veryfront 0.1.1049 → 0.1.1050

package/esm/cli/commands/generate/handler.d.ts

@@ -3,7 +3,7 @@
  */
 import type { ParsedArgs } from "../../shared/types.js";
 export declare const parseGenerateArgs: (args: ParsedArgs) => import("../../shared/args.js").SafeParseResult<import("../../../src/extensions/schema/schema-validator.js").InferShape<{
-    type: import("../../../src/internal-agents/schema.js").Schema<"prompt" | "page" | "api" | "agent" | "layout" | "resource" | "component" | "task" | "tool" | "integration" | "workflow" | "skill" | undefined>;
+    type: import("../../../src/internal-agents/schema.js").Schema<"prompt" | "page" | "api" | "agent" | "layout" | "resource" | "component" | "task" | "tool" | "integration" | "skill" | "workflow" | undefined>;
     name: import("../../../src/internal-agents/schema.js").Schema<string | undefined>;
 }>>;
 export declare function handleGenerateCommand(args: ParsedArgs): Promise<void>;

package/esm/cli/mcp/tools/scaffold-tools.d.ts

@@ -5,7 +5,7 @@ import type { InferSchema } from "../../../src/extensions/schema/index.js";
 import type { MCPTool } from "../tools.js";
 import { type ScaffoldResult } from "../../scaffold/engine.js";
 declare const getScaffoldInput: () => import("../../../src/internal-agents/schema.js").Schema<import("../../../src/extensions/schema/schema-validator.js").InferShape<{
-    type: import("../../../src/internal-agents/schema.js").Schema<"prompt" | "page" | "api" | "agent" | "layout" | "resource" | "component" | "task" | "tool" | "workflow" | "skill">;
+    type: import("../../../src/internal-agents/schema.js").Schema<"prompt" | "page" | "api" | "agent" | "layout" | "resource" | "component" | "task" | "tool" | "skill" | "workflow">;
     name: import("../../../src/internal-agents/schema.js").Schema<string>;
     methods: import("../../../src/internal-agents/schema.js").Schema<string[] | undefined>;
     projectPath: import("../../../src/internal-agents/schema.js").Schema<string | undefined>;

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.1049",
+    "version": "0.1.1050",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "minimumDependencyAge": {

package/esm/src/agent/hosted/child-tool-input.d.ts

@@ -14,7 +14,7 @@ export declare const getHostedChildForkToolInputSchema: () => import("../../inte
     model: import("../../internal-agents/schema.js").Schema<string | undefined>;
     thinking: import("../../internal-agents/schema.js").Schema<number | undefined>;
     max_steps: import("../../internal-agents/schema.js").Schema<number | undefined>;
-    result_mode: import("../../internal-agents/schema.js").Schema<"full" | "summary" | undefined>;
+    result_mode: import("../../internal-agents/schema.js").Schema<"summary" | "full" | undefined>;
 }>>;
 /** Schema for hosted child fork tool input.
  * @deprecated Use getHostedChildForkToolInputSchema()
@@ -28,7 +28,7 @@ export declare const hostedChildForkToolInputSchema: import("../../internal-agen
     model: import("../../internal-agents/schema.js").Schema<string | undefined>;
     thinking: import("../../internal-agents/schema.js").Schema<number | undefined>;
     max_steps: import("../../internal-agents/schema.js").Schema<number | undefined>;
-    result_mode: import("../../internal-agents/schema.js").Schema<"full" | "summary" | undefined>;
+    result_mode: import("../../internal-agents/schema.js").Schema<"summary" | "full" | undefined>;
 }>>;
 /** Input payload for hosted child fork tool. */
 export type HostedChildForkToolInput = InferSchema<ReturnType<typeof getHostedChildForkToolInputSchema>>;

package/esm/src/agent/hosted/default-invoke-agent-tool.d.ts

@@ -88,7 +88,7 @@ export declare const getDefaultHostedInvokeAgentInputSchema: () => import("../..
     model?: string | undefined;
     thinking?: number | undefined;
     max_steps?: number | undefined;
-    result_mode?: "full" | "summary" | undefined;
+    result_mode?: "summary" | "full" | undefined;
 } & {
     agent_id: string;
 }>;
@@ -105,7 +105,7 @@ export declare const defaultHostedInvokeAgentInputSchema: import("../../internal
     model?: string | undefined;
     thinking?: number | undefined;
     max_steps?: number | undefined;
-    result_mode?: "full" | "summary" | undefined;
+    result_mode?: "summary" | "full" | undefined;
 } & {
     agent_id: string;
 }>;
@@ -124,7 +124,7 @@ export declare function createDefaultHostedInvokeAgentTool<TContext extends Defa
     model?: string | undefined;
     thinking?: number | undefined;
     max_steps?: number | undefined;
-    result_mode?: "full" | "summary" | undefined;
+    result_mode?: "summary" | "full" | undefined;
 } & {
     agent_id: string;
 }, DefaultHostedInvokeAgentToolResult>;

