veryfront 0.1.1205 → 0.1.1207

package/esm/cli/commands/build/command.d.ts

@@ -1,6 +1,23 @@
 import type { BuildOptions } from "./types.js";
 /** @internal */
 export declare function runWithBundlerShutdown<T>(operation: () => Promise<T>, stopBundler?: () => Promise<void>): Promise<T>;
+/**
+ * Release the extensions composed for this build.
+ *
+ * Extensions can hold timers and other resources, and `teardownAll()` also
+ * clears the process-global contract registry that `orchestrateExtensions`
+ * populated. `veryfront eval` and `veryfront serve` already do this; the build
+ * did not, so a command that composes extensions left them running.
+ *
+ * A teardown failure never changes the build's outcome. The build has already
+ * produced its result by this point, and `runWithBundlerShutdown` sets the
+ * same precedent by preserving the build error over a shutdown one.
+ *
+ * @internal
+ */
+export declare function releaseBuildExtensions(loader: {
+    teardownAll: () => Promise<void>;
+} | undefined): Promise<void>;
 export declare function formatBuildOutputPath(projectDir: string, outputDir: string): string;
 export declare function buildCommand(options: BuildOptions): Promise<void>;
 //# sourceMappingURL=command.d.ts.map

package/esm/cli/commands/build/command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/build/command.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C,gBAAgB;AAChB,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,WAAW,GAAE,MAAM,OAAO,CAAC,IAAI,CAG9B,GACA,OAAO,CAAC,CAAC,CAAC,CAiBZ;AAED,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnF;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAyFjE"}
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/build/command.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAK/C,gBAAgB;AAChB,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,WAAW,GAAE,MAAM,OAAO,CAAC,IAAI,CAG9B,GACA,OAAO,CAAC,CAAC,CAAC,CAiBZ;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE;IAAE,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,GAAG,SAAS,GACvD,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnF;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAwGjE"}

package/esm/cli/commands/build/command.js

@@ -9,6 +9,7 @@ import { handleBuildError } from "./error-handler.js";
 import { displayBuildSuccess } from "./stats-display.js";
 import { isJsonMode, streamJsonLine } from "../../shared/json-output.js";
 import { ensureBuiltinContentProcessor } from "../../shared/ensure-content-processor.js";
+import { setupBuildCliExtensions } from "../../shared/build-extensions.js";
 /** @internal */
 export async function runWithBundlerShutdown(operation, stopBundler = async () => {
     const { stop } = await import("../../../src/extensions/bundler/index.js");
@@ -32,6 +33,32 @@ export async function runWithBundlerShutdown(operation, stopBundler = async () =
     await stopBundler();
     return result;
 }
+/**
+ * Release the extensions composed for this build.
+ *
+ * Extensions can hold timers and other resources, and `teardownAll()` also
+ * clears the process-global contract registry that `orchestrateExtensions`
+ * populated. `veryfront eval` and `veryfront serve` already do this; the build
+ * did not, so a command that composes extensions left them running.
+ *
+ * A teardown failure never changes the build's outcome. The build has already
+ * produced its result by this point, and `runWithBundlerShutdown` sets the
+ * same precedent by preserving the build error over a shutdown one.
+ *
+ * @internal
+ */
+export async function releaseBuildExtensions(loader) {
+    if (!loader)
+        return;
+    try {
+        await loader.teardownAll();
+    }
+    catch {
+        if (!isJsonMode()) {
+            cliLogger.warn("Extension teardown failed after the build");
+        }
+    }
+}
 export function formatBuildOutputPath(projectDir, outputDir) {
     return relative(projectDir, resolve(projectDir, outputDir)).replace(/\\/g, "/");
 }
@@ -40,6 +67,14 @@ export function buildCommand(options) {
         const outputDir = options.outputDir ?? join(options.projectDir, "dist");
         const startTime = Date.now();
         const dryRun = options.dryRun ?? false;
+        let extensions;
+        // exit() does not run `finally`, so the JSON error path below releases
+        // explicitly before exiting. Clearing the handle keeps that idempotent.
+        const releaseExtensions = async () => {
+            const loader = extensions;
+            extensions = undefined;
+            await releaseBuildExtensions(loader);
+        };
         try {
             if (isJsonMode()) {
                 streamJsonLine({ type: "step", name: "config", status: "started" });
@@ -49,7 +84,11 @@ export function buildCommand(options) {
             }
             const stats = await runWithBundlerShutdown(async () => {
                 const adapter = await runtime.get();
-                await getConfig(options.projectDir, adapter);
+                const config = await getConfig(options.projectDir, adapter);
+                // Compose the project's extensions before anything that resolves a
+                // contract. Only server bootstrap used to do this, so the build ran
+                // with whatever one-off shims had been added and failed on the rest.
+                extensions = await setupBuildCliExtensions(options.projectDir, config);
                 await ensureBuiltinContentProcessor();
                 if (isJsonMode()) {
                     streamJsonLine({ type: "step", name: "config", status: "completed" });
@@ -104,11 +143,15 @@ export function buildCommand(options) {
                     success: false,
                     error: error instanceof Error ? error.message : String(error),
                 });
+                await releaseExtensions();
                 const { exit } = await import("../../../src/platform/index.js");
                 exit(1);
                 return;
             }
             handleBuildError(error);
         }
+        finally {
+            await releaseExtensions();
+        }
     }, { "cli.projectDir": options.projectDir });
 }

