veryfront 0.1.229 → 0.1.230

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.229",
+    "version": "0.1.230",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "workspace": [

package/esm/src/agent/hosted-child-lifecycle.d.ts

@@ -0,0 +1,41 @@
+export interface HostedChildLifecycleTerminalState {
+    status: "completed" | "failed" | "cancelled";
+    usage?: {
+        inputTokens?: number;
+        outputTokens?: number;
+        totalTokens?: number;
+    };
+    terminalErrorCode?: string | null;
+    terminalErrorMessage?: string | null;
+}
+export interface HostedChildLifecycleCompletedState extends Omit<HostedChildLifecycleTerminalState, "status"> {
+    status: "completed";
+}
+export interface HostedChildLifecycleAdapter {
+    pending?: () => Promise<void> | void;
+    running?: () => Promise<void> | void;
+    completed?: (terminalState: HostedChildLifecycleTerminalState) => Promise<void> | void;
+    failed?: (terminalState: HostedChildLifecycleTerminalState) => Promise<void> | void;
+    cancelled?: (terminalState: HostedChildLifecycleTerminalState) => Promise<void> | void;
+}
+export interface HostedChildLifecycleErrorState extends Omit<HostedChildLifecycleTerminalState, "status"> {
+    status: "failed" | "cancelled";
+}
+export interface HostedChildLifecycleRunnerOptions<TResult> {
+    adapter: HostedChildLifecycleAdapter;
+    execute: () => Promise<TResult> | TResult;
+    resolveCompletedState?: (result: TResult) => Promise<HostedChildLifecycleCompletedState> | HostedChildLifecycleCompletedState;
+    resolveErrorState: (error: unknown) => Promise<HostedChildLifecycleErrorState> | HostedChildLifecycleErrorState;
+    onLifecycleError?: (error: unknown) => Promise<void> | void;
+}
+export type HostedChildLifecycleRunResult<TResult> = {
+    status: "completed";
+    result: TResult;
+    terminalState: HostedChildLifecycleTerminalState;
+} | {
+    status: "failed" | "cancelled";
+    error: unknown;
+    terminalState: HostedChildLifecycleTerminalState;
+};
+export declare function runHostedChildLifecycle<TResult>(options: HostedChildLifecycleRunnerOptions<TResult>): Promise<HostedChildLifecycleRunResult<TResult>>;
+//# sourceMappingURL=hosted-child-lifecycle.d.ts.map

package/esm/src/agent/hosted-child-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-child-lifecycle.d.ts","sourceRoot":"","sources":["../../../src/src/agent/hosted-child-lifecycle.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iCAAiC;IAChD,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;IAC7C,KAAK,CAAC,EAAE;QACN,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,kCACf,SAAQ,IAAI,CAAC,iCAAiC,EAAE,QAAQ,CAAC;IACzD,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACrC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,CACV,aAAa,EAAE,iCAAiC,KAC7C,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,CACP,aAAa,EAAE,iCAAiC,KAC7C,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,CACV,aAAa,EAAE,iCAAiC,KAC7C,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,8BACf,SAAQ,IAAI,CAAC,iCAAiC,EAAE,QAAQ,CAAC;IACzD,MAAM,EAAE,QAAQ,GAAG,WAAW,CAAC;CAChC;AAED,MAAM,WAAW,iCAAiC,CAAC,OAAO;IACxD,OAAO,EAAE,2BAA2B,CAAC;IACrC,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAC1C,qBAAqB,CAAC,EAAE,CACtB,MAAM,EAAE,OAAO,KAEb,OAAO,CAAC,kCAAkC,CAAC,GAC3C,kCAAkC,CAAC;IACvC,iBAAiB,EAAE,CACjB,KAAK,EAAE,OAAO,KAEZ,OAAO,CAAC,8BAA8B,CAAC,GACvC,8BAA8B,CAAC;IACnC,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC7D;AAED,MAAM,MAAM,6BAA6B,CAAC,OAAO,IAC7C;IACA,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,iCAAiC,CAAC;CAClD,GACC;IACA,MAAM,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,iCAAiC,CAAC;CAClD,CAAC;AAmBJ,wBAAsB,uBAAuB,CAAC,OAAO,EACnD,OAAO,EAAE,iCAAiC,CAAC,OAAO,CAAC,GAClD,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC,CAsCjD"}

package/esm/src/agent/hosted-child-lifecycle.js

@@ -0,0 +1,47 @@
+async function dispatchTerminalState(adapter, terminalState) {
+    if (terminalState.status === "cancelled") {
+        await adapter.cancelled?.(terminalState);
+        return;
+    }
+    if (terminalState.status === "failed") {
+        await adapter.failed?.(terminalState);
+        return;
+    }
+    await adapter.completed?.(terminalState);
+}
+export async function runHostedChildLifecycle(options) {
+    await options.adapter.pending?.();
+    await options.adapter.running?.();
+    let result;
+    try {
+        result = await options.execute();
+    }
+    catch (error) {
+        const terminalState = await options.resolveErrorState(error);
+        try {
+            await dispatchTerminalState(options.adapter, terminalState);
+        }
+        catch (lifecycleError) {
+            if (options.onLifecycleError) {
+                await options.onLifecycleError(lifecycleError);
+            }
+            else {
+                throw lifecycleError;
+            }
+        }
+        return {
+            status: terminalState.status,
+            error,
+            terminalState,
+        };
+    }
+    const terminalState = options.resolveCompletedState
+        ? await options.resolveCompletedState(result)
+        : { status: "completed" };
+    await dispatchTerminalState(options.adapter, terminalState);
+    return {
+        status: "completed",
+        result,
+        terminalState,
+    };
+}

package/esm/src/agent/index.d.ts

@@ -89,6 +89,7 @@ export { type AgUiRuntimeContextItem, AgUiRuntimeContextItemSchema, type AgUiRun
 export { normalizeAgUiRuntimeMessages } from "./ag-ui-runtime-support.js";
 export { type AgUiBrowserEncodedEvent, type AgUiBrowserEncoderState, type AgUiBrowserRunFinishedMetadata, type AgUiRuntimeStreamEvent, buildAgUiBrowserFinalizeResponse, createAgUiBrowserEncoderState, finalizeAgUiBrowserEvents, mapRuntimeStreamEventToAgUiBrowserEvents, } from "./ag-ui-browser-encoder.js";
 export { type AgUiBrowserResponseEncoder, type AgUiBrowserResponseExecution, type AgUiBrowserResponseRequestState, createAgUiBrowserResponseStream, type CreateAgUiBrowserResponseStreamInput, } from "./ag-ui-browser-response-stream.js";
+export { type HostedChildLifecycleAdapter, type HostedChildLifecycleRunnerOptions, type HostedChildLifecycleRunResult, type HostedChildLifecycleTerminalState, runHostedChildLifecycle, } from "./hosted-child-lifecycle.js";
 export { type HostedLifecycleAdapter, type HostedLifecycleExecution, type HostedLifecycleRunnerOptions, type HostedLifecycleRunResult, type HostedLifecycleTerminalState, runHostedLifecycle, } from "./hosted-lifecycle.js";
 export { mergeToolCallInput, mergeToolInputDelta, parseDataStreamSseEvents, parseToolInputObject, streamDataStreamEvents, stripLeadingEmptyObjectPlaceholder, } from "./data-stream.js";
 export { expandAllowedRemoteToolNames, getProviderNativeToolNames, type ProviderNativeToolInventoryOptions, } from "./provider-native-tool-inventory.js";

