veryfront 0.1.1213 → 0.1.1214

package/esm/src/security/sandbox/deno-sandbox.d.ts

@@ -0,0 +1,71 @@
+export interface SandboxOptions {
+    timeoutMs?: number;
+    memoryLimitMb?: number;
+}
+/**
+ * Operator opt-in env var that allows {@link runInWorker} to execute on Node.js
+ * despite the lack of permission isolation. Read via {@link getHostEnv} so that
+ * a per-request project env overlay cannot enable unsafe execution from inside
+ * a tenant context.
+ *
+ * @internal Exported for testing.
+ */
+export declare const NODE_SANDBOX_ALLOW_UNSAFE_ENV = "VERYFRONT_NODE_SANDBOX_ALLOW_UNSAFE";
+/**
+ * Pure decision helper for the Node.js sandbox guard. Given the raw env-var
+ * value, decide whether to block execution on Node.
+ *
+ * Returns `true` only when the value is the literal string `"1"`. Any other
+ * value (including `"true"`, `"yes"`, whitespace, or empty string) keeps the
+ * guard active. Strict equality is intentional for a security opt-in.
+ *
+ * @internal Exported for testing only.
+ */
+export declare function isNodeSandboxAllowedUnsafe(envValue: string | undefined): boolean;
+/**
+ * Operator opt-in env var that allows {@link runInWorker} to execute on Bun
+ * despite the lack of permission isolation. Read via {@link getHostEnv} so that
+ * a per-request project env overlay cannot enable unsafe execution from inside
+ * a tenant context.
+ *
+ * @internal Exported for testing.
+ */
+export declare const BUN_SANDBOX_ALLOW_UNSAFE_ENV = "VERYFRONT_BUN_SANDBOX_ALLOW_UNSAFE";
+/**
+ * Pure decision helper for the Bun sandbox guard. Given the raw env-var
+ * value, decide whether to block execution on Bun.
+ *
+ * Returns `true` only when the value is the literal string `"1"`. Any other
+ * value (including `"true"`, `"yes"`, whitespace, or empty string) keeps the
+ * guard active. Strict equality is intentional for a security opt-in.
+ *
+ * @internal Exported for testing only.
+ */
+export declare function isBunSandboxAllowedUnsafe(envValue: string | undefined): boolean;
+/**
+ * Run untrusted JavaScript in an isolated Worker.
+ *
+ * ## Isolation model
+ *
+ * - **Deno (recommended):** the worker is spawned with `permissions: "none"`,
+ *   denying filesystem, network, env, and subprocess access. This is the
+ *   primary safe execution path.
+ * - **Node.js:** Node Workers do not support permission isolation. They
+ *   inherit full access to the filesystem, network, env vars, and built-in
+ *   modules. Only memory limits can be enforced. Because of this, the Node
+ *   path is **disabled by default** and throws {@link NOT_SUPPORTED}.
+ *   Operators who deliberately trust their input may set the env var
+ *   `VERYFRONT_NODE_SANDBOX_ALLOW_UNSAFE=1` to bypass the guard.
+ * - **Bun:** Bun Workers have the same lack of permission isolation as Node.js.
+ *   The Bun path is **disabled by default** and throws {@link NOT_SUPPORTED}.
+ *   Operators who deliberately trust their input may set the env var
+ *   `VERYFRONT_BUN_SANDBOX_ALLOW_UNSAFE=1` to bypass the guard.
+ *
+ * Callers SHOULD NOT pass untrusted code to this function on Node.js or Bun
+ * unless they have audited every caller and operator and accept the risk.
+ *
+ * @throws NOT_SUPPORTED on Node.js without the explicit opt-in env var.
+ * @throws NOT_SUPPORTED on Bun without the explicit opt-in env var.
+ */
+export declare function runInWorker<T = unknown>(code: string, options?: SandboxOptions): Promise<T>;
+//# sourceMappingURL=deno-sandbox.d.ts.map

package/esm/src/security/sandbox/deno-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deno-sandbox.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/deno-sandbox.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAYD;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,wCAAwC,CAAC;AAEnF;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEhF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,uCAAuC,CAAC;AAEjF;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE/E;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,WAAW,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CA6H/F"}

