veryfront 0.1.1213 → 0.1.1215

package/esm/src/platform/adapters/token/veryfront/types.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Token Storage Adapter Types
+ *
+ * Defines the interface for token storage backends.
+ * Tokens are encrypted client-side before being sent to the backend.
+ */
+export declare const DEFAULT_TOKEN_STORAGE_REQUEST_TIMEOUT_MS = 30000;
+/**
+ * Token storage adapter interface
+ *
+ * Simple key-value interface for storing encrypted tokens.
+ * Keys are formatted as "{userId}:{serviceId}" (e.g., "user123:gmail").
+ * Values are encrypted token blobs (client encrypts before sending).
+ */
+export interface TokenStorageAdapter {
+    /** Get encrypted token by key */
+    get(key: string): Promise<string | null>;
+    /** Set encrypted token by key (upsert) */
+    set(key: string, value: string): Promise<void>;
+    /** Delete token by key (idempotent) */
+    delete(key: string): Promise<void>;
+    /** List all keys with optional prefix filter */
+    list?(prefix?: string): Promise<string[]>;
+    /** Initialize the adapter (e.g., verify connection) */
+    initialize?(): Promise<void>;
+    /** Cleanup resources */
+    dispose?(): void;
+}
+/** Veryfront Cloud token-storage options. */
+export interface VeryfrontTokenStorageOptions {
+    /** API token for authentication */
+    apiToken: string;
+    /** Project slug */
+    projectSlug: string;
+    /** API base URL (defaults to production) */
+    apiBaseUrl?: string;
+    /** Per-request timeout in milliseconds. Defaults to 30000ms. */
+    timeoutMs?: number;
+    /** Retry configuration */
+    retry?: {
+        /** Retries after the initial request, from 0 through 9. */
+        maxRetries?: number;
+        /** Initial retry delay in whole milliseconds. */
+        initialDelay?: number;
+        /** Maximum retry delay in whole milliseconds. */
+        maxDelay?: number;
+    };
+}
+/**
+ * Configuration for token storage adapters.
+ *
+ * The discriminator is optional only for the empty/default memory config.
+ * Cloud options can never be combined with, or silently downgraded to, the
+ * in-memory adapter.
+ */
+export type TokenStorageAdapterConfig = {
+    type?: "memory";
+    veryfront?: never;
+} | {
+    type: "veryfront-api";
+    veryfront: VeryfrontTokenStorageOptions;
+};
+/**
+ * Internal config with defaults applied
+ */
+export interface VeryfrontTokenConfig {
+    apiBaseUrl: string;
+    apiToken: string;
+    projectSlug: string;
+    /** Request timeout in milliseconds. */
+    timeoutMs: number;
+    retry: {
+        maxRetries: number;
+        initialDelay: number;
+        maxDelay: number;
+    };
+}
+/**
+ * Create verified config from adapter config
+ */
+export declare function createTokenConfig(config: TokenStorageAdapterConfig): VeryfrontTokenConfig;
+export declare function assertTokenStorageKey(key: string): void;
+export declare function assertTokenStoragePrefix(prefix: string | undefined): void;
+export declare function assertTokenStorageValue(value: string): void;
+export { TOKEN_STORAGE_ERROR } from "../../../../errors/index.js";
+//# sourceMappingURL=types.d.ts.map

package/esm/src/platform/adapters/token/veryfront/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../src/src/platform/adapters/token/veryfront/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,eAAO,MAAM,wCAAwC,QAAS,CAAC;AAG/D;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,iCAAiC;IACjC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEzC,0CAA0C;IAC1C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C,uCAAuC;IACvC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnC,gDAAgD;IAChD,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE1C,uDAAuD;IACvD,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7B,wBAAwB;IACxB,OAAO,CAAC,IAAI,IAAI,CAAC;CAClB;AAED,6CAA6C;AAC7C,MAAM,WAAW,4BAA4B;IAC3C,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,KAAK,CAAC,EAAE;QACN,2DAA2D;QAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iDAAiD;QACjD,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,iDAAiD;QACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED;;;;;;GAMG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;IAAC,SAAS,CAAC,EAAE,KAAK,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,4BAA4B,CAAA;CAAE,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE;QACL,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAgBD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,yBAAyB,GAAG,oBAAoB,CAiCzF;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEvD;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAGzE;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAI3D;AA8BD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC"}

