veryfront 0.1.1206 → 0.1.1208

package/esm/src/proxy/asset-handler.js

@@ -20,13 +20,36 @@ const ASSET_PATH_PREFIX = "/_vf/assets/";
 const ASSET_PATH_RE = /^\/_vf\/assets\/([0-9a-f]{64})\.(js|css)$/;
 const DEFAULT_UPSTREAM_TIMEOUT_MS = 10_000;
 const MAX_UPSTREAM_TIMEOUT_MS = 30_000;
-/** Count and byte bounds for completed immutable asset snapshots. */
-const MAX_CACHED_ASSETS = 100;
+/**
+ * Count and byte bounds for completed immutable asset snapshots.
+ *
+ * The byte budget is the binding limit. The entry count only exists so a
+ * pathological run of tiny assets cannot grow the map without end; sized so a
+ * pod serving several projects keeps whole module graphs resident, because
+ * evicting one holds the next page load hostage to a cold-load round trip.
+ */
+const MAX_CACHED_ASSETS = 2_000;
 const MAX_CACHED_ASSET_BYTES = 32 * 1024 * 1024;
-/** Aggregate process-local bounds for cache-miss work and attached callers. */
+/**
+ * Concurrent upstream fetches. This is the one real resource: each in-flight
+ * load buffers a whole asset in memory, so peak bytes is this count times
+ * RELEASE_ASSET_MAX_SIZE_BYTES.
+ *
+ * Excess demand queues rather than failing. A page's module graph is a fan-out
+ * this proxy itself produced by serving the HTML, so shedding it would reject
+ * the predictable consequence of our own response — and browser `import()`
+ * never retries, which turns one shed asset into a dead page. Callers are
+ * already bounded by their own deadline (`timeoutMs`) and the producer ceiling
+ * (`MAX_UPSTREAM_TIMEOUT_MS`); a saturated proxy therefore shows up as latency
+ * and finally an honest 504.
+ *
+ * A 503 is still reachable, but only from the semaphore's own
+ * `DEFAULT_PERMIT_SEMAPHORE_MAX_QUEUE_SIZE` backstop. That threshold is two
+ * orders of magnitude above one page's module graph, so reaching it means a
+ * genuine flood rather than a project being shed for the size of the document
+ * this proxy just served.
+ */
 const MAX_CONCURRENT_COLD_LOADS = 4;
-const MAX_QUEUED_COLD_LOADS = 16;
-const MAX_COLD_LOAD_WAITERS = 64;
 class ReleaseAssetNotFoundError extends Error {
     constructor() {
         super("Release asset was not found upstream");
@@ -62,11 +85,8 @@ const assetCache = new LRUCache({
     maxSizeBytes: MAX_CACHED_ASSET_BYTES,
     estimateSizeOf: (asset) => asset.bytes.byteLength + asset.contentType.length * 2 + 64,
 });
-const coldLoadAdmission = new PermitSemaphore(MAX_CONCURRENT_COLD_LOADS, {
-    maxQueueSize: MAX_QUEUED_COLD_LOADS,
-});
+const coldLoadAdmission = new PermitSemaphore(MAX_CONCURRENT_COLD_LOADS);
 const inflightAssetLoads = new Map();
-let coldLoadWaiters = 0;
 /** True when the path is owned by the release asset prefix. */
 export function isReleaseAssetPath(pathname) {
     return pathname.startsWith(ASSET_PATH_PREFIX);
@@ -305,9 +325,6 @@ export async function handleReleaseAssetRequest(req, url, options) {
     }
     if (req.signal.aborted)
         return clientClosedRequest();
-    if (coldLoadWaiters >= MAX_COLD_LOAD_WAITERS)
-        return serviceUnavailable();
-    coldLoadWaiters++;
     try {
         const task = getOrCreateInflightAssetLoad(hash, upstreamUrl, doFetch);
         const asset = await waitForInflightAssetLoad(task, req.signal, timeoutMs);
@@ -326,9 +343,6 @@ export async function handleReleaseAssetRequest(req, url, options) {
             return serviceUnavailable();
         return badGateway();
     }
-    finally {
-        coldLoadWaiters--;
-    }
 }
 /** Clear the in-memory asset cache (tests / memory pressure). */
 export function clearReleaseAssetProxyCache() {

package/esm/src/release-assets/manifest-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-cache.d.ts","sourceRoot":"","sources":["../../../src/src/release-assets/manifest-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAQH,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAC;AAwC9B,iEAAiE;AACjE,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAOD,wEAAwE;AACxE,MAAM,WAAW,gCAAgC;IAC/C,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,yEAAyE;AACzE,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,CACE,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,+BAA+B,GAAG,IAAI,CAAC,CAAC;CACpD;AAED,uDAAuD;AACvD,MAAM,MAAM,kCAAkC,GAAG,MAAM,IAAI,CAAC;AAmC5D;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,2BAA2B,GACnC,kCAAkC,CA0BpC;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAG3E;AAED,yEAAyE;AACzE,wBAAgB,6BAA6B,IAAI,OAAO,CAKvD;AA2CD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACnC,oBAAoB,GAAG,IAAI,CAyC7B;AAsDD;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAMtC;AAED;;;;GAIG;AACH,wBAAsB,yCAAyC,CAC7D,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAEtC;AA2LD,6EAA6E;AAC7E,wBAAgB,gCAAgC,IAAI,IAAI,CAOvD;AAED,uEAAuE;AACvE,wBAAgB,8BAA8B,IAAI,IAAI,CAGrD"}
+{"version":3,"file":"manifest-cache.d.ts","sourceRoot":"","sources":["../../../src/src/release-assets/manifest-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAQH,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAC;AAwC9B,iEAAiE;AACjE,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAOD,wEAAwE;AACxE,MAAM,WAAW,gCAAgC;IAC/C,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,yEAAyE;AACzE,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,CACE,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,+BAA+B,GAAG,IAAI,CAAC,CAAC;CACpD;AAED,uDAAuD;AACvD,MAAM,MAAM,kCAAkC,GAAG,MAAM,IAAI,CAAC;AAmC5D;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,2BAA2B,GACnC,kCAAkC,CA0BpC;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAG3E;AAED,yEAAyE;AACzE,wBAAgB,6BAA6B,IAAI,OAAO,CAKvD;AA2CD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACnC,oBAAoB,GAAG,IAAI,CAyC7B;AAsDD;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAMtC;AAED;;;;GAIG;AACH,wBAAsB,yCAAyC,CAC7D,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAEtC;AA8MD,6EAA6E;AAC7E,wBAAgB,gCAAgC,IAAI,IAAI,CAOvD;AAED,uEAAuE;AACvE,wBAAgB,8BAA8B,IAAI,IAAI,CAGrD"}

