veryfront 0.1.545 → 0.1.547

package/src/src/server/runtime-handler/index.ts

@@ -1,716 +0,0 @@
-/**
- * Veryfront Core HTTP Handler - Composition Root
- *
- * Runtime-agnostic HTTP handler using modular architecture.
- * This file orchestrates the extracted modules for request handling.
- *
- * @module server/runtime-handler
- */
-
-import { getBaseLogger } from "../../utils/logger/logger.js";
-import {
-  type RequestContext,
-  runWithRequestContextAsync,
-} from "../../utils/logger/request-context.js";
-import type { RuntimeAdapter } from "../../platform/adapters/base.js";
-import type { VeryfrontConfig } from "../../config/index.js";
-import { getConfig } from "../../config/loader.js";
-import { getErrorMessage } from "../../errors/veryfront-error.js";
-import { UNKNOWN_ERROR } from "../../errors/error-registry.js";
-import { errorToRFC9457Response } from "../../errors/middleware/http-error-boundary.js";
-import { RouteRegistry } from "../../routing/registry/index.js";
-import type { Handler } from "../../types/index.js";
-import { SecurityConfigLoader } from "../../security/http/config.js";
-import { getHostEnv } from "../../platform/compat/process.js";
-
-// Re-export is at the bottom of the file
-import type { HandlerContext as _HandlerContext } from "../handlers/types.js";
-import { createRequestContext } from "../context/request-context.js";
-
-// Handler imports
-import { AuthHandler } from "../../security/http/auth.js";
-import { CsrfHandler } from "../../security/http/csrf/csrf-handler.js";
-import { CorsHandler } from "../handlers/response/cors.js";
-import { HealthHandler } from "../handlers/monitoring/health.handler.js";
-import { MetricsHandler } from "../handlers/monitoring/metrics.handler.js";
-import {
-  finalizeRequestProfiling,
-  runWithRequestProfiling,
-} from "../../observability/request-profiler.js";
-import { ClientLogHandler } from "../handlers/monitoring/client-log.handler.js";
-import { MemoryDebugHandler } from "../handlers/monitoring/memory.handler.js";
-import { DevEndpointsHandler } from "../handlers/dev/endpoints.handler.js";
-import { DevFileHandler } from "../handlers/dev/files/index.js";
-import { DebugContextHandler } from "../handlers/dev/debug-context.handler.js";
-import { StylesCSSHandler } from "../handlers/dev/styles-css.handler.js";
-import { StudioBridgeModulesHandler } from "../handlers/studio/bridge-modules.handler.js";
-import { StaticHandler } from "../handlers/request/static.handler.js";
-import { SnippetHandler } from "../handlers/request/snippet.handler.js";
-import { LibModulesHandler } from "../handlers/request/lib-modules.handler.js";
-import { ProdHydrationModuleHandler } from "../handlers/request/prod-hydration-module.handler.js";
-import { CSSHandler } from "../handlers/request/css.handler.js";
-import { RSCHandler } from "../handlers/request/rsc/index.js";
-import { ModuleHandler } from "../handlers/request/module/index.js";
-import { ApiHandlerWrapper } from "../handlers/request/api/index.js";
-import { SSRHandler } from "../handlers/request/ssr/index.js";
-import { NotFoundHandler } from "../handlers/response/not-found.js";
-import { HMRHandler } from "../handlers/preview/hmr.handler.js";
-import { MarkdownPreviewHandler } from "../handlers/preview/markdown-preview.handler.js";
-import { OpenAPIHandler } from "../handlers/request/openapi.handler.js";
-import { OpenAPIDocsHandler } from "../handlers/request/openapi-docs.handler.js";
