veryfront 0.1.1239 → 0.1.1241

package/esm/src/server/handlers/request/api/pages-api-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pages-api-handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/request/api/pages-api-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAO/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIrD,MAAM,WAAW,YAAY,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;IAChC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7B,KAAK,IAAI,IAAI,CAAC;IACd,OAAO,IAAI,gBAAgB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC;CAC/B;AAID,qBAAa,eAAe,CAAC,CAAC,CAAE,YAAW,YAAY,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,uBAAuB,CAAS;gBAGtC,OAAO,GAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC;KACzB;IAUR,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS;IAG/B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAGhC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAU5B,KAAK,IAAI,IAAI;IAQb,OAAO,IAAI,gBAAgB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAGvC,MAAM,IAAI,gBAAgB,CAAC,CAAC,CAAC;CAG/B;AAqBD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,GAAG,IAAI,GACnD,IAAI,CAEN;AA8BD,wBAAsB,gCAAgC,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAUzF;AAED,wBAAsB,4BAA4B,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAGrF;AAED,UAAU,iBAAiB;IACzB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAyFD,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAEjF;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,CAAC,EACpC,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EACjD,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED,wBAAsB,eAAe,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAaxE;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAcf"}
+{"version":3,"file":"pages-api-handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/request/api/pages-api-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAO/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIrD,MAAM,WAAW,YAAY,CAAC,CAAC;IAC7B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;IAChC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7B,KAAK,IAAI,IAAI,CAAC;IACd,OAAO,IAAI,gBAAgB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC;CAC/B;AAID,qBAAa,eAAe,CAAC,CAAC,CAAE,YAAW,YAAY,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,uBAAuB,CAAS;gBAGtC,OAAO,GAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC;KACzB;IAUR,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS;IAG/B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI;IAGhC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAU5B,KAAK,IAAI,IAAI;IAQb,OAAO,IAAI,gBAAgB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAGvC,MAAM,IAAI,gBAAgB,CAAC,CAAC,CAAC;CAG/B;AA0BD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,GAAG,IAAI,GACnD,IAAI,CAEN;AA4CD,wBAAsB,gCAAgC,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAUzF;AAED,wBAAsB,4BAA4B,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAGrF;AAED,UAAU,iBAAiB;IACzB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAyFD,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAEjF;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,CAAC,EACpC,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EACjD,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED,wBAAsB,eAAe,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAaxE;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/esm/src/server/handlers/request/api/pages-api-handler.js

@@ -66,6 +66,11 @@ const apiHandlerCache = new LRUHandlerCache({
 });
 let injectedCache = null;
 const handlerLeaseStates = new WeakMap();
+// Hosted config snapshots are deeply frozen and cached by their source and
+// environment fingerprint. Keep that exact process-local identity in the
+// handler key so changed environment values cannot reuse a stale handler.
+const configSnapshotIds = new WeakMap();
+let nextConfigSnapshotId = 1;
 function getCache() {
     return injectedCache ?? apiHandlerCache;
 }
@@ -75,6 +80,14 @@ export function __injectCacheForTests(cache) {
 function getApiHandlerCacheContext(ctx) {
     return tryGetCacheKeyContext() ?? extractCacheKeyContext(ctx);
 }
+function getConfigSnapshotId(config) {
+    let id = configSnapshotIds.get(config);
+    if (id === undefined) {
+        id = nextConfigSnapshotId++;
+        configSnapshotIds.set(config, id);
+    }
+    return id;
+}
 function getCacheKey(ctx) {
     if (!ctx.projectSlug)
         return ctx.projectDir;
@@ -83,7 +96,12 @@ function getCacheKey(ctx) {
     // project-specific dir key rather than a shared bucket.
     if (!cacheContext)
         return ctx.projectDir;
-    return `${ctx.projectDir}:${ctx.projectSlug}:${cacheContext.mode}:${cacheContext.versionId}`;
+    const environmentIdentity = ctx.environmentId ?? ctx.environmentName;
+    const environmentKey = environmentIdentity
+        ? `:environment:${encodeURIComponent(environmentIdentity)}`
+        : "";
+    const configKey = ctx.config ? `:config:${getConfigSnapshotId(ctx.config)}` : "";
+    return `${ctx.projectDir}:${ctx.projectSlug}:${cacheContext.mode}:${cacheContext.versionId}${environmentKey}${configKey}`;
 }
 function shouldCacheApiHandler(ctx) {
     if (!ctx.projectSlug)
@@ -118,7 +136,7 @@ async function createApiHandler(ctx, options = {}) {
     if (!options.sourceSnapshotReady) {
         await ensurePreviewSourceSnapshotFresh(ctx);
     }
-    const handler = new APIRouteHandler(ctx.projectDir, ctx.adapter);
+    const handler = new APIRouteHandler(ctx.projectDir, ctx.adapter, ctx.config);
     await handler.initialize();
     return handler;
 }

package/esm/src/server/handlers/request/module/page-data-endpoint-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"page-data-endpoint-handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/request/module/page-data-endpoint-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AA+HhE,wBAAgB,oCAAoC,IAAI,IAAI,CAE3D;AAED,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,cAAc,EACnB,qBAAqB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,eAAe,EAC/D,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,aAAa,EAC9C,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,GAC1C,OAAO,CAAC,aAAa,CAAC,CA0KxB"}
+{"version":3,"file":"page-data-endpoint-handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/request/module/page-data-endpoint-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAgIhE,wBAAgB,oCAAoC,IAAI,IAAI,CAE3D;AAED,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,cAAc,EACnB,qBAAqB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,eAAe,EAC/D,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,aAAa,EAC9C,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,GAC1C,OAAO,CAAC,aAAa,CAAC,CAoLxB"}