package/esm/cli/shared/build-extensions.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Extension composition for `veryfront build`.
+ *
+ * Extension orchestration used to happen only in server bootstrap, so commands
+ * that never start a server ran with an almost empty contract registry. The
+ * build path compensated with one-off shims (`ensureCliBundlerContracts`,
+ * `ensureBuiltinContentProcessor`) that covered the contracts someone had
+ * already been bitten by, and nothing else.
+ *
+ * CSS was the contract nobody had added a shim for. A scaffolded project whose
+ * stylesheet is `@import "tailwindcss";` reached the release-asset CSS compile
+ * with no CSSProcessor registered and failed with:
+ *
+ *   Missing extension for contract "CSSProcessor".
+ *     Install it with: deno add @veryfront/ext-css-tailwind
+ *
+ * The extension was installed the whole time. `veryfront dev` compiled the same
+ * stylesheet correctly because starting a server orchestrated it.
+ *
+ * Composing extensions here fixes that class of failure rather than one
+ * instance of it, and honors what the project configures: a project that
+ * declares `ext-css-lightning` gets its own processor instead of whichever one
+ * a shim happened to hardcode. `veryfront eval` already does this.
+ *
+ * @module cli/shared/build-extensions
+ */
+import { orchestrateExtensions } from "../../src/extensions/index.js";
+type OrchestrateExtensions = typeof orchestrateExtensions;
+type OrchestrateOptions = Parameters<OrchestrateExtensions>[0];
+/**
+ * Compose the extensions a production build needs.
+ *
+ * `orchestrate` is a test seam and defaults to the real implementation.
+ */
+export declare function setupBuildCliExtensions(projectDir: string, config: OrchestrateOptions["config"], orchestrate?: OrchestrateExtensions): Promise<Awaited<ReturnType<OrchestrateExtensions>>>;
+export {};
+//# sourceMappingURL=build-extensions.d.ts.map

package/esm/cli/shared/build-extensions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-extensions.d.ts","sourceRoot":"","sources":["../../../src/cli/shared/build-extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAItE,KAAK,qBAAqB,GAAG,OAAO,qBAAqB,CAAC;AAC1D,KAAK,kBAAkB,GAAG,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE/D;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EACpC,WAAW,GAAE,qBAA6C,GACzD,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAOrD"}