package/esm/src/agent/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/agent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,OAAO,yBAAyB,CAAC;AAGjC,YAAY,EACV,KAAK,EACL,WAAW,EACX,YAAY,EACZ,eAAe,EACf,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,OAAO,IAAI,YAAY,EACvB,WAAW,EACX,aAAa,EACb,WAAW,EACX,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,KAAK,MAAM,EACX,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,WAAW,EACX,KAAK,iBAAiB,EACtB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,WAAW,EACX,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACrC,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,iCAAiC,EACtC,KAAK,yBAAyB,EAC9B,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,KAAK,uBAAuB,EAC5B,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,EACnC,KAAK,sBAAsB,EAC3B,gCAAgC,EAChC,6BAA6B,EAC7B,yBAAyB,EACzB,wCAAwC,GACzC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,+BAA+B,EAC/B,KAAK,oCAAoC,GAC1C,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EACjC,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,kCAAkC,GACnC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,KAAK,kCAAkC,GACxC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,KAAK,yBAAyB,EAC9B,+BAA+B,EAC/B,KAAK,+BAA+B,EACpC,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,8BAA8B,EAC9B,wBAAwB,EACxB,KAAK,6BAA6B,GACnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,YAAY,EACjB,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,uBAAuB,EACvB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,EAC5B,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/agent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,OAAO,yBAAyB,CAAC;AAGjC,YAAY,EACV,KAAK,EACL,WAAW,EACX,YAAY,EACZ,eAAe,EACf,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,OAAO,IAAI,YAAY,EACvB,WAAW,EACX,aAAa,EACb,WAAW,EACX,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,KAAK,MAAM,EACX,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,WAAW,EACX,KAAK,iBAAiB,EACtB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,WAAW,EACX,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACrC,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,iCAAiC,EACtC,KAAK,yBAAyB,EAC9B,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,KAAK,uBAAuB,EAC5B,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,EACnC,KAAK,sBAAsB,EAC3B,gCAAgC,EAChC,6BAA6B,EAC7B,yBAAyB,EACzB,wCAAwC,GACzC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,+BAA+B,EAC/B,KAAK,oCAAoC,GAC1C,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,iCAAiC,EACtC,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACtC,uBAAuB,GACxB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EACjC,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,kCAAkC,GACnC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,KAAK,kCAAkC,GACxC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,KAAK,yBAAyB,EAC9B,+BAA+B,EAC/B,KAAK,+BAA+B,EACpC,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,8BAA8B,EAC9B,wBAAwB,EACxB,KAAK,6BAA6B,GACnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,YAAY,EACjB,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,8BAA8B,EAC9B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,uBAAuB,EACvB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,EAC5B,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAC/B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC"}

package/esm/src/agent/index.js

@@ -88,6 +88,7 @@ export { AgUiRuntimeContextItemSchema, AgUiRuntimeInjectedToolSchema, AgUiRuntim
 export { normalizeAgUiRuntimeMessages } from "./ag-ui-runtime-support.js";
 export { buildAgUiBrowserFinalizeResponse, createAgUiBrowserEncoderState, finalizeAgUiBrowserEvents, mapRuntimeStreamEventToAgUiBrowserEvents, } from "./ag-ui-browser-encoder.js";
 export { createAgUiBrowserResponseStream, } from "./ag-ui-browser-response-stream.js";
+export { runHostedChildLifecycle, } from "./hosted-child-lifecycle.js";
 export { runHostedLifecycle, } from "./hosted-lifecycle.js";
 export { mergeToolCallInput, mergeToolInputDelta, parseDataStreamSseEvents, parseToolInputObject, streamDataStreamEvents, stripLeadingEmptyObjectPlaceholder, } from "./data-stream.js";
 export { expandAllowedRemoteToolNames, getProviderNativeToolNames, } from "./provider-native-tool-inventory.js";

package/esm/src/channels/control-plane.d.ts

@@ -159,6 +159,27 @@ export interface RuntimeAgentDiscoveryDeps {
     getAllAgentIds: () => string[];
 }
 export declare function listRuntimeAgents(ctx: HandlerContext, deps: RuntimeAgentDiscoveryDeps): Promise<RuntimeAgentListResponse>;
+/**
+ * Verify the Ed25519 signature of a dispatch JWS and the recency of its
+ * timestamps, without binding to a particular request body or audience.
+ *
+ * This is intentionally weaker than {@link verifyDispatchJws}: it answers
+ * "was this JWS minted by a holder of the control-plane private key and is it
+ * still fresh?" and is used as a trust signal in code paths (proxy-trust,
+ * adapter selection) that don't yet have access to the authoritative request
+ * body or project audience. Callers that consume request payloads MUST still
+ * call {@link verifyDispatchJws} / {@link verifyControlPlaneJws} to bind the
+ * signature to the body and project.
+ *
+ * Returns true iff the signature verifies and `iat`/`exp` are within the
+ * allowed skew and max-age window. All other failures (including parsing
+ * errors) resolve to false so callers can treat the signal as present-but-not-
+ * proven without raising.
+ */
+export declare function verifyDispatchJwsSignature(jws: string, options: {
+    publicKeyPem: string;
+    maxAgeSeconds: number;
+}): Promise<boolean>;
 export declare function verifyDispatchJws(jws: string, body: string, options: {
     audience: string;
     expectedPlatform?: string;

package/esm/src/channels/control-plane.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../../../src/src/channels/control-plane.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,eAAO,MAAM,yBAAyB;;;;;EAA+C,CAAC;AAEtF,eAAO,MAAM,mCAAmC;;;;;;;;;iBAI9C,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;iBAMlC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;2BAgBvC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;iBAGxC,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQ7B,CAAC;AAEH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEzC,CAAC;AAEH,QAAA,MAAM,oBAAoB;;;;;;;;;iBASxB,CAAC;AAEH,QAAA,MAAM,wBAAwB;;;;;;;;;;;;;;iBAS5B,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,WAAW,yBAAyB;IACxC,sBAAsB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,KAAK,GAAG,SAAS,CAAC;IAC5C,cAAc,EAAE,MAAM,MAAM,EAAE,CAAC;CAChC;AAiLD,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAUnC;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,GACA,OAAO,CAAC,cAAc,CAAC,CAmBzB;AAED,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,GACA,OAAO,CAAC,kBAAkB,CAAC,CAmB7B"}
+{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../../../src/src/channels/control-plane.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,eAAO,MAAM,yBAAyB;;;;;EAA+C,CAAC;AAEtF,eAAO,MAAM,mCAAmC;;;;;;;;;iBAI9C,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;iBAMlC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;2BAgBvC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;iBAGxC,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQ7B,CAAC;AAEH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEzC,CAAC;AAEH,QAAA,MAAM,oBAAoB;;;;;;;;;iBASxB,CAAC;AAEH,QAAA,MAAM,wBAAwB;;;;;;;;;;;;;;iBAS5B,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,MAAM,WAAW,yBAAyB;IACxC,sBAAsB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,KAAK,GAAG,SAAS,CAAC;IAC5C,cAAc,EAAE,MAAM,MAAM,EAAE,CAAC;CAChC;AAiLD,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAUnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;IACP,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,OAAO,CAAC,CA2BlB;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,GACA,OAAO,CAAC,cAAc,CAAC,CAmBzB;AAED,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,GACA,OAAO,CAAC,kBAAkB,CAAC,CAmB7B"}

