veryfront 0.1.1213 → 0.1.1214

package/esm/src/platform/adapters/token/veryfront/types.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Token Storage Adapter Types
+ *
+ * Defines the interface for token storage backends.
+ * Tokens are encrypted client-side before being sent to the backend.
+ */
+export declare const DEFAULT_TOKEN_STORAGE_REQUEST_TIMEOUT_MS = 30000;
+/**
+ * Token storage adapter interface
+ *
+ * Simple key-value interface for storing encrypted tokens.
+ * Keys are formatted as "{userId}:{serviceId}" (e.g., "user123:gmail").
+ * Values are encrypted token blobs (client encrypts before sending).
+ */
+export interface TokenStorageAdapter {
+    /** Get encrypted token by key */
+    get(key: string): Promise<string | null>;
+    /** Set encrypted token by key (upsert) */
+    set(key: string, value: string): Promise<void>;
+    /** Delete token by key (idempotent) */
+    delete(key: string): Promise<void>;
+    /** List all keys with optional prefix filter */
+    list?(prefix?: string): Promise<string[]>;
+    /** Initialize the adapter (e.g., verify connection) */
+    initialize?(): Promise<void>;
+    /** Cleanup resources */
+    dispose?(): void;
+}
+/** Veryfront Cloud token-storage options. */
+export interface VeryfrontTokenStorageOptions {
+    /** API token for authentication */
+    apiToken: string;
+    /** Project slug */
+    projectSlug: string;
+    /** API base URL (defaults to production) */
+    apiBaseUrl?: string;
+    /** Per-request timeout in milliseconds. Defaults to 30000ms. */
+    timeoutMs?: number;
+    /** Retry configuration */
+    retry?: {
+        /** Retries after the initial request, from 0 through 9. */
+        maxRetries?: number;
+        /** Initial retry delay in whole milliseconds. */
+        initialDelay?: number;
+        /** Maximum retry delay in whole milliseconds. */
+        maxDelay?: number;
+    };
+}
+/**
+ * Configuration for token storage adapters.
+ *
+ * The discriminator is optional only for the empty/default memory config.
+ * Cloud options can never be combined with, or silently downgraded to, the
+ * in-memory adapter.
+ */
+export type TokenStorageAdapterConfig = {
+    type?: "memory";
+    veryfront?: never;
+} | {
+    type: "veryfront-api";
+    veryfront: VeryfrontTokenStorageOptions;
+};
+/**
+ * Internal config with defaults applied
+ */
+export interface VeryfrontTokenConfig {
+    apiBaseUrl: string;
+    apiToken: string;
+    projectSlug: string;
+    /** Request timeout in milliseconds. */
+    timeoutMs: number;
+    retry: {
+        maxRetries: number;
+        initialDelay: number;
+        maxDelay: number;
+    };
+}
+/**
+ * Create verified config from adapter config
+ */
+export declare function createTokenConfig(config: TokenStorageAdapterConfig): VeryfrontTokenConfig;
+export declare function assertTokenStorageKey(key: string): void;
+export declare function assertTokenStoragePrefix(prefix: string | undefined): void;
+export declare function assertTokenStorageValue(value: string): void;
+export { TOKEN_STORAGE_ERROR } from "../../../../errors/index.js";
+//# sourceMappingURL=types.d.ts.map

package/esm/src/platform/adapters/token/veryfront/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/src/platform/adapters/token/veryfront/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,eAAO,MAAM,wCAAwC,QAAS,CAAC;AAG/D;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,iCAAiC;IACjC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEzC,0CAA0C;IAC1C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C,uCAAuC;IACvC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnC,gDAAgD;IAChD,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE1C,uDAAuD;IACvD,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7B,wBAAwB;IACxB,OAAO,CAAC,IAAI,IAAI,CAAC;CAClB;AAED,6CAA6C;AAC7C,MAAM,WAAW,4BAA4B;IAC3C,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,KAAK,CAAC,EAAE;QACN,2DAA2D;QAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iDAAiD;QACjD,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,iDAAiD;QACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED;;;;;;GAMG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;IAAC,SAAS,CAAC,EAAE,KAAK,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,4BAA4B,CAAA;CAAE,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE;QACL,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAgBD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,yBAAyB,GAAG,oBAAoB,CAiCzF;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEvD;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAGzE;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAI3D;AA8BD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC"}

