veryfront 0.1.65 → 0.1.68

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.65",
+    "version": "0.1.68",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "exclude": [

package/esm/src/security/http/base-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-handler.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/base-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAClD,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,eAAe,EACf,aAAa,EAEd,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,qBAAqB,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,eAAe,CAAC;IAChF,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,aAAa,CAAC;IAC3F,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,IAAI,CAAC;IAC3F,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5C,QAAQ,EAAE,MAAM,aAAa,CAAC;CAC/B;AAED,8BAAsB,WAAY,YAAW,OAAO;IAClD,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAMxC;IAEF,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAElF,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO;IAY1E,OAAO,CAAC,cAAc;IAmBtB,SAAS,CAAC,qBAAqB,CAC7B,GAAG,EAAE,cAAc,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,eAAe;IAWlB,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,IAAI;IAKhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI;IAIhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI;IAIhG,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAKjD,SAAS,CAAC,QAAQ,IAAI,aAAa;IAInC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa;IAIhG,SAAS,CAAC,gBAAgB,CAAC,CAAC,EAC1B,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC,CAAC,CAAC;CAuDd"}
+{"version":3,"file":"base-handler.d.ts","sourceRoot":"","sources":["../../../../src/src/security/http/base-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAC;AAClD,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,eAAe,EACf,aAAa,EAEd,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,qBAAqB,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,eAAe,CAAC;IAChF,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,aAAa,CAAC;IAC3F,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,IAAI,CAAC;IAC3F,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5C,QAAQ,EAAE,MAAM,aAAa,CAAC;CAC/B;AAED,8BAAsB,WAAY,YAAW,OAAO;IAClD,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAMxC;IAEF,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAElF,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO;IAY1E,OAAO,CAAC,cAAc;IAmBtB,SAAS,CAAC,qBAAqB,CAC7B,GAAG,EAAE,cAAc,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,eAAe;IAWlB,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,IAAI;IAKhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI;IAIhG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI;IAIhG,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAKjD,SAAS,CAAC,QAAQ,IAAI,aAAa;IAInC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa;IAIhG,SAAS,CAAC,gBAAgB,CAAC,CAAC,EAC1B,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC,CAAC,CAAC;CAwDd"}

package/esm/src/security/http/base-handler.js

@@ -66,6 +66,7 @@ export class BaseHandler {
         return { response, continue: false, metadata };
     }
     withProxyContext(ctx, fn, options = {}) {
+        const effectiveToken = ctx.proxyToken || ctx.adapter.env.get("VERYFRONT_API_TOKEN") || "";
         const fsWrapper = ctx.adapter.fs;
         if (typeof fsWrapper.setRequestBranch === "function") {
             try {
@@ -76,7 +77,7 @@ export class BaseHandler {
             }
         }
         const requireToken = options.requireToken ?? false;
-        if (!ctx.projectSlug || (requireToken && !ctx.proxyToken))
+        if (!ctx.projectSlug || (requireToken && !effectiveToken))
             return fn();
         if (fsWrapper.isMultiProjectMode?.()) {
             const isProduction = (ctx.resolvedEnvironment ?? ctx.requestContext?.mode) === "production";
@@ -87,10 +88,10 @@ export class BaseHandler {
                 releaseId: ctx.releaseId,
                 branch,
             }, ctx);
-            return fsWrapper.runWithContext(ctx.projectSlug, ctx.proxyToken ?? "", fn, ctx.projectId, { productionMode: isProduction, releaseId: ctx.releaseId, branch });
+            return fsWrapper.runWithContext(ctx.projectSlug, effectiveToken, fn, ctx.projectId, { productionMode: isProduction, releaseId: ctx.releaseId, branch });
         }
-        if (typeof fsWrapper.setRequestToken === "function" && ctx.proxyToken) {
-            fsWrapper.setRequestToken(ctx.proxyToken);
+        if (typeof fsWrapper.setRequestToken === "function" && effectiveToken) {
+            fsWrapper.setRequestToken(effectiveToken);
         }
         return runWithCacheBatching(fn);
     }