package/esm/src/server/handlers/request/module/page-data-endpoint-handler.js

@@ -10,6 +10,7 @@ import { Singleflight, waitForSharedPromise } from "../../../../utils/singleflig
 import { requestHasCacheSensitiveState } from "../../../../cache/request-cacheability.js";
 import { sanitizeQueryParamsForCacheKey, } from "../../../../cache/keys.js";
 import { resolveSSRControlOutcome } from "../../../../rendering/ssr-outcome.js";
+import { isRedirectDestinationAllowed } from "../../../../utils/redirect-policy.js";
 import { getEnv } from "../../../../platform/compat/process.js";
 import { createHandlerDependencyPinningSource } from "../../utils/dependency-pinning-source.js";
 import { readSnapshotHeader, resolveSnapshotForRequest, snapshotConflictResponse, stripSnapshotHeader, withSnapshotResponseHeaders, } from "../../utils/dependency-snapshot-protocol.js";
@@ -145,7 +146,9 @@ export function handlePageDataEndpoint(req, pathname, ctx, createResponseBuilder
             const control = resolveSSRControlOutcome(e);
             // A destination the client refuses to follow is not a redirect the
             // endpoint can encode, so it falls through to normal error handling.
-            if (control?.kind === "redirect" && isFollowableRedirect(control.location)) {
+            if (control?.kind === "redirect" &&
+                isFollowableRedirect(control.location) &&
+                isRedirectDestinationAllowed(control.location, ctx.requestOrigin === undefined ? req.url : ctx.requestOrigin, ctx.securityConfig?.redirects)) {
                 return respondPageData(ResponseBuilder.json({
                     redirect: { destination: control.location, permanent: control.permanent },
                     ...(dependencySnapshot?.cacheKey.startsWith("on:")
@@ -157,7 +160,9 @@ export function handlePageDataEndpoint(req, pathname, ctx, createResponseBuilder
                     status: 200,
                 }));
             }
-            const errorMessage = getErrorMessage(e);
+            const errorMessage = control?.kind === "redirect"
+                ? "Redirect destination is not allowed"
+                : getErrorMessage(e);
             const isNotFound = control?.kind === "not-found";
             const status = isNotFound ? 404 : 500;
             // Log the full error server-side but return a generic message
@@ -268,24 +273,36 @@ function refreshStalePageData(cacheKey, resolve, cachePolicy) {
     });
 }
 /**
- * Only http(s) and root-relative destinations may be encoded for the client to
- * follow. The client follows the destination with `window.location.href`, which
- * would EXECUTE a `javascript:`/`data:` URL — unlike the full-page 302 path where
- * the browser ignores such a Location. Protocol-relative `//host` is rejected too
- * (it is easy to smuggle past a naive "starts with /" check). Blocked
- * destinations fall through to normal error handling instead of being followed.
+ * Only absolute http(s) or same-origin relative destinations may be encoded for
+ * the client to follow. The client follows the destination with
+ * `window.location.href`, which would execute a `javascript:` or `data:` URL.
+ * Protocol-relative and backslash-normalized cross-origin values are rejected.
+ * Blocked destinations fall through to normal error handling.
  */
 function isFollowableRedirect(destination) {
-    if (destination.startsWith("/")) {
-        const baseOrigin = "https://veryfront.local";
-        try {
-            return new URL(destination, baseOrigin).origin === baseOrigin;
-        }
-        catch {
+    if (!destination || destination.trim() !== destination)
+        return false;
+    for (let index = 0; index < destination.length; index++) {
+        const codeUnit = destination.charCodeAt(index);
+        if (codeUnit <= 0x1f || codeUnit === 0x7f)
+            return false;
+    }
+    const isAbsoluteHttpUrl = /^https?:\/\//i.test(destination);
+    if (/^[a-z][a-z\d+.-]*:/i.test(destination) && !isAbsoluteHttpUrl)
+        return false;
+    const base = new URL("https://veryfront.local/current/page");
+    try {
+        const target = new URL(destination, base);
+        if ((target.protocol !== "http:" && target.protocol !== "https:") ||
+            target.username !== "" ||
+            target.password !== "") {
             return false;
         }
+        return isAbsoluteHttpUrl || target.origin === base.origin;
+    }
+    catch {
+        return false;
     }
-    return /^https?:\/\//i.test(destination);
 }
 function buildPageDataCacheKey(ctx, slug, url, dependencyPinningCacheKey = "off") {
     const projectKey = ctx.projectId ?? ctx.projectSlug ?? ctx.projectDir;

package/esm/src/server/handlers/request/prod-hydration-module.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prod-hydration-module.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/request/prod-hydration-module.handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAuBnG,qBAAa,0BAA2B,SAAQ,WAAW;IACzD,QAAQ,EAAE,eAAe,CASvB;IAEI,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CAgCxE"}
+{"version":3,"file":"prod-hydration-module.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/request/prod-hydration-module.handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAwBnG,qBAAa,0BAA2B,SAAQ,WAAW;IACzD,QAAQ,EAAE,eAAe,CASvB;IAEI,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CAyCxE"}

package/esm/src/server/handlers/request/prod-hydration-module.handler.js

@@ -1,5 +1,5 @@
 import { BaseHandler } from "../response/base.js";
-import { generateProdHydrationModule, isVersionedProdHydrationModulePath, PROD_HYDRATION_MODULE_PATH, PROD_HYDRATION_MODULE_VERSIONED_PATH_PATTERN, } from "../../../html/hydration-script-builder/prod-scripts.js";
+import { generateProdHydrationModule, getProdHydrationModulePath, isVersionedProdHydrationModulePath, PROD_HYDRATION_MODULE_PATH, PROD_HYDRATION_MODULE_VERSIONED_PATH_PATTERN, } from "../../../html/hydration-script-builder/prod-scripts.js";
 import { computeStrongEtag, hasMatchingEtag } from "../utils/etag.js";
 import { HTTP_OK, PRIORITY_HIGH_DEV } from "../../../utils/constants/index.js";
 let cachedModule = null;
@@ -28,9 +28,16 @@ export class ProdHydrationModuleHandler extends BaseHandler {
         if (!this.shouldHandle(req, ctx)) {
             return this.continue();
         }
-        const method = req.method.toUpperCase();
         const pathname = new URL(req.url).pathname;
-        const cacheStrategy = isVersionedProdHydrationModulePath(pathname) ? "immutable" : "no-cache";
+        const isVersioned = isVersionedProdHydrationModulePath(pathname);
+        // Serve only the current content address dynamically. Non-current hashes
+        // may name valid release-baked assets, so StaticHandler owns their lookup
+        // and returns the final non-cacheable 404 when no stored asset matches.
+        if (isVersioned && pathname !== getProdHydrationModulePath()) {
+            return this.continue();
+        }
+        const method = req.method.toUpperCase();
+        const cacheStrategy = isVersioned ? "immutable" : "no-cache";
         const { js, etag } = getProdHydrationModuleBundle();
         const builder = this.createResponseBuilder(ctx).withCORS(req, ctx.securityConfig?.cors);
         if (hasMatchingEtag(req, etag)) {