package/esm/src/release-assets/manifest-cache.js

@@ -28,7 +28,7 @@ import { registerLRUCache } from "../cache/index.js";
 import { getHostEnv } from "../platform/compat/process.js";
 import { markRequestProfilePhase, profilePhase } from "../observability/index.js";
 import { RELEASE_ASSET_MANIFEST_ENV_FLAG, RELEASE_ASSET_MANIFEST_LIMITS } from "./constants.js";
-import { parseReadyReleaseAssetManifestResponse, } from "./manifest-schema.js";
+import { describeReadyReleaseAssetManifestRejection, parseReadyReleaseAssetManifestResponse, } from "./manifest-schema.js";
 import { hasControlCharacters } from "./string-validation.js";
 const logger = serverLogger.component("release-asset-manifest");
 /** Bound on cached manifests (per releaseId:manifestVersion). */
@@ -334,10 +334,28 @@ function fetchManifest(releaseId) {
                 return manifest;
             }
             else {
-                if (state === "ready")
+                // Classify on what the publisher claimed, not on the derived `state`.
+                // A response that says `ready` with an unusable `manifest_version` is
+                // normalized to "invalid" above, so keying on `state` would route the
+                // envelope-level rejections to debug — silencing exactly the reasons
+                // this diagnostic exists to surface.
+                if (rawState === "ready") {
                     markManifestDecision("fetch_ready_invalid");
-                else
+                    // A manifest the publisher calls ready but this build cannot read is
+                    // an operator problem, not a wait: browser modules are refused for
+                    // the whole release until someone acts. Say why. Without this the
+                    // only signal is a 503 and a timing mark, which cannot distinguish
+                    // framework version skew from a corrupt payload.
+                    logger.error("Release manifest is ready upstream but failed validation", {
+                        releaseId,
+                        reason: describeReadyReleaseAssetManifestRejection(result, releaseId),
+                    });
+                }
+                else {
                     markManifestDecision(`fetch_${manifestState}`);
+                    // Any other state is the release legitimately not being ready yet.
+                    logger.debug("Release manifest is not ready", { releaseId, state: manifestState });
+                }
                 markManifestDecision("fetch_not_ready");
                 evictReadyManifests(releaseId, active.token);
                 cacheNonReadyManifest(releaseId, active.token);

package/esm/src/routing/api/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAWlD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAS9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAe3D,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAYrC;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAYzF;AAED;;GAEG;AACH,UAAU,mBAAmB;IAC3B,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC7C,oBAAoB,CAAC,EAAE,OAAO,oBAAoB,CAAC;IACnD,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACjD,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC7C,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;CAC9B;AAID;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAE3E;AAYD,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AAe3E,qBAAa,eAAe;IAmBxB,OAAO,CAAC,UAAU;IAlBpB,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,UAAU,CAAgF;IAClG,OAAO,CAAC,gBAAgB,CAA+B;IACvD,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,SAAS,CAAS;IAE1B,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,cAAc,CAAwC;IAE9D,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,iBAAiB,CAA8B;IAEvD,OAAO,CAAC,MAAM,CAAsD;IACpE,OAAO,CAAC,aAAa,CAA8B;gBAGzC,UAAU,EAAE,MAAM,EAC1B,OAAO,CAAC,EAAE,cAAc;IAM1B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD3B,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAoJxE,OAAO,CAAC,SAAS;IAsDjB,UAAU,IAAI,IAAI;IAQlB,OAAO,IAAI,IAAI;IAWf,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,UAAU;YASJ,aAAa;YAsBb,gBAAgB;YAOhB,cAAc;YAcd,YAAY;YAOZ,cAAc;CAW7B;AAED,OAAO,EACL,UAAU,EACV,SAAS,EACT,mBAAmB,IAAI,WAAW,EAClC,YAAY,IAAI,IAAI,EACpB,QAAQ,EACR,gBAAgB,IAAI,QAAQ,EAC5B,YAAY,GACb,MAAM,yCAAyC,CAAC"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAWlD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAS9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAoB3D,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAYrC;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAYzF;AAED;;GAEG;AACH,UAAU,mBAAmB;IAC3B,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC7C,oBAAoB,CAAC,EAAE,OAAO,oBAAoB,CAAC;IACnD,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACjD,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IAC7C,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;CAC9B;AAID;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAE3E;AAYD,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AAe3E,qBAAa,eAAe;IAmBxB,OAAO,CAAC,UAAU;IAlBpB,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,UAAU,CAAgF;IAClG,OAAO,CAAC,gBAAgB,CAA+B;IACvD,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,SAAS,CAAS;IAE1B,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,cAAc,CAAwC;IAE9D,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,iBAAiB,CAA8B;IAEvD,OAAO,CAAC,MAAM,CAAsD;IACpE,OAAO,CAAC,aAAa,CAA8B;gBAGzC,UAAU,EAAE,MAAM,EAC1B,OAAO,CAAC,EAAE,cAAc;IAM1B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD3B,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAmLxE,OAAO,CAAC,SAAS;IAsDjB,UAAU,IAAI,IAAI;IAQlB,OAAO,IAAI,IAAI;IAWf,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,UAAU;YASJ,aAAa;YAsBb,gBAAgB;YAOhB,cAAc;YAcd,YAAY;YAOZ,cAAc;CAW7B;AAED,OAAO,EACL,UAAU,EACV,SAAS,EACT,mBAAmB,IAAI,WAAW,EAClC,YAAY,IAAI,IAAI,EACpB,QAAQ,EACR,gBAAgB,IAAI,QAAQ,EAC5B,YAAY,GACb,MAAM,yCAAyC,CAAC"}

