veryfront 0.1.80 → 0.1.82

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.80",
+    "version": "0.1.82",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "exclude": [

package/esm/src/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAMlD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;AAOzD,UAAU,cAAc;IACtB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,iBAAiB,CAAC,CAA0B;IACpD,OAAO,CAAC,kBAAkB,CAAS;gBAEvB,MAAM,EAAE,eAAe;IAInC;;;OAGG;IACH,oBAAoB,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAK3D,aAAa,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;IAsBhG,OAAO,CAAC,QAAQ;IA8BhB,OAAO,CAAC,UAAU;YAYJ,SAAS;IA2BvB,OAAO,CAAC,QAAQ;IAmChB,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,YAAY;IA6CpB,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,SAAS;IAuCjB,iBAAiB,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IAsD5E,OAAO,CAAC,qBAAqB;YAkBf,YAAY;IAe1B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,cAAc;YAYR,oBAAoB;CA0BnC;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAElE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAMlD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAOzE,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;AAOzD,UAAU,cAAc;IACtB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,iBAAiB,CAAC,CAA0B;IACpD,OAAO,CAAC,kBAAkB,CAAS;gBAEvB,MAAM,EAAE,eAAe;IAQnC;;;OAGG;IACH,oBAAoB,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAK3D,aAAa,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;IAsBhG,OAAO,CAAC,QAAQ;IA8BhB,OAAO,CAAC,UAAU;YAYJ,SAAS;IA2BvB,OAAO,CAAC,QAAQ;IAmChB,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,YAAY;IA6CpB,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,SAAS;IAuCjB,iBAAiB,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IA+E5E,OAAO,CAAC,qBAAqB;YAkBf,YAAY;IAoB1B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,cAAc;YAqBR,oBAAoB;CA0BnC;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAElE"}

package/esm/src/mcp/server.js

@@ -9,6 +9,9 @@ import { withSpan } from "../observability/tracing/otlp-setup.js";
 import { VERSION } from "../utils/version.js";
 import { validateContentType } from "../security/input-validation/limits.js";
 import { VeryfrontError } from "../security/input-validation/errors.js";
+import { logger as baseLogger } from "../utils/index.js";
+const logger = baseLogger.component("mcp-server");
+const MAX_REQUEST_BODY_SIZE = 1_048_576; // 1 MB
 function asParamsRecord(params) {
     if (!params || Array.isArray(params))
         return {};
@@ -20,6 +23,9 @@ export class MCPServer {
     integrationsLoaded = false;
     constructor(config) {
         this.config = config;
+        if (!config.auth || config.auth.type === "none") {
+            logger.warn("MCP server has no authentication configured — all requests will be accepted");
+        }
     }
     /**
      * Configure integration tools to be lazily loaded on first tools/list call.
@@ -207,13 +213,23 @@ export class MCPServer {
     }
     createHTTPHandler() {
         return async (request) => {
+            const requestOrigin = request.headers.get("Origin");
             if (request.method === "OPTIONS")
-                return this.handleCORS();
+                return this.handleCORS(requestOrigin);
             if (this.config.auth?.type && this.config.auth.type !== "none") {
                 const authorized = await this.validateAuth(request);
                 if (!authorized)
                     return new dntShim.Response("Unauthorized", { status: 401 });
             }
+            // Enforce request body size limit (fast path via Content-Length header)
+            const contentLength = request.headers.get("content-length");
+            if (contentLength && Number(contentLength) > MAX_REQUEST_BODY_SIZE) {
+                return new dntShim.Response(JSON.stringify({
+                    jsonrpc: "2.0",
+                    id: null,
+                    error: { code: -32600, message: "Request body too large" },
+                }), { status: 413, headers: { "Content-Type": "application/json" } });
+            }
             try {
                 validateContentType(request, "application/json");
             }
@@ -227,7 +243,15 @@ export class MCPServer {
             }
             let rpcRequest;
             try {
-                rpcRequest = await request.json();
+                const bodyText = await request.text();
+                if (bodyText.length > MAX_REQUEST_BODY_SIZE) {
+                    return new dntShim.Response(JSON.stringify({
+                        jsonrpc: "2.0",
+                        id: null,
+                        error: { code: -32600, message: "Request body too large" },
+                    }), { status: 413, headers: { "Content-Type": "application/json" } });
+                }
+                rpcRequest = JSON.parse(bodyText);
             }
             catch (_) {
                 // expected: malformed JSON in request body
@@ -246,7 +270,7 @@ export class MCPServer {
             return new dntShim.Response(JSON.stringify(rpcResponse), {
                 headers: {
                     "Content-Type": "application/json",
-                    ...this.getCORSHeaders(),
+                    ...this.getCORSHeaders(requestOrigin),
                 },
             });
         };
@@ -275,21 +299,33 @@ export class MCPServer {
         if (auth.type !== "bearer")
             return false;
         const token = authHeader.replace("Bearer ", "");
-        if (!auth.validate)
+        // When bearer auth is configured without a validate function, reject all requests
+        if (!auth.validate) {
+            logger.warn("Bearer auth configured without validate function — rejecting request");
             return false;
+        }
         return await auth.validate(token);
     }
-    handleCORS() {
-        return new dntShim.Response(null, { status: 204, headers: this.getCORSHeaders() });
+    handleCORS(requestOrigin) {
+        return new dntShim.Response(null, { status: 204, headers: this.getCORSHeaders(requestOrigin) });
     }
-    getCORSHeaders() {
+    getCORSHeaders(requestOrigin) {
         if (!this.config.cors?.enabled)
             return {};
-        const origin = this.config.cors.origins?.[0] ?? "*";
+        const origins = this.config.cors.origins;
+        if (!origins || origins.length === 0)
+            return {};
+        // Match request origin against the configured origins list
+        const matchedOrigin = requestOrigin && origins.includes(requestOrigin)
+            ? requestOrigin
+            : undefined;
+        if (!matchedOrigin)
+            return {};
         return {
-            "Access-Control-Allow-Origin": origin,
+            "Access-Control-Allow-Origin": matchedOrigin,
             "Access-Control-Allow-Methods": "POST, OPTIONS",
             "Access-Control-Allow-Headers": "Content-Type, Authorization, X-End-User-Id, X-Project-Id",
+            "Vary": "Origin",
         };
     }
     async loadIntegrationTools(config) {

