of truth for static file
+ * serving / prerender writes so traversal defenses cannot drift.
+ */
+export declare function resolveWithin(baseDir: string, relPath: string): string | null;
+/**
+ * True when an incoming WebSocket upgrade may connect: same-origin when the
+ * client sends an Origin header, always allowed for non-browser clients that
+ * omit it (matching the HMR threat model — cross-site pages always attach
+ * Origin to WS handshakes). Loopback aliases (localhost / 127.0.0.1 / ::1)
+ * are treated as equivalent so local dev works over either name.
+ */
+export declare function isAllowedWsUpgrade(headers: Record<string, unknown>): boolean;
+//# sourceMappingURL=paths.d.ts.map

package/dist/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM7E;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAU5E"}

package/dist/paths.js

@@ -0,0 +1,81 @@
+import { resolve, sep } from 'node:path';
+/**
+ * Resolves `relPath` against `baseDir` and returns the absolute path ONLY if
+ * it stays strictly inside `baseDir` (never the directory itself, never a
+ * sibling). Returns null otherwise. Single source of truth for static file
+ * serving / prerender writes so traversal defenses cannot drift.
+ */
+export function resolveWithin(baseDir, relPath) {
+    const base = resolve(baseDir);
+    const target = resolve(baseDir, relPath);
+    const prefix = base + sep;
+    if (!target.startsWith(prefix))
+        return null;
+    return target;
+}
+/**
+ * True when an incoming WebSocket upgrade may connect: same-origin when the
+ * client sends an Origin header, always allowed for non-browser clients that
+ * omit it (matching the HMR threat model — cross-site pages always attach
+ * Origin to WS handshakes). Loopback aliases (localhost / 127.0.0.1 / ::1)
+ * are treated as equivalent so local dev works over either name.
+ */
+export function isAllowedWsUpgrade(headers) {
+    const origin = typeof headers['origin'] === 'string' ? headers['origin'] : '';
+    if (!origin)
+        return true;
+    const host = typeof headers['host'] === 'string' ? headers['host'] : '';
+    if (!host)
+        return false;
+    const originAuth = urlAuthority(origin);
+    if (originAuth === host.toLowerCase().trim())
+        return true;
+    const a = splitAuthority(originAuth);
+    const b = splitAuthority(host.toLowerCase().trim());
+    return a.port === b.port && isLoopback(a.hostname) && isLoopback(b.hostname);
+}
+function splitAuthority(authority) {
+    // bracketed IPv6 [::1]:3000
+    if (authority.startsWith('[')) {
+        const close = authority.indexOf(']');
+        if (close !== -1) {
+            return { hostname: authority.slice(0, close + 1), port: authority.slice(close + 2) };
+        }
+    }
+    const colon = authority.lastIndexOf(':');
+    if (colon === -1)
+        return { hostname: authority, port: '' };
+    let multiColon = false;
+    for (let i = 0; i < colon; i++) {
+        if (authority[i] === ':') {
+            multiColon = true;
+            break;
+        }
+    }
+    if (multiColon)
+        return { hostname: authority, port: '' };
+    return { hostname: authority.slice(0, colon), port: authority.slice(colon + 1) };
+}
+function isLoopback(hostname) {
+    const h = hostname.replace(/^\[|\]$/g, '');
+    return h === 'localhost' || h === '127.0.0.1' || h === '::1';
+}
+function urlAuthority(url) {
+    const schemeIdx = url.indexOf('://');
+    if (schemeIdx === -1)
+        return '';
+    let rest = url.slice(schemeIdx + 3);
+    let end = rest.length;
+    for (let i = 0; i < rest.length; i++) {
+        const c = rest[i];
+        if (c === '/' || c === '?' || c === '#') {
+            end = i;
+            break;
+        }
+    }
+    rest = rest.slice(0, end);
+    const at = rest.lastIndexOf('@');
+    if (at !== -1)
+        rest = rest.slice(at + 1);
+    return rest.toLowerCase();
+}

package/dist/platform-deploy.js

@@ -265,7 +265,8 @@ function shellFor(platform) {
                 staticServe: 'disk-deno',
                 bootstrap: [
                     'if (typeof Deno !== "undefined" && typeof Deno.serve === "function") {',
-                    '  Deno.serve(async (request) => {',
+                    '  const __veskPort = Number(Deno.env.get("PORT") || 8000);',
+                    '  Deno.serve({ port: __veskPort }, async (request) => {',
                     '    const staticResponse = await serveEmbeddedStatic(request);',
                     '    if (staticResponse) return staticResponse;',
                     '    return handleRequest(request);',