package/esm/src/routing/api/handler.js

@@ -11,7 +11,8 @@ import { loadHandlerModule, prepareHandlerModule } from "./module-loader/loader.
 import { discoverAppRoutes, discoverPagesRoutes } from "./route-discovery.js";
 import { executeAppRoute, executePagesRoute, executePreparedAppRoute, executePreparedPagesRoute, } from "./route-executor.js";
 import { withSpan } from "../../observability/tracing/otlp-setup.js";
-import { evictWorkerScopeIfPresent, isWorkerIsolationEnabled, } from "../../security/sandbox/worker-pool.js";
+import { evictWorkerScopeIfPresent, isHostRealmApiExecution, isWorkerIsolationEnabled, } from "../../security/sandbox/worker-pool.js";
+import { isIsolatedApiPreparationSupported, ISOLATED_API_PREPARATION_UNSUPPORTED_REASON, } from "../../security/sandbox/isolation-capability.js";
 import { createApplicationRequest } from "../../security/http/application-request.js";
 import { isHostProjectCodeExecutionAllowed, isSharedProjectRuntime, } from "../../security/project-locality.js";
 /** Max entries in the loaded-handler LRU cache */
@@ -162,7 +163,33 @@ export class APIRouteHandler {
                     config: this.corsConfig ?? undefined,
                 }) ?? unavailable;
             }
-            const useHostRealm = allowHostProjectCodeExecution && !isWorkerIsolationEnabled();
+            const useHostRealm = isHostRealmApiExecution(allowHostProjectCodeExecution);
+            // Only the isolated path is left and this build cannot prepare a module
+            // for it, so every continuation dead-ends in loadRoute and is flattened
+            // to "Handler not found" below. Name the flag instead. Gated on
+            // !useHostRealm so a dedicated-but-ungranted runtime, which skips the
+            // shared-runtime 503 above, also gets a typed answer.
+            if (!useHostRealm && !isIsolatedApiPreparationSupported()) {
+                const isolationRequested = isWorkerIsolationEnabled();
+                logger.error("API route unservable under the configured execution posture", {
+                    pathname,
+                    reason: ISOLATED_API_PREPARATION_UNSUPPORTED_REASON,
+                    workerIsolationApi: isolationRequested,
+                    allowHostProjectCodeExecution,
+                });
+                const unservable = createErrorResponseFromDefinition(PROJECT_EXECUTION_UNAVAILABLE, {
+                    detail: isolationRequested
+                        ? "WORKER_ISOLATION_API is set but this runtime cannot prepare isolated API route source"
+                        : "Host project code execution is not granted and this runtime cannot prepare isolated API route source",
+                    instance: pathname,
+                });
+                unservable.headers.set("cache-control", "no-store");
+                return await applyCORSHeaders({
+                    request,
+                    response: unservable,
+                    config: this.corsConfig ?? undefined,
+                }) ?? unservable;
+            }
             const { route, errorMessage } = await this.loadRoute(match, useHostRealm);
             if (!route) {
                 const msg = errorMessage ?? "Handler not found";

package/esm/src/routing/api/module-loader/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/loader.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAkBrF,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,2CAA2C,CAAC;AAOnD,OAAO,EACL,iCAAiC,EACjC,gCAAgC,EAChC,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,0CAA0C,EAC1C,qCAAqC,EACrC,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA8B1F;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA+C9F;AA0DD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIlE;AAgcD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACnC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAWrB"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../../../src/src/routing/api/module-loader/loader.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,QAAQ,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAkBrF,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,2CAA2C,CAAC;AAWnD,OAAO,EACL,iCAAiC,EACjC,gCAAgC,EAChC,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,0CAA0C,EAC1C,qCAAqC,EACrC,6BAA6B,EAC7B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA8B1F;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgD9F;AA0DD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIlE;AAgcD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACnC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAWrB"}

package/esm/src/routing/api/module-loader/loader.js

@@ -16,6 +16,7 @@ import { isWithinDirectory } from "../../../security/path-validation.js";
 import { generateCompiledBinaryRequireShim, NODE_BUILTINS, readProjectDependencies, rewriteExternalImports, } from "./external-import-rewriter.js";
 import { MAX_WORKER_MODULE_SOURCE_BYTES, } from "../../../security/sandbox/worker-types.js";
 import { isExplicitHostProjectCodeExecutionAllowed } from "../../../security/project-locality.js";
+import { isIsolatedApiPreparationSupported, ISOLATED_API_PREPARATION_UNSUPPORTED_REASON, } from "../../../security/sandbox/isolation-capability.js";
 import { createProjectSourceSnapshot, ProjectBoundaryViolationError, } from "./project-source-snapshot.js";
 export { generateCompiledBinaryRequireShim, getNodeExternalPackagesToResolve, loadVeryfrontExportsMap, resolveEsmUserDependencies, resolveNodePackageToFileUrl, rewriteCompiledBinaryUserDependencyImports, rewriteCompiledBinaryVeryfrontImports, rewriteDenoNodeBuiltinImports, rewriteDenoNpmDependencyImports, rewriteNodeExternalImports, } from "./external-import-rewriter.js";
 const logger = serverLogger.component("api");
@@ -51,10 +52,11 @@ export function prepareHandlerModule(options) {
     return withSpan("api.prepareHandlerModule", async () => {
         const { projectDir, modulePath, adapter, config } = options;
         validateModulePath(modulePath, projectDir);
-        if (isCompiledBinary()) {
+        // Fail-closed backstop. API ownership reports a typed 503 before this.
+        if (!isIsolatedApiPreparationSupported()) {
             throw toError(createError({
                 type: "api",
-                message: "Isolated API route preparation is unavailable in this compiled runtime",
+                message: ISOLATED_API_PREPARATION_UNSUPPORTED_REASON,
             }));
         }
         try {

