veryfront 0.1.1186 → 0.1.1190

package/esm/src/server/handlers/response/cors.js

@@ -3,6 +3,18 @@ import { ResponseBuilder } from "../../../security/index.js";
 import { getConfig } from "../../../config/index.js";
 import { PRIORITY_VERY_HIGH } from "../../../utils/constants/index.js";
 import { resolveAppRouteFile } from "../request/api/app-router-resolver.js";
+import { isSharedProjectRuntime } from "../../../security/project-locality.js";
+import { isInfrastructureOnlyRequestHeader } from "../../../security/http/application-request.js";
+const DEFAULT_ALLOWED_HEADERS = "Content-Type,Authorization";
+function getApplicationPreflightHeaders(request) {
+    const requested = request.headers.get("access-control-request-headers");
+    if (!requested)
+        return DEFAULT_ALLOWED_HEADERS;
+    const allowed = requested.split(",")
+        .map((name) => name.trim())
+        .filter((name) => name.length > 0 && !isInfrastructureOnlyRequestHeader(name));
+    return allowed.length > 0 ? allowed.join(",") : DEFAULT_ALLOWED_HEADERS;
+}
 export class CorsHandler extends BaseHandler {
     metadata = {
         name: "CorsHandler",
@@ -11,26 +23,35 @@ export class CorsHandler extends BaseHandler {
     };
     static DEFAULT_METHODS = "GET,POST,PUT,PATCH,DELETE,OPTIONS";
     static HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+    resolveAppRouteFile;
+    constructor(dependencies = {}) {
+        super();
+        this.resolveAppRouteFile = dependencies.resolveAppRouteFile ?? resolveAppRouteFile;
+    }
     async handle(req, ctx) {
         if (req.method.toUpperCase() !== "OPTIONS")
             return this.continue();
         const pathname = new URL(req.url).pathname;
-        const allowMethods = await this.resolveAllowedMethods(pathname, ctx);
+        const isSharedRuntime = isSharedProjectRuntime(ctx);
+        const allowMethods = isSharedRuntime
+            ? CorsHandler.DEFAULT_METHODS
+            : await this.resolveAllowedMethods(pathname, ctx);
         let corsConfig = ctx.securityConfig?.cors;
-        try {
-            const cfg = await getConfig(ctx.projectDir, ctx.adapter);
-            corsConfig = cfg?.security?.cors ?? corsConfig;
-        }
-        catch (error) {
-            // Falling back to ctx.securityConfig?.cors (set at request time). If that is
-            // also absent, ResponseBuilder.preflight will use its own restrictive defaults.
-            // Verify the fallback is not more permissive than the config-file value intended.
-            this.logWarn("Failed to load CORS config — falling back to security-context defaults", { error }, ctx);
+        if (!isSharedRuntime) {
+            try {
+                const cfg = await getConfig(ctx.projectDir, ctx.adapter);
+                corsConfig = cfg?.security?.cors ?? corsConfig;
+            }
+            catch (error) {
+                // Falling back to ctx.securityConfig?.cors (set at request time). If that is
+                // also absent, ResponseBuilder.preflight will use its own restrictive defaults.
+                // Verify the fallback is not more permissive than the config-file value intended.
+                this.logWarn("Failed to load CORS config — falling back to security-context defaults", { error });
+            }
         }
         const response = ResponseBuilder.preflight(req, {
             allowMethods,
-            allowHeaders: req.headers.get("access-control-request-headers") ??
-                "Content-Type,Authorization",
+            allowHeaders: getApplicationPreflightHeaders(req),
             securityConfig: ctx.securityConfig ?? undefined,
             corsConfig,
         });
@@ -38,7 +59,7 @@ export class CorsHandler extends BaseHandler {
     }
     async resolveAllowedMethods(pathname, ctx) {
         try {
-            const match = await resolveAppRouteFile(pathname, ctx);
+            const match = await this.resolveAppRouteFile(pathname, ctx);
             if (!match)
                 return CorsHandler.DEFAULT_METHODS;
             const mod = (await import(`file://${match.file}`));
@@ -50,7 +71,7 @@ export class CorsHandler extends BaseHandler {
             return [...new Set(methods)].join(", ");
         }
         catch (error) {
-            this.logWarn("Failed to resolve route for CORS", { error, pathname }, ctx);
+            this.logWarn("Failed to resolve route for CORS", { error, pathname });
             return CorsHandler.DEFAULT_METHODS;
         }
     }