-import { InternalAgentsListHandler } from "../handlers/request/internal-agents-list.handler.js";
-import { AgentStreamHandler } from "../handlers/request/agent-stream.handler.js";
-import { AgentRunResumeHandler } from "../handlers/request/agent-run-resume.handler.js";
-import { AgentRunCancelHandler } from "../handlers/request/agent-run-cancel.handler.js";
-import { ChannelInvokeHandler } from "../handlers/request/channel-invoke.handler.js";
-import { DevDashboardHandler } from "../handlers/dev/dashboard/index.js";
-import { ProjectsHandler } from "../handlers/dev/projects/index.js";
-
-// Extracted modules
-import {
-  endRequestTracing,
-  executeWithTracingContext,
-  setProjectAttributes,
-  setRequestAttributes,
-  SpanNames,
-  startRequestTracing,
-  withSpan,
-} from "./tracing.js";
-import {
-  completeRequestTracking,
-  endContentMetrics,
-  endRequestLifecycle,
-  incrementRequestMetrics,
-  startContentMetrics,
-  startRequestLifecycle,
-  startRequestTracking,
-  timeAsync,
-} from "./request-lifecycle.js";
-import { extractRequestHeaders, resolveProject } from "./project-resolution.js";
-import {
-  checkRequestIsolation,
-  completeIsolatedRequest,
-  createIsolationErrorResponse,
-  startIsolatedRequest,
-} from "./isolation.js";
-import { resolveAdapter } from "./adapter-factory.js";
-import { localProjectCache } from "./local-project-discovery.js";
-import { resolveEnvironment } from "./environment-resolution.js";
-import { buildHandlerContext, buildMinimalContext } from "./handler-context-builder.js";
-import { handleProjectsRequest, shouldHandleProjectsUI } from "./projects-handler.js";
-import {
-  HTTP_GATEWAY_TIMEOUT,
-  isLightweightPath,
-  isMonitoringPath,
-  isWebSocketPath,
-  shouldSkipEnrichedContext,
-} from "./request-utils.js";
-import { withRequestTimeout } from "./timeout-manager.js";
-import {
-  EnvironmentVariableCache,
-  fetchProjectEnvVars,
-  runWithProjectEnv,
-} from "../project-env/index.js";
-import { SCANNER_PATH_PATTERN } from "../../utils/constants/security.js";
-import { isProxyTrusted } from "../utils/proxy-trust.js";
-
-// Re-export from dedicated module for lightweight imports
-export { parseProxyEnvironment, type ProxyEnvironment } from "./proxy-environment.js";
-
-const baseLogger = getBaseLogger("SERVER");
-
-const logger = baseLogger.component("runtime-handler");
-
-/** Handler names in registration order. */
-export const HANDLER_NAMES = [
-  "AuthHandler",
-  "CsrfHandler",
-  "HMRHandler",
-  "CorsHandler",
-  "HealthHandler",
-  "MetricsHandler",
-  "MemoryDebugHandler",
-  "ClientLogHandler",
-  "DevEndpointsHandler",
-  "StylesCSSHandler",
-  "DebugContextHandler",
-  "OpenAPIHandler",
-  "OpenAPIDocsHandler",
-  "InternalAgentsListHandler",
-  "AgentStreamHandler",
-  "AgentRunResumeHandler",
-  "AgentRunCancelHandler",
-  "ChannelInvokeHandler",
-  "DevDashboardHandler",
-  "ProjectsHandler",
-  "StudioBridgeModulesHandler",
-  "ProdHydrationModuleHandler",
-  "CSSHandler",
-  "DevFileHandler",
-  "SnippetHandler",
-  "StaticHandler",
-  "LibModulesHandler",
-  "RSCHandler",
-  "ModuleHandler",
-  "ApiHandlerWrapper",
-  "MarkdownPreviewHandler",
-  "SSRHandler",
-  "NotFoundHandler",
-] as const;
-
-/** Union of all registered handler names. */
-export type HandlerName = (typeof HANDLER_NAMES)[number];
-
-/**
- * Dependencies for handler registry creation.
- * All fields are optional — when omitted, the real handler implementation is used.
- * This allows tests to inject mock handlers for specific slots.