package/esm/src/security/sandbox/deno-sandbox.js

@@ -0,0 +1,184 @@
+import { DEFAULT_SANDBOX_TIMEOUT_MS, MAX_SANDBOX_CODE_SIZE } from "./constants.js";
+import { isCompiledBinary, serverLogger } from "../../utils/index.js";
+import { isBun, isDeno, isNode } from "../../platform/compat/runtime.js";
+import { getHostEnv } from "../../platform/compat/process/env.js";
+import { withSpan } from "../../observability/tracing/otlp-setup.js";
+import { INVALID_ARGUMENT, NOT_SUPPORTED, TIMEOUT_ERROR, UNKNOWN_ERROR } from "../../errors/index.js";
+/**
+ * Operator opt-in env var that allows {@link runInWorker} to execute on Node.js
+ * despite the lack of permission isolation. Read via {@link getHostEnv} so that
+ * a per-request project env overlay cannot enable unsafe execution from inside
+ * a tenant context.
+ *
+ * @internal Exported for testing.
+ */
+export const NODE_SANDBOX_ALLOW_UNSAFE_ENV = "VERYFRONT_NODE_SANDBOX_ALLOW_UNSAFE";
+/**
+ * Pure decision helper for the Node.js sandbox guard. Given the raw env-var
+ * value, decide whether to block execution on Node.
+ *
+ * Returns `true` only when the value is the literal string `"1"`. Any other
+ * value (including `"true"`, `"yes"`, whitespace, or empty string) keeps the
+ * guard active. Strict equality is intentional for a security opt-in.
+ *
+ * @internal Exported for testing only.
+ */
+export function isNodeSandboxAllowedUnsafe(envValue) {
+    return envValue === "1";
+}
+/**
+ * Operator opt-in env var that allows {@link runInWorker} to execute on Bun
+ * despite the lack of permission isolation. Read via {@link getHostEnv} so that
+ * a per-request project env overlay cannot enable unsafe execution from inside
+ * a tenant context.
+ *
+ * @internal Exported for testing.
+ */
+export const BUN_SANDBOX_ALLOW_UNSAFE_ENV = "VERYFRONT_BUN_SANDBOX_ALLOW_UNSAFE";
+/**
+ * Pure decision helper for the Bun sandbox guard. Given the raw env-var
+ * value, decide whether to block execution on Bun.
+ *
+ * Returns `true` only when the value is the literal string `"1"`. Any other
+ * value (including `"true"`, `"yes"`, whitespace, or empty string) keeps the
+ * guard active. Strict equality is intentional for a security opt-in.
+ *
+ * @internal Exported for testing only.
+ */
+export function isBunSandboxAllowedUnsafe(envValue) {
+    return envValue === "1";
+}
+/**
+ * Run untrusted JavaScript in an isolated Worker.
+ *
+ * ## Isolation model
+ *
+ * - **Deno (recommended):** the worker is spawned with `permissions: "none"`,
+ *   denying filesystem, network, env, and subprocess access. This is the
+ *   primary safe execution path.
+ * - **Node.js:** Node Workers do not support permission isolation. They
+ *   inherit full access to the filesystem, network, env vars, and built-in
+ *   modules. Only memory limits can be enforced. Because of this, the Node
+ *   path is **disabled by default** and throws {@link NOT_SUPPORTED}.
+ *   Operators who deliberately trust their input may set the env var
+ *   `VERYFRONT_NODE_SANDBOX_ALLOW_UNSAFE=1` to bypass the guard.
+ * - **Bun:** Bun Workers have the same lack of permission isolation as Node.js.
+ *   The Bun path is **disabled by default** and throws {@link NOT_SUPPORTED}.
+ *   Operators who deliberately trust their input may set the env var
+ *   `VERYFRONT_BUN_SANDBOX_ALLOW_UNSAFE=1` to bypass the guard.
+ *
+ * Callers SHOULD NOT pass untrusted code to this function on Node.js or Bun
+ * unless they have audited every caller and operator and accept the risk.
+ *
+ * @throws NOT_SUPPORTED on Node.js without the explicit opt-in env var.
+ * @throws NOT_SUPPORTED on Bun without the explicit opt-in env var.
+ */
+export function runInWorker(code, options = {}) {
+    if (typeof code !== "string") {
+        return Promise.reject(INVALID_ARGUMENT.create({ message: "Sandbox code must be a string" }));
+    }
+    if (code.length === 0) {
+        return Promise.reject(INVALID_ARGUMENT.create({ message: "Sandbox code cannot be empty" }));
+    }
+    const codeByteLength = new TextEncoder().encode(code).byteLength;
+    if (codeByteLength > MAX_SANDBOX_CODE_SIZE) {
+        return Promise.reject(INVALID_ARGUMENT.create({
+            message: `Sandbox code exceeds maximum size (${MAX_SANDBOX_CODE_SIZE} bytes)`,
+        }));
+    }
+    // SEC-008: Node Workers have no permission isolation. Refuse execution
+    // unless the operator has explicitly opted in via host env var. Use
+    // getHostEnv so a tenant project env overlay cannot enable this.