package/esm/cli/shared/build-extensions.js

@@ -0,0 +1,42 @@
+/**
+ * Extension composition for `veryfront build`.
+ *
+ * Extension orchestration used to happen only in server bootstrap, so commands
+ * that never start a server ran with an almost empty contract registry. The
+ * build path compensated with one-off shims (`ensureCliBundlerContracts`,
+ * `ensureBuiltinContentProcessor`) that covered the contracts someone had
+ * already been bitten by, and nothing else.
+ *
+ * CSS was the contract nobody had added a shim for. A scaffolded project whose
+ * stylesheet is `@import "tailwindcss";` reached the release-asset CSS compile
+ * with no CSSProcessor registered and failed with:
+ *
+ *   Missing extension for contract "CSSProcessor".
+ *     Install it with: deno add @veryfront/ext-css-tailwind
+ *
+ * The extension was installed the whole time. `veryfront dev` compiled the same
+ * stylesheet correctly because starting a server orchestrated it.
+ *
+ * Composing extensions here fixes that class of failure rather than one
+ * instance of it, and honors what the project configures: a project that
+ * declares `ext-css-lightning` gets its own processor instead of whichever one
+ * a shim happened to hardcode. `veryfront eval` already does this.
+ *
+ * @module cli/shared/build-extensions
+ */
+import { orchestrateExtensions } from "../../src/extensions/index.js";
+import { cliLogger } from "../utils/index.js";
+import { createBuiltinExtensions } from "../../src/extensions/builtin-extensions.js";
+/**
+ * Compose the extensions a production build needs.
+ *
+ * `orchestrate` is a test seam and defaults to the real implementation.
+ */
+export async function setupBuildCliExtensions(projectDir, config, orchestrate = orchestrateExtensions) {
+    return await orchestrate({
+        projectDir,
+        config,
+        logger: cliLogger.component("build-extensions"),
+        builtinExtensions: createBuiltinExtensions(),
+    });
+}

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.1205",
+    "version": "0.1.1207",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "minimumDependencyAge": {