package/dist/platform-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-handler.d.ts","sourceRoot":"","sources":["../src/platform-handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAIvE,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAMpD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,wBAAgB,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEtC;AAQD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CA4HjF;AAED,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8DzF;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;CACxB"}
+{"version":3,"file":"platform-handler.d.ts","sourceRoot":"","sources":["../src/platform-handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAIvE,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAMpD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED,wBAAgB,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEtC;AAQD;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAgIjF;AAED,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiFzF;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;CACxB"}

package/dist/platform-handler.js

@@ -96,8 +96,9 @@ export async function handleRequest(request) {
     return new Response(null, { status: 308, headers: { Location: '/_vesk/static/public' + (pathname.endsWith('/') ? pathname + 'index.html' : pathname + '.html') } });
   }
 
+  let mwCtx = { params: {}, url, locals: {}, cookies: {}, request, set() {}, get() { return undefined; } };
   if (${hasMwLiteral}) {
-    const mwCtx = {
+    mwCtx = {
       request,
       params: {},
       url,
@@ -110,6 +111,9 @@ export async function handleRequest(request) {
     if (mwResult.response) return mwResult.response;
     if (mwResult.rewriteUrl) url.pathname = mwResult.rewriteUrl;
   }
+  // Expose root middleware locals to API/SSR handlers (which seed their own
+  // ctx.locals from this before running route-level middleware).
+  globalThis.__vesk_request = mwCtx;
 
   for (const route of __routes) {
     const params = __matchPath(route.path, url.pathname);
@@ -154,12 +158,28 @@ export async function bundlePlatformHandler(options) {
         plugins.push({
             name: 'empty-node-builtins',
             setup(build) {
-                const builtins = /^(fs|path|node:fs|node:path|child_process|os|crypto|net|stream|buffer|events|util|url|querystring|http|https|zlib|tty)$/;
-                build.onResolve({ filter: builtins }, () => {
-                    return { path: 'node-builtin-empty', namespace: 'empty-node' };
+                const builtins = /^(node:)?(fs|path|child_process|os|crypto|net|stream|buffer|events|util|url|querystring|http|https|zlib|tty|async_hooks)$/;
+                build.onResolve({ filter: builtins }, (args) => {
+                    return { path: args.path, namespace: 'empty-node' };
                 });
-                build.onLoad({ filter: /.*/, namespace: 'empty-node' }, () => ({
-                    contents: `
+                build.onLoad({ filter: /.*/, namespace: 'empty-node' }, (args) => {
+                    // async_hooks needs a usable AsyncLocalStorage shape (constructor +
+                    // run/getStore), not a callable-Proxy stub — the runtime's
+                    // per-request SSR data isolation instantiates it.
+                    if (/async_hooks$/.test(args.path)) {
+                        return {
+                            contents: `
+export class AsyncLocalStorage {
+  run(_store, fn) { return fn(); }
+  getStore() { return null; }
+  enterWith() {}
+  exit(fn) { return fn(); }
+}
+`,
+                            loader: 'js',
+                        };
+                    }
+                    const contents = `
 const __m = typeof Proxy !== 'undefined' ? new Proxy({}, {
   get(_, key) { return typeof key === 'string' ? () => {} : undefined; },
   has() { return true; },
@@ -187,9 +207,12 @@ export const spawnSync = () => ({ status: 0 });
 export const execSync = () => '';
 export const randomBytes = () => ({});
 export const createHash = () => ({ update: () => {}, digest: () => '' });
-`,
-                    loader: 'js',
-                }));
+`;
+                    return {
+                        contents,
+                        loader: 'js',
+                    };
+                });
             },
         });
     }

package/dist/prod-server.d.ts

@@ -1,5 +1,10 @@
 import { type Server } from 'node:http';
+export declare function bodyTooLarge(maxBytes: number): Error & {
+    status: number;
+};
 export declare function startProdServer(outDir: string, options?: {
     port?: number;
+    host?: string;
+    maxBodyBytes?: number;
 }): Promise<Server>;
 //# sourceMappingURL=prod-server.d.ts.map