package/esm/src/channels/control-plane.js

@@ -197,6 +197,54 @@ export async function listRuntimeAgents(ctx, deps) {
         .sort((left, right) => left.name.localeCompare(right.name));
     return RuntimeAgentListResponseSchema.parse({ agents });
 }
+/**
+ * Verify the Ed25519 signature of a dispatch JWS and the recency of its
+ * timestamps, without binding to a particular request body or audience.
+ *
+ * This is intentionally weaker than {@link verifyDispatchJws}: it answers
+ * "was this JWS minted by a holder of the control-plane private key and is it
+ * still fresh?" and is used as a trust signal in code paths (proxy-trust,
+ * adapter selection) that don't yet have access to the authoritative request
+ * body or project audience. Callers that consume request payloads MUST still
+ * call {@link verifyDispatchJws} / {@link verifyControlPlaneJws} to bind the
+ * signature to the body and project.
+ *
+ * Returns true iff the signature verifies and `iat`/`exp` are within the
+ * allowed skew and max-age window. All other failures (including parsing
+ * errors) resolve to false so callers can treat the signal as present-but-not-
+ * proven without raising.
+ */
+export async function verifyDispatchJwsSignature(jws, options) {
+    try {
+        const parts = jws.split(".");
+        if (parts.length !== 3)
+            return false;
+        const [encodedHeader, encodedPayload, encodedSignature] = parts;
+        if (!encodedHeader || !encodedPayload || !encodedSignature)
+            return false;
+        compactJwsHeaderSchema.parse(parseCompactJwsPart(encodedHeader));
+        const claims = dispatchClaimsSchema.parse(parseCompactJwsPart(encodedPayload));
+        const signingInput = new TextEncoder().encode(`${encodedHeader}.${encodedPayload}`);
+        const signature = base64urlDecodeToBytes(encodedSignature);
+        const publicKey = await importEd25519PublicKey(options.publicKeyPem);
+        const verified = await dntShim.crypto.subtle.verify("Ed25519", publicKey, signature, signingInput);
+        if (!verified)
+            return false;
+        if (claims.iss !== "veryfront-api")
+            return false;
+        const now = Math.floor(Date.now() / 1000);
+        if (claims.exp <= now)
+            return false;
+        if (claims.iat > now + SIGNATURE_SKEW_SECONDS)
+            return false;
+        if (now - claims.iat > options.maxAgeSeconds)
+            return false;
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export async function verifyDispatchJws(jws, body, options) {
     return verifySignedRequestJws(jws, body, {
         audience: options.audience,

package/esm/src/channels/invoke.d.ts

@@ -139,7 +139,7 @@ export interface ChannelInvokeDeps extends RuntimeAgentDiscoveryDeps {
 }
 export declare const defaultChannelInvokeDeps: ChannelInvokeDeps;
 export declare function listChannelAssistants(ctx: HandlerContext, deps: ChannelInvokeDeps): Promise<ChannelAssistantsResponse>;
-export { verifyDispatchJws } from "./control-plane.js";
+export { verifyDispatchJws, verifyDispatchJwsSignature } from "./control-plane.js";
 export declare function normalizeConversationHistoryForRuntime(messages: ChannelInvokeRequest["conversationHistory"]): Message[];
 export declare function resolveChannelInvokeAgent(assistantId: string, deps: Pick<ChannelInvokeDeps, "getAgent">): Agent | undefined;
 export declare function buildChannelResponseParts(response: AgentResponse): ChannelResponsePart[];

package/esm/src/channels/invoke.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invoke.d.ts","sourceRoot":"","sources":["../../../src/src/channels/invoke.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,IAAI,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAqB,KAAK,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AA4CvF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAiC,CAAC;AAEzE,eAAO,MAAM,8BAA8B;;;;iBAIzC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;iBAKjC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;iBAE1C,CAAC;AAiCH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;2BAMpC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAYtC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,KAAK,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AACrE,MAAM,WAAW,iBAAkB,SAAQ,yBAAyB;CAAG;AAEvE,eAAO,MAAM,wBAAwB,EAAE,iBAItC,CAAC;AAEF,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,yBAAyB,CAAC,CAYpC;AACD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAqCvD,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,GACpD,OAAO,EAAE,CAUX;AAED,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,GACxC,KAAK,GAAG,SAAS,CAEnB;AAsDD,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,aAAa,GAAG,mBAAmB,EAAE,CAiDxF;AAgBD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,qBAAqB,CAAC,CAkEhC"}
+{"version":3,"file":"invoke.d.ts","sourceRoot":"","sources":["../../../src/src/channels/invoke.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,IAAI,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAqB,KAAK,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AA4CvF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAiC,CAAC;AAEzE,eAAO,MAAM,8BAA8B;;;;iBAIzC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;iBAKjC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;iBAE1C,CAAC;AAiCH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;2BAMpC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAYtC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,KAAK,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AACrE,MAAM,WAAW,iBAAkB,SAAQ,yBAAyB;CAAG;AAEvE,eAAO,MAAM,wBAAwB,EAAE,iBAItC,CAAC;AAEF,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,yBAAyB,CAAC,CAYpC;AACD,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAqCnF,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,GACpD,OAAO,EAAE,CAUX;AAED,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,GACxC,KAAK,GAAG,SAAS,CAEnB;AAsDD,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,aAAa,GAAG,mBAAmB,EAAE,CAiDxF;AAgBD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,qBAAqB,CAAC,CAkEhC"}

package/esm/src/channels/invoke.js

@@ -116,7 +116,7 @@ export async function listChannelAssistants(ctx, deps) {
     }));
     return ChannelAssistantsResponseSchema.parse({ assistants });
 }
-export { verifyDispatchJws } from "./control-plane.js";
+export { verifyDispatchJws, verifyDispatchJwsSignature } from "./control-plane.js";
 function normalizeConversationPart(part) {
     if (part.type === "text" && typeof part.text === "string") {
         return { type: "text", text: part.text };

package/esm/src/server/handlers/preview/hmr.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hmr.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/preview/hmr.handler.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,eAAe,EAEpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAoBrB,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAK7D,qBAAa,UAAW,SAAQ,WAAW;IACzC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAgD;IAC1E,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAA6B;IAC7D,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAK;IAChD,OAAO,CAAC,MAAM,CAAC,WAAW,CAAS;IAEnC,QAAQ,EAAE,eAAe,CAKvB;IAEF,OAAO,CAAC,MAAM,CAAC,UAAU;IAsCzB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA0JjE;;;;;OAKG;YACW,wBAAwB;IAuCtC,MAAM,CAAC,cAAc,IAAI,MAAM;IAI/B,MAAM,CAAC,UAAU,IAAI;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;KAC3B;IAID,MAAM,CAAC,+BAA+B,IAAI,MAAM,IAAI;IAWpD,MAAM,CAAC,QAAQ,IAAI,IAAI;IAcvB,OAAO,CAAC,MAAM,CAAC,cAAc;CAO9B"}
+{"version":3,"file":"hmr.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/preview/hmr.handler.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,eAAe,EAEpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAsBrB,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAK7D,qBAAa,UAAW,SAAQ,WAAW;IACzC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAgD;IAC1E,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAA6B;IAC7D,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAK;IAChD,OAAO,CAAC,MAAM,CAAC,WAAW,CAAS;IAEnC,QAAQ,EAAE,eAAe,CAKvB;IAEF,OAAO,CAAC,MAAM,CAAC,UAAU;IAsCnB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA8JvE;;;;;OAKG;YACW,wBAAwB;IAuCtC,MAAM,CAAC,cAAc,IAAI,MAAM;IAI/B,MAAM,CAAC,UAAU,IAAI;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;KAC3B;IAID,MAAM,CAAC,+BAA+B,IAAI,MAAM,IAAI;IAWpD,MAAM,CAAC,QAAQ,IAAI,IAAI;IAcvB,OAAO,CAAC,MAAM,CAAC,cAAc;CAO9B"}