package/esm/src/routing/api/route-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-executor.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/route-executor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAqB,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAMzD,OAAO,KAAK,EACV,QAAQ,EAIT,MAAM,0BAA0B,CAAC;AAkBlC,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAIvB,MAAM,wCAAwC,CAAC;AAgBhD,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uDAAuD,CAAC;AA0L/D,iBAAS,iCAAiC,CACxC,GAAG,EAAE,OAAO,GACX,kBAAkB,GAAG,SAAS,CAsDhC;AAMD,0EAA0E;AAC1E,eAAO,MAAM,kCAAkC,0CAAoC,CAAC;AA6hBpF,iBAAe,gBAAgB,CAC7B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CAe5B;AAED,2EAA2E;AAC3E,eAAO,MAAM,0BAA0B,yBAAmB,CAAC;AA+P3D,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,uEAAuE;IACvE,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,QAAQ,CAAC,CAWnB;AAED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,QAAQ,CAAC,CAWnB;AAED,wBAAsB,2BAA2B,CAC/C,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,OAAO,EAAE,IAAI,CAAC,6BAA6B,EAAE,gBAAgB,CAAC,GAC7D,OAAO,CAAC,MAAM,EAAE,CAAC,CAiCnB;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,QAAQ,EACjB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,cAAc,EACxB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAoEnB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,QAAQ,EACjB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc,EACvB,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,QAAQ,CAAC,CA0EnB"}
+{"version":3,"file":"route-executor.d.ts","sourceRoot":"","sources":["../../../../src/src/routing/api/route-executor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAqB,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAMzD,OAAO,KAAK,EACV,QAAQ,EAIT,MAAM,0BAA0B,CAAC;AAelC,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAIvB,MAAM,wCAAwC,CAAC;AAgBhD,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uDAAuD,CAAC;AA0L/D,iBAAS,iCAAiC,CACxC,GAAG,EAAE,OAAO,GACX,kBAAkB,GAAG,SAAS,CAsDhC;AAMD,0EAA0E;AAC1E,eAAO,MAAM,kCAAkC,0CAAoC,CAAC;AA6hBpF,iBAAe,gBAAgB,CAC7B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CAe5B;AAED,2EAA2E;AAC3E,eAAO,MAAM,0BAA0B,yBAAmB,CAAC;AA+P3D,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,uEAAuE;IACvE,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,QAAQ,CAAC,CAWnB;AAED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,QAAQ,CAAC,CAWnB;AAED,wBAAsB,2BAA2B,CAC/C,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,OAAO,EAAE,IAAI,CAAC,6BAA6B,EAAE,gBAAgB,CAAC,GAC7D,OAAO,CAAC,MAAM,EAAE,CAAC,CAiCnB;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,QAAQ,EACjB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,cAAc,EACxB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAmEnB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,QAAQ,EACjB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc,EACvB,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAyEnB"}

package/esm/src/routing/api/route-executor.js

@@ -6,7 +6,7 @@ import { createAppRouteMethodNotAllowed, createPagesRouteMethodNotAllowed, } fro
 import { isAbsolute, join } from "../../platform/compat/path/index.js";
 import { withSpan } from "../../observability/tracing/otlp-setup.js";
 import { serverLogger as logger } from "../../utils/index.js";
-import { getWorkerPool, isWorkerIsolationEnabled, } from "../../security/sandbox/worker-pool.js";
+import { getWorkerPool, isHostRealmApiExecution } from "../../security/sandbox/worker-pool.js";
 import { resolveWorkerGeneration, snapshotWorkerGenerationIdentity, } from "../../security/sandbox/worker-generation.js";
 import { deserializeWorkerError } from "../../security/sandbox/worker-error-boundary.js";
 import { MAX_WORKER_BODY_BYTES, } from "../../security/sandbox/worker-types.js";
@@ -844,8 +844,7 @@ export async function resolvePreparedRouteMethods(requestedMethod, options) {
 export function executeAppRoute(handler, request, match, pathname, _adapter, options) {
     const routeOptions = snapshotExecuteRouteOptions(options);
     const isLocalProject = routeOptions.isLocalProject === true;
-    const isolationRequired = isWorkerIsolationEnabled() ||
-        !routeOptions.allowHostProjectCodeExecution;
+    const isolationRequired = !isHostRealmApiExecution(routeOptions.allowHostProjectCodeExecution);
     // Routes without an explicit host-execution capability require prepared
     // worker execution. Local development projects retain the legacy capability.
     if (isolationRequired) {
@@ -885,8 +884,7 @@ export function executeAppRoute(handler, request, match, pathname, _adapter, opt
 export function executePagesRoute(handler, request, match, pathname, adapter, projectDir, options) {
     const routeOptions = snapshotExecuteRouteOptions(options);
     const isLocalProject = routeOptions.isLocalProject === true;
-    const isolationRequired = isWorkerIsolationEnabled() ||
-        !routeOptions.allowHostProjectCodeExecution;
+    const isolationRequired = !isHostRealmApiExecution(routeOptions.allowHostProjectCodeExecution);
     const isolatedProjectDir = routeOptions.projectDir ?? projectDir;
     // Routes without an explicit host-execution capability require prepared
     // worker execution. Local development projects retain the legacy capability.