package/esm/src/platform/adapters/token/veryfront/types.js

@@ -0,0 +1,81 @@
+/**
+ * Token Storage Adapter Types
+ *
+ * Defines the interface for token storage backends.
+ * Tokens are encrypted client-side before being sent to the backend.
+ */
+import { createError, toError } from "../../../../errors/index.js";
+import { normalizeVeryfrontApiRetryConfig } from "../../../../utils/config-resource-limits.js";
+import { normalizeTimerDurationMs } from "../../../../utils/timer.js";
+export const DEFAULT_TOKEN_STORAGE_REQUEST_TIMEOUT_MS = 30_000;
+const MAX_TOKEN_STORAGE_KEY_CODE_UNITS = 4_096;
+function requireVeryfrontConfig(config) {
+    const veryfront = config.veryfront;
+    if (veryfront)
+        return veryfront;
+    throw toError(createError({
+        type: "config",
+        message: "Veryfront token adapter requires veryfront configuration",
+    }));
+}
+/**
+ * Create verified config from adapter config
+ */
+export function createTokenConfig(config) {
+    const veryfront = requireVeryfrontConfig(config);
+    const apiToken = veryfront.apiToken;
+    if (!isNonBlankString(apiToken)) {
+        throw toError(createError({
+            type: "config",
+            message: "Veryfront token adapter requires apiToken",
+        }));
+    }
+    const projectSlug = veryfront.projectSlug;
+    if (!isNonBlankString(projectSlug)) {
+        throw toError(createError({
+            type: "config",
+            message: "Veryfront token adapter requires projectSlug",
+        }));
+    }
+    return {
+        apiBaseUrl: veryfront.apiBaseUrl ?? "https://api.veryfront.com",
+        apiToken,
+        projectSlug,
+        timeoutMs: normalizeTimerDurationMs(veryfront.timeoutMs ?? DEFAULT_TOKEN_STORAGE_REQUEST_TIMEOUT_MS, "Token storage timeoutMs"),
+        retry: normalizeVeryfrontApiRetryConfig(veryfront.retry),
+    };
+}
+export function assertTokenStorageKey(key) {
+    assertBoundedTokenStorageIdentifier(key, "key", false);
+}
+export function assertTokenStoragePrefix(prefix) {
+    if (prefix === undefined)
+        return;
+    assertBoundedTokenStorageIdentifier(prefix, "prefix", true);
+}
+export function assertTokenStorageValue(value) {
+    if (typeof value !== "string") {
+        throw new TypeError("Token storage value must be a string");
+    }
+}
+function isNonBlankString(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+function assertBoundedTokenStorageIdentifier(value, label, allowEmpty) {
+    if (typeof value !== "string") {
+        throw new TypeError(`Token storage ${label} must be a string`);
+    }
+    if (!allowEmpty && value.length === 0) {
+        throw new TypeError("Token storage key must be non-empty");
+    }
+    if (value.length > MAX_TOKEN_STORAGE_KEY_CODE_UNITS) {
+        throw new RangeError(`Token storage ${label} must not exceed ${MAX_TOKEN_STORAGE_KEY_CODE_UNITS} code units`);
+    }
+    for (let index = 0; index < value.length; index++) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit <= 0x1f || codeUnit === 0x7f) {
+            throw new TypeError(`Token storage ${label} must not contain control characters`);
+        }
+    }
+}
+export { TOKEN_STORAGE_ERROR } from "../../../../errors/index.js";