package/esm/src/server/handlers/utils/dependency-snapshot-protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-snapshot-protocol.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/utils/dependency-snapshot-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EAElC,MAAM,6CAA6C,CAAC;AAErD,wEAAwE;AACxE,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AAEpE,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,SAAS,CAAC;AAElD;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AASpE,6EAA6E;AAC7E,MAAM,MAAM,eAAe;AACzB,sEAAsE;AACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE;AAC7B,iEAAiE;GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AACnD,0EAA0E;GACxE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAElC,6EAA6E;AAC7E,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAA;CAAE,GACxE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAElC,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;CACjD;AAUD,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,eAAe,CAGpE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,eAAe,CAM3D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAI7D;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAIhD;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,OAAO,EAChB,gBAAgB,CAAC,EAAE,MAAM,GACxB,IAAI,CAYN;AAED,4EAA4E;AAC5E,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,OAAO,EACZ,cAAc,EAAE,cAAc,CAAC,gBAAgB,CAAC,GAC/C,QAAQ,CAOV;AAED,yDAAyD;AACzD,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,QAAQ,EAClB,gBAAgB,CAAC,EAAE,MAAM,GACxB,QAAQ,CAQV;AAED,8EAA8E;AAC9E,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,4BAA4B,EACpC,SAAS,EAAE,eAAe,EAC1B,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,kBAAkB,CAAC,CAkB7B"}
+{"version":3,"file":"dependency-snapshot-protocol.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/utils/dependency-snapshot-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EAElC,MAAM,6CAA6C,CAAC;AAErD,wEAAwE;AACxE,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AAEpE,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,SAAS,CAAC;AAElD;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AASpE,6EAA6E;AAC7E,MAAM,MAAM,eAAe;AACzB,sEAAsE;AACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE;AAC7B,iEAAiE;GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AACnD,0EAA0E;GACxE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAElC,6EAA6E;AAC7E,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAA;CAAE,GACxE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAElC,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;CACjD;AAUD,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,eAAe,CAGpE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,eAAe,CAM3D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAI7D;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAIhD;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,OAAO,EAChB,gBAAgB,CAAC,EAAE,MAAM,GACxB,IAAI,CAYN;AAED,4EAA4E;AAC5E,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,OAAO,EACZ,cAAc,EAAE,cAAc,CAAC,gBAAgB,CAAC,GAC/C,QAAQ,CAQV;AAED,yDAAyD;AACzD,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,QAAQ,EAClB,gBAAgB,CAAC,EAAE,MAAM,GACxB,QAAQ,CAQV;AAED,8EAA8E;AAC9E,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,4BAA4B,EACpC,SAAS,EAAE,eAAe,EAC1B,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,kBAAkB,CAAC,CAkB7B"}

package/esm/src/server/handlers/utils/dependency-snapshot-protocol.js

@@ -85,6 +85,8 @@ export function snapshotConflictResponse(builder, req, securityConfig) {
         .withSecurity(securityConfig ?? undefined, req)
         .withCache("no-store");
     applySnapshotResponseHeaders(prepared.headers);
+    if (req.method === "HEAD")
+        return prepared.build(null, 409);
     return prepared.text(SNAPSHOT_CONFLICT_BODY, 409);
 }
 /** Copy a response with the snapshot headers applied. */

package/esm/src/server/node-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-handler.d.ts","sourceRoot":"","sources":["../../../src/src/server/node-handler.ts"],"names":[],"mappings":"AAEA,sEAAsE;AACtE,wBAAgB,aAAa,CAC3B,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,GACtD,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,WAAW,EAAE,cAAc,KAAK,IAAI,CA0E7F"}
+{"version":3,"file":"node-handler.d.ts","sourceRoot":"","sources":["../../../src/src/server/node-handler.ts"],"names":[],"mappings":"AAEA,sEAAsE;AACtE,wBAAgB,aAAa,CAC3B,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,GACtD,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,WAAW,EAAE,cAAc,KAAK,IAAI,CAyE7F"}

package/esm/src/server/node-handler.js

@@ -27,10 +27,9 @@ export function toNodeHandler(handler) {
                 return;
             const outHeaders = {};
             const setCookies = [];
-            // Headers.prototype.getSetCookie landed in Node ~18.14, but our published
-            // engines.node is ">=18.0.0". On early 18.x it is undefined, so calling it
-            // unconditionally throws for every response and turns valid requests into
-            // 500s. Feature-detect it and fall back to the header iterator.
+            // Node provides getSetCookie, while compatible Web Headers adapters may
+            // omit it. Feature-detect the method so an adapter mismatch cannot turn
+            // every otherwise valid response into a 500.
             const getSetCookie = response.headers.getSetCookie;
             if (typeof getSetCookie === "function") {
                 // Modern path: getSetCookie returns each Set-Cookie as a distinct value.
@@ -42,7 +41,7 @@ export function toNodeHandler(handler) {
                 }
             }
             else {
-                // Fallback for runtimes without getSetCookie. The undici-based Headers
+                // Compatibility path for adapters without getSetCookie. The undici-based Headers
                 // iterator yields each Set-Cookie as its own entry (it is the one header
                 // that is NOT comma-joined during iteration), so iterating preserves
                 // multiples where the platform allows it. If a runtime does collapse