package/esm/src/platform/adapters/token/veryfront/types.js

@@ -0,0 +1,81 @@
+/**
+ * Token Storage Adapter Types
+ *
+ * Defines the interface for token storage backends.
+ * Tokens are encrypted client-side before being sent to the backend.
+ */
+import { createError, toError } from "../../../../errors/index.js";
+import { normalizeVeryfrontApiRetryConfig } from "../../../../utils/config-resource-limits.js";
+import { normalizeTimerDurationMs } from "../../../../utils/timer.js";
+export const DEFAULT_TOKEN_STORAGE_REQUEST_TIMEOUT_MS = 30_000;
+const MAX_TOKEN_STORAGE_KEY_CODE_UNITS = 4_096;
+function requireVeryfrontConfig(config) {
+    const veryfront = config.veryfront;
+    if (veryfront)
+        return veryfront;
+    throw toError(createError({
+        type: "config",
+        message: "Veryfront token adapter requires veryfront configuration",
+    }));
+}
+/**
+ * Create verified config from adapter config
+ */
+export function createTokenConfig(config) {
+    const veryfront = requireVeryfrontConfig(config);
+    const apiToken = veryfront.apiToken;
+    if (!isNonBlankString(apiToken)) {
+        throw toError(createError({
+            type: "config",
+            message: "Veryfront token adapter requires apiToken",
+        }));
+    }
+    const projectSlug = veryfront.projectSlug;
+    if (!isNonBlankString(projectSlug)) {
+        throw toError(createError({
+            type: "config",
+            message: "Veryfront token adapter requires projectSlug",
+        }));
+    }
+    return {
+        apiBaseUrl: veryfront.apiBaseUrl ?? "https://api.veryfront.com",
+        apiToken,
+        projectSlug,
+        timeoutMs: normalizeTimerDurationMs(veryfront.timeoutMs ?? DEFAULT_TOKEN_STORAGE_REQUEST_TIMEOUT_MS, "Token storage timeoutMs"),
+        retry: normalizeVeryfrontApiRetryConfig(veryfront.retry),
+    };
+}
+export function assertTokenStorageKey(key) {
+    assertBoundedTokenStorageIdentifier(key, "key", false);
+}
+export function assertTokenStoragePrefix(prefix) {
+    if (prefix === undefined)
+        return;
+    assertBoundedTokenStorageIdentifier(prefix, "prefix", true);
+}
+export function assertTokenStorageValue(value) {
+    if (typeof value !== "string") {
+        throw new TypeError("Token storage value must be a string");
+    }
+}
+function isNonBlankString(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+function assertBoundedTokenStorageIdentifier(value, label, allowEmpty) {
+    if (typeof value !== "string") {
+        throw new TypeError(`Token storage ${label} must be a string`);
+    }
+    if (!allowEmpty && value.length === 0) {
+        throw new TypeError("Token storage key must be non-empty");
+    }
+    if (value.length > MAX_TOKEN_STORAGE_KEY_CODE_UNITS) {
+        throw new RangeError(`Token storage ${label} must not exceed ${MAX_TOKEN_STORAGE_KEY_CODE_UNITS} code units`);
+    }
+    for (let index = 0; index < value.length; index++) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit <= 0x1f || codeUnit === 0x7f) {
+            throw new TypeError(`Token storage ${label} must not contain control characters`);
+        }
+    }
+}
+export { TOKEN_STORAGE_ERROR } from "../../../../errors/index.js";