+    if (isNode && !isNodeSandboxAllowedUnsafe(getHostEnv(NODE_SANDBOX_ALLOW_UNSAFE_ENV))) {
+        return Promise.reject(NOT_SUPPORTED.create({
+            detail: "Sandbox execution is not safely supported on Node.js. The current " +
+                "implementation provides only memory limits, not permission isolation. " +
+                "Set VERYFRONT_NODE_SANDBOX_ALLOW_UNSAFE=1 to enable execution at your " +
+                "own risk, or run under Deno for full isolation.",
+        }));
+    }
+    // SEC-008: Bun Workers have no permission isolation (same risk as Node.js).
+    // Refuse execution unless the operator has explicitly opted in via host env
+    // var. Use getHostEnv so a tenant project env overlay cannot enable this.
+    if (isBun && !isBunSandboxAllowedUnsafe(getHostEnv(BUN_SANDBOX_ALLOW_UNSAFE_ENV))) {
+        return Promise.reject(NOT_SUPPORTED.create({
+            detail: "Sandbox execution is not safely supported on Bun. The current " +
+                "implementation provides no permission isolation. " +
+                "Set VERYFRONT_BUN_SANDBOX_ALLOW_UNSAFE=1 to enable execution at your " +
+                "own risk, or run under Deno for full isolation.",
+        }));
+    }
+    const timeoutMs = options.timeoutMs ?? DEFAULT_SANDBOX_TIMEOUT_MS;
+    return withSpan("security.sandbox.runInWorker", () => {
+        const workerOptions = { type: "module" };
+        if (isDeno)
+            workerOptions.deno = { permissions: "none" };
+        const { memoryLimitMb } = options;
+        if (typeof memoryLimitMb === "number") {
+            if (!Number.isFinite(memoryLimitMb) || memoryLimitMb <= 0) {
+                throw INVALID_ARGUMENT.create({
+                    detail: "Sandbox memoryLimitMb must be a positive, finite number",
+                });
+            }
+            if (!isNode) {
+                throw NOT_SUPPORTED.create({
+                    detail: "Sandbox memory limits are not supported in this runtime",
+                });
+            }
+            workerOptions.resourceLimits = {
+                ...workerOptions.resourceLimits,
+                maxOldGenerationSizeMb: Math.floor(memoryLimitMb),
+            };
+        }
+        const workerCode = `self.onmessage = async (e) => {` +
+            `  const { code } = e.data;` +
+            `  let result;` +
+            `  try { result = await (async () => {` +
+            `    return await (new Function(code))();` +
+            `  })(); } catch (error) {` +
+            `    self.postMessage({ error: String(error && error.message || error) });` +
+            `    return;` +
+            `  }` +
+            `  self.postMessage({ result });` +
+            `};`;
+        // Use data URL for compiled binaries (blob URLs don't work in deno compile)
+        // See: https://github.com/denoland/deno/issues/18327
+        const workerUrl = isCompiledBinary()
+            ? `data:text/javascript;base64,${btoa(workerCode)}`
+            : URL.createObjectURL(new Blob([workerCode], { type: "application/javascript" }));
+        const worker = new Worker(workerUrl, workerOptions);
+        function safeTerminate(logMessage, error) {
+            try {
+                worker.terminate();
+            }
+            catch (e) {
+                serverLogger.debug(logMessage, { error: error ?? e });
+            }
+        }
+        const promise = new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                safeTerminate("[sandbox] worker terminate failed");
+                reject(TIMEOUT_ERROR.create({ detail: "Sandbox timeout" }));
+            }, timeoutMs);
+            worker.onmessage = (e) => {
+                clearTimeout(timer);
+                const { result, error } = e.data ?? {};
+                if (error)
+                    reject(UNKNOWN_ERROR.create({ detail: error }));
+                else
+                    resolve(result);
+                safeTerminate("[sandbox] worker terminate failed");
+            };
+            worker.onerror = (e) => {
+                clearTimeout(timer);
+                reject(UNKNOWN_ERROR.create({ detail: String(e.message || e.error || "Worker error") }));
+                safeTerminate("[sandbox] worker terminate failed on error");
+            };
+        });
+        worker.postMessage({ code });
+        return promise;
+    }, {
+        "sandbox.timeoutMs": timeoutMs,
+        "sandbox.memoryLimitMb": options.memoryLimitMb ?? 0,
+    });
+}