package/esm/src/server/production-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"production-server.d.ts","sourceRoot":"","sources":["../../../src/src/server/production-server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AA4BrE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AA6EtE,sEAAsE;AACtE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,UAAU,aAAa;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC;IAC9C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,oFAAoF;IACpF,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,mDAAmD;AACnD,MAAM,WAAW,4BAA6B,SAAQ,aAAa;IACjE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,gCAAgC;AAChC,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,YAAY,CAAC,CAuKvB"}
+{"version":3,"file":"production-server.d.ts","sourceRoot":"","sources":["../../../src/src/server/production-server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AA4BrE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AA8EtE,sEAAsE;AACtE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,UAAU,aAAa;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC;IAC9C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,oFAAoF;IACpF,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,mDAAmD;AACnD,MAAM,WAAW,4BAA6B,SAAQ,aAAa;IACjE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,gCAAgC;AAChC,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,YAAY,CAAC,CA0KvB"}

package/esm/src/server/production-server.js

@@ -16,6 +16,7 @@ import { setServerInitialized } from "./handlers/monitoring/health.handler.js";
 import { gracefullyShutdownProductionServer, parseShutdownDrainTimeoutMs, } from "./graceful-shutdown.js";
 import { enableSSRClientOnlyFetching, enableSSRFetchInterception, setSSRServerPort, } from "../rendering/ssr-globals.js";
 import { snapshotNodeWebSocketServerProvider } from "../extensions/websocket/index.js";
+import { isSharedProjectRuntime } from "../security/project-locality.js";
 const serverLog = logger.component("server");
 const globalLog = logger.component("global");
 /** Default port when PORT / VERYFRONT_PORT env vars are not set */
@@ -131,6 +132,7 @@ export function startProductionServer(options) {
                             baseDir: discoveryConfig.baseDir,
                             fsAdapter: discoveryConfig.fsAdapter,
                             verbose: discoveryConfig.verbose ?? false,
+                            allowHostProjectCodeExecution: true,
                         });
                     }
                 }
@@ -150,6 +152,8 @@ export function startProductionServer(options) {
                 defaultReleaseId,
                 defaultEnvironment,
                 localProjects,
+                allowHostProjectCodeExecution: bootstrap.config.fs?.veryfront?.proxyMode !== true &&
+                    !isSharedProjectRuntime({ adapter }),
             });
             const coreHandler = baseHandler;
             // Wrap handler with interceptor if provided (for combined mode)

package/esm/src/server/project-env/snapshot.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Bounded, immutable project-environment snapshots.
+ *
+ * Environment values cross an authenticated API boundary before they are
+ * exposed to config evaluation and isolated project workers. Keep the shape
+ * deliberately narrower than a generic JavaScript record: enumerable string
+ * data properties only, with no inherited state or accessors.
+ *
+ * @module server/project-env/snapshot
+ */
+import { type ProjectEnvSnapshot } from "../../platform/compat/process/project-env-contract.js";
+export { PROJECT_ENV_SNAPSHOT_LIMITS, type ProjectEnvSnapshot, } from "../../platform/compat/process/project-env-contract.js";
+/** Stable rejection reasons for project-environment boundary failures. */
+export type ProjectEnvSnapshotErrorCode = "accessor-property" | "duplicate-key" | "inspection-failed" | "invalid-key" | "invalid-prototype" | "invalid-value" | "max-entries-exceeded" | "max-key-length-exceeded" | "max-total-bytes-exceeded" | "max-value-length-exceeded" | "non-enumerable-property" | "symbol-key";
+/** Error raised when an environment value is unsafe or exceeds its budget. */
+export declare class ProjectEnvSnapshotError extends TypeError {
+    readonly code: ProjectEnvSnapshotErrorCode;
+    constructor(code: ProjectEnvSnapshotErrorCode, reason: string);
+}
+/**
+ * Copy a project environment into a sorted, frozen, null-prototype record.
+ *
+ * Property descriptors are inspected without reading property values through
+ * ordinary access, so getters are rejected without invocation.
+ */
+export declare function createProjectEnvSnapshot(value: unknown): ProjectEnvSnapshot;
+//# sourceMappingURL=snapshot.d.ts.map

package/esm/src/server/project-env/snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../../../src/src/server/project-env/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uDAAuD,CAAC;AAE/D,OAAO,EACL,2BAA2B,EAC3B,KAAK,kBAAkB,GACxB,MAAM,uDAAuD,CAAC;AA4B/D,0EAA0E;AAC1E,MAAM,MAAM,2BAA2B,GACnC,mBAAmB,GACnB,eAAe,GACf,mBAAmB,GACnB,aAAa,GACb,mBAAmB,GACnB,eAAe,GACf,sBAAsB,GACtB,yBAAyB,GACzB,0BAA0B,GAC1B,2BAA2B,GAC3B,yBAAyB,GACzB,YAAY,CAAC;AAEjB,8EAA8E;AAC9E,qBAAa,uBAAwB,SAAQ,SAAS;IACpD,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;gBAE/B,IAAI,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM;CAK9D;AA8GD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,GACb,kBAAkB,CAgFpB"}