package/esm/src/agent/streaming/lifecycle/watchdog-compat-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"watchdog-compat-adapter.d.ts","sourceRoot":"","sources":["../../../../../src/src/agent/streaming/lifecycle/watchdog-compat-adapter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,qDAAqD;AACrD,eAAO,MAAM,mCAAmC,SAAU,CAAC;AAC3D,6DAA6D;AAC7D,eAAO,MAAM,2CAA2C,SAAU,CAAC;AAEnE,0DAA0D;AAC1D,MAAM,MAAM,uBAAuB,GAC/B,kBAAkB,GAClB,sBAAsB,GACtB,cAAc,GACd,gBAAgB,CAAC;AAErB,sCAAsC;AACtC,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,uBAAuB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,gDAAgD;AAChD,MAAM,MAAM,yBAAyB,GAAG;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oBAAoB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxC,uBAAuB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,UAAU,CAAC,UAAU,CAAC;IAC5C,cAAc,CAAC,EAAE,OAAO,UAAU,CAAC,YAAY,CAAC;CACjD,CAAC;AAEF,gDAAgD;AAChD,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;gBAE5B,KAAK,EAAE,uBAAuB;CAY3C;AAED,6CAA6C;AAC7C,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,uBAAuB,EAC9B,QAAQ,CAAC,EAAE;IACT,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,EACD,OAAO,GAAE,IAAI,CACX,QAAQ,CAAC,yBAAyB,CAAC,EACnC,eAAe,GAAG,sBAAsB,CAIzC,GACA,uBAAuB,CAOzB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,uBAAuB,EAChC,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,EACzC,uBAAuB,GAAE,SAAS,MAAM,EAAO,GAC9C,OAAO,CAOT;AAED,+CAA+C;AAC/C,wBAAgB,8BAA8B,CAC5C,YAAY,EAAE,uBAAuB,EACrC,KAAK,EAAE,kBAAkB,CAAC,eAAe,CAAC,EAC1C,OAAO,CAAC,EAAE,yBAAyB,GAClC,uBAAuB,CAmFzB;AAED,6DAA6D;AAC7D,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,kBAAkB,CAAC,eAAe,CAAC,GACzC,OAAO,CAGT;AAED,mEAAmE;AACnE,MAAM,MAAM,yBAAyB,GACjC;IACA,IAAI,EAAE,mBAAmB,CAAC;IAC1B,KAAK,EAAE,oBAAoB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACC;IACA,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,oBAAoB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC;AAE1B,0EAA0E;AAC1E,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,uBAAuB,EAChC,KAAK,EAAE,kBAAkB,CAAC,eAAe,CAAC,GACzC,yBAAyB,CAmD3B;AAED,8EAA8E;AAC9E,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE,yBAAyB;;+BAmEhD,uBAAuB,GAAG,IAAI;;mBAcvC,kBAAkB,CAAC,eAAe,CAAC;;EAqCrD"}
+{"version":3,"file":"watchdog-compat-adapter.d.ts","sourceRoot":"","sources":["../../../../../src/src/agent/streaming/lifecycle/watchdog-compat-adapter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AASlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,qDAAqD;AACrD,eAAO,MAAM,mCAAmC,SAAU,CAAC;AAC3D,6DAA6D;AAC7D,eAAO,MAAM,2CAA2C,SAAU,CAAC;AAEnE,0DAA0D;AAC1D,MAAM,MAAM,uBAAuB,GAC/B,kBAAkB,GAClB,sBAAsB,GACtB,cAAc,GACd,gBAAgB,CAAC;AAErB,sCAAsC;AACtC,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EAAE,uBAAuB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,gDAAgD;AAChD,MAAM,MAAM,yBAAyB,GAAG;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oBAAoB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxC,uBAAuB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,UAAU,CAAC,UAAU,CAAC;IAC5C,cAAc,CAAC,EAAE,OAAO,UAAU,CAAC,YAAY,CAAC;CACjD,CAAC;AAEF,gDAAgD;AAChD,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;gBAE5B,KAAK,EAAE,uBAAuB;CAY3C;AAED,6CAA6C;AAC7C,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,uBAAuB,EAC9B,QAAQ,CAAC,EAAE;IACT,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,EACD,OAAO,GAAE,IAAI,CACX,QAAQ,CAAC,yBAAyB,CAAC,EACnC,eAAe,GAAG,sBAAsB,CAIzC,GACA,uBAAuB,CAOzB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,uBAAuB,EAChC,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,EACzC,uBAAuB,GAAE,SAAS,MAAM,EAAO,GAC9C,OAAO,CAOT;AAED,+CAA+C;AAC/C,wBAAgB,8BAA8B,CAC5C,YAAY,EAAE,uBAAuB,EACrC,KAAK,EAAE,kBAAkB,CAAC,eAAe,CAAC,EAC1C,OAAO,CAAC,EAAE,yBAAyB,GAClC,uBAAuB,CAmFzB;AAED,6DAA6D;AAC7D,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,kBAAkB,CAAC,eAAe,CAAC,GACzC,OAAO,CAGT;AAED,mEAAmE;AACnE,MAAM,MAAM,yBAAyB,GACjC;IACA,IAAI,EAAE,mBAAmB,CAAC;IAC1B,KAAK,EAAE,oBAAoB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACC;IACA,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,oBAAoB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC;AAE1B,0EAA0E;AAC1E,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,uBAAuB,EAChC,KAAK,EAAE,kBAAkB,CAAC,eAAe,CAAC,GACzC,yBAAyB,CAmD3B;AAED,8EAA8E;AAC9E,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE,yBAAyB;;+BAmEhD,uBAAuB,GAAG,IAAI;;mBAcvC,kBAAkB,CAAC,eAAe,CAAC;;EAqCrD"}