- */
-export interface HandlerDependencies {
-  /** Override any handler by its typed name. */
-  overrides?: Partial<Record<HandlerName, Handler>>;
-  /** When true, log handler registration details. */
-  debug?: boolean;
-}
-
-/** Factory for each handler. Only called when no override is provided (lazy instantiation). */
-const handlerFactories: Record<
-  HandlerName,
-  (projectDir: string, adapter: RuntimeAdapter) => Handler
-> = {
-  AuthHandler: () => new AuthHandler(),
-  CsrfHandler: () => new CsrfHandler(),
-  HMRHandler: () => new HMRHandler(),
-  CorsHandler: () => new CorsHandler(),
-  HealthHandler: () => new HealthHandler(),
-  MetricsHandler: () => new MetricsHandler(),
-  MemoryDebugHandler: () => new MemoryDebugHandler(),
-  ClientLogHandler: () => new ClientLogHandler(),
-  DevEndpointsHandler: () => new DevEndpointsHandler(),
-  StylesCSSHandler: () => new StylesCSSHandler(),
-  DebugContextHandler: () => new DebugContextHandler(),
-  OpenAPIHandler: () => new OpenAPIHandler(),
-  OpenAPIDocsHandler: () => new OpenAPIDocsHandler(),
-  InternalAgentsListHandler: () => new InternalAgentsListHandler(),
-  AgentStreamHandler: () => new AgentStreamHandler(),
-  AgentRunResumeHandler: () => new AgentRunResumeHandler(),
-  AgentRunCancelHandler: () => new AgentRunCancelHandler(),
-  ChannelInvokeHandler: () => new ChannelInvokeHandler(),
-  DevDashboardHandler: () => new DevDashboardHandler(),
-  ProjectsHandler: () => new ProjectsHandler(),
-  StudioBridgeModulesHandler: () => new StudioBridgeModulesHandler(),
-  ProdHydrationModuleHandler: () => new ProdHydrationModuleHandler(),
-  CSSHandler: () => new CSSHandler(),
-  DevFileHandler: () => new DevFileHandler(),
-  SnippetHandler: () => new SnippetHandler(),
-  StaticHandler: () => new StaticHandler(),
-  LibModulesHandler: () => new LibModulesHandler(),
-  RSCHandler: () => new RSCHandler(),
-  ModuleHandler: () => new ModuleHandler(),
-  ApiHandlerWrapper: (projectDir, adapter) => new ApiHandlerWrapper(projectDir, adapter),
-  MarkdownPreviewHandler: () => new MarkdownPreviewHandler(),
-  SSRHandler: () => new SSRHandler(),
-  NotFoundHandler: () => new NotFoundHandler(),
-};
-
-/**
- * Creates a RouteRegistry populated with the standard handler chain.
- *
- * Handlers are instantiated lazily — overridden slots skip construction
- * of the default handler entirely.
- *
- * @param projectDir - Root project directory
- * @param adapter - Runtime adapter for environment access
- * @param deps - Optional dependency overrides for testing
- * @returns Object containing the registry and the api handler (for initialization)
- */
-export function createHandlerRegistry(
-  projectDir: string,
-  adapter: RuntimeAdapter,
-  deps: HandlerDependencies = {},
-): { registry: RouteRegistry; apiHandler: ApiHandlerWrapper } {
-  const registry = new RouteRegistry({
-    debug: deps.debug,
-    enableMetrics: true,
-  });
-
-  const overrides = deps.overrides ?? {};
-
-  // Create the ApiHandlerWrapper first — it's special because callers need
-  // the returned instance for initialization regardless of overrides.