package/esm/src/security/sandbox/permission-system.d.ts

@@ -0,0 +1,11 @@
+export type Permission = "net" | "fs" | "env" | "run" | "read" | "write";
+export interface PermissionRequest {
+    name: Permission;
+    host?: string;
+    path?: string;
+}
+export interface PermissionResult {
+    state: "granted" | "denied" | "prompt";
+}
+export declare function requestPermission(request: PermissionRequest): Promise<PermissionResult>;
+//# sourceMappingURL=permission-system.d.ts.map

package/esm/src/security/sandbox/permission-system.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-system.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/permission-system.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;CACxC;AAkGD,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,gBAAgB,CAAC,CA2B3B"}

package/esm/src/security/sandbox/permission-system.js

@@ -0,0 +1,85 @@
+import * as dntShim from "../../../_dnt.shims.js";
+import { serverLogger } from "../../utils/index.js";
+import { isDeno } from "../../platform/compat/runtime.js";
+import { withSpan } from "../../observability/tracing/otlp-setup.js";
+const logger = serverLogger.component("permissions");
+/**
+ * Access the Deno permissions API through a narrow, typed view.
+ * Returns null when not running under Deno or the API is unavailable.
+ */
+function getDenoPermissions() {
+    const denoGlobal = dntShim.dntGlobalThis.Deno;
+    const permissions = denoGlobal?.permissions;
+    if (!permissions || typeof permissions.request !== "function")
+        return null;
+    return permissions;
+}
+function createPermissionDescriptor(request) {
+    const { name, host, path } = request;
+    switch (name) {
+        case "net":
+            return host ? { name, host } : { name };
+        case "read":
+        case "write":
+            return path ? { name, path } : { name };
+        case "env":
+        case "run":
+            return { name };
+        case "fs":
+        default:
+            return null;
+    }
+}
+function requestDenoPermission(request) {
+    return withSpan("security.permissions.requestDeno", async () => {
+        const permissions = getDenoPermissions();
+        if (!isDeno || !permissions)
+            return { state: "denied" };
+        if (request.name === "fs") {
+            const path = request.path;
+            const readStatus = await permissions.request({ name: "read", path });
+            if (readStatus.state !== "granted")
+                return { state: readStatus.state };
+            const writeStatus = await permissions.request({ name: "write", path });
+            return { state: writeStatus.state };
+        }
+        const descriptor = createPermissionDescriptor(request);
+        if (!descriptor) {
+            logger.warn("Unsupported permission request", request);
+            return { state: "denied" };
+        }
+        const status = await permissions.request(descriptor);
+        return { state: status.state };
+    }, { "permission.name": request.name });
+}
+let warnedNonDenoAutoGrant = false;
+function warnNonDenoAutoGrantOnce() {
+    if (warnedNonDenoAutoGrant)
+        return;
+    warnedNonDenoAutoGrant = true;
+    logger.warn("Permission sandbox is a no-op on non-Deno runtimes: all permission " +
+        "requests are auto-granted. Do not rely on this guard for isolation " +
+        "when running outside Deno.");
+}
+export function requestPermission(request) {
+    return withSpan("security.permissions.request", async () => {
+        try {
+            if (isDeno)
+                return await requestDenoPermission(request);
+            // On non-Deno runtimes there is no OS-level permission API to consult,
+            // so every request is auto-granted — this guard provides NO isolation
+            // here. Warn loudly (once) so an operator running the runtime outside
+            // Deno cannot mistake this for an enforced sandbox.
+            warnNonDenoAutoGrantOnce();
+            serverLogger.debug("[permissions] Permission auto-granted (non-Deno runtime)", { permission: request.name });
+            return { state: "granted" };
+        }
+        catch (error) {
+            logger.warn("Permission request failed", {
+                permission: request.name,
+                error,
+            });
+            return { state: "denied" };
+        }
+    }, { "permission.name": request.name });
+}