package/dist/prod-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAgGjG,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAyWlG"}
+{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAsBjG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AA4FD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA0YxI"}

package/dist/prod-server.js

@@ -3,17 +3,32 @@ import { resolve, extname, dirname } from 'node:path';
 import { createServer } from 'node:http';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
-import { createRateLimiter, resolveComponentName } from '@vesk/compiler/src/server-codegen';
-import { securityHeaders, getClientProtocol } from '@vesk/compiler/src/server-utils';
+import { createRateLimiter, resolveComponentName, safeJsonForScript, getClientProtocol, DEFAULT_MAX_BODY_BYTES } from '@vesk/compiler/src/server-codegen';
+import { securityHeaders } from '@vesk/compiler/src/server-utils';
+import { resolveWithin } from '@vesk/adapter/src/paths';
 const _require = createRequire(import.meta.url);
 const __dirname = dirname(fileURLToPath(import.meta.url));
-async function readBody(req) {
+async function readBody(req, maxBytes = DEFAULT_MAX_BODY_BYTES) {
     const chunks = [];
-    for await (const chunk of req)
+    let total = 0;
+    for await (const chunk of req) {
+        total += chunk.byteLength;
+        if (total > maxBytes)
+            throw bodyTooLarge(maxBytes);
         chunks.push(chunk);
+    }
     return Buffer.concat(chunks);
 }
-function makeWebRequest(nodeReq, url) {
+export function bodyTooLarge(maxBytes) {
+    const err = new Error(`Request body exceeds limit (${maxBytes} bytes)`);
+    err.status = 413;
+    return err;
+}
+function errorStatus(e, fallback) {
+    const s = e?.status ?? e?.statusCode;
+    return typeof s === 'number' && s >= 400 && s < 600 ? s : fallback;
+}
+function makeWebRequest(nodeReq, url, maxBodyBytes = DEFAULT_MAX_BODY_BYTES) {
     const parsedUrl = new URL(url, `http://${nodeReq.headers.host || 'localhost'}`);
     const method = nodeReq.method || 'GET';
     let _bodyBuffer = null;
@@ -21,8 +36,13 @@ function makeWebRequest(nodeReq, url) {
         if (_bodyBuffer)
             return _bodyBuffer;
         const chunks = [];
-        for await (const chunk of nodeReq)
+        let total = 0;
+        for await (const chunk of nodeReq) {
+            total += chunk.byteLength;
+            if (total > maxBodyBytes)
+                throw bodyTooLarge(maxBodyBytes);
             chunks.push(Buffer.from(chunk));
+        }
         _bodyBuffer = Buffer.concat(chunks);
         return _bodyBuffer;
     }
@@ -70,6 +90,11 @@ const MIME = {
 };
 export async function startProdServer(outDir, options) {
     const port = options?.port || 3000;
+    const host = options?.host || '127.0.0.1';
+    const maxBodyBytes = options?.maxBodyBytes || DEFAULT_MAX_BODY_BYTES;
+    // Production default: generated handlers consult this to gate error details.
+    if (!process.env.NODE_ENV)
+        process.env.NODE_ENV = 'production';
     const staticDir = resolve(outDir, 'static');
     const configPath = resolve(outDir, 'config.json');
     if (!existsSync(configPath)) {
@@ -81,6 +106,7 @@ export async function startProdServer(outDir, options) {
     console.error(`vesk start: serving from ${outDir}`);
     const projectDir = resolve(outDir, '..');
     let securityConfig = {};
+    let mdConfig;
     try {
         const veskConfigPath = resolve(projectDir, 'vesk.config.js');
         const veskConfigTsPath = resolve(projectDir, 'vesk.config.ts');
@@ -98,14 +124,24 @@ export async function startProdServer(outDir, options) {
             rawConfig = rawConfig();
         const configObj = rawConfig;
         securityConfig = { security: configObj.security };
+        mdConfig = configObj.md;
     }
-    catch {
-        // ignore config load errors
+    catch (e) {
+        // Fail closed: keep the secure defaults above and warn loudly — a broken
+        // config must never silently disable the app's chosen security policy.
+        console.error('vesk start: failed to load vesk.config — falling back to secure defaults:', e instanceof Error ? e.message : e);
+    }
+    if (mdConfig) {
+        try {
+            const { configureMd } = await import('@vesk/runtime/src/md');
+            configureMd(mdConfig);
+        }
+        catch { /* runtime md module unavailable — keep default escape policy */ }
     }
     let rateLimiter = null;
     if (securityConfig?.rateLimit) {
         const rlConfig = securityConfig.rateLimit;
-        rateLimiter = createRateLimiter({ windowMs: rlConfig.windowMs || 60000, max: rlConfig.max || 100 });
+        rateLimiter = createRateLimiter({ windowMs: rlConfig.windowMs || 60000, max: rlConfig.max || 100, trustProxy: !!securityConfig?.trustProxy });
     }
     let securityHeadersFn = null;
     try {
@@ -199,9 +235,8 @@ export async function startProdServer(outDir, options) {
             return origWriteHead(statusCode, headers);
         });
         const publicDir = resolve(staticDir, 'public');