package/esm/src/server/handlers/preview/hmr.handler.js

@@ -11,6 +11,8 @@ import { addClient, clearAll, getClient, getClientCount, getClientDetails, remov
 import { getPingIntervalMs, startPingInterval, stopPingInterval } from "./hmr-ping-keepalive.js";
 import { broadcastUpdate, getMetrics } from "./hmr-message-router.js";
 import { getEffectiveRequestHost } from "../../utils/request-host.js";
+import { isProxyTrusted } from "../../utils/proxy-trust.js";
+import { getHostEnv } from "../../../platform/compat/process.js";
 const logger = serverLogger.component("hmr-handler");
 // Priority between auth (0) and high (100)
 const PRIORITY_HMR = HandlerPriority.EARLY;
@@ -56,14 +58,24 @@ export class HMRHandler extends BaseHandler {
             pingIntervalMs: getPingIntervalMs(),
         });
     }
-    handle(req, ctx) {
+    async handle(req, ctx) {
         if (!this.shouldHandle(req, ctx))
-            return Promise.resolve(this.continue());
+            return this.continue();
         const url = new URL(req.url);
         const queryEnv = url.searchParams.get("x-environment");
         const isPreviewMode = ctx.requestContext?.mode === "preview" || queryEnv === "preview";
         const isLocal = !!ctx.isLocalProject;
-        const host = getEffectiveRequestHost(req, url);
+        // SECURITY: x-forwarded-host is client-controlled unless we trust the upstream proxy.
+        // Honouring it unconditionally lets any remote client present `x-forwarded-host: localhost`
+        // and unlock the localhost short-circuit that opens HMR (VULN-SRV-4). Only consult
+        // forwarded headers when the request is proxy-trusted; otherwise use Host / url.host.
+        // Proxy trust requires a verifiable dispatch JWS (or operator opt-in) — mere header
+        // presence is not enough, since `x-veryfront-dispatch-jws` is not stripped on ingress.
+        const publicKeyPem = ctx.adapter?.env?.get("CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY") ??
+            getHostEnv("CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY");
+        const host = (await isProxyTrusted(req, { publicKeyPem }))
+            ? getEffectiveRequestHost(req, url)
+            : (req.headers.get("host") ?? url.host);
         const isLocalhost = isLocalDevHost(host);
         if (!isPreviewMode && !isLocal && !isLocalhost) {
             logger.warn("Skipping /_ws - not preview, local dev, or localhost", {
@@ -75,7 +87,7 @@ export class HMRHandler extends BaseHandler {
                 isLocal,
                 isLocalhost,
             });
-            return Promise.resolve(this.continue());
+            return this.continue();
         }
         HMRHandler.initialize();
         // In proxy mode, ensure the adapter is initialized so WebSocketManager connects
@@ -90,7 +102,7 @@ export class HMRHandler extends BaseHandler {
             });
         }
         if (req.headers.get("upgrade")?.toLowerCase() !== "websocket") {
-            return Promise.resolve(this.respond(new Response(JSON.stringify({
+            return this.respond(new Response(JSON.stringify({
                 status: "ok",
                 clients: getClientCount(),
                 clientDetails: getClientDetails(),
@@ -99,10 +111,10 @@ export class HMRHandler extends BaseHandler {
                     reloadNotifierMetrics: ReloadNotifier.getMetrics(),
                 },
                 message: "HMR WebSocket endpoint - connect via WebSocket",
-            }), { headers: { "content-type": "application/json" } })));
+            }), { headers: { "content-type": "application/json" } }));
         }
         if (!ctx.adapter?.server) {
-            return Promise.resolve(this.respond(new Response("WebSocket not supported", { status: 501 })));
+            return this.respond(new Response("WebSocket not supported", { status: 501 }));
         }
         try {
             const { socket, response } = ctx.adapter.server.upgradeWebSocket(req);
@@ -180,11 +192,11 @@ export class HMRHandler extends BaseHandler {
                 projectSlug: ctx.projectSlug,
                 totalClients: getClientCount(),
             });
-            return Promise.resolve(this.respond(response));
+            return this.respond(response);
         }
         catch (error) {
             logger.error("WebSocket upgrade failed", { error });
-            return Promise.resolve(this.respond(new Response("WebSocket upgrade failed", { status: 500 })));
+            return this.respond(new Response("WebSocket upgrade failed", { status: 500 }));
         }
     }
     /**

package/esm/src/server/runtime-handler/adapter-factory.d.ts

@@ -21,6 +21,11 @@ interface AdapterResolutionResult {
     isLocalProject: boolean;
 }
 interface AdapterResolutionOptions {
+    /**
+     * Inbound request. Used to determine whether forwarded headers such as
+     * `x-project-path` can be trusted (see {@link isProxyTrusted}).
+     */
+    req: Request;
     /** Base project directory */
     projectDir: string;
     /** Base adapter */
@@ -43,8 +48,6 @@ interface AdapterResolutionOptions {
     environmentName: string | undefined;
     /** Parsed domain info */
     parsedDomain: ParsedDomain;
-    /** Project path from header */
-    headerProjectPath: string | undefined;
     /** Whether running in proxy mode */
     isProxyMode: boolean;
     /** Optional injectable cache (defaults to module-level singleton) */

package/esm/src/server/runtime-handler/adapter-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter-factory.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/adapter-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAGtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAM9D,UAAU,uBAAuB;IAC/B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,OAAO,EAAE,cAAc,CAAC;IACxB,kCAAkC;IAClC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,yDAAyD;IACzD,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,UAAU,wBAAwB;IAChC,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,6BAA6B;IAC7B,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,mBAAmB;IACnB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,kBAAkB;IAClB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,uCAAuC;IACvC,QAAQ,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;IAC/C,kBAAkB;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,yCAAyC;IACzC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,yBAAyB;IACzB,YAAY,EAAE,YAAY,CAAC;IAC3B,+BAA+B;IAC/B,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,oCAAoC;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,qEAAqE;IACrE,KAAK,CAAC,EAAE,qBAAqB,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAqHlC"}
+{"version":3,"file":"adapter-factory.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/adapter-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAGtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAQ9D,UAAU,uBAAuB;IAC/B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,OAAO,EAAE,cAAc,CAAC;IACxB,kCAAkC;IAClC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,yDAAyD;IACzD,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,UAAU,wBAAwB;IAChC;;;OAGG;IACH,GAAG,EAAE,OAAO,CAAC;IACb,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB;IACnB,OAAO,EAAE,cAAc,CAAC;IACxB,6BAA6B;IAC7B,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,mBAAmB;IACnB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,kBAAkB;IAClB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,iBAAiB;IACjB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,uCAAuC;IACvC,QAAQ,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;IAC/C,kBAAkB;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,yCAAyC;IACzC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,yBAAyB;IACzB,YAAY,EAAE,YAAY,CAAC;IAC3B,oCAAoC;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,qEAAqE;IACrE,KAAK,CAAC,EAAE,qBAAqB,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAoIlC"}