package/esm/src/cache/backends/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../../src/src/cache/backends/api.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAsDhD,qBAAa,eAAgB,YAAW,YAAY;IAClD,QAAQ,CAAC,IAAI,EAAG,KAAK,CAAU;IAC/B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,cAAc,CAAC;gBAGrB,OAAO,GAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KACxB;IAiBR,OAAO,CAAC,SAAS;YAIH,OAAO;IAyGf,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQxC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;YAuBrD,eAAe;IAKvB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,SAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAYrF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/B,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAMrD"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../../src/src/cache/backends/api.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAsDhD,qBAAa,eAAgB,YAAW,YAAY;IAClD,QAAQ,CAAC,IAAI,EAAG,KAAK,CAAU;IAC/B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,cAAc,CAAC;gBAGrB,OAAO,GAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KACxB;IAiBR,OAAO,CAAC,SAAS;YAIH,OAAO;IA2Gf,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQxC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;YAuBrD,eAAe;IAKvB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,SAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAYrF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/B,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAMrD"}

package/esm/src/cache/backends/api.js

@@ -9,6 +9,7 @@ import { buildBatchResults } from "../batch-results.js";
 import { REQUEST_ERROR } from "../../errors/index.js";
 import { sanitizeUrlForSpan } from "../../utils/logger/redact.js";
 import { getHostEnv } from "../../platform/compat/process.js";
+import { getVerifiedCacheApiCredential } from "../verified-api-credential-context.js";
 const logger = baseLogger.component("api-cache-backend");
 const DEFAULT_TIMEOUT_MS = 10_000;
 const CIRCUIT_BREAKER_RESET_TIMEOUT_MS = 15_000;
@@ -66,20 +67,22 @@ export class ApiCacheBackend {
         const reqCtx = getCurrentRequestContext();
         const hostToken = getHostEnv("VERYFRONT_API_TOKEN");
         const envToken = getEnvValue("VERYFRONT_API_TOKEN");
-        const verifiedRequestToken = reqCtx?.tokenTrust === "verified-control-plane"
-            ? reqCtx.token
-            : undefined;
-        // Ordinary proxy headers are not cache credentials. Only a request token
-        // explicitly marked after control-plane verification may override the host.
-        const token = verifiedRequestToken || hostToken || envToken || null;
+        const verifiedCredential = getVerifiedCacheApiCredential();
+        const verifiedRequestToken = verifiedCredential?.token;
+        // The private verified-request context cannot be changed through the
+        // globally exposed filesystem request context.
+        const token = verifiedRequestToken || hostToken || reqCtx?.token || envToken || null;
         const tokenSource = verifiedRequestToken
             ? "verified-control-plane"
             : hostToken
                 ? "host-env"
-                : envToken
-                    ? "env"
-                    : "none";
-        const projectRef = reqCtx?.projectId || reqCtx?.projectSlug ||
+                : reqCtx?.token
+                    ? "request"
+                    : envToken
+                        ? "env"
+                        : "none";
+        const projectRef = verifiedCredential?.projectId || verifiedCredential?.projectSlug ||
+            reqCtx?.projectId || reqCtx?.projectSlug ||
             tryGetCacheKeyContext()?.projectId || null;
         if (!token || !projectRef) {
             logger.debug("Missing auth or project context", {

package/esm/src/cache/verified-api-credential-context.d.ts

@@ -0,0 +1,8 @@
+import { type VerifiedControlPlaneCacheCredential, type VerifiedControlPlaneRequestClaims } from "../internal-agents/control-plane-auth.js";
+/**
+ * Runs framework work with the exact cache API credential from a verified
+ * control-plane request body. Keep this helper on internal import surfaces.
+ */
+export declare function runWithVerifiedCacheApiCredential<T>(claims: VerifiedControlPlaneRequestClaims, fn: () => T): T;
+export declare function getVerifiedCacheApiCredential(): VerifiedControlPlaneCacheCredential | undefined;
+//# sourceMappingURL=verified-api-credential-context.d.ts.map

package/esm/src/cache/verified-api-credential-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verified-api-credential-context.d.ts","sourceRoot":"","sources":["../../../src/src/cache/verified-api-credential-context.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,mCAAmC,EACxC,KAAK,iCAAiC,EACvC,MAAM,0CAA0C,CAAC;AAMlD;;;GAGG;AACH,wBAAgB,iCAAiC,CAAC,CAAC,EACjD,MAAM,EAAE,iCAAiC,EACzC,EAAE,EAAE,MAAM,CAAC,GACV,CAAC,CAKH;AAED,wBAAgB,6BAA6B,IACzC,mCAAmC,GACnC,SAAS,CAEZ"}

package/esm/src/cache/verified-api-credential-context.js

@@ -0,0 +1,13 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { consumeVerifiedControlPlaneCacheCredential, } from "../internal-agents/control-plane-auth.js";
+const verifiedCredentialStorage = new AsyncLocalStorage();
+/**
+ * Runs framework work with the exact cache API credential from a verified
+ * control-plane request body. Keep this helper on internal import surfaces.
+ */
+export function runWithVerifiedCacheApiCredential(claims, fn) {
+    return verifiedCredentialStorage.run(consumeVerifiedControlPlaneCacheCredential(claims), fn);
+}
+export function getVerifiedCacheApiCredential() {
+    return verifiedCredentialStorage.getStore() || undefined;
+}

