veryfront 0.1.122 → 0.1.126

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.122",
+    "version": "0.1.126",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "exclude": [

package/esm/src/security/http/response/security-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/security-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAQjD,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAmCD,wBAAgB,QAAQ,CACtB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CA4BR;AAED,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CAMR;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,CAAC,OAAO,EACxB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,IAAI,CA6DN"}
+{"version":3,"file":"security-handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/security/http/response/security-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAQjD,wBAAgB,aAAa,IAAI,MAAM,CAItC;AA2CD,wBAAgB,QAAQ,CACtB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CA4BR;AAED,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CAMR;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,CAAC,OAAO,EACxB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,EAC9B,OAAO,CAAC,EAAE,cAAc,EACxB,iBAAiB,CAAC,EAAE,OAAO,GAC1B,IAAI,CA6DN"}

package/esm/src/security/http/response/security-handler.js

@@ -14,9 +14,16 @@ export function generateNonce() {
  *
  * - Scripts: nonce-based + cdn.jsdelivr.net + esm.sh (Scalar API docs,
  *   html2canvas, legacy/browser ESM hydration)
- * - Styles: 'self' + 'unsafe-inline' + nonce + Google Fonts + cdn.veryfront.com
- *   plus style-src-attr 'unsafe-inline' so React style="" attributes remain
- *   compatible while inline <style> tags continue to use the nonce
+ * - Styles:
+ *   - style-src: 'self' + 'unsafe-inline' + Google Fonts + cdn.veryfront.com
+ *     so React style="" attributes and framework inline styles remain
+ *     compatible. Do not include a nonce in style-src here: browsers ignore
+ *     'unsafe-inline' when a nonce/hash is present on the directive, which
+ *     breaks React style attributes.
+ *   - style-src-elem: nonce-based + Google Fonts + cdn.veryfront.com for
+ *     inline <style> tags and stylesheet elements
+ *   - style-src-attr: 'unsafe-inline' for modern browsers with directive-level
+ *     style attribute support
  * - Images/media/fonts: 'self' + data: + https: + cdn.veryfront.com
  * - Connections: 'self' + wss: + https: (WebSocket for HMR/live reload, API calls)
  * - Objects: 'none' (block Flash/plugins)
@@ -29,7 +36,8 @@ function buildDefaultCSP(nonce) {
     return [
         `default-src 'self'`,
         `script-src 'self' 'nonce-${nonce}' https://cdn.jsdelivr.net https://esm.sh`,
-        `style-src 'self' 'unsafe-inline' 'nonce-${nonce}' https://fonts.googleapis.com https://cdn.veryfront.com`,
+        `style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.veryfront.com`,
+        `style-src-elem 'self' 'nonce-${nonce}' https://fonts.googleapis.com https://cdn.veryfront.com`,
         `style-src-attr 'unsafe-inline'`,
         `img-src 'self' data: https:`,
         `font-src 'self' data: https://fonts.gstatic.com https://cdn.veryfront.com`,

package/esm/src/server/context/request-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../../../src/src/server/context/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAIlD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,SAAS,GAAG,YAAY,CAAC;CAChC;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,cAAc,CA+BzE;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,cAAc,EACnB,cAAc,CAAC,EAAE,OAAO,GACvB,MAAM,GAAG,YAAY,GAAG,WAAW,CAIrC;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,EAAE,cAAc,CAAC,EAAE,OAAO,GAAG,OAAO,CAExF;AAED,wBAAgB,uBAAuB,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,EAAE,OAAO,GAAG,OAAO,CAG/F"}
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../../../src/src/server/context/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAKlD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,SAAS,GAAG,YAAY,CAAC;CAChC;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,cAAc,CAqBzE;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,cAAc,EACnB,cAAc,CAAC,EAAE,OAAO,GACvB,MAAM,GAAG,YAAY,GAAG,WAAW,CAIrC;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,EAAE,cAAc,CAAC,EAAE,OAAO,GAAG,OAAO,CAExF;AAED,wBAAgB,uBAAuB,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,EAAE,OAAO,GAAG,OAAO,CAG/F"}