package/esm/src/security/http/base-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-handler.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/base-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,EACb,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAErG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAKhF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,qBAAqB,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,eAAe,CAAC;IAChF,OAAO,EAAE,CACP,QAAQ,EAAE,QAAQ,GAAG,wBAAwB,EAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,aAAa,CAAC;IACnB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,IAAI,CAAC;IAC3F,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5C,QAAQ,EAAE,MAAM,aAAa,CAAC;CAC/B;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAY1F;AAED,8BAAsB,WAAY,YAAW,OAAO;IAClD,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAMxC;IAEF,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAE1E,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO;IAYlE,OAAO,CAAC,cAAc;IAWtB,SAAS,CAAC,qBAAqB,CAC7B,GAAG,EAAE,cAAc,EACnB,KAAK,CAAC,EAAE,MAAM,GACb,eAAe;IAWlB,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,IAAI;IAKhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAIzE,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAIzE,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAIjD,SAAS,CAAC,QAAQ,IAAI,aAAa;IAInC,SAAS,CAAC,OAAO,CACf,QAAQ,EAAE,QAAQ,GAAG,wBAAwB,EAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,aAAa;IAMhB,SAAS,CAAC,gBAAgB,CAAC,CAAC,EAC1B,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,GAAE;QACP,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,0BAA0B,CAAC,EAAE,iCAAiC,CAAC;KAC3D,GACL,OAAO,CAAC,CAAC,CAAC;CA4Gd"}
+{"version":3,"file":"base-handler.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/base-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,eAAe,EACf,aAAa,EACb,YAAY,EACb,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAErG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAKhF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,qBAAqB,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,eAAe,CAAC;IAChF,OAAO,EAAE,CACP,QAAQ,EAAE,QAAQ,GAAG,wBAAwB,EAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,aAAa,CAAC;IACnB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,IAAI,CAAC;IAC3F,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5C,QAAQ,EAAE,MAAM,aAAa,CAAC;CAC/B;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAY1F;AAED,8BAAsB,WAAY,YAAW,OAAO;IAClD,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAMxC;IAEF,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAE1E,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO;IAYlE,OAAO,CAAC,cAAc;IAWtB,SAAS,CAAC,qBAAqB,CAC7B,GAAG,EAAE,cAAc,EACnB,KAAK,CAAC,EAAE,MAAM,GACb,eAAe;IAUlB,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,IAAI;IAKhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAIzE,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAIzE,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAIjD,SAAS,CAAC,QAAQ,IAAI,aAAa;IAInC,SAAS,CAAC,OAAO,CACf,QAAQ,EAAE,QAAQ,GAAG,wBAAwB,EAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,aAAa;IAMhB,SAAS,CAAC,gBAAgB,CAAC,CAAC,EAC1B,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,GAAE;QACP,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,0BAA0B,CAAC,EAAE,iCAAiC,CAAC;KAC3D,GACL,OAAO,CAAC,CAAC,CAAC;CA4Gd"}

package/esm/src/security/http/base-handler.js

@@ -48,7 +48,6 @@ export class BaseHandler {
         return new ResponseBuilder({
             securityConfig: ctx.securityConfig ?? undefined,
             isDev: isExplicitlyLocalProject(ctx),
-            cspUserHeader: ctx.cspUserHeader,
             adapter: ctx.adapter,
             nonce,
             isVeryfrontDomain: ctx.parsedDomain?.allowIframeEmbed ?? false,

package/esm/src/security/http/config.d.ts

@@ -3,7 +3,6 @@ import type { SecurityConfig } from "../../types/index.js";
 import type { VeryfrontConfig } from "../../config/index.js";
 export interface DerivedSecurityContext {
     securityConfig: SecurityConfig;
-    cspUserHeader: string | null;
 }
 export interface DeriveSecurityContextOptions {
     /**
@@ -48,7 +47,6 @@ export declare class SecurityConfigLoader {
     private configOverride?;
     private productionRuntime;
     private securityConfig;
-    private cspUserHeader;
     private isLoaded;
     private loadPromise;
     constructor(projectDir: string, adapter: RuntimeAdapter, configOverride?: VeryfrontConfig | undefined, productionRuntime?: boolean);
@@ -56,7 +54,6 @@ export declare class SecurityConfigLoader {
     private load;
     private applyConfig;
     getSecurityConfig(): SecurityConfig | null;
-    getCspUserHeader(): string | null;
     getCorsConfig(): SecurityConfig["cors"];
     buildCsp(isDev: boolean, nonce?: string): string;
     getSecurityHeader(headerName: string, defaultValue: string): string;

package/esm/src/security/http/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQ7D,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,cAAc,CAAC;IAC/B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAwLD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,cAAc,CAO/E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAIhC;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,CAAC,EAAE,eAAe,EACrB,OAAO,GAAE,4BAAiC,GACzC,sBAAsB,CAkBxB;AAED,qBAAa,oBAAoB;IAO7B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,iBAAiB;IAT3B,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,WAAW,CAA8B;gBAGvC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,cAAc,CAAC,EAAE,eAAe,YAAA,EAChC,iBAAiB,UAAQ;IAG7B,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;YAqBrB,IAAI;IAKlB,OAAO,CAAC,WAAW;IAkBnB,iBAAiB,IAAI,cAAc,GAAG,IAAI;IAI1C,gBAAgB,IAAI,MAAM,GAAG,IAAI;IAIjC,aAAa,IAAI,cAAc,CAAC,MAAM,CAAC;IAIvC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,MAAwB,GAAG,MAAM;IAIjE,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;CAQpE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQ7D,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAwLD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,cAAc,CAO/E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAIhC;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,CAAC,EAAE,eAAe,EACrB,OAAO,GAAE,4BAAiC,GACzC,sBAAsB,CAiBxB;AAED,qBAAa,oBAAoB;IAM7B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,iBAAiB;IAR3B,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,WAAW,CAA8B;gBAGvC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,cAAc,CAAC,EAAE,eAAe,YAAA,EAChC,iBAAiB,UAAQ;IAG7B,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;YAqBrB,IAAI;IAKlB,OAAO,CAAC,WAAW;IAiBnB,iBAAiB,IAAI,cAAc,GAAG,IAAI;IAI1C,aAAa,IAAI,cAAc,CAAC,MAAM,CAAC;IAIvC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,MAAwB,GAAG,MAAM;IAIjE,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;CAQpE"}