package/esm/src/platform/compat/http/pinned-fetch.d.ts

@@ -7,7 +7,7 @@
  * Client identity for guarded egress, standing in for the runtime-supplied
  * `user-agent` (`node`, `Deno/x.y.z`) that this transport cannot inherit.
  */
-export declare const DEFAULT_OUTBOUND_USER_AGENT = "veryfront/0.1.1213";
+export declare const DEFAULT_OUTBOUND_USER_AGENT = "veryfront/0.1.1214";
 /**
  * Fill in the request headers a plain `fetch` attaches on its own, leaving any
  * the caller set untouched. This transport talks to `node:http` directly, so

package/esm/src/security/http/config.d.ts

@@ -11,6 +11,11 @@ export interface DeriveSecurityContextOptions {
      * classification may override it explicitly.
      */
     productionDefaults?: boolean;
+    /**
+     * Origins derived from the project's released source. Platform-supplied;
+     * anything a project config carries under this name is discarded.
+     */
+    derivedCsp?: SecurityConfig["derivedCsp"];
 }
 /**
  * Check a standalone security configuration against the canonical project

package/esm/src/security/http/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQ7D,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAwLD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,cAAc,CAO/E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAIhC;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,CAAC,EAAE,eAAe,EACrB,OAAO,GAAE,4BAAiC,GACzC,sBAAsB,CAiBxB;AAED,qBAAa,oBAAoB;IAM7B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,iBAAiB;IAR3B,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,WAAW,CAA8B;gBAGvC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,cAAc,CAAC,EAAE,eAAe,YAAA,EAChC,iBAAiB,UAAQ;IAG7B,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;YAqBrB,IAAI;IAKlB,OAAO,CAAC,WAAW;IAiBnB,iBAAiB,IAAI,cAAc,GAAG,IAAI;IAI1C,aAAa,IAAI,cAAc,CAAC,MAAM,CAAC;IAIvC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,MAAwB,GAAG,MAAM;IAIjE,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;CAQpE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQ7D,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;CAC3C;AA4LD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,cAAc,CAO/E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAIhC;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,CAAC,EAAE,eAAe,EACrB,OAAO,GAAE,4BAAiC,GACzC,sBAAsB,CA4BxB;AAED,qBAAa,oBAAoB;IAM7B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,iBAAiB;IAR3B,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,WAAW,CAA8B;gBAGvC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,cAAc,CAAC,EAAE,eAAe,YAAA,EAChC,iBAAiB,UAAQ;IAG7B,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;YAqBrB,IAAI;IAKlB,OAAO,CAAC,WAAW;IAiBnB,iBAAiB,IAAI,cAAc,GAAG,IAAI;IAI1C,aAAa,IAAI,cAAc,CAAC,MAAM,CAAC;IAIvC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,MAAwB,GAAG,MAAM;IAIjE,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;CAQpE"}

package/esm/src/security/http/config.js

@@ -160,8 +160,12 @@ function readProductionDefaults(options) {
         const prototype = Object.getPrototypeOf(options);
         if (prototype !== Object.prototype && prototype !== null)
             return invalidSecurityConfig();
+        // Allowlisted rather than ignored: this object reaches a security decision,
+        // so an unrecognised key is a caller mistake worth failing on, not a
+        // silently discarded one.
+        const allowed = new Set(["productionDefaults", "derivedCsp"]);
         const keys = Reflect.ownKeys(options);
-        if (keys.some((key) => key !== "productionDefaults"))
+        if (keys.some((key) => !allowed.has(key)))
             return invalidSecurityConfig();
         const descriptor = Object.getOwnPropertyDescriptor(options, "productionDefaults");
         if (!descriptor)
@@ -228,6 +232,17 @@ export function deriveSecurityContext(cfg, options = {}) {
     if (normalized.csrf === undefined && productionDefaults) {
         normalized.csrf = true;
     }
+    // Assigned unconditionally, never merged. `SecurityConfig` carries an index
+    // signature, so the clone above would happily copy a `derivedCsp` a project
+    // wrote in its own config; overwriting here makes the platform the only
+    // author of this layer. Deleting when absent keeps a stale project value
+    // from surviving as the derived set.
+    if (options.derivedCsp && Object.keys(options.derivedCsp).length > 0) {
+        normalized.derivedCsp = options.derivedCsp;
+    }
+    else {
+        delete normalized.derivedCsp;
+    }
     const securityConfig = Object.freeze(normalized);
     return Object.freeze({
         securityConfig,