package/esm/src/server/context/request-context.js

@@ -1,16 +1,8 @@
 import { getHostEnv } from "../../platform/compat/process.js";
 import { parseProjectDomain } from "../utils/domain-parser.js";
+import { getEffectiveRequestHost } from "../utils/request-host.js";
 export function createRequestContext(req) {
-    const { hostname } = new URL(req.url);
-    const rawForwardedHost = req.headers.get("x-forwarded-host");
-    // x-forwarded-host can be comma-separated (multiple proxies); take the first entry.
-    const forwardedHost = rawForwardedHost
-        ? (rawForwardedHost.split(",")[0]?.trim() || undefined)
-        : undefined;
-    const hostHeader = req.headers.get("host");
-    // In proxy mode, req.url hostname may be 127.0.0.1 while the real domain
-    // is in the Host header (e.g., "flow-ops.lvh.me:3010"). Prefer Host header.
-    const effectiveHost = forwardedHost ?? hostHeader ?? hostname;
+    const effectiveHost = getEffectiveRequestHost(req);
     const parsed = parseProjectDomain(effectiveHost);
     const headerProjectSlug = req.headers.get("x-project-slug")?.trim() || undefined;
     const xEnvironment = req.headers.get("x-environment");

package/esm/src/server/handlers/dev/projects/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/projects/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAWrD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAOpG"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/dev/projects/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAYrD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAOpG"}

package/esm/src/server/handlers/dev/projects/api.js

@@ -1,4 +1,5 @@
 import * as dntShim from "../../../../../_dnt.shims.js";
+import { getEffectiveRequestHost } from "../../../utils/request-host.js";
 const JSON_HEADERS = {
     "Content-Type": "application/json",
     "Cache-Control": "no-cache",
@@ -16,10 +17,7 @@ export function handleProjectsAPI(req, ctx) {
 }
 function handleGetConfig(req, ctx) {
     const url = new URL(req.url);
-    const host = req.headers.get("x-forwarded-host") ??
-        req.headers.get("host") ??
-        url.host ??
-        "lvh.me";
+    const host = getEffectiveRequestHost(req, url) || "lvh.me";
     const hostWithoutPort = host.replace(/:\d+$/, "") || "lvh.me";
     const port = host.includes(":") ? host.split(":")[1] ?? "" : "";
     return jsonResponse({

package/esm/src/server/handlers/preview/hmr.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hmr.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/preview/hmr.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AASrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,eAAe,EAEpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAmBrB,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAK7D,qBAAa,UAAW,SAAQ,WAAW;IACzC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAgD;IAC1E,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAA6B;IAC7D,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAK;IAChD,OAAO,CAAC,MAAM,CAAC,WAAW,CAAS;IAEnC,QAAQ,EAAE,eAAe,CAKvB;IAEF,OAAO,CAAC,MAAM,CAAC,UAAU;IAsCzB,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA0JzE;;;;;OAKG;YACW,wBAAwB;IAuCtC,MAAM,CAAC,cAAc,IAAI,MAAM;IAI/B,MAAM,CAAC,UAAU,IAAI;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;KAC3B;IAID,MAAM,CAAC,+BAA+B,IAAI,MAAM,IAAI;IAWpD,MAAM,CAAC,QAAQ,IAAI,IAAI;IAcvB,OAAO,CAAC,MAAM,CAAC,cAAc;CAO9B"}
+{"version":3,"file":"hmr.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/preview/hmr.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,2BAA2B,CAAC;AASrD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,eAAe,EAEpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAoBrB,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAK7D,qBAAa,UAAW,SAAQ,WAAW;IACzC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAgD;IAC1E,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAA6B;IAC7D,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAK;IAChD,OAAO,CAAC,MAAM,CAAC,WAAW,CAAS;IAEnC,QAAQ,EAAE,eAAe,CAKvB;IAEF,OAAO,CAAC,MAAM,CAAC,UAAU;IAsCzB,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA0JzE;;;;;OAKG;YACW,wBAAwB;IAuCtC,MAAM,CAAC,cAAc,IAAI,MAAM;IAI/B,MAAM,CAAC,UAAU,IAAI;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;KAC3B;IAID,MAAM,CAAC,+BAA+B,IAAI,MAAM,IAAI;IAWpD,MAAM,CAAC,QAAQ,IAAI,IAAI;IAcvB,OAAO,CAAC,MAAM,CAAC,cAAc;CAO9B"}

package/esm/src/server/handlers/preview/hmr.handler.js

@@ -10,6 +10,7 @@ import { isLocalDevHost } from "../../utils/domain-parser.js";
 import { addClient, clearAll, getClient, getClientCount, getClientDetails, removeClient, } from "./hmr-client-manager.js";
 import { getPingIntervalMs, startPingInterval, stopPingInterval } from "./hmr-ping-keepalive.js";
 import { broadcastUpdate, getMetrics } from "./hmr-message-router.js";
+import { getEffectiveRequestHost } from "../../utils/request-host.js";
 const logger = serverLogger.component("hmr-handler");
 // Priority between auth (0) and high (100)
 const PRIORITY_HMR = HandlerPriority.EARLY;
@@ -62,7 +63,7 @@ export class HMRHandler extends BaseHandler {
         const queryEnv = url.searchParams.get("x-environment");
         const isPreviewMode = ctx.requestContext?.mode === "preview" || queryEnv === "preview";
         const isLocal = !!ctx.isLocalProject;
-        const host = req.headers.get("host") ?? "";
+        const host = getEffectiveRequestHost(req, url);
         const isLocalhost = isLocalDevHost(host);
         if (!isPreviewMode && !isLocal && !isLocalhost) {
             logger.warn("Skipping /_ws - not preview, local dev, or localhost", {