package/esm/src/server/runtime-handler/project-runtime-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-runtime-context.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/project-runtime-context.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAKhF,KAAK,kBAAkB,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE7D,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,GAAG,CAAC;IACT,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACtE,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACrE,KAAK,yBAAyB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;AAC5E,KAAK,wBAAwB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;AAC3E,KAAK,4BAA4B,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC1E,KAAK,uBAAuB,GAAG,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAEnF,KAAK,sBAAsB,GAAG;IAC5B,GAAG,CAAC,KAAK,EAAE;QACT,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrC,CAAC;AAEF,KAAK,sBAAsB,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;AAE7E,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,qBAAqB,CAAC;IAC/B,cAAc,EAAE,qBAAqB,CAAC;IACtC,UAAU,EAAE;QACV,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;QAClC,sBAAsB,EAAE,OAAO,CAAC;KACjC,CAAC;IACF,WAAW,EAAE,mBAAmB,CAAC;IACjC,aAAa,EAAE,oBAAoB,CAAC;IACpC,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,qBAAqB,CAAC;IAC/B,cAAc,EAAE,qBAAqB,CAAC;IACtC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,EAAE;QACV,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;KACnC,CAAC;CACH;AAED,MAAM,WAAW,iCAAiC;IAChD,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,GAAG,CAAC;IACT,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,eAAe,EAAE,yBAAyB,CAAC;IAC3C,OAAO,EAAE,qBAAqB,CAAC;IAC/B,cAAc,EAAE,qBAAqB,CAAC;IACtC,WAAW,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,UAAU,EAAE;QACV,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;KACnC,CAAC;IACF,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,KAAK,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC;IAC9C,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,WAAW,EAAE,sBAAsB,CAAC;IACpC,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,qBAAqB,CAAC,EAAE,CAAC,WAAW,EAAE,4BAA4B,KAAK,IAAI,CAAC;IAC5E,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACvE;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,wBAAwB,CAAC;IAClC,WAAW,EAAE,4BAA4B,CAAC;IAC1C,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IAC3C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,uBAAuB,EAAE,uBAAuB,CAAC;CAClD;AAED,UAAU,mBAAmB;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,oBAAoB;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,sBAAsB,CAAC,CA8CjC;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,yBAAyB,CAAC,CAcpC;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,+BAA+B,CAAC,CAwN1C"}
+{"version":3,"file":"project-runtime-context.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/project-runtime-context.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM3D,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAKhF,KAAK,kBAAkB,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE7D,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,GAAG,CAAC;IACT,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACtE,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACrE,KAAK,yBAAyB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;AAC5E,KAAK,wBAAwB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;AAC3E,KAAK,4BAA4B,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC1E,KAAK,uBAAuB,GAAG,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAEnF,KAAK,sBAAsB,GAAG;IAC5B,GAAG,CAAC,KAAK,EAAE;QACT,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrC,CAAC;AAEF,KAAK,sBAAsB,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;AAE7E,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,qBAAqB,CAAC;IAC/B,cAAc,EAAE,qBAAqB,CAAC;IACtC,UAAU,EAAE;QACV,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;QAClC,sBAAsB,EAAE,OAAO,CAAC;KACjC,CAAC;IACF,WAAW,EAAE,mBAAmB,CAAC;IACjC,aAAa,EAAE,oBAAoB,CAAC;IACpC,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,qBAAqB,CAAC;IAC/B,cAAc,EAAE,qBAAqB,CAAC;IACtC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,EAAE;QACV,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;KACnC,CAAC;CACH;AAED,MAAM,WAAW,iCAAiC;IAChD,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,GAAG,CAAC;IACT,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,eAAe,EAAE,yBAAyB,CAAC;IAC3C,OAAO,EAAE,qBAAqB,CAAC;IAC/B,cAAc,EAAE,qBAAqB,CAAC;IACtC,WAAW,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,UAAU,EAAE;QACV,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;KACnC,CAAC;IACF,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,KAAK,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC;IAC9C,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,WAAW,EAAE,sBAAsB,CAAC;IACpC,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,qBAAqB,CAAC,EAAE,CAAC,WAAW,EAAE,4BAA4B,KAAK,IAAI,CAAC;IAC5E,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACvE;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,wBAAwB,CAAC;IAClC,WAAW,EAAE,4BAA4B,CAAC;IAC1C,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IAC3C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,uBAAuB,EAAE,uBAAuB,CAAC;CAClD;AAED,UAAU,mBAAmB;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,oBAAoB;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,sBAAsB,CAAC,CA8CjC;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,yBAAyB,CAAC,CAcpC;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,+BAA+B,CAAC,CAqQ1C"}