package/esm/src/channels/control-plane.d.ts

@@ -11,20 +11,20 @@ export declare const CONTROL_PLANE_RUN_STREAM_PATH = "/api/control-plane/runs/:r
 /** Allowed control-plane surfaces — source of truth for the schema and {@link ControlPlaneSurface}. */
 export declare const CONTROL_PLANE_SURFACES: readonly ["studio", "channels", "a2a", "mcp"];
 /** Zod schema for get control plane surface. */
-export declare const getControlPlaneSurfaceSchema: () => Schema<"mcp" | "channels" | "studio" | "a2a">;
+export declare const getControlPlaneSurfaceSchema: () => Schema<"mcp" | "studio" | "channels" | "a2a">;
 /** Zod schema for control plane surface. */
-export declare const ControlPlaneSurfaceSchema: Schema<"mcp" | "channels" | "studio" | "a2a">;
+export declare const ControlPlaneSurfaceSchema: Schema<"mcp" | "studio" | "channels" | "a2a">;
 /** Zod schema for get control plane agents list request. */
 export declare const getControlPlaneAgentsListRequestSchema: () => Schema<import("../extensions/schema/schema-validator.js").InferShape<{
     requestId: Schema<string>;
     projectId: Schema<string>;
-    surface: Schema<"mcp" | "channels" | "studio" | "a2a">;
+    surface: Schema<"mcp" | "studio" | "channels" | "a2a">;
 }>>;
 /** Zod schema for control plane agents list request. */
 export declare const ControlPlaneAgentsListRequestSchema: Schema<import("../extensions/schema/schema-validator.js").InferShape<{
     requestId: Schema<string>;
     projectId: Schema<string>;
-    surface: Schema<"mcp" | "channels" | "studio" | "a2a">;
+    surface: Schema<"mcp" | "studio" | "channels" | "a2a">;
 }>>;
 /** Zod schema for get runtime agent skill. */
 export declare const getRuntimeAgentSkillSchema: () => Schema<import("../extensions/schema/schema-validator.js").InferShape<{
@@ -236,7 +236,7 @@ declare const getControlPlaneClaimsSchema: () => Schema<import("../extensions/sc
     iss: Schema<string>;
     aud: Schema<string>;
     sub: Schema<string>;
-    surface: Schema<"mcp" | "channels" | "studio" | "a2a">;
+    surface: Schema<"mcp" | "studio" | "channels" | "a2a">;
     project_id: Schema<string>;
     request_hash: Schema<string>;
     iat: Schema<number>;

package/esm/src/internal-agents/control-plane-auth.d.ts

@@ -1,5 +1,15 @@
-import { type ControlPlaneSurface } from "../channels/control-plane.js";
+import { type ControlPlaneClaims, type ControlPlaneSurface } from "../channels/control-plane.js";
 import type { HandlerContext } from "../types/index.js";
+declare const verifiedControlPlaneRequestBrand: unique symbol;
+export type VerifiedControlPlaneRequestClaims = ControlPlaneClaims & {
+    readonly [verifiedControlPlaneRequestBrand]: true;
+};
+export interface VerifiedControlPlaneCacheCredential {
+    readonly token: string;
+    readonly projectId: string;
+    readonly projectSlug: string;
+}
+export declare function consumeVerifiedControlPlaneCacheCredential(claims: VerifiedControlPlaneRequestClaims): VerifiedControlPlaneCacheCredential | null;
 export declare class ControlPlaneRequestError extends Error {
     readonly status: number;
     constructor(status: number, message: string);
@@ -8,14 +18,6 @@ export declare function getControlPlaneVerificationPublicKey(ctx: HandlerContext
 export declare function verifyControlPlaneRequest(req: Request, ctx: HandlerContext, rawBody: string, options?: {
     expectedSubject?: string;
     expectedSurface?: ControlPlaneSurface;
-}): Promise<import("../extensions/schema/schema-validator.js").InferShape<{
-    iss: import("./schema.js").Schema<string>;
-    aud: import("./schema.js").Schema<string>;
-    sub: import("./schema.js").Schema<string>;
-    surface: import("./schema.js").Schema<"mcp" | "channels" | "studio" | "a2a">;
-    project_id: import("./schema.js").Schema<string>;
-    request_hash: import("./schema.js").Schema<string>;
-    iat: import("./schema.js").Schema<number>;
-    exp: import("./schema.js").Schema<number>;
-}>>;
+}): Promise<VerifiedControlPlaneRequestClaims>;
+export {};
 //# sourceMappingURL=control-plane-auth.d.ts.map