-  const apiHandler = overrides.ApiHandlerWrapper
-    ? (overrides.ApiHandlerWrapper as ApiHandlerWrapper)
-    : new ApiHandlerWrapper(projectDir, adapter);
-
-  const handlers = HANDLER_NAMES.map((name) => {
-    if (name === "ApiHandlerWrapper") return apiHandler;
-    if (overrides[name]) return overrides[name]!;
-    return handlerFactories[name](projectDir, adapter);
-  });
-
-  registry.registerAll(handlers);
-
-  return { registry, apiHandler };
-}
-
-export interface RuntimeHandlerOptions {
-  projectDir: string;
-  /** When true, expose additional debug logging. */
-  debug?: boolean;
-  /** Module server URL for ESM imports (e.g., 'http://localhost:8765') */
-  moduleServerUrl?: string;
-  /** Pre-loaded config (avoids re-loading via FSAdapter) */
-  config?: VeryfrontConfig;
-  /** Map of local project slugs to their filesystem paths (for unified dev server) */
-  localProjects?: Record<string, string>;
-  /** Default project slug when not provided via proxy headers (for tests/local mode) */
-  defaultProjectSlug?: string;
-  /** Default project ID when not provided via proxy headers (for tests/local mode) */
-  defaultProjectId?: string;
-  /** Default environment for standalone mode (preview or production). Defaults to preview for safety. */
-  defaultEnvironment?: "preview" | "production";
-}
-
-export function createVeryfrontHandler(
-  projectDir: string,
-  adapter: RuntimeAdapter,
-  opts: RuntimeHandlerOptions = { projectDir },
-): ((req: Request) => Promise<Response>) & { ready?: Promise<void> } {
-  const isDebugEnabled = !!(opts.debug || adapter.env.get("VERYFRONT_DEBUG"));
-
-  function logDebug(message: string, extra?: Record<string, unknown>): void {
-    if (!isDebugEnabled) return;
-    if (extra) {
-      logger.debug(message, extra);
-      return;
-    }
-    logger.debug(message);
-  }
-
-  logDebug("[runtime-handler] handler initialized", { projectDir });
-
-  // Seed local project cache from explicit mappings (for tests and capability injection)
-  if (opts.localProjects) {
-    for (const [slug, path] of Object.entries(opts.localProjects)) {
-      localProjectCache.set(slug, path);
-    }
-    logDebug("[runtime-handler] Seeded local project cache", {
-      projects: Object.keys(opts.localProjects),
-    });
-  }
-
-  const securityLoader = new SecurityConfigLoader(projectDir, adapter, opts.config);
-
-  // Per-project environment variable cache (fetches from API, caches with 60s TTL)
-  const apiBaseUrl = adapter.env.get("VERYFRONT_API_BASE_URL") ?? "https://api.veryfront.com/api";
-  const envVarCache = new EnvironmentVariableCache(
-    (environmentId, token, projectSlug) =>
-      fetchProjectEnvVars(apiBaseUrl, projectSlug, environmentId, token),
-  );
-
-  let config: VeryfrontConfig | undefined = opts.config;
-  const configPromise = (async () => {
-    try {
-      const c = opts.config ? opts.config : await getConfig(projectDir, adapter);
-      config = c;
-      if (c?.security?.csrf === undefined) {
-        logger.info(
-          "CSRF protection is not configured. Add `security: { csrf: true }` to veryfront.config.ts to enable.",
-        );
-      }
-      return c;
-    } catch (error) {
-      logger.warn("Failed to load config, using defaults", {
-        error: getErrorMessage(error),
-      });
-      return undefined;
-    }
-  })();
-
-  const { registry, apiHandler } = createHandlerRegistry(projectDir, adapter, {
-    debug: opts.debug,
-  });
-
-  const isProxyMode = opts.config?.fs?.veryfront?.proxyMode === true;
-
-  const readyPromise = isProxyMode ? Promise.resolve() : apiHandler.initialize().catch((error) => {
-    logger.error("API handler initialization failed", {
-      error: getErrorMessage(error),
-      stack: error instanceof Error ? error.stack : undefined,
-    });
-    throw error;
-  });
-
-  if (isProxyMode) {
-    logger.debug("Running in proxy mode - lazy initialization enabled");
-  }
-
-  const handler = async (req: Request): Promise<Response> => {
-    const url = new URL(req.url);
-    const lifecycle = startRequestLifecycle(req, url.pathname, isLightweightPath(url.pathname));
-
-    // Fast path for monitoring endpoints
-    if (isMonitoringPath(url.pathname)) {
-      try {
-        await readyPromise;
-        if (!isProxyMode) await securityLoader.ensureLoaded();
-
-        const minimalCtx = buildMinimalContext(
-          projectDir,
-          adapter,
-          securityLoader.getSecurityConfig(),
-          securityLoader.getCspUserHeader(),
-          opts.debug,
-          config,
-        );
-
-        const response = await registry.execute(req, minimalCtx);
-        return response ?? new Response("Not Found", { status: 404 });
-      } finally {
-        endRequestLifecycle(lifecycle);
-      }
-    }
-
-    // Build logger context
-    const hostHeader = req.headers.get("host") ?? url.host;