package/esm/src/server/handlers/request/project-run-execute.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-run-execute.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/request/project-run-execute.handler.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAKjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAAW,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,KAAK,cAAc,EAAgB,MAAM,4BAA4B,CAAC;AAE/E,OAAO,EACL,KAAK,6BAA6B,EAEnC,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EAGd,UAAU,EACV,cAAc,EACf,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,KAAK,kBAAkB,EAAoB,MAAM,sCAAsC,CAAC;AAEjG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGvE,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAWlD,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,aAAa,GAAG,aAAa,GAAG,gBAAgB,CAAC;IACrE,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;CACvB;AAED,UAAU,qBAAqB;IAC7B,OAAO,EAAE,wBAAwB,CAAC;IAClC,GAAG,EAAE,cAAc,CAAC;IACpB,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,eAAe;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACrC;AAED,UAAU,mBAAmB;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,GAAG,WAAW,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC,KAAK,CACH,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3B,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACvD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACzD,gBAAgB,CACd,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,cAAc,CAAC;QACxB,MAAM,CAAC,EAAE,eAAe,CAAC;QACzB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,6BAA6B,CAAC,EAAE,OAAO,CAAC;KACzC,GACA,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACtC,YAAY,CACV,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,cAAc,CAAC;QACxB,MAAM,CAAC,EAAE,eAAe,CAAC;QACzB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,6BAA6B,CAAC,EAAE,OAAO,CAAC;KACzC,GACA,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAClC,oBAAoB,CAClB,MAAM,CAAC,EAAE,oBAAoB,GAC5B,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpD,OAAO,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAClF,sBAAsB,CAAC,MAAM,EAAE,6BAA6B,GAAG,gBAAgB,CAAC;IAChF,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvE,sBAAsB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACtE,sBAAsB,CAAC,KAAK,EAAE;QAC5B,OAAO,EAAE,wBAAwB,CAAC;QAClC,GAAG,EAAE,cAAc,CAAC;QACpB,GAAG,EAAE,OAAO,CAAC;KACd,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACvC,wBAAwB,CAAC,KAAK,EAAE;QAC9B,OAAO,EAAE,wBAAwB,CAAC;QAClC,GAAG,EAAE,cAAc,CAAC;QACpB,GAAG,EAAE,OAAO,CAAC;KACd,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACvC,8BAA8B,CAAC,KAAK,EAAE;QACpC,OAAO,EAAE,wBAAwB,CAAC;QAClC,GAAG,EAAE,cAAc,CAAC;QACpB,GAAG,EAAE,OAAO,CAAC;KACd,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACvC,yBAAyB,CAAC,KAAK,EAAE;QAC/B,OAAO,EAAE,wBAAwB,CAAC;QAClC,GAAG,EAAE,cAAc,CAAC;QACpB,GAAG,EAAE,OAAO,CAAC;KACd,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACvC,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,GAAG,IAAI,MAAM,CAAC;CACf;AA+1CD,qBAAa,wBAAyB,SAAQ,WAAW;IAS3C,OAAO,CAAC,QAAQ,CAAC,IAAI;IARjC,QAAQ,EAAE,eAAe,CAMvB;gBAE2B,IAAI,GAAE,4BAA0C;IAIvE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CA0ExE"}
+{"version":3,"file":"project-run-execute.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/request/project-run-execute.handler.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAKjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAAW,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,KAAK,cAAc,EAAgB,MAAM,4BAA4B,CAAC;AAE/E,OAAO,EACL,KAAK,6BAA6B,EAEnC,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EAGd,UAAU,EACV,cAAc,EACf,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,KAAK,kBAAkB,EAAoB,MAAM,sCAAsC,CAAC;AAEjG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGvE,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAWlD,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,aAAa,GAAG,aAAa,GAAG,gBAAgB,CAAC;IACrE,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;CACvB;AAED,UAAU,qBAAqB;IAC7B,OAAO,EAAE,wBAAwB,CAAC;IAClC,GAAG,EAAE,cAAc,CAAC;IACpB,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,eAAe;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACrC;AAED,UAAU,mBAAmB;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,GAAG,WAAW,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC,KAAK,CACH,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3B,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACvD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACzD,gBAAgB,CACd,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,cAAc,CAAC;QACxB,MAAM,CAAC,EAAE,eAAe,CAAC;QACzB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,6BAA6B,CAAC,EAAE,OAAO,CAAC;KACzC,GACA,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACtC,YAAY,CACV,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,cAAc,CAAC;QACxB,MAAM,CAAC,EAAE,eAAe,CAAC;QACzB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,6BAA6B,CAAC,EAAE,OAAO,CAAC;KACzC,GACA,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAClC,oBAAoB,CAClB,MAAM,CAAC,EAAE,oBAAoB,GAC5B,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpD,OAAO,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAClF,sBAAsB,CAAC,MAAM,EAAE,6BAA6B,GAAG,gBAAgB,CAAC;IAChF,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvE,sBAAsB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACtE,sBAAsB,CAAC,KAAK,EAAE;QAC5B,OAAO,EAAE,wBAAwB,CAAC;QAClC,GAAG,EAAE,cAAc,CAAC;QACpB,GAAG,EAAE,OAAO,CAAC;KACd,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACvC,wBAAwB,CAAC,KAAK,EAAE;QAC9B,OAAO,EAAE,wBAAwB,CAAC;QAClC,GAAG,EAAE,cAAc,CAAC;QACpB,GAAG,EAAE,OAAO,CAAC;KACd,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACvC,8BAA8B,CAAC,KAAK,EAAE;QACpC,OAAO,EAAE,wBAAwB,CAAC;QAClC,GAAG,EAAE,cAAc,CAAC;QACpB,GAAG,EAAE,OAAO,CAAC;KACd,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACvC,yBAAyB,CAAC,KAAK,EAAE;QAC/B,OAAO,EAAE,wBAAwB,CAAC;QAClC,GAAG,EAAE,cAAc,CAAC;QACpB,GAAG,EAAE,OAAO,CAAC;KACd,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACvC,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,GAAG,IAAI,MAAM,CAAC;CACf;AAg2CD,qBAAa,wBAAyB,SAAQ,WAAW;IAS3C,OAAO,CAAC,QAAQ,CAAC,IAAI;IARjC,QAAQ,EAAE,eAAe,CAMvB;gBAE2B,IAAI,GAAE,4BAA0C;IAIvE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CA0ExE"}

package/esm/src/server/handlers/request/project-run-execute.handler.js

@@ -817,6 +817,7 @@ async function executeReleaseAssetBuildRun(input) {
                 ssr: options.ssr,
                 studioEmbed: false,
                 reactVersion: options.reactVersion,
+                serverExternalPackages: releaseConfig.build?.serverExternalPackages,
                 dependencyPinningCacheKey: options.dependencyPinningSnapshot?.cacheKey,
                 dependencyPinningDependencies: options.dependencyPinningSnapshot?.dependencies,
                 dependencyPinningSource: options.dependencyPinningSource,