package/esm/src/server/project-env/snapshot.js

@@ -0,0 +1,205 @@
+/**
+ * Bounded, immutable project-environment snapshots.
+ *
+ * Environment values cross an authenticated API boundary before they are
+ * exposed to config evaluation and isolated project workers. Keep the shape
+ * deliberately narrower than a generic JavaScript record: enumerable string
+ * data properties only, with no inherited state or accessors.
+ *
+ * @module server/project-env/snapshot
+ */
+import { PROJECT_ENV_SNAPSHOT_LIMITS, } from "../../platform/compat/process/project-env-contract.js";
+export { PROJECT_ENV_SNAPSHOT_LIMITS, } from "../../platform/compat/process/project-env-contract.js";
+const IntrinsicArray = Array;
+const ArrayIsArray = Array.isArray;
+const ArrayPrototypeSort = Array.prototype.sort;
+const ObjectCreate = Object.create;
+const ObjectDefineProperty = Object.defineProperty;
+const ObjectFreeze = Object.freeze;
+const ObjectGetOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
+const ObjectGetPrototypeOf = Object.getPrototypeOf;
+const ObjectPrototype = Object.prototype;
+const ObjectPrototypeHasOwnProperty = Object.prototype.hasOwnProperty;
+const NumberIsSafeInteger = Number.isSafeInteger;
+const ReflectApply = Reflect.apply;
+const ReflectOwnKeys = Reflect.ownKeys;
+const StringPrototypeCharCodeAt = String.prototype.charCodeAt;
+const TextEncoderPrototypeEncode = TextEncoder.prototype.encode;
+const intrinsicTextEncoder = new TextEncoder();
+const typedArrayPrototype = ObjectGetPrototypeOf(Uint8Array.prototype);
+const maybeTypedArrayByteLengthGetter = typedArrayPrototype
+    ? ObjectGetOwnPropertyDescriptor(typedArrayPrototype, "byteLength")?.get
+    : undefined;
+if (!maybeTypedArrayByteLengthGetter) {
+    throw new TypeError("Typed-array byte-length intrinsic is unavailable");
+}
+const typedArrayByteLengthGetter = maybeTypedArrayByteLengthGetter;
+/** Error raised when an environment value is unsafe or exceeds its budget. */
+export class ProjectEnvSnapshotError extends TypeError {
+    code;
+    constructor(code, reason) {
+        super(`Invalid project environment snapshot: ${reason}`);
+        this.name = "ProjectEnvSnapshotError";
+        this.code = code;
+    }
+}
+function reject(code, reason) {
+    throw new ProjectEnvSnapshotError(code, reason);
+}
+function inspectPrototype(value) {
+    try {
+        return ObjectGetPrototypeOf(value);
+    }
+    catch {
+        return reject("inspection-failed", "prototype inspection failed");
+    }
+}
+function inspectIsArray(value) {
+    try {
+        return ArrayIsArray(value);
+    }
+    catch {
+        return reject("inspection-failed", "array inspection failed");
+    }
+}
+function inspectKeys(value) {
+    try {
+        return ReflectOwnKeys(value);
+    }
+    catch {
+        return reject("inspection-failed", "property-key inspection failed");
+    }
+}
+function inspectDescriptor(value, key) {
+    try {
+        const descriptor = ObjectGetOwnPropertyDescriptor(value, key);
+        if (descriptor)
+            return descriptor;
+    }
+    catch {
+        // Fall through to the stable boundary error below.
+    }
+    return reject("inspection-failed", "property descriptor inspection failed");
+}
+function compareStrings(left, right) {
+    const leftIndex = toArrayIndex(left);
+    const rightIndex = toArrayIndex(right);
+    if (leftIndex !== null && rightIndex !== null)
+        return leftIndex - rightIndex;
+    if (leftIndex !== null)
+        return -1;
+    if (rightIndex !== null)
+        return 1;
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function toArrayIndex(key) {
+    if (key === "")
+        return null;
+    const value = +key;
+    return NumberIsSafeInteger(value) &&
+        value >= 0 &&
+        value <= 4_294_967_294 &&
+        `${value}` === key
+        ? value
+        : null;
+}
+function isValidEnvironmentKey(key) {
+    if (key.length === 0)
+        return false;
+    for (let index = 0; index < key.length; index += 1) {
+        const code = ReflectApply(StringPrototypeCharCodeAt, key, [index]);
+        if (code === 0 || code === 61)
+            return false;
+    }
+    return true;
+}