package/esm/src/agent/streaming/lifecycle/watchdog-compat-adapter.js

@@ -1,5 +1,11 @@
 import * as dntShim from "../../../../_dnt.shims.js";
-import { getHostEnv } from "../../../platform/compat/process.js";
+// Import from process/env.ts, not the process.ts barrel. This module is
+// reachable from the `veryfront/chat` client entry, and the barrel also
+// re-exports runCommand from process/command.ts, which pulls
+// platform/compat/dynamic-import.ts and its `new Function` into the client
+// bundle. Project pages ship a CSP without 'unsafe-eval', so that throws
+// EvalError and kills hydration before first paint.
+import { getHostEnv } from "../../../platform/compat/process/env.js";
 import { createAbsoluteDeadline } from "./deadlines.js";
 /** Default value for chat stream idle timeout ms. */
 export const DEFAULT_CHAT_STREAM_IDLE_TIMEOUT_MS = 120_000;

package/esm/src/config/schemas/config.schema.d.ts

@@ -125,7 +125,15 @@ export declare const getVeryfrontConfigSchema: () => import("../../internal-agen
                 token: import("../../internal-agents/schema.js").Schema<string>;
             }> | undefined>;
         }>> | undefined>;
-        csp: import("../../internal-agents/schema.js").Schema<Record<string, string[]> | undefined>;
+        /**
+         * Extra CSP sources, merged into the platform's baseline policy.
+         *
+         * Additive: `{ fontSrc: ["https://fonts.gstatic.com"] }` keeps every
+         * default and adds that origin. `null` drops the platform's optional
+         * sources for one directive (e.g. `styleSrc: null` removes
+         * `'unsafe-inline'`) while keeping the ones the renderer requires.
+         */
+        csp: import("../../internal-agents/schema.js").Schema<Record<string, string[] | null> | undefined>;
         remoteHosts: import("../../internal-agents/schema.js").Schema<string[] | undefined>;
         cors: import("../../internal-agents/schema.js").Schema<boolean | import("../../extensions/schema/schema-validator.js").InferShape<{
             origin: import("../../internal-agents/schema.js").Schema<string | string[] | CorsOriginValidator | undefined>;
@@ -594,7 +602,15 @@ export declare const veryfrontConfigSchema: import("../../internal-agents/schema
                 token: import("../../internal-agents/schema.js").Schema<string>;
             }> | undefined>;
         }>> | undefined>;
-        csp: import("../../internal-agents/schema.js").Schema<Record<string, string[]> | undefined>;
+        /**
+         * Extra CSP sources, merged into the platform's baseline policy.
+         *
+         * Additive: `{ fontSrc: ["https://fonts.gstatic.com"] }` keeps every
+         * default and adds that origin. `null` drops the platform's optional
+         * sources for one directive (e.g. `styleSrc: null` removes
+         * `'unsafe-inline'`) while keeping the ones the renderer requires.
+         */
+        csp: import("../../internal-agents/schema.js").Schema<Record<string, string[] | null> | undefined>;
         remoteHosts: import("../../internal-agents/schema.js").Schema<string[] | undefined>;
         cors: import("../../internal-agents/schema.js").Schema<boolean | import("../../extensions/schema/schema-validator.js").InferShape<{
             origin: import("../../internal-agents/schema.js").Schema<string | string[] | CorsOriginValidator | undefined>;