-    const domain = hostHeader.replace(/:\d+$/, "");
-    const headers = extractRequestHeaders(req, url);
-
-    const loggerContext: RequestContext = {
-      logger: logger.child({
-        requestId: lifecycle.requestId,
-        request_url: req.url,
-        domain,
-        project_slug: headers.projectSlug,
-        project_id: headers.projectId,
-        release_id: headers.releaseId,
-        branch_id: headers.branchId,
-        branch_name: headers.branchName,
-        pathname: url.pathname,
-      }),
-      requestId: lifecycle.requestId,
-      projectSlug: headers.projectSlug,
-      projectId: headers.projectId,
-      domain,
-    };
-
-    return runWithRequestContextAsync(loggerContext, async () => {
-      const spanInfo = startRequestTracing(req, url.pathname);
-      setRequestAttributes(spanInfo.span, req, url);
-
-      startRequestTracking(
-        lifecycle.requestId,
-        headers.projectSlug,
-        url.pathname,
-        req.method,
-        headers.environment,
-        headers.releaseId,
-      );
-
-      startContentMetrics();
-
-      // Check isolation
-      const isolationCheck = checkRequestIsolation(
-        headers.projectSlug,
-        lifecycle.shouldCheckIsolation,
-      );
-
-      if (!isolationCheck.allowed) {
-        endContentMetrics({
-          requestId: lifecycle.requestId,
-          pathname: url.pathname,
-          mode: "isolation",
-        });
-        completeRequestTracking(lifecycle.requestId, 503, false);
-        const response = createIsolationErrorResponse(isolationCheck);
-        endRequestTracing(spanInfo.span, response.status);
-        return response;
-      }
-
-      startIsolatedRequest(headers.projectSlug, lifecycle.shouldCheckIsolation);
-
-      try {
-        // Early validation: in proxy mode, required context headers must be present.
-        // Without these, the server cannot authenticate or resolve the project, and
-        // proceeding would cause cryptic 500s deep in the rendering pipeline.
-        if (isProxyMode && !isLightweightPath(url.pathname) && !isWebSocketPath(url.pathname)) {
-          const token = req.headers.get("x-token");
-
-          const missingHeader = !headers.projectSlug
-            ? {
-              error: "Missing project context",
-              detail: "x-project-slug header is required in proxy mode",
-            }
-            : !token
-            ? {
-              error: "Missing authentication context",
-              detail: "x-token header is required in proxy mode",
-            }
-            : null;
-
-          const publicKeyPem = adapter.env.get("CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY") ??
-            getHostEnv("CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY");
-          const hasTrustSensitiveProxyHeaders = !!req.headers.get("x-project-path");
-          const untrustedProxyContext = !missingHeader && hasTrustSensitiveProxyHeaders &&
-            !(await isProxyTrusted(req, { publicKeyPem }));
-          const proxyContextError = untrustedProxyContext
-            ? {
-              error: "Untrusted proxy context",
-              detail: "proxy context headers require a trusted upstream proxy",
-            }
-            : null;
-
-          const proxyGuardError = missingHeader ?? proxyContextError;
-
-          if (proxyGuardError) {
-            logger.warn(proxyGuardError.detail, {
-              pathname: url.pathname,
-              domain,
-              projectSlug: headers.projectSlug,
-              host: req.headers.get("host"),
-              forwardedHost: req.headers.get("x-forwarded-host"),
-            });
-            endContentMetrics({
-              requestId: lifecycle.requestId,
-              pathname: url.pathname,
-              mode: "proxy",
-            });
-            completeRequestTracking(lifecycle.requestId, 502, false);
-            completeIsolatedRequest(headers.projectSlug, lifecycle.shouldCheckIsolation, false);
-            endRequestTracing(spanInfo.span, 502);
-            return new Response(
-              JSON.stringify(proxyGuardError),
-              { status: 502, headers: { "Content-Type": "application/json" } },
-            );
-          }
-        }
-
-        const executeHandler = async (): Promise<Response> => {
-          // Fast rejection of vulnerability scanner probes before any async work
-          if (SCANNER_PATH_PATTERN.test(url.pathname)) {
-            return new Response("Not Found", { status: 404 });
-          }
-
-          await readyPromise;
-
-          await timeAsync("security:load", async () => {
-            if (isProxyMode) return;
-            await securityLoader.ensureLoaded();
-          });
-
-          await timeAsync("config:load", async () => {
-            await configPromise;
-          });
-