package/esm/src/proxy/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/src/proxy/handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,KAAK,YAAY,EAAsB,MAAM,kCAAkC,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAQnD,eAAO,MAAM,sBAAsB,0MAYzB,CAAC;AA6EX,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,SAAS,GAAG,YAAY,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC9D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC7D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC7D,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAC9E;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AA4CD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB;0BA6K1B,OAAO,CAAC,OAAO,KAAG,OAAO,CAAC,YAAY,CAAC;0BA+NvC,OAAO,CAAC,OAAO,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;;;;;;;;0BAjVrD,MAAM,EAAE;;EA+XpC;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEjE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAwB7F"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/src/proxy/handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,KAAK,YAAY,EAAsB,MAAM,kCAAkC,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAQnD,eAAO,MAAM,sBAAsB,0MAYzB,CAAC;AAoGX,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,SAAS,GAAG,YAAY,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC9D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC7D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC7D,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAC9E;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AA8ED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB;0BAiL1B,OAAO,CAAC,OAAO,KAAG,OAAO,CAAC,YAAY,CAAC;0BA+NvC,OAAO,CAAC,OAAO,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;;;;;;;;0BArVrD,MAAM,EAAE;;EAmYpC;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEjE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAwB7F"}

package/esm/src/proxy/handler.js

@@ -6,7 +6,7 @@ import { cwd, getEnv } from "../platform/compat/process.js";
 import { join } from "../platform/compat/path/index.js";
 import { injectContext, ProxySpanNames, withSpan } from "./tracing.js";
 import { computeContentSourceId } from "../cache/keys.js";
-import { jwtVerify } from "jose";
+import { createRemoteJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
 export const INTERNAL_PROXY_HEADERS = [
     "x-token",
     "x-project-slug",
@@ -20,6 +20,26 @@ export const INTERNAL_PROXY_HEADERS = [
     "x-branch-id",
     "x-branch-name",
 ];
+const remoteJwksByUrl = new Map();
+function getApiJwks(apiBaseUrl, logger) {
+    try {
+        const normalizedBaseUrl = apiBaseUrl.endsWith("/") ? apiBaseUrl : `${apiBaseUrl}/`;
+        const jwksUrl = new URL(".well-known/jwks.json", normalizedBaseUrl);
+        const cacheKey = jwksUrl.toString();
+        let jwks = remoteJwksByUrl.get(cacheKey);
+        if (!jwks) {
+            jwks = createRemoteJWKSet(jwksUrl);
+            remoteJwksByUrl.set(cacheKey, jwks);
+        }
+        return jwks;
+    }
+    catch (error) {
+        logger?.error("Invalid API base URL for JWKS lookup", error, {
+            apiBaseUrl,
+        });
+        return undefined;
+    }
+}
 async function lookupProjectByDomain(domain, apiBaseUrl, token, logger) {
     return withSpan(ProxySpanNames.PROXY_DOMAIN_LOOKUP, async () => {
         const domainWithoutPort = domain.replace(/:\d+$/, "");
@@ -70,7 +90,38 @@ function extractUserToken(cookieHeader) {
     const match = cookieHeader.match(/(?:^|;\s*)authToken=([^;]+)/);
     return match?.[1] ? decodeURIComponent(match[1]) : undefined;
 }
-async function extractUserIdFromToken(token, log) {
+async function extractUserIdFromToken(token, apiBaseUrl, log) {
+    let algorithm;
+    try {
+        algorithm = decodeProtectedHeader(token).alg;
+    }
+    catch (error) {
+        log?.debug("Failed to decode JWT header", {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return undefined;
+    }
+    if (algorithm === "RS256") {
+        const jwks = getApiJwks(apiBaseUrl, log);
+        if (!jwks)
+            return undefined;
+        try {
+            const { payload } = await jwtVerify(token, jwks, {
+                algorithms: ["RS256"],
+            });
+            return payload.userId;
+        }
+        catch (error) {
+            log?.debug("RS256 JWT verification failed", {
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return undefined;
+        }
+    }
+    if (algorithm !== "HS256") {
+        log?.debug("Unsupported JWT algorithm", { algorithm: algorithm ?? null });
+        return undefined;
+    }
     const jwtSecret = getEnv("JWT_SECRET");
     if (!jwtSecret) {
         log?.warn("JWT_SECRET not configured — cannot verify user token");
@@ -184,7 +235,7 @@ export function createProxyHandler(options) {
             });
             return { status: 302, message: "Authentication required", redirectUrl };
         }
-        const userId = await extractUserIdFromToken(userToken, logger);
+        const userId = await extractUserIdFromToken(userToken, config.apiBaseUrl, logger);
         if (!userId) {
             const redirectUrl = makeAuthRedirectUrl(req);
             logger?.info("Could not extract userId from token", {

package/esm/src/rendering/orchestrator/module-loader/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/src/rendering/orchestrator/module-loader/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AA6BzE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAkJpE,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,cAAc,EAC5B,MAAM,EAAE,kBAAkB,EAC1B,eAAe,UAAQ,GACtB,OAAO,CAAC,MAAM,CAAC,CAkSjB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;IACnC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAyBD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAqClC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/src/rendering/orchestrator/module-loader/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AA2BzE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAkJpE,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,cAAc,EAC5B,MAAM,EAAE,kBAAkB,EAC1B,eAAe,UAAQ,GACtB,OAAO,CAAC,MAAM,CAAC,CA4RjB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;IACnC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAyBD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAqClC"}