package/esm/src/server/handlers/request/snippet.handler.d.ts

@@ -1,7 +1,13 @@
 import { BaseHandler } from "../response/base.js";
 import type { HandlerContext, HandlerMetadata, HandlerResult } from "../types.js";
+import { renderSnippet } from "../../../rendering/snippet-renderer.js";
+export interface SnippetHandlerDeps {
+    renderSnippet: typeof renderSnippet;
+}
 export declare class SnippetHandler extends BaseHandler {
+    private readonly deps;
     metadata: HandlerMetadata;
+    constructor(deps?: SnippetHandlerDeps);
     handle(req: Request, ctx: HandlerContext): Promise<HandlerResult>;
     private resolveFilePath;
     private getModuleServerUrl;

package/esm/src/server/handlers/request/snippet.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"snippet.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/request/snippet.handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAuBnG,qBAAa,cAAe,SAAQ,WAAW;IAC7C,QAAQ,EAAE,eAAe,CAIvB;IAEI,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAwHvE,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,eAAe;CASxB"}
+{"version":3,"file":"snippet.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/request/snippet.handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAEnG,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAqBvE,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,OAAO,aAAa,CAAC;CACrC;AAID,qBAAa,cAAe,SAAQ,WAAW;IAOjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IANjC,QAAQ,EAAE,eAAe,CAIvB;gBAE2B,IAAI,GAAE,kBAAgC;IAI7D,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAyHvE,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,eAAe;CASxB"}

package/esm/src/server/handlers/request/snippet.handler.js

@@ -7,12 +7,18 @@ import { requiresIsolatedProjectRuntime } from "../../../security/project-locali
 import { createHandlerDependencyPinningSource, getHandlerDependencyPinningIdentity, } from "../utils/dependency-pinning-source.js";
 const logger = serverLogger.component("snippet-handler");
 const PRIORITY_SNIPPET = 450;
+const defaultDeps = { renderSnippet };
 export class SnippetHandler extends BaseHandler {
+    deps;
     metadata = {
         name: "SnippetHandler",
         priority: PRIORITY_SNIPPET,
         patterns: [{ pattern: /^\/(@\/|@components\/)/, method: "GET" }],
     };
+    constructor(deps = defaultDeps) {
+        super();
+        this.deps = deps;
+    }
     async handle(req, ctx) {
         const url = new URL(req.url);
         const { pathname } = url;
@@ -63,13 +69,14 @@ export class SnippetHandler extends BaseHandler {
                 const pageId = url.searchParams.get("page_id") ?? undefined;
                 const isDev = !!ctx.isLocalProject;
                 const dependencyIdentity = getHandlerDependencyPinningIdentity(ctx);
-                const result = await renderSnippet(content, {
+                const result = await this.deps.renderSnippet(content, {
                     mode: isDev ? "development" : "production",
                     projectDir: ctx.projectDir,
                     adapter: stableAdapter,
                     isLocalProject: ctx.isLocalProject,
                     projectId: dependencyIdentity.projectId,
                     contentSourceId: dependencyIdentity.contentSourceId,
+                    releaseId: dependencyIdentity.releaseId,
                     dependencyPinningSource: createHandlerDependencyPinningSource(ctx),
                     filePath: admittedPath,
                     moduleServerUrl,

package/esm/src/server/handlers/request/ssr/error-page-fallback.js

@@ -180,6 +180,7 @@ async function loadErrorComponent(filePath, ctx, reactVersion, dependencySnapsho
         dev: isLocal,
         contentSourceId,
         reactVersion,
+        serverExternalPackages: ctx.config?.build?.serverExternalPackages,
         moduleServerOrigin,
         dependencyPinningCacheKey: dependencySnapshot.cacheKey,
         dependencyPinningDependencies: dependencySnapshot.dependencies,

package/esm/src/server/handlers/request/ssr/ssr-response-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-response-builder.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/request/ssr/ssr-response-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAElF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAgBrF;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,QAAQ,CAAC,CAmEnB"}
+{"version":3,"file":"ssr-response-builder.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/request/ssr/ssr-response-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAElF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAiBrF;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,QAAQ,CAAC,CAsEnB"}

package/esm/src/server/handlers/request/ssr/ssr-response-builder.js

@@ -11,6 +11,7 @@ import { getContentType } from "../../utils/content-types.js";
 import { ErrorPages } from "../../../utils/error-html.js";
 import { addNonceToHtmlTags } from "../../../../html/nonce-injection.js";
 import { serverLogger } from "../../../../utils/index.js";
+import { appendDataResponseMetadata } from "../../../../data/response-metadata.js";
 const logger = serverLogger.component("ssr-response-builder");
 async function cancelHeadResponseBody(body) {
     if (!body)
@@ -33,12 +34,13 @@ export async function buildSSRResponse(req, ctx, result, builder) {
     const isDev = !!ctx.isLocalProject;
     // Streaming response path
     if (result.isStreaming && result.stream) {
-        const response = builder
+        const responseBuilder = builder
             .withCORS(req, ctx.securityConfig?.cors)
             .withSecurity(ctx.securityConfig ?? undefined, req)
             .withClientHints()
-            .withCache(result.cacheStrategy)
-            .withContentType(getContentType(".html"), result.stream, result.status);
+            .withCache(result.cacheStrategy);
+        appendDataResponseMetadata(responseBuilder.headers, result);
+        const response = responseBuilder.withContentType(getContentType(".html"), result.stream, result.status);
         if (!isHeadRequest)
             return response;
         await cancelHeadResponseBody(response.body);
@@ -46,11 +48,12 @@ export async function buildSSRResponse(req, ctx, result, builder) {
     }
     // ETag match → 304 Not Modified (production only)
     if (!isDev && !builder.nonce && result.etag && hasMatchingEtag(req, result.etag)) {
-        return builder
+        const responseBuilder = builder
             .withCORS(req, ctx.securityConfig?.cors)
             .withSecurity(ctx.securityConfig ?? undefined, req)
-            .withCache(result.cacheStrategy)
-            .notModified(result.etag);
+            .withCache(result.cacheStrategy);
+        appendDataResponseMetadata(responseBuilder.headers, result);
+        return responseBuilder.notModified(result.etag);
     }
     // Buffered response path
     const renderedContent = typeof result.html === "string"
@@ -76,6 +79,7 @@ export async function buildSSRResponse(req, ctx, result, builder) {
         response = response.withClientHints();
     if (result.etag)
         response = response.withETag(result.etag);
+    appendDataResponseMetadata(response.headers, result);
     const finalResponse = response.withContentType(getContentType(".html"), body, result.status);
     if (!isHeadRequest || !finalResponse.body)
         return finalResponse;