package/esm/src/config/schemas/config.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.schema.d.ts","sourceRoot":"","sources":["../../../../src/src/config/schemas/config.schema.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAShF,OAAO,KAAK,EACV,6BAA6B,EAE9B,MAAM,qCAAqC,CAAC;AAiG7C,KAAK,mBAAmB,GAAG,CACzB,MAAM,EAAE,MAAM,KACX,OAAO,GAAG,MAAM,CAAC;AAkMtB,eAAO,MAAM,wBAAwB;;;;;QAQ3B,2GAA2G;;;;;;;;;;;;;;;IA0B/G,wFAAwF;;IAExF,0FAA0F;;;;;;;;QAWtF;;;;WAIG;;;;;;;;;;;;;;;;;;;;;YAkCC,gFAAgF;;;YAGhF;;;eAGG;;;gBAIC,6EAA6E;;;;QAuCrF;;;;;;;;;;;;;;;;;WAiBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAgEH;;;;;;;;;;;;;;;WAeG;;;;;;;;;;QAKH;;;;;;WAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA+JK,uDAAuD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAwD3D,kFAAkF;;YAElF,oFAAoF;;YAEpF,+EAA+E;;YAE/E,mEAAmE;;;;;;;;;;;;;;;;;;YA2BnE,mCAAmC;;YAEnC,8CAA8C;;YAE9C,sBAAsB;;YAEtB,mDAAmD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAoFvD,yDAAyD;;QAEzD,iDAAiD;;;YAI7C,iEAAiE;;;;;;;IAkBzE,uCAAuC;;QAGnC,2CAA2C;;;IAM/C,0EAA0E;;QAGtE,6DAA6D;;;IAcjE;;;OAGG;;;;;;;;;IAmBH;;;;;;OAMG;;;YAUO,+DAA+D;;;;IAoBzE;;;;;;;;;OASG;;IAEH,0CAA0C;;QAGtC,8CAA8C;;QAE9C,gEAAgE;;QAEhE,yCAAyC;;QAEzC,qCAAqC;;QAErC,sBAAsB;;QAEtB,gCAAgC;;YAG5B,qDAAqD;;YAErD,qDAAqD;;YAErD,oDAAoD;;;QAMxD,oCAAoC;;YAGhC,4EAA4E;;YAE5E,8DAA8D;;YAE9D,8EAA8E;;;;IAa3F,CAAC;AACF,eAAO,MAAM,qBAAqB;;;;;QAjuBxB,2GAA2G;;;;;;;;;;;;;;;IA0B/G,wFAAwF;;IAExF,0FAA0F;;;;;;;;QAWtF;;;;WAIG;;;;;;;;;;;;;;;;;;;;;YAkCC,gFAAgF;;;YAGhF;;;eAGG;;;gBAIC,6EAA6E;;;;QAuCrF;;;;;;;;;;;;;;;;;WAiBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAgEH;;;;;;;;;;;;;;;WAeG;;;;;;;;;;QAKH;;;;;;WAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA+JK,uDAAuD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAwD3D,kFAAkF;;YAElF,oFAAoF;;YAEpF,+EAA+E;;YAE/E,mEAAmE;;;;;;;;;;;;;;;;;;YA2BnE,mCAAmC;;YAEnC,8CAA8C;;YAE9C,sBAAsB;;YAEtB,mDAAmD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAoFvD,yDAAyD;;QAEzD,iDAAiD;;;YAI7C,iEAAiE;;;;;;;IAkBzE,uCAAuC;;QAGnC,2CAA2C;;;IAM/C,0EAA0E;;QAGtE,6DAA6D;;;IAcjE;;;OAGG;;;;;;;;;IAmBH;;;;;;OAMG;;;YAUO,+DAA+D;;;;IAoBzE;;;;;;;;;OASG;;IAEH,0CAA0C;;QAGtC,8CAA8C;;QAE9C,gEAAgE;;QAEhE,yCAAyC;;QAEzC,qCAAqC;;QAErC,sBAAsB;;QAEtB,gCAAgC;;YAG5B,qDAAqD;;YAErD,qDAAqD;;YAErD,oDAAoD;;;QAMxD,oCAAoC;;YAGhC,4EAA4E;;YAE5E,8DAA8D;;YAE9D,8EAA8E;;;;IAcnB,CAAC;AAG1E,KAAK,uBAAuB,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC;AACxF,KAAK,4BAA4B,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC;AAE5F,iFAAiF;AACjF,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,EAAE,cAAc,CAAC,GAAG;IAC5E,YAAY,CAAC,EAAE,6BAA6B,CAAC;CAC9C,CAAC;AACF,yEAAyE;AACzE,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,4BAA4B,EAAE,cAAc,CAAC,GAAG;IACtF,YAAY,CAAC,EAAE,6BAA6B,CAAC;CAC9C,CAAC;AAGF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAsBvE;AAmCD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAEhF"}