package/esm/src/internal-agents/control-plane-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane-auth.d.ts","sourceRoot":"","sources":["../../../src/src/internal-agents/control-plane-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAQxD,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK5C;AAED,wBAAgB,oCAAoC,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAM5F;AAED,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,mBAAmB,CAAC;CAClC;;;;;;;;;IA2CP"}
+{"version":3,"file":"control-plane-auth.d.ts","sourceRoot":"","sources":["../../../src/src/internal-agents/control-plane-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EAEzB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AASxD,OAAO,CAAC,MAAM,gCAAgC,EAAE,OAAO,MAAM,CAAC;AAE9D,MAAM,MAAM,iCAAiC,GAAG,kBAAkB,GAAG;IACnE,QAAQ,CAAC,CAAC,gCAAgC,CAAC,EAAE,IAAI,CAAC;CACnD,CAAC;AAEF,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAoCD,wBAAgB,0CAA0C,CACxD,MAAM,EAAE,iCAAiC,GACxC,mCAAmC,GAAG,IAAI,CAK5C;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK5C;AAED,wBAAgB,oCAAoC,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAM5F;AAED,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IACP,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,mBAAmB,CAAC;CAClC,GACL,OAAO,CAAC,iCAAiC,CAAC,CAsE5C"}

package/esm/src/internal-agents/control-plane-auth.js

@@ -4,7 +4,36 @@ import { serverLogger } from "../utils/index.js";
 import { HTTP_INTERNAL_SERVER_ERROR } from "../utils/constants/index.js";
 const CONTROL_PLANE_JWS_HEADER = "x-veryfront-control-plane-jws";
 const MAX_CONTROL_PLANE_SIGNATURE_AGE_SECONDS = 60;
+const CONTROL_PLANE_SIGNING_KEY_ENV = "CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY";
 const logger = serverLogger.component("internal-agents-auth");
+const verifiedCacheCredentials = new WeakMap();
+function extractVerifiedCacheCredential(rawBody, claims) {
+    try {
+        const body = JSON.parse(rawBody);
+        const credentials = body.credentials;
+        if (!credentials || typeof credentials !== "object" || Array.isArray(credentials)) {
+            return null;
+        }
+        const token = credentials.authToken;
+        if (typeof token !== "string" || token.length === 0)
+            return null;
+        return Object.freeze({
+            token,
+            projectId: claims.project_id,
+            projectSlug: claims.aud,
+        });
+    }
+    catch {
+        return null;
+    }
+}
+export function consumeVerifiedControlPlaneCacheCredential(claims) {
+    const grant = verifiedCacheCredentials.get(claims);
+    verifiedCacheCredentials.delete(claims);
+    if (!grant || grant.expiresAt <= Math.floor(Date.now() / 1000))
+        return null;
+    return grant.credential;
+}
 export class ControlPlaneRequestError extends Error {
     status;
     constructor(status, message) {
@@ -17,10 +46,11 @@ export function getControlPlaneVerificationPublicKey(ctx) {
     // Project env overlays intentionally hide host secrets from request-scoped reads.
     // Control-plane verification is framework-owned config, so it must fall back to
     // the host environment when the runtime adapter env is overlay-aware.
-    return ctx.adapter.env.get("CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY") ??
-        getHostEnv("CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY");
+    return ctx.adapter.env.get(CONTROL_PLANE_SIGNING_KEY_ENV) ??
+        getHostEnv(CONTROL_PLANE_SIGNING_KEY_ENV);
 }
 export async function verifyControlPlaneRequest(req, ctx, rawBody, options = {}) {
+    const hostPublicKeyPem = getHostEnv(CONTROL_PLANE_SIGNING_KEY_ENV);
     const publicKeyPem = getControlPlaneVerificationPublicKey(ctx);
     if (!publicKeyPem) {
         throw new ControlPlaneRequestError(HTTP_INTERNAL_SERVER_ERROR, "Control-plane verification is not configured");
@@ -34,14 +64,35 @@ export async function verifyControlPlaneRequest(req, ctx, rawBody, options = {})
         throw new ControlPlaneRequestError(401, "Missing control-plane signature");
     }
     try {
-        return await verifyControlPlaneJws(controlPlaneJws, rawBody, {
+        const verificationOptions = {
             audience: projectSlug,
             expectedProjectId: ctx.projectId,
             expectedSubject: options.expectedSubject,
             expectedSurface: options.expectedSurface,
             publicKeyPem,
             maxAgeSeconds: MAX_CONTROL_PLANE_SIGNATURE_AGE_SECONDS,
-        });
+        };
+        const claims = await verifyControlPlaneJws(controlPlaneJws, rawBody, verificationOptions);
+        const verifiedClaims = claims;
+        let hostVerified = hostPublicKeyPem === publicKeyPem && Boolean(hostPublicKeyPem);
+        if (hostPublicKeyPem && !hostVerified) {
+            try {
+                await verifyControlPlaneJws(controlPlaneJws, rawBody, {
+                    ...verificationOptions,
+                    publicKeyPem: hostPublicKeyPem,
+                });
+                hostVerified = true;
+            }
+            catch {
+                // Compatibility verification can still succeed through the adapter,
+                // but only the host key may mint the cache credential capability.
+            }
+        }
+        verifiedCacheCredentials.set(verifiedClaims, Object.freeze({
+            credential: hostVerified ? extractVerifiedCacheCredential(rawBody, claims) : null,
+            expiresAt: claims.exp,
+        }));
+        return verifiedClaims;
     }
     catch (error) {
         // verifyControlPlaneJws performs only crypto and claim validation with no