package/esm/src/server/handlers/request/ssr/ssr.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr.handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/request/ssr/ssr.handler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EAEf,aAAa,EACd,MAAM,gBAAgB,CAAC;AAWxB,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,4CAA4C,CAAC;AAuBpD;;;;;;;;;;GAUG;AAEH,qBAAa,UAAW,SAAQ,WAAW;IACzC,QAAQ,EAAE,eAAe,CAIvB;IAEF,OAAO,CAAC,UAAU,CAAiB;gBAEvB,UAAU,CAAC,EAAE,cAAc;IAKvC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAoDjE,OAAO,CAAC,qBAAqB;IAmF7B,OAAO,CAAC,iBAAiB;IAwHzB,OAAO,CAAC,cAAc;YAqBR,cAAc;YA0Cd,sBAAsB;YAsBtB,aAAa;IAe3B,OAAO,CAAC,gCAAgC;IAaxC,OAAO,CAAC,6BAA6B;CAStC"}
+{"version":3,"file":"ssr.handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/handlers/request/ssr/ssr.handler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EAEf,aAAa,EACd,MAAM,gBAAgB,CAAC;AAWxB,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,4CAA4C,CAAC;AAwBpD;;;;;;;;;;GAUG;AAEH,qBAAa,UAAW,SAAQ,WAAW;IACzC,QAAQ,EAAE,eAAe,CAIvB;IAEF,OAAO,CAAC,UAAU,CAAiB;gBAEvB,UAAU,CAAC,EAAE,cAAc;IAKvC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAoDjE,OAAO,CAAC,qBAAqB;IAmF7B,OAAO,CAAC,iBAAiB;IAyHzB,OAAO,CAAC,cAAc;YAsBR,cAAc;YAoDd,sBAAsB;YAwBtB,aAAa;IAe3B,OAAO,CAAC,gCAAgC;IAaxC,OAAO,CAAC,6BAA6B;CAStC"}

package/esm/src/server/handlers/request/ssr/ssr.handler.js

@@ -27,6 +27,7 @@ import { applySnapshotResponseHeaders, readSnapshotHeader, resolveSnapshotForReq
 import { isProductionMode, shouldHideRouteInProduction } from "../route-visibility-policy.js";
 import { createErrorResponseFromDefinition, PROJECT_EXECUTION_UNAVAILABLE, } from "../../../../errors/index.js";
 import { requiresIsolatedProjectRuntime } from "../../../../security/project-locality.js";
+import { appendDataResponseMetadata } from "../../../../data/response-metadata.js";
 const logger = serverLogger.component("ssr");
 /**
  * SSR Handler - Thin orchestration layer
@@ -216,7 +217,7 @@ export class SSRHandler extends BaseHandler {
                 case "redirect":
                     return this.handleRedirect(req, ctx, rendered, failure.location, nonce);
                 case "not-found":
-                    return this.handleNotFound(applicationRequest, ctx, slug, nonce, dependencySnapshot);
+                    return this.handleNotFound(applicationRequest, ctx, slug, nonce, dependencySnapshot, rendered);
                 case "overloaded":
                 case "runtime":
                 case "server-error": {
@@ -236,26 +237,31 @@ export class SSRHandler extends BaseHandler {
         }, { "ssr.slug": slug, "ssr.projectSlug": ctx.projectSlug || "unknown" });
     }
     handleRedirect(req, ctx, result, location, nonce) {
-        const response = this.createSnapshotResponseBuilder(ctx, nonce, result.dependencyPinningCacheKey)
+        const builder = this.createSnapshotResponseBuilder(ctx, nonce, result.dependencyPinningCacheKey)
             .withCORS(req, ctx.securityConfig?.cors)
             .withSecurity(ctx.securityConfig ?? undefined, req)
             .withCache(result.cacheStrategy)
-            .withHeaders({ Location: location })
-            .build(null, result.status);
+            .withHeaders({ Location: location });
+        appendDataResponseMetadata(builder.headers, result);
+        const response = builder.build(null, result.status);
         return this.respond(response);
     }
-    async handleNotFound(req, ctx, slug, nonce, dependencySnapshot) {
+    async handleNotFound(req, ctx, slug, nonce, dependencySnapshot, result) {
         const builder = this.createSnapshotResponseBuilder(ctx, nonce, dependencySnapshot.cacheKey);
         const notFoundResponse = await tryNotFoundFallback(req, slug, ctx, builder, dependencySnapshot);
-        if (notFoundResponse)
+        if (notFoundResponse) {
+            appendDataResponseMetadata(notFoundResponse.headers, result);
             return this.respond(notFoundResponse);
+        }
         const customResponse = await tryErrorPageFallback(req, ctx, builder, {
             statusCode: 404,
             pathname: slug || "/",
         }, dependencySnapshot);
-        if (customResponse)
+        if (customResponse) {
+            appendDataResponseMetadata(customResponse.headers, result);
             return this.respond(customResponse);
-        const result = {
+        }
+        const fallbackResult = {
             status: 404,
             html: ErrorPages.notFound(slug || "/"),
             htmlProvenance: "framework",
@@ -264,8 +270,11 @@ export class SSRHandler extends BaseHandler {
             failure: { kind: "not-found" },
             slug,
             dependencyPinningCacheKey: dependencySnapshot.cacheKey,
+            ...(result.headers ? { headers: result.headers } : {}),
+            ...(result.cookies ? { cookies: result.cookies } : {}),
         };
-        return this.buildResponse(req, ctx, result, nonce);
+        const response = await buildSSRResponse(req, ctx, fallbackResult, builder);
+        return this.respond(response);
     }
     async tryCustomErrorFallback(req, ctx, result, error, nonce, dependencySnapshot) {
         const builder = this.createSnapshotResponseBuilder(ctx, nonce, result.dependencyPinningCacheKey);
@@ -274,7 +283,10 @@ export class SSRHandler extends BaseHandler {
             error,
             pathname: result.slug || "/",
         }, dependencySnapshot);
-        return customResponse ? this.respond(customResponse) : null;
+        if (!customResponse)
+            return null;
+        appendDataResponseMetadata(customResponse.headers, result);
+        return this.respond(customResponse);
     }
     async buildResponse(req, ctx, result, nonce) {
         const builder = this.createSnapshotResponseBuilder(ctx, nonce, result.dependencyPinningCacheKey);