package/esm/src/server/runtime-handler/adapter-factory.js

@@ -13,6 +13,8 @@ import { isExtendedFSAdapter } from "../../platform/adapters/fs/wrapper.js";
 import { getConfig } from "../../config/loader.js";
 import { timeAsync } from "./request-lifecycle.js";
 import { defaultDiscoveryCache, findLocalProjectPath, } from "./local-project-discovery.js";
+import { isProxyTrusted } from "../utils/proxy-trust.js";
+import { getHostEnv } from "../../platform/compat/process.js";
 const baseLogger = getBaseLogger("SERVER");
 const logger = baseLogger.component("adapter-factory");
 /**
@@ -29,7 +31,22 @@ export async function resolveAdapter(opts) {
     // Check if this is a local project.
     // In proxy mode, skip local discovery unless there's an explicit header path override —
     // the standard directories (data/projects/, projects/) don't exist in k8s.
-    const trustedHeaderProjectPath = opts.isProxyMode ? opts.headerProjectPath : undefined;
+    //
+    // SECURITY: `x-project-path` is a client-controlled header. Honouring it from any
+    // request would let an attacker reaching the runtime directly aim project discovery
+    // (and therefore `/_veryfront/fs/...`) at arbitrary filesystem paths (VULN-SRV-3).
+    // Only read it when the request is proxy-trusted: either the operator opted in via
+    // VERYFRONT_TRUST_FORWARDED_HEADERS=1, or the request carries a dispatch JWS that
+    // verifies against CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY. Mere header presence is
+    // NOT sufficient — a direct-access attacker could otherwise spoof `x-project-path`
+    // by attaching any value in `x-veryfront-dispatch-jws`.
+    const publicKeyPem = opts.adapter.env.get("CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY") ??
+        getHostEnv("CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY");
+    const proxyTrusted = opts.isProxyMode &&
+        (await isProxyTrusted(opts.req, { publicKeyPem }));
+    const trustedHeaderProjectPath = proxyTrusted
+        ? opts.req.headers.get("x-project-path")?.trim() || undefined
+        : undefined;
     const shouldCheckLocalPath = opts.projectSlug && (!opts.isProxyMode || trustedHeaderProjectPath);
     const localProjectPath = shouldCheckLocalPath
         ? await findLocalProjectPath(opts.projectSlug, opts.adapter, trustedHeaderProjectPath, cache)

package/esm/src/server/runtime-handler/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAK7D,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AA+BpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AA+DrE,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAMtF,2CAA2C;AAC3C,eAAO,MAAM,aAAa,uqBAkChB,CAAC;AAEX,6CAA6C;AAC7C,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,8CAA8C;IAC9C,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,mDAAmD;IACnD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AA0CD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,mBAAwB,GAC7B;IAAE,QAAQ,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,iBAAiB,CAAA;CAAE,CAuB5D;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,oFAAoF;IACpF,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC;CAC/C;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,qBAAsC,GAC3C,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAganE;AAGD,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/src/server/runtime-handler/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAK7D,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AA+BpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AA+DrE,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAMtF,2CAA2C;AAC3C,eAAO,MAAM,aAAa,uqBAkChB,CAAC;AAEX,6CAA6C;AAC7C,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,8CAA8C;IAC9C,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,mDAAmD;IACnD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AA0CD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,mBAAwB,GAC7B;IAAE,QAAQ,EAAE,aAAa,CAAC;IAAC,UAAU,EAAE,iBAAiB,CAAA;CAAE,CAuB5D;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,oFAAoF;IACpF,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,SAAS,GAAG,YAAY,CAAC;CAC/C;AAED,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,qBAAsC,GAC3C,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAmanE;AAGD,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC"}

package/esm/src/server/runtime-handler/index.js

@@ -352,8 +352,12 @@ export function createVeryfrontHandler(projectDir, adapter, opts = { projectDir
                         if (response)
                             return response;
                     }
-                    // Resolve adapter and config for project
+                    // Resolve adapter and config for project.
+                    // Note: `x-project-path` is NOT forwarded via `headers.projectPath` anymore;
+                    // `resolveAdapter` reads it directly from `req` and only honours it when the
+                    // request is proxy-trusted (see isProxyTrusted).
                     const adapterRes = await resolveAdapter({
+                        req,
                         projectDir,
                         adapter,
                         config,
@@ -365,7 +369,6 @@ export function createVeryfrontHandler(projectDir, adapter, opts = { projectDir
                         branch: reqCtx.branch,
                         environmentName: projectRes.environmentName,
                         parsedDomain: projectRes.parsedDomain,
-                        headerProjectPath: headers.projectPath,
                         isProxyMode,
                     });
                     // Resolve environment and validate

package/esm/src/server/services/rsc/orchestrators/page-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"page-handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/services/rsc/orchestrators/page-handler.ts"],"names":[],"mappings":"AAEA,qBAAa,WAAW;IACtB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ;IAQjF,OAAO,CAAC,SAAS;CAwElB"}
+{"version":3,"file":"page-handler.d.ts","sourceRoot":"","sources":["../../../../../../src/src/server/services/rsc/orchestrators/page-handler.ts"],"names":[],"mappings":"AAuBA,qBAAa,WAAW;IACtB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ;IAQjF,OAAO,CAAC,SAAS;CAyElB"}

package/esm/src/server/services/rsc/orchestrators/page-handler.js

@@ -1,4 +1,24 @@
 import { buildNonceAttribute } from "../../../../html/html-escape.js";
+/**
+ * Serialize a value as a JSON string literal that is safe to embed inside an
+ * inline HTML <script>. JSON already escapes quotes, backslashes, and control
+ * characters; we additionally escape:
+ *   - `<` / `>` so `</script>`, `<!--`, and `<script` cannot appear literally,
+ *   - `&` as defense-in-depth against reparsing contexts (e.g. HTML entity
+ *     re-decoding in some legacy paths),
+ *   - U+2028 / U+2029 which are valid JSON but terminate JS string literals
+ *     in older browsers.
+ *
+ * See VULN-INJ-1 in the security audit.
+ */
+function jsonForScript(value) {
+    return JSON.stringify(value)
+        .replace(/</g, "\\u003c")
+        .replace(/>/g, "\\u003e")
+        .replace(/&/g, "\\u0026")
+        .replace(/\u2028/g, "\\u2028")
+        .replace(/\u2029/g, "\\u2029");
+}
 export class PageHandler {
     handle(pathname, searchParams, nonce) {
         const html = this.buildHtml(pathname, searchParams, nonce);
@@ -10,6 +30,7 @@ export class PageHandler {
         const queryString = searchParams.toString();
         const renderUrl = `/_veryfront/rsc/render${pathname}${queryString ? `?${queryString}` : ""}`;
         const nonceAttr = buildNonceAttribute(nonce);
+        const renderUrlJs = jsonForScript(renderUrl);
         return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -57,7 +78,7 @@ export class PageHandler {
     }
 
     (async () => {
-      const renderUrl = '${renderUrl}';
+      const renderUrl = ${renderUrlJs};
       const payload =
         (await fetchPayload(renderUrl)) ??
         (await fetchPayload('/_veryfront/rsc/payload')) ??

package/esm/src/server/utils/proxy-trust.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Proxy trust boundary.
+ *
+ * Forwarded headers such as `x-forwarded-host` and `x-project-path` must only be
+ * honoured when the request is known to come from a trusted upstream proxy.
+ * Any other treatment lets an attacker reaching the runtime directly spoof the
+ * origin host or point project discovery at arbitrary filesystem paths.
+ *
+ * A request is considered proxy-trusted when either:
+ *   1. The operator has opted in via `VERYFRONT_TRUST_FORWARDED_HEADERS=1`
+ *      (strict "1" match — "true", "yes", whitespace-padded values do NOT count
+ *      so misconfiguration fails closed); or
+ *   2. The request carries a valid `x-veryfront-dispatch-jws` header that
+ *      cryptographically verifies against the configured control-plane public
+ *      key and whose `iat`/`exp` claims are within the allowed freshness
+ *      window. Presence alone is NOT trusted because the proxy does not strip
+ *      this header from untrusted inbound requests (it has to pass through to
+ *      the channel-invoke / channel-assistants handlers unchanged), so a
+ *      direct-access attacker could otherwise set any value and promote
+ *      forwarded-header spoofing.
+ *
+ * @module server/utils/proxy-trust
+ */
+export interface ProxyTrustOptions {
+    /**
+     * PEM-encoded Ed25519 public key used to verify `x-veryfront-dispatch-jws`.
+     * When absent, the dispatch-JWS trust signal is disabled (fails closed) and
+     * only the operator opt-in env var can unlock proxy trust.
+     */
+    publicKeyPem?: string;
+}
+export declare function isProxyTrusted(req: Request, options?: ProxyTrustOptions): Promise<boolean>;
+//# sourceMappingURL=proxy-trust.d.ts.map