package/esm/src/security/http/derived-csp-cache.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Per-release cache for {@link deriveCspOriginsFromSource}.
+ *
+ * Derivation reads every source file a release pins, which is far too much work
+ * to repeat per response but exactly the right amount to do once per release:
+ * the input is immutable for a given content version, so the result is too.
+ *
+ * @module security/http/derived-csp-cache
+ */
+import { type DerivationSourceFile, type DerivedCspOrigins } from "./derived-csp-origins.js";
+export interface DerivedCspLookup {
+    /** Project scope, so two projects on one pod cannot share an entry. */
+    readonly projectScope: string;
+    /**
+     * Content version, as `resolveStyleContentVersion` spells it. A branch
+     * version is stable while its content changes, which is why the caller passes
+     * a snapshot identity rather than a branch name where one is available.
+     */
+    readonly contentVersion: string;
+    /** Reads the release's source files. Called only on a miss. */
+    readonly loadSourceFiles: () => Promise<readonly DerivationSourceFile[] | null>;
+}
+/**
+ * Derived origins for a content version, computing them at most once.
+ *
+ * Failure is not fatal: a project whose sources cannot be read gets an empty
+ * derivation, which leaves it exactly where it was before this existed -- the
+ * platform floor plus whatever `security.csp` declares.
+ */
+export declare function getDerivedCspOrigins(lookup: DerivedCspLookup): Promise<DerivedCspOrigins>;
+/** @internal Test seam. */
+export declare function __clearDerivedCspCacheForTests(): void;
+//# sourceMappingURL=derived-csp-cache.d.ts.map

package/esm/src/security/http/derived-csp-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derived-csp-cache.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/derived-csp-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EACL,KAAK,oBAAoB,EAEzB,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAuClC,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,eAAe,EAAE,MAAM,OAAO,CAAC,SAAS,oBAAoB,EAAE,GAAG,IAAI,CAAC,CAAC;CACjF;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,iBAAiB,CAAC,CAmB5B;AA+BD,2BAA2B;AAC3B,wBAAgB,8BAA8B,IAAI,IAAI,CAGrD"}