package/esm/src/platform/adapters/fs/veryfront/multi-project-adapter.d.ts

@@ -2,9 +2,8 @@ import type { DirectoryEntry, FSAdapter, FSAdapterConfig } from "./types.js";
 import type { FileInfo, ResolveFileOptions } from "../../base.js";
 import { ProxyFSAdapterManager } from "./proxy-manager.js";
 import type { VeryfrontFSAdapter } from "./adapter.js";
-import { type RequestTokenTrust } from "./request-context.js";
 export { clearRequestScopedFileCache, getCurrentRequestContext, getRequestScopedFile, runWithRequestContext, setRequestScopedFile, wrapWithCurrentContext, } from "./request-context.js";
-export type { RequestContext, RequestTokenTrust } from "./request-context.js";
+export type { RequestContext } from "./request-context.js";
 export declare class MultiProjectFSAdapter implements FSAdapter {
     private manager;
     private defaultAdapter?;
@@ -14,7 +13,6 @@ export declare class MultiProjectFSAdapter implements FSAdapter {
         releaseId?: string | null;
         branch?: string | null;
         environmentName?: string | null;
-        tokenTrust?: RequestTokenTrust;
     }): Promise<T>;
     setRequestContext(projectSlug: string, token: string): void;
     setProductionMode(_enabled: boolean, _releaseId?: string | null): void;

package/esm/src/platform/adapters/fs/veryfront/multi-project-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"multi-project-adapter.d.ts","sourceRoot":"","sources":["../../../../../../src/src/platform/adapters/fs/veryfront/multi-project-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAQ9E,qBAAa,qBAAsB,YAAW,SAAS;IACrD,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,cAAc,CAAC,CAAqB;gBAEhC,MAAM,EAAE,eAAe;IAanC,cAAc,CAAC,CAAC,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QACR,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,UAAU,CAAC,EAAE,iBAAiB,CAAC;KAChC,GACA,OAAO,CAAC,CAAC,CAAC;IAqDb,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAS3D,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;YAIxD,UAAU;IAgDxB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI;IAIpD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKvC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK3C,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKnD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAKrC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAKtD;;;OAGG;IACI,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC;IAOrD,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKnB,qBAAqB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3D,OAAO,IAAI,IAAI;IAOf,eAAe,IAAI,UAAU,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAI1D,cAAc,IAAI,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,GAAG,SAAS,CAAC;IAUvF,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAUpE,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAoB9E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,qBAAqB,CAExF"}
+{"version":3,"file":"multi-project-adapter.d.ts","sourceRoot":"","sources":["../../../../../../src/src/platform/adapters/fs/veryfront/multi-project-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOvD,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAQ3D,qBAAa,qBAAsB,YAAW,SAAS;IACrD,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,cAAc,CAAC,CAAqB;gBAEhC,MAAM,EAAE,eAAe;IAanC,cAAc,CAAC,CAAC,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QACR,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACjC,GACA,OAAO,CAAC,CAAC,CAAC;IAoDb,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAQ3D,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;YAIxD,UAAU;IAgDxB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI;IAIpD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKvC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK3C,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKnD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAKrC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAKtD;;;OAGG;IACI,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC;IAOrD,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKnB,qBAAqB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3D,OAAO,IAAI,IAAI;IAOf,eAAe,IAAI,UAAU,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAI1D,cAAc,IAAI,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,GAAG,SAAS,CAAC;IAUvF,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAUpE,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAoB9E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,qBAAqB,CAExF"}

package/esm/src/platform/adapters/fs/veryfront/multi-project-adapter.js

@@ -40,7 +40,6 @@ export class MultiProjectFSAdapter {
             projectSlug,
             projectId,
             token,
-            tokenTrust: options?.tokenTrust,
             productionMode,
             releaseId: productionMode ? releaseId : null,
             branch: productionMode ? null : branch,
@@ -72,7 +71,6 @@ export class MultiProjectFSAdapter {
             return;
         store.projectSlug = projectSlug;
         store.token = token;
-        store.tokenTrust = undefined;
     }
     setProductionMode(_enabled, _releaseId) {
         // No-op: In proxy mode, productionMode/releaseId are passed via runWithContext().

package/esm/src/platform/adapters/fs/veryfront/request-context.d.ts

@@ -1,11 +1,8 @@
 import { AsyncLocalStorage } from "node:async_hooks";
-export type RequestTokenTrust = "verified-control-plane";
 export interface RequestContext {
     projectSlug: string;
     projectId?: string;
     token: string;
-    /** Trust marker set only after the control-plane request signature is verified. */
-    tokenTrust?: RequestTokenTrust;
     productionMode: boolean;
     /** Release ID for production mode (mutually exclusive with branch) */
     releaseId?: string | null;
@@ -43,7 +40,6 @@ export declare function clearRequestScopedFileCache(): number;
 export declare function runWithRequestContext<T>(options: {
     projectSlug: string;
     token: string;
-    tokenTrust?: RequestTokenTrust;
     projectId?: string;
     productionMode?: boolean;
     releaseId?: string | null;