package/esm/src/security/http/config.js

@@ -1,6 +1,6 @@
 import { getConfig, validateVeryfrontConfig } from "../../config/index.js";
 import { serverLogger } from "../../utils/index.js";
-import { buildCSP, generateNonce, serializeCSPDirectives } from "./response/security-handler.js";
+import { buildCSP, generateNonce } from "./response/security-handler.js";
 import { isProduction } from "../../platform/environment.js";
 const logger = serverLogger.component("security-config-loader");
 const MAX_SECURITY_CONFIG_DEPTH = 32;
@@ -231,7 +231,6 @@ export function deriveSecurityContext(cfg, options = {}) {
     const securityConfig = Object.freeze(normalized);
     return Object.freeze({
         securityConfig,
-        cspUserHeader: serializeCSPDirectives(securityConfig.csp),
     });
 }
 export class SecurityConfigLoader {
@@ -240,7 +239,6 @@ export class SecurityConfigLoader {
     configOverride;
     productionRuntime;
     securityConfig = null;
-    cspUserHeader = null;
     isLoaded = false;
     loadPromise = null;
     constructor(projectDir, adapter, configOverride, productionRuntime = false) {
@@ -285,20 +283,16 @@ export class SecurityConfigLoader {
                 "Consider explicitly configuring security.cors and security.csrf.");
         }
         this.securityConfig = security;
-        this.cspUserHeader = derived.cspUserHeader;
         this.isLoaded = true;
     }
     getSecurityConfig() {
         return this.securityConfig;
     }
-    getCspUserHeader() {
-        return this.cspUserHeader;
-    }
     getCorsConfig() {
         return this.securityConfig?.cors;
     }
     buildCsp(isDev, nonce = generateNonce()) {
-        return buildCSP(isDev, nonce, this.cspUserHeader, this.securityConfig, this.adapter);
+        return buildCSP(isDev, nonce, this.securityConfig, this.adapter);
     }
     getSecurityHeader(headerName, defaultValue) {
         const configKey = headerName.toLowerCase();

package/esm/src/security/http/csp-directives.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Canonical Content-Security-Policy directive names.
+ *
+ * Kept as a leaf module so both the policy builder and the config validator
+ * read the same list. A project that misspells a directive is told at config
+ * load rather than discovering it as a silently missing protection in
+ * production — an unrecognized directive name is ignored by browsers, so
+ * without this check `fontSource: [...]` would look configured and do nothing.
+ *
+ * @module security/http/csp-directives
+ */
+/** Every directive a project may name in `security.csp`. */
+export declare const CSP_DIRECTIVE_NAMES: readonly string[];
+/**
+ * A short, representative sample for error messages. Listing all 28 directives
+ * buries the fix; these are the ones projects actually reach for.
+ */
+export declare const EXAMPLE_CSP_DIRECTIVES: readonly string[];
+/**
+ * Normalize a configured key to its directive name.
+ *
+ * `fontSrc` and `font-src` address the same directive; projects may write
+ * either, and camelCase matches the surrounding config style.
+ */
+export declare function toCspDirectiveName(key: string): string;
+/** True when a configured key names a real CSP directive. */
+export declare function isCspDirectiveName(key: string): boolean;
+//# sourceMappingURL=csp-directives.d.ts.map

package/esm/src/security/http/csp-directives.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp-directives.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/csp-directives.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EA6B/C,CAAC;AAIH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAMlD,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,6DAA6D;AAC7D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEvD"}

package/esm/src/security/http/csp-directives.js

@@ -0,0 +1,67 @@
+/**
+ * Canonical Content-Security-Policy directive names.
+ *
+ * Kept as a leaf module so both the policy builder and the config validator
+ * read the same list. A project that misspells a directive is told at config
+ * load rather than discovering it as a silently missing protection in
+ * production — an unrecognized directive name is ignored by browsers, so
+ * without this check `fontSource: [...]` would look configured and do nothing.
+ *
+ * @module security/http/csp-directives
+ */
+/** Every directive a project may name in `security.csp`. */
+export const CSP_DIRECTIVE_NAMES = Object.freeze([
+    "base-uri",
+    "block-all-mixed-content",
+    "child-src",
+    "connect-src",
+    "default-src",
+    "fenced-frame-src",
+    "font-src",
+    "form-action",
+    "frame-ancestors",
+    "frame-src",
+    "img-src",
+    "manifest-src",
+    "media-src",
+    "object-src",
+    "prefetch-src",
+    "report-to",
+    "report-uri",
+    "require-trusted-types-for",
+    "sandbox",
+    "script-src",
+    "script-src-attr",
+    "script-src-elem",
+    "style-src",
+    "style-src-attr",
+    "style-src-elem",
+    "trusted-types",
+    "upgrade-insecure-requests",
+    "worker-src",
+]);
+const CSP_DIRECTIVE_NAME_SET = new Set(CSP_DIRECTIVE_NAMES);
+/**
+ * A short, representative sample for error messages. Listing all 28 directives
+ * buries the fix; these are the ones projects actually reach for.
+ */
+export const EXAMPLE_CSP_DIRECTIVES = Object.freeze([
+    "styleSrc",
+    "fontSrc",
+    "imgSrc",
+    "connectSrc",
+    "frameSrc",
+]);
+/**
+ * Normalize a configured key to its directive name.
+ *
+ * `fontSrc` and `font-src` address the same directive; projects may write
+ * either, and camelCase matches the surrounding config style.
+ */
+export function toCspDirectiveName(key) {
+    return key.replace(/[A-Z]/g, (match) => `-${match.toLowerCase()}`);
+}
+/** True when a configured key names a real CSP directive. */
+export function isCspDirectiveName(key) {
+    return CSP_DIRECTIVE_NAME_SET.has(toCspDirectiveName(key));
+}

package/esm/src/security/http/response/builder.d.ts

@@ -10,7 +10,6 @@ export declare class ResponseBuilder implements FluentMethodsContext, ResponseMe
     securityConfig: SecurityConfig | null;
     isDev: boolean;
     nonce: string;
-    cspUserHeader: string | null;
     adapter: import("../../../platform/adapters/base.js").RuntimeAdapter | undefined;
     isVeryfrontDomain: boolean;
     constructor(config?: ResponseBuilderConfig);