package/esm/src/security/http/derived-csp-cache.js

@@ -0,0 +1,101 @@
+/**
+ * Per-release cache for {@link deriveCspOriginsFromSource}.
+ *
+ * Derivation reads every source file a release pins, which is far too much work
+ * to repeat per response but exactly the right amount to do once per release:
+ * the input is immutable for a given content version, so the result is too.
+ *
+ * @module security/http/derived-csp-cache
+ */
+import { registerCache } from "../../utils/memory/index.js";
+import { serverLogger } from "../../utils/logger/logger.js";
+import { deriveCspOriginsFromSource, } from "./derived-csp-origins.js";
+const logger = serverLogger.component("derived-csp");
+/** Bounded so a fleet of projects cannot grow this without limit. */
+const MAX_ENTRIES = 200;
+const EMPTY = Object.freeze({});
+const cache = new Map();
+/**
+ * Derivations currently running, keyed exactly as the resolved cache is.
+ *
+ * A key is coldest immediately after a release, when every pod serves that
+ * content version for the first time. Without this, each concurrent request for
+ * the same key reads and scans the whole source set; with it the first caller
+ * does the work and the rest await its result.
+ */
+const inFlight = new Map();
+registerCache("derived-csp-origins", () => ({
+    name: "derived-csp-origins",
+    entries: cache.size,
+    maxEntries: MAX_ENTRIES,
+}));
+function remember(key, value) {
+    // Insertion-ordered eviction: the oldest content version is the one least
+    // likely to still be serving traffic.
+    while (cache.size >= MAX_ENTRIES) {
+        const oldest = cache.keys().next().value;
+        if (oldest === undefined)
+            break;
+        cache.delete(oldest);
+    }
+    cache.set(key, value);
+    return value;
+}
+/**
+ * Derived origins for a content version, computing them at most once.
+ *
+ * Failure is not fatal: a project whose sources cannot be read gets an empty
+ * derivation, which leaves it exactly where it was before this existed -- the
+ * platform floor plus whatever `security.csp` declares.
+ */
+export function getDerivedCspOrigins(lookup) {
+    // NUL separates the two components because neither can contain one, so no
+    // scope/version pair can collide with another by concatenation. Written as an
+    // escape rather than a raw byte: a literal NUL in the source makes the file
+    // binary to grep and friends.
+    const key = `${lookup.projectScope}\u0000${lookup.contentVersion}`;
+    const cached = cache.get(key);
+    if (cached)
+        return Promise.resolve(cached);
+    const pending = inFlight.get(key);
+    if (pending)
+        return pending;
+    const derivation = deriveOnce(key, lookup);
+    inFlight.set(key, derivation);
+    return derivation.finally(() => {
+        // Clear only our own entry: after an eviction a later call may already have
+        // started a fresh derivation under the same key.
+        if (inFlight.get(key) === derivation)
+            inFlight.delete(key);
+    });
+}
+async function deriveOnce(key, lookup) {
+    let files;
+    try {
+        files = await lookup.loadSourceFiles();
+    }
+    catch (error) {
+        logger.debug("Could not read sources for CSP derivation", {
+            projectScope: lookup.projectScope,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return remember(key, EMPTY);
+    }
+    if (!files || files.length === 0)
+        return remember(key, EMPTY);
+    const derived = deriveCspOriginsFromSource(files);
+    const count = derived["img-src"]?.length ?? 0;
+    if (count > 0) {
+        logger.debug("Derived CSP origins from project source", {
+            projectScope: lookup.projectScope,
+            contentVersion: lookup.contentVersion,
+            originCount: count,
+        });
+    }
+    return remember(key, derived);
+}
+/** @internal Test seam. */
+export function __clearDerivedCspCacheForTests() {
+    cache.clear();
+    inFlight.clear();
+}

package/esm/src/security/http/derived-csp-origins.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Derive a project's CSP origins from the source it publishes.
+ *
+ * The platform floor lists what the *platform* emits. Anything a project loads
+ * from elsewhere -- a stock-photo host, its own asset CDN, a video origin --
+ * has to be admitted separately, and until now the only way to do that was
+ * `security.csp`. That made a working site depend on configuration the project
+ * had no reason to know it needed: an audit of the hosted fleet found ~100
+ * projects loading blocked assets and two that had declared anything.
+ *
+ * This module closes that gap by reading the origins out of the project's own
+ * released source, so `security.csp` becomes an override for what static
+ * analysis cannot see rather than a prerequisite for a site that works.
+ *
+ * Two properties make that safe rather than merely convenient:
+ *
+ * 1. **Only passive-content directives are derived.** `img-src`, `media-src`
+ *    and `font-src` decide whether a logo renders. `script-src` and
+ *    `connect-src` decide whether a third party can execute code in the page
+ *    or receive data from it. Deriving those would mean anyone able to
+ *    influence source -- a compromised dependency, a merged pull request,
+ *    CMS-authored MDX -- could grant themselves execution or an exfiltration
+ *    endpoint, collapsing two independent barriers into one. Every project in
+ *    the audit was fixed by passive directives alone.
+ *
+ * 2. **Origins come from an immutable release.** Derivation runs over the
+ *    source a release pins, not over live content, so a script injected at
+ *    runtime cannot extend the allowlist it is subject to.
+ *
+ * Derivation is deliberately incomplete. A URL assembled at runtime -- a
+ * template literal, a CMS field, an environment variable -- is invisible here,
+ * and those projects still declare `security.csp`. Under-deriving costs a
+ * broken image; over-deriving costs the policy its meaning.
+ *
+ * @module security/http/derived-csp-origins
+ */
+/** Directives this module is permitted to contribute to. */
+export declare const DERIVABLE_CSP_DIRECTIVES: readonly ["img-src", "media-src", "font-src"];
+export type DerivableCspDirective = (typeof DERIVABLE_CSP_DIRECTIVES)[number];
+export type DerivedCspOrigins = Readonly<Partial<Record<DerivableCspDirective, readonly string[]>>>;
+/** A source file as the release stores it. */
+export interface DerivationSourceFile {
+    readonly path: string;
+    readonly content?: string;
+}
+/**
+ * Collect the passive-content origins a project's source references.
+ *
+ * Pure over its input: callers hand it the file set a release pins, and the
+ * result is stable for that set, which is what lets it be computed once per
+ * release rather than per request.
+ */
+export declare function deriveCspOriginsFromSource(files: readonly DerivationSourceFile[]): DerivedCspOrigins;
+//# sourceMappingURL=derived-csp-origins.d.ts.map