package/esm/src/server/runtime-handler/project-runtime-context.js

@@ -2,6 +2,9 @@ import { getBaseLogger } from "../../utils/index.js";
 import { getHostEnv } from "../../platform/compat/process.js";
 import { prepareDeclarativeConfigContext } from "../../config/declarative-evaluator.js";
 import { deriveSecurityContext } from "../../security/http/config.js";
+import { getDerivedCspOrigins } from "../../security/http/derived-csp-cache.js";
+import { resolveStyleContentVersion } from "../../html/styles-builder/content-version.js";
+import { isExtendedFSAdapter } from "../../platform/adapters/index.js";
 import { normalizeSourceIntegrationPolicy } from "../../integrations/source-policy.js";
 import { createRequestContext } from "../context/request-context.js";
 import { isProxyTrusted } from "../utils/proxy-trust.js";
@@ -157,11 +160,55 @@ export async function resolveProjectRuntimeContext(input) {
     // deliberately config-less control-plane path config-less: those endpoints
     // authenticate their signed operation envelope and do not expose an
     // application/browser surface.
+    // Origins the project's own source references, so a project that never wrote
+    // a `security.csp` still loads its own images, video and fonts. Only passive
+    // directives are derived; see security/http/derived-csp-origins.ts for why
+    // script-src is not.
+    //
+    // Runs inside runWithContext, not after it. MultiProjectFSAdapter resolves
+    // the tenant from AsyncLocalStorage, and outside that context it either
+    // throws -- swallowed by getAllSourceFiles into an empty list that would then
+    // be cached forever -- or falls back to a default adapter, which would derive
+    // one project's origins from another's source.
+    //
+    // Derived for config-less projects too. Those are the ones this exists for:
+    // a project with no veryfront.config.* is exactly the project that never
+    // declared a policy, and gating on config would leave it on the bare floor.
+    //
+    // Excluded on the deferred path. Those control-plane endpoints authenticate a
+    // signed operation envelope, expose no browser surface, and deliberately read
+    // no outer source -- deriving there would both serve nothing and break that
+    // guarantee.
+    const derivedCsp = input.isProxyMode && projectRes.projectSlug && reqCtx.token &&
+        adapterRes.configOutcome !== "deferred"
+        ? await deriveProjectCspOrigins({
+            adapter: adapterRes.adapter,
+            projectSlug: projectRes.projectSlug,
+            projectId: projectRes.projectId,
+            token: reqCtx.token,
+            releaseId: envRes.releaseId,
+            // Same precedence as the hosted config source context above. If the two
+            // disagree, derivation reads a different branch than the one that
+            // produced the config, and the origins describe content other than the
+            // page being served.
+            branch: reqCtx.branch ?? projectRes.parsedDomain?.branch,
+            environmentName: projectRes.environmentName,
+        })
+        : undefined;
     const requestSecurity = input.isProxyMode && adapterRes.config !== undefined
         ? deriveSecurityContext(adapterRes.config, {
             productionDefaults: envRes.resolvedEnvironment === "production",
+            derivedCsp,
         })
-        : undefined;
+        // A hosted project with no config file still gets its own security context
+        // rather than the process-wide one: defaults plus whatever its source
+        // implies. `deferred` control-plane requests keep the config-less shape.
+        : input.isProxyMode && projectRes.projectSlug && adapterRes.configOutcome === "hosted-absent"
+            ? deriveSecurityContext(undefined, {
+                productionDefaults: envRes.resolvedEnvironment === "production",
+                derivedCsp,
+            })
+            : undefined;
     // Falling back here substitutes the process-wide security config for the
     // project's, which serves a 200 whose CSP is the platform floor rather than
     // the project's policy. The response looks correct, so nothing downstream
@@ -307,3 +354,52 @@ function createProxyGuard(req, isProxyMode, headers, proxyTrusted, identityHeade
         }),
     };
 }
+/**
+ * Derive a project's passive CSP origins inside its own adapter context.
+ *
+ * The source read and the snapshot identity are both taken under
+ * `runWithContext`, because the multi-project adapter selects the tenant from
+ * AsyncLocalStorage and silently yields nothing -- or the wrong project --
+ * without it.
+ */
+async function deriveProjectCspOrigins(args) {
+    if (!isExtendedFSAdapter(args.adapter.fs) || !args.adapter.fs.runWithContext)
+        return undefined;
+    const fs = args.adapter.fs;
+    const run = async () => {
+        const underlying = typeof fs.getUnderlyingAdapter === "function"
+            ? fs.getUnderlyingAdapter()
+            : undefined;
+        if (!underlying || typeof underlying.getAllSourceFiles !== "function")
+            return undefined;
+        // Branch and environment content versions are stable while the content
+        // under them changes, so the adapter's snapshot generation is what actually
+        // moves when a preview is pushed to. Without it a preview would serve a
+        // derivation from before the push until the entry is evicted.
+        const snapshot = typeof underlying.getSourceSnapshotVersion === "function"
+            ? underlying.getSourceSnapshotVersion()
+            : 0;
+        const contentVersion = `${resolveStyleContentVersion(underlying.getContentContext?.() ?? null, {
+            releaseId: args.releaseId,
+            branch: args.branch,
+            environmentName: args.environmentName,
+        })}@${snapshot}`;
+        return await getDerivedCspOrigins({
+            projectScope: args.projectSlug,
+            contentVersion,
+            loadSourceFiles: () => underlying.getAllSourceFiles(),
+        });
+    };
+    try {
+        return await fs.runWithContext(args.projectSlug, args.token, run, args.projectId, {
+            productionMode: Boolean(args.releaseId),
+            releaseId: args.releaseId ?? null,
+            branch: args.branch ?? null,
+            environmentName: args.environmentName ?? null,
+        });
+    }
+    catch {
+        // Never fail a response over a CSP nicety.
+        return undefined;
+    }
+}