package/esm/src/platform/adapters/fs/veryfront/request-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../../../../../src/src/platform/adapters/fs/veryfront/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEzD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,cAAc,EAAE,OAAO,CAAC;IACxB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;OAIG;IACH,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,eAAO,MAAM,iBAAiB,mCAA0C,CAAC;AAEzE,wBAAgB,wBAAwB,IAAI,cAAc,GAAG,IAAI,CAEhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAOxF;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEzE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAE5E;AAED,wBAAgB,2BAA2B,IAAI,MAAM,CAKpD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,EACD,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAcZ;AAED;;;;GAIG;AACH,UAAU,2BAA2B;IACnC,wBAAwB,EAAE,MAAM,cAAc,GAAG,IAAI,CAAC;IACtD,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC/D,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAClE,2BAA2B,EAAE,MAAM,MAAM,CAAC;CAC3C;AAED,OAAO,CAAC,MAAM,CAAC;IACb,IAAI,0BAA0B,EAAE,2BAA2B,GAAG,SAAS,CAAC;CACzE"}
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../../../../../src/src/platform/adapters/fs/veryfront/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,OAAO,CAAC;IACxB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;OAIG;IACH,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,eAAO,MAAM,iBAAiB,mCAA0C,CAAC;AAEzE,wBAAgB,wBAAwB,IAAI,cAAc,GAAG,IAAI,CAEhE;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAOxF;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEzE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAE5E;AAED,wBAAgB,2BAA2B,IAAI,MAAM,CAKpD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,EACD,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAaZ;AAED;;;;GAIG;AACH,UAAU,2BAA2B;IACnC,wBAAwB,EAAE,MAAM,cAAc,GAAG,IAAI,CAAC;IACtD,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC/D,oBAAoB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAClE,2BAA2B,EAAE,MAAM,MAAM,CAAC;CAC3C;AAED,OAAO,CAAC,MAAM,CAAC;IACb,IAAI,0BAA0B,EAAE,2BAA2B,GAAG,SAAS,CAAC;CACzE"}

package/esm/src/platform/adapters/fs/veryfront/request-context.js

@@ -43,7 +43,6 @@ export function runWithRequestContext(options, fn) {
         projectSlug: options.projectSlug,
         projectId: options.projectId,
         token: options.token,
-        tokenTrust: options.tokenTrust,
         productionMode,
         releaseId: options.releaseId ?? null,
         branch: productionMode ? null : (options.branch ?? null),

package/esm/src/security/http/base-handler.d.ts

@@ -1,6 +1,6 @@
 import type { Handler, HandlerContext, HandlerMetadata, HandlerResult } from "../../types/index.js";
+import type { VerifiedControlPlaneRequestClaims } from "../../internal-agents/control-plane-auth.js";
 import type { WebSocketUpgradeResponse } from "../../platform/adapters/base.js";
-import type { RequestTokenTrust } from "../../platform/adapters/fs/veryfront/request-context.js";
 import { ResponseBuilder } from "./response/index.js";
 export interface HandlerHelpers {
     createResponseBuilder: (ctx: HandlerContext, nonce?: string) => ResponseBuilder;
@@ -24,7 +24,7 @@ export declare abstract class BaseHandler implements Handler {
     protected respond(response: Response | WebSocketUpgradeResponse, metadata?: Record<string, unknown>): HandlerResult;
     protected withProxyContext<T>(ctx: HandlerContext, fn: () => Promise<T>, options?: {
         requireToken?: boolean;
-        tokenTrust?: RequestTokenTrust;
+        verifiedControlPlaneClaims?: VerifiedControlPlaneRequestClaims;
     }): Promise<T>;
 }
 //# sourceMappingURL=base-handler.d.ts.map

package/esm/src/security/http/base-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-handler.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/base-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,eAAe,EACf,aAAa,EAEd,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yDAAyD,CAAC;AAEjG,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,qBAAqB,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,eAAe,CAAC;IAChF,OAAO,EAAE,CACP,QAAQ,EAAE,QAAQ,GAAG,wBAAwB,EAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,aAAa,CAAC;IACnB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,IAAI,CAAC;IAC3F,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5C,QAAQ,EAAE,MAAM,aAAa,CAAC;CAC/B;AAED,8BAAsB,WAAY,YAAW,OAAO;IAClD,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAMxC;IAEF,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAE1E,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO;IAYlE,OAAO,CAAC,cAAc;IAmBtB,SAAS,CAAC,qBAAqB,CAC7B,GAAG,EAAE,cAAc,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,eAAe;IAWlB,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,IAAI;IAKhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI;IAIhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI;IAIhG,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAKjD,SAAS,CAAC,QAAQ,IAAI,aAAa;IAInC,SAAS,CAAC,OAAO,CACf,QAAQ,EAAE,QAAQ,GAAG,wBAAwB,EAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,aAAa;IAIhB,SAAS,CAAC,gBAAgB,CAAC,CAAC,EAC1B,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,iBAAiB,CAAA;KAAO,GACvE,OAAO,CAAC,CAAC,CAAC;CAqFd"}
+{"version":3,"file":"base-handler.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/base-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,eAAe,EACf,aAAa,EAEd,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAErG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,qBAAqB,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,eAAe,CAAC;IAChF,OAAO,EAAE,CACP,QAAQ,EAAE,QAAQ,GAAG,wBAAwB,EAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,aAAa,CAAC;IACnB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,IAAI,CAAC;IAC3F,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5C,QAAQ,EAAE,MAAM,aAAa,CAAC;CAC/B;AAED,8BAAsB,WAAY,YAAW,OAAO;IAClD,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAMxC;IAEF,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAE1E,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO;IAYlE,OAAO,CAAC,cAAc;IAmBtB,SAAS,CAAC,qBAAqB,CAC7B,GAAG,EAAE,cAAc,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,eAAe;IAWlB,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,IAAI;IAKhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI;IAIhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI;IAIhG,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAKjD,SAAS,CAAC,QAAQ,IAAI,aAAa;IAInC,SAAS,CAAC,OAAO,CACf,QAAQ,EAAE,QAAQ,GAAG,wBAAwB,EAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,aAAa;IAIhB,SAAS,CAAC,gBAAgB,CAAC,CAAC,EAC1B,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,GAAE;QACP,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,0BAA0B,CAAC,EAAE,iCAAiC,CAAC;KAC3D,GACL,OAAO,CAAC,CAAC,CAAC;CA6Fd"}