package/esm/src/security/http/derived-csp-origins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derived-csp-origins.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/derived-csp-origins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,4DAA4D;AAC5D,eAAO,MAAM,wBAAwB,+CAEpC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CACtC,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAC1D,CAAC;AAEF,8CAA8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AA2ED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,SAAS,oBAAoB,EAAE,GACrC,iBAAiB,CAsCnB"}

package/esm/src/security/http/derived-csp-origins.js

@@ -0,0 +1,156 @@
+/**
+ * Derive a project's CSP origins from the source it publishes.
+ *
+ * The platform floor lists what the *platform* emits. Anything a project loads
+ * from elsewhere -- a stock-photo host, its own asset CDN, a video origin --
+ * has to be admitted separately, and until now the only way to do that was
+ * `security.csp`. That made a working site depend on configuration the project
+ * had no reason to know it needed: an audit of the hosted fleet found ~100
+ * projects loading blocked assets and two that had declared anything.
+ *
+ * This module closes that gap by reading the origins out of the project's own
+ * released source, so `security.csp` becomes an override for what static
+ * analysis cannot see rather than a prerequisite for a site that works.
+ *
+ * Two properties make that safe rather than merely convenient:
+ *
+ * 1. **Only passive-content directives are derived.** `img-src`, `media-src`
+ *    and `font-src` decide whether a logo renders. `script-src` and
+ *    `connect-src` decide whether a third party can execute code in the page
+ *    or receive data from it. Deriving those would mean anyone able to
+ *    influence source -- a compromised dependency, a merged pull request,
+ *    CMS-authored MDX -- could grant themselves execution or an exfiltration
+ *    endpoint, collapsing two independent barriers into one. Every project in
+ *    the audit was fixed by passive directives alone.
+ *
+ * 2. **Origins come from an immutable release.** Derivation runs over the
+ *    source a release pins, not over live content, so a script injected at
+ *    runtime cannot extend the allowlist it is subject to.
+ *
+ * Derivation is deliberately incomplete. A URL assembled at runtime -- a
+ * template literal, a CMS field, an environment variable -- is invisible here,
+ * and those projects still declare `security.csp`. Under-deriving costs a
+ * broken image; over-deriving costs the policy its meaning.
+ *
+ * @module security/http/derived-csp-origins
+ */
+/** Directives this module is permitted to contribute to. */
+export const DERIVABLE_CSP_DIRECTIVES = Object.freeze(["img-src", "media-src", "font-src"]);
+/**
+ * Cap on how much of one file is scanned. A generated bundle or an inlined
+ * data blob can be megabytes, and scanning it yields nothing a hand-written
+ * source file would not.
+ *
+ * Measured in UTF-16 code units, matching `String.prototype.length`, because
+ * that is the unit the regex engine actually steps through -- 512K code units
+ * is the same amount of scanning whether they are ASCII or CJK. A UTF-8 byte
+ * cap would read as the more natural bound but would not correspond to the
+ * cost being bounded, and computing it means walking the string to decide how
+ * much of the string to walk.
+ */
+const MAX_SCANNED_CHARS_PER_FILE = 512 * 1024;
+/**
+ * Upper bound on distinct origins, so a generated file cannot inflate the
+ * policy. Origins are ranked before the cap applies -- see
+ * {@link deriveCspOriginsFromSource}.
+ */
+const MAX_DERIVED_ORIGINS = 32;
+/**
+ * Every absolute https URL in the source, whatever syntax surrounds it.
+ *
+ * An earlier version of this matched by position -- `<img src>`, `url()`,
+ * `poster` -- on the theory that knowing which element referenced a URL would
+ * let each origin land in exactly the right directive. Measured against real
+ * released content that recovers about a third of the references. The same