+function isValidEnvironmentValue(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        if (ReflectApply(StringPrototypeCharCodeAt, value, [index]) === 0) {
+            return false;
+        }
+    }
+    return true;
+}
+function utf8Length(value) {
+    const encoded = ReflectApply(TextEncoderPrototypeEncode, intrinsicTextEncoder, [value]);
+    return ReflectApply(typedArrayByteLengthGetter, encoded, []);
+}
+function hasDescriptorValue(descriptor) {
+    return ReflectApply(ObjectPrototypeHasOwnProperty, descriptor, ["value"]);
+}
+function defineDataProperty(target, key, value, writable = false, configurable = false) {
+    const descriptor = ObjectCreate(null);
+    descriptor.value = value;
+    descriptor.enumerable = true;
+    descriptor.configurable = configurable;
+    descriptor.writable = writable;
+    ObjectDefineProperty(target, key, descriptor);
+}
+/**
+ * Copy a project environment into a sorted, frozen, null-prototype record.
+ *
+ * Property descriptors are inspected without reading property values through
+ * ordinary access, so getters are rejected without invocation.
+ */
+export function createProjectEnvSnapshot(value) {
+    if (typeof value !== "object" || value === null || inspectIsArray(value)) {
+        return reject("invalid-prototype", "expected a plain data record");
+    }
+    const prototype = inspectPrototype(value);
+    if (prototype !== null && prototype !== ObjectPrototype) {
+        return reject("invalid-prototype", "expected a plain or null-prototype record");
+    }
+    const ownKeys = inspectKeys(value);
+    if (ownKeys.length > PROJECT_ENV_SNAPSHOT_LIMITS.maxEntries) {
+        return reject("max-entries-exceeded", `entry count exceeds ${PROJECT_ENV_SNAPSHOT_LIMITS.maxEntries}`);
+    }
+    const keys = new IntrinsicArray(ownKeys.length);
+    for (let index = 0; index < ownKeys.length; index += 1) {
+        const key = ownKeys[index];
+        if (typeof key !== "string") {
+            return reject("symbol-key", "symbol properties are not allowed");
+        }
+        if (key.length > PROJECT_ENV_SNAPSHOT_LIMITS.maxKeyChars) {
+            return reject("max-key-length-exceeded", `key length exceeds ${PROJECT_ENV_SNAPSHOT_LIMITS.maxKeyChars}`);
+        }
+        if (!isValidEnvironmentKey(key)) {
+            return reject("invalid-key", "keys must be non-empty and cannot contain NUL or '='");
+        }
+        defineDataProperty(keys, index, key, true, true);
+    }
+    ReflectApply(ArrayPrototypeSort, keys, [compareStrings]);
+    const output = ObjectCreate(null);
+    let totalBytes = 0;
+    let previousKey;
+    for (let index = 0; index < keys.length; index += 1) {
+        const key = keys[index];
+        if (key === previousKey) {
+            return reject("duplicate-key", "duplicate keys are not allowed");
+        }
+        previousKey = key;
+        const descriptor = inspectDescriptor(value, key);
+        if (!hasDescriptorValue(descriptor)) {
+            return reject("accessor-property", "accessor properties are not allowed");
+        }
+        if (!descriptor.enumerable) {
+            return reject("non-enumerable-property", "non-enumerable properties are not allowed");
+        }
+        const descriptorValue = descriptor.value;
+        if (typeof descriptorValue !== "string") {
+            return reject("invalid-value", "values must be strings without NUL characters");
+        }
+        if (descriptorValue.length > PROJECT_ENV_SNAPSHOT_LIMITS.maxValueChars) {
+            return reject("max-value-length-exceeded", `value length exceeds ${PROJECT_ENV_SNAPSHOT_LIMITS.maxValueChars}`);
+        }
+        if (!isValidEnvironmentValue(descriptorValue)) {
+            return reject("invalid-value", "values must be strings without NUL characters");
+        }
+        totalBytes += utf8Length(key) + utf8Length(descriptorValue);
+        if (totalBytes > PROJECT_ENV_SNAPSHOT_LIMITS.maxUtf8Bytes) {
+            return reject("max-total-bytes-exceeded", `UTF-8 size exceeds ${PROJECT_ENV_SNAPSHOT_LIMITS.maxUtf8Bytes} bytes`);
+        }
+        defineDataProperty(output, key, descriptorValue);
+    }
+    return ObjectFreeze(output);
+}