package/esm/src/security/http/base-handler.js

@@ -1,4 +1,5 @@
 import { runWithCacheBatching } from "../../cache/request-cache-batcher.js";
+import { runWithVerifiedCacheApiCredential } from "../../cache/verified-api-credential-context.js";
 import { getHostEnv } from "../../platform/compat/process.js";
 import { serverLogger } from "../../utils/index.js";
 import { ResponseBuilder } from "./response/index.js";
@@ -67,6 +68,11 @@ export class BaseHandler {
         return { response: response, continue: false, metadata };
     }
     withProxyContext(ctx, fn, options = {}) {
+        if (options.verifiedControlPlaneClaims) {
+            return runWithVerifiedCacheApiCredential(options.verifiedControlPlaneClaims, () => this.withProxyContext(ctx, fn, {
+                requireToken: options.requireToken,
+            }));
+        }
         // Framework-owned token: bypass project env overlay so proxy mode works
         // when a remote project overlay is active.
         const effectiveToken = ctx.proxyToken || getHostEnv("VERYFRONT_API_TOKEN") || "";
@@ -106,7 +112,6 @@ export class BaseHandler {
                 releaseId: ctx.releaseId,
                 branch,
                 environmentName: ctx.environmentName,
-                tokenTrust: options.tokenTrust,
             });
         }
         if (typeof fsWrapper.setRequestToken === "function" && effectiveToken) {

package/esm/src/server/handlers/request/agent-stream.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-stream.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/request/agent-stream.handler.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAEpF,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,wCAAwC,CAAC;AAQhD,OAAO,EACL,4BAA4B,EAE7B,MAAM,2CAA2C,CAAC;AAyBnD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAcnG,MAAM,WAAW,sBACf,SAAQ,yBAAyB,EAAE,+BAA+B;IAClE,4BAA4B,CAAC,EAAE,OAAO,4BAA4B,CAAC;IACnE,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,+BAA+B,CAAC,YAAY,CAAC,CAAC;CACpF;AA6gBD,qBAAa,kBAAmB,SAAQ,WAAW;IASrC,OAAO,CAAC,QAAQ,CAAC,IAAI;IARjC,QAAQ,EAAE,eAAe,CAMvB;gBAE2B,IAAI,GAAE,sBAAoC;IAIvE,OAAO,CAAC,sBAAsB;IAwBxB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CAqMxE"}
+{"version":3,"file":"agent-stream.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/request/agent-stream.handler.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAEpF,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,wCAAwC,CAAC;AAQhD,OAAO,EACL,4BAA4B,EAE7B,MAAM,2CAA2C,CAAC;AAyBnD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAcnG,MAAM,WAAW,sBACf,SAAQ,yBAAyB,EAAE,+BAA+B;IAClE,4BAA4B,CAAC,EAAE,OAAO,4BAA4B,CAAC;IACnE,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,+BAA+B,CAAC,YAAY,CAAC,CAAC;CACpF;AAwgBD,qBAAa,kBAAmB,SAAQ,WAAW;IASrC,OAAO,CAAC,QAAQ,CAAC,IAAI;IARjC,QAAQ,EAAE,eAAe,CAMvB;gBAE2B,IAAI,GAAE,sBAAoC;IAIvE,OAAO,CAAC,sBAAsB;IAwBxB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CAqMxE"}