package/esm/src/platform/compat/http/pinned-fetch.d.ts

@@ -7,7 +7,7 @@
  * Client identity for guarded egress, standing in for the runtime-supplied
  * `user-agent` (`node`, `Deno/x.y.z`) that this transport cannot inherit.
  */
-export declare const DEFAULT_OUTBOUND_USER_AGENT = "veryfront/0.1.1213";
+export declare const DEFAULT_OUTBOUND_USER_AGENT = "veryfront/0.1.1215";
 /**
  * Fill in the request headers a plain `fetch` attaches on its own, leaving any
  * the caller set untouched. This transport talks to `node:http` directly, so

package/esm/src/proxy/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/src/proxy/handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,YAAY,EAAsB,MAAM,kCAAkC,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAWnD,OAAO,EAAiC,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAuB3F,eAAO,MAAM,sBAAsB,yPAczB,CAAC;AA8CX,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,SAAS,GAAG,YAAY,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAyBD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC9D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC7D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC7D,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAChF;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,KAAK,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iCAAkC,SAAQ,wBAAwB;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAmCD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB;0BA2hBtD,OAAO,YACH,mBAAmB,KAC3B,OAAO,CAAC,YAAY,CAAC;0BAmfjB,OAAO,YACH,mBAAmB,KAC3B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;;;;;;;;0BAlrBH,MAAM,EAAE;qCAtMK,wBAAwB,KAAG;QACjE,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;KACpB;+CA2JQ,iCAAiC,KACvC,OAAO,CAAC,IAAI,CAAC;;EAmwBjB;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEjE,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,OAAO,EACtB,GAAG,EAAE,YAAY,GAChB,OAAO,CA0CT;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAW7E"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/src/proxy/handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,YAAY,EAElB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAWnD,OAAO,EAAiC,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAuB3F,eAAO,MAAM,sBAAsB,yPAczB,CAAC;AA8CX,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,SAAS,GAAG,YAAY,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAyBD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC9D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC7D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC7D,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAChF;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,KAAK,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iCAAkC,SAAQ,wBAAwB;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAmCD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB;0BA2hBtD,OAAO,YACH,mBAAmB,KAC3B,OAAO,CAAC,YAAY,CAAC;0BAogBjB,OAAO,YACH,mBAAmB,KAC3B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;;;;;;;;0BAnsBH,MAAM,EAAE;qCAtMK,wBAAwB,KAAG;QACjE,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;KACpB;+CA2JQ,iCAAiC,KACvC,OAAO,CAAC,IAAI,CAAC;;EAoxBjB;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEjE,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,OAAO,EACtB,GAAG,EAAE,YAAY,GAChB,OAAO,CA0CT;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAW7E"}

package/esm/src/proxy/handler.js

@@ -1,5 +1,5 @@
 import { TokenManager } from "./token-manager.js";
-import { parseProjectDomain } from "../server/utils/domain-parser.js";
+import { isHostedVeryfrontDomain, parseProjectDomain, } from "../server/utils/domain-parser.js";
 import { computeContentSourceId } from "../cache/keys.js";
 import { getEnv } from "../platform/compat/process.js";
 import { checkProtectedProxyAccess } from "./proxy-access-control.js";
@@ -469,6 +469,22 @@ export function createProxyHandler(options) {
             expectedProjectId: resolvedProjectId,
         }, logger);
         if (!projectSlug && parsedDomain.isVeryfrontDomain) {
+            // A hosted environment root (staging.veryfront.com) names no project and
+            // nothing downstream can supply one, so forwarding only sends
+            // x-project-slug: "" and earns 502 "Missing project context" — a
+            // configuration gap reported as an upstream failure. A custom domain in
+            // that state already answers 404.
+            //
+            // Locally the same shape means something else: on lvh.me and friends a
+            // project-less host is how the project chooser is reached, so those keep
+            // forwarding. See ProjectsHandler, enabled for exactly this state.
+            if (isHostedVeryfrontDomain(host)) {
+                logger?.info("No project for hosted veryfront domain", { host });
+                return createProxyErrorContext(base, {
+                    status: 404,
+                    message: `No project configured for domain: ${host}`,
+                });
+            }
             return {
                 token: undefined,
                 projectSlug: undefined,