package/esm/src/rendering/orchestrator/module-loader/index.js

@@ -14,14 +14,12 @@ import { createFileSystem } from "../../../platform/compat/fs.js";
 import { getProjectTmpDir } from "../../../modules/react-loader/index.js";
 import { generateCacheKey as generateTransformCacheKey, getOrComputeTransform, initializeTransformCache, setCachedTransformAsync, } from "../../../transforms/esm/transform-cache.js";
 import { TRANSFORM_DISTRIBUTED_TTL_SEC } from "../../../utils/constants/cache.js";
-import { ensureHttpBundlesExist } from "../../../transforms/esm/http-cache.js";
-import { validateBundleGroup } from "../../../transforms/esm/bundle-manifest.js";
+import { validateCachedBundlesByManifestOrCode } from "../../../transforms/esm/cached-bundle-validation.js";
 import { getHttpBundleCacheDir, getMdxEsmCacheDir } from "../../../utils/cache-dir.js";
 import { dirname, join, normalize } from "../../../platform/compat/path/index.js";
 import { hashCodeHex } from "../../../utils/hash-utils.js";
 import { VERSION } from "../../../utils/version.js";
 import { getModulePathCache, lookupMdxEsmCache, saveModulePathCache, } from "../../../transforms/mdx/esm-module-loader/cache/index.js";
-import { extractHttpBundlePaths } from "../../../modules/react-loader/ssr-module-loader/http-bundle-helpers.js";
 const logger = rendererLogger.component("module-loader");
 // Re-export utilities
 export { createEsmCache, createModuleCache, generateHash } from "./cache.js";
@@ -243,30 +241,19 @@ export async function transformModuleWithDeps(filePath, tmpDir, localAdapter, co
     let transformedCode = transformResult.code;
     const cacheDir = getHttpBundleCacheDir();
     let bundlesValid = true;
-    if (transformResult.cacheHit && transformResult.bundleManifestId) {
-        const validation = await validateBundleGroup(transformResult.bundleManifestId, cacheDir);
+    if (transformResult.cacheHit) {
+        const validation = await validateCachedBundlesByManifestOrCode(transformedCode, transformResult.bundleManifestId, cacheDir);
         if (!validation.valid) {
-            logger.warn("Bundle manifest validation failed, re-transforming", {
+            logger.warn("Cached HTTP bundle validation failed, re-transforming", {
                 filePath,
-                manifestId: transformResult.bundleManifestId.slice(0, 12),
+                manifestId: transformResult.bundleManifestId?.slice(0, 12),
                 failedHashes: validation.failedHashes,
+                reason: validation.reason,
+                source: validation.source,
             });
             bundlesValid = false;
         }
     }
-    else {
-        const bundlePaths = extractHttpBundlePaths(transformedCode);
-        if (bundlePaths.length > 0) {
-            const failed = await ensureHttpBundlesExist(bundlePaths, cacheDir);
-            if (failed.length > 0) {
-                logger.warn("HTTP bundle recovery failed, re-transforming", {
-                    filePath,
-                    failed,
-                });
-                bundlesValid = false;
-            }
-        }
-    }
     if (!bundlesValid) {
         transformedCode = await transformToESM(fileContent, filePath, projectDir, adapter, {
             projectId: effectiveProjectId,

package/esm/src/transforms/esm/bundle-manifest.d.ts

@@ -20,10 +20,12 @@ interface BundleManifest {
     createdAt: number;
     ttlSeconds: number;
 }
+export type ManifestValidationReason = "manifest_missing" | "bundle_missing";
 /** Result of manifest validation. */
-interface ManifestValidationResult {
+export interface ManifestValidationResult {
     valid: boolean;
     failedHashes: string[];
+    reason?: ManifestValidationReason;
 }
 /**
  * Compute a deterministic manifest ID from bundle hashes.

package/esm/src/transforms/esm/bundle-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle-manifest.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/bundle-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;4BAQ4B;AAiB5B,gDAAgD;AAChD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oEAAoE;AACpE,UAAU,cAAc;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qCAAqC;AACrC,UAAU,wBAAwB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAgBD;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAEzE;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAc1F;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBjF;AAuBD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,wBAAwB,CAAC,CA6CnC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErE;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB1E"}
+{"version":3,"file":"bundle-manifest.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/bundle-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;4BAQ4B;AAiB5B,gDAAgD;AAChD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oEAAoE;AACpE,UAAU,cAAc;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,wBAAwB,GAAG,kBAAkB,GAAG,gBAAgB,CAAC;AAE7E,qCAAqC;AACrC,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,wBAAwB,CAAC;CACnC;AAgBD;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAEzE;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAc1F;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBjF;AAuBD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,wBAAwB,CAAC,CA6CnC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErE;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB1E"}

package/esm/src/transforms/esm/bundle-manifest.js

@@ -106,7 +106,7 @@ export async function validateBundleGroup(manifestId, cacheDir) {
         logger.debug(`${LOG_PREFIX} Manifest not found in distributed cache`, {
             manifestId: manifestId.slice(0, 12),
         });
-        return { valid: false, failedHashes: [] };
+        return { valid: false, failedHashes: [], reason: "manifest_missing" };
     }
     const missingBundles = [];
     await Promise.all(manifest.bundles.map(async ({ hash }) => {
@@ -132,7 +132,7 @@ export async function validateBundleGroup(manifestId, cacheDir) {
             manifestId: manifestId.slice(0, 12),
             unrecoverable: unrecoverableHashes,
         });
-        return { valid: false, failedHashes: unrecoverableHashes };
+        return { valid: false, failedHashes: unrecoverableHashes, reason: "bundle_missing" };
     }
     logger.info(`${LOG_PREFIX} All missing bundles recovered successfully`, {
         manifestId: manifestId.slice(0, 12),