package/esm/src/server/handlers/request/agent-stream.handler.js

@@ -339,20 +339,17 @@ function buildAgentSourceRunOptions(sourceContext) {
             return {
                 productionMode: false,
                 branch: sourceContext.branch,
-                tokenTrust: "verified-control-plane",
             };
         case "environment":
             return {
                 productionMode: true,
                 environmentName: sourceContext.environmentName,
                 releaseId: sourceContext.releaseId ?? null,
-                tokenTrust: "verified-control-plane",
             };
         case "release":
             return {
                 productionMode: true,
                 releaseId: sourceContext.releaseId,
-                tokenTrust: "verified-control-plane",
             };
     }
 }
@@ -436,7 +433,7 @@ export class AgentStreamHandler extends BaseHandler {
             if (!pathRunId || pathRunId !== payload.runId) {
                 return this.respond(builder.json({ error: "CONTROL_PLANE_RUN_ID_MISMATCH" }, 400));
             }
-            await verifyControlPlaneRequest(req, ctx, rawBody, {
+            const verifiedClaims = await verifyControlPlaneRequest(req, ctx, rawBody, {
                 expectedSubject: payload.runId,
                 expectedSurface: "studio",
             });
@@ -541,7 +538,7 @@ export class AgentStreamHandler extends BaseHandler {
                     ? setResponseHeader(response, RUNTIME_OWNER_INVOKE_URL_HEADER, runtimeOwnerInvokeUrl)
                     : response;
                 return this.respond(applyBuilderHeaders(responseWithOwner, builder.headers));
-            }), { tokenTrust: "verified-control-plane" });
+            }), { verifiedControlPlaneClaims: verifiedClaims });
         }
         catch (error) {
             if (error instanceof InternalAgentRequestBodyTooLargeError) {

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.1049";
+export declare const VERSION = "0.1.1050";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.1049";
+export const VERSION = "0.1.1050";

package/esm/src/workflow/schemas/workflow.schema.d.ts

@@ -82,7 +82,7 @@ export declare const getCheckpointSchema: () => import("../../internal-agents/sc
 /**
  * Approval status schema
  */
-export declare const getApprovalStatusSchema: () => import("../../internal-agents/schema.js").Schema<"rejected" | "pending" | "approved" | "expired">;
+export declare const getApprovalStatusSchema: () => import("../../internal-agents/schema.js").Schema<"pending" | "rejected" | "approved" | "expired">;
 /**
  * Pending approval schema
  */
@@ -94,7 +94,7 @@ export declare const getPendingApprovalSchema: () => import("../../internal-agen
     approvers: import("../../internal-agents/schema.js").Schema<string[] | undefined>;
     requestedAt: import("../../internal-agents/schema.js").Schema<Date>;
     expiresAt: import("../../internal-agents/schema.js").Schema<Date | undefined>;
-    status: import("../../internal-agents/schema.js").Schema<"rejected" | "pending" | "approved" | "expired">;
+    status: import("../../internal-agents/schema.js").Schema<"pending" | "rejected" | "approved" | "expired">;
     decidedBy: import("../../internal-agents/schema.js").Schema<string | undefined>;
     decidedAt: import("../../internal-agents/schema.js").Schema<Date | undefined>;
     comment: import("../../internal-agents/schema.js").Schema<string | undefined>;
@@ -193,7 +193,7 @@ export declare const CheckpointSchema: import("../../internal-agents/schema.js")
         completedAt: import("../../internal-agents/schema.js").Schema<Date | undefined>;
     }>>>;
 }>>;
-export declare const ApprovalStatusSchema: import("../../internal-agents/schema.js").Schema<"rejected" | "pending" | "approved" | "expired">;
+export declare const ApprovalStatusSchema: import("../../internal-agents/schema.js").Schema<"pending" | "rejected" | "approved" | "expired">;
 export declare const PendingApprovalSchema: import("../../internal-agents/schema.js").Schema<import("../../extensions/schema/schema-validator.js").InferShape<{
     id: import("../../internal-agents/schema.js").Schema<string>;
     nodeId: import("../../internal-agents/schema.js").Schema<string>;
@@ -202,7 +202,7 @@ export declare const PendingApprovalSchema: import("../../internal-agents/schema
     approvers: import("../../internal-agents/schema.js").Schema<string[] | undefined>;
     requestedAt: import("../../internal-agents/schema.js").Schema<Date>;
     expiresAt: import("../../internal-agents/schema.js").Schema<Date | undefined>;
-    status: import("../../internal-agents/schema.js").Schema<"rejected" | "pending" | "approved" | "expired">;
+    status: import("../../internal-agents/schema.js").Schema<"pending" | "rejected" | "approved" | "expired">;
     decidedBy: import("../../internal-agents/schema.js").Schema<string | undefined>;
     decidedAt: import("../../internal-agents/schema.js").Schema<Date | undefined>;
     comment: import("../../internal-agents/schema.js").Schema<string | undefined>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.1049",
+  "version": "0.1.1050",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",
@@ -329,9 +329,10 @@
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
     "ws": "8.21.0",
-    "@veryfront/ext-bundler-esbuild": "0.1.1049",
-    "@veryfront/ext-content-mdx": "0.1.1049",
-    "@veryfront/ext-css-tailwind": "0.1.1049"
+    "@veryfront/ext-bundler-esbuild": "0.1.1050",
+    "@veryfront/ext-content-mdx": "0.1.1050",
+    "@veryfront/ext-css-tailwind": "0.1.1050",
+    "@veryfront/ext-parser-babel": "0.1.1050"
   },
   "devDependencies": {
     "@types/node": "20.9.0"