package/esm/src/security/http/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EAEf,aAAa,EACd,MAAM,sBAAsB,CAAC;AAoJ9B,qBAAa,WAAY,SAAQ,WAAW;IAC1C,QAAQ,EAAE,eAAe,CAIvB;IAEF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAejE,OAAO,CAAC,WAAW;IA4CnB,OAAO,CAAC,cAAc;IAoBtB,OAAO,CAAC,eAAe;IAqBvB,OAAO,CAAC,iBAAiB;CAY1B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EAEf,aAAa,EACd,MAAM,sBAAsB,CAAC;AAoJ9B,qBAAa,WAAY,SAAQ,WAAW;IAC1C,QAAQ,EAAE,eAAe,CAIvB;IAEF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAsBjE,OAAO,CAAC,WAAW;IA4CnB,OAAO,CAAC,cAAc;IAoBtB,OAAO,CAAC,eAAe;IAqBvB,OAAO,CAAC,iBAAiB;CAY1B"}

package/esm/src/security/http/auth.js

@@ -1,3 +1,4 @@
+import { isCspReportRequest } from "./csp-report-endpoint.js";
 import { BaseHandler } from "./base-handler.js";
 import { encodeBase64 } from "../../utils/index.js";
 import { constantTimeEqual } from "../utils/constant-time.js";
@@ -121,6 +122,12 @@ export class AuthHandler extends BaseHandler {
     handle(req, ctx) {
         if (req.method.toUpperCase() === "OPTIONS")
             return Promise.resolve(this.continue());
+        // Same reasoning as the CSRF gate: a browser reports a violation without
+        // credentials, so a protected project would collect nothing. See
+        // `isCspReportRequest` for why exempting it discloses nothing.
+        if (isCspReportRequest(req.method, new URL(req.url).pathname)) {
+            return Promise.resolve(this.continue());
+        }
         const auth = this.resolveAuth(ctx);
         if (!auth)
             return Promise.resolve(this.continue());

package/esm/src/security/http/config.d.ts

@@ -11,6 +11,11 @@ export interface DeriveSecurityContextOptions {
      * classification may override it explicitly.
      */
     productionDefaults?: boolean;
+    /**
+     * Origins derived from the project's released source. Platform-supplied;
+     * anything a project config carries under this name is discarded.
+     */
+    derivedCsp?: SecurityConfig["derivedCsp"];
 }
 /**
  * Check a standalone security configuration against the canonical project

package/esm/src/security/http/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQ7D,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAwLD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,cAAc,CAO/E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAIhC;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,CAAC,EAAE,eAAe,EACrB,OAAO,GAAE,4BAAiC,GACzC,sBAAsB,CAiBxB;AAED,qBAAa,oBAAoB;IAM7B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,iBAAiB;IAR3B,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,WAAW,CAA8B;gBAGvC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,cAAc,CAAC,EAAE,eAAe,YAAA,EAChC,iBAAiB,UAAQ;IAG7B,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;YAqBrB,IAAI;IAKlB,OAAO,CAAC,WAAW;IAiBnB,iBAAiB,IAAI,cAAc,GAAG,IAAI;IAI1C,aAAa,IAAI,cAAc,CAAC,MAAM,CAAC;IAIvC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,MAAwB,GAAG,MAAM;IAIjE,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;CAQpE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQ7D,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC;CAC3C;AA4LD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,cAAc,CAO/E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAIhC;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,CAAC,EAAE,eAAe,EACrB,OAAO,GAAE,4BAAiC,GACzC,sBAAsB,CA4BxB;AAED,qBAAa,oBAAoB;IAM7B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,OAAO;IACf,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,iBAAiB;IAR3B,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,WAAW,CAA8B;gBAGvC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,cAAc,CAAC,EAAE,eAAe,YAAA,EAChC,iBAAiB,UAAQ;IAG7B,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;YAqBrB,IAAI;IAKlB,OAAO,CAAC,WAAW;IAiBnB,iBAAiB,IAAI,cAAc,GAAG,IAAI;IAI1C,aAAa,IAAI,cAAc,CAAC,MAAM,CAAC;IAIvC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,GAAE,MAAwB,GAAG,MAAM;IAIjE,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;CAQpE"}