package/esm/src/server/utils/proxy-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-trust.d.ts","sourceRoot":"","sources":["../../../../src/src/server/utils/proxy-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAQH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAalB"}

package/esm/src/server/utils/proxy-trust.js

@@ -0,0 +1,41 @@
+/**
+ * Proxy trust boundary.
+ *
+ * Forwarded headers such as `x-forwarded-host` and `x-project-path` must only be
+ * honoured when the request is known to come from a trusted upstream proxy.
+ * Any other treatment lets an attacker reaching the runtime directly spoof the
+ * origin host or point project discovery at arbitrary filesystem paths.
+ *
+ * A request is considered proxy-trusted when either:
+ *   1. The operator has opted in via `VERYFRONT_TRUST_FORWARDED_HEADERS=1`
+ *      (strict "1" match — "true", "yes", whitespace-padded values do NOT count
+ *      so misconfiguration fails closed); or
+ *   2. The request carries a valid `x-veryfront-dispatch-jws` header that
+ *      cryptographically verifies against the configured control-plane public
+ *      key and whose `iat`/`exp` claims are within the allowed freshness
+ *      window. Presence alone is NOT trusted because the proxy does not strip
+ *      this header from untrusted inbound requests (it has to pass through to
+ *      the channel-invoke / channel-assistants handlers unchanged), so a
+ *      direct-access attacker could otherwise set any value and promote
+ *      forwarded-header spoofing.
+ *
+ * @module server/utils/proxy-trust
+ */
+import { verifyDispatchJwsSignature } from "../../channels/control-plane.js";
+import { getHostEnv } from "../../platform/compat/process.js";
+const DISPATCH_JWS_HEADER = "x-veryfront-dispatch-jws";
+const MAX_DISPATCH_SIGNATURE_AGE_SECONDS = 60;
+export async function isProxyTrusted(req, options = {}) {
+    if (getHostEnv("VERYFRONT_TRUST_FORWARDED_HEADERS") === "1")
+        return true;
+    const jws = req.headers.get(DISPATCH_JWS_HEADER);
+    if (!jws)
+        return false;
+    const { publicKeyPem } = options;
+    if (!publicKeyPem)
+        return false;
+    return verifyDispatchJwsSignature(jws, {
+        publicKeyPem,
+        maxAgeSeconds: MAX_DISPATCH_SIGNATURE_AGE_SECONDS,
+    });
+}

package/esm/src/utils/version-constant.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.1.229";
+export declare const VERSION = "0.1.230";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,3 +1,3 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
-export const VERSION = "0.1.229";
+export const VERSION = "0.1.230";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.229",
+  "version": "0.1.230",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",

package/src/deno.js

@@ -1,6 +1,6 @@
 export default {
   "name": "veryfront",
-  "version": "0.1.229",
+  "version": "0.1.230",
   "license": "Apache-2.0",
   "nodeModulesDir": "auto",
   "workspace": [

package/src/src/agent/hosted-child-lifecycle.ts

@@ -0,0 +1,121 @@
+export interface HostedChildLifecycleTerminalState {
+  status: "completed" | "failed" | "cancelled";
+  usage?: {
+    inputTokens?: number;
+    outputTokens?: number;
+    totalTokens?: number;
+  };
+  terminalErrorCode?: string | null;
+  terminalErrorMessage?: string | null;
+}
+
+export interface HostedChildLifecycleCompletedState
+  extends Omit<HostedChildLifecycleTerminalState, "status"> {
+  status: "completed";
+}
+
+export interface HostedChildLifecycleAdapter {
+  pending?: () => Promise<void> | void;
+  running?: () => Promise<void> | void;
+  completed?: (
+    terminalState: HostedChildLifecycleTerminalState,
+  ) => Promise<void> | void;
+  failed?: (
+    terminalState: HostedChildLifecycleTerminalState,
+  ) => Promise<void> | void;
+  cancelled?: (
+    terminalState: HostedChildLifecycleTerminalState,
+  ) => Promise<void> | void;
+}
+
+export interface HostedChildLifecycleErrorState
+  extends Omit<HostedChildLifecycleTerminalState, "status"> {
+  status: "failed" | "cancelled";
+}
+
+export interface HostedChildLifecycleRunnerOptions<TResult> {
+  adapter: HostedChildLifecycleAdapter;
+  execute: () => Promise<TResult> | TResult;
+  resolveCompletedState?: (
+    result: TResult,
+  ) =>
+    | Promise<HostedChildLifecycleCompletedState>
+    | HostedChildLifecycleCompletedState;
+  resolveErrorState: (
+    error: unknown,
+  ) =>
+    | Promise<HostedChildLifecycleErrorState>
+    | HostedChildLifecycleErrorState;
+  onLifecycleError?: (error: unknown) => Promise<void> | void;
+}
+
+export type HostedChildLifecycleRunResult<TResult> =
+  | {
+    status: "completed";
+    result: TResult;
+    terminalState: HostedChildLifecycleTerminalState;
+  }
+  | {
+    status: "failed" | "cancelled";
+    error: unknown;
+    terminalState: HostedChildLifecycleTerminalState;
+  };
+
+async function dispatchTerminalState(
+  adapter: HostedChildLifecycleAdapter,
+  terminalState: HostedChildLifecycleTerminalState,
+): Promise<void> {
+  if (terminalState.status === "cancelled") {
+    await adapter.cancelled?.(terminalState);
+    return;
+  }
+
+  if (terminalState.status === "failed") {
+    await adapter.failed?.(terminalState);
+    return;
+  }
+
+  await adapter.completed?.(terminalState);
+}
+
+export async function runHostedChildLifecycle<TResult>(
+  options: HostedChildLifecycleRunnerOptions<TResult>,
+): Promise<HostedChildLifecycleRunResult<TResult>> {
+  await options.adapter.pending?.();
+  await options.adapter.running?.();
+
+  let result: TResult;
+  try {
+    result = await options.execute();
+  } catch (error) {
+    const terminalState = await options.resolveErrorState(error);
+
+    try {
+      await dispatchTerminalState(options.adapter, terminalState);
+    } catch (lifecycleError) {
+      if (options.onLifecycleError) {
+        await options.onLifecycleError(lifecycleError);
+      } else {
+        throw lifecycleError;
+      }
+    }
+
+    return {
+      status: terminalState.status,
+      error,
+      terminalState,
+    };
+  }
+
+  const terminalState = options.resolveCompletedState
+    ? await options.resolveCompletedState(result)
+    : { status: "completed" as const };
+
+  await dispatchTerminalState(options.adapter, terminalState);
+
+  return {
+    status: "completed",
+    result,
+    terminalState,
+  };
+}

package/src/src/agent/index.ts

@@ -180,6 +180,13 @@ export {
   createAgUiBrowserResponseStream,
   type CreateAgUiBrowserResponseStreamInput,
 } from "./ag-ui-browser-response-stream.js";
+export {
+  type HostedChildLifecycleAdapter,
+  type HostedChildLifecycleRunnerOptions,
+  type HostedChildLifecycleRunResult,
+  type HostedChildLifecycleTerminalState,
+  runHostedChildLifecycle,
+} from "./hosted-child-lifecycle.js";
 export {
   type HostedLifecycleAdapter,
   type HostedLifecycleExecution,

package/src/src/channels/control-plane.ts

@@ -294,6 +294,58 @@ export async function listRuntimeAgents(
   return RuntimeAgentListResponseSchema.parse({ agents });
 }
 