+{"version":3,"file":"config.schema.d.ts","sourceRoot":"","sources":["../../../../src/src/config/schemas/config.schema.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAahF,OAAO,KAAK,EACV,6BAA6B,EAE9B,MAAM,qCAAqC,CAAC;AAiG7C,KAAK,mBAAmB,GAAG,CACzB,MAAM,EAAE,MAAM,KACX,OAAO,GAAG,MAAM,CAAC;AAkMtB,eAAO,MAAM,wBAAwB;;;;;QAQ3B,2GAA2G;;;;;;;;;;;;;;;IA0B/G,wFAAwF;;IAExF,0FAA0F;;;;;;;;QAWtF;;;;WAIG;;;;;;;;;;;;;;;;;;;;;YAkCC,gFAAgF;;;YAGhF;;;eAGG;;;gBAIC,6EAA6E;;;;QAuCrF;;;;;;;;;;;;;;;;;WAiBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA0DH;;;;;;;WAOG;;;;;;;;;;;QA0BH;;;;;;;;;;;;;;;WAeG;;;;;;;;;;QAKH;;;;;;WAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA+JK,uDAAuD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAwD3D,kFAAkF;;YAElF,oFAAoF;;YAEpF,+EAA+E;;YAE/E,mEAAmE;;;;;;;;;;;;;;;;;;YA2BnE,mCAAmC;;YAEnC,8CAA8C;;YAE9C,sBAAsB;;YAEtB,mDAAmD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAoFvD,yDAAyD;;QAEzD,iDAAiD;;;YAI7C,iEAAiE;;;;;;;IAkBzE,uCAAuC;;QAGnC,2CAA2C;;;IAM/C,0EAA0E;;QAGtE,6DAA6D;;;IAcjE;;;OAGG;;;;;;;;;IAmBH;;;;;;OAMG;;;YAUO,+DAA+D;;;;IAoBzE;;;;;;;;;OASG;;IAEH,0CAA0C;;QAGtC,8CAA8C;;QAE9C,gEAAgE;;QAEhE,yCAAyC;;QAEzC,qCAAqC;;QAErC,sBAAsB;;QAEtB,gCAAgC;;YAG5B,qDAAqD;;YAErD,qDAAqD;;YAErD,oDAAoD;;;QAMxD,oCAAoC;;YAGhC,4EAA4E;;YAE5E,8DAA8D;;YAE9D,8EAA8E;;;;IAa3F,CAAC;AACF,eAAO,MAAM,qBAAqB;;;;;QA5vBxB,2GAA2G;;;;;;;;;;;;;;;IA0B/G,wFAAwF;;IAExF,0FAA0F;;;;;;;;QAWtF;;;;WAIG;;;;;;;;;;;;;;;;;;;;;YAkCC,gFAAgF;;;YAGhF;;;eAGG;;;gBAIC,6EAA6E;;;;QAuCrF;;;;;;;;;;;;;;;;;WAiBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA0DH;;;;;;;WAOG;;;;;;;;;;;QA0BH;;;;;;;;;;;;;;;WAeG;;;;;;;;;;QAKH;;;;;;WAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA+JK,uDAAuD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAwD3D,kFAAkF;;YAElF,oFAAoF;;YAEpF,+EAA+E;;YAE/E,mEAAmE;;;;;;;;;;;;;;;;;;YA2BnE,mCAAmC;;YAEnC,8CAA8C;;YAE9C,sBAAsB;;YAEtB,mDAAmD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAoFvD,yDAAyD;;QAEzD,iDAAiD;;;YAI7C,iEAAiE;;;;;;;IAkBzE,uCAAuC;;QAGnC,2CAA2C;;;IAM/C,0EAA0E;;QAGtE,6DAA6D;;;IAcjE;;;OAGG;;;;;;;;;IAmBH;;;;;;OAMG;;;YAUO,+DAA+D;;;;IAoBzE;;;;;;;;;OASG;;IAEH,0CAA0C;;QAGtC,8CAA8C;;QAE9C,gEAAgE;;QAEhE,yCAAyC;;QAEzC,qCAAqC;;QAErC,sBAAsB;;QAEtB,gCAAgC;;YAG5B,qDAAqD;;YAErD,qDAAqD;;YAErD,oDAAoD;;;QAMxD,oCAAoC;;YAGhC,4EAA4E;;YAE5E,8DAA8D;;YAE9D,8EAA8E;;;;IAcnB,CAAC;AAG1E,KAAK,uBAAuB,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC;AACxF,KAAK,4BAA4B,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAAC;AAE5F,iFAAiF;AACjF,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,EAAE,cAAc,CAAC,GAAG;IAC5E,YAAY,CAAC,EAAE,6BAA6B,CAAC;CAC9C,CAAC;AACF,yEAAyE;AACzE,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,4BAA4B,EAAE,cAAc,CAAC,GAAG;IACtF,YAAY,CAAC,EAAE,6BAA6B,CAAC;CAC9C,CAAC;AAGF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAsBvE;AAmCD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAEhF"}