package/esm/src/server/project-env/storage.d.ts

@@ -1,8 +1,9 @@
+import { type ProjectEnvSnapshot } from "./snapshot.js";
 /**
  * Run a function with project-specific environment variables.
  * Within the callback, `getProjectEnv()` will return values from `vars`.
  */
-export declare function runWithProjectEnv<T>(vars: Record<string, string>, fn: () => T): T;
+export declare function runWithProjectEnv<T>(vars: Readonly<Record<string, string>>, fn: () => T): T;
 /**
  * Get a project-scoped environment variable from the current request context.
  * Returns undefined if no project env overlay is active or key is not present.
@@ -19,5 +20,5 @@ export declare function isProjectEnvActive(): boolean;
  * Returns undefined if no overlay is active.
  * Used to forward env vars to isolated workers in proxy mode.
  */
-export declare function getProjectEnvSnapshot(): Record<string, string> | undefined;
+export declare function getProjectEnvSnapshot(): ProjectEnvSnapshot | undefined;
 //# sourceMappingURL=storage.d.ts.map

package/esm/src/server/project-env/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../../src/src/server/project-env/storage.ts"],"names":[],"mappings":"AAeA;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAEjF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE7D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAE1E"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../../src/src/server/project-env/storage.ts"],"names":[],"mappings":"AAaA,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAIlF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACtC,EAAE,EAAE,MAAM,CAAC,GACV,CAAC,CAEH;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE7D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,kBAAkB,GAAG,SAAS,CAEtE"}

package/esm/src/server/project-env/storage.js

@@ -8,13 +8,15 @@
  */
 import * as dntShim from "../../../_dnt.shims.js";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { registerTrustedProjectEnvSnapshot } from "../../platform/compat/process/env.js";
+import { createProjectEnvSnapshot } from "./snapshot.js";
 const projectEnvStorage = new AsyncLocalStorage();
 /**
  * Run a function with project-specific environment variables.
  * Within the callback, `getProjectEnv()` will return values from `vars`.
  */
 export function runWithProjectEnv(vars, fn) {
-    return projectEnvStorage.run(vars, fn);
+    return projectEnvStorage.run(createProjectEnvSnapshot(vars), fn);
 }
 /**
  * Get a project-scoped environment variable from the current request context.
@@ -39,8 +41,11 @@ export function isProjectEnvActive() {
 export function getProjectEnvSnapshot() {
     return projectEnvStorage.getStore();
 }
-// Register on globalThis so lower-layer code can access without upward imports.
-// process.ts is low-level (platform/compat), project-env is high-level (server/).
+registerTrustedProjectEnvSnapshot(getProjectEnvSnapshot);
+// Preserve the legacy lookup bridges used by the compiled-binary runtime shim
+// and the snapshot bridge used by isolated route workers. Host process
+// compatibility code uses the trusted closure-registration bridge above and
+// never relies on mutable global state for project isolation.
 dntShim.dntGlobalThis.__vfProjectEnvGetter = getProjectEnv;
 dntShim.dntGlobalThis.__vfProjectEnvActiveChecker = isProjectEnvActive;
 dntShim.dntGlobalThis.__vfProjectEnvSnapshotGetter = getProjectEnvSnapshot;

package/esm/src/server/runtime-handler/adapter-factory.d.ts

@@ -7,6 +7,7 @@
  * @module server/runtime-handler/adapter-factory
  */
 import type { RuntimeAdapter } from "../../platform/adapters/base.js";
+import { type PreparedHostedConfigContext } from "../../config/loader.js";
 import type { VeryfrontConfig } from "../../config/index.js";
 import { type ProjectDiscoveryCache } from "./local-project-discovery.js";
 import type { ParsedDomain } from "../utils/domain-parser.js";
@@ -56,6 +57,11 @@ interface AdapterResolutionOptions {
     proxyTrusted?: boolean;
     /** Optional injectable cache (defaults to module-level singleton) */
     cache?: ProjectDiscoveryCache;
+    /**
+     * Authenticated source and environment snapshot for hosted config. Proxy
+     * config must never derive either value independently inside this factory.
+     */
+    prepareHostedConfigContext?: (isLocalProject: boolean) => Promise<PreparedHostedConfigContext>;
 }
 /**
  * Resolve the effective adapter and config for a request.

package/esm/src/server/runtime-handler/adapter-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter-factory.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/adapter-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAGtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAQ9D,UAAU,uBAAuB;IAC/B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,OAAO,EAAE,cAAc,CAAC;IACxB,kCAAkC;IAClC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,yDAAyD;IACzD,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,UAAU,wBAAwB;IAChC;;;OAGG;IACH,GAAG,EAAE,OAAO,CAAC;IACb,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,6BAA6B;IAC7B,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,mBAAmB;IACnB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,kBAAkB;IAClB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,uCAAuC;IACvC,QAAQ,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;IAC/C,kBAAkB;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,yCAAyC;IACzC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,yBAAyB;IACzB,YAAY,EAAE,YAAY,CAAC;IAC3B,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,sEAAsE;IACtE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qEAAqE;IACrE,KAAK,CAAC,EAAE,qBAAqB,CAAC;CAC/B;AASD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAiJlC"}
+{"version":3,"file":"adapter-factory.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/adapter-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAGL,KAAK,2BAA2B,EACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAQ9D,UAAU,uBAAuB;IAC/B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,OAAO,EAAE,cAAc,CAAC;IACxB,kCAAkC;IAClC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,yDAAyD;IACzD,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,UAAU,wBAAwB;IAChC;;;OAGG;IACH,GAAG,EAAE,OAAO,CAAC;IACb,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,6BAA6B;IAC7B,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,mBAAmB;IACnB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,kBAAkB;IAClB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,uCAAuC;IACvC,QAAQ,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;IAC/C,kBAAkB;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,yCAAyC;IACzC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,yBAAyB;IACzB,YAAY,EAAE,YAAY,CAAC;IAC3B,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,sEAAsE;IACtE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qEAAqE;IACrE,KAAK,CAAC,EAAE,qBAAqB,CAAC;IAC9B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,CAC3B,cAAc,EAAE,OAAO,KACpB,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAC3C;AAgCD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CA6JlC"}