package/esm/src/security/http/config.js

@@ -160,8 +160,12 @@ function readProductionDefaults(options) {
         const prototype = Object.getPrototypeOf(options);
         if (prototype !== Object.prototype && prototype !== null)
             return invalidSecurityConfig();
+        // Allowlisted rather than ignored: this object reaches a security decision,
+        // so an unrecognised key is a caller mistake worth failing on, not a
+        // silently discarded one.
+        const allowed = new Set(["productionDefaults", "derivedCsp"]);
         const keys = Reflect.ownKeys(options);
-        if (keys.some((key) => key !== "productionDefaults"))
+        if (keys.some((key) => !allowed.has(key)))
             return invalidSecurityConfig();
         const descriptor = Object.getOwnPropertyDescriptor(options, "productionDefaults");
         if (!descriptor)
@@ -228,6 +232,17 @@ export function deriveSecurityContext(cfg, options = {}) {
     if (normalized.csrf === undefined && productionDefaults) {
         normalized.csrf = true;
     }
+    // Assigned unconditionally, never merged. `SecurityConfig` carries an index
+    // signature, so the clone above would happily copy a `derivedCsp` a project
+    // wrote in its own config; overwriting here makes the platform the only
+    // author of this layer. Deleting when absent keeps a stale project value
+    // from surviving as the derived set.
+    if (options.derivedCsp && Object.keys(options.derivedCsp).length > 0) {
+        normalized.derivedCsp = options.derivedCsp;
+    }
+    else {
+        delete normalized.derivedCsp;
+    }
     const securityConfig = Object.freeze(normalized);
     return Object.freeze({
         securityConfig,

package/esm/src/security/http/csp-report-endpoint.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Where the platform CSP asks browsers to send violation reports.
+ *
+ * The policy is built in the security module and the reports are received by a
+ * server handler, so the path and the group name live here, on the side both
+ * can depend on. They have to agree: a `report-to` directive naming a group the
+ * `Reporting-Endpoints` header does not define makes the browser send nothing,
+ * and it fails silently.
+ */
+/** Path serving {@link CSP_REPORT_ENDPOINT_NAME}, on the project's own origin. */
+export declare const CSP_REPORT_PATH = "/_vf/csp-report";
+/** Reporting group tying the CSP `report-to` directive to `Reporting-Endpoints`. */
+export declare const CSP_REPORT_ENDPOINT_NAME = "veryfront-csp";
+/**
+ * Whether a request is the platform's own CSP report submission.
+ *
+ * The auth and CSRF gates both run ahead of the handler and both refuse a
+ * browser-generated report: it carries no credentials and no CSRF token,
+ * because a violation report is not a user action. Left alone, any project
+ * enabling either feature advertises a reporting endpoint that silently
+ * collects nothing.
+ *
+ * Exempting it is safe on the terms those gates exist for. The endpoint reads
+ * no credentials, changes no state, and answers 204 regardless of the body, so
+ * it discloses nothing about a protected project; what it writes is a bounded,
+ * sanitized, rate-limited log line.
+ */
+export declare function isCspReportRequest(method: string, pathname: string): boolean;
+//# sourceMappingURL=csp-report-endpoint.d.ts.map

package/esm/src/security/http/csp-report-endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp-report-endpoint.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/csp-report-endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,kFAAkF;AAClF,eAAO,MAAM,eAAe,oBAAoB,CAAC;AAEjD,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAExD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5E"}