package/esm/src/server/runtime-handler/project-resolution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-resolution.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/project-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAIlD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,KAAK,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAQtF;;GAEG;AACH,UAAU,qBAAqB;IAC7B,qBAAqB,CAAC,EAAE,OAAO,qBAAqB,CAAC;IACrD,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC/C,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;CAChD;AAID;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAE7E;AAUD,UAAU,cAAc;IACtB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,0CAA0C;IAC1C,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,0CAA0C;IAC1C,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,wCAAwC;IACxC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,4CAA4C;IAC5C,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,4CAA4C;IAC5C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,sCAAsC;IACtC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,wDAAwD;IACxD,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,8CAA8C;IAC9C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAeD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,cAAc,CAkBpF;AAED,UAAU,uBAAuB;IAC/B,4BAA4B;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,0BAA0B;IAC1B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,0BAA0B;IAC1B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,yCAAyC;IACzC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,sDAAsD;IACtD,QAAQ,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACvC,gCAAgC;IAChC,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED,UAAU,wBAAwB;IAChC,sCAAsC;IACtC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,gDAAgD;IAChD,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;QACzB,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;QAC3C,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;QAClC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;KAC3B,CAAC;IACF,+CAA+C;IAC/C,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,6CAA6C;IAC7C,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,wCAAwC;IACxC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAuHlC;AAGD,OAAO,EAAE,KAAK,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"project-resolution.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/project-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAIlD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,KAAK,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAStF;;GAEG;AACH,UAAU,qBAAqB;IAC7B,qBAAqB,CAAC,EAAE,OAAO,qBAAqB,CAAC;IACrD,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC/C,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;CAChD;AAID;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAE7E;AAUD,UAAU,cAAc;IACtB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,0CAA0C;IAC1C,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,0CAA0C;IAC1C,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,wCAAwC;IACxC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,4CAA4C;IAC5C,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,4CAA4C;IAC5C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,sCAAsC;IACtC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,wDAAwD;IACxD,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,8CAA8C;IAC9C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAMD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,cAAc,CAkBpF;AAED,UAAU,uBAAuB;IAC/B,4BAA4B;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,0BAA0B;IAC1B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,0BAA0B;IAC1B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,yCAAyC;IACzC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,sDAAsD;IACtD,QAAQ,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACvC,gCAAgC;IAChC,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED,UAAU,wBAAwB;IAChC,sCAAsC;IACtC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,gDAAgD;IAChD,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;QACzB,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;QAC3C,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;QAClC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;KAC3B,CAAC;IACF,+CAA+C;IAC/C,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,6CAA6C;IAC7C,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,wCAAwC;IACxC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAuHlC;AAGD,OAAO,EAAE,KAAK,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC"}

package/esm/src/server/runtime-handler/project-resolution.js

@@ -4,6 +4,7 @@ import { getEnvironmentType, lookupProjectByDomain } from "../utils/domain-looku
 import { parseProxyEnvironment } from "./proxy-environment.js";
 import { SpanNames, withSpan } from "./tracing.js";
 import { isInternalHost } from "./request-utils.js";
+import { getEffectiveRequestHost } from "../utils/request-host.js";
 const baseLogger = getBaseLogger("SERVER");
 const logger = baseLogger.component("project-resolution");
 let injectedDeps = null;
@@ -20,17 +21,8 @@ function getDeps() {
         getEnvironmentType: injectedDeps?.getEnvironmentType ?? getEnvironmentType,
     };
 }
-function parseForwardedHost(raw) {
-    if (!raw)
-        return undefined;
-    // x-forwarded-host can be a comma-separated list when multiple proxies
-    // are chained. Take the first (client-facing) entry and trim whitespace.
-    const first = raw.split(",")[0]?.trim();
-    return first || undefined;
-}
 function getEffectiveHost(req, url) {
-    const forwardedHost = parseForwardedHost(req.headers.get("x-forwarded-host"));
-    return forwardedHost ?? req.headers.get("host") ?? url.host;
+    return getEffectiveRequestHost(req, url);
 }
 /**
  * Extract project-related headers from a request.