package/esm/src/transforms/esm/cached-bundle-validation.d.ts

@@ -0,0 +1,9 @@
+import { type ManifestValidationReason } from "./bundle-manifest.js";
+export interface CachedBundleValidationResult {
+    valid: boolean;
+    failedHashes: string[];
+    reason?: ManifestValidationReason;
+    source: "manifest" | "code";
+}
+export declare function validateCachedBundlesByManifestOrCode(code: string, bundleManifestId: string | undefined, cacheDir: string): Promise<CachedBundleValidationResult>;
+//# sourceMappingURL=cached-bundle-validation.d.ts.map

package/esm/src/transforms/esm/cached-bundle-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cached-bundle-validation.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/cached-bundle-validation.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,wBAAwB,EAAuB,MAAM,sBAAsB,CAAC;AAE1F,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC;CAC7B;AAED,wBAAsB,qCAAqC,CACzD,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,4BAA4B,CAAC,CAwBvC"}

package/esm/src/transforms/esm/cached-bundle-validation.js

@@ -0,0 +1,25 @@
+import { extractHttpBundlePaths } from "../../modules/react-loader/ssr-module-loader/http-bundle-helpers.js";
+import { ensureHttpBundlesExist } from "./http-cache.js";
+import { validateBundleGroup } from "./bundle-manifest.js";
+export async function validateCachedBundlesByManifestOrCode(code, bundleManifestId, cacheDir) {
+    if (bundleManifestId) {
+        const validation = await validateBundleGroup(bundleManifestId, cacheDir);
+        if (validation.valid || validation.reason === "bundle_missing") {
+            return { ...validation, source: "manifest" };
+        }
+    }
+    const bundlePaths = extractHttpBundlePaths(code);
+    if (bundlePaths.length === 0) {
+        return { valid: true, failedHashes: [], source: "code" };
+    }
+    const failedHashes = await ensureHttpBundlesExist(bundlePaths, cacheDir);
+    if (failedHashes.length === 0) {
+        return { valid: true, failedHashes: [], source: "code" };
+    }
+    return {
+        valid: false,
+        failedHashes,
+        reason: "bundle_missing",
+        source: "code",
+    };
+}

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/distributed-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"distributed-cache.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/distributed-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAC;AAYjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAWjF,qDAAqD;AACrD,KAAK,gBAAgB,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,CAAC,CAAC,CAAC;AAEhG;;;;;GAKG;AACH,UAAU,0BAA0B;IAClC,4EAA4E;IAC5E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,4DAA4D;IAC5D,gBAAgB,EAAE,gBAAgB,CAAC;CACpC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CACxC,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CA4G5C;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,gBAAgB,EAAE,gBAAgB,EAClC,iBAAiB,EAAE,MAAM,EACzB,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,MAAM,GACV,IAAI,CAqCN"}
+{"version":3,"file":"distributed-cache.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/distributed-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAC;AASjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAWjF,qDAAqD;AACrD,KAAK,gBAAgB,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,8BAA8B,CAAC,CAAC,CAAC,CAAC;AAEhG;;;;;GAKG;AACH,UAAU,0BAA0B;IAClC,4EAA4E;IAC5E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,4DAA4D;IAC5D,gBAAgB,EAAE,gBAAgB,CAAC;CACpC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CACxC,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAoG5C;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,gBAAgB,EAAE,gBAAgB,EAClC,iBAAiB,EAAE,MAAM,EACzB,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,MAAM,GACV,IAAI,CAqCN"}

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/distributed-cache.js

@@ -7,10 +7,11 @@
  * @module transforms/mdx/esm-module-loader/module-fetcher/distributed-cache
  */
 import { detokenizeAllCachePaths, tokenizeAllVeryFrontPaths } from "../../../../cache/index.js";
-import { cacheHttpImportsToLocal, ensureHttpBundlesExist } from "../../../esm/http-cache.js";
+import { cacheHttpImportsToLocal } from "../../../esm/http-cache.js";
 import { loadImportMap } from "../../../../modules/import-map/index.js";
 import { extractHttpBundlePaths } from "../../../../modules/react-loader/ssr-module-loader/http-bundle-helpers.js";
-import { createBundleManifest, storeBundleManifest, validateBundleGroup, } from "../../../esm/bundle-manifest.js";
+import { createBundleManifest, storeBundleManifest } from "../../../esm/bundle-manifest.js";
+import { validateCachedBundlesByManifestOrCode } from "../../../esm/cached-bundle-validation.js";
 import { getHttpBundleCacheDir } from "../../../../utils/cache-dir.js";
 import { FRAMEWORK_ROOT, LOG_PREFIX_MDX_LOADER } from "../constants.js";
 import { getDistributedTransformBackend } from "../../../esm/transform-cache.js";
@@ -50,33 +51,20 @@ export async function readDistributedCache(transformCacheKey, normalizedPath, pr
         });
         const bundleManifestKey = `${transformCacheKey}:bm`;
         const manifestId = await distributedCache.get(bundleManifestKey).catch(() => null);
-        if (manifestId) {
+        if (moduleCode) {
             const cacheDir = getHttpBundleCacheDir();
-            const validation = await validateBundleGroup(manifestId, cacheDir);
+            const validation = await validateCachedBundlesByManifestOrCode(moduleCode, manifestId ?? undefined, cacheDir);
             if (!validation.valid) {
-                log.warn(`${LOG_PREFIX_MDX_LOADER} Bundle manifest validation failed`, {
+                log.warn(`${LOG_PREFIX_MDX_LOADER} Cached HTTP bundle validation failed`, {
                     normalizedPath,
-                    manifestId: manifestId.slice(0, 12),
+                    manifestId: manifestId?.slice(0, 12),
                     failedHashes: validation.failedHashes,
+                    reason: validation.reason,
+                    source: validation.source,
                 });
                 moduleCode = null;
             }
         }
-        else {
-            // Use detokenized code for bundle path extraction
-            const bundlePaths = extractHttpBundlePaths(moduleCode);
-            if (bundlePaths.length > 0) {
-                const cacheDir = getHttpBundleCacheDir();
-                const failed = await ensureHttpBundlesExist(bundlePaths, cacheDir);
-                if (failed.length > 0) {
-                    log.warn(`${LOG_PREFIX_MDX_LOADER} Some HTTP bundles could not be recovered`, {
-                        normalizedPath,
-                        failed,
-                    });
-                    moduleCode = null;
-                }
-            }
-        }
         // Use detokenized code for framework path checks
         if (moduleCode && await hasIncompatibleFrameworkPaths(moduleCode, log)) {
             log.warn(`${LOG_PREFIX_MDX_LOADER} Cached code has incompatible framework paths`, {