package/esm/src/security/http/csp-report-endpoint.js

@@ -0,0 +1,30 @@
+/**
+ * Where the platform CSP asks browsers to send violation reports.
+ *
+ * The policy is built in the security module and the reports are received by a
+ * server handler, so the path and the group name live here, on the side both
+ * can depend on. They have to agree: a `report-to` directive naming a group the
+ * `Reporting-Endpoints` header does not define makes the browser send nothing,
+ * and it fails silently.
+ */
+/** Path serving {@link CSP_REPORT_ENDPOINT_NAME}, on the project's own origin. */
+export const CSP_REPORT_PATH = "/_vf/csp-report";
+/** Reporting group tying the CSP `report-to` directive to `Reporting-Endpoints`. */
+export const CSP_REPORT_ENDPOINT_NAME = "veryfront-csp";
+/**
+ * Whether a request is the platform's own CSP report submission.
+ *
+ * The auth and CSRF gates both run ahead of the handler and both refuse a
+ * browser-generated report: it carries no credentials and no CSRF token,
+ * because a violation report is not a user action. Left alone, any project
+ * enabling either feature advertises a reporting endpoint that silently
+ * collects nothing.
+ *
+ * Exempting it is safe on the terms those gates exist for. The endpoint reads
+ * no credentials, changes no state, and answers 204 regardless of the body, so
+ * it discloses nothing about a protected project; what it writes is a bounded,
+ * sanitized, rate-limited log line.
+ */
+export function isCspReportRequest(method, pathname) {
+    return method.toUpperCase() === "POST" && pathname === CSP_REPORT_PATH;
+}

package/esm/src/security/http/csrf/csrf-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/csrf/csrf-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EAEf,aAAa,EACd,MAAM,yBAAyB,CAAC;AAIjC,qBAAa,WAAY,SAAQ,WAAW;IAC1C,QAAQ,EAAE,eAAe,CAIvB;IAEI,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CAuCxE"}
+{"version":3,"file":"csrf-handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/csrf/csrf-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EAEf,aAAa,EACd,MAAM,yBAAyB,CAAC;AAIjC,qBAAa,WAAY,SAAQ,WAAW;IAC1C,QAAQ,EAAE,eAAe,CAIvB;IAEI,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CA4CxE"}

package/esm/src/security/http/csrf/csrf-handler.js

@@ -40,6 +40,7 @@
  *
  * @module security/http/csrf/csrf-handler
  */
+import { isCspReportRequest } from "../csp-report-endpoint.js";
 import { BaseHandler } from "../base-handler.js";
 import { validateCsrf } from "../../csrf/helpers.js";
 const CSRF_SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
@@ -60,6 +61,11 @@ export class CsrfHandler extends BaseHandler {
         if (CSRF_SAFE_METHODS.has(method))
             return this.continue();
         const { pathname } = new URL(req.url);
+        // A CSP violation report is not a user action and carries no token. See
+        // `isCspReportRequest`; relying on a project to add it to `excludePaths`
+        // would make reporting another thing a project has to configure first.
+        if (isCspReportRequest(method, pathname))
+            return this.continue();
         // Check exclude paths
         if (typeof csrfConfig === "object" && csrfConfig.excludePaths?.length) {
             for (const excludePath of csrfConfig.excludePaths) {

package/esm/src/security/http/derived-csp-cache.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Per-release cache for {@link deriveCspOriginsFromSource}.
+ *
+ * Derivation reads every source file a release pins, which is far too much work
+ * to repeat per response but exactly the right amount to do once per release:
+ * the input is immutable for a given content version, so the result is too.
+ *
+ * @module security/http/derived-csp-cache
+ */
+import { type DerivationSourceFile, type DerivedCspOrigins } from "./derived-csp-origins.js";
+export interface DerivedCspLookup {
+    /** Project scope, so two projects on one pod cannot share an entry. */
+    readonly projectScope: string;
+    /**
+     * Content version, as `resolveStyleContentVersion` spells it. A branch
+     * version is stable while its content changes, which is why the caller passes
+     * a snapshot identity rather than a branch name where one is available.
+     */
+    readonly contentVersion: string;
+    /** Reads the release's source files. Called only on a miss. */
+    readonly loadSourceFiles: () => Promise<readonly DerivationSourceFile[] | null>;
+}
+/**
+ * Derived origins for a content version, computing them at most once.
+ *
+ * Failure is not fatal: a project whose sources cannot be read gets an empty
+ * derivation, which leaves it exactly where it was before this existed -- the
+ * platform floor plus whatever `security.csp` declares.
+ */
+export declare function getDerivedCspOrigins(lookup: DerivedCspLookup): Promise<DerivedCspOrigins>;
+/** @internal Test seam. */
+export declare function __clearDerivedCspCacheForTests(): void;
+//# sourceMappingURL=derived-csp-cache.d.ts.map