-          const reqCtx = createRequestContext(req);
-
-          const wsSlugOverride = url.searchParams.get("x-project-slug") || undefined;
-
-          // Resolve project from various sources
-          const projectRes = await resolveProject(req, url, headers, {
-            config,
-            reqCtx,
-            defaultProjectSlug: opts.defaultProjectSlug,
-            defaultProjectId: opts.defaultProjectId,
-            wsSlugOverride,
-          });
-
-          setProjectAttributes(spanInfo.span, projectRes.projectSlug, projectRes.proxyEnv);
-
-          // Handle projects discovery UI
-          if (
-            shouldHandleProjectsUI(url.pathname, projectRes.projectSlug, projectRes.parsedDomain)
-          ) {
-            const response = await handleProjectsRequest(
-              req,
-              url,
-              buildMinimalContext(
-                projectDir,
-                adapter,
-                securityLoader.getSecurityConfig(),
-                securityLoader.getCspUserHeader(),
-                opts.debug,
-                config,
-              ),
-            );
-            if (response) return response;
-          }
-
-          // Resolve adapter and config for project.
-          // Note: `x-project-path` is NOT forwarded via `headers.projectPath` anymore;
-          // `resolveAdapter` reads it directly from `req` and only honours it when the
-          // request is proxy-trusted (see isProxyTrusted).
-          const adapterRes = await resolveAdapter({
-            req,
-            projectDir,
-            adapter,
-            config,
-            projectSlug: projectRes.projectSlug,
-            projectId: projectRes.projectId,
-            proxyToken: reqCtx.token,
-            releaseId: projectRes.releaseId,
-            proxyEnv: projectRes.proxyEnv,
-            branch: reqCtx.branch,
-            environmentName: projectRes.environmentName,
-            parsedDomain: projectRes.parsedDomain,
-            isProxyMode,
-          });
-
-          // Resolve environment and validate
-          const host = req.headers.get("x-forwarded-host") || req.headers.get("host") || url.host;
-          const envRes = resolveEnvironment({
-            proxyEnv: projectRes.proxyEnv,
-            reqCtxMode: reqCtx.mode,
-            releaseId: projectRes.releaseId,
-            projectSlug: projectRes.projectSlug,
-            projectId: projectRes.projectId,
-            environmentName: projectRes.environmentName,
-            host,
-            isLocalProject: adapterRes.isLocalProject,
-            isProxyMode,
-            pathname: url.pathname,
-            defaultEnvironment: opts.defaultEnvironment,
-          });
-
-          if (envRes.errorResponse) {
-            return envRes.errorResponse;
-          }
-
-          const skipRenderEnrichedContext = shouldSkipEnrichedContext(url.pathname);
-
-          // Build handler context
-          const ctx = buildHandlerContext({
-            projectDir: adapterRes.projectDir,
-            adapter: adapterRes.adapter,
-            securityConfig: securityLoader.getSecurityConfig(),
-            cspUserHeader: securityLoader.getCspUserHeader(),
-            debug: opts.debug,
-            config: adapterRes.config,
-            parsedDomain: projectRes.parsedDomain,
-            projectSlug: projectRes.projectSlug,
-            projectId: projectRes.projectId,
-            releaseId: envRes.releaseId,
-            proxyToken: reqCtx.token,
-            environmentName: projectRes.environmentName,
-            resolvedEnvironment: envRes.resolvedEnvironment ?? "preview",
-            requestContext: reqCtx,
-            routeRegistry: registry,
-            isLocalProject: adapterRes.isLocalProject,
-            moduleServerUrl: opts.moduleServerUrl,
-            environmentId: headers.environmentId,
-            skipEnrichedContext: skipRenderEnrichedContext,
-          });
-
-          // Fetch per-project env vars for remote projects
-          let envVarsForRequest: Record<string, string> = {};
-          if (
-            !adapterRes.isLocalProject &&
-            headers.environmentId &&
-            reqCtx.token &&
-            projectRes.projectSlug
-          ) {
-            envVarsForRequest = await envVarCache.get(
-              headers.environmentId,
-              reqCtx.token,
-              projectRes.projectSlug,
-            );
-
-            logDebug("[runtime-handler] Project env vars fetched", {
-              projectSlug: projectRes.projectSlug,
-              environmentId: headers.environmentId,
-              count: Object.keys(envVarsForRequest).length,
-            });
-          }
-
-          await incrementRequestMetrics();
-
-          const executeRoute = () => registry.execute(req, ctx);
-          // Only activate env isolation in proxy mode (multi-tenant).