package/esm/src/types/server.d.ts

@@ -31,6 +31,16 @@ export interface SecurityConfig {
      * renderer requires.
      */
     csp?: Partial<Record<string, string | string[] | null>>;
+    /**
+     * Origins derived from the project's own released source, merged between the
+     * platform floor and `csp`.
+     *
+     * Platform-owned: `deriveSecurityContext` overwrites whatever a project
+     * config carries under this key, because `SecurityConfig` has an index
+     * signature and would otherwise let a project declare its own derived layer.
+     * Projects extend the policy through `csp`, which is merged on top of this.
+     */
+    derivedCsp?: import("../security/http/derived-csp-origins.js").DerivedCspOrigins;
     coop?: "same-origin" | "same-origin-allow-popups" | "unsafe-none";
     corp?: "same-origin" | "same-site" | "cross-origin";
     coep?: "require-corp" | "unsafe-none";

package/esm/src/types/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/src/types/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,YAAY,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE;YACN,QAAQ,EAAE,MAAM,CAAC;YACjB,QAAQ,EAAE,MAAM,CAAC;YACjB,KAAK,CAAC,EAAE,MAAM,CAAC;SAChB,CAAC;QACF,MAAM,CAAC,EAAE;YACP,KAAK,EAAE,MAAM,CAAC;SACf,CAAC;KACH,CAAC;IACF,IAAI,CAAC,EACD,OAAO,GACP;QACA,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,CAAC,CAAC;QACpE,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACJ,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,6BAA6B,EAAE,UAAU,CAAC;IAClE;;;;OAIG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,EAAE,aAAa,GAAG,0BAA0B,GAAG,aAAa,CAAC;IAClE,IAAI,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,cAAc,CAAC;IACpD,IAAI,CAAC,EAAE,cAAc,GAAG,aAAa,CAAC;IACtC,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC1E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,kDAAkD;IAClD,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC;IAC/C,0DAA0D;IAC1D,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,sGAAsG;IACtG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,mFAAmF;IACnF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,0BAA0B,CAAC,EAAE,MAAM,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxE,kEAAkE;IAClE,aAAa,CAAC,EAAE;QACd,WAAW,IAAI,aAAa,CAAC;YAAE,QAAQ,EAAE,eAAe,CAAA;SAAE,CAAC,CAAC;QAC5D,QAAQ,IAAI;YACV,aAAa,EAAE,MAAM,CAAC;YACtB,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3C,YAAY,EAAE,MAAM,EAAE,CAAC;SACxB,CAAC;KACH,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,oBAAY,eAAe;IACzB,QAAQ,IAAI,CAAE,wBAAwB;IACtC,KAAK,KAAK,CAAE,kDAAkD;IAC9D,IAAI,MAAM,CAAE,yBAAyB;IACrC,MAAM,MAAM,CAAE,2BAA2B;IACzC,GAAG,OAAO,CAAE,iBAAiB;IAC7B,QAAQ,QAAQ;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC;CAC5C;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACnE;AAED,MAAM,MAAM,kBAAkB,GAAG,CAC/B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC1B,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,KAAK,YAAY,GAAG,CAClB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;CAAE,KAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AAElC,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;CAC3C"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/src/types/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,YAAY,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE;YACN,QAAQ,EAAE,MAAM,CAAC;YACjB,QAAQ,EAAE,MAAM,CAAC;YACjB,KAAK,CAAC,EAAE,MAAM,CAAC;SAChB,CAAC;QACF,MAAM,CAAC,EAAE;YACP,KAAK,EAAE,MAAM,CAAC;SACf,CAAC;KACH,CAAC;IACF,IAAI,CAAC,EACD,OAAO,GACP;QACA,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,CAAC,CAAC;QACpE,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACJ,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,6BAA6B,EAAE,UAAU,CAAC;IAClE;;;;OAIG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACxD;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,OAAO,yCAAyC,EAAE,iBAAiB,CAAC;IACjF,IAAI,CAAC,EAAE,aAAa,GAAG,0BAA0B,GAAG,aAAa,CAAC;IAClE,IAAI,CAAC,EAAE,aAAa,GAAG,WAAW,GAAG,cAAc,CAAC;IACpD,IAAI,CAAC,EAAE,cAAc,GAAG,aAAa,CAAC;IACtC,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC1E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,kDAAkD;IAClD,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC;IAC/C,0DAA0D;IAC1D,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,sGAAsG;IACtG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,mFAAmF;IACnF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,0BAA0B,CAAC,EAAE,MAAM,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxE,kEAAkE;IAClE,aAAa,CAAC,EAAE;QACd,WAAW,IAAI,aAAa,CAAC;YAAE,QAAQ,EAAE,eAAe,CAAA;SAAE,CAAC,CAAC;QAC5D,QAAQ,IAAI;YACV,aAAa,EAAE,MAAM,CAAC;YACtB,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3C,YAAY,EAAE,MAAM,EAAE,CAAC;SACxB,CAAC;KACH,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,oBAAY,eAAe;IACzB,QAAQ,IAAI,CAAE,wBAAwB;IACtC,KAAK,KAAK,CAAE,kDAAkD;IAC9D,IAAI,MAAM,CAAE,yBAAyB;IACrC,MAAM,MAAM,CAAE,2BAA2B;IACzC,GAAG,OAAO,CAAE,iBAAiB;IAC7B,QAAQ,QAAQ;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC;CAC5C;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACnE;AAED,MAAM,MAAM,kBAAkB,GAAG,CAC/B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC1B,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,KAAK,YAAY,GAAG,CAClB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;CAAE,KAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AAElC,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;CAC3C"}