-        const sanitized = url.pathname.replace(/\.\./g, '');
-        const rootFile = resolve(publicDir, sanitized.slice(1));
-        if (rootFile.startsWith(publicDir) && existsSync(rootFile) && statSync(rootFile).isFile()) {
+        const rootFile = url.pathname.length > 1 ? resolveWithin(publicDir, url.pathname.slice(1)) : null;
+        if (rootFile && existsSync(rootFile) && statSync(rootFile).isFile()) {
             const ext = extname(rootFile);
             res.writeHead(200, { 'Content-Type': MIME[ext] || 'application/octet-stream' });
             res.end(readFileSync(rootFile));
@@ -214,10 +249,11 @@ export async function startProdServer(outDir, options) {
             if (payload)
                 delete store[token];
             const lines = [];
+            // script-safe serialization: props may contain user data
             if (payload?.props)
-                lines.push(`globalThis.__vesk_props = ${JSON.stringify(payload.props)};`);
+                lines.push(`globalThis.__vesk_props = ${safeJsonForScript(JSON.stringify(payload.props))};`);
             if (payload?.ssrData)
-                lines.push(`globalThis.__vsk_ssr_data = ${JSON.stringify(payload.ssrData)};`);
+                lines.push(`globalThis.__vsk_ssr_data = ${safeJsonForScript(JSON.stringify(payload.ssrData))};`);
             res.writeHead(200, { 'Content-Type': 'application/javascript', 'Cache-Control': 'no-store' });
             res.end(lines.join('\n') || '// no ssr data');
             return;
@@ -231,9 +267,9 @@ export async function startProdServer(outDir, options) {
             }
         }
         if (url.pathname.startsWith('/_vesk/static/')) {
-            const relPath = url.pathname.replace('/_vesk/static/', '').replace(/\.\./g, '');
-            const staticPath = resolve(staticDir, relPath);
-            if (!staticPath.startsWith(staticDir)) {
+            const relPath = url.pathname.slice('/_vesk/static/'.length);
+            const staticPath = resolveWithin(staticDir, relPath);
+            if (!staticPath) {
                 res.writeHead(403);
                 res.end('Forbidden');
                 return;
@@ -256,8 +292,9 @@ export async function startProdServer(outDir, options) {
                 }
             }
         }
+        let mwCtx;
         if (middlewareMod) {
-            const mwCtx = {
+            mwCtx = {
                 request: new Request(url.href, { headers: req.headers, method: req.method || 'GET' }),
                 params: {},
                 url,
@@ -277,6 +314,20 @@ export async function startProdServer(outDir, options) {
                 url.pathname = mwResult.rewriteUrl;
             }
         }
+        else {
+            mwCtx = {
+                params: {},
+                url,
+                locals: {},
+                cookies: {},
+                request: null,
+                set() { },
+                get() { return undefined; },
+            };
+        }
+        // Expose root middleware locals to API/SSR handlers (which seed their own
+        // ctx.locals from this before running route-level middleware).
+        globalThis.__vesk_request = mwCtx;
         if (url.pathname.startsWith('/_vesk/action/')) {
             const actionId = url.pathname.replace('/_vesk/action/', '');
             const actionEntry = buildConfig.actions && buildConfig.actions.find(a => a.id === actionId);
@@ -292,15 +343,18 @@ export async function startProdServer(outDir, options) {
                 return;
             }
             try {
-                const webRequest = makeWebRequest(req, url.href);
+                const webRequest = makeWebRequest(req, url.href, maxBodyBytes);
                 const response = await mod.handleAction(webRequest, actionId);
                 const body = await response.text();
                 res.writeHead(response.status, Object.fromEntries(response.headers));
                 res.end(body);
             }
             catch (e) {
-                const message = e instanceof Error ? e.message : String(e);
-                res.writeHead(500, { 'Content-Type': 'application/json' });
+                const status = errorStatus(e, 500);
+                const message = status === 500 && process.env.NODE_ENV === 'production'
+                    ? 'Internal Server Error'
+                    : e instanceof Error ? e.message : String(e);
+                res.writeHead(status, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ ok: false, error: message }));
             }
             return;
@@ -313,7 +367,7 @@ export async function startProdServer(outDir, options) {
                         const mod = await loadFunction(route.function);
                         if (mod) {
                             try {
-                                const webRequest = makeWebRequest(req, url.href);
+                                const webRequest = makeWebRequest(req, url.href, maxBodyBytes);
                                 const response = await mod.handle(webRequest);