package/esm/src/transforms/pipeline/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/pipeline/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAEhB,eAAe,EAChB,MAAM,YAAY,CAAC;AA4IpB,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,cAAc,GACtB,OAAO,CAAC,eAAe,CAAC,CAoI1B;AAoBD,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CASjB;AAmCD,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,SAAS,EACT,KAAK,EACL,KAAK,EACL,YAAY,GACb,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/pipeline/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAEhB,eAAe,EAChB,MAAM,YAAY,CAAC;AA0HpB,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,cAAc,GACtB,OAAO,CAAC,eAAe,CAAC,CAoI1B;AAoBD,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CASjB;AAmCD,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,SAAS,EACT,KAAK,EACL,KAAK,EACL,YAAY,GACb,MAAM,cAAc,CAAC"}

package/esm/src/transforms/pipeline/index.js

@@ -11,10 +11,8 @@ import { computeConfigHash } from "../../cache/config-hash.js";
 import { computeDepsHash } from "../../cache/dependency-graph.js";
 import { compilePlugin, cssStripPlugin, finalizePlugin, parsePlugin, resolveImportsPlugin, ssrHttpCachePlugin, ssrHttpStubPlugin, ssrVfModulesPlugin, } from "./stages/index.js";
 import { createFileSystem, exists } from "../../platform/compat/fs.js";
-import { ensureHttpBundlesExist } from "../esm/http-cache.js";
-import { extractHttpBundlePaths } from "../../modules/react-loader/ssr-module-loader/http-bundle-helpers.js";
 import { getHttpBundleCacheDir } from "../../utils/cache-dir.js";
-import { validateBundleGroup } from "../esm/bundle-manifest.js";
+import { validateCachedBundlesByManifestOrCode } from "../esm/cached-bundle-validation.js";
 import { extractFrameworkBundlePaths } from "../shared/framework-bundle-paths.js";
 const SSR_PIPELINE = [
     parsePlugin,
@@ -96,29 +94,15 @@ async function validateFrameworkBundles(code, cacheKey) {
  */
 async function validateCachedBundles(code, bundleManifestId, cacheKey) {
     const cacheDir = getHttpBundleCacheDir();
-    // If we have a manifest ID, use the faster manifest-based validation
-    if (bundleManifestId) {
-        const validation = await validateBundleGroup(bundleManifestId, cacheDir);
-        if (validation.valid)
-            return true;
-        logger.debug("Bundle manifest validation failed", {
-            cacheKey: cacheKey.slice(-40),
-            manifestId: bundleManifestId.slice(0, 12),
-            failedCount: validation.failedHashes.length,
-        });
-        return false;
-    }
-    // Fall back to extracting bundle paths from code and validating each
-    const bundlePaths = extractHttpBundlePaths(code);
-    if (bundlePaths.length === 0)
-        return true;
-    const failed = await ensureHttpBundlesExist(bundlePaths, cacheDir);
-    if (failed.length === 0)
+    const validation = await validateCachedBundlesByManifestOrCode(code, bundleManifestId, cacheDir);
+    if (validation.valid)
         return true;
-    logger.debug("HTTP bundle validation failed", {
+    logger.debug("Cached HTTP bundle validation failed", {
         cacheKey: cacheKey.slice(-40),
-        failedCount: failed.length,
-        totalBundles: bundlePaths.length,
+        manifestId: bundleManifestId?.slice(0, 12),
+        failedCount: validation.failedHashes.length,
+        reason: validation.reason,
+        source: validation.source,
     });
     return false;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.80",
+  "version": "0.1.82",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",

package/src/deno.js

@@ -1,6 +1,6 @@
 export default {
   "name": "veryfront",
-  "version": "0.1.80",
+  "version": "0.1.82",
   "license": "Apache-2.0",
   "nodeModulesDir": "auto",
   "exclude": [

package/src/src/mcp/server.ts

@@ -12,6 +12,11 @@ import { VERSION } from "../utils/version.js";
 import { validateContentType } from "../security/input-validation/limits.js";
 import { VeryfrontError } from "../security/input-validation/errors.js";
 import type { IntegrationRuntimeConfig } from "../integrations/types.js";
+import { logger as baseLogger } from "../utils/index.js";
+
+const logger = baseLogger.component("mcp-server");
+
+const MAX_REQUEST_BODY_SIZE = 1_048_576; // 1 MB
 
 type JSONRPCParams = Record<string, unknown> | unknown[];
 
@@ -51,6 +56,10 @@ export class MCPServer {
 
   constructor(config: MCPServerConfig) {
     this.config = config;
+
+    if (!config.auth || config.auth.type === "none") {
+      logger.warn("MCP server has no authentication configured — all requests will be accepted");
+    }
   }
 
   /**
@@ -304,13 +313,27 @@ export class MCPServer {
 
   createHTTPHandler(): (request: dntShim.Request) => Promise<dntShim.Response> {
     return async (request: dntShim.Request) => {
-      if (request.method === "OPTIONS") return this.handleCORS();
+      const requestOrigin = request.headers.get("Origin");
+      if (request.method === "OPTIONS") return this.handleCORS(requestOrigin);
 
       if (this.config.auth?.type && this.config.auth.type !== "none") {
         const authorized = await this.validateAuth(request);
         if (!authorized) return new dntShim.Response("Unauthorized", { status: 401 });
       }
 