package/esm/src/server/utils/request-host.d.ts

@@ -0,0 +1,4 @@
+import * as dntShim from "../../../_dnt.shims.js";
+export declare function parseForwardedHost(raw: string | null): string | undefined;
+export declare function getEffectiveRequestHost(req: dntShim.Request, url?: URL): string;
+//# sourceMappingURL=request-host.d.ts.map

package/esm/src/server/utils/request-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-host.d.ts","sourceRoot":"","sources":["../../../../src/src/server/utils/request-host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAClD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,CAI/E"}

package/esm/src/server/utils/request-host.js

@@ -0,0 +1,11 @@
+export function parseForwardedHost(raw) {
+    if (!raw)
+        return undefined;
+    const first = raw.split(",")[0]?.trim();
+    return first || undefined;
+}
+export function getEffectiveRequestHost(req, url) {
+    return parseForwardedHost(req.headers.get("x-forwarded-host")) ??
+        req.headers.get("host") ??
+        (url ?? new URL(req.url)).host;
+}

package/esm/src/utils/version-constant.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.1.122";
+export declare const VERSION = "0.1.126";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,3 +1,3 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
-export const VERSION = "0.1.122";
+export const VERSION = "0.1.126";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.122",
+  "version": "0.1.126",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",

package/src/deno.js

@@ -1,6 +1,6 @@
 export default {
   "name": "veryfront",
-  "version": "0.1.122",
+  "version": "0.1.126",
   "license": "Apache-2.0",
   "nodeModulesDir": "auto",
   "exclude": [

package/src/src/security/http/response/security-handler.ts

@@ -20,9 +20,16 @@ export function generateNonce(): string {
  *
  * - Scripts: nonce-based + cdn.jsdelivr.net + esm.sh (Scalar API docs,
  *   html2canvas, legacy/browser ESM hydration)
- * - Styles: 'self' + 'unsafe-inline' + nonce + Google Fonts + cdn.veryfront.com
- *   plus style-src-attr 'unsafe-inline' so React style="" attributes remain
- *   compatible while inline <style> tags continue to use the nonce
+ * - Styles:
+ *   - style-src: 'self' + 'unsafe-inline' + Google Fonts + cdn.veryfront.com
+ *     so React style="" attributes and framework inline styles remain
+ *     compatible. Do not include a nonce in style-src here: browsers ignore
+ *     'unsafe-inline' when a nonce/hash is present on the directive, which
+ *     breaks React style attributes.
+ *   - style-src-elem: nonce-based + Google Fonts + cdn.veryfront.com for
+ *     inline <style> tags and stylesheet elements
+ *   - style-src-attr: 'unsafe-inline' for modern browsers with directive-level
+ *     style attribute support
  * - Images/media/fonts: 'self' + data: + https: + cdn.veryfront.com
  * - Connections: 'self' + wss: + https: (WebSocket for HMR/live reload, API calls)
  * - Objects: 'none' (block Flash/plugins)
@@ -35,7 +42,8 @@ function buildDefaultCSP(nonce: string): string {
   return [
     `default-src 'self'`,
     `script-src 'self' 'nonce-${nonce}' https://cdn.jsdelivr.net https://esm.sh`,
-    `style-src 'self' 'unsafe-inline' 'nonce-${nonce}' https://fonts.googleapis.com https://cdn.veryfront.com`,
+    `style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.veryfront.com`,
+    `style-src-elem 'self' 'nonce-${nonce}' https://fonts.googleapis.com https://cdn.veryfront.com`,
     `style-src-attr 'unsafe-inline'`,
     `img-src 'self' data: https:`,
     `font-src 'self' data: https://fonts.gstatic.com https://cdn.veryfront.com`,

package/src/src/server/context/request-context.ts

@@ -1,6 +1,7 @@
 import * as dntShim from "../../../_dnt.shims.js";
 import { getHostEnv } from "../../platform/compat/process.js";
 import { parseProjectDomain } from "../utils/domain-parser.js";
+import { getEffectiveRequestHost } from "../utils/request-host.js";
 
 export interface RequestContext {
   token: string;
@@ -10,17 +11,7 @@ export interface RequestContext {
 }
 