package/esm/src/server/handlers/request/static.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"static.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/request/static.handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAoCnG,qBAAa,aAAc,SAAQ,WAAW;IAC5C,QAAQ,EAAE,eAAe,CAOvB;IAEF,OAAO,CAAC,aAAa,CAA2B;IAEhD,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAejE,OAAO,CAAC,cAAc;CAwFvB"}
+{"version":3,"file":"static.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/request/static.handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAoCnG,qBAAa,aAAc,SAAQ,WAAW;IAC5C,QAAQ,EAAE,eAAe,CAOvB;IAEF,OAAO,CAAC,aAAa,CAA2B;IAEhD,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAejE,OAAO,CAAC,cAAc;CAyFvB"}

package/esm/src/server/handlers/request/static.handler.js

@@ -72,6 +72,7 @@ export class StaticHandler extends BaseHandler {
                 adapter: ctx.adapter,
                 isPreviewMode,
                 isLocalProject: isLocal,
+                buildOutDir: ctx.config?.build?.outDir,
             };
             const result = await this.staticService.resolveFile(pathname, resolveOptions);
             if (!result) {

package/esm/src/server/runtime-handler/handler-context-builder.d.ts

@@ -20,6 +20,8 @@ export interface HandlerContextOptions {
     adapter: RuntimeAdapter;
     /** Security config */
     securityConfig: SecurityConfig | null;
+    /** Browser-visible HTTP(S) origin resolved at the trusted request boundary. */
+    requestOrigin: string | null;
     /** CSP user header */
     /** Debug mode */
     debug: boolean | undefined;

package/esm/src/server/runtime-handler/handler-context-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler-context-builder.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/handler-context-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,uEAAuE;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAIrE,MAAM,WAAW,qBAAqB;IACpC,wBAAwB;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB,sBAAsB;IACtB,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,sBAAsB;IACtB,iBAAiB;IACjB,KAAK,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,uBAAuB;IACvB,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,yBAAyB;IACzB,YAAY,EAAE,YAAY,CAAC;IAC3B,mBAAmB;IACnB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,uBAAuB;IACvB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,2BAA2B;IAC3B,mBAAmB,EAAE,SAAS,GAAG,YAAY,CAAC;IAC9C,kDAAkD;IAClD,cAAc,EAAE,OAAO,+BAA+B,EAAE,cAAc,CAAC;IACvE,qBAAqB;IACrB,aAAa,EAAE,aAAa,CAAC;IAC7B,sCAAsC;IACtC,cAAc,EAAE,OAAO,CAAC;IACxB,+DAA+D;IAC/D,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,mFAAmF;IACnF,WAAW,EAAE,OAAO,CAAC;IACrB,wBAAwB;IACxB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,sFAAsF;IACtF,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,6FAA6F;IAC7F,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,cAAc,CAAC,4BAA4B,CAAC,CAAC;CAC3E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,GAAG,cAAc,CAyD/E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,cAAc,EAAE,cAAc,GAAG,IAAI,EACrC,KAAK,EAAE,OAAO,GAAG,SAAS,EAC1B,MAAM,EAAE,eAAe,GAAG,SAAS,GAClC,cAAc,CAQhB"}
+{"version":3,"file":"handler-context-builder.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/handler-context-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,uEAAuE;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAIrE,MAAM,WAAW,qBAAqB;IACpC,wBAAwB;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB,sBAAsB;IACtB,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,+EAA+E;IAC/E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sBAAsB;IACtB,iBAAiB;IACjB,KAAK,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,uBAAuB;IACvB,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,yBAAyB;IACzB,YAAY,EAAE,YAAY,CAAC;IAC3B,mBAAmB;IACnB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,uBAAuB;IACvB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,2BAA2B;IAC3B,mBAAmB,EAAE,SAAS,GAAG,YAAY,CAAC;IAC9C,kDAAkD;IAClD,cAAc,EAAE,OAAO,+BAA+B,EAAE,cAAc,CAAC;IACvE,qBAAqB;IACrB,aAAa,EAAE,aAAa,CAAC;IAC7B,sCAAsC;IACtC,cAAc,EAAE,OAAO,CAAC;IACxB,+DAA+D;IAC/D,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,mFAAmF;IACnF,WAAW,EAAE,OAAO,CAAC;IACrB,wBAAwB;IACxB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,sFAAsF;IACtF,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,6FAA6F;IAC7F,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,cAAc,CAAC,4BAA4B,CAAC,CAAC;CAC3E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,GAAG,cAAc,CA0D/E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,cAAc,EAAE,cAAc,GAAG,IAAI,EACrC,KAAK,EAAE,OAAO,GAAG,SAAS,EAC1B,MAAM,EAAE,eAAe,GAAG,SAAS,GAClC,cAAc,CAQhB"}

package/esm/src/server/runtime-handler/handler-context-builder.js

@@ -40,6 +40,7 @@ export function buildHandlerContext(opts) {
         adapter: opts.adapter,
         moduleServerUrl: opts.moduleServerUrl,
         securityConfig: opts.securityConfig,
+        requestOrigin: opts.requestOrigin,
         debug: opts.debug,
         config: opts.config,
         parsedDomain: opts.parsedDomain,