package/esm/src/server/bootstrap.js

@@ -4,7 +4,7 @@ import { getErrorMessage } from "../errors/veryfront-error.js";
 import { INVALID_ARGUMENT } from "../errors/index.js";
 import { enhanceAdapterWithFS } from "../platform/adapters/fs/integration.js";
 import { isExtendedFSAdapter } from "../platform/adapters/fs/wrapper.js";
-import { getEnv } from "../platform/compat/process.js";
+import { getEnv, getHostEnv } from "../platform/compat/process.js";
 import { initializeEsbuild } from "../platform/compat/esbuild.js";
 import { logger } from "../utils/index.js";
 import { isDebugEnabled } from "../utils/constants/env.js";
@@ -180,6 +180,7 @@ export async function bootstrapProd(projectDir, adapter) {
 function validateProductionEnvironment(_adapter) {
     const nodeEnv = getEnv("NODE_ENV") ?? getEnv("DENO_ENV");
     const proxyMode = getEnv("PROXY_MODE");
+    const controlPlanePublicKey = getHostEnv("CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY");
     // In proxy mode (deployed pods), NODE_ENV must be explicitly set to production
     if (proxyMode === "1") {
         if (!nodeEnv) {
@@ -193,6 +194,13 @@ function validateProductionEnvironment(_adapter) {
             logger.warn("[Bootstrap:Prod] NODE_ENV is set to '%s' in proxy mode. " +
                 "Expected 'production'. This may enable dev features.", nodeEnv);
         }
+        if (!controlPlanePublicKey) {
+            logger.error("[Bootstrap:Prod] CRITICAL: CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY is not set in proxy mode. " +
+                "Hosted runtimes cannot verify control-plane requests without it.");
+            throw INVALID_ARGUMENT.create({
+                detail: "CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY must be set when running in proxy mode (PROXY_MODE=1)",
+            });
+        }
     }
     // Log effective configuration for debugging
     bootstrapProdLog.debug("Environment configuration", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.65",
+  "version": "0.1.68",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",

package/src/deno.js

@@ -1,6 +1,6 @@
 export default {
   "name": "veryfront",
-  "version": "0.1.65",
+  "version": "0.1.68",
   "license": "Apache-2.0",
   "nodeModulesDir": "auto",
   "exclude": [

package/src/src/security/http/base-handler.ts

@@ -108,6 +108,7 @@ export abstract class BaseHandler implements Handler {
     fn: () => Promise<T>,
     options: { requireToken?: boolean } = {},
   ): Promise<T> {
+    const effectiveToken = ctx.proxyToken || ctx.adapter.env.get("VERYFRONT_API_TOKEN") || "";
     const fsWrapper = ctx.adapter.fs as {
       setRequestToken?: (t: string) => void;
       setRequestBranch?: (b: string | null) => void;
@@ -130,7 +131,7 @@ export abstract class BaseHandler implements Handler {
     }
 
     const requireToken = options.requireToken ?? false;
-    if (!ctx.projectSlug || (requireToken && !ctx.proxyToken)) return fn();
+    if (!ctx.projectSlug || (requireToken && !effectiveToken)) return fn();
 
     if (fsWrapper.isMultiProjectMode?.()) {
       const isProduction = (ctx.resolvedEnvironment ?? ctx.requestContext?.mode) === "production";
@@ -149,15 +150,15 @@ export abstract class BaseHandler implements Handler {
 
       return fsWrapper.runWithContext!(
         ctx.projectSlug,
-        ctx.proxyToken ?? "",
+        effectiveToken,
         fn,
         ctx.projectId,
         { productionMode: isProduction, releaseId: ctx.releaseId, branch },
       );
     }
 
-    if (typeof fsWrapper.setRequestToken === "function" && ctx.proxyToken) {
-      fsWrapper.setRequestToken(ctx.proxyToken);
+    if (typeof fsWrapper.setRequestToken === "function" && effectiveToken) {
+      fsWrapper.setRequestToken(effectiveToken);
     }
 
     return runWithCacheBatching(fn);

package/src/src/server/bootstrap.ts

@@ -10,7 +10,7 @@ import { getErrorMessage } from "../errors/veryfront-error.js";
 import { INVALID_ARGUMENT } from "../errors/index.js";
 import { enhanceAdapterWithFS } from "../platform/adapters/fs/integration.js";
 import { isExtendedFSAdapter } from "../platform/adapters/fs/wrapper.js";
-import { getEnv } from "../platform/compat/process.js";
+import { getEnv, getHostEnv } from "../platform/compat/process.js";
 import { initializeEsbuild } from "../platform/compat/esbuild.js";
 import { logger } from "../utils/index.js";
 import { isDebugEnabled } from "../utils/constants/env.js";
@@ -256,6 +256,7 @@ export async function bootstrapProd(
 function validateProductionEnvironment(_adapter: RuntimeAdapter): void {
   const nodeEnv = getEnv("NODE_ENV") ?? getEnv("DENO_ENV");
   const proxyMode = getEnv("PROXY_MODE");
+  const controlPlanePublicKey = getHostEnv("CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY");
 
   // In proxy mode (deployed pods), NODE_ENV must be explicitly set to production
   if (proxyMode === "1") {
@@ -276,6 +277,17 @@ function validateProductionEnvironment(_adapter: RuntimeAdapter): void {
         nodeEnv,
       );
     }
+
+    if (!controlPlanePublicKey) {
+      logger.error(
+        "[Bootstrap:Prod] CRITICAL: CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY is not set in proxy mode. " +
+          "Hosted runtimes cannot verify control-plane requests without it.",
+      );
+      throw INVALID_ARGUMENT.create({
+        detail:
+          "CHANNEL_DISPATCH_SIGNING_PUBLIC_KEY must be set when running in proxy mode (PROXY_MODE=1)",
+      });
+    }
   }
 
   // Log effective configuration for debugging