                                 const body = await response.text();
                                 res.writeHead(response.status, Object.fromEntries(response.headers));
@@ -321,9 +375,9 @@ export async function startProdServer(outDir, options) {
                                 return;
                             }
                             catch (e) {
-                                const message = e instanceof Error ? e.message : String(e);
-                                res.writeHead(500, { 'Content-Type': 'application/json' });
-                                res.end(JSON.stringify({ error: message }));
+                                const status = errorStatus(e, 500);
+                                res.writeHead(status, { 'Content-Type': 'application/json' });
+                                res.end(JSON.stringify({ error: status === 500 ? 'Internal Server Error' : e instanceof Error ? e.message : String(e) }));
                                 return;
                             }
                         }
@@ -337,10 +391,10 @@ export async function startProdServer(outDir, options) {
         if (existsSync(nfPath)) {
             try {
                 const runtimePath = resolve(outDir, 'server', 'runtime.js');
-                const { renderFullPage } = await import(runtimePath);
+                const { renderFullPage, storeDataScriptGlobal } = await import(runtimePath);
                 const src = readFileSync(nfPath, 'utf-8');
                 const compName = resolveComponentName(src) || 'NotFound';
-                notFoundHtml = await renderFullPage(src, compName, { params: {}, url: url.pathname }, new Map(), { hydrate: true, cssUrls: ['/_vesk/static/_tailwind.css', '/_vesk/static/global.css'], security: securityConfig?.security || {}, sourcePath: nfPath });
+                notFoundHtml = await renderFullPage(src, compName, { params: {}, url: url.pathname }, new Map(), { hydrate: true, cssUrls: ['/_vesk/static/_tailwind.css', '/_vesk/static/global.css'], security: securityConfig?.security || {}, externalDataScript: storeDataScriptGlobal, sourcePath: nfPath });
             }
             catch { }
         }
@@ -351,7 +405,7 @@ export async function startProdServer(outDir, options) {
                     const mod = await loadFunction(route.function);
                     if (mod) {
                         try {
-                            const webRequest = makeWebRequest(req, url.href);
+                            const webRequest = makeWebRequest(req, url.href, maxBodyBytes);
                             let cachedResult = null;
                             if (route.revalidate && route.revalidate > 0) {
                                 const { pageIsr } = await import('@vesk/runtime/src/index-server');
@@ -404,10 +458,12 @@ export async function startProdServer(outDir, options) {
                             if (existsSync(errPath)) {
                                 try {
                                     const runtimePath = resolve(outDir, 'server', 'runtime.js');
-                                    const { renderFullPage } = await import(runtimePath);
+                                    const { renderFullPage, storeDataScriptGlobal } = await import(runtimePath);
                                     const src = readFileSync(errPath, 'utf-8');
                                     const compName = resolveComponentName(src) || 'Error';
-                                    errorHtml = await renderFullPage(src, compName, { error: err.message, stack: err.stack, statusCode: 500, url: url.pathname }, new Map(), { hydrate: true, cssUrls: ['/_vesk/static/_tailwind.css', '/_vesk/static/global.css'], security: securityConfig?.security || {}, sourcePath: errPath });
+                                    // never leak stack traces / internal messages to prod error pages
+                                    const expose = process.env.NODE_ENV !== 'production';
+                                    errorHtml = await renderFullPage(src, compName, { error: expose ? err.message : 'Internal Server Error', stack: expose ? err.stack : '', statusCode: 500, url: url.pathname }, new Map(), { hydrate: true, cssUrls: ['/_vesk/static/_tailwind.css', '/_vesk/static/global.css'], clientScriptUrl: '/_vesk/static/client.js', security: securityConfig?.security || {}, externalDataScript: storeDataScriptGlobal, sourcePath: errPath });
                                 }
                                 catch { }
                             }
@@ -422,8 +478,8 @@ export async function startProdServer(outDir, options) {
         res.writeHead(404, { 'Content-Type': 'text/html' });
         res.end(notFoundHtml || '<!DOCTYPE html><html><body><h1>404</h1><p>Not Found</p></body></html>');
     });
-    server.listen(port, () => {
-        console.error(`vesk production server at http://localhost:${port}`);
+    server.listen(port, host, () => {
+        console.error(`vesk production server at http://localhost:${port} (listening on ${host})`);
     });
     return server;
 }