package/esm/src/utils/version-constant.d.ts

@@ -1,3 +1,3 @@
 /** Shared version value. */
-export declare const VERSION = "0.1.1213";
+export declare const VERSION = "0.1.1214";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,4 +1,4 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
 /** Shared version value. */
-export const VERSION = "0.1.1213";
+export const VERSION = "0.1.1214";

package/esm/src/workflow/api.d.ts

@@ -52,7 +52,7 @@ export declare const api: {
             cursor?: string;
             limit?: number;
             pattern?: string;
-        }) => Promise<import("../platform/adapters/veryfront-api-client/operations.js").FileListResult>;
+        }) => Promise<import("../platform/adapters/index.js").FileListResult>;
         /**
          * List all files in the project (handles pagination automatically)
          */
@@ -72,7 +72,7 @@ export declare const api: {
          * Get file details (content + metadata)
          * @param pathOrId - File path or ID
          */
-        get: (pathOrId: string) => Promise<import("../platform/adapters/veryfront-api-client/operations.js").FileDetail>;
+        get: (pathOrId: string) => Promise<import("../platform/adapters/index.js").FileDetail>;
         /**
          * Search for files matching a pattern
          * @param pattern - Search pattern (glob-like)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.1213",
+  "version": "0.1.1214",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",
@@ -421,13 +421,13 @@
     "@deno/shim-crypto": "0.3.1",
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
-    "@veryfront/ext-bundler-esbuild": "0.1.1213",
-    "@veryfront/ext-content-mdx": "0.1.1213",
-    "@veryfront/ext-css-tailwind": "0.1.1213",
-    "@veryfront/ext-dev-ui-react": "0.1.1213",
-    "@veryfront/ext-node-websocket-ws": "0.1.1213",
-    "@veryfront/ext-parser-babel": "0.1.1213",
-    "@veryfront/ext-yaml": "0.1.1213"
+    "@veryfront/ext-bundler-esbuild": "0.1.1214",
+    "@veryfront/ext-content-mdx": "0.1.1214",
+    "@veryfront/ext-css-tailwind": "0.1.1214",
+    "@veryfront/ext-dev-ui-react": "0.1.1214",
+    "@veryfront/ext-node-websocket-ws": "0.1.1214",
+    "@veryfront/ext-parser-babel": "0.1.1214",
+    "@veryfront/ext-yaml": "0.1.1214"
   },
   "devDependencies": {
     "@types/node": "20.9.0"