package/esm/src/security/http/response/builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,eAAe,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAC;AAGrD,qBAAa,eAAgB,YAAW,oBAAoB,EAAE,sBAAsB;IAClF,OAAO,EAAE,OAAO,CAAiB;IACjC,MAAM,EAAE,MAAM,CAAO;IACrB,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,EAAE,OAAO,oCAAoC,EAAE,cAAc,GAAG,SAAS,CAAC;IACjF,iBAAiB,EAAE,OAAO,CAAC;gBAEf,MAAM,CAAC,EAAE,qBAAqB;IAS1C,QAAQ,gCAA0B;IAClC,aAAa,qCAA+B;IAC5C,YAAY,oCAA8B;IAC1C,SAAS,iCAA2B;IACpC,QAAQ,gCAA0B;IAClC,WAAW,mCAA6B;IACxC,UAAU,kCAA4B;IACtC,SAAS,iCAA2B;IACpC,eAAe,uCAAiC;IAEhD,IAAI,8BAAwB;IAC5B,IAAI,8BAAwB;IAC5B,IAAI,8BAAwB;IAC5B,UAAU,oCAA8B;IACxC,eAAe,yCAAmC;IAClD,KAAK,+BAAyB;IAC9B,WAAW,qCAA+B;IAE1C,MAAM,CAAC,KAAK,6BAAuB;IACnC,MAAM,CAAC,IAAI,4BAAsB;IACjC,MAAM,CAAC,IAAI,4BAAsB;IACjC,MAAM,CAAC,SAAS,iCAA2B;IAC3C,MAAM,CAAC,MAAM,8BAAwB;CACtC;AASD,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAErF"}
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,eAAe,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAC;AAGrD,qBAAa,eAAgB,YAAW,oBAAoB,EAAE,sBAAsB;IAClF,OAAO,EAAE,OAAO,CAAiB;IACjC,MAAM,EAAE,MAAM,CAAO;IACrB,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,oCAAoC,EAAE,cAAc,GAAG,SAAS,CAAC;IACjF,iBAAiB,EAAE,OAAO,CAAC;gBAEf,MAAM,CAAC,EAAE,qBAAqB;IAQ1C,QAAQ,gCAA0B;IAClC,aAAa,qCAA+B;IAC5C,YAAY,oCAA8B;IAC1C,SAAS,iCAA2B;IACpC,QAAQ,gCAA0B;IAClC,WAAW,mCAA6B;IACxC,UAAU,kCAA4B;IACtC,SAAS,iCAA2B;IACpC,eAAe,uCAAiC;IAEhD,IAAI,8BAAwB;IAC5B,IAAI,8BAAwB;IAC5B,IAAI,8BAAwB;IAC5B,UAAU,oCAA8B;IACxC,eAAe,yCAAmC;IAClD,KAAK,+BAAyB;IAC9B,WAAW,qCAA+B;IAE1C,MAAM,CAAC,KAAK,6BAAuB;IACnC,MAAM,CAAC,IAAI,4BAAsB;IACjC,MAAM,CAAC,IAAI,4BAAsB;IACjC,MAAM,CAAC,SAAS,iCAA2B;IAC3C,MAAM,CAAC,MAAM,8BAAwB;CACtC;AASD,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAErF"}

package/esm/src/security/http/response/builder.js

@@ -8,14 +8,12 @@ export class ResponseBuilder {
     securityConfig;
     isDev;
     nonce;
-    cspUserHeader;
     adapter;
     isVeryfrontDomain;
     constructor(config) {
         this.securityConfig = config?.securityConfig ?? null;
         this.isDev = config?.isDev ?? false;
         this.nonce = config?.nonce ?? generateNonce();
-        this.cspUserHeader = config?.cspUserHeader ?? null;
         this.adapter = config?.adapter;
         this.isVeryfrontDomain = config?.isVeryfrontDomain ?? false;
     }

package/esm/src/security/http/response/fluent-methods.d.ts

@@ -8,7 +8,6 @@ export interface FluentMethodsContext {
     securityConfig: SecurityConfig | null;
     isDev: boolean;
     nonce: string;
-    cspUserHeader: string | null;
     adapter: import("../../../platform/adapters/base.js").RuntimeAdapter | undefined;
     isVeryfrontDomain: boolean;
 }