+ * project reaches its asset host through `<img src>`, a JSX `imageSrc` prop,
+ * YAML frontmatter, markdown `![](url)`, a bare string in a props array, a
+ * `srcFallback` key, and `href` on a favicon link. Partial derivation is worse
+ * than none: the site still breaks, but now it looks configured.
+ *
+ * Recall is what protects the project here, and precision is not what protects
+ * the visitor -- the passive/active split is. An origin admitted for images
+ * that is never referenced costs nothing; one that is missed costs a broken
+ * page.
+ */
+const HTTPS_URL_PATTERN = /https:\/\/[a-zA-Z0-9.-]+(?::\d{1,5})?(?![a-zA-Z0-9.:-])/g;
+/**
+ * Reduce a URL to the `scheme://host[:port]` form CSP matches on.
+ *
+ * Returns undefined for anything unparseable, which is the same as declining
+ * to derive from it.
+ */
+function toCspOrigin(rawUrl) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed.protocol !== "https:")
+        return undefined;
+    if (!parsed.hostname)
+        return undefined;
+    // A hostname with no dot is a bare label, not a public origin; a wildcard is
+    // an unfilled template. Neither belongs in a served policy.
+    if (!parsed.hostname.includes("."))
+        return undefined;
+    if (parsed.hostname.includes("*"))
+        return undefined;
+    return parsed.port ? `https://${parsed.hostname}:${parsed.port}` : `https://${parsed.hostname}`;
+}
+function scanContent(content, into) {
+    const scanned = content.length > MAX_SCANNED_CHARS_PER_FILE
+        ? content.slice(0, MAX_SCANNED_CHARS_PER_FILE)
+        : content;
+    for (const match of scanned.matchAll(HTTPS_URL_PATTERN)) {
+        const origin = toCspOrigin(match[0]);
+        if (origin)
+            into.set(origin, (into.get(origin) ?? 0) + 1);
+    }
+}
+/**
+ * Collect the passive-content origins a project's source references.
+ *
+ * Pure over its input: callers hand it the file set a release pins, and the
+ * result is stable for that set, which is what lets it be computed once per
+ * release rather than per request.
+ */
+export function deriveCspOriginsFromSource(files) {
+    const counts = new Map();
+    for (const file of files) {
+        if (!file?.content)
+            continue;
+        scanContent(file.content, counts);
+    }
+    if (counts.size === 0)
+        return Object.freeze({});
+    // Rank by how often an origin is referenced before applying the cap.
+    //
+    // Truncating in discovery order looked fine until it was run over a real
+    // project: one article yielded its asset CDN plus five hosts that appear
+    // only as prose links. Across a content site those one-off links vastly
+    // outnumber asset hosts, so an arbitrary cut can drop the very origin the
+    // site depends on and silently reintroduce the breakage this exists to
+    // prevent. An asset host is referenced from every page that uses it; a link
+    // in body copy is referenced once. Frequency separates them cleanly.
+    //
+    // Ties break alphabetically so the result stays deterministic for a given
+    // release, which is what lets the header and anything keyed on it be cached.
+    const ranked = [...counts.entries()]
+        .sort(([originA, countA], [originB, countB]) => countB - countA || originA.localeCompare(originB))
+        .slice(0, MAX_DERIVED_ORIGINS)
+        .map(([origin]) => origin)
+        .sort();
+    // Every retained origin is granted to all three passive directives rather
+    // than routed between them. Splitting by file extension would reintroduce a
+    // failure mode with no compensating benefit: an origin allowed for images
+    // but not media is not a boundary anyone reasons about, while guessing wrong
+    // leaves the asset blocked. The boundary that matters -- passive content
+    // versus script and connect -- is enforced by this list, not by the split.
+    const sorted = Object.freeze(ranked);
+    const derived = {};
+    for (const directive of DERIVABLE_CSP_DIRECTIVES)
+        derived[directive] = sorted;
+    return Object.freeze(derived);
+}