package/esm/src/server/runtime-handler/adapter-factory.js

@@ -7,10 +7,10 @@
  * @module server/runtime-handler/adapter-factory
  */
 import { getBaseLogger } from "../../utils/index.js";
-import { getErrorMessage } from "../../errors/index.js";
+import { CACHE_INVARIANT_VIOLATION, getErrorMessage } from "../../errors/index.js";
 import { runtime } from "../../platform/adapters/detect.js";
 import { isExtendedFSAdapter } from "../../platform/adapters/fs/wrapper.js";
-import { getConfig } from "../../config/loader.js";
+import { getConfig, getHostedConfig, } from "../../config/loader.js";
 import { isConfigOptionalControlPlaneRunRequest } from "../../channels/control-plane.js";
 import { timeAsync } from "./request-lifecycle.js";
 import { defaultDiscoveryCache, findLocalProjectPath, } from "./local-project-discovery.js";
@@ -24,6 +24,25 @@ function usesExactSourceConfig(opts) {
         !!opts.proxyToken &&
         isConfigOptionalControlPlaneRunRequest(opts.req.method, opts.pathname);
 }
+function shouldDeferConfigLoad(opts) {
+    if (usesExactSourceConfig(opts))
+        return true;
+    // There is no immutable production source to evaluate until resolution has
+    // selected a release. Let environment resolution return its canonical 404.
+    return opts.isProxyMode && !!opts.projectSlug && opts.proxyEnv === "production" &&
+        !opts.releaseId;
+}
+async function prepareProxyConfigLoad(opts, isLocalProject) {
+    if (!opts.projectSlug || !opts.prepareHostedConfigContext) {
+        throw CACHE_INVARIANT_VIOLATION.create({
+            detail: "Proxy project config requires an authenticated declarative evaluation context",
+        });
+    }
+    return {
+        cacheKey: opts.projectId ?? opts.projectSlug,
+        ...await opts.prepareHostedConfigContext(isLocalProject),
+    };
+}
 /**
  * Resolve the effective adapter and config for a request.
  *
@@ -75,9 +94,16 @@ export async function resolveAdapter(opts) {
             });
         }
         effectiveAdapter = cache.adapters.get(effectiveProjectDir);
-        if (usesExactSourceConfig(opts)) {
+        if (shouldDeferConfigLoad(opts)) {
             effectiveConfig = undefined;
         }
+        else if (opts.isProxyMode) {
+            const hosted = await prepareProxyConfigLoad(opts, true);
+            effectiveConfig = await timeAsync("config:load-project", () => getHostedConfig(effectiveProjectDir, effectiveAdapter, {
+                ...hosted,
+                signal: opts.req.signal,
+            }));
+        }
         else {
             effectiveConfig = await timeAsync("config:load-project", () => getConfig(effectiveProjectDir, effectiveAdapter));
             logger.debug("Loaded project-specific config", {
@@ -89,7 +115,7 @@ export async function resolveAdapter(opts) {
         }
     }
     else if (opts.isProxyMode && opts.projectSlug && opts.proxyToken) {
-        if (usesExactSourceConfig(opts)) {
+        if (shouldDeferConfigLoad(opts)) {
             logger.debug("Skipping outer config load for exact-source control-plane request", {
                 projectSlug: opts.projectSlug,
                 projectId: opts.projectId,
@@ -107,21 +133,23 @@ export async function resolveAdapter(opts) {
         // Unlike local projects, proxy mode config loading failures are propagated
         // because proceeding without config causes silent 404s for valid projects.
         try {
-            effectiveConfig = await timeAsync("config:load-proxy-project", () => {
+            effectiveConfig = await timeAsync("config:load-proxy-project", async () => {
+                const hosted = await prepareProxyConfigLoad(opts, false);
                 const loadCurrentConfig = async () => {
                     // Config controls route and primitive discovery, so it must be read
                     // from the same current snapshot that those consumers will retain.
                     await effectiveAdapter.fs.ensureSourceSnapshotFresh?.("config-load");
-                    return await getConfig(effectiveProjectDir, effectiveAdapter, {
-                        cacheKey: opts.projectId ?? opts.projectSlug,
+                    return await getHostedConfig(effectiveProjectDir, effectiveAdapter, {
+                        ...hosted,
+                        signal: opts.req.signal,
                     });
                 };
                 if (isExtendedFSAdapter(effectiveAdapter.fs) && effectiveAdapter.fs.runWithContext) {
                     return effectiveAdapter.fs.runWithContext(opts.projectSlug, opts.proxyToken, loadCurrentConfig, opts.projectId, {
-                        productionMode: opts.proxyEnv === "production",
-                        releaseId: opts.releaseId,
-                        branch: opts.branch ?? opts.parsedDomain.branch ?? null,
-                        environmentName: opts.environmentName,
+                        productionMode: hosted.sourceContext.productionMode,
+                        releaseId: hosted.sourceContext.releaseId,
+                        branch: hosted.sourceContext.branch,
+                        environmentName: hosted.sourceContext.environmentName,
                     });
                 }
                 return loadCurrentConfig();