package/esm/src/security/http/derived-csp-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derived-csp-cache.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/derived-csp-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EACL,KAAK,oBAAoB,EAEzB,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAuClC,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,eAAe,EAAE,MAAM,OAAO,CAAC,SAAS,oBAAoB,EAAE,GAAG,IAAI,CAAC,CAAC;CACjF;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,iBAAiB,CAAC,CAmB5B;AA+BD,2BAA2B;AAC3B,wBAAgB,8BAA8B,IAAI,IAAI,CAGrD"}

package/esm/src/security/http/derived-csp-cache.js

@@ -0,0 +1,101 @@
+/**
+ * Per-release cache for {@link deriveCspOriginsFromSource}.
+ *
+ * Derivation reads every source file a release pins, which is far too much work
+ * to repeat per response but exactly the right amount to do once per release:
+ * the input is immutable for a given content version, so the result is too.
+ *
+ * @module security/http/derived-csp-cache
+ */
+import { registerCache } from "../../utils/memory/index.js";
+import { serverLogger } from "../../utils/logger/logger.js";
+import { deriveCspOriginsFromSource, } from "./derived-csp-origins.js";
+const logger = serverLogger.component("derived-csp");
+/** Bounded so a fleet of projects cannot grow this without limit. */
+const MAX_ENTRIES = 200;
+const EMPTY = Object.freeze({});
+const cache = new Map();
+/**
+ * Derivations currently running, keyed exactly as the resolved cache is.
+ *
+ * A key is coldest immediately after a release, when every pod serves that
+ * content version for the first time. Without this, each concurrent request for
+ * the same key reads and scans the whole source set; with it the first caller
+ * does the work and the rest await its result.
+ */
+const inFlight = new Map();
+registerCache("derived-csp-origins", () => ({
+    name: "derived-csp-origins",
+    entries: cache.size,
+    maxEntries: MAX_ENTRIES,
+}));
+function remember(key, value) {
+    // Insertion-ordered eviction: the oldest content version is the one least
+    // likely to still be serving traffic.
+    while (cache.size >= MAX_ENTRIES) {
+        const oldest = cache.keys().next().value;
+        if (oldest === undefined)
+            break;
+        cache.delete(oldest);
+    }
+    cache.set(key, value);
+    return value;
+}
+/**
+ * Derived origins for a content version, computing them at most once.
+ *
+ * Failure is not fatal: a project whose sources cannot be read gets an empty
+ * derivation, which leaves it exactly where it was before this existed -- the
+ * platform floor plus whatever `security.csp` declares.
+ */
+export function getDerivedCspOrigins(lookup) {
+    // NUL separates the two components because neither can contain one, so no
+    // scope/version pair can collide with another by concatenation. Written as an
+    // escape rather than a raw byte: a literal NUL in the source makes the file
+    // binary to grep and friends.
+    const key = `${lookup.projectScope}\u0000${lookup.contentVersion}`;
+    const cached = cache.get(key);
+    if (cached)
+        return Promise.resolve(cached);
+    const pending = inFlight.get(key);
+    if (pending)
+        return pending;
+    const derivation = deriveOnce(key, lookup);
+    inFlight.set(key, derivation);
+    return derivation.finally(() => {
+        // Clear only our own entry: after an eviction a later call may already have
+        // started a fresh derivation under the same key.
+        if (inFlight.get(key) === derivation)
+            inFlight.delete(key);
+    });
+}
+async function deriveOnce(key, lookup) {
+    let files;
+    try {
+        files = await lookup.loadSourceFiles();
+    }
+    catch (error) {
+        logger.debug("Could not read sources for CSP derivation", {
+            projectScope: lookup.projectScope,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return remember(key, EMPTY);
+    }
+    if (!files || files.length === 0)
+        return remember(key, EMPTY);
+    const derived = deriveCspOriginsFromSource(files);
+    const count = derived["img-src"]?.length ?? 0;
+    if (count > 0) {
+        logger.debug("Derived CSP origins from project source", {
+            projectScope: lookup.projectScope,
+            contentVersion: lookup.contentVersion,
+            originCount: count,
+        });
+    }
+    return remember(key, derived);
+}
+/** @internal Test seam. */
+export function __clearDerivedCspCacheForTests() {
+    cache.clear();
+    inFlight.clear();
+}