package/esm/src/security/http/response/fluent-methods.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fluent-methods.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/fluent-methods.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEhF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,EAAE,OAAO,oCAAoC,EAAE,cAAc,GAAG,SAAS,CAAC;IACjF,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,gDAAgD;AAChD,wBAAgB,QAAQ,CAAC,CAAC,SAAS,oBAAoB,EACrD,IAAI,EAAE,CAAC,EACP,GAAG,EAAE,OAAO,EACZ,UAAU,CAAC,EAAE,OAAO,GAAG,cAAc,GACpC,CAAC,CAOH;AAED,wCAAwC;AACxC,wBAAsB,aAAa,CAAC,CAAC,SAAS,oBAAoB,EAChE,IAAI,EAAE,CAAC,EACP,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,CAAC,CAAC,CAOZ;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,CAAC,SAAS,oBAAoB,EACzD,IAAI,EAAE,CAAC,EACP,MAAM,CAAC,EAAE,cAAc,EACvB,GAAG,CAAC,EAAE,OAAO,GACZ,CAAC,CAeH;AAED,oDAAoD;AACpD,wBAAgB,SAAS,CAAC,CAAC,SAAS,oBAAoB,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,aAAa,GAAG,CAAC,CAa7F;AAED,sBAAsB;AACtB,wBAAgB,QAAQ,CAAC,CAAC,SAAS,oBAAoB,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,CAGjF;AAED,yBAAyB;AACzB,wBAAgB,WAAW,CAAC,CAAC,SAAS,oBAAoB,EACxD,IAAI,EAAE,CAAC,EACP,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5C,CAAC,CAUH;AAED,0BAA0B;AAC1B,wBAAgB,UAAU,CAAC,CAAC,SAAS,oBAAoB,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,CAGrF;AAED,qDAAqD;AACrD,wBAAgB,eAAe,CAAC,CAAC,SAAS,oBAAoB,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAU1E;AAED,4CAA4C;AAC5C,wBAAgB,SAAS,CAAC,CAAC,SAAS,oBAAoB,EACtD,IAAI,EAAE,CAAC,EACP,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GACzB,CAAC,CAKH"}
+{"version":3,"file":"fluent-methods.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/fluent-methods.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEhF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,oCAAoC,EAAE,cAAc,GAAG,SAAS,CAAC;IACjF,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,gDAAgD;AAChD,wBAAgB,QAAQ,CAAC,CAAC,SAAS,oBAAoB,EACrD,IAAI,EAAE,CAAC,EACP,GAAG,EAAE,OAAO,EACZ,UAAU,CAAC,EAAE,OAAO,GAAG,cAAc,GACpC,CAAC,CAOH;AAED,wCAAwC;AACxC,wBAAsB,aAAa,CAAC,CAAC,SAAS,oBAAoB,EAChE,IAAI,EAAE,CAAC,EACP,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,CAAC,CAAC,CAOZ;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,CAAC,SAAS,oBAAoB,EACzD,IAAI,EAAE,CAAC,EACP,MAAM,CAAC,EAAE,cAAc,EACvB,GAAG,CAAC,EAAE,OAAO,GACZ,CAAC,CAcH;AAED,oDAAoD;AACpD,wBAAgB,SAAS,CAAC,CAAC,SAAS,oBAAoB,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,aAAa,GAAG,CAAC,CAa7F;AAED,sBAAsB;AACtB,wBAAgB,QAAQ,CAAC,CAAC,SAAS,oBAAoB,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,CAGjF;AAED,yBAAyB;AACzB,wBAAgB,WAAW,CAAC,CAAC,SAAS,oBAAoB,EACxD,IAAI,EAAE,CAAC,EACP,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5C,CAAC,CAUH;AAED,0BAA0B;AAC1B,wBAAgB,UAAU,CAAC,CAAC,SAAS,oBAAoB,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,CAGrF;AAED,qDAAqD;AACrD,wBAAgB,eAAe,CAAC,CAAC,SAAS,oBAAoB,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAU1E;AAED,4CAA4C;AAC5C,wBAAgB,SAAS,CAAC,CAAC,SAAS,oBAAoB,EACtD,IAAI,EAAE,CAAC,EACP,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GACzB,CAAC,CAKH"}

package/esm/src/security/http/response/fluent-methods.js

@@ -25,7 +25,7 @@ export async function withCORSAsync(req) {
 }
 /** Apply security headers (CSP, COOP, CORP, COEP) and optionally set CSRF cookie */
 export function withSecurity(config, req) {
-    applySecurityHeaders(this.headers, this.isDev, this.nonce, this.cspUserHeader, config ?? this.securityConfig, this.adapter, this.isVeryfrontDomain);
+    applySecurityHeaders(this.headers, this.isDev, this.nonce, config ?? this.securityConfig, this.adapter, this.isVeryfrontDomain);
     if (req) {
         const secConfig = config ?? this.securityConfig;
         applyCsrfCookie(req, this.headers, secConfig?.csrf);

package/esm/src/security/http/response/security-handler.d.ts

@@ -8,8 +8,16 @@ import type { SecurityConfig } from "./types.js";
 export declare const SECURITY_POLICY_RESPONSE_HEADER_NAMES: readonly ["content-security-policy", "cross-origin-embedder-policy", "cross-origin-opener-policy", "cross-origin-resource-policy", "referrer-policy", "strict-transport-security", "x-content-type-options", "x-frame-options", "x-xss-protection"];
 export declare function isSecurityPolicyResponseHeaderName(name: string): boolean;
 export declare function generateNonce(): string;
-export declare function serializeCSPDirectives(csp: SecurityConfig["csp"], nonce?: string): string | null;
-export declare function buildCSP(isDev: boolean, nonce: string, cspUserHeader: string | null, config?: SecurityConfig | null, adapter?: RuntimeAdapter, isVeryfrontDomain?: boolean): string;
+/**
+ * Build the served policy: the platform floor with project sources merged in.
+ *
+ * The floor is enforced, not opt-in — hosting means a project that never
+ * configures anything still gets a baseline. Project configuration can only
+ * add to it, or drop the baseline class of a directive with `null`. Producing
+ * a policy that omits required sources needs `VERYFRONT_CSP`, an ops-level
+ * decision that is deliberately unreachable from project config.
+ */
+export declare function buildCSP(isDev: boolean, nonce: string, config?: SecurityConfig | null, adapter?: RuntimeAdapter, isVeryfrontDomain?: boolean): string;
 export declare function getSecurityHeader(headerName: string, defaultValue: string, config?: SecurityConfig | null, adapter?: RuntimeAdapter): string;
-export declare function applySecurityHeaders(headers: Headers, isDev: boolean, nonce: string, cspUserHeader: string | null, config?: SecurityConfig | null, adapter?: RuntimeAdapter, isVeryfrontDomain?: boolean): void;
+export declare function applySecurityHeaders(headers: Headers, isDev: boolean, nonce: string, config?: SecurityConfig | null, adapter?: RuntimeAdapter, isVeryfrontDomain?: boolean): void;
 //# sourceMappingURL=security-handler.d.ts.map

package/esm/src/security/http/response/security-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/security-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AASzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKjD;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,qPAYjD,CAAC;AAMF,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExE;AAQD,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAoED,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,EAC1B,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CAef;AAED,wBAAgB,QAAQ,CACtB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,MAAM,CAiBR;AAED,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CAMR;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,IAAI,CAqFN"}
+{"version":3,"file":"security-handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/security-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAUzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKjD;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,qPAYjD,CAAC;AAMF,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExE;AAQD,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAwKD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,MAAM,CAWR;AAED,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CAMR;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,IAAI,CAqFN"}