package/esm/src/server/runtime-handler/handler-context-builder.d.ts

@@ -47,12 +47,19 @@ export interface HandlerContextOptions {
     routeRegistry: RouteRegistry;
     /** Whether this is a local project */
     isLocalProject: boolean;
+    /** Narrow host-owned capability for project-code execution. */
+    allowHostProjectCodeExecution?: boolean;
     /** Module server URL */
     moduleServerUrl: string | undefined;
     /** Environment ID for env var resolution (from proxy x-environment-id header) */
     environmentId: string | undefined;
     /** Skip render-specific enriched context requirements for non-render control-plane routes */
     skipEnrichedContext?: boolean;
+    /**
+     * Prepares the authenticated hosted evaluation context for this request.
+     * Supplied only for shared multi-project runtimes.
+     */
+    prepareHostedConfigContext?: HandlerContext["prepareHostedConfigContext"];
 }
 /**
  * Build the HandlerContext for route handlers.

package/esm/src/server/runtime-handler/handler-context-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler-context-builder.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/handler-context-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,uEAAuE;AACvE,KAAK,aAAa,GAAG,MAAM,GAAG,IAAI,CAAC;AACnC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAIrE,MAAM,WAAW,qBAAqB;IACpC,wBAAwB;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB,sBAAsB;IACtB,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,sBAAsB;IACtB,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,iBAAiB;IACjB,KAAK,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,uBAAuB;IACvB,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,yBAAyB;IACzB,YAAY,EAAE,YAAY,CAAC;IAC3B,mBAAmB;IACnB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,iDAAiD;IACjD,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,uBAAuB;IACvB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,2BAA2B;IAC3B,mBAAmB,EAAE,SAAS,GAAG,YAAY,CAAC;IAC9C,kDAAkD;IAClD,cAAc,EAAE,OAAO,+BAA+B,EAAE,cAAc,CAAC;IACvE,qBAAqB;IACrB,aAAa,EAAE,aAAa,CAAC;IAC7B,sCAAsC;IACtC,cAAc,EAAE,OAAO,CAAC;IACxB,wBAAwB;IACxB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,iFAAiF;IACjF,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,6FAA6F;IAC7F,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,GAAG,cAAc,CAmD/E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,cAAc,EAAE,cAAc,GAAG,IAAI,EACrC,aAAa,EAAE,aAAa,GAAG,IAAI,EACnC,KAAK,EAAE,OAAO,GAAG,SAAS,EAC1B,MAAM,EAAE,eAAe,GAAG,SAAS,GAClC,cAAc,CAShB"}
+{"version":3,"file":"handler-context-builder.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/handler-context-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,uEAAuE;AACvE,KAAK,aAAa,GAAG,MAAM,GAAG,IAAI,CAAC;AACnC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAIrE,MAAM,WAAW,qBAAqB;IACpC,wBAAwB;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB,sBAAsB;IACtB,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,sBAAsB;IACtB,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,iBAAiB;IACjB,KAAK,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,uBAAuB;IACvB,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,yBAAyB;IACzB,YAAY,EAAE,YAAY,CAAC;IAC3B,mBAAmB;IACnB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,iDAAiD;IACjD,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,uBAAuB;IACvB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,2BAA2B;IAC3B,mBAAmB,EAAE,SAAS,GAAG,YAAY,CAAC;IAC9C,kDAAkD;IAClD,cAAc,EAAE,OAAO,+BAA+B,EAAE,cAAc,CAAC;IACvE,qBAAqB;IACrB,aAAa,EAAE,aAAa,CAAC;IAC7B,sCAAsC;IACtC,cAAc,EAAE,OAAO,CAAC;IACxB,+DAA+D;IAC/D,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,wBAAwB;IACxB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,iFAAiF;IACjF,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,6FAA6F;IAC7F,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,cAAc,CAAC,4BAA4B,CAAC,CAAC;CAC3E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,GAAG,cAAc,CAsD/E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,cAAc,EAAE,cAAc,GAAG,IAAI,EACrC,aAAa,EAAE,aAAa,GAAG,IAAI,EACnC,KAAK,EAAE,OAAO,GAAG,SAAS,EAC1B,MAAM,EAAE,eAAe,GAAG,SAAS,GAClC,cAAc,CAShB"}