package/esm/src/security/http/derived-csp-origins.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Derive a project's CSP origins from the source it publishes.
+ *
+ * The platform floor lists what the *platform* emits. Anything a project loads
+ * from elsewhere -- a stock-photo host, its own asset CDN, a video origin --
+ * has to be admitted separately, and until now the only way to do that was
+ * `security.csp`. That made a working site depend on configuration the project
+ * had no reason to know it needed: an audit of the hosted fleet found ~100
+ * projects loading blocked assets and two that had declared anything.
+ *
+ * This module closes that gap by reading the origins out of the project's own
+ * released source, so `security.csp` becomes an override for what static
+ * analysis cannot see rather than a prerequisite for a site that works.
+ *
+ * Two properties make that safe rather than merely convenient:
+ *
+ * 1. **Only passive-content directives are derived.** `img-src`, `media-src`
+ *    and `font-src` decide whether a logo renders. `script-src` and
+ *    `connect-src` decide whether a third party can execute code in the page
+ *    or receive data from it. Deriving those would mean anyone able to
+ *    influence source -- a compromised dependency, a merged pull request,
+ *    CMS-authored MDX -- could grant themselves execution or an exfiltration
+ *    endpoint, collapsing two independent barriers into one. Every project in
+ *    the audit was fixed by passive directives alone.
+ *
+ * 2. **Origins come from an immutable release.** Derivation runs over the
+ *    source a release pins, not over live content, so a script injected at
+ *    runtime cannot extend the allowlist it is subject to.
+ *
+ * Derivation is deliberately incomplete. A URL assembled at runtime -- a
+ * template literal, a CMS field, an environment variable -- is invisible here,
+ * and those projects still declare `security.csp`. Under-deriving costs a
+ * broken image; over-deriving costs the policy its meaning.
+ *
+ * @module security/http/derived-csp-origins
+ */
+/** Directives this module is permitted to contribute to. */
+export declare const DERIVABLE_CSP_DIRECTIVES: readonly ["img-src", "media-src", "font-src"];
+export type DerivableCspDirective = (typeof DERIVABLE_CSP_DIRECTIVES)[number];
+export type DerivedCspOrigins = Readonly<Partial<Record<DerivableCspDirective, readonly string[]>>>;
+/** A source file as the release stores it. */
+export interface DerivationSourceFile {
+    readonly path: string;
+    readonly content?: string;
+}
+/**
+ * Collect the passive-content origins a project's source references.
+ *
+ * Pure over its input: callers hand it the file set a release pins, and the
+ * result is stable for that set, which is what lets it be computed once per
+ * release rather than per request.
+ */
+export declare function deriveCspOriginsFromSource(files: readonly DerivationSourceFile[]): DerivedCspOrigins;
+//# sourceMappingURL=derived-csp-origins.d.ts.map

package/esm/src/security/http/derived-csp-origins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derived-csp-origins.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/derived-csp-origins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,4DAA4D;AAC5D,eAAO,MAAM,wBAAwB,+CAEpC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CACtC,OAAO,CAAC,MAAM,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAC1D,CAAC;AAEF,8CAA8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AA2ED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,SAAS,oBAAoB,EAAE,GACrC,iBAAiB,CAsCnB"}