package/esm/src/config/schemas/config.schema.js

@@ -3,6 +3,7 @@ import { isAbsolute } from "../../platform/compat/path/index.js";
 import { CONFIG_VALIDATION_FAILED } from "../../errors/error-registry.js";
 import { MAX_REMOTE_INTEGRATION_TOOL_NAME_LENGTH, MAX_SOURCE_INTEGRATION_POLICY_INTEGRATIONS, MAX_SOURCE_INTEGRATION_POLICY_SEGMENT_LENGTH, MAX_SOURCE_INTEGRATION_POLICY_TOOL_IDS, } from "../../integrations/limits.js";
 import { ALL_INTEGRATION_NAMES } from "../../integrations/schema.js";
+import { EXAMPLE_CSP_DIRECTIVES, isCspDirectiveName, } from "../../security/http/csp-directives.js";
 import { MAX_CACHE_TTL_MILLISECONDS } from "../../cache/backends/ttl.js";
 import { MAX_PORT, MIN_PORT } from "../../utils/constants/network.js";
 import { HTTP_TOKEN_PATTERN, isBoundedCorsOrigin, isBoundedCorsOriginList, isBoundedCorsTokenList, MAX_CORS_MAX_AGE, MAX_CORS_ORIGIN_COUNT, MAX_CORS_ORIGIN_LENGTH, MAX_CORS_TOKEN_COUNT, MAX_CORS_TOKEN_LENGTH, } from "../../utils/cors-policy-limits.js";
@@ -385,7 +386,33 @@ export const getVeryfrontConfigSchema = defineSchema((v) => v
             .strict()
             .refine((auth) => !(auth.basic && auth.bearer), "Configure either basic or bearer authentication, not both")
             .optional(),
-        csp: v.record(v.string(), v.array(v.string())).optional(),
+        /**
+         * Extra CSP sources, merged into the platform's baseline policy.
+         *
+         * Additive: `{ fontSrc: ["https://fonts.gstatic.com"] }` keeps every
+         * default and adds that origin. `null` drops the platform's optional
+         * sources for one directive (e.g. `styleSrc: null` removes
+         * `'unsafe-inline'`) while keeping the ones the renderer requires.
+         */
+        csp: v
+            .record(v.string(), v.union([v.array(v.string()), v.null()]))
+            .superRefine((csp, ctx) => {
+            for (const key of Object.keys(csp)) {
+                if (isCspDirectiveName(key))
+                    continue;
+                // Browsers ignore unknown directives silently, so a typo would
+                // otherwise read as configured and protect nothing.
+                ctx.addIssue({
+                    message: `Unknown Content-Security-Policy directive "${key}". ` +
+                        `Use a directive name such as ${EXAMPLE_CSP_DIRECTIVES.join(", ")} (camelCase or kebab-case).`,
+                    // Relative to the refined value, which is already
+                    // `security.csp`. Prefixing "csp" would report
+                    // `security.csp.csp.<key>`.
+                    path: [key],
+                });
+            }
+        })
+            .optional(),
         remoteHosts: v
             .array(v.string().max(MAX_REMOTE_HOST_URL_LENGTH).url())
             .max(MAX_REMOTE_HOST_COUNT)