package/esm/src/security/http/response/security-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/security-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAYzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AASjD;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,4RAgBjD,CAAC;AAMF,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExE;AAkBD,wBAAgB,aAAa,IAAI,MAAM,CAItC;AA0KD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,MAAM,CAWR;AA0CD,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CAMR;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,IAAI,CA8GN"}
+{"version":3,"file":"security-handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/security-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAYzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AASjD;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,4RAgBjD,CAAC;AAMF,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExE;AAkBD,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAkLD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,MAAM,CAgBR;AA0CD,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CAMR;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,IAAI,CA8GN"}

package/esm/src/security/http/response/security-handler.js

@@ -149,7 +149,7 @@ function normalizeSources(sources) {
  * directive but never the required class, which is how a project hardens past
  * the floor without being able to break its own site.
  */
-function mergeCspDirectives(required, projectCsp, nonce) {
+function mergeCspDirectives(required, projectCsp, nonce, derived) {
     const project = new Map();
     for (const [key, value] of Object.entries(projectCsp ?? {})) {
         if (value === undefined)
@@ -177,16 +177,23 @@ function mergeCspDirectives(required, projectCsp, nonce) {
     const names = new Set([
         ...requiredByName.keys(),
         ...BASELINE_DIRECTIVES.keys(),
+        ...Object.keys(derived ?? {}),
         ...project.keys(),
     ]);
     const merged = Object.create(null);
     for (const name of names) {
         const configured = project.get(name);
         const baseline = configured === null ? [] : BASELINE_DIRECTIVES.get(name) ?? [];
+        // Derived origins sit above the floor and below project config, and follow
+        // the baseline's `null` semantics: a project that explicitly drops a
+        // directive means it, and static analysis must not put back what the
+        // project just said it does not want.
+        const derivedForName = configured === null ? [] : derived?.[name] ?? [];
         const additions = configured ?? [];
         merged[name] = normalizeSources([
             ...(requiredByName.get(name) ?? []),
             ...baseline,
+            ...derivedForName,
             ...additions,
         ]);
     }
@@ -219,7 +226,7 @@ export function buildCSP(isDev, nonce, config, adapter, isVeryfrontDomain) {
     // development allowance can never widen the production policy.
     if (isDev)
         return "";
-    return serializeDirectives(mergeCspDirectives(requiredDirectives(nonce, isVeryfrontDomain ?? false), config?.csp, nonce));
+    return serializeDirectives(mergeCspDirectives(requiredDirectives(nonce, isVeryfrontDomain ?? false), config?.csp, nonce, config?.derivedCsp));
 }
 /**
  * Whether the built policy is enforced or merely reported.

package/esm/src/security/sandbox/constants.d.ts

@@ -0,0 +1,3 @@
+export declare const DEFAULT_SANDBOX_TIMEOUT_MS = 5000;
+export declare const MAX_SANDBOX_CODE_SIZE = 1000000;
+//# sourceMappingURL=constants.d.ts.map

package/esm/src/security/sandbox/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAC/C,eAAO,MAAM,qBAAqB,UAAY,CAAC"}

package/esm/src/security/sandbox/constants.js

@@ -0,0 +1,2 @@
+export const DEFAULT_SANDBOX_TIMEOUT_MS = 5000;
+export const MAX_SANDBOX_CODE_SIZE = 1_000_000; // 1 MB