 export function createRequestContext(req: dntShim.Request): RequestContext {
-  const { hostname } = new URL(req.url);
-  const rawForwardedHost = req.headers.get("x-forwarded-host");
-  // x-forwarded-host can be comma-separated (multiple proxies); take the first entry.
-  const forwardedHost = rawForwardedHost
-    ? (rawForwardedHost.split(",")[0]?.trim() || undefined)
-    : undefined;
-  const hostHeader = req.headers.get("host");
-
-  // In proxy mode, req.url hostname may be 127.0.0.1 while the real domain
-  // is in the Host header (e.g., "flow-ops.lvh.me:3010"). Prefer Host header.
-  const effectiveHost = forwardedHost ?? hostHeader ?? hostname;
+  const effectiveHost = getEffectiveRequestHost(req);
   const parsed = parseProjectDomain(effectiveHost);
   const headerProjectSlug = req.headers.get("x-project-slug")?.trim() || undefined;
 

package/src/src/server/handlers/dev/projects/api.ts

@@ -1,5 +1,6 @@
 import * as dntShim from "../../../../../_dnt.shims.js";
 import type { HandlerContext } from "../../types.js";
+import { getEffectiveRequestHost } from "../../../utils/request-host.js";
 
 const JSON_HEADERS = {
   "Content-Type": "application/json",
@@ -21,11 +22,7 @@ export function handleProjectsAPI(req: dntShim.Request, ctx: HandlerContext): dn
 
 function handleGetConfig(req: dntShim.Request, ctx: HandlerContext): dntShim.Response {
   const url = new URL(req.url);
-
-  const host = req.headers.get("x-forwarded-host") ??
-    req.headers.get("host") ??
-    url.host ??
-    "lvh.me";
+  const host = getEffectiveRequestHost(req, url) || "lvh.me";
 
   const hostWithoutPort = host.replace(/:\d+$/, "") || "lvh.me";
   const port = host.includes(":") ? host.split(":")[1] ?? "" : "";

package/src/src/server/handlers/preview/hmr.handler.ts

@@ -28,6 +28,7 @@ import {
 } from "./hmr-client-manager.js";
 import { getPingIntervalMs, startPingInterval, stopPingInterval } from "./hmr-ping-keepalive.js";
 import { broadcastUpdate, getMetrics } from "./hmr-message-router.js";
+import { getEffectiveRequestHost } from "../../utils/request-host.js";
 
 const logger = serverLogger.component("hmr-handler");
 
@@ -95,7 +96,7 @@ export class HMRHandler extends BaseHandler {
     const queryEnv = url.searchParams.get("x-environment");
     const isPreviewMode = ctx.requestContext?.mode === "preview" || queryEnv === "preview";
     const isLocal = !!ctx.isLocalProject;
-    const host = req.headers.get("host") ?? "";
+    const host = getEffectiveRequestHost(req, url);
     const isLocalhost = isLocalDevHost(host);
 
     if (!isPreviewMode && !isLocal && !isLocalhost) {

package/src/src/server/runtime-handler/project-resolution.ts

@@ -19,6 +19,7 @@ import { getEnvironmentType, lookupProjectByDomain } from "../utils/domain-looku
 import { parseProxyEnvironment, type ProxyEnvironment } from "./proxy-environment.js";
 import { SpanNames, withSpan } from "./tracing.js";
 import { isInternalHost } from "./request-utils.js";
+import { getEffectiveRequestHost } from "../utils/request-host.js";
 
 const baseLogger = getBaseLogger("SERVER");
 
@@ -73,17 +74,8 @@ interface RequestHeaders {
   projectPath: string | undefined;
 }
 
-function parseForwardedHost(raw: string | null): string | undefined {
-  if (!raw) return undefined;
-  // x-forwarded-host can be a comma-separated list when multiple proxies
-  // are chained. Take the first (client-facing) entry and trim whitespace.
-  const first = raw.split(",")[0]?.trim();
-  return first || undefined;
-}
-
 function getEffectiveHost(req: dntShim.Request, url: URL): string {
-  const forwardedHost = parseForwardedHost(req.headers.get("x-forwarded-host"));
-  return forwardedHost ?? req.headers.get("host") ?? url.host;
+  return getEffectiveRequestHost(req, url);
 }
 
 /**

package/src/src/server/utils/request-host.ts

@@ -0,0 +1,13 @@
+import * as dntShim from "../../../_dnt.shims.js";
+export function parseForwardedHost(raw: string | null): string | undefined {
+  if (!raw) return undefined;
+
+  const first = raw.split(",")[0]?.trim();
+  return first || undefined;
+}
+
+export function getEffectiveRequestHost(req: dntShim.Request, url?: URL): string {
+  return parseForwardedHost(req.headers.get("x-forwarded-host")) ??
+    req.headers.get("host") ??
+    (url ?? new URL(req.url)).host;
+}

package/src/src/utils/version-constant.ts

@@ -1,3 +1,3 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
-export const VERSION = "0.1.122";
+export const VERSION = "0.1.126";