package/esm/src/server/runtime-handler/project-runtime-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-runtime-context.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/project-runtime-context.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM3D,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAKhF,KAAK,kBAAkB,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE7D,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,GAAG,CAAC;IACT,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACtE,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACrE,KAAK,yBAAyB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;AAC5E,KAAK,wBAAwB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;AAC3E,KAAK,4BAA4B,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC1E,KAAK,uBAAuB,GAAG,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAEnF,KAAK,sBAAsB,GAAG;IAC5B,GAAG,CAAC,KAAK,EAAE;QACT,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrC,CAAC;AAEF,KAAK,sBAAsB,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;AAE7E,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,qBAAqB,CAAC;IAC/B,cAAc,EAAE,qBAAqB,CAAC;IACtC,UAAU,EAAE;QACV,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;QAClC,sBAAsB,EAAE,OAAO,CAAC;KACjC,CAAC;IACF,WAAW,EAAE,mBAAmB,CAAC;IACjC,aAAa,EAAE,oBAAoB,CAAC;IACpC,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,qBAAqB,CAAC;IAC/B,cAAc,EAAE,qBAAqB,CAAC;IACtC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,EAAE;QACV,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;KACnC,CAAC;CACH;AAED,MAAM,WAAW,iCAAiC;IAChD,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,GAAG,CAAC;IACT,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,eAAe,EAAE,yBAAyB,CAAC;IAC3C,OAAO,EAAE,qBAAqB,CAAC;IAC/B,cAAc,EAAE,qBAAqB,CAAC;IACtC,WAAW,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,UAAU,EAAE;QACV,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;KACnC,CAAC;IACF,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,KAAK,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC;IAC9C,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,WAAW,EAAE,sBAAsB,CAAC;IACpC,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,qBAAqB,CAAC,EAAE,CAAC,WAAW,EAAE,4BAA4B,KAAK,IAAI,CAAC;IAC5E,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACvE;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,wBAAwB,CAAC;IAClC,WAAW,EAAE,4BAA4B,CAAC;IAC1C,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IAC3C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,uBAAuB,EAAE,uBAAuB,CAAC;CAClD;AAED,UAAU,mBAAmB;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,oBAAoB;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,sBAAsB,CAAC,CA8CjC;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,yBAAyB,CAAC,CAcpC;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,+BAA+B,CAAC,CAqQ1C;AAyED;;;;;;;GAOG;AACH;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,OAAO,EAAE,cAAc,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC,GAAG,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,CA+FxC"}
+{"version":3,"file":"project-runtime-context.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/project-runtime-context.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM3D,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAKhF,KAAK,kBAAkB,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE7D,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,GAAG,CAAC;IACT,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACtE,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACrE,KAAK,yBAAyB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;AAC5E,KAAK,wBAAwB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;AAC3E,KAAK,4BAA4B,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC1E,KAAK,uBAAuB,GAAG,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAEnF,KAAK,sBAAsB,GAAG;IAC5B,GAAG,CAAC,KAAK,EAAE;QACT,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrC,CAAC;AAEF,KAAK,sBAAsB,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;AAE7E,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,qBAAqB,CAAC;IAC/B,cAAc,EAAE,qBAAqB,CAAC;IACtC,UAAU,EAAE;QACV,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;QAClC,sBAAsB,EAAE,OAAO,CAAC;KACjC,CAAC;IACF,WAAW,EAAE,mBAAmB,CAAC;IACjC,aAAa,EAAE,oBAAoB,CAAC;IACpC,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,qBAAqB,CAAC;IAC/B,cAAc,EAAE,qBAAqB,CAAC;IACtC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,EAAE;QACV,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;KACnC,CAAC;CACH;AAED,MAAM,WAAW,iCAAiC;IAChD,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,GAAG,CAAC;IACT,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,eAAe,EAAE,yBAAyB,CAAC;IAC3C,OAAO,EAAE,qBAAqB,CAAC;IAC/B,cAAc,EAAE,qBAAqB,CAAC;IACtC,WAAW,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,UAAU,EAAE;QACV,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;KACnC,CAAC;IACF,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,KAAK,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC;IAC9C,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,WAAW,EAAE,sBAAsB,CAAC;IACpC,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,qBAAqB,CAAC,EAAE,CAAC,WAAW,EAAE,4BAA4B,KAAK,IAAI,CAAC;IAC5E,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACvE;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,wBAAwB,CAAC;IAClC,WAAW,EAAE,4BAA4B,CAAC;IAC1C,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IAC3C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,uBAAuB,EAAE,uBAAuB,CAAC;CAClD;AAED,UAAU,mBAAmB;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,oBAAoB;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,sBAAsB,CAAC,CA8CjC;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,yBAAyB,CAAC,CAcpC;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,+BAA+B,CAAC,CAyQ1C;AAyED;;;;;;;GAOG;AACH;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,OAAO,EAAE,cAAc,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC,GAAG,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,CA+FxC"}

package/esm/src/server/runtime-handler/project-runtime-context.js

@@ -8,7 +8,7 @@ import { isExtendedFSAdapter } from "../../platform/adapters/index.js";
 import { normalizeSourceIntegrationPolicy } from "../../integrations/source-policy.js";
 import { createRequestContext } from "../context/request-context.js";
 import { isProxyTrusted } from "../utils/proxy-trust.js";
-import { getEffectiveRequestHost } from "../utils/request-host.js";
+import { getEffectiveRequestHost, getEffectiveRequestOrigin } from "../utils/request-host.js";
 import { resolveAdapter } from "./adapter-factory.js";
 import { resolveEnvironment } from "./environment-resolution.js";
 import { buildHandlerContext } from "./handler-context-builder.js";
@@ -129,7 +129,10 @@ export async function resolveProjectRuntimeContext(input) {
         proxyTrusted: input.proxyTrust.proxyTrusted,
         ...(input.isProxyMode ? { prepareHostedConfigContext } : {}),
     }));
-    const host = getEffectiveRequestHost(input.req, input.url, input.proxyTrust.proxyTrusted ?? getHostEnv("VERYFRONT_TRUST_FORWARDED_HEADERS") === "1");
+    const trustProxyHeaders = input.proxyTrust.proxyTrusted ??
+        getHostEnv("VERYFRONT_TRUST_FORWARDED_HEADERS") === "1";
+    const host = getEffectiveRequestHost(input.req, input.url, trustProxyHeaders);
+    const requestOrigin = getEffectiveRequestOrigin(input.req, input.url, trustProxyHeaders);
     const envRes = resolveEnvironment({
         proxyEnv: projectRes.proxyEnv,
         reqCtxMode: reqCtx.mode,
@@ -236,6 +239,7 @@ export async function resolveProjectRuntimeContext(input) {
         projectDir: adapterRes.projectDir,
         adapter: adapterRes.adapter,
         securityConfig: requestSecurity?.securityConfig ?? input.securityConfig,
+        requestOrigin,
         debug: input.debug,
         config: adapterRes.config,
         parsedDomain: projectRes.parsedDomain,