+/**
+ * Verify the Ed25519 signature of a dispatch JWS and the recency of its
+ * timestamps, without binding to a particular request body or audience.
+ *
+ * This is intentionally weaker than {@link verifyDispatchJws}: it answers
+ * "was this JWS minted by a holder of the control-plane private key and is it
+ * still fresh?" and is used as a trust signal in code paths (proxy-trust,
+ * adapter selection) that don't yet have access to the authoritative request
+ * body or project audience. Callers that consume request payloads MUST still
+ * call {@link verifyDispatchJws} / {@link verifyControlPlaneJws} to bind the
+ * signature to the body and project.
+ *
+ * Returns true iff the signature verifies and `iat`/`exp` are within the
+ * allowed skew and max-age window. All other failures (including parsing
+ * errors) resolve to false so callers can treat the signal as present-but-not-
+ * proven without raising.
+ */
+export async function verifyDispatchJwsSignature(
+  jws: string,
+  options: {
+    publicKeyPem: string;
+    maxAgeSeconds: number;
+  },
+): Promise<boolean> {
+  try {
+    const parts = jws.split(".");
+    if (parts.length !== 3) return false;
+    const [encodedHeader, encodedPayload, encodedSignature] = parts;
+    if (!encodedHeader || !encodedPayload || !encodedSignature) return false;
+
+    compactJwsHeaderSchema.parse(parseCompactJwsPart(encodedHeader));
+    const claims = dispatchClaimsSchema.parse(parseCompactJwsPart(encodedPayload));
+
+    const signingInput = new TextEncoder().encode(`${encodedHeader}.${encodedPayload}`);
+    const signature = base64urlDecodeToBytes(encodedSignature);
+    const publicKey = await importEd25519PublicKey(options.publicKeyPem);
+    const verified = await dntShim.crypto.subtle.verify("Ed25519", publicKey, signature, signingInput);
+    if (!verified) return false;
+
+    if (claims.iss !== "veryfront-api") return false;
+
+    const now = Math.floor(Date.now() / 1000);
+    if (claims.exp <= now) return false;
+    if (claims.iat > now + SIGNATURE_SKEW_SECONDS) return false;
+    if (now - claims.iat > options.maxAgeSeconds) return false;
+
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 export async function verifyDispatchJws(
   jws: string,
   body: string,

package/src/src/channels/invoke.ts

@@ -153,7 +153,7 @@ export async function listChannelAssistants(
 
   return ChannelAssistantsResponseSchema.parse({ assistants });
 }
-export { verifyDispatchJws } from "./control-plane.js";
+export { verifyDispatchJws, verifyDispatchJwsSignature } from "./control-plane.js";
 
 function normalizeConversationPart(
   part: z.infer<typeof rawHistoryPartSchema>,

package/src/src/server/handlers/preview/hmr.handler.ts

@@ -29,6 +29,8 @@ import {
 import { getPingIntervalMs, startPingInterval, stopPingInterval } from "./hmr-ping-keepalive.js";
 import { broadcastUpdate, getMetrics } from "./hmr-message-router.js";
 import { getEffectiveRequestHost } from "../../utils/request-host.js";
+import { isProxyTrusted } from "../../utils/proxy-trust.js";
+import { getHostEnv } from "../../../platform/compat/process.js";
 
 const logger = serverLogger.component("hmr-handler");
 
@@ -89,14 +91,24 @@ export class HMRHandler extends BaseHandler {
     });
   }
 
-  handle(req: Request, ctx: HandlerContext): Promise<HandlerResult> {
-    if (!this.shouldHandle(req, ctx)) return Promise.resolve(this.continue());
+  async handle(req: Request, ctx: HandlerContext): Promise<HandlerResult> {
+    if (!this.shouldHandle(req, ctx)) return this.continue();
 
     const url = new URL(req.url);
     const queryEnv = url.searchParams.get("x-environment");
     const isPreviewMode = ctx.requestContext?.mode === "preview" || queryEnv === "preview";
     const isLocal = !!ctx.isLocalProject;
-    const host = getEffectiveRequestHost(req, url);
+    // SECURITY: x-forwarded-host is client-controlled unless we trust the upstream proxy.
+    // Honouring it unconditionally lets any remote client present `x-forwarded-host: localhost`
+    // and unlock the localhost short-circuit that opens HMR (VULN-SRV-4). Only consult
+    // forwarded headers when the request is proxy-trusted; otherwise use Host / url.host.
+    // Proxy trust requires a verifiable dispatch JWS (or operator opt-in) — mere header
+    // presence is not enough, since `x-veryfront-dispatch-jws` is not stripped on ingress.
+    const publicKeyPem = ctx.adapter?.env?.get("CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY") ??
+      getHostEnv("CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY");
+    const host = (await isProxyTrusted(req, { publicKeyPem }))
+      ? getEffectiveRequestHost(req, url)
+      : (req.headers.get("host") ?? url.host);
     const isLocalhost = isLocalDevHost(host);
 
     if (!isPreviewMode && !isLocal && !isLocalhost) {
@@ -109,7 +121,7 @@ export class HMRHandler extends BaseHandler {
         isLocal,
         isLocalhost,
       });
-      return Promise.resolve(this.continue());
+      return this.continue();
     }
 
     HMRHandler.initialize();
@@ -127,29 +139,25 @@ export class HMRHandler extends BaseHandler {
     }
 
     if (req.headers.get("upgrade")?.toLowerCase() !== "websocket") {
-      return Promise.resolve(
-        this.respond(
-          new Response(
-            JSON.stringify({
-              status: "ok",
-              clients: getClientCount(),
-              clientDetails: getClientDetails(),
-              metrics: {
-                ...getMetrics(),
-                reloadNotifierMetrics: ReloadNotifier.getMetrics(),
-              },
-              message: "HMR WebSocket endpoint - connect via WebSocket",
-            }),
-            { headers: { "content-type": "application/json" } },
-          ),
+      return this.respond(
+        new Response(
+          JSON.stringify({
+            status: "ok",
+            clients: getClientCount(),
+            clientDetails: getClientDetails(),
+            metrics: {
+              ...getMetrics(),
+              reloadNotifierMetrics: ReloadNotifier.getMetrics(),
+            },
+            message: "HMR WebSocket endpoint - connect via WebSocket",
+          }),
+          { headers: { "content-type": "application/json" } },
         ),
       );
     }
 
     if (!ctx.adapter?.server) {
-      return Promise.resolve(
-        this.respond(new Response("WebSocket not supported", { status: 501 })),
-      );
+      return this.respond(new Response("WebSocket not supported", { status: 501 }));
     }
 
     try {
@@ -234,12 +242,10 @@ export class HMRHandler extends BaseHandler {
         totalClients: getClientCount(),
       });
 
-      return Promise.resolve(this.respond(response));
+      return this.respond(response);
     } catch (error) {
       logger.error("WebSocket upgrade failed", { error });
-      return Promise.resolve(
-        this.respond(new Response("WebSocket upgrade failed", { status: 500 })),
-      );
+      return this.respond(new Response("WebSocket upgrade failed", { status: 500 }));
     }
   }
 

package/src/src/server/runtime-handler/adapter-factory.ts

@@ -21,6 +21,8 @@ import {
   type ProjectDiscoveryCache,
 } from "./local-project-discovery.js";
 import type { ParsedDomain } from "../utils/domain-parser.js";
+import { isProxyTrusted } from "../utils/proxy-trust.js";
+import { getHostEnv } from "../../platform/compat/process.js";
 
 const baseLogger = getBaseLogger("SERVER");
 