+      // Enforce request body size limit (fast path via Content-Length header)
+      const contentLength = request.headers.get("content-length");
+      if (contentLength && Number(contentLength) > MAX_REQUEST_BODY_SIZE) {
+        return new dntShim.Response(
+          JSON.stringify({
+            jsonrpc: "2.0",
+            id: null,
+            error: { code: -32600, message: "Request body too large" },
+          }),
+          { status: 413, headers: { "Content-Type": "application/json" } },
+        );
+      }
+
       try {
         validateContentType(request, "application/json");
       } catch (error) {
@@ -327,7 +350,18 @@ export class MCPServer {
 
       let rpcRequest: JSONRPCRequest;
       try {
-        rpcRequest = await request.json();
+        const bodyText = await request.text();
+        if (bodyText.length > MAX_REQUEST_BODY_SIZE) {
+          return new dntShim.Response(
+            JSON.stringify({
+              jsonrpc: "2.0",
+              id: null,
+              error: { code: -32600, message: "Request body too large" },
+            }),
+            { status: 413, headers: { "Content-Type": "application/json" } },
+          );
+        }
+        rpcRequest = JSON.parse(bodyText) as JSONRPCRequest;
       } catch (_) {
         // expected: malformed JSON in request body
         return new dntShim.Response(
@@ -350,7 +384,7 @@ export class MCPServer {
       return new dntShim.Response(JSON.stringify(rpcResponse), {
         headers: {
           "Content-Type": "application/json",
-          ...this.getCORSHeaders(),
+          ...this.getCORSHeaders(requestOrigin),
         },
       });
     };
@@ -384,24 +418,38 @@ export class MCPServer {
     if (auth.type !== "bearer") return false;
 
     const token = authHeader.replace("Bearer ", "");
-    if (!auth.validate) return false;
+
+    // When bearer auth is configured without a validate function, reject all requests
+    if (!auth.validate) {
+      logger.warn("Bearer auth configured without validate function — rejecting request");
+      return false;
+    }
 
     return await auth.validate(token);
   }
 
-  private handleCORS(): dntShim.Response {
-    return new dntShim.Response(null, { status: 204, headers: this.getCORSHeaders() });
+  private handleCORS(requestOrigin?: string | null): dntShim.Response {
+    return new dntShim.Response(null, { status: 204, headers: this.getCORSHeaders(requestOrigin) });
   }
 
-  private getCORSHeaders(): Record<string, string> {
+  private getCORSHeaders(requestOrigin?: string | null): Record<string, string> {
     if (!this.config.cors?.enabled) return {};
 
-    const origin = this.config.cors.origins?.[0] ?? "*";
+    const origins = this.config.cors.origins;
+    if (!origins || origins.length === 0) return {};
+
+    // Match request origin against the configured origins list
+    const matchedOrigin = requestOrigin && origins.includes(requestOrigin)
+      ? requestOrigin
+      : undefined;
+
+    if (!matchedOrigin) return {};
 
     return {
-      "Access-Control-Allow-Origin": origin,
+      "Access-Control-Allow-Origin": matchedOrigin,
       "Access-Control-Allow-Methods": "POST, OPTIONS",
       "Access-Control-Allow-Headers": "Content-Type, Authorization, X-End-User-Id, X-Project-Id",
+      "Vary": "Origin",
     };
   }
 

package/src/src/proxy/handler.ts

@@ -7,7 +7,7 @@ import { cwd, getEnv } from "../platform/compat/process.js";
 import { join } from "../platform/compat/path/index.js";
 import { injectContext, ProxySpanNames, withSpan } from "./tracing.js";
 import { computeContentSourceId } from "../cache/keys.js";
-import { jwtVerify } from "jose";
+import { createRemoteJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
 
 export const INTERNAL_PROXY_HEADERS = [
   "x-token",
@@ -37,6 +37,29 @@ interface DomainLookupResult {
   }>;
 }
 
+const remoteJwksByUrl = new Map<string, ReturnType<typeof createRemoteJWKSet>>();
+
+function getApiJwks(apiBaseUrl: string, logger?: ProxyLogger) {
+  try {
+    const normalizedBaseUrl = apiBaseUrl.endsWith("/") ? apiBaseUrl : `${apiBaseUrl}/`;
+    const jwksUrl = new URL(".well-known/jwks.json", normalizedBaseUrl);
+    const cacheKey = jwksUrl.toString();
+    let jwks = remoteJwksByUrl.get(cacheKey);
+
+    if (!jwks) {
+      jwks = createRemoteJWKSet(jwksUrl);
+      remoteJwksByUrl.set(cacheKey, jwks);
+    }
+
+    return jwks;
+  } catch (error) {
+    logger?.error("Invalid API base URL for JWKS lookup", error as Error, {
+      apiBaseUrl,
+    });
+    return undefined;
+  }
+}
+
 async function lookupProjectByDomain(
   domain: string,
   apiBaseUrl: string,
@@ -154,8 +177,42 @@ function extractUserToken(cookieHeader: string): string | undefined {
 
 async function extractUserIdFromToken(
   token: string,
+  apiBaseUrl: string,
   log?: ProxyLogger,
 ): Promise<string | undefined> {
+  let algorithm: string | undefined;
+
+  try {
+    algorithm = decodeProtectedHeader(token).alg;
+  } catch (error) {
+    log?.debug("Failed to decode JWT header", {
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return undefined;
+  }
+
+  if (algorithm === "RS256") {
+    const jwks = getApiJwks(apiBaseUrl, log);
+    if (!jwks) return undefined;
+
+    try {
+      const { payload } = await jwtVerify(token, jwks, {
+        algorithms: ["RS256"],
+      });
+      return (payload as { userId?: string }).userId;
+    } catch (error) {
+      log?.debug("RS256 JWT verification failed", {
+        error: error instanceof Error ? error.message : String(error),
+      });
+      return undefined;
+    }
+  }
+
+  if (algorithm !== "HS256") {
+    log?.debug("Unsupported JWT algorithm", { algorithm: algorithm ?? null });
+    return undefined;
+  }
+
   const jwtSecret = getEnv("JWT_SECRET");
 
   if (!jwtSecret) {
@@ -304,7 +361,11 @@ export function createProxyHandler(options: ProxyHandlerOptions) {
       return { status: 302, message: "Authentication required", redirectUrl };
     }
 