package/esm/src/server/runtime-handler/request-tracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-tracker.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/request-tracker.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAMzE,UAAU,cAAc;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;IAC1C,aAAa,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;CAC/C;AAsED,cAAM,cAAc;IAClB,OAAO,CAAC,QAAQ,CAAqC;IACrD,OAAO,CAAC,cAAc,CAA6C;IACnE,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,aAAa,CAAK;IAE1B,OAAO,CAAC,kBAAkB;IA8B1B,OAAO,CAAC,iBAAiB;IAMzB,KAAK,CACH,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,GAAG,CAAC,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,iBAAiB,UAAQ,GACxB,IAAI;IA0DP,QAAQ,CACN,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,QAAQ,UAAQ,EAChB,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,GACpC,IAAI;IA4CP,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IActC,gBAAgB,IAAI,MAAM;IAI1B,mBAAmB,IAAI,cAAc,EAAE;IAIvC,QAAQ,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;IAS9E,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,SAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsD7E,QAAQ,IAAI,IAAI;CAUjB;AAED,eAAO,MAAM,cAAc,gBAAuB,CAAC"}
+{"version":3,"file":"request-tracker.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/request-tracker.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAMzE,UAAU,cAAc;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;IAC1C,aAAa,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;CAC/C;AA6ED,cAAM,cAAc;IAClB,OAAO,CAAC,QAAQ,CAAqC;IACrD,OAAO,CAAC,cAAc,CAA6C;IACnE,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,aAAa,CAAK;IAE1B,OAAO,CAAC,kBAAkB;IA8B1B,OAAO,CAAC,iBAAiB;IAMzB,KAAK,CACH,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,GAAG,CAAC,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,iBAAiB,UAAQ,GACxB,IAAI;IA8DP,QAAQ,CACN,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,QAAQ,UAAQ,EAChB,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,GACpC,IAAI;IA4CP,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IActC,gBAAgB,IAAI,MAAM;IAI1B,mBAAmB,IAAI,cAAc,EAAE;IAIvC,QAAQ,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;IAS9E,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,SAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsD7E,QAAQ,IAAI,IAAI;CAUjB;AAED,eAAO,MAAM,cAAc,gBAAuB,CAAC"}

package/esm/src/server/runtime-handler/request-tracker.js

@@ -22,6 +22,11 @@ const DRAIN_PROGRESS_LOG_INTERVAL_MS = 5_000; // 5 seconds
 const MODULE_REQUEST_LOG_THRESHOLD_MS = 100;
 /** Attach request-profiler details to completion logs at or above this duration. */
 const DEFAULT_SLOW_REQUEST_PROFILE_LOG_THRESHOLD_MS = 2_000;
+/** Control-plane execution can legitimately run until the configured request timeout. */
+const RUN_EXECUTION_PATH_PATTERN = /^\/api\/control-plane\/runs\/[^/]+\/execute$/u;
+function isExpectedLongRunningRequest(path, method) {
+    return method === "POST" && RUN_EXECUTION_PATH_PATTERN.test(path);
+}
 function getSlowRequestProfileLogThresholdMs() {
     const raw = getEnv("VERYFRONT_SLOW_REQUEST_PROFILE_LOG_THRESHOLD_MS");
     if (!raw)
@@ -119,9 +124,11 @@ class RequestTracker {
             releaseId,
             productionRuntime,
         };
-        // WebSocket connections are long-lived by design and lightweight internal
-        // asset/module requests can be noisy under CI jitter — don't flag them as stuck.
-        if (!isWebSocketPath(path) && !isLightweightPath(path)) {
+        // WebSocket connections and control-plane execution are long-lived by design.
+        // Lightweight internal asset/module requests can be noisy under CI jitter.
+        if (!isExpectedLongRunningRequest(path, method) &&
+            !isWebSocketPath(path) &&
+            !isLightweightPath(path)) {
             tracked.slowTimer = setTimeout(() => {
                 const elapsedMs = Math.round(performance.now() - startTime);
                 logger.warn("Slow request detected", {

package/esm/src/server/services/rendering/ssr.service.d.ts

@@ -3,6 +3,7 @@ import { type RendererAdapter } from "../../shared/renderer-factory.js";
 import type { SSRFailureOutcome } from "../../../rendering/ssr-outcome.js";
 import type { CacheRepository } from "../../../repositories/types.js";
 import type { DependencyPinningSourceInput } from "../../../transforms/esm/package-registry.js";
+import type { ResponseCookie } from "../../../data/types.js";
 /**
  * Provides a renderer for a given handler context.
  * Extracted to allow dependency injection in tests.
@@ -42,6 +43,10 @@ export interface SSRRenderResult {
     slug: string;
     /** Dependency snapshot identity rendered into this document. */
     dependencyPinningCacheKey?: string;
+    /** Validated application headers appended after framework-owned headers. */
+    headers?: Record<string, string>;
+    /** Distinct cookies emitted as separate Set-Cookie response fields. */
+    cookies?: ResponseCookie[];
 }
 export interface SSRRenderOptions {
     request: Request;

package/esm/src/server/services/rendering/ssr.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr.service.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/services/rendering/ssr.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,kCAAkC,CAAC;AAI1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAoB3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAKhG;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC5D;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,mBAAmB,IAAI,YAAY,CAAC;IACpC,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACrF,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;CAC3D;AAUD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,cAAc,CAAC,EAAE,WAAW,CAAC;IAC7B,MAAM,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,UAAU,GAAG,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,2EAA2E;IAC3E,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,mEAAmE;IACnE,6BAA6B,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,yEAAyE;IACzE,uBAAuB,CAAC,EAAE,4BAA4B,CAAC;CACxD;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAsDD,qBAAa,UAAW,YAAW,cAAc;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAA0B;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;gBAExC,OAAO,CAAC,EAAE;QACpB,SAAS,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;KACrC;IAKD,mBAAmB,IAAI,YAAY;IAW7B,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAS1D,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IA+I1F,OAAO,CAAC,iBAAiB;IA4HzB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe;CAU1D"}
+{"version":3,"file":"ssr.service.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/services/rendering/ssr.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,kCAAkC,CAAC;AAI1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAyB3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAEhG,OAAO,KAAK,EAAwB,cAAc,EAAE,MAAM,wBAAwB,CAAC;AASnF;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC5D;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,mBAAmB,IAAI,YAAY,CAAC;IACpC,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACrF,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;CAC3D;AAUD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,cAAc,CAAC,EAAE,WAAW,CAAC;IAC7B,MAAM,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,UAAU,GAAG,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,uEAAuE;IACvE,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,2EAA2E;IAC3E,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,mEAAmE;IACnE,6BAA6B,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,yEAAyE;IACzE,uBAAuB,CAAC,EAAE,4BAA4B,CAAC;CACxD;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAqED,qBAAa,UAAW,YAAW,cAAc;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAA0B;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;gBAExC,OAAO,CAAC,EAAE;QACpB,SAAS,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;KACrC;IAKD,mBAAmB,IAAI,YAAY;IAW7B,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAS1D,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IA8J1F,OAAO,CAAC,iBAAiB;IA0KzB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe;CAU1D"}