package/dist/runtime-bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-bundle.d.ts","sourceRoot":"","sources":["../src/runtime-bundle.ts"],"names":[],"mappings":"AAuCA,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAsGnF"}
+{"version":3,"file":"runtime-bundle.d.ts","sourceRoot":"","sources":["../src/runtime-bundle.ts"],"names":[],"mappings":"AAuCA,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA2GnF"}

package/dist/runtime-bundle.js

@@ -39,7 +39,7 @@ export async function bundleRuntime(appDir, outDir) {
     const runtimeRoot = findRuntimeSrc(appDir);
     const entryFile = resolve(outDir, 'server', `.runtime-entry-${buildId++}.mjs`);
     const entryContent = [
-        `import { renderPage, renderFullPage, renderPageStream, compileFile, setRuntimeModule, setVskHydrate } from ${JSON.stringify(resolve(compilerRoot, 'server-codegen.js'))};`,
+        `import { renderPage, renderFullPage, renderPageStream, compileFile, setRuntimeModule, setVskHydrate, assertSameOrigin } from ${JSON.stringify(resolve(compilerRoot, 'server-codegen.js'))};`,
         `import { parseCookies } from ${JSON.stringify(resolve(compilerRoot, 'server-cookies.js'))};`,
         `import * as __veskRuntime from ${JSON.stringify(resolve(runtimeRoot, 'index-server.js'))};`,
         '',
@@ -77,14 +77,19 @@ export async function bundleRuntime(appDir, outDir) {
         '  return req.locals || {};',
         '}',
         '',
-        'export { renderPage, renderFullPage, renderPageStream, compileFile, setVskHydrate, parseCookies };',
+        'export { renderPage, renderFullPage, renderPageStream, compileFile, setVskHydrate, parseCookies, assertSameOrigin };',
         'export { withSsrStore } from "@vesk/compiler/src/ssr-store";',
         '',
         '// Deliver hydration data as an origin-served script so strict CSP (no unsafe-inline)',
         '// does not block it. The prod server serves /ssr-data.js from the global store.',
         'export function storeDataScriptGlobal(payload) {',
         "  if (!payload || (!payload.props && !payload.ssrData)) return null;",
-        "  const token = Math.random().toString(36).slice(2) + Date.now().toString(36);",
+        '  // CSPRNG token — this URL gates access to the page\'s hydration payload',
+        '  const bytes = new Uint8Array(12);',
+        '  crypto.getRandomValues(bytes);',
+        "  let tk = '';",
+        "  for (const b of bytes) tk += b.toString(16).padStart(2, '0');",
+        '  const token = tk;',
         "  const store = (globalThis.__vsk_ssr_data_store ||= {});",
         "  store[token] = payload;",
         '  // Bound the store: if the browser never fetches /ssr-data.js the entry',

package/dist/ssr-function.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-function.d.ts","sourceRoot":"","sources":["../src/ssr-function.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAkB,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAW7F,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQjF;AAiDD,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,kBAAkB,GAC3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA8VtD"}
+{"version":3,"file":"ssr-function.d.ts","sourceRoot":"","sources":["../src/ssr-function.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAkB,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAW7F,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQjF;AAiDD,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,kBAAkB,GAC3B;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAyWtD"}