-          // reqCtx.token indicates the request came through the proxy with auth.
-          // Without it (standalone / test), host env must remain accessible.
-          const shouldIsolateEnv = !adapterRes.isLocalProject && !!reqCtx.token;
-          const response = await runWithRequestProfiling(
-            {
-              category: url.pathname.startsWith("/_vf_styles/")
-                ? "css"
-                : url.pathname.startsWith("/_vf_modules/")
-                ? "module"
-                : url.pathname.startsWith("/api/")
-                ? "api"
-                : "html",
-              method: req.method,
-              pathname: url.pathname,
-              projectSlug: projectRes.projectSlug,
-              requestMode: envRes.resolvedEnvironment,
-            },
-            async () => {
-              let routedResponse: Response | null | undefined;
-              try {
-                routedResponse = await withSpan(
-                  SpanNames.HANDLER_EXECUTE,
-                  () => {
-                    if (shouldIsolateEnv) {
-                      return runWithProjectEnv(envVarsForRequest, executeRoute);
-                    }
-                    return executeRoute();
-                  },
-                  {
-                    "handler.project_slug": projectRes.projectSlug || "unknown",
-                    "handler.path": url.pathname,
-                    "handler.method": req.method,
-                  },
-                );
-                return routedResponse;
-              } finally {
-                finalizeRequestProfiling(routedResponse?.status);
-              }
-            },
-          );
-
-          if (response) return response;
-
-          logDebug("[runtime-handler] No handler produced response (unexpected)", {
-            path: url.pathname,
-          });
-          // RFC 9457 error response for no handler case (env-aware filtering)
-          const noHandlerError = UNKNOWN_ERROR.create({
-            detail: "No handler available to process this request",
-            instance: url.pathname,
-          });
-          return errorToRFC9457Response(noHandlerError, ctx, req);
-        };
-
-        const { response, error } = await withRequestTimeout(
-          () => executeWithTracingContext(spanInfo, executeHandler),
-          url.pathname,
-          req.method,
-        );
-
-        endRequestTracing(spanInfo.span, response.status, error);
-
-        endContentMetrics({
-          requestId: lifecycle.requestId,
-          pathname: url.pathname,
-          mode: headers.environment || "unknown",
-        });
-
-        const isTimeout = response.status === HTTP_GATEWAY_TIMEOUT;
-        completeRequestTracking(lifecycle.requestId, response.status, isTimeout);
-        completeIsolatedRequest(headers.projectSlug, lifecycle.shouldCheckIsolation, isTimeout);
-
-        return response;
-      } finally {
-        endRequestLifecycle(lifecycle);
-      }
-    });
-  };
-
-  handler.ready = readyPromise;
-
-  return handler;
-}
-
-// Re-export types and utilities for backward compatibility
-export type { HandlerContext } from "../handlers/types.js";
-export { RouteRegistry } from "../../routing/registry/index.js";
-export { BaseHandler } from "../handlers/response/base.js";