-    const userId = await extractUserIdFromToken(userToken, logger);
+    const userId = await extractUserIdFromToken(
+      userToken,
+      config.apiBaseUrl,
+      logger,
+    );
     if (!userId) {
       const redirectUrl = makeAuthRedirectUrl(req);
       logger?.info("Could not extract userId from token", {

package/src/src/rendering/orchestrator/module-loader/index.ts

@@ -21,8 +21,7 @@ import {
   setCachedTransformAsync,
 } from "../../../transforms/esm/transform-cache.js";
 import { TRANSFORM_DISTRIBUTED_TTL_SEC } from "../../../utils/constants/cache.js";
-import { ensureHttpBundlesExist } from "../../../transforms/esm/http-cache.js";
-import { validateBundleGroup } from "../../../transforms/esm/bundle-manifest.js";
+import { validateCachedBundlesByManifestOrCode } from "../../../transforms/esm/cached-bundle-validation.js";
 import { getHttpBundleCacheDir, getMdxEsmCacheDir } from "../../../utils/cache-dir.js";
 import { dirname, join, normalize } from "../../../platform/compat/path/index.js";
 import { hashCodeHex } from "../../../utils/hash-utils.js";
@@ -32,7 +31,6 @@ import {
   lookupMdxEsmCache,
   saveModulePathCache,
 } from "../../../transforms/mdx/esm-module-loader/cache/index.js";
-import { extractHttpBundlePaths } from "../../../modules/react-loader/ssr-module-loader/http-bundle-helpers.js";
 
 const logger = rendererLogger.component("module-loader");
 
@@ -344,28 +342,22 @@ export async function transformModuleWithDeps(
   const cacheDir = getHttpBundleCacheDir();
   let bundlesValid = true;
 
-  if (transformResult.cacheHit && transformResult.bundleManifestId) {
-    const validation = await validateBundleGroup(transformResult.bundleManifestId, cacheDir);
+  if (transformResult.cacheHit) {
+    const validation = await validateCachedBundlesByManifestOrCode(
+      transformedCode,
+      transformResult.bundleManifestId,
+      cacheDir,
+    );
     if (!validation.valid) {
-      logger.warn("Bundle manifest validation failed, re-transforming", {
+      logger.warn("Cached HTTP bundle validation failed, re-transforming", {
         filePath,
-        manifestId: transformResult.bundleManifestId.slice(0, 12),
+        manifestId: transformResult.bundleManifestId?.slice(0, 12),
         failedHashes: validation.failedHashes,
+        reason: validation.reason,
+        source: validation.source,
       });
       bundlesValid = false;
     }
-  } else {
-    const bundlePaths = extractHttpBundlePaths(transformedCode);
-    if (bundlePaths.length > 0) {
-      const failed = await ensureHttpBundlesExist(bundlePaths, cacheDir);
-      if (failed.length > 0) {
-        logger.warn("HTTP bundle recovery failed, re-transforming", {
-          filePath,
-          failed,
-        });
-        bundlesValid = false;
-      }
-    }
   }
 
   if (!bundlesValid) {

package/src/src/transforms/esm/bundle-manifest.ts

@@ -38,10 +38,13 @@ interface BundleManifest {
   ttlSeconds: number;
 }
 
+export type ManifestValidationReason = "manifest_missing" | "bundle_missing";
+
 /** Result of manifest validation. */
-interface ManifestValidationResult {
+export interface ManifestValidationResult {
   valid: boolean;
   failedHashes: string[];
+  reason?: ManifestValidationReason;
 }
 
 /**
@@ -148,7 +151,7 @@ export async function validateBundleGroup(
     logger.debug(`${LOG_PREFIX} Manifest not found in distributed cache`, {
       manifestId: manifestId.slice(0, 12),
     });
-    return { valid: false, failedHashes: [] };
+    return { valid: false, failedHashes: [], reason: "manifest_missing" };
   }
 
   const missingBundles: Array<{ path: string; hash: string }> = [];
@@ -178,7 +181,7 @@ export async function validateBundleGroup(
       manifestId: manifestId.slice(0, 12),
       unrecoverable: unrecoverableHashes,
     });
-    return { valid: false, failedHashes: unrecoverableHashes };
+    return { valid: false, failedHashes: unrecoverableHashes, reason: "bundle_missing" };
   }
 
   logger.info(`${LOG_PREFIX} All missing bundles recovered successfully`, {

package/src/src/transforms/esm/cached-bundle-validation.ts

@@ -0,0 +1,40 @@
+import { extractHttpBundlePaths } from "../../modules/react-loader/ssr-module-loader/http-bundle-helpers.js";
+import { ensureHttpBundlesExist } from "./http-cache.js";
+import { type ManifestValidationReason, validateBundleGroup } from "./bundle-manifest.js";
+
+export interface CachedBundleValidationResult {
+  valid: boolean;
+  failedHashes: string[];
+  reason?: ManifestValidationReason;
+  source: "manifest" | "code";
+}
+
+export async function validateCachedBundlesByManifestOrCode(
+  code: string,
+  bundleManifestId: string | undefined,
+  cacheDir: string,
+): Promise<CachedBundleValidationResult> {
+  if (bundleManifestId) {
+    const validation = await validateBundleGroup(bundleManifestId, cacheDir);
+    if (validation.valid || validation.reason === "bundle_missing") {
+      return { ...validation, source: "manifest" };
+    }
+  }
+
+  const bundlePaths = extractHttpBundlePaths(code);
+  if (bundlePaths.length === 0) {
+    return { valid: true, failedHashes: [], source: "code" };
+  }
+
+  const failedHashes = await ensureHttpBundlesExist(bundlePaths, cacheDir);
+  if (failedHashes.length === 0) {
+    return { valid: true, failedHashes: [], source: "code" };
+  }
+
+  return {
+    valid: false,
+    failedHashes,
+    reason: "bundle_missing",
+    source: "code",
+  };
+}

package/src/src/transforms/mdx/esm-module-loader/module-fetcher/distributed-cache.ts