@@ -38,6 +40,11 @@ interface AdapterResolutionResult {
 }
 
 interface AdapterResolutionOptions {
+  /**
+   * Inbound request. Used to determine whether forwarded headers such as
+   * `x-project-path` can be trusted (see {@link isProxyTrusted}).
+   */
+  req: Request;
   /** Base project directory */
   projectDir: string;
   /** Base adapter */
@@ -60,8 +67,6 @@ interface AdapterResolutionOptions {
   environmentName: string | undefined;
   /** Parsed domain info */
   parsedDomain: ParsedDomain;
-  /** Project path from header */
-  headerProjectPath: string | undefined;
   /** Whether running in proxy mode */
   isProxyMode: boolean;
   /** Optional injectable cache (defaults to module-level singleton) */
@@ -86,7 +91,22 @@ export async function resolveAdapter(
   // Check if this is a local project.
   // In proxy mode, skip local discovery unless there's an explicit header path override —
   // the standard directories (data/projects/, projects/) don't exist in k8s.
-  const trustedHeaderProjectPath = opts.isProxyMode ? opts.headerProjectPath : undefined;
+  //
+  // SECURITY: `x-project-path` is a client-controlled header. Honouring it from any
+  // request would let an attacker reaching the runtime directly aim project discovery
+  // (and therefore `/_veryfront/fs/...`) at arbitrary filesystem paths (VULN-SRV-3).
+  // Only read it when the request is proxy-trusted: either the operator opted in via
+  // VERYFRONT_TRUST_FORWARDED_HEADERS=1, or the request carries a dispatch JWS that
+  // verifies against CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY. Mere header presence is
+  // NOT sufficient — a direct-access attacker could otherwise spoof `x-project-path`
+  // by attaching any value in `x-veryfront-dispatch-jws`.
+  const publicKeyPem = opts.adapter.env.get("CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY") ??
+    getHostEnv("CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY");
+  const proxyTrusted = opts.isProxyMode &&
+    (await isProxyTrusted(opts.req, { publicKeyPem }));
+  const trustedHeaderProjectPath = proxyTrusted
+    ? opts.req.headers.get("x-project-path")?.trim() || undefined
+    : undefined;
   const shouldCheckLocalPath = opts.projectSlug && (!opts.isProxyMode || trustedHeaderProjectPath);
   const localProjectPath = shouldCheckLocalPath
     ? await findLocalProjectPath(opts.projectSlug!, opts.adapter, trustedHeaderProjectPath, cache)

package/src/src/server/runtime-handler/index.ts

@@ -520,8 +520,12 @@ export function createVeryfrontHandler(
             if (response) return response;
           }
 
-          // Resolve adapter and config for project
+          // Resolve adapter and config for project.
+          // Note: `x-project-path` is NOT forwarded via `headers.projectPath` anymore;
+          // `resolveAdapter` reads it directly from `req` and only honours it when the
+          // request is proxy-trusted (see isProxyTrusted).
           const adapterRes = await resolveAdapter({
+            req,
             projectDir,
             adapter,
             config,
@@ -533,7 +537,6 @@ export function createVeryfrontHandler(
             branch: reqCtx.branch,
             environmentName: projectRes.environmentName,
             parsedDomain: projectRes.parsedDomain,
-            headerProjectPath: headers.projectPath,
             isProxyMode,
           });
 

package/src/src/server/services/rsc/orchestrators/page-handler.ts

@@ -1,5 +1,26 @@
 import { buildNonceAttribute } from "../../../../html/html-escape.js";
 
+/**
+ * Serialize a value as a JSON string literal that is safe to embed inside an
+ * inline HTML <script>. JSON already escapes quotes, backslashes, and control
+ * characters; we additionally escape:
+ *   - `<` / `>` so `</script>`, `<!--`, and `<script` cannot appear literally,
+ *   - `&` as defense-in-depth against reparsing contexts (e.g. HTML entity
+ *     re-decoding in some legacy paths),
+ *   - U+2028 / U+2029 which are valid JSON but terminate JS string literals
+ *     in older browsers.
+ *
+ * See VULN-INJ-1 in the security audit.
+ */
+function jsonForScript(value: unknown): string {
+  return JSON.stringify(value)
+    .replace(/</g, "\\u003c")
+    .replace(/>/g, "\\u003e")
+    .replace(/&/g, "\\u0026")
+    .replace(/\u2028/g, "\\u2028")
+    .replace(/\u2029/g, "\\u2029");
+}
+
 export class PageHandler {
   handle(pathname: string, searchParams: URLSearchParams, nonce?: string): Response {
     const html = this.buildHtml(pathname, searchParams, nonce);
@@ -13,6 +34,7 @@ export class PageHandler {
     const queryString = searchParams.toString();
     const renderUrl = `/_veryfront/rsc/render${pathname}${queryString ? `?${queryString}` : ""}`;
     const nonceAttr = buildNonceAttribute(nonce);
+    const renderUrlJs = jsonForScript(renderUrl);
 
     return `<!DOCTYPE html>
 <html lang="en">
@@ -61,7 +83,7 @@ export class PageHandler {
     }
 
     (async () => {
-      const renderUrl = '${renderUrl}';
+      const renderUrl = ${renderUrlJs};
       const payload =
         (await fetchPayload(renderUrl)) ??
         (await fetchPayload('/_veryfront/rsc/payload')) ??

package/src/src/server/utils/proxy-trust.ts

@@ -0,0 +1,56 @@
+/**
+ * Proxy trust boundary.
+ *
+ * Forwarded headers such as `x-forwarded-host` and `x-project-path` must only be
+ * honoured when the request is known to come from a trusted upstream proxy.
+ * Any other treatment lets an attacker reaching the runtime directly spoof the
+ * origin host or point project discovery at arbitrary filesystem paths.
+ *
+ * A request is considered proxy-trusted when either:
+ *   1. The operator has opted in via `VERYFRONT_TRUST_FORWARDED_HEADERS=1`
+ *      (strict "1" match — "true", "yes", whitespace-padded values do NOT count
+ *      so misconfiguration fails closed); or
+ *   2. The request carries a valid `x-veryfront-dispatch-jws` header that
+ *      cryptographically verifies against the configured control-plane public
+ *      key and whose `iat`/`exp` claims are within the allowed freshness
+ *      window. Presence alone is NOT trusted because the proxy does not strip
+ *      this header from untrusted inbound requests (it has to pass through to
+ *      the channel-invoke / channel-assistants handlers unchanged), so a
+ *      direct-access attacker could otherwise set any value and promote
+ *      forwarded-header spoofing.
+ *
+ * @module server/utils/proxy-trust
+ */
+
+import { verifyDispatchJwsSignature } from "../../channels/control-plane.js";
+import { getHostEnv } from "../../platform/compat/process.js";
+
+const DISPATCH_JWS_HEADER = "x-veryfront-dispatch-jws";
+const MAX_DISPATCH_SIGNATURE_AGE_SECONDS = 60;
+
+export interface ProxyTrustOptions {
+  /**
+   * PEM-encoded Ed25519 public key used to verify `x-veryfront-dispatch-jws`.
+   * When absent, the dispatch-JWS trust signal is disabled (fails closed) and
+   * only the operator opt-in env var can unlock proxy trust.
+   */
+  publicKeyPem?: string;
+}
+
+export async function isProxyTrusted(
+  req: Request,
+  options: ProxyTrustOptions = {},
+): Promise<boolean> {
+  if (getHostEnv("VERYFRONT_TRUST_FORWARDED_HEADERS") === "1") return true;
+
+  const jws = req.headers.get(DISPATCH_JWS_HEADER);
+  if (!jws) return false;
+
+  const { publicKeyPem } = options;
+  if (!publicKeyPem) return false;
+
+  return verifyDispatchJwsSignature(jws, {
+    publicKeyPem,
+    maxAgeSeconds: MAX_DISPATCH_SIGNATURE_AGE_SECONDS,
+  });
+}

package/src/src/utils/version-constant.ts

@@ -1,3 +1,3 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
-export const VERSION = "0.1.229";
+export const VERSION = "0.1.230";