@@ -9,14 +9,11 @@
 
 import type { Logger } from "../../../../utils/logger/logger.js";
 import { detokenizeAllCachePaths, tokenizeAllVeryFrontPaths } from "../../../../cache/index.js";
-import { cacheHttpImportsToLocal, ensureHttpBundlesExist } from "../../../esm/http-cache.js";
+import { cacheHttpImportsToLocal } from "../../../esm/http-cache.js";
 import { loadImportMap } from "../../../../modules/import-map/index.js";
 import { extractHttpBundlePaths } from "../../../../modules/react-loader/ssr-module-loader/http-bundle-helpers.js";
-import {
-  createBundleManifest,
-  storeBundleManifest,
-  validateBundleGroup,
-} from "../../../esm/bundle-manifest.js";
+import { createBundleManifest, storeBundleManifest } from "../../../esm/bundle-manifest.js";
+import { validateCachedBundlesByManifestOrCode } from "../../../esm/cached-bundle-validation.js";
 import { getHttpBundleCacheDir } from "../../../../utils/cache-dir.js";
 import { FRAMEWORK_ROOT, LOG_PREFIX_MDX_LOADER } from "../constants.js";
 import { getDistributedTransformBackend } from "../../../esm/transform-cache.js";
@@ -86,31 +83,23 @@ export async function readDistributedCache(
     const bundleManifestKey = `${transformCacheKey}:bm`;
     const manifestId = await distributedCache.get(bundleManifestKey).catch(() => null);
 
-    if (manifestId) {
+    if (moduleCode) {
       const cacheDir = getHttpBundleCacheDir();
-      const validation = await validateBundleGroup(manifestId, cacheDir);
+      const validation = await validateCachedBundlesByManifestOrCode(
+        moduleCode,
+        manifestId ?? undefined,
+        cacheDir,
+      );
       if (!validation.valid) {
-        log.warn(`${LOG_PREFIX_MDX_LOADER} Bundle manifest validation failed`, {
+        log.warn(`${LOG_PREFIX_MDX_LOADER} Cached HTTP bundle validation failed`, {
           normalizedPath,
-          manifestId: manifestId.slice(0, 12),
+          manifestId: manifestId?.slice(0, 12),
           failedHashes: validation.failedHashes,
+          reason: validation.reason,
+          source: validation.source,
         });
         moduleCode = null;
       }
-    } else {
-      // Use detokenized code for bundle path extraction
-      const bundlePaths = extractHttpBundlePaths(moduleCode);
-      if (bundlePaths.length > 0) {
-        const cacheDir = getHttpBundleCacheDir();
-        const failed = await ensureHttpBundlesExist(bundlePaths, cacheDir);
-        if (failed.length > 0) {
-          log.warn(`${LOG_PREFIX_MDX_LOADER} Some HTTP bundles could not be recovered`, {
-            normalizedPath,
-            failed,
-          });
-          moduleCode = null;
-        }
-      }
     }
 
     // Use detokenized code for framework path checks

package/src/src/transforms/pipeline/index.ts

@@ -31,10 +31,8 @@ import {
   ssrVfModulesPlugin,
 } from "./stages/index.js";
 import { createFileSystem, exists } from "../../platform/compat/fs.js";
-import { ensureHttpBundlesExist } from "../esm/http-cache.js";
-import { extractHttpBundlePaths } from "../../modules/react-loader/ssr-module-loader/http-bundle-helpers.js";
 import { getHttpBundleCacheDir } from "../../utils/cache-dir.js";
-import { validateBundleGroup } from "../esm/bundle-manifest.js";
+import { validateCachedBundlesByManifestOrCode } from "../esm/cached-bundle-validation.js";
 import { extractFrameworkBundlePaths } from "../shared/framework-bundle-paths.js";
 
 const SSR_PIPELINE: TransformPlugin[] = [
@@ -130,31 +128,15 @@ async function validateCachedBundles(
   cacheKey: string,
 ): Promise<boolean> {
   const cacheDir = getHttpBundleCacheDir();
+  const validation = await validateCachedBundlesByManifestOrCode(code, bundleManifestId, cacheDir);
+  if (validation.valid) return true;
 
-  // If we have a manifest ID, use the faster manifest-based validation
-  if (bundleManifestId) {
-    const validation = await validateBundleGroup(bundleManifestId, cacheDir);
-    if (validation.valid) return true;
-
-    logger.debug("Bundle manifest validation failed", {
-      cacheKey: cacheKey.slice(-40),
-      manifestId: bundleManifestId.slice(0, 12),
-      failedCount: validation.failedHashes.length,
-    });
-    return false;
-  }
-
-  // Fall back to extracting bundle paths from code and validating each
-  const bundlePaths = extractHttpBundlePaths(code);
-  if (bundlePaths.length === 0) return true;
-
-  const failed = await ensureHttpBundlesExist(bundlePaths, cacheDir);
-  if (failed.length === 0) return true;
-
-  logger.debug("HTTP bundle validation failed", {
+  logger.debug("Cached HTTP bundle validation failed", {
     cacheKey: cacheKey.slice(-40),
-    failedCount: failed.length,
-    totalBundles: bundlePaths.length,
+    manifestId: bundleManifestId?.slice(0, 12),
+    failedCount: validation.failedHashes.length,
+    reason: validation.reason,
+    source: validation.